Protocol guide
IEC 62351 explained
IEC 62351 is a series of standards that adds security to the communication protocols used in power systems. Part 5 covers secure authentication for IEC 60870-5 protocols and their derivatives such as DNP3, and part 3 profiles TLS for protocols that run over TCP/IP.
What does the IEC 62351 series cover?
The series addresses different protocols and layers: part 3 profiles TLS for TCP/IP-based protocols, part 4 covers MMS-based protocols, part 5 covers IEC 60870-5 and derivatives, part 6 covers IEC 61850 messages, part 8 role-based access control and part 9 key management.
What is IEC 62351-5?
IEC 62351-5 defines secure authentication for IEC 60870-5-101, IEC 60870-5-104 and derived protocols such as DNP3. A station challenges critical messages and the sender proves possession of a shared session key with an HMAC.
A protocol implementation conformance statement (PICS) documents which options of IEC 62351-5 an implementation supports, so an operator can check interoperability before deployment.
Implements, certified or compliant?
A product can implement IEC 62351-5 without holding a certificate. Certification is a separate assessment by a test body. Buyers should ask for the PICS and test the implementation against their own master.
How NeoTechX uses it
NeoCore implements IEC 62351-5 with HMAC-SHA-256 and AES-256 key wrap, plus TLS, for DNP3 and IEC 104, and can sit in front of a legacy device to add this layer without replacing it. NeoTechX provides the IEC 62351-5 PICS on request. See the NeoCore protocol matrix and how to secure legacy equipment.
Other guides: IEC 60870-5-104 explained · DNP3 Secure Authentication explained
Frequently asked questions
What is IEC 62351-5?
IEC 62351-5 is the part of the IEC 62351 series that defines secure authentication for IEC 60870-5-101, IEC 60870-5-104 and derived protocols such as DNP3, using challenge-response with HMAC and managed session keys.
What is the difference between IEC 62351-3 and IEC 62351-5?
IEC 62351-3 profiles TLS to protect TCP/IP connections. IEC 62351-5 authenticates messages at the application layer, including on serial links where TLS cannot be used.
Field equipment sending DNP3 or Modbus in clear text?
NeoCore can secure it without replacing the device. Start with a free assessment.