Abstract: It has been found that there are some cyber security risks in the communication process of distribution automation system(DAS)based on IEC60870-5-104protocol．In order to realize mutual authentication and shared key establishment for DAS Front-End Processor(FEP)and any terminal,this article presented a scheme based on unidirectional digital signature and unidirectional Keyed-Hashing for Message Authentication(HMAC)algorithm．It analyzed the features of communication network architecture based on EPON in DAS,the corresponding cyber security risks and security requirements,showed the implementation procedure of the scheme．The scheme needs not change original software and hardware of legacy terminals and considers resource-constraint terminals by using dedicated security devices．Security analysis proves that the scheme can resist outsider attack,replay attack and impersonation attack．Compared with the related works,the proposed scheme is more secure and practical,which can satisfy the application requirement.

Key words: Distribution automation,Cyber security,IEC60870-5-104protocol,Digital signature,HMAC algorithm