Generic Object Oriented Substation Event Messages Research Articles

A novel hybrid methodology to secure GOOSE messages against cyberattacks in smart grids

IEC 61850 is emerging as a popular communication standard for smart grids. Standardized communication in smart grids has an unwanted consequence of higher vulnerability to cyber-attacks. Attackers exploit the standardized semantics of the communication protocols to launch different types of attacks such as false data injection (FDI) attacks. Hence, there is a need to develop a cybersecurity testbed and novel mitigation strategies to study the impact of attacks and mitigate them. This paper presents a testbed and methodology to simulate FDI attacks on IEC 61850 standard compliant Generic Object-Oriented Substation Events (GOOSE) protocol using real time digital simulator (RTDS) together with open-source tools such as Snort and Wireshark. Furthermore, a novel hybrid cybersecurity solution by the name of sequence content resolver is proposed to counter such attacks on the GOOSE protocol in smart grids. Utilizing the developed testbed FDI attacks in the form of replay and masquerade attacks on are launched and the impact of attacks on electrical side is studied. Finally, the proposed hybrid cybersecurity solution is implemented with the developed testbed and its effectiveness is demonstrated.

Rainbow Signature Scheme to Secure GOOSE Communications From Quantum Computer Attacks

The International Electrotechnical Commission (IEC) 62351-6 standard prescribes provisions to secure IEC 61850-8-1 generic object-oriented substation events (GOOSE) communications from cyber threats. The GOOSE authentication schemes recommended by IEC 62351-6 have shortcomings, such as long authentication-value computation times, large signature lengths, the usage of symmetric keys, and susceptibility to quantum computer attacks. To overcome these, this paper proposes the usage of the rainbow signature scheme (RSS), a quantum cryptographic method to secure GOOSE messages. The RSS offers fast signature generation and verification using asymmetric keys, making it very attractive to meet the time-latency and security requirements of the GOOSE protocol. The adaptation of the RSS cryptography method for its application to the GOOSE protocol is presented in this paper. The algorithms for key generation, signature computation and message verification are discussed in detail. A first-of-its-kind C library that incorporates security features within the GOOSE protocol in compliance with the IEC 62351-6-stipulated format, is developed. The superior features of the RSS in comparison with the other IEC 62351-6 security schemes are demonstrated.

Machine Learning-Based Intrusion Detection for Achieving Cybersecurity in Smart Grids Using IEC 61850 GOOSE Messages

Increased connectivity is required to implement novel coordination and control schemes. IEC 61850-based communication solutions have become popular due to many reasons—object-oriented modeling capability, interoperable connectivity and strong communication protocols, to name a few. However, communication infrastructure is not well-equipped with cybersecurity mechanisms for secure operation. Unlike online banking systems that have been running such security systems for decades, smart grid cybersecurity is an emerging field. To achieve security at all levels, operational technology-based security is also needed. To address this need, this paper develops an intrusion detection system for smart grids utilizing IEC 61850’s Generic Object-Oriented Substation Event (GOOSE) messages. The system is developed with machine learning and is able to monitor the communication traffic of a given power system and distinguish normal events from abnormal ones, i.e., attacks. The designed system is implemented and tested with a realistic IEC 61850 GOOSE message dataset under symmetric and asymmetric fault conditions in the power system. The results show that the proposed system can successfully distinguish normal power system events from cyberattacks with high accuracy. This ensures that smart grids have intrusion detection in addition to cybersecurity features attached to exchanged messages.

A Fixed-Latency Architecture to Secure GOOSE and Sampled Value Messages in Substation Systems

International Electrotechnical Commission (IEC) 62351-6 standard specifies the security mechanisms to protect real-time communications based on IEC 61850. Generic Object Oriented Substation Events (GOOSE) and Sampled Value (SV) messages must be generated, transmitted and processed in less than 3 ms, which challenges the introduction of IEC 62351-6. After evaluating the security threats to IEC 61850 communications and the state of the art in GOOSE and SV security, this work presents a novel architecture based on wire-speed processing able to provide message authentication and confidentiality. This architecture has been implemented and tested to evaluate its performance, resource usage, and the latency introduced. Other proposals in the scientific literature do not support real-time traffic, so they are not suitable for GOOSE and SV messages. Whereas the others exceed the target latency of 3 ms or do not comply with the standards, our design authenticates and encrypts real-time IEC 61850 data in less than 7 μs-predictable latency-, and complies with IEC 62351:2020.

