Substation Security Research Articles

Implementation of a Trust-Based Framework for Substation Defense in the Smart Grid

The Smart Grid is a cyber-integrated power grid that manages electricity generation, transmission, and distribution to consumers and central to its functioning is the substation. However, integrating cyber-infrastructure into the substation has increased its attack surface. Notably, sophisticated attacks such as the PipeDream APT exploit multiple device protocols, such as Modbus, DNP3, and IEC61850. The substation’s constraints pose challenges for implementing security measures such as encryption and intrusion detection systems. To address this, we propose a comprehensive trust-based framework aimed at enhancing substation security. The framework comprises a trust model, a risk posture model, and a trust transferability model. The trust model detects protocol-based attacks on Intelligent Electronic Devices and SCADA HMI systems, while the risk posture model dynamically assesses the substation’s risk posture. The trust transferability model evaluates the feasibility of transferring and integrating a device and its trust capabilities into a different substation. The practical substation emulation involves a Docker-based testbed, employing a multi-agent architecture with a real-time Security Operations Center-influenced dashboard. Assessment involves testing against attacks guided by the MITRE ICS ATT&CK framework. Our framework displays resilience against diverse attacks, identifies malicious behavior, and rewards trustworthy devices.

Application of 5G communication technology on intelligent inspection in 750kV substation

Ultra-high voltage AC substation has the characteristics of high voltage level, large area, complex equipment structure, heavy inspection task and high operation risk. The existing video surveillance system is mainly used for substation security, but the distribution of points is insufficient and the clarity is low, so it can’t achieve full coverage of inspection points. UHV AC substation needs to develop remote intelligent inspection system to assist operation and maintenance staffs to carry out daily inspection work, reduce the workload of operation and maintenance staffs, improve the speed of emergency response and ensure the safety of operation. In this paper, remote intelligent inspection system of substation based on 5G communication transmission technology is proposed in 750kV substation, so as to achieve the purpose of intelligent inspection of substation, and expand the idea for the application of 5G technology in substation.

Research on optimal layout of Video Surveillance in the Smart Grid based on Multi-dimensional Evaluation Objectives

The video surveillance is a key technology, which is one of the design technology for the ubiquitous perception and acquisition of panoramic information in the smart grid. The remote video surveillance technology and power automation systems such as remote control, telemetry, remote sensing and remote signal, which ensure the normal operation of the whole smart grid, can greatly improve the security of important substations or unmanned substations. At present, there is not a unified standard for video surveillance layout of the smart grid. The video surveillance system in each area is often arranged with reference to the requirements and habits of the operation and maintenance in the region. But, other important factors are not taken into account. In this paper, by constructing the objective function of multi-dimensional evaluation, the optimal layout scheme of video surveillance in the smart grid is obtained. Finally, the effectiveness of the proposed method is proved by the analysis of the cases.

Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations

Integration of Information and Communication Technology (ICT) in modern smart grids (SGs) offers many advantages including the use of renewables and an effective way to protect, control and monitor the energy transmission and distribution. To reach an optimal operation of future energy systems, availability, integrity and confidentiality of data should be guaranteed. Research on the cyber-physical security of electrical substations based on IEC 61850 is still at an early stage. In the present work, we first model the network traffic data in electrical substations, then, we present a statistical Anomaly Detection (AD) method to detect Denial of Service (DoS) attacks against the Generic Object Oriented Substation Event (GOOSE) network communication. According to interpretations on the self-similarity and the Long-Range Dependency (LRD) of the data, an Auto-Regressive Fractionally Integrated Moving Average (ARFIMA) model was shown to describe well the GOOSE communication in the substation process network. Based on this ARFIMA-model and in view of cyber-physical security, an effective model-based AD method is developed and analyzed. Two variants of the statistical AD considering statistical hypothesis testing based on the Generalized Likelihood Ratio Test (GLRT) and the cumulative sum (CUSUM) are presented to detect flooding attacks that might affect the availability of the data. Our work presents a novel AD method, with two different variants, tailored to the specific features of the GOOSE traffic in IEC 61850 substations. The statistical AD is capable of detecting anomalies at unknown change times under the realistic assumption of unknown model parameters. The performance of both variants of the AD method is validated and assessed using data collected from a simulation case study. We perform several Monte-Carlo simulations under different noise variances. The detection delay is provided for each detector and it represents the number of discrete time samples after which an anomaly is detected. In fact, our statistical AD method with both variants (CUSUM and GLRT) has around half the false positive rate and a smaller detection delay when compared with two of the closest works found in the literature. Our AD approach based on the GLRT detector has the smallest false positive rate among all considered approaches. Whereas, our AD approach based on the CUSUM test has the lowest false negative rate thus the best detection rate. Depending on the requirements as well as the costs of false alarms or missed anomalies, both variants of our statistical detection method can be used and are further analyzed using composite detection metrics.

Research on sequence automatic execution technology of substation safety measures

With the increasing complexity of the power grid, in order to ensure the reliability and stability of the power supply system, higher requirements are imposed on the automation level of the power system. Substation security measures are generally performed manually, and maintenance personnel need to cast and withdraw pressure plates one by one based on the automatically generated secondary security measures, and manually verify the results of each step. This paper proposes a technology for the automatic execution of security measures in substations. Based on the generated security measures, it implements automatic sequence control operations and has proofreading functions. This method improves the level of substation automation while ensuring the correct execution results of safety measures, and provides an important guarantee for the safe and stable operation of the power system.

An Adaptive Encryption-as-a-Service Architecture Based on Fog Computing for Real-Time Substation Communications

The recent outbreak of industrial cyberattacks indicates that the current industrial network security architecture is under serious challenges. As one of the critical industrial networks, the heterogeneous and real-time substation network lacks compatibility with the conventional cryptography architecture represented by secure sockets layer/transport layer security (SSL/TLS) and public key infrastructure (PKI). To enhance the security of smart substations under the premise of low latency, in this article, we present a novel encryption-as-a-service architecture based on fog computing in this article. The architecture offloads encryption to dedicated devices and makes certificate and key management available through unified web services on the fog and cloud layers. Based on this architecture, we propose MX-SORTS, maximizing security on real-time communication of different services, an algorithm for adaptive configuration of encrypting and signing substation network traffic. By the contrast experiments with the conventional cryptography architecture, we prove that the encryption-as-a-service architecture can significantly improve the real-time and security performance of substation networks.

Discussion on The Construction of Substation Security Video Surveillance System

The construction of security video surveillance system is the key to ensure the normal operation of substation. In order to ensure that this system can play its intended role, this paper will first analyze the defects existing in the application process of video surveillance system of existing power enterprises. And then based on this, the core technologies to be applied in the new substation security video surveillance system are introduced. The third section and the fourth section respectively discuss the design and construction methods of the hardware system and software system in the system.

A Protection Method Based on Message Identification and Flow Monitoