Securing the cloud-assisted smart grid

Abstract

Rapid elasticity, ubiquitous network access, and highly-reliable services are some of the desirable features of cloud computing that are attractive for building cloud-assisted data-intensive Smart Grid (SG) applications. However, the Distributed Denial-of-Service (DDoS) attacks represent a serious threat to the cloud-assisted SG applications. To mitigate the risk related to the DDoS threat, we propose an SG-relevant Hierarchical Hybrid Cloud-Extension Concept (HHCEC) along with a DDoS attack defense mechanism, termed as Port Hopping Spread Spectrum (PHSS). HHCEC is a cloud-assisted architecture designed to meet scalability and security requirements of the SG applications in the cloud. To prevent transport or application-layer DDoS attacks on HHCEC, PHSS switches the open port of server as a function of time and a secret shared between authorized clients and server, and thus efficiently dropping packets with closed port number. In addition, PHSS spreads the data packets over all the servers versus a single server to provide a robust protection against volume-based DDoS attacks that would affect some of the servers. This packet spreading approach enables PHSS to instantiate replica servers to take over the attacked servers without blocking the whole traffic by utilizing the rapid-elasticity characteristic of the cloud. Moreover, PHSS leverages a shuffling-based containment mechanism in order to quarantine malicious clients in a notably short time. Accordingly, the effect of a DDoS attack based on the compromised secret of the malicious clients is minimized. We evaluate our approach by building a proof-of-concept prototype using Amazon’s EC2 and the PlanetLab test-bed. In a DDoS attack scenario, the proposed approach obtains a significant availability enhancement of > 38% that highlight its efficiency in comparison to existing approaches. The results also indicate negligible overhead for the proposed approach compared to the plain system i.e., no additional latency and less than 0.01% throughput degradation.