Protocol guide
DNP3 Secure Authentication explained
DNP3 Secure Authentication is the part of the DNP3 standard (IEEE 1815) that lets an outstation and a master prove to each other that critical messages, such as control commands, come from an authorised station and were not altered.
What problem does Secure Authentication solve?
DNP3 was designed for closed serial networks. Once DNP3 travels over IP networks, an attacker who can reach the network could send a valid-looking command. Secure Authentication lets the receiving station verify the sender before acting.
How does challenge-response work?
When a station receives a critical message, it can send a challenge. The sender answers with a message authentication code, an HMAC computed over the challenge and the original message with a shared session key. Only a station holding the key can produce the right answer.
Session keys are changed regularly and are themselves protected with longer-term update keys using key wrap, for example AES-256 key wrap.
How does it relate to IEC 62351-5?
DNP3 Secure Authentication and IEC 62351-5 share the same authentication mechanism. IEC 62351-5 applies it to IEC 60870-5-101 and -104 as well as DNP3, so one design can protect both protocol families.
Secure Authentication does not encrypt data. Where confidentiality is needed, TLS protects the TCP connection.
How NeoTechX uses it
NeoCore implements IEC 62351-5 secure authentication with HMAC-SHA-256 and AES-256 key wrap, plus TLS, on both DNP3 and IEC 60870-5-104, and can sit in front of a legacy DNP3 device to add this layer without replacing it. See the NeoCore protocol matrix and how to secure legacy equipment.
Other guides: IEC 60870-5-104 explained · IEC 62351 explained
Frequently asked questions
Does DNP3 Secure Authentication encrypt data?
No. Secure Authentication verifies who sent a message and that it was not altered. Encryption of the connection is provided separately by TLS.
Which messages are authenticated?
Critical messages, such as control commands, are challenged. Which function codes count as critical is configured on each station.
Field equipment sending DNP3 or Modbus in clear text?
NeoCore can secure it without replacing the device. Start with a free assessment.