EN IEC 62351-8:2020
(Main)Power systems management and associated information exchange - Data and communications security - Part 8: Role-based access control for power system management
Power systems management and associated information exchange - Data and communications security - Part 8: Role-based access control for power system management
IEC 62351-8: 2020 is to facilitate role-based access control (RBAC) for power system management. RBAC assigns human users, automated systems, and software applications (collectively called "subjects" in this document) to specified "roles", and restricts their access to only those resources, which the security policies identify as necessary for their roles. As electric power systems become more automated and cyber security concerns become more prominent, it is becoming increasingly critical to ensure that access to data (read, write, control, etc.) is restricted. As in many aspects of security, RBAC is not just a technology; it is a way of running a business. RBAC is not a new concept; in fact, it is used by many operating systems to control access to system resources. Specifically, RBAC provides an alternative to the all-or-nothing super-user model in which all subjects have access to all data, including control commands. RBAC is a primary method to meet the security principle of least privilege, which states that no subject should be authorized more permissions than necessary for performing that subject’s task. With RBAC, authorization is separated from authentication. RBAC enables an organization to subdivide super-user capabilities and package them into special user accounts termed roles for assignment to specific individuals according to their associated duties. This subdivision enables security policies to determine who or what systems are permitted access to which data in other systems. RBAC provides thus a means of reallocating system controls as defined by the organization policy. In particular, RBAC can protect sensitive system operations from inadvertent (or deliberate) actions by unauthorized users. Clearly RBAC is not confined to human users though; it applies equally well to automated systems and software applications, i.e., software parts operating independent of user interactions. The following interactions are in scope: – local (direct wired) access to the object by a human user; by a local and automated computer agent, or built-in HMI or panel; – remote (via dial-up or wireless media) access to the object by a human user; – remote (via dial-up or wireless media) access to the object by a remote automated computer agent, e.g. another object at another substation, a distributed energy resource at an end-user’s facility, or a control centre application. While this document defines a set of mandatory roles to be supported, the exchange format for defined specific or custom roles is also in scope of this document. Out of scope for this document are all topics which are not directly related to the definition of roles and access tokens for local and remote access, especially administrative or organizational tasks.
Energiemanagementsysteme und zugehöriger Datenaustausch – IT-Sicherheit für Daten und Kommunikation – Teil 8: Rollenbasierte Zugriffskontrolle für Energiemanagementsysteme
Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des communications et des données - Partie 8: Contrôle d'accès basé sur les rôles pour la gestion de systèmes de puissance
IEC 62351-8:2020 a pour objet de faciliter le contrôle d'accès basé sur les rôles (RBAC) pour la gestion de systèmes de puissance. Le RBAC attribue des utilisateurs humains, des systèmes automatisés et des applications logicielles (appelés "sujets" dans le présent document) aux "rôles" spécifiés et limite leur accès à ces ressources uniquement, que les politiques de sécurité identifient comme nécessaires à leurs rôles. Les systèmes électriques de puissance étant de plus en plus automatisés et les préoccupations relatives à la cybersécurité étant de plus en plus importantes, il est de plus en plus critique d’assurer la restriction de l’accès aux données (lecture, écriture, contrôle, etc.). Comme pour beaucoup d’aspects liés à la sécurité, le RBAC n’est pas uniquement une technologie; il s’agit d’une manière de diriger une entreprise. Le RBAC n’est pas un concept nouveau; en réalité, il est utilisé par de nombreux systèmes d’exploitation pour contrôler l’accès aux ressources de systèmes. Le RBAC fournit notamment une alternative au modèle tout ou rien de super utilisateur dans lequel tous les sujets ont accès à toutes les données, y compris aux commandes de contrôle. Le RBAC est une méthode primaire pour satisfaire au principe de sécurité du droit d’accès minimal, qui indique qu’il convient qu’aucun sujet ne se voit attribué plus de permissions que nécessaire pour effectuer la tâche affectée audit sujet. Avec le RBAC, l’autorisation est distincte de l’authentification. Le RBAC donne lieu à une organisation permettant de sous-diviser les capacités des super utilisateurs et de les empaqueter dans des rôles de comptes utilisateurs spéciaux destinés à être attribués à des individus spécifiques selon les responsabilités qui leur sont associées. Cette sous-division permet aux politiques de sécurité de déterminer les personnes ou les systèmes qui ont accès aux données dans d’autres systèmes. Le RBAC fournit ainsi un moyen de réattribuer des contrôles de systèmes comme cela est défini par la politique organisationnelle. Le RBAC peut notamment protéger des opérations sensibles de systèmes contre des actions commises par inadvertance (ou délibérées) par des utilisateurs non autorisés. Cependant, le RBAC ne se limite clairement pas aux utilisateurs humains; il s’applique tout aussi bien aux systèmes automatisés qu’aux applications logicielles, c’est-à-dire, aux parties logicielles qui fonctionnent indépendamment des interactions avec l’utilisateur. Les interactions suivantes relèvent du domaine d’application: – accès local (raccordé directement) à l’objet par un utilisateur humain; par un agent ordinateur automatisé local, ou par un IHM ou du panneau intégré(e) aux objets; – accès à distance (par ligne commutée ou support sans fil) à l’objet par un utilisateur humain; – accès à distance (par ligne commutée ou support sans fil) à l’objet par un agent ordinateur automatisé distant, par exemple, un autre objet dans un autre poste, une ressource d’énergie distribuée dans l’installation d’un utilisateur final, ou une application centrale de contrôle. Tandis que le présent document définit un ensemble de rôles obligatoires à prendre en charge, le format d’échange de rôles définis spécifiques ou personnalisés relève également du domaine d’application du présent document. Tous les thèmes non directement liés à la définition des rôles et des jetons d’accès concernant les accès locaux et distants, en particulier les tâches administratives ou organisationnelles, ne relèvent pas du domaine d’application du présent document.
