PLX51-HART-4I / PLX51-HART-4O
♦
HART Input/Output
Setup
Multidrop Field Devices
User Manual
ProSoft Technology, Inc.
Page 37 of 127
3.6 DNP3 Security
If one of the DNP3 protocols (DNP3 TCP or DNP3 UDP) have been selected, then
the DNP3 Security tab will be enabled. This DNP3 Security configuration consists of
the following parameters:
Table 3.7 – DNP3 configuration parameters
Parameter
Description
Enable Security
DNP3 Secure Authentication can be enabled or disabled. When enabled
there will be no unsecured exchange of data (for critical functions).
Key Change Method
This setting determines the method by which security keys are exchanged
between two devices. Currently the HART 4 only supports the Pre-Shared
Key method. This method requires both devices to have update keys
entered by means outside the DNP3 protocol, (i.e. using PLX50
Configuration Utility).
MAC Algorithm
The MAC algorithm is used to encrypt the challenge data for secure
authentication. DNP3 allows for various encryption standards in different
formats to be used for secure authentication:
HMAC SHA-1 encryption (4 octets – serial) – for legacy support
HMAC SHA-1 encryption (8 octets – serial)
HMAC SHA-1 encryption (10 octets – networked)
HMAC SHA-256 encryption (8 octets – serial)
HMAC SHA-256 encryption (16 octets – networked)
AES-GMAC (12 octets)
Key Wrap Algorithm
DNP3 uses various keys for secure authentication. The keys that are used
for data exchange and called the session keys and these keys may be
updated frequently. To exchange the session keys between two DNP3
devices the update key (refer to the Secure Authentication section for
further detail) is used to encrypt the data and session keys before
exchanging it between parties. DNP3 allows for two standards to encrypt
the session keys:
AES-128 Key Wrap
AES-256 Key Wrap
Aggressive Mode
To reduce the bandwidth used for secure authentication the user can
select aggressive mode which allows the message initiator to anticipate
and provide the required authentication in the request message. Thus
from a network point of view there is a two message exchange for secure
authentication compared to the normal four message exchange for secure
authentication.
Secure Optional Critical
Functions
When secure authentication is enabled there are various mandatory and
optional application functions that must be authenticated before data can
be exchanged. The optional functions can be selected in the box.
Mandatory functions, e.g. Operate, are therefore not included in the
options list.
Note
: For further information regarding the security settings refer to the Security section.
The security configuration is shown in the figure below. The DNP3 Security
configuration window is opened by either double-clicking on the module in the tree or
right clicking the module and selecting
Configuration.
Once in the configuration
window select the
DNP3
tab at the top.
Note
: The actual pre-shared key cannot be included in the configuration. It can only be written to the
module when online via the Status window.