GB/T 25320.4-2024Power systems management and associated information exchange - Data and communications security - Part 4: Profiles including MMS and derivatives (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part 1: Structure and drafting rules for standardization documents" Drafting.

This document is Part 4 of GB/T (Z) 25320 "Power system management and information exchange data and communication security".

GB/T (Z) 25320 has published the following parts.

--- Part 1: Introduction to security issues of communication networks and systems;

--- Part 2: Terminology;

--- Part 3: Communication network and system security protocol suite including TCP/IP;

--- Part 4: Contains the MMS protocol set and its annexes;

--- Part 5: Safety of GB/T 18657 and its derivative standards;

--- Part 6: Safety of IEC 61850;

--- Part 7: Data object model for network and system management (NSM);

--- Part 11: Security of XML documents;

--- Part 100-1.Conformance test cases for IEC TS62351-5 and IEC TS60870-5-7;

--- Part 100-3.Conformance test cases for IEC 62351-3 and security communications extensions including the TCP/IP protocol suite.

This document replaces GB/Z 25320.4-2010 "Power system management and information exchange data and communication security Part 4: Packet Compared with GB/Z 25320.4-2010, in addition to structural adjustments and editorial changes, the main technical changes are as follows.

a) The scope of application has been changed (see Chapter 1, Chapter 1 of the 2010 edition);

b) The terms and definitions have been changed and abbreviations have been added (see Chapter 3, Chapter 3 of the 2010 edition);

c) The safety issues involved in this document have been changed (see Chapter 4, see Chapter 4 of the 2010 edition);

d) Application Protocol Profile (A-Profile) security has been deleted (see Chapter 5 of the 2010 edition);

e) Deleted the Transport Protocol Suite (T-Profile) security (see Chapter 6 of the 2010 edition);

f) Added specific requirements (see Chapter 5);

g) increased transmission security (see Chapter 6);

h) Added an overview of application layer security (see Chapter 7);

i) Added the application of encryption algorithm (see Chapter 8);

j) Added object identifier allocation (see Chapter 9);

k) Added general OSI upper layer requirements (see Chapter 10);

l) Added end-to-end application security model (see Chapter 12);

m) Increased end-to-end application security (see Chapter 13);

n) Added end-to-end security error handling (see Chapter 14);

o) Added end-to-end security in the OSI operating environment (see Chapter 15);

p) Increased E2E security in the XMPP operating environment (see Chapter 16);

q) Changed consistency (see Chapter 17, see Chapter 7 of the 2010 edition);

r) Added the ANS.1 specification of the application security protocol suite (see Appendix A);

s) Added the ANS.1 specification for end-to-end security (see Appendix B);

t) Added the W3C XSD specification for end-to-end security (see Appendix C);

u) Added the ANS.1 model in the OSI operating environment (see Appendix D);

v) Added the ANS.1 model and W3C schema document XSD in the XMPP operating environment (see Appendix E);

w) Added virtual API template specification (see Appendix F);

x) Added the end-entity public key certificate specification (see Appendix G);

y) Added the underlying requirements for the OSI operating environment (see Appendix H).

This document is modified to adopt IEC 62351-4:2018 "Power system management and information exchange data and communication security Part 4: Packet Protocol set including MMS and its annexes.

The technical differences between this document and IEC 62351-4:2018 and their reasons are as follows.

---Normative references IEC 62351-3, IEC TS62351-8, IEC 62351-9, ISO 8601-1 are updated to the latest versions.

Introduction

GB/T (Z) 25320 "Power system management and information exchange data and communication security" aims to reduce communication and computing as much as possible.

The malicious attacks in the computer network will cause harm to the data and communication security of the power system, and improve the communication protocols used in the power system.

The proposed security loopholes and improve the security management of power system information infrastructure are to be composed of the following parts.

--- Part 1: Introduction to security issues of communication networks and systems. The purpose is to introduce other parts of GB/T (Z) 25320 it mainly introduces readers to various aspects of information security applied to power system operation.

--- Part 2: Terminology. The purpose is to introduce the key terms used in GB/T 25320(Z).

--- Part 3: Communication network and system security includes the TCP/IP protocol suite. The purpose is to specify how to the message, process and algorithm specifications of the layer security protocol provide security protection for TCP/IP-based protocols, so that these protocols can Applicable to the telecontrol environment of IEC TC57.

--- Part 4: Contains the MMS protocol set and its annexes. The purpose is to specify the requirements for the MMS protocol based on GB/T 16720 (ISO 9506).

The process, protocol extensions and algorithms for security protection using the Message Making Specification (MMS) and its derivative standards.

--- Part 5: GB/T 18657 and its derivative standards. The purpose is to define the application profile (a-profile) security the full communication mechanism specifies the requirements for the telecontrol equipment and systems based on or derived from IEC 60870-5 (GB/T 18657 "Telecontrol Equipment and Systems Part 5.

The messages, processes, and algorithms that are used to secure the operation of all protocols in the IEEE Transmission Protocol.

--- Part 6: Security of IEC 61850.The purpose is to specify the operation of all protocols based on or derived from IEC 61850.

The messages, processes and algorithms used for security protection.

--- Part 7: Data object model for network and system management (NSM). The purpose is to define the data object model specific to power system operation.

A data object model for network and system management.

--- Part 8: Role-based access control. The purpose is to provide role-based access control for power system management.

--- Part 9: Cybersecurity key management for power system equipment. The purpose is to specify or restrict the key management to be used options to define requirements and techniques for achieving key management interoperability.

--- Part 10: Security architecture guidelines. The purpose is to describe the security architecture guidelines for power systems based on basic safety controls.

--- Part 11: Security of XML files. The purpose is to standardize the configuration files (XML files) in the communication process of smart substations security.

--- Part 12: Rapid recovery and safety recommendations for distributed energy (DER) systems. The purpose is to improve the Safety and reliability of DER systems.

--- Part 13: Guidance on safety topics covered in standards and specifications. The purpose is to provide information on standards and specifications used in the power industry.

which safety issues could or should be covered in a standard (IEC or other).

--- Part 90-1.Guidelines for role-based access control in power systems. The purpose is to develop a A standardized way to define roles and role mapping.

--- Part 90-2.Deep packet inspection for encrypted communications. The purpose is to describe the application of deep packet inspection to communication channels protected by IEC 62351.

DPI latest technology.

--- Part 90-3.Guidelines for network and system management. The purpose is to provide guidelines for processing IT and OT data.

--- Part 100-1.Conformance test cases for IEC TS62351-5 and IEC TS60870-5-7.The purpose is to provide Test cases for conformance and/or interoperability testing of IEC 62351-5:2023 and IEC TS60870-5-7:2013.

--- Part 100-3.Conformance test cases for IEC 62351-3 and extensions for secure communications including the TCP/IP protocol suite. Purpose it provides IEC 62351-3:2023 conformance test cases and verifies all safety extensions and protocol behaviors that affect Configuration of parameters.

--- Part 100-6.Cybersecurity conformance testing for IEC 61850-8-1 and IEC 61850-9-2.

Test cases for data and communication security interoperability conformance testing of power station automation systems and telecontrol systems.

GB/T (Z) 25320 "Power system management and information exchange data and communication security" defines the power system related communication protocols (IEC 60870-5, IEC 60870-6, IEC 61850, IEC 61970 and IEC 61968 series), also defines the communication the security threats and attacks that may occur during the communication process and the security response measures.

This document is part 4 of GB/T (Z) 25320 "Power system management and information exchange data and communication security", which is based on GB/T 16720 (ISO 9506) Manufacturing Message Specification (MMS) and its derivative standards for security protection processes, protocol expansion and algorithm.

Power system management and information exchange Data and communications security Part 4: Protocol suite including MMS and its annexes

1 Scope

2 Normative references

The contents of the following documents constitute the essential clauses of this document through normative references in this document.