IEC 62351-6:2020

Overview

IEC 62351-6:2020 - "Power systems management and associated information exchange - Data and communications security - Part 6: Security for IEC 61850" specifies the messages, procedures and algorithms needed to secure protocols based on or derived from the IEC 61850 series. The standard targets security for at least the following mappings and components: IEC 61850-8-1 (MMS/ISO 9506 over Ethernet), IEC 61850-8-2 (XMPP), IEC 61850-9-2 (Sampled Values over Ethernet) and IEC 61850-6 (SCL – Substation Configuration Language). It is written so that working groups can incorporate these measures into the protocol specifications and so product developers can implement them.

Key topics and technical requirements

• Protocol coverage: Security provisions for MMS-based Client/Server, XMPP, Sampled Values (SV) and GOOSE-related profiles derived from IEC 61850.
• Messages, procedures and algorithms: Defines the mechanisms required to protect IEC 61850-derived communications (authentication, integrity and confidentiality measures are covered via defined algorithms and message formats).
• Replay protection: Specific state machines and procedures for GOOSE and Sampled Values to detect and mitigate replay attacks.
• Layer‑2 security & extended PDUs: Extensions to L2 packet formats to carry security metadata (including support for MAC domains and authenticated encryption such as AES‑GCM for L2 GOOSE/SV packets).
• SNTP security: Security considerations for time synchronization over SNTP within IEC 61850 environments.
• SCL extensions: Substation Configuration Language extensions for declaring security capabilities, publish-with-security options and key management policies.
• Conformance and testing: Requirements, PICS tables and conformance profiles (including TLS for MMS/ISO-9506 profiles and ACSE authentication, VLAN and SNTP profile conformance).

Practical applications & who uses it

• Product developers building IEDs, substations and control‑center software will use IEC 62351-6 to implement secure GOOSE, SV, MMS and XMPP communication stacks.
• Standards working groups reference this document to incorporate security measures into IEC 61850 parts and profiles.
• System integrators and utilities rely on it to design secure substation-to-control-center and intra-substation communications and to define device capabilities in SCL files.
• Security architects and managers use the standard to understand required protections (replay protection, L2 security, time synchronization security) when defining procurement and cybersecurity policies for power utility automation.

Related standards (for implementation context)

• IEC 61850 series (configuration, GOOSE, SV, MMS mappings)
• ISO/IEC 9506 (MMS)
• IEC 62351 family (other parts addressing communication security, e.g., TLS, key management)

Keywords: IEC 62351-6, IEC 61850 security, GOOSE security, Sampled Values security, SNTP security, substation configuration language, AES‑GCM, layer‑2 security, power utility automation, MMS, XMPP.