IEC 62351 - Power Systems Communication Security 3:4: Part 3, clause 4: security issues addressed, threats and attack methods countered, security events

The TLS profile answers the power system environment's differences from IT use of TLS: connections are long, often permanent, so the profile selects a session key update mechanism from existing TLS features (TLSv1.2 and TLSv1.3 rekey differently); equipment is long-lived, so older TLS versions or cipher suites may need support for backward compatibility; and interoperability needs a common set of TLS features every conforming implementation supports. The profile covers only the transport layers (OSI 4 and below), protecting layer 5 and above transparently, and counters tampering through mutual certificate-based authentication and packet-level integrity, unauthorized access to information through packet-level encryption where confidentiality is required, impersonation through mutual X.509 authentication and signed revocation information, man-in-the-middle through MACs on mutually authenticated session keys and the handshake's Finished message (TLSv1.3 encrypting the handshake itself), replay through per-packet MAC with sequence numbers, and eavesdropping through encrypting cipher suites. Security events defined through the document support handling of errors, intrusion detection, audit trails and testing for conformance, graded notice, warning, error and alarm, with the organization's security policy deciding the handling.