No passwords are stored in clear text within the IED. A hashed representation of
the passwords with SHA 256 is stored in the IED. These are not accessible from
outside via any ports. A user with SECADM or RBACMNT role is allowed to read
out the hashed password on a secured (TLS) ODBC link.
3.5 Denial of service
GUID-94340D4F-4D32-409B-BA1A-BA49A0C3F297 v5
The denial of service protection is designed to protect the IED from overload when
exposed to high amount of Ethernet network traf
fic. The communication facilities
must not be allowed to compromise the primary functionality of the device. All
inbound network traffic is quota controlled, so that a too heavy network load can be
controlled. Heavy network load might for instance be the result of malfunctioning
equipment connected to the network.
The denial of service functionality in FRONSTATUS, SCHLCCH and RCHLCCH
measures the IED load from communication and, if necessary, limits it from
jeopardizing the IED's control and protection functionality. The function has the
following outputs:
• RCHLCCH
• LinkAUp and LinkBUp indicates the Ethernet link status for the rear
ports channel A and B
• DOSLINKA and DOSLINKB indicates that DOS functionality is active
on channel A and channel B
• DOSALARM indicates that DOS functionality is active on the access
point
• SCHLCCH and FRONTSTATUS
• LINKUP indicates the Ethernet link status
• DOSALARM indicates that DOS functionality is active on the access
point
The DOS functionality activates when the inbound traffic rate
exceeds 3000 packets per second.
3.6 Certificate handling
GUID-C9F2CFBF-1A4A-4237-A37F-50064A6E1E65 v3
A self-signed certificate is signed by the IED. Certificates use encryption to
provide secure communication over the network. Certificate encryption strength
depends on the certificate authority (CA). A self-signed X.509 certificate and an
RSA key-pair with key-length of 2048 bits will be generated by the IED. The RSA
key stored in the certificate is used to establish secure communication.
1MRK 511 399-UEN B Section 3
Secure system setup
670 series 2.2 IEC 19
Cyber security deployment guideline
To Next Page
Loading...
Need help?
General
