ABB Relion REX610, Manual

Page: 18 / 36

3.4 Secure communication
The protection relay supports secure communication for file transfer protocol using
Transport Layer Security protocol. File transfer client must use explicit FTPS to
communicate to the relay.
FTPS is always enabled by default but the relay also supports FTP communication.
PCM600 always uses FTPS to communicate with the relay.
It is recommended to always use FTPS communication.
3.4.1 Certificate handling
For encryption and secure identification, FTPS protocols in the protection relay use
public key certificates that bind together a public key with an identity, that is,
information such as the name of an organization, their address and so on. The
server certificate used by the protection relay is generated by the relay itself as a
self-signed certificate and not issued by any certification authority (CA).
Certificates use encryption to provide secure communication over the network. A
self-signed X.509 certificate and an RSA key-pair with key-length of 1024 bits is
generated by the protection relay. The RSA key stored in the certificate is used to
establish secure communication.
The certificate is used to verify that a public key belongs to an identity. The public
key is one part of an asymmetric key algorithm in which one key is used to encrypt
a message and another key is used to decrypt it. The public private key pair
(asymmetric key) is used to exchange the symmetric key, which is used to encrypt
and decrypt the data that is exchanged between server and client.
Messages encrypted with the public key can only be decrypted with the other part
of the algorithm, the private key. Public and private key are related mathematically
and represent a cryptographic key pair. The private key is kept secret and stored
safely in the protection relay, while the public key may be widely distributed.
Once the protection relay certificate has been manually trusted in a separate dialog
box, the certificate is trusted in communication between the relay and PCM600.
3.4.2 Encryption algorithms
TLS connections are encrypted with either AES 256 or AES 128. At start-up a
negotiation decides between these two options.
Section 3
2NGA000818 A
Secure system setup
12 REX610
Cyber Security Deployment Guideline