PLX51-HART-4I / PLX51-HART-4O
♦
HART Input/Output
Operation
Multidrop Field Devices
User Manual
ProSoft Technology, Inc.
Page 68 of 127
4.3.1 DNP3 Security
DNP3 offers Secure Authentication for links at risk of being attacked. There are
various Key Change methods, Message Authentication Code (MAC) algorithms, and
Authentication methods provided in the DNP3 protocol specification.
Various keys are used in DNP3 Secure Authentication. Session keys are used most
frequently as it is used for Authentication of the requests. These keys are updated by
the DNP3 master at a certain interval or every time there has been a message
failure. The DNP3 master encrypts these keys before sending them across the wire
using the Key Wrap Algorithm selected and the Update key. The Update Key can be
updated in numerous ways (including sending it across the wire with another set of
Keys encrypting that message).
The modules support DNP3 Secure Authentication 5, using the Pre-Shared Key
method for Key Changes. Thus, the Update Key needs to be entered into each
device by means outside of the DNP3 protocol.
In the PLX50 Configuration Utility the user can write the Update Key into the module
using the Key tab in the Online Status window. The key entered must match the Key
Wrap Algorithm selected. Thus, if AES-128 Key Wrap was selected the Update Key
must be 128-bit (16 bytes) long. If AES-256 Key Wrap was selected the Update Key
must be 256-bit (32 bytes) long. The user can either enter a predetermined
hexadecimal code of create a new code in the PLX50 Configuration Utility as shown
below. This key is encrypted and sent to the module where it is saved into the NV
memory of the module.
Important
: The Key update method in the PLX50 Configuration Utility is a
write-only
function. Thus
once the key has been downloaded the user will not be able to view the key again. Thus the user must
make provision to document or save the key in a secure manner.
Important
: The DNP3 master device must have the same Update Key and security configuration
settings as that of the module. Failing to do this will result in failed data exchange for critical messages.
Figure 4.11 - HART 4 DNP3 key update method.
The module supports all DNP3 MAC algorithms and Key Wrap algorithms. The
module also supports Aggressive Authentication mode which reduces the amount of
traffic on the network (which could be required on busy networks or serial
communication).