Overview
IEC TR 62351-90-2:2018 - "Power systems management and associated information exchange - Data and communications security - Part 90-2: Deep packet inspection of encrypted communications" is a technical report from IEC TC57. It examines how to perform Deep Packet Inspection (DPI) on communication channels used in power systems that are secured under the IEC 62351 family (including TLS and message-level protections). The report surveys the state-of-the-art DPI techniques, describes implementation costs and security risks, and proposes additional approaches to address limitations of existing solutions.
Key topics and technical focus
- Scope and use cases: monitoring, auditing and validation needs for utilities and vendors when inspecting traffic to/from IEDs, SCADA, MMS and other power-system endpoints.
- Encrypted channel types: channels secured by IEC 62351 (including TLS-based profiles) and channels that provide integrity/non‑repudiation but are not encrypted.
- DPI techniques evaluated:
- Unencrypted TLS (inspection without encryption)
- Private-key sharing approaches
- Proxy and middlebox solutions
- Advanced middlebox methods (e.g., mcTLS-like concepts)
- Secure session-key sharing and delayed session-key sharing
- Application‑level mirroring and message mirroring
- Additional proposals such as secure private-key sharing
- Evaluation framework: criteria for assessing DPI methods - security risks, interoperability, performance and implementation cost.
- Practical considerations: recommendations to mitigate risks (e.g., eavesdropping and key compromise), auditability and operational implications.
Applications and who uses it
- Utilities and grid operators needing DPI for intrusion detection, protocol validation and compliance monitoring.
- Security architects and network engineers designing inspection capabilities for substations, control centers and corporate networks.
- Vendors of DPI, SIEM, IDS/IPS and middlebox solutions integrating with IEC 62351-secured protocols.
- Compliance officers and auditors evaluating monitoring strategies that balance observability with cryptographic protections.
Practical uses include enabling DPI for:
- SCADA and IEC 61850/IEC 60870‑5 communications,
- MMS and management traffic covered by IEC 62351,
- Forensic analysis, real-time anomaly detection and regulatory auditing in power systems.
Related standards
- IEC 62351-3 (TCP/IP and network profiles)
- IEC TS 62351-4 (MMS profiles)
- IEC TS 62351-5 (IEC 60870‑5 security)
- IEC TS 62351-6 (IEC 61850 security)
- IEC 62351-7 (NSM data models)
- IEC TS 62351-8 (Role-based access control)
IEC TR 62351-90-2 is a practical reference for teams who must reconcile strong encryption in power-system communications with operational DPI and monitoring needs, while understanding trade-offs in security, privacy and cost.