User's Manual
Table Of Contents
- Table of Contents
- List of Tables
- List of Figures
- Figure1.1 Typical SEL3022 and SEL5810 Virtual Serial Software Application 1.2
- Figure1.2 Encrypted Packet Stream 1.4
- Figure1.3 Typical Connections for the SEL3022 1.6
- Figure1.4 Typical Alarm Output Installation 1.8
- Figure2.1 SEL3022 Dimension Drawing 2.2
- Figure2.2 Windows Run Command 2.3
- Figure2.3 Product Unregistered Prompt 2.4
- Figure2.4 Select a Device Type to Create 2.7
- Figure2.5 Specify New Device Location 2.8
- Figure2.6 Opening Device 2.8
- Figure2.7 Identification Screen 2.9
- Figure2.8 Status: Device 2.10
- Figure2.9 Settings: Wireless 2.10
- Figure2.10 Settings: WEP Keys 2.11
- Figure2.11 Settings: User 2.11
- Figure2.12 Settings: Operator 2.12
- Figure2.13 Settings: Security Officer 2.12
- Figure2.14 Confirm Send Prompt 2.13
- Figure2.15 Send Operation Message 2.13
- Figure2.16 Select Items to Print 2.14
- Figure2.17 Print Window 2.14
- Figure3.1 Remotely Located Recloser Control 3.2
- Figure3.2 Job Done Example SEL-5809 Top Level View 3.3
- Figure3.3 Select a Wireless Session for DNP3 Job Done Example 3.4
- Figure3.4 Settings: DCE Port 3.4
- Figure3.5 Status: Virtual Serial Port With Connection Status Red 3.5
- Figure3.6 Communication Parameters Window in acSELerator 3.6
- Figure3.7 Status: Virtual Serial Port With Connection Status Green 3.6
- Figure3.8 Reading Settings Via the SEL3022 3.7
- Figure3.9 Monitoring SEL651R Meter Data Via the SEL3022 3.8
- Figure3.10 Status: Virtual Serial Port Connection Status Red 3.9
- Figure3.11 Specify Device to Export to SEL5810 Virtual Serial Software 3.10
- Figure3.12 Export Encrypted User Configuration File 3.10
- Figure3.13 Store Encrypted File 3.11
- Figure3.14 Password Prompt in SEL5810 Virtual Serial Software 3.12
- Figure3.15 Communication Parameters Window in acSELerator 3.13
- Figure3.16 Reading SER Report Via acSELerator 3.14
- FigureB.1 PC to SEL3022 Connection B.2
- FigureB.2 SEL3022 and SEL-5809 Connection Parameters B.2
- FigureB.3 SEL5809 Settings Software Connection Method B.3
- FigureB.4 SEL-5809 Opening Connection B.3
- FigureB.5 Status: Device Window B.4
- FigureB.6 Confirmation Prompt B.4
- FigureB.7 Send Operation Prompt B.4
- FigureB.8 Configuring Serial Port Settings in the Terminal Software B.5
- FigureB.9 Send File Prompt B.6
- FigureB.10 Sending Confirmation Window B.6
- FigureB.11 Terminal Invalid Firmware Error Message B.7
- FigureB.12 Terminal Valid Firmware Message B.7
- FigureC.1 Two Independent Layers of Cryptographic Security Protect the SEL3022 Wireless Operato...
- FigureC.2 Operation of the HMAC SHA-1 Keyed Hash Authentication Function C.9
- FigureC.3 Operation of the AES Encryption Function C.10
- FigureC.4 SEL3022 Security Application Overview C.11
- FigureC.5 Wireless Interface Session Authentication Dialog C.15
- Preface
- Introduction & Specifications
- Installation
- Job Done Example
- Settings and Commands
- Testing and Troubleshooting
- Firmware and Manual Versions
- Firmware Upgrade Instructions
- Wireless Operator Interface Security
- Introduction
- Wireless Interface Security Overview
- IEEE 802.11 WEP Security
- The SEL Security Application
- Certificates
- Glossary
Date Code 20050615 Instruction Manual SEL-3022 Transceiver
Wireless Operator Interface Security
Wireless Interface Security Overview
C.3
Cryptographic Manual—Do Not Copy
Application. The data frames must then AES decrypt and HMAC SHA-1 authenticate.
If the SEL Security decryption or authentication fails, the SEL Security Application
discards these data frames and disconnects. In summary, before the SEL-3022
considers data to be valid, the data must AES decrypt, HMAC SHA-1 authenticate, and
WEP decrypt correctly, or the data are discarded. The process is reversed for the
transmission and encryption process.
The SEL-3022/SEL-5809 Settings Software includes the following wireless security
features:
➤ 104-Bit Wired Equivalent Privacy (WEP) Encryption: The WEP
encryption function, provided by the 802.11b wireless LAN module,
is always enabled and active on the SEL-3022.
➤ 128-Bit Advanced Encryption Standard (AES) Encryption:
Because of the relative weakness of the WEP encryption function, the
SEL-3022 also incorporates an independent layer of AES encryption.
➤ 128-Bit HMAC SHA-1 Frame Authentication: Every frame
transmitted on the wireless operator interface is cryptographically
authenticated to prevent malicious tampering and to guarantee
acceptance of only those frames that authorized users transmit.
➤ Message Replay Protection: The SEL-3022 uses frame sequence
numbers with HMAC SHA-1 authentication to ensure that individual
frames cannot be retransmitted to cause malicious actions.
➤ Session Replay Protection: The SEL-3022 uses a robust challenge-
response session authentication protocol to guarantee that wireless
operator sessions cannot be replayed to cause malicious actions.
➤ AES and HMAC Session Key Exchange: The SEL-3022 exchanges
unique, randomly-generated encryption and authentication keys on
each wireless session connection. This limits the amount of data
protected by any single key value and strengthens the SEL-3022
against cryptanalytic attacks.
➤ Wireless Session Password: A configurable password is required to
open a wireless connection with the SEL-3022. This password is
never stored in the configuration software device image, so it cannot
be compromised by theft of a configured maintenance PC containing
the wireless encryption and authentication keys. In the event of a lost
Preliminary Copy