The IEC 60870-5-104 (IEC 104) protocol serves as the backbone for communication between Control Centers and substations in electrical power systems. Unlike legacy serial protocols, IEC 104 bridges the gap between field-level telecontrol requirements and standard TCP/IP networking, enabling wide-area monitoring and control. However, this transition to Ethernet-based transport introduces complexities in state management, framing, and exposure to network-level vulnerabilities that were previously mitigated by physical isolation.

To understand IEC 104, one must look past the transport layer and examine the Application Protocol Data Unit (APDU) structure. It is not merely a wrapper for serial data; it is a state-aware protocol that manages control flow through specific sequence numbering and acknowledgment mechanisms, which are critical for ensuring data integrity in time-sensitive power grid operations.

The Architecture of the APDU

An IEC 104 frame consists of an Application Protocol Control Information (APCI) header and an Application Protocol Data Unit (ASDU). The APCI is fixed at six bytes, providing the framing necessary to identify the start of a message, the length of the PDU, and the sequence numbers for both transmit (TX) and receive (RX) buffers.

Byte 0: Start Byte (0x68)
Byte 1: APDU Length (excluding start and length bytes)
Byte 2-3: Send Sequence Number (N(S))
Byte 4-5: Receive Sequence Number (N(R))

The sequence numbering mechanism is the heartbeat of the protocol. Because TCP guarantees ordered delivery, the sequence numbers in IEC 104 function primarily as an application-layer flow control mechanism. If the receiver’s unacknowledged frame count exceeds a threshold (k), the sender must pause transmission. This prevents buffer overflows in resource-constrained embedded RTUs (Remote Terminal Units).

Operational States and Flow Control

IEC 104 operates in a stateful manner, requiring a specific sequence of initialization frames (STARTDT) before data transfer can commence. This handshake establishes the session context. Once the session is active, the protocol differentiates between I-frames (information transfer), S-frames (supervisory/acknowledgment), and U-frames (unconfirmed control).

• I-frames: Used for actual telemetry and command signals, carrying the ASDU.
• S-frames: Used to acknowledge receipt of I-frames when no data is being sent back.
• U-frames: Used for link management, such as STARTDT and STOPDT commands.

Mismanagement of these states—specifically the inability to properly handle the window size ‘k’ or the timeout ‘t1’—often results in connection drops. In high-latency wide-area networks, tuning these timers is a delicate balance between responsiveness and network stability.

Security Boundaries and Vulnerabilities

The primary security failure of IEC 104 is its lack of inherent authentication or encryption. The protocol assumes a trusted network environment. When deployed over public or semi-private infrastructure, the lack of cryptographic signatures allows for trivial man-in-the-middle (MITM) attacks, including command injection and replay attacks.

Because IEC 104 lacks native authentication, the security boundary is effectively defined by the perimeter firewall and the physical security of the network switches. In modern grid architectures, this is insufficient.

Attackers can perform reconnaissance by sniffing traffic, as the protocol is plain-text. By capturing a valid control command, an attacker can replay that command to manipulate circuit breakers or change setpoints, provided they can spoof the sequence numbers required by the target RTU.

Hardening the Communication Path

To mitigate these risks, engineers must implement compensating controls. The most effective approach is the use of an IPSec VPN tunnel or TLS-based encapsulation to wrap the IEC 104 traffic. This moves the security responsibility from the application layer to the transport layer, effectively creating a cryptographically secure tunnel.

Deep Packet Inspection (DPI) firewalls are also essential. A properly configured DPI firewall can inspect the ASDU content to ensure that only authorized commands are sent to specific RTUs, effectively creating a whitelist-based access control policy for industrial operations.

Conclusion

IEC 104 is a robust protocol designed for reliability in power systems, but its design predates modern cybersecurity threats. Understanding the nuances of its framing, state management, and sequence numbering is vital for engineers tasked with maintaining grid stability. By recognizing that the protocol itself provides no security, engineers can better architect systems that layer necessary encryption and access control, ensuring that the legacy of reliability is not compromised by the realities of modern connectivity.