IEC 62351 - Power Systems Communication Security

Part 5: security for IEC 60870-5 and derivatives – IEC 62351 - Power Systems Communication Security

IEC 62351 - Power Systems Communication Security 5:8.4: Part 5, 8.4: session key change procedure

Session keys are changed through a defined procedure with controlling and controlled station state machines and directives for session key management, the controlling station issuing new session keys at an interval or message count so that a captured key has bounded value.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Part 5: security for IEC 60870-5 and derivatives – IEC 62351 - Power Systems Communication Security

5:5.2 Part 5, 5.2: threats addressed (spoofing, tampering, replay, eavesdropping)
5:5.3 Part 5, 5.3: design issues of the telecontrol environment
5:5.4 Part 5, 5.4: general principles (application layer only, generic definition mapped to protocols, bi-directional, key management, backwards tolerance, upgradeable, multiple connections)
5:6.2 Part 5, 6.2: theory of operation (association ID, authenticating, central authority, role-based access control, cryptographic keys, security statistics and events)
5:7 Part 5, clause 7: functional requirements (procedures, state machines, timers and counters, security statistics thresholds, reporting, event monitoring and logging)
5:8.3 Part 5, 8.3: station association procedure (public-key certificates, configuration of authorized remote stations, verification of certificates, update keys)
5:8.5 Part 5, 8.5 and following: authentication of critical messages (challenge-response and aggressive mode), ASDU protection and error handling

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All IEC 62351 - Power Systems Communication Security controls