Upravljanje elektroenergetskega sistema in pripadajoča izmenjava informacij - Varnost podatkov in komunikacij - 8. del: Kontrola dostopa do elektroenergetskega sistema na podlagi vlog
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
01-september-2020
Upravljanje elektroenergetskega sistema in pripadajoča izmenjava informacij -
Varnost podatkov in komunikacij - 8. del: Kontrola dostopa do
elektroenergetskega sistema na podlagi vlog
Power systems management and associated information exchange - Data and
communications security - Part 8: Role-based access control for power system
management
Ta slovenski standard je istoveten z: EN IEC 62351-8:2020
ICS:
29.240.30 Krmilna oprema za Control equipment for electric
elektroenergetske sisteme power systems
35.240.50 Uporabniške rešitve IT v IT applications in industry
industriji
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN IEC 62351-8
NORME EUROPÉENNE
EUROPÄISCHE NORM
June 2020
ICS 33.200
English Version
Power systems management and associated information
exchange - Data and communications security - Part 8: Role-
based access control for power system management
(IEC 62351-8:2020)
Gestion des systèmes de puissance et échanges Energiemanagementsysteme und zugehöriger
d'informations associés - Sécurité des communications et Datenaustausch - IT-Sicherheit für Daten und
des données - Partie 8: Contrôle d'accès basé sur les rôles Kommunikation - Teil 8: Rollenbasierte Zugriffskontrolle für
pour la gestion de systèmes de puissance Energiemanagementsysteme
(IEC 62351-8:2020) (IEC 62351-8:2020)
This European Standard was approved by CENELEC on 2020-06-02. CENELEC members are bound to comply with the CEN/CENELEC
Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC
Management Centre or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the
same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the
Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2020 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
Ref. No. EN IEC 62351-8:2020 E
European foreword
The text of document 57/2180/FDIS, future edition 1 of IEC 62351-8, prepared by IEC/TC 57 "Power
systems management and associated information exchange" was submitted to the IEC-CENELEC
parallel vote and approved by CENELEC as EN IEC 62351-8:2020.
The following dates are fixed:
• latest date by which the document has to be implemented at national (dop) 2021-03-02
level by publication of an identical national standard or by endorsement
• latest date by which the national standards conflicting with the (dow) 2023-06-02
document have to be withdrawn
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CENELEC shall not be held responsible for identifying any or all such patent rights.
Endorsement notice
The text of the International Standard IEC 62351-8:2020 was approved by CENELEC as a European
Standard without any modification.
In the official version, for Bibliography, the following notes have to be added for the standards
indicated:
IEC 60870-5-104 NOTE Harmonized as EN 60870-5-104
IEC 61784 (series) NOTE Harmonized as EN IEC 61784 (series)
IEC 61850-8-1 NOTE Harmonized as EN 61850-8-1
IEC 61850-8-2 NOTE Harmonized as EN IEC 61850-8-2
IEC 61968 (series) NOTE Harmonized as EN 61968 (series)
IEC 61970 (series) NOTE Harmonized as EN 61970 (series)
IEC 62351-7:2017 NOTE Harmonized as EN 62351-7:2017 (not modified)
IEC 62351-9 NOTE Harmonized as EN 62351-9
IEC 62351-14 NOTE Harmonized as EN IEC 62351-14
IEC 62443 (series) NOTE Harmonized as EN IEC 62443 (series)
To be published. Stage at the time of publication: prEN IEC 62351-14:2019.
Annex ZA
(normative)
Normative references to international publications
with their corresponding European publications
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments)
applies.
NOTE 1 Where an International Publication has been modified by common modifications, indicated by (mod), the relevant
EN/HD applies.
NOTE 2 Up-to-date information on the latest versions of the European Standards listed in this annex is available here:
www.cenelec.eu.
Publication Year Title EN/HD Year
IEC 61850-7-2 - Communication networks and systems for EN 61850-7-2 -
power utility automation - Part 7-2: Basic
information and communication structure -
Abstract communication service interface
(ACSI)
IEC/TS 62351-2 - Power systems management and - -
associated information exchange - Data and
communications security - Part 2: Glossary
of terms
IEC 62351-3 2014 Power systems management and EN 62351-3 2014
associated information exchange - Data and
communications security - Part 3:
Communication network and system
security - Profiles including TCP/IP
+ A2 2020 + A2 2020
IEC 62351-4 - Power systems management and EN IEC 62351-4 -
associated information exchange - Data and
communications security - Part 4: Profiles
including MMS and derivatives
IEC/TS 62351-8 2011 Power systems management and - -
associated information exchange - Data and
communications security - Part 8: Role-
based access control
RFC 2865 - Remote Authentication Dial In User Service - -
(RADIUS)
RFC 5246 - The Transport Layer Security (TLS) - -
Protocol Version 1.2
RFC 5288 - AES Galois Counter Mode (GCM) Cipher - -
Suites for TLS)
RFC 5289 - TLS Elliptic Curve Cipher Suites with SHA- - -
256/384 and AES Galois Counter Mode
(GCM)
RFC 5755 - An Internet Attribute Certificate Profile for - -
Authorization
RFC 5878 - Transport Layer Security (TLS) - -
Authorization Extensions
RFC 6749 - The OAuth 2.0 Authorization Framework - -
RFC 7519 - JSON Web Token (JWT) - -
XACML-RBAC 2014 XACML v3.0 Core and Hierarchical Role - -
Based Access Control (RBAC) Profile
Version 1.0, October 2014.
IEC 62351-8 ®
Edition 1.0 2020-04
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
colour
inside
Power systems management and associated information exchange – Data and
communications security –
Part 8: Role-based access control for power system management
Gestion des systèmes de puissance et échanges d'informations associés –
Sécurité des communications et des données –
Partie 8: Contrôle d'accès basé sur les rôles pour la gestion de systèmes de
puissance
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
INTERNATIONALE
ICS 33.200 ISBN 978-2-8322-8072-0
– 2 – IEC 62351-8:2020 IEC 2020
CONTENTS
FOREWORD . 6
INTRODUCTION . 8
1 Scope . 9
2 Normative references . 10
3 Terms and definitions . 11
4 Abbreviated terms . 13
5 RBAC process model . 14
5.1 Overview of RBAC process model . 14
5.2 Generic RBAC concepts . 15
5.3 Separation of subjects, roles, and permissions . 16
5.3.1 RBAC model . 16
5.3.2 Subject assignment (subject-to-role mapping). 18
5.3.3 Role assignment (role-to-permission mapping) . 18
5.3.4 Permission assignment (mapping of actions to objects) . 19
5.4 Criteria for defining roles. 19
5.4.1 Policies . 19
5.4.2 Subjects, roles, and permissions . 19
5.4.3 Introducing roles reduces complexity . 19
6 Definition of roles . 20
6.1 Role-to-permission assignment inside the entity in general . 20
6.1.1 General . 20
6.1.2 Number of supported permissions by a role . 20
6.1.3 Number of supported roles . 20
6.1.4 Flexibility of role-to-permission mapping . 20
6.2 Role-to-permission assignment with respect to power systems . 20
6.2.1 Mandatory roles and permissions for IED access control . 20
6.2.2 Power utility automation using IEC 61850 . 23
6.3 Role to permission assignment for specific roles . 25
6.3.1 General . 25
6.3.2 Encoding specific roles . 25
6.3.3 Evaluation context . 29
6.4 Role-to-permission assignment with respect to other non-power system
domains (e.g. industrial process control) . 30
7 RBAC credential distribution using the PUSH model . 30
7.1 General . 30
7.2 Secure access to an LDAP-enabled repository . 31
7.3 Secure access to an identity provider for retrieval of a JWT . 31
8 RBAC credential distribution using the PULL model . 32
8.1 General . 32
8.2 Secure access to an LDAP-enabled repository . 33
8.2.1 General . 33
8.2.2 PULL model with LDAP . 33
8.2.3 LDAP Directory organization . 34
8.3 Secure access to the RADIUS-enabled repository . 35
8.3.1 General . 35
8.3.2 PULL model with RADIUS . 35
IEC 62351-8:2020 IEC 2020 – 3 –
8.3.3 RADIUS security applying transparent TLS protection . 36
8.4 Secure access to the JWT provider . 39
9 General application of RBAC access token (informative) . 39
9.1 General . 39
9.2 Session-based approach . 40
9.3 Message-based approach .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.