UNE-EN IEC 62351-3:2023

This part of IEC 62351 specifies how to provide confidentiality, integrity protection, and

message level authentication for protocols that make use of TCP/IP as a message transport

layer and utilize Transport Layer Security when cyber-security is required. This may relate to

SCADA and telecontrol protocols, but also to additional protocols if they meet the requirements in this standard.

IEC 62351-3 specifies how to secure TCP/IP-based protocols through constraints on the

specification of the messages, procedures, and algorithms of Transport Layer Security (TLS)

(TLSv1.2 defined in RFC 5246, TLSv1.3 defined in RFC 8446). In the specific sections, there

will be subclauses to note the differences and commonalities in the application depending on

the target TLS version. The use and specification of intervening external security devices

(e.g., bump-in-the-wire ) are considered out-of-scope.

In contrast to former versions of this standard, this edition is self-contained in terms of

completely defining a profile of TLS. Hence, it can be applied directly, without the need to

specify further TLS parameters. Therefore, this part can be directly utilized from a referencing

standard and may be combined with further security measures on other layers. Providing the

profiling of TLS without the need for further specifying TLS parameters allows to declare

conformity to the described functionality without the need to involve further IEC 62351 documents.

This part is intended to be referenced as a normative part of other IEC standards that have

the need for providing security for their TCP/IP-based protocol exchanges under similar

boundary conditions. However, it is up to the individual protocol security initiatives to decide if

this standard is to be referenced.

The document also defines security events for specific conditions, which support the error

handling, security audit trails, intrusion detection and conformance testing. The actions of the

organisation in response to events to an error condition described in this document are

beyond the scope of this document and are expected to be defined by the organizations security policy.

This part of IEC 62351 reflects the security requirements of the IEC power systems

management protocols. Should other standards bring forward new requirements, this standard

may need to be revised.