# Advancements and Research Trends in Microgrids Cybersecurity
## 3 The Action of IEC 62351  
Control networks in Supervisory Control And Data Acquisition (SCADA) systems were typically realized by using only proprietary solutions. Several application protocols were developed, each targeting specific communication constraints required by the control systems. The need of remote control and the advances in computer networks led to the blending of traditional control networks with modern Internet. Consequently, control systems inherited security vulnerabilities that threatened the modern internet [13]. In the electrical sector, broadly employed protocols to communicate data and control information are Modbus, DNP3, IEC 60870-5, and IEC 61850. In particular, although developed for substation automation, IEC 61850 suite is exploited for smart microgrids [14]. Abstract data models defined in IEC 61850 can be mapped to different protocols, such as Manufacturing Message Specification (MMS), Generic Object Oriented Substation Event (GOOSE), and Sampled Measured Values (SMV), which can run over TCP/IP networks or over substation LANs by using Ethernet. As said, severe vulnerabilities affect these protocols. Different papers show possible attacks at these protocols and the related impact. In Reference [15], vulnerabilities of GOOSE are tested by using real-time simulation and industry standard hardware-in-the-loop emulation. Reference [16] shows how an attacker can launch a Man-In-The-Middle attack on the MMS communications of a photovoltaic inverter installation by using ARP spoofing. Some of these vulnerabilities are currently addressed by IEC 62351, which is a standard developed by WG15 of IEC TC57. The main purpose is to address the problem of security of TC 57 series of protocols including IEC 60870-5, IEC 60870-6, IEC 61850, IEC 61970, and IEC 61968 series. Currently, the standard is composed of 18 parts listed in Table 1.  
IEC 62351 series does not provide only cryptography for common electrical control system protocols. It also defines cybersecurity requirements to implement security technologies in the operational environment, including objects for network and system management, role-based access control, cryptographic key management, and security event logging. \begin{table}
\begin{tabular}{l l} \hline
**Section** & **Description** \\ \hline Part 1 & Introduction to security issue \\ Part 2 & Glossary of terms \\ Part 3 & Profiles including TCP/IP \\ Part 4 & Profiles including MMS and derivatives \\ Part 5 & Security for IEC 60870-5 and derivatives \\ Part 6 & Security for IEC 61850 \\ Part 7 & Network and system management (NSM) data object models \\ Part 8 & Role-based access control for power system management \\ Part 9 & Cyber security key management for power system equipment \\ Part 10 & Security architecture guidelines \\ Part 11 & Security for e\&ensible markup language (XML) documents \\ Part 12 & Resilience and security recommendations for power systems with DER \\ Part 13 & Guidelines on security topics to be covered in standards and specifications \\ Part 90-1 & Guidelines for handling role-based access control in power systems \\ Part 90-2 & Deep packet inspection of encrypted communications \\ Part 90-3 & Guidelines for network and system management \\ Part 100-1 & Conformance test cases for IEC TS 62351-5 and IEC TS 60870-5-7 \\ Part 100-3 & Conformance test cases for the IEC 62351-3, the secure communication \\  & extension for profiles including TCP/IP \\ \hline \end{tabular}
\end{table} 
Table 1: Summary of IEC 62351 specifications. IEC 62351 offers a list of guidelines for protocols security and a framework for secure operations. It is designed to be referenced by other standards, not used directly. For example, IEC 62351-3 specifies how to provide confidentiality, tamper detection, and message level authentication for SCADA and telecontrol protocols, and how to secure TCP/IP-based protocols through constraints on the specification of the messages, procedures, and algorithms of Transport Layer Security (TLS) 1.2 according to RFC 5246.