IEC 104 Before the Wire: Understanding Its Architecture, Framing, and Security Boundaries

IEC 60870-5-104 (IEC 104) is an integral part of the IEC 60870-5 telecontrol family, designed to transmit SCADA telemetry and control information over packet-switched networks in electrical power systems. To grasp its inner workings before delving into raw packets, it's essential to comprehend how IEC 104 is structured, how its communication state is managed, and where its security boundaries lie.

IEC 104 communicates over TCP, typically using port 2404. Two key protocol components are crucial: APCI (Application Protocol Control Information) and ASDU (Application Service Data Unit). APCI manages framing, sequencing, acknowledgments, and connection control, while ASDU carries actual telecontrol information.

Each APDU (Application Protocol Data Unit) starts with a 0x68 start byte, followed by a length field and four control bytes. The length indicates the number of bytes that follow, encompassing the four control bytes and, if present, the ASDU. This fixed structure forms the basis for understanding IEC 104 traffic.

IEC 104 defines three APDU formats:

1. I-Format: Carries application information, containing an ASDU, and two sequence numbers: N(S) (send sequence number) and N(R) (receive sequence number). These numbers facilitate ordered transmission and acknowledgment state across stations.

2. S-Format: Supervisory frames that do not carry an ASDU. They serve to transmit receive acknowledgments independently of application data.

3. U-Format: Handles connection-control functions, including STARTDT (Start data transfer), STOPDT (Stop data transfer), and TESTFR (Test the communication relationship).

A critical distinction exists between a TCP connection and an IEC 104 data-transfer session. TCP connection establishes transport connectivity, while IEC 104 manages application-level communication state.

When an I-format frame carries application data, the ASDU defines its meaning. A simplified ASDU structure includes:

- Type Identification

- Variable Structure Qualifier

- Cause of Transmission

- Common Address

- Information Object

- Information Elements

The Type ID identifies the information type being transmitted, while the VSQ indicates the number of information objects present and whether their addressing follows a sequential structure. The COT provides context for why the ASDU is transmitted, potentially indicating events such as spontaneous transmission, interrogation responses, activation, activation confirmation, or termination. Finally, the CA and IOA fields define the addressing model for identifying telemetry and control points.

The base IEC 104 protocol lacks cryptographic security features, such as cryptographic peer authentication, confidentiality, and integrity protection. Historically, this responsibility fell on the network architecture. However, IEC 62351 defines security mechanisms for power-system communication, including TLS-based profiles for TCP/IP protocols, providing confidentiality, integrity protection, and message-level authentication.

The security question arises: What security profile does the deployed implementation support, and is it actually enabled and correctly configured? The protocol architecture presents several areas for investigation, including session state handling (STARTDT and STOPDT), sequence state synchronization (N(S) and N(R) values), and the potential attack surface resulting from these architectural decisions.