IEC TS 62351-8:2011

IEC/TS 62351-8 ®
Edition 1.0 2011-09
TECHNICAL
SPECIFICATION
colour
inside
Power systems management and associated information exchange – Data and
communications security –
Part 8: Role-based access control

IEC/TS 62351-8:2011(E)
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by

any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either IEC or

IEC's member National Committee in the country of the requester.
If you have any questions about IEC copyright or have an enquiry about obtaining additional rights to this publication,
please contact the address below or your local IEC member National Committee for further information.

Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite
ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie
et les microfilms, sans l'accord écrit de la CEI ou du Comité national de la CEI du pays du demandeur.

Si vous avez des questions sur le copyright de la CEI ou si vous désirez obtenir des droits supplémentaires sur cette

publication, utilisez les coordonnées ci-après ou contactez le Comité national de la CEI de votre pays de résidence.

IEC Central Office
3, rue de Varembé
CH-1211 Geneva 20
Switzerland
Email: inmail@iec.ch
Web: www.iec.ch
About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.
 Catalogue of IEC publications: www.iec.ch/searchpub
The IEC on-line Catalogue enables you to search by a variety of criteria (reference number, text, technical committee,…).
It also gives information on projects, withdrawn and replaced publications.
 IEC Just Published: www.iec.ch/online_news/justpub
Stay up to date on all new IEC publications. Just Published details twice a month all new publications released. Available
on-line and also by email.
 Electropedia: www.electropedia.org
The world's leading online dictionary of electronic and electrical terms containing more than 20 000 terms and definitions
in English and French, with equivalent terms in additional languages. Also known as the International Electrotechnical
Vocabulary online.
 Customer Service Centre: www.iec.ch/webstore/custserv
If you wish to give us your feedback on this publication or need further assistance, please visit the Customer Service
Centre FAQ or contact us:
Email: csc@iec.ch
Tel.: +41 22 919 02 11
Fax: +41 22 919 03 00
IEC/TS 62351-8 ®
Edition 1.0 2011-09
TECHNICAL
SPECIFICATION
colour
inside
Power systems management and associated information exchange – Data and
communications security –
Part 8: Role-based access control

INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
PRICE CODE
X
ICS 33.200 ISBN 978-2-88912-723-8

– 2 – TS 62351-8 © IEC:2011(E)

CONTENTS
FOREWORD . 5

INTRODUCTION . 7

1 Scope . 8

2 Normative references. 9

3 Terms, definitions and abbreviations . 10

3.1 Terms and definitions . 10

3.2 Abbreviations . 12

4 RBAC process model . 13
4.1 General . 13
4.2 Separation of subjects, roles, and rights. 14
4.2.1 General . 14
4.2.2 Subject assignment. 15
4.2.3 Role assignment . 16
4.2.4 Right assignment . 16
4.3 Criteria for defining roles . 16
4.3.1 Policies . 16
4.3.2 User, roles, and rights . 16
4.3.3 Introducing roles reduces complexity . 16
5 Definition of roles . 17
5.1 Role-to-right assignment inside the object in general . 17
5.1.1 General . 17
5.1.2 Number of supported rights . 17
5.1.3 Number of supported roles . 17
5.1.4 Flexibility of role-to-right mapping . 17
5.2 Role-to-right assignment with respect to power systems . 17
5.2.1 Mandatory roles and rights for logical-device access control . 17
5.2.2 Power utility automation – IEC 61850 . 20
5.2.3 CIM – IEC 61968 . 22
5.2.4 AMI. 22
5.2.5 DER . 22
5.2.6 Markets . 23
5.3 Role-to-right assignment with respect to other non-power system domains
(e.g. industrial process control) . 23
6 General architecture for the PUSH model . 23
6.1 General . 23
6.2 Secure access to the LDAP-enabled service . 24
7 General architecture for the PULL model . 24
7.1 General . 24
7.2 Secure access to the LDAP-enabled service . 26
7.3 LDAP directory organization . 26
8 General application of RBAC access token . 26
8.1 General . 26
8.2 Session based approach . 27
8.3 Message based approach . 28
9 Definition of access tokens . 28
9.1 General . 28

TS 62351-8 © IEC:2011(E) – 3 –

9.2 Supported profiles . 29

9.3 Identification of access token . 29

9.4 General structure of the access tokens . 29

9.4.1 Mandatory fields in the access tokens . 29

9.4.2 Mandatory profile-specific fields . 29

9.4.3 Optional fields in the access tokens . 30

9.4.4 Definition of specific fields . 30

9.5 Specific structure of the access tokens . 32

9.5.1 Profile A: X.509 ID certificate . 32

9.5.2 Profile B: X.509 attribute certificate . 34

9.5.3 Profile C: Software token . 37
9.6 Distribution of the access tokens . 37
10 Transport profiles . 38
10.1 Usage in TCP-based protocols . 38
10.2 Usage in non-Ethernet based protocols . 38
11 Verification of access tokens. 38
11.1 Normative part . 38
11.1.1 General . 38
11.1.2 Access token authenticity . 38
11.1.3 Time period . 39
11.1.4 Access token integrity . 39
11.2 Optional part . 39
11.3 Revocation methods . 39
11.3.1 General . 39
11.3.2 Supported methods . 40
12 Interoperability . 40
12.1 General . 40
12.2 Supported access tokens . 40
12.3 How to ensure backward compatibility . 40
12.4 How to extend the list of roles and rights . 41
12.5 How to map this specification to specific authorization mechanisms . 41
Bibliography . 42

Figure 1 – Generic framework for access control . 13

Figure 2 – Diagram of RBAC with static and dynamic separation of duty according to
(ANSI INCITS 359-2004) . 14
Figure 3 – User, roles, rights and operations . 15
Figure 4 – Schematic view of authorization mechanism based on RBAC . 24
Figure 5 – Schematic view of authorization mechanism based on RBAC PULL model . 25
Figure 6 – Session based RBAC approach . 28

Table 1 – List of pre-defined role-to-right assignment . 18
Table 2 – List of mandatory pre-defined rights . 19
Table 3 – Pre-defined roles . 20
Table 4 – Mandatory role-to-right mapping for service access control . 21
Table 5 – The ALLOW right . 21
Table 6 – The DENY right. 21

– 4 – TS 62351-8 © IEC:2011(E)

Table 7 – VIEW right and associated ACSI services . 22

Table 8 – Mapping between ID and attribute certificate . 36

TS 62351-8 © IEC:2011(E) – 5 –

INTERNATIONAL ELECTROTECHNICAL COMMISSION

____________
POWER SYSTEMS MANAGEMENT
AND ASSOCIATED INFORMATION EXCHANGE
...