This part of IEC 62351, which is a technical report, addresses the handling of access control of users and automated agents to data objects in power systems by means of role-based access control (RBAC) as defined in IEC TS 62351-8. IEC TS 62351-8 defines three different profiles to distribute role information and also defines a set of mandatory roles to be supported. Adoption of RBAC has shown that the defined mandatory roles are not always sufficient and it is recommended that the method for defining custom roles be standardized to ensure interoperability. Hence, the main focus of this document lies in developing a standardized method for defining and engineering custom roles, their role-to-right mappings and the corresponding infrastructure support needed to utilize these custom roles in power systems. This is achieved by defining categories and sub level categories, which provide a distinction of actions, connected with dedicated rights as well as a proposal for a format to distribute the custom role-to-right mappings. Moreover, a format is being proposed to distribute the information on custom defined roles and associated rights by utilizing XACML as an established standard for access control.<\/p>\n
Besides the discussion of handling custom roles, this document also addresses the following issues:<\/p>\n
Providing recommendations and\/or examples for role-right-operation and (object) association to ensure interoperability from operational and developers point of view.<\/p>\n<\/li>\n
Providing mechanisms and rules to avoid overloading of existing roles by allowing for an aligned way to define new (custom) roles.<\/p>\n<\/li>\n
Easing the administration of roles in IEDs from a device management point of view:<\/p>\n
Allowing for centralized assignment of roles, by maintaining the same associations on device\/application level.<\/p>\n<\/li>\n
Avoiding the definition of role-right-operation on command level to cope with diverse application environment of IEC TS 62351-8 (e.g. IED, substation level, control centre, SCADA).<\/p>\n<\/li>\n<\/ul>\n<\/li>\n
Enhancing available constraints for acting in a specific role considering the local environment with respect to operational constraints.<\/p>\n<\/li>\n<\/ul>\n
| PDF Pages<\/th>\n | PDF Title<\/th>\n<\/tr>\n | ||||||
|---|---|---|---|---|---|---|---|
| 2<\/td>\n | undefined <\/td>\n<\/tr>\n | ||||||
| 4<\/td>\n | CONTENTS <\/td>\n<\/tr>\n | ||||||
| 6<\/td>\n | FOREWORD <\/td>\n<\/tr>\n | ||||||
| 8<\/td>\n | INTRODUCTION <\/td>\n<\/tr>\n | ||||||
| 9<\/td>\n | 1 Scope 2 Normative references <\/td>\n<\/tr>\n | ||||||
| 10<\/td>\n | 3 Terms, definitions and abbreviated terms 3.1 Terms and definitions 3.2 Abbreviated terms <\/td>\n<\/tr>\n | ||||||
| 11<\/td>\n | 4 Overview 4.1 General <\/td>\n<\/tr>\n | ||||||
| 12<\/td>\n | 4.2 Current definitions from IEC TS 62351-8 <\/td>\n<\/tr>\n | ||||||
| 13<\/td>\n | Figures Figure 1 \u2013 Scope of RBAC as defined in IEC TS 62351-8 Tables Table 1 \u2013 Pre-defined roles in IEC TS 62351-8 <\/td>\n<\/tr>\n | ||||||
| 14<\/td>\n | 4.3 Example standards and guidelines requiring RBAC 4.3.1 General 4.3.2 BDEW Whitepaper 4.3.3 IEEE 1686 <\/td>\n<\/tr>\n | ||||||
| 15<\/td>\n | 4.3.4 ISO\/IEC 27019 4.3.5 IEC 62443 <\/td>\n<\/tr>\n | ||||||
| 16<\/td>\n | 4.3.6 NERC CIP 4.3.7 BSI TR 03109 4.3.8 Further requirements 5 Categorization of actions to ease the definition of custom roles 5.1 General <\/td>\n<\/tr>\n | ||||||
| 17<\/td>\n | 5.2 Main category overview Figure 2 \u2013 Main categories <\/td>\n<\/tr>\n | ||||||
| 18<\/td>\n | 5.3 Category: Administration Figure 3 \u2013 Level structure of categories (example) Table 2 \u2013 Subcategories for administration <\/td>\n<\/tr>\n | ||||||
| 19<\/td>\n | 5.4 Category: Provisioning 5.5 Category: Operation Table 3 \u2013 Subcategories for provisioning Table 4 \u2013 Subcategories for operation <\/td>\n<\/tr>\n | ||||||
| 20<\/td>\n | 5.6 Category: Audit 6 RBAC Operation 6.1 General 6.2 Synchronous versus asynchronous RBAC operation Table 5 \u2013 Subcategories for audit <\/td>\n<\/tr>\n | ||||||
| 21<\/td>\n | 6.3 Role changes during a communication session 6.4 Application of RBAC under specific circumstances Figure 4 \u2013 Online engineering session (synchronous) <\/td>\n<\/tr>\n | ||||||
| 23<\/td>\n | Figure 5 \u2013 Enhancement of the RBAC approach with operational constraints <\/td>\n<\/tr>\n | ||||||
| 24<\/td>\n | 7 Information exchange of defined custom roles and associated rights 7.1 General 7.2 Encoding and exchange of custom Role Definitions Figure 6 \u2013 XACML Overview <\/td>\n<\/tr>\n | ||||||
| 25<\/td>\n | Figure 7 \u2013 Terminating XACML at the IED directly <\/td>\n<\/tr>\n | ||||||
| 26<\/td>\n | Figure 8 \u2013 Terminating XACML at the security engineering tool <\/td>\n<\/tr>\n | ||||||
| 27<\/td>\n | 7.3 Encoding and exchange of IEC TS 62351-8 defined roles Figure 9 \u2013 XACML policy file mapping <\/td>\n<\/tr>\n | ||||||
| 31<\/td>\n | 7.4 User defined roles 7.4.1 Usage 7.4.2 Example Table 6 \u2013 User defined role definition <\/td>\n<\/tr>\n | ||||||
| 32<\/td>\n | 7.5 Role polymorphism 7.5.1 Encoding in XACML <\/td>\n<\/tr>\n | ||||||
| 33<\/td>\n | 7.5.2 Examples Figure 10 \u2013 AoR decision point <\/td>\n<\/tr>\n | ||||||
| 35<\/td>\n | Figure 11 \u2013 Role polymorphism decision point <\/td>\n<\/tr>\n | ||||||
| 37<\/td>\n | 7.6 Roles to rights mapping data <\/td>\n<\/tr>\n | ||||||
| 38<\/td>\n | Bibliography <\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":" Power systems management and associated information exchange. Data and communications security – Guidelines for handling role-based access control in power systems<\/b><\/p>\n |