GB/Z 25320.1003-2023Power systems management and associated information exchange - Data and communication security - Part 100-3: Conformance test cases for IEC 62351-3, the secure communication extension for profiles including TCP/IP (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1. Structure and Drafting Rules of Standardization Documents" Drafting.

This document is Part 100-3 of GB/T (Z) 25320 "Power System Management and Information Exchange Data and Communication Security". GB/T (Z)25320 has released the following parts.

---Part 1. Introduction to communication network and system security issues;

---Part 2. Terminology;

---Part 3. Communication network and system security including TCP/IP protocol set;

---Part 4. Protocol set including MMS;

---Part 5. Safety of GB/T 18657 and other standards and their derivatives;

---Part 6. Safety of IEC 61850;

---Part 7. Data Object Model for Network and System Management (NSM);

---Part 11. Security of XML files;

---Part 100-1. Conformance test cases for IEC TS62351-5 and IEC TS60870-5-7;

---Part 100-3. Conformance test cases for IEC 62351-3 and secure communication extensions including the TCP/IP protocol set.

This document is modified to adopt IEC TS62351-100-3:2020 "Power system management and its information exchange data and communication security" Part 100-3. Conformance test cases for IEC 62351-3 and secure communication extensions including the TCP/IP protocol suite. File type by IEC The technical specifications were adjusted into my country's national standardization guiding technical documents.

The technical differences and reasons between this document and IEC TS62351-100-3:2020 are as follows:

---Deleted the content of "Reference Standard Requirements". The "reference standard requirements" have been deleted from the new version of the standard, and the corresponding content has been deleted from this document.

Introduction

GB/T (Z) 25320 "Power System Management and Information Exchange Data and Communication Security", which aims to reduce communication and computing as much as possible In order to avoid the harm caused by malicious attacks in the computer network to the data and communication security of the power system, it is necessary to improve the communication protocols at all levels used in the power system. discuss security vulnerabilities and improve the security management of power system information infrastructure. It is planned to consist of the following parts.

---Part 1. Introduction to communication network and system security security issues. The purpose is to introduce other parts of GB/T (Z)25320 It mainly introduces readers to all aspects of information security applied to power system operation.

---Part 2. Terminology. The purpose is to introduce the key terms used in GB/T (Z) 25320.

---Part 3. Communication Network and System Security includes the TCP/IP protocol set. The purpose is to specify how transmission is limited to specifications of the messages, processes and algorithms of layer security protocols, and provide security protection for TCP/IP-based protocols so that these protocols can Suitable for IEC TC57 telecontrol environment.

---Part 4. Contains the protocol set of MMS. The purpose is to describe the use of GB/T 16720 (ISO /IEC 9506) to create messages Some mandatory and optional security specifications that should be implemented when standardizing MMS.

---Part 5. Security of GB/T 18657 and other standards and their derivatives. The purpose is to define the application configuration file (a-profile) Secure communication mechanism that specifies the secure operation of all protocols based on or derived from IEC 60870-5 Protected messages, processes and algorithms.

---Part 6. Safety of IEC 61850. The purpose is to specify the operation of all protocols based on or derived from IEC 61850. Messages, processes and algorithms for security protection.

---Part 7. Data Object Model for Network and System Management (NSM). The purpose is to define the characteristics unique to power system operation. A data object model for network and systems management.

---Part 8. Role-based access control for power system management. The purpose is to provide role-based access for power system management. Ask about control.

---Part 9. Network security key management of power system equipment. The purpose is to manage by specifying or restricting the keys to be used Options to define requirements and technologies for achieving key management interoperability.

---Part 10. Security Architecture Guidelines. The purpose is to describe guidelines for a power system security architecture based on basic security controls.

---Part 11. Security of XML files. The purpose is to standardize the configuration file (XML file) in the communication process of smart substations security.

---Part 12. Security recommendations for distributed energy resources (DER) cyber-physical systems and power systems. The aim is to improve the distribution security and reliability of renewable energy (DER) systems.

---Part 13. Guidelines on security topics covering standards and specifications. The purpose is to provide standards and specifications for use in the power industry What safety issues could or should be covered in (IEC or other).

---Part 90-1. Guidelines for handling role-based access control in power systems. The purpose is to develop customizations for defining and designing Roles and a standardized approach to role mapping.

---Part 90-2. Deep packet inspection for encrypted communications. The purpose is to describe the methods applied to communication channels protected by IEC 62351 DPI latest technology.

---Part 90-3. Network and system management guidelines. The purpose is to provide guidelines for handling IT and OT data.

---Part 100-1. Conformance test cases for IEC TS62351-5 and IEC TS60870-5-7. The purpose is to provide Test cases for conformance and/or interoperability testing of IEC 62351-5:2023 and IEC TS60870-5-7:2013.

---Part 100-3. Conformance test cases for IEC 62351-3 and secure communication extensions including the TCP/IP protocol set. Purpose It provides IEC 62351-3:2023 conformance test cases and verifies all aspects that affect security extensions and protocol behavior. Configuration of parameters.

---Part 100-6. Network security conformance testing of IEC 61850-8-1 and IEC 61850-9-2. The purpose is to provide changes Test cases for conformance testing of data and communication security interoperability of power plant automation systems and telecontrol systems.

GB/T (Z) 25320 "Power System Management and Information Exchange Data and Communication Security" defines power system-related communication protocols (IEC 60870-5, IEC 60870-6, IEC 61850, IEC 61970 and IEC 61968 series) data and communication security also defines the communication Security threats and security attacks that may be encountered during the communication process, as well as security countermeasures.

1 Scope

This document provides data and communication security testing of telecontrol equipment, substation automation systems (SAS) and SCADA front-end computers. case.

This document provides a standard test method for protocol implementations to achieve interoperability to verify that equipment meets the requirements of IEC 62351-3. symbol The consistency of standards does not guarantee interoperability between different devices, but it is expected that using this document to test will reduce the risk of non-interoperability to a minimum. lowest. The basic condition for interoperability is that both devices pass conformance testing.

This document specifies generally applicable procedures and definitions for conformance and/or interoperability testing of IEC 62351-3. This document defines The conformance test cases focus on verifying the consistent integration of the underlying authentication/encryption protocol (TLS) specified in IEC 62351-3 to protect Communication based on TCP/IP.

This document does not cover testing the underlying authentication/encryption protocols over TCP/IP (TLS) required by IEC 62351-3. based on Conformance testing of the TCP/IP authentication/encryption protocol is beyond the scope of this document.

This document deals with data and communications security conformance testing and does not cover other requirements such as security or EMC. These requests are made by other Standards (if applicable) are covered, and proof of compliance with this part follows other standards.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document.

GB /Z 25320.2-2013 Power system management and information exchange data and communication security Part 2. Terminology (IEC TS62351-2:2008,IDT)

IEC 62351-3:2023 Power system management and information exchange data and communication security Part 3. Communication networks and systems includingTCP/IP)

Note: GB /Z 25320.3-2010 Power system management and information exchange data and communication security Part 3. Communication network and system security package Protocol set including TCPIP (IEC TS62351-3:2007, IDT)

3 Terms, definitions and abbreviations