What is BS EN IEC 62351‑8 about?
BS EN IEC 62351 is a series on power systems management and associated information exchange. BS EN IEC 62351‑8 is applicable to facilitate role-based access control (RBAC) for power system management. RBAC assigns human users, automated systems, and software applications (collectively called "subjects" in this document) to specified "roles", and restricts their access to only those resources, which the security policies identify as necessary for their roles.
Specifically, RBAC provides an alternative to the all-or-nothing super-user model in which all subjects have access to all data, including control commands.
While BS EN IEC 62351‑8 defines a set of mandatory roles to be supported, the exchange format for defined specific or custom roles is also in the scope of BS EN IEC 62351‑8.
The following interactions are in BS EN IEC 62351‑8:
- Local (direct wired) access to the object by a human user, a local and automated computer agent, or a built-in HMI or panel
- Remote (via dial-up or wireless media) access to the object by a human user
- Remote (via dial-up or wireless media) access to the object by a remote automated computer agent, e.g., another object at another substation, a distributed energy resource at an end user’s facility, or a control centre application
Note 1: Out of scope for BS EN IEC 62351‑8 are all topics that are not directly related to the definition of roles and access tokens for local and remote access, especially administrative or organizational tasks.
Who is BS EN IEC 62351‑8 for?
BS EN IEC 62351‑8 on power systems management (Data and communications security) is useful for:
- Power distribution networks
- Administration sectors
- IT companies
- Design engineers
- Software developers
Why should you use BS EN IEC 62351‑8?
BS EN IEC 62351‑8 provides a standard for access control in power systems. The power system environment supported by BS EN IEC 62351‑8 is enterprise-wide and extends beyond traditional borders to include external providers, suppliers, and other energy partners. Driving factors are the liberalization of the energy sector to include many more stakeholders, the increasingly decentralized generation of energy, and the need to control access to sensitive data of resources and stakeholders.
BS EN IEC 62351‑8 defines RBAC for enterprise-wide use in power systems. It supports a distributed or service-oriented architecture where security is distributed, and applications are consumers of distributed services. RBAC is a primary method to meet the security principle of least privilege, which states that no subject should be authorized more permissions than necessary for performing that subject’s task. With RBAC, authorization is separated from authentication. RBAC enables an organization to subdivide super-user capabilities and package them into special user accounts termed roles for assignment to specific individuals according to their associated duties.
Using BS EN IEC 62351‑8 provides an entity with protection for sensitive system operations from inadvertent (or deliberate) actions by unauthorized users