GB/T 25320.11-2023Power systems management and associated information exchange - Data and communications security - Part 11: Security for XML documents (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents" Drafting:

This document is Part 11 of GB/T (Z) 25320 "Power System Management and Information Exchange Data and Communication Security": GB/T 25320 the following sections have been published:

---Part 1: Introduction to communication network and system security issues;

---Part 2: Terminology;

---Part 3: Communication network and system security including TCP/IP protocol set;

---Part 4: Protocol set including MMS;

---Part 5: Safety of GB/T 18657 and other standards and their derivatives;

---Part 6: Safety of IEC 61850;

---Part 7: Data Object Model for Network and System Management (NSM);

---Part 11: Security of XML files;

---Part 100-1: Conformance test cases for IEC TS62351-5 and IEC TS60870-5-7;

---Part 100-3: Conformance test cases for IEC 62351-3 and secure communication extensions including the TCP/IP protocol set:

This document is equivalent to IEC 62351-11:2016 "Power system management and its information exchange data and communication security Part 11:

Security of XML Files":

Certain contents of this document may be covered by patents: The publisher of this document assumes no responsibility for identifying patents:

Introduction

GB/T (Z) 25320 "Power System Management and Information Exchange Data and Communication Security", which aims to reduce communication and computing as much as possible in order to avoid the harm caused by malicious attacks in the computer network to the data and communication security of the power system, it is necessary to improve the communication protocols at all levels used in the power system:

discuss security vulnerabilities and improve the security management of power system information infrastructure: It is planned to consist of the following parts:

---Part 1: Introduction to communication network and system security issues: The purpose is to introduce other parts of GB/T (Z)25320 it mainly introduces readers to all aspects of information security applied to power system operation:

---Part 2: Terminology: The purpose is to introduce the key terms used in GB/T (Z) 25320:

---Part 3: Communication Network and System Security includes the TCP/IP protocol set: The purpose is to specify how transmission is limited to specifications of the messages, processes and algorithms of layer security protocols, and provide security protection for TCP/IP-based protocols so that these protocols can Suitable for IEC TC57 telecontrol environment:

---Part 4: Contains the protocol set of MMS: The purpose is to stipulate the manufacturing message specifications based on GB/T 16720 (ISO 9506) the process, protocol extensions and algorithms for security protection of MMS applications:

---Part 5: Security of GB/T 18657 and other standards and their derivatives: The purpose is to define the application configuration file (a-profile) Secure communication mechanism that specifies the secure operation of all protocols based on or derived from IEC 60870-5 Protected messages, processes and algorithms:

---Part 6: Safety of IEC 61850: The purpose is to specify the operation of all protocols based on or derived from IEC 61850:

Messages, processes and algorithms for security protection:

---Part 7: Data Object Model for Network and System Management (NSM): The purpose is to define the characteristics unique to power system operation:

A data object model for network and systems management:

---Part 8: Role-based access control: The purpose is to provide role-based access control for power system management:

---Part 9: Network security key management of power system equipment: The purpose is to manage by specifying or restricting the keys to be used Options to define requirements and technologies for achieving key management interoperability:

---Part 10: Security Architecture Guidelines: The purpose is to describe guidelines for a power system security architecture based on basic security controls:

---Part 11: Security of XML files: The purpose is to standardize the configuration file (XML file) in the communication process of smart substations security:

---Part 12: Rapid recovery and security recommendations for distributed energy resources (DER) systems: The aim is to improve distributed energy (DER) system security and reliability:

---Part 13: Guidance on safety topics covered in standards and specifications: The purpose is to provide standards and regulations for use in the power industry What safety issues could or should be covered in the specification (IEC or other):

---Part 90-1: Guidelines for handling role-based access control in power systems: The purpose is to develop custom A standardized approach to defining roles and role mapping:

---Part 90-2: Deep packet inspection of encrypted communications: The purpose is to describe the methods applied to communication channels protected by IEC 62351 DPI latest technology:

---Part 90-3: Network and System Administration Guide: The purpose is to provide guidelines for handling IT and OT data:

---Part 100-1: Conformance test cases for IEC 62351-5 and IEC TS60870-5-7: The purpose is to provide Test cases for conformance and/or interoperability testing of IEC 62351-5:2023 and IEC TS60870-5-7:2013:

---Part 100-3: Conformance test cases for IEC 62351-3 and secure communication extensions including the TCP/IP protocol set: Purpose it provides IEC 62351-3:2023 conformance test cases and verifies all aspects that affect security extensions and protocol behavior:

Configuration of parameters:

---Part 100-6: Network security conformance testing of IEC 61850-8-1 and IEC 61850-9-2: The purpose is to provide changes Test cases for conformance testing of data and communication security interoperability of power plant automation systems and telecontrol systems:

GB/T (Z) 25320 "Power System Management and Information Exchange Data and Communication Security" defines power system-related communication protocols (IEC 60870-5, IEC 60870-6, IEC 61850, IEC 61970 and IEC 61968 series) data and communication security: defines the pass Security threats and security attacks that may be encountered during the communication process, as well as security countermeasures:

Power system management and information exchange Data and communications security Part 11: Security of XML files

1 Scope

This document specifies methods for protecting XML files used within the scope of IEC as well as files in other fields (e.g. IEEE, patents, etc:) Format, process and algorithm: If secure exchange is required, this document is intended to be referenced by the standard, unless there is agreement between the parties to use another Recognized secure exchange mechanism:

This document uses W3C standards for XML file security and provides an introduction to these standards and other extensions: This article the software provides the following provisions for extensions:

---Header (information header): Header contains relevant information about the created saved file, such as creating the XML of IEC 62351-11 the date and time of the file:

---You can choose to encapsulate the original XML file in encrypted or non-encrypted format: If encryption is selected, a mechanism is provided to represent Represents the information required to perform encryption in an interoperable manner:

---AccessControl: A mechanism that represents access control information related to the information contained in the original XML file:

---Body (text): used to contain the original XML file to be encapsulated:

---Signature: A signature that can be used for authentication and tampering detection:

The overall structure should conform to Figure 1:

Figure 1 Overview of the XML file structure of IEC 62351-11

For the methods described in this document to be valid, they need to be accepted and referenced by the specification: This document has been written to enable this process:

The readers of this document are developers of products that implement these specifications:

Portions of this document may also be used by managers and executives to understand the purpose and requirements of the job:

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text: Among them, the dated quotations for undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document:

IEC TS62351-2 Power system management and information exchange data and communication security Part 2: Terminology (Powersys-