A Method for Achieving Confidentiality and Integrity in IEC 61850 GOOSE Messages

IEC 62351-6 standard stipulates the use of digital signatures for ensuring integrity and authenticity in IEC 61850 Generic Object-Oriented Substation Events (GOOSE) message exchanges. Yet, it does not specify any method for ensuring confidentiality in GOOSE messages. With rapid growth of IEC 61850 from substation automation to power management domain, sensitive data that requires privacy is carried over GOOSE messages. In this letter, a novel method employing Authenticated Encryption with Associated Data (AEAD) algorithms is proposed to achieve both confidentiality and integrity of GOOSE messages. Further, lab tests are run to observe the timing performance and applicability of these algorithms to GOOSE messages with strict timing requirements.

Network traffic prediction for detecting DDoS attacks in IEC 61850 communication networks

This article presents the development of a Generic Object Oriented Substation Event (GOOSE) message traffic prediction system using a Nonlinear Autoregressive Model with Exogenous Input (NARX) input. An Artificial Neural Network was adopted to detect Distributed Denial-of-Service (DDoS) attacks in networks using the IEC-61850 protocol. The system uses the OpenFlow protocol to split the multicast groups of GOOSE messages, in which each transmission is analysed separately. The implemented intelligent system used 62 prediction steps with a percentage relative error of up to 5%. The system was embedded in the ZYBO development platform with the OpenMul controller. The results showed that the percentage relative error of each sample presents a determinant signature for classifying the state of operation of the electrical system, making it possible to identify DDoS attacks in communication networks for electric power substations.

Event-Based Simulation of a Decentralized Protection System Based on Secured GOOSE Messages

A new simulation library is developed on OMNeT++ to model faults in distribution systems. The proposed library makes it possible to calculate the status of lines and busbars from the point of view of a protection system, enabling the modeling of overcurrents, power outages and fault passage indicators. The library is applied to model a decentralized protection system based on the exchange of IEC 61850 Generic Object Oriented Substation Events (GOOSE) messages between intelligent electronic devices responsible for the operation of circuit breakers and disconnectors. The time needed to secure and transmit GOOSE messages over the Internet is characterized and included in the model. Several studies are carried out to analyze the effect of different parameters, such as GOOSE retransmission times and failure rates of switching devices and communication channels, on the performance of the protection system.

Analysis of GOOSE message and the engineering application for GOOSE message in the intelligent substation

Generic Object Oriented Substation Event (GOOSE) message reflects the transmission of information between many intelligent electronic devices, which is more reliable as original data. The communication Ethernet opaque also leads to a big problem of information extraction analysis, limiting the development of state maintenance and other techniques. This study describes the process equipment and the network transmission technology of the intelligent substation and analyses the specified message format of IEC61850. The study then compares it with the characteristics of the typical intelligent substation message and gives the analysis method and the meaning of each byte in the actual message frame, making the communication network in the process layer more transparent and giving a clear direction of information acquisitions and analysis. It also provides some reference meanings to the intelligent substation communication and the equipment status analysis.

New Method for OC Relay Coordination

Protection relays design and manufacture have arrived to a new level of advancement; hence, numerical relays have appeared recently. They combine all the functions of monitoring, control, and protection in one device. Also these relays have the ability to communicate with each other to share statuses and orders using GOOSE (generic object‐oriented substation events) messages based on communication protocols such as IEC61850. In this paper, a proposed method for overcurrent (OC) relay coordination has been introduced based on numerical relay features of several setting groups and communication capability. This work supposes that the coordination between feeder, bus section, and incomer protection relays, in a substation of single busbar configuration with bus sectionalizer (i.e., bus section), depends on the status of the bus section circuit breaker (CB) as a criterion for determining active relay setting group, to achieve a faster tripping action. ETAP has been used as a simulation software environment. And the simulation results show the advantages of the proposed method in reducing the time needed by the relay to clear the electrical fault. Siemens SIPROTEC series have been used as an example of numerical relays, specifically 7SJ64 as OC relay, which exists in the ETAP library.

