Secure Authentication for IEC 60870-5 (-101 and -104)

• End to end cryptographic authentication at the application layer which goes beyond VPN tunnels or TLS
• Based on IEC 62351 security standard (Parts 3, 5, and 8)
• TLS is supported for IP based networks
• Legacy support for networks or devices that do not support encryption
• Configuration of which requests are considered critical
• Authentication can be performed in either direction (Controlling or Controlled Station)
• Supports IEC 101 and IEC 104

• Supports Role Based Access Control (RBAC) - multiple users and roles (engineers, operators, viewers, admin)
• Configure privileges(view, read, security, etc.) for each role
• Users can be added, modified, or removed

• Support low bandwidth and/or serial networks
• Low overhead for Outstations that may not have processing capability for public/private certificates or encryption

Additional tools for Secure Authentication

• The Communication Protocol Test Harness supports Secure Authentication
• A powerful tool for testing the implementation of the IEC 60870-5 Source Code Libraries

Distributed Test Manager (DTM)

• Distributed Test Manager (DTM) supports Secure Authentication
• A powerful tool that can simulate the SCADA communications in the substation and perform automated tests to confirm system or individual device behavior

SCADA Data Gateway

• For projects where Secure Authentication needs to be added to an existing system
• The SCADA Data Gateway is a flexible protocol translation application for easily deploying Secure Authentication in a control center or substation

Watch our IEC 60870-5 training videos to learn more about Secure Authentication


Example of Aggressive Mode Challenge-Reply Sequence for IEC 60870-5: