User's Manual
Table Of Contents
- Table of Contents
- List of Tables
- List of Figures
- Figure1.1 Typical SEL3022 and SEL5810 Virtual Serial Software Application 1.2
- Figure1.2 Encrypted Packet Stream 1.4
- Figure1.3 Typical Connections for the SEL3022 1.6
- Figure1.4 Typical Alarm Output Installation 1.8
- Figure2.1 SEL3022 Dimension Drawing 2.2
- Figure2.2 Windows Run Command 2.3
- Figure2.3 Product Unregistered Prompt 2.4
- Figure2.4 Select a Device Type to Create 2.7
- Figure2.5 Specify New Device Location 2.8
- Figure2.6 Opening Device 2.8
- Figure2.7 Identification Screen 2.9
- Figure2.8 Status: Device 2.10
- Figure2.9 Settings: Wireless 2.10
- Figure2.10 Settings: WEP Keys 2.11
- Figure2.11 Settings: User 2.11
- Figure2.12 Settings: Operator 2.12
- Figure2.13 Settings: Security Officer 2.12
- Figure2.14 Confirm Send Prompt 2.13
- Figure2.15 Send Operation Message 2.13
- Figure2.16 Select Items to Print 2.14
- Figure2.17 Print Window 2.14
- Figure3.1 Remotely Located Recloser Control 3.2
- Figure3.2 Job Done Example SEL-5809 Top Level View 3.3
- Figure3.3 Select a Wireless Session for DNP3 Job Done Example 3.4
- Figure3.4 Settings: DCE Port 3.4
- Figure3.5 Status: Virtual Serial Port With Connection Status Red 3.5
- Figure3.6 Communication Parameters Window in acSELerator 3.6
- Figure3.7 Status: Virtual Serial Port With Connection Status Green 3.6
- Figure3.8 Reading Settings Via the SEL3022 3.7
- Figure3.9 Monitoring SEL651R Meter Data Via the SEL3022 3.8
- Figure3.10 Status: Virtual Serial Port Connection Status Red 3.9
- Figure3.11 Specify Device to Export to SEL5810 Virtual Serial Software 3.10
- Figure3.12 Export Encrypted User Configuration File 3.10
- Figure3.13 Store Encrypted File 3.11
- Figure3.14 Password Prompt in SEL5810 Virtual Serial Software 3.12
- Figure3.15 Communication Parameters Window in acSELerator 3.13
- Figure3.16 Reading SER Report Via acSELerator 3.14
- FigureB.1 PC to SEL3022 Connection B.2
- FigureB.2 SEL3022 and SEL-5809 Connection Parameters B.2
- FigureB.3 SEL5809 Settings Software Connection Method B.3
- FigureB.4 SEL-5809 Opening Connection B.3
- FigureB.5 Status: Device Window B.4
- FigureB.6 Confirmation Prompt B.4
- FigureB.7 Send Operation Prompt B.4
- FigureB.8 Configuring Serial Port Settings in the Terminal Software B.5
- FigureB.9 Send File Prompt B.6
- FigureB.10 Sending Confirmation Window B.6
- FigureB.11 Terminal Invalid Firmware Error Message B.7
- FigureB.12 Terminal Valid Firmware Message B.7
- FigureC.1 Two Independent Layers of Cryptographic Security Protect the SEL3022 Wireless Operato...
- FigureC.2 Operation of the HMAC SHA-1 Keyed Hash Authentication Function C.9
- FigureC.3 Operation of the AES Encryption Function C.10
- FigureC.4 SEL3022 Security Application Overview C.11
- FigureC.5 Wireless Interface Session Authentication Dialog C.15
- Preface
- Introduction & Specifications
- Installation
- Job Done Example
- Settings and Commands
- Testing and Troubleshooting
- Firmware and Manual Versions
- Firmware Upgrade Instructions
- Wireless Operator Interface Security
- Introduction
- Wireless Interface Security Overview
- IEEE 802.11 WEP Security
- The SEL Security Application
- Certificates
- Glossary
Date Code 20050615 Instruction Manual SEL-3022 Transceiver
Wireless Operator Interface Security
The SEL Security Application
C.9
Cryptographic Manual—Do Not Copy
The SEL Security Application
The SEL Security Application consists of an authentication and encryption scheme that
provides very strong data security. Authentication verifies message integrity (i.e., the
message has not been altered). Encryption conceals the contents of the message. The
combination of the two security techniques provides a state-of-the-art encryption and
authentication system with a key strength greater than 128 bits. Proof of the security
strength is detailed in the following sections.
HMAC SHA-1 Authentication Overview
The HMAC SHA-1 function provides protection against frame alteration and ensures
(with extremely high probability) that the digital integrity of every frame remains
intact. With a 128-bit-long authentication key, the HMAC SHA-1 function also
provides strong frame authentication capability that allows confirmation that an
authorized device transmitted the frame.
The National Institute of Standards and Technology (NIST) developed the SHA-1 one-
way hash algorithm in 1993. NIST developed the Keyed-Hash Message Authentication
Code (HMAC) algorithm in 2002. The SEL-3022 uses the proven SHA-1 one-way
hash algorithm to form the NIST-approved HMAC SHA-1 keyed hash function.
The HMAC SHA-1 function takes a variable-length message and an authentication key
as input and generates a 160-bit-long, fixed-length hash output value. The hash output
is a condensed fingerprint or signature of the message input (see Figure C.2).
Figure C.2 Operation of the HMAC SHA-1 Keyed
Hash Authentication Function
The 128-bit-long secret key gives the HMAC SHA-1 algorithm a strong built-in
authentication capability. If an attacker changes the contents of the message, then the
hash value appended to the message would not match the value that results from a
newly calculated hash value over the new, altered message. Because the HMAC SHA-1
function is keyed (i.e., uses a secret authentication key to form the hash output), an
attacker without knowledge of the authentication key value would be unable to
recalculate a new, valid hash value over the altered message appended to the new
message to hide the fact that the message has been altered.
Authentication Key
Digital Message
"Fingerprint"
Message
HMAC
Function
Preliminary Copy