Data-Centric Communication Framework for Multicast IEC 61850 Routable GOOSE Messages over the WAN in Modern Power Systems

In this paper, a data-centric communication framework is proposed for multicast routable generic object-oriented substation event (GOOSE) messages (MRGM) over the wide area network (WAN) for effective substation-to-substation (SS2SS) and substation to control center (SS2CC) communications. In this structure, the IEC 61850 GOOSE message is transmitted over the WAN using the data distribution service (DDS) as a fast, reliable, and secure data-centric communication middleware. The main feature of this framework is its multicast capability, where several authorized subscribers can receive a published message simultaneously. This can significantly improve the system monitoring and control of the protection systems in modern smart grids, where intelligent schemes can be applied. The effectiveness of the proposed platform, in terms of total end-to-end delay between participants, is evaluated through experimental results obtained from the actual hardware-based test setup developed at the Florida International University (FIU) smart grid testbed. The results demonstrate that the latency between sending and receiving a GOOSE message among participants is within its maximum time span defined by the IEC 61850-90-5 working group for communications over the WAN.

Doubly-Fed Induction Generator Coordination Control Strategy Compatible with Feeder Automation

To solve the problem of incompatibility and mutual repulsion between a distribution network (DN) and distributed generation (DG), this paper first analyzes the conflicts between current feeder automation (FA) and doubly-fed induction generation (DFIG). Then, a DFIG coordination control strategy compatible with FA is proposed to cause the DFIG operating continuously during fault isolation and power supply recovery. The strategy consists of three aspects: (1) a DFIG islanding active synchronization control technology to support islanding and distant presynchronization control; (2) DFIG senses the status of circuit breakers/tie-switch through generic object oriented substation event (GOOSE) messages to achieve rapid switch of control modes and distant synchronization; (3) tie-switch senses the status of DFIG through GOOSE messages for closing. Finally, the effectiveness of the strategy is validated by multiple sound and detailed time-domain simulation cases. This study indicates future possible development trends and provides a simple and effective strategy for researches in the field of smart grid DN–DG compatibility.

S-GoSV: Framework for Generating Secure IEC 61850 GOOSE and Sample Value Messages

Standardized communication plays an important role in substation automation system (SAS). IEC 61850 is a de-facto standard in SAS. It facilitates smooth communication between different devices located in the substation by achieving interoperability. Generic Object-Oriented Substation Event (GOOSE) and Sample Value (SV) messages developed according to IEC 61850 enable efficient monitoring and operation control of SAS. IEC 61850 is very popular due to its flexible and robust modeling. As the number of critical infrastructures that employed IEC 61850 increases, it is important to study cybersecurity aspects as well. To this end, this paper develops a software framework, S-GoSV (Secure GOOSE and SV), that generates custom GOOSE and Sample Value messages. Furthermore, security features are added to protect them from different security attacks within a substation. IEC 62351-6 specifies digital signatures to achieve node authentication and messages integrity. Therefore, S-GoSV implements RSASSA-PKCS1-v1_5 digital signature algorithm based on RFC 2313. Performance studies show that digital signature algorithms based on RSA signing and verification take long times and do not conform to timing requirements stipulated by IEC 61850 for power system communication. To address this, Message Authentication Code (MAC) based digital signature algorithm, Keyed Hash-Message Authentication Code- Secure Hash Algorithm (HMAC-SHA256), is additionally implemented in S-GoSV framework for securing GOOSE messages.

Analyzing Reliability of the Communication for Secure and Highly Available GOOSE-Based Logic Selectivity

In an electrical distribution network, Logic Selectivity significantly reduces both the number and duration of outages. Generic Object-Oriented Substation Events (GOOSE) have a key role in the decision-making process of substation protection devices using GOOSE-based Logic Selectivity. GOOSE messages are exchanged between remote protection devices over the communication network. Secured communication with low latency and high reliability is therefore required in order to ensure reliable operation as well as meeting real-time requirement of the Logic Selectivity application. There is thus a need to evaluate feasibility of the selected communication network technology for Logic Selectivity use cases. This paper analyzes reliability of cellular 4G/LTE Internet for GOOSE communication in a Logic Selectivity application. For this purpose, experimental lab set-ups are introduced for different configurations: ordinary GOOSE communication, secured GOOSE communication by IPsec in Transport mode, and redundant GOOSE communication using the IEC 62439-3 Parallel Redundancy Protocol. In each configuration, the GOOSE retransmissions are recorded for a period of three days and the average GOOSE transmission time is measured. Furthermore, the measured data is classified into histograms and a probability value for communication reliability, based on the transmission time, is calculated. The statistical analysis shows that 4G Internet satisfies the real-time and reliability requirements for secure and highly available GOOSE-based Logic Selectivity.

Performance Evaluation and Analysis of IEC 62351-6 Probabilistic Signature Scheme for Securing GOOSE Messages

Cyber security is a growing concern in power systems. To achieve security requirements such as authentication and integrity for generic object-oriented substation event (GOOSE) messages, IEC 62351-6 standard recommends using digital signatures. Furthermore, it explicitly specifies to use RSASSA-Probabilistic Signature Scheme (PSS) digital signature algorithm based on RFC 3447. Power systems run in real-time and implemented cybersecurity measures have to strictly meet timing requirements. Therefore, it is very important to study performances of such methods and contrast them with the timing requirements stipulated by grid operations, e.g., power system protection enforces a maximum delay of 3 ms. In this fashion, it can be analyzed whether a recommended cyber security mechanism is fit for use in power systems. In previous works, only RSA digital signatures were studied and its performance evaluation in terms of computational times for securing GOOSE messages have been studied. This paper analyses the timing performance of RSASSA-PSS digital signature algorithm for securing the GOOSE messages. This is important to assess its feasibility for IEC 61850-based networks, as specified by the IEC 62351-6 standard. RSASSA-PSS digital signature algorithm is implemented in Python and verification times are calculated. The results show that RSASSA-PKCS1-v1_5 1024 key digital signatures provide improved performance compared with other RSA digital signature schemes. That being said, none of the algorithms is fast enough to be implemented for time-critical operations such as protection coordination.

Analysis and Implementation of Message Authentication Code (MAC) Algorithms for GOOSE Message Security

There is growing awareness towards cybersecurity threats in power systems. IEC 61850 standard facilitates communication between different Intelligent Electronic devices (IEDs) and eases interoperable operation with set data and message structures. An unwanted consequence of this standardized communication over ethernet is increased viability to cyber threats. The IEC 62351-6 standard stipulates the use of digital signatures for ensuring integrity in IEC 61850 message exchanges. However, the digital signatures result in higher computational times which makes it very difficult to use for Generic Object-Oriented Substation Events (GOOSE) messages. This short communication article proposes implementation of the Message Authentication Code (MAC) algorithms, such as Hash-based Message Authentication Code (HMAC) and Advanced Encryption Standard-Galois Message Authentication Code (AES-GMAC), for GOOSE message integrity. Lab tests are run to observe their timing performances and feasibility for GOOSE.

An Efficient Behavior-based Intrusion Detection System Using OC-ELM for Intelligent Substation in Smart Grid

Generic Object Oriented Substation Events (GOOSE), as an essential component of IEC 61850 communication standard, plays an important role in intelligent substation. Any abnormal change of GOOSE field values could cause substation automatic system failures, incorrect switching, or physical damages in the field devices, which will result in probably catastrophic losses. To mitigate the risks caused by vulnerabilities of GOOSE protocol, a behavior-based intrusion detection system is proposed. Different from the existing proposed approaches, considering there is no attack traffic in intelligent substation network so far, one class classifier is used to model the normal behaviors. Compared to the existing approaches, it can usually detect much more complex attacks. To specify the proposed system, when giving a GOOSE message, we first convert it into a feature vector with a specific approach. Considering only normal GOOSE messages are given, One Class classifier with Extreme Learning Machine (OC-ELM) is used to model the information embedded in the normal training set. Extensive experiments demonstrate the efficiency and effectiveness of the proposed intrusion detection system.

A new methodology for real-time detection of attacks in IEC 61850-based systems

This paper presents a new methodology to detect spoofing attacks concerning Generic Object Oriented Substation Event (GOOSE) messages in IEC 61850 communication systems. The methodology is based on anomaly detection, in which GOOSE messages are characterized by observing the correct operation of the power system and any variation of the normal behavior is classified as an intrusion. To validate this methodology, a pulse generation logic was configured to communicate among Intelligent Electronic Devices (IEDs), which were prone to replication attacks and tampering messages. The results show that the IEDs are vulnerable to such attacks, and that the Intrusion Detection Systems (IDS) of corporate networks are not able to deal with specific attacks in IEC 61850. Considering this, real time tools are needed to analyze GOOSE messages in order to identify intrusion. The software proposed in this paper was very efficient in detecting replication and falsification messages.

Tunneling Horizontal IEC 61850 Traffic through Audio Video Bridging Streams for Flexible Microgrid Control and Protection

In this paper, it is argued that some low-level aspects of the usual IEC 61850 mapping to Ethernet are not well suited to microgrids due to their dynamic nature and geographical distribution as compared to substations. It is proposed that the integration of IEEE time-sensitive networking (TSN) concepts (which are currently implemented as audio video bridging (AVB) technologies) within an IEC 61850 / Manufacturing Message Specification framework provides a flexible and reconfigurable platform capable of overcoming such issues. A prototype test platform and bump-in-the-wire device for tunneling horizontal traffic through AVB are described. Experimental results are presented for sending IEC 61850 GOOSE (generic object oriented substation events) and SV (sampled values) messages through AVB tunnels. The obtained results verify that IEC 61850 event and sampled data may be reliably transported within the proposed framework with very low latency, even over a congested network. It is argued that since AVB streams can be flexibly configured from one or more central locations, and bandwidth reserved for their data ensuring predictability of delivery, this gives a solution which seems significantly more reliable than a pure MMS-based solution.

RT-HIL Implementation of the Hybrid Synchrophasor and GOOSE-Based Passive Islanding Schemes

Real-time hardware-in-the-loop performance assessment of three different passive islanding detection methods for local and wide-area synchrophasor measurements is carried out in this paper. Islanding detection algorithms are deployed within the phasor measurement unit (PMU) using logic equations. Tripping decisions are based on local and wide-area synchrophasors as computed by the PMU, and trips are generated using IEC 61850-8-1 generic object-oriented substation event messages. The performance assessment compares these islanding detection schemes for the nondetection zone and operation speed under different operating conditions. The testbench that is demonstrated is useful for a myriad of applications where simulation exercises in power system computer-aided design software provide no realistic insight into the practical design and implementation challenges. Finally, different communication latencies introduced due to the utilization of synchrophasors and IEC 61850-8-1 GOOSE messages are determined.

An ANN based forecast for IED network management using the IEC61850 standard

This paper presents the development of a forecast approach to manage IED networks using the IEC 61850 Standard. This is achieved by monitoring a special network occupancy parameter, which properly measures the traffic and behavior of Generic Object Oriented Substation Event (GOOSE) messages in the underlying network bandwidth. A small-scale station bus network was setup in a laboratory to test the proposed strategy. The tests revealed that IED functions may be deteriorated when the network parameter surpasses 5–15% of the available bandwidth, depending on the IED manufacturer and model. A piece of software was created to continuously calculate these parameters in the network, as well as a specially designed Artificial Neural Network, responsible for forecasting the bandwidth occupation. The software monitors and reports any possible changes in the performance of GOOSE messages, which makes it possible to use adaptive strategies in order to ensure the proper operation and performance of the protection and automation schemes.