APARIAN A-DNP3R, Руководство пользователя

Страница: 24 / 108

Setup
Document No. D109-010 Page 24 of 108
Revision 1.15
MAC Algorithm The MAC algorithm is used to encrypt the challenge data for secure
authentication. DNP3 allows for various encryption standards in different formats
to be used for secure authentication:
HMAC SHA-1 encryption (4 octets – serial) – for legacy support
HMAC SHA-1 encryption (8 octets – serial)
HMAC SHA-1 encryption (10 octets – networked)
HMAC SHA-256 encryption (8 octets – serial)
HMAC SHA-256 encryption (16 octets – networked)
AES-GMAC (12 octets)
Key Wrap Algorithm DNP3 uses various keys for secure authentication. The keys that are used for data
exchange and called the session keys and these keys may be updated frequently.
To exchange the session keys between two DNP3 devices the update key (refer
to the Secure Authentication section for further detail) is used to encrypt the data
and session keys before exchanging it between parties. DNP3 allows for two
standards to encrypt the session keys:
AES-128 Key Wrap
AES-256 Key Wrap
Aggressive Mode To reduce the bandwidth used for secure authentication the user can select
aggressive mode which allows the message initiator to anticipate and provide the
required authentication in the request message. Thus from a network point of
view there is a two message exchange for secure authentication compared to the
normal four message exchange for secure authentication.
Link Unsolicited and
Aggressive Mode CSQ Ensure that the Challenge Sequence Numbers (CSQ) of unsolicited requests and
Aggressive Mode requests are the same.
Secure Optional Critical
Functions
When secure authentication is enabled there are various mandatory and optional
application functions that must be authenticated before data can be exchanged.
The optional functions can be selected in the box.
Mandatory functions, e.g. Operate, are therefore not included in the options list.
Table 3.3 – Security configuration parameters
NOTE: For further information regarding the security settings refer to the
Security section.
The security configuration is shown in the figure below. The DNP3 Security configuration
window is opened by either double clicking on the module in the tree or right-clicking the
module and selecting
Configuration. Once in the configuration window, select the second tab
at the top Security .
NOTE: The actual pre-shared key cannot be included in the configuration. It
can only be written to the DNP3 Router when online via the Status window.