from gurux_dlms.objects import GXDLMSClock, GXDLMSDisconnectControl
from gurux_dlms.enums import Security

def operate_secure_objects(client, reader):
    # Enforce Suite 1 Authentication + Encryption
    client.ciphering.security = Security.AUTHENTICATION_ENCRYPTION
    
    # 1. Read Protected Clock (Class 8)
    clock = GXDLMSClock("0.0.1.0.0.255")
    current_time = reader.read(clock, 2)
    print(f"[+] Current Protected Meter Time: {current_time}")
    
    # 2. Execute Protected Disconnect Control (Class 70)
    relay = GXDLMSDisconnectControl("0.0.96.3.10.255")
    reader.method(relay, 1, 0) # Method 1: remote_disconnect
    print("[+] Breaker successfully tripped via encrypted Action-Request.")

Summary Checklist:

1. Access Matrix: Verify Association LN object_list access modes (IEC 62056-62 Table 42).
2. Encrypted Access: Wrap Class 8 / Class 70 in 0xDB General-Glo-Ciphering.
3. Security Policy: Default HES management associations to Security.AUTHENTICATION_ENCRYPTION.

00 01 00 01 00 01 00 25 DB 08 53 48 41 00 00 00 00 01 30 00 00 00 03 44 19 82 77 1B C0 90 AA BB CC DD EE FF 00 11 22 33 44 55 66 77 88

Deciphering yields the 12-byte Date/Time octet string.

Even if a malicious party establishes a low-level association, they cannot tamper with Class 70 or Class 8 without possessing the Global Unicast Key (GUEK) and monotonically valid $IC$.

A client can operate in:

1. Pure Plain Mode: HLS 5 handshake, all subsequent APDUs plaintext 0xC0/0xC1/0xC3;
2. Pure Ciphered Mode: HLS 5 handshake, all subsequent APDUs encrypted 0xDB;
3. Mixed Mode: Low-sensitivity telemetry plain, high-sensitivity control actions encrypted.

To access an object marked authenticated_and_encrypted, the request must be wrapped inside General-Glo-Ciphering (0xDB) with Security Control 0x30 (AES-GCM-128 authentication + encryption):

Here is the correct ciphered request for Class 8 Clock:

00 01 00 01 00 01 00 23 DB 08 53 48 41 00 00 00 00 01 30 00 00 00 02 88 1A 2B C0 44 99 EE 12 33 44 55 66 77 88 99 AA BB CC DD EE FF

When transmitted with 0xDB encryption, the meter's access controller validates that encryption security requirements are satisfied and returns the encrypted Clock value!

Per DLMS Blue Book Ed. 17 Section 4.5.3 (Association LN Class 15) and IEC 62056-62 Section 6.2.23:
The Association LN object (OBIS 0.0.40.0.0.255) contains Attribute 2 object_list, which defines an access descriptor table for every object accessible under that client SAP:

ObjectAccessDescriptor ::= Structure {
  class_id: Long-Unsigned,
  logical_name: Octet-String (6B),
  access_rights: Structure {
    attribute_access_modes: Array [
      { attribute_id: 2, access_mode: Enum }
    ],
    method_access_modes: Array [
      { method_id: 1, access_mode: Enum }
    ]
  }
}

Access Mode Enumeration (IEC 62056-62 Table 42):

• 0 = no_access
• 1 = read_only (Plaintext allowed)
• 2 = write_only
• 3 = read_and_write
• 4 = authenticated_read
• 5 = authenticated_and_encrypted_read

For energy registers (Class 3), the access mode is often set to 1 (read_only).
For Clock (Class and Disconnect Control (Class 70), the access mode is configured as 5 (authenticated_and_encrypted). When you transmit a plain 0xC0 0x01 APDU, the meter enforces rule 5 and rejects with scope-of-access-violated!