IEC 62351-9:2017

Overview

IEC 62351-9:2017 specifies cryptographic key management practices for power system equipment. It defines how to generate, distribute, renew and revoke asymmetric (private/public-key certificates) and symmetric (group) keys to protect digital data and communications in power systems. The standard focuses on management techniques (not on selecting cryptographic algorithms) and aims to ensure interoperability among vendors by constraining key-management options. It assumes readers understand cryptography and PKI principles.

Key topics and requirements

• Scope: Management of asymmetric keys, public‑key certificates and symmetric group keys (GDOI).
• Lifecycle management: Requirements for key/certificate generation, enrolment, renewal, revocation and expiry; certificate profiles and lifecycle diagrams.
• Trust models: Use of PKI (CAs, RAs, trust anchors), non‑PKI self‑signed certificates, Authorization and Validation Lists (AVLs), and pre‑shared keys.
• Certificate processes: Certificate Signing Requests (CSRs), initial enrolment, CRLs, OCSP, SCVP and options for short‑lived certificates.
• Protocols & mechanisms: Support and guidance for enrolment and management protocols such as SCEP, CMP, CMC, EST, and Trust Anchor Management Protocol (TAMP).
• Group key management: Group Domain of Interpretation (GDOI) and IKEv1 exchanges for secure group key distribution (useful for multicast/real‑time data).
• Transport and session keys: Use of TLS and session-key handling for secure channels.
• Security controls: Cryptographic key protection, random number generation guidance (informative annex), and Protocol Implementation Conformance Statement (PICS).
• Interoperability focus: Limits and options defined to guarantee cross‑vendor interoperability in power system operations.

Practical applications

IEC 62351-9 is applied where robust key management is required to secure:

• Substation automation and protection communications (including multicast messaging and IEC 61850 data).
• Control center to field device communications and SCADA telemetry.
• Secure firmware provisioning, device enrolment and remote key lifecycle operations.
• Group communications (e.g., GOOSE/SV multicast) where synchronized group keys are needed. The standard helps utilities, vendors and integrators implement repeatable, auditable key management capable of meeting operational and compliance needs.

Who should use this standard

• Utility cybersecurity architects and engineers
• Device and system vendors (IEDs, RTUs, gateways)
• PKI and Certificate Authority administrators
• System integrators and implementers of IEC 61850 / SCADA security
• Compliance and security auditors in the energy sector

Related standards and keywords

• Related IEC 62351 parts (data/communications security) and IEC 61850 (substation automation)
• Keywords: IEC 62351-9, key management, PKI, GDOI, certificate management, OCSP, CRL, SCEP, EST, IKEv1, TLS, power system cybersecurity, cryptographic key lifecycle.