8-4
D30 Line Distance Protection System
GE Multilin
8.2 CYBERSENTRY
8 SECURITY
8
8.2CYBERSENTRY
8.2.1 OVERVIEW
CyberSentry Embedded Security is a software option that provides advanced security services through the following:
•
An Authentication, Authorization, Accounting (AAA) Remote Authentication Dial-In User Service (RADIUS) client that
is centrally managed, enables user attribution, provides accounting of all user activities, and uses secure standards-
based strong cryptography for authentication and credential protection.
•
A Role-Based Access Control (RBAC) system that provides a permission model that allows access to UR device oper-
ations and configurations based on specific roles and individual user accounts configured on the AAA server (that is,
Administrator, Supervisor, Engineer, Operator, Observer).
•
Security event reporting through the Syslog protocol for supporting Security Information Event Management (SIEM)
systems for centralized cybersecurity monitoring.
•
Strong encryption of all access and configuration network messages between the EnerVista software and UR devices
using the Secure Shell (SSH) protocol, the Advanced Encryption Standard (AES), and 128-bit keys in Galois Counter
Mode (GCM) as specified in the U.S. National Security Agency Suite B extension for SSH and approved by the
National Institute of Standards and Technology (NIST) FIPS-140-2 standards for cryptographic systems.
Example:
Administrative functions can be segmented away from common operator functions, or engineering type access,
all of which are defined by separate roles, as shown in the following figure, so that access of UR devices by multiple per-
sonnel within a substation is allowed. Permission for each role are outlined in the table later in this section.
Figure 8–1: CYBERSENTRY USER ROLES
There are two types of authentication supported by CyberSentry that can be used to access the UR device:
•
Local Authentication (local UR device authenticates)
•
Remote Authentication (RADIUS server authenticates)
The EnerVista software allows access to functionality that is determined by the user role, which comes either from the local
UR device or RADIUS server.
The EnerVista software has a local authentication option on the login screen for accessing the UR device. When the "Local"
button is selected, the UR uses its local authentication database and not the RADIUS server to authenticate the user. In this
case, it uses its built-in roles (Administrator, Engineer, Supervisor, Observer, Operator) as login names and the associated
passwords are stored on the UR device. As such, when using the local accounts, access is not user-attributable.
Summary of Contents for D30D00HCHF8AH6AM6BP8BX7A
Page 10: ...x D30 Line Distance Protection System GE Multilin TABLE OF CONTENTS...
Page 374: ...5 248 D30 Line Distance Protection System GE Multilin 5 10 TESTING 5 SETTINGS 5...
Page 398: ...6 24 D30 Line Distance Protection System GE Multilin 6 5 PRODUCT INFORMATION 6 ACTUAL VALUES 6...
Page 410: ...7 12 D30 Line Distance Protection System GE Multilin 7 2 TARGETS 7 COMMANDS AND TARGETS 7...
Page 444: ...9 24 D30 Line Distance Protection System GE Multilin 9 5 FAULT LOCATOR 9 THEORY OF OPERATION 9...
Page 576: ...B 102 D30 Line Distance Protection System GE Multilin B 4 MEMORY MAPPING APPENDIX B B...
Page 616: ...D 10 D30 Line Distance Protection System GE Multilin D 1 IEC 60870 5 104 PROTOCOL APPENDIX D D...
Page 628: ...E 12 D30 Line Distance Protection System GE Multilin E 2 DNP POINT LISTS APPENDIX E E...
Page 636: ...F 8 D30 Line Distance Protection System GE Multilin F 3 WARRANTY APPENDIX F F...
Page 646: ...x D30 Line Distance Protection System GE Multilin INDEX...
