oSIST prEN IEC 62351-8:2025

SLOVENSKI STANDARD
01-maj-2025
Upravljanje elektroenergetskega sistema in pripadajoča izmenjava informacij -
Varnost podatkov in komunikacij - 8. del: Kontrola dostopa do
elektroenergetskega sistema na podlagi vlog
Power systems management and associated information exchange - Data and
communications security - Part 8: Role-based access control for power system
management
Energiemanagementsysteme und zugehöriger Datenaustausch – IT-Sicherheit für Daten
und Kommunikation – Teil 8: Rollenbasierte Zugriffskontrolle für
Energiemanagementsysteme
Gestion des systèmes de puissance et échanges d'informations associés - Sécurité des
communications et des données - Partie 8: Contrôle d'accès basé sur les rôles pour la
gestion de systèmes de puissance
Ta slovenski standard je istoveten z: prEN IEC 62351-8:2025
ICS:
29.240.30 Krmilna oprema za Control equipment for electric
elektroenergetske sisteme power systems
35.240.50 Uporabniške rešitve IT v IT applications in industry
industriji
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

57/2752/CDV
COMMITTEE DRAFT FOR VOTE (CDV)
PROJECT NUMBER:
IEC 62351-8 ED2
DATE OF CIRCULATION: CLOSING DATE FOR VOTING:
2025-03-07 2025-05-30
SUPERSEDES DOCUMENTS:
57/2663/CD, 57/2690A/CC
IEC TC 57 : POWER SYSTEMS MANAGEMENT AND ASSOCIATED INFORMATION EXCHANGE
SECRETARIAT: SECRETARY:
Germany Mr Heiko Englert
OF INTEREST TO THE FOLLOWING COMMITTEES: HORIZONTAL FUNCTION(S):
TC 65, TC 69, TC 88
ASPECTS CONCERNED:
SUBMITTED FOR CENELEC PARALLEL VOTING NOT SUBMITTED FOR CENELEC PARALLEL VOTING
Attention IEC-CENELEC parallel voting
The attention of IEC National Committees, members of CENELEC,
is drawn to the fact that this Committee Draft for Vote (CDV) is
submitted for parallel voting.
The CENELEC members are invited to vote through the CENELEC
online voting system.
This document is still under study and subject to change. It should not be used for reference purposes.
Recipients of this document are invited to submit, with their comments, notification of any relevant patent rights of which they are aware
and to provide supporting documentation.
Recipients of this document are invited to submit, with their comments, notification of any relevant “In Some Countries” clau ses to be
included should this proposal proceed. Recipients are reminded that the CDV stage is the final stage for submitting ISC c lauses. (SEE
AC/22/2007 OR NEW GUIDANCE DOC).

TITLE:
Power systems management and associated information exchange - Data and communications security - Part 8:
Role-based access control for power system management

PROPOSED STABILITY DATE: 2026
NOTE FROM TC/SC OFFICERS:
electronic file, to make a copy and to print out the content for the sole purpose of preparing National Committee positions.
You may not copy or "mirror" the file or printed version of the document, or any part of it, for any other purpose without
permission in writing from IEC.

57/2752/CDV – 2 – IEC CDV 62351-8 © IEC 2025
CONTENTS
CONTENTS . 1
FOREWORD . 8
INTRODUCTION . 10
1 Scope . 12
2 Normative references . 13
3 Terms and definitions . 14
4 Abbreviated terms . 17
5 RBAC process model . 18
5.1 Overview of RBAC process model . 18
5.2 Generic RBAC concepts . 18
5.3 Separation of subjects, roles, and permissions . 20
5.3.1 RBAC model . 20
5.3.2 Subject assignment (subject-to-role mapping). 23
5.3.3 Role assignment (role-to-permission mapping) . 23
5.3.4 Permission definition . 23
5.3.5 operationSet assignment (mapping of roles-permission-combinations to
objects) . 23
5.4 Criteria for defining roles. 24
5.4.1 Policies . 24
5.4.2 Subjects, roles, and permissions . 24
5.4.3 Introducing roles reduces complexity . 24
6 Definition of roles and permission assignment . 25
6.1 General . 25
6.2 Pre-defined roles . 25
6.3 Role-to-permission assignment . 26
6.3.1 General . 26
6.3.2 Number of supported permissions by a role . 27
6.3.3 Number of supported roles . 27
6.3.4 Assigning permissions to roles . 27
6.4 Definition of (custom based) roles . 29
6.4.1 General . 29
6.4.2 Encoding of roles based on specific permissions . 30
6.4.3 Encoding of roles using constraints on existing permissions . 35
6.5 Consideration of operational states . 38
6.6 Security Event consideration for the engineering of roles and permissions . 39
7 Simplified role assignment . 40
7.1 General . 40
7.2 Application of roles associated with multiple role definitions (generic roles) . 40
7.3 Illustrative examples . 41
7.3.1 General . 41
7.3.2 Application of pre-defined role “VIEWER” on Device-X for all role
definitions . 41
7.3.3 Application of custom role “OPERATOR-DFR” on Device-Y for all
supported role definitions . 43
7.3.4 Application of pre-defined role “SECADM” for selected role definitions . 43

IEC CDV 62351-8 © IEC 2025 – 3 – 57/2752/CDV
8 Definition of access tokens . 45
8.1 General . 45
8.2 Supported profiles . 45
8.3 Role-based access control related Object Identifiers . 45
8.4 General structure of the access tokens . 46
8.4.1 Profile specific mandatory components in the access tokens . 46
8.4.2 Optional access token components . 47
8.4.3 Definition of specific fields . 47
8.5 Access token profiles . 52
8.5.1 General . 52
8.5.2 Profile A: X.509 Public-key certificate . 52
8.5.3 Profile B: X.509 Attribute certificate . 55
8.5.4 Profile C: JSON Web Token – JWT . 59
8.5.5 Profile D: RADIUS provided access token information . 61
8.5.6 Profile E: LDAP provided RBAC information . 64
9 Verification of access tokens . 69
9.1 General . 69
9.2 Multiple access token existence . 69
9.3 Subject authentication . 70
9.4 Access token availability . 70
9.5 Validity period . 70
9.6 Access token integrity . 71
9.7 Issuer . 71
9.8 RoleID . 71
9.9 Revision number . 71
9.10 Area of responsibility . 72
9.11 Role definition . 72
9.12 Revocation state . 72
9.13 Operation . 73
9.14 Sequence number . 73
9.15 Revocation methods . 73
9.15.1 General . 73
9.15.2 Supported methods . 74
10 RBAC access token distribution models . 74
10.1 General . 74
10.2 PUSH model . 74
10.3 PULL model . 76
11 Interaction with backend services for RBAC access token distribution . 77
11.1 General . 77
11.2 Using directory services with LDAP . 77
11.2.1 General . 77
11.2.2 Secure communication . 78
11.2.3 LDAP Directory organization . 79
11.3 Using OAuth to provide JWT token . 80
11.3.1 General . 80
11.3.2 Secure communication . 81
11.4 Using AAA services with RADIUS . 82

57/2752/CDV – 4 – IEC CDV 62351-8 © IEC 2025
11.4.1 General . 82
11.4.2 Secure communication . 82
11.4.3 Peer configuration . 83
11.4.4 RADIUS server organization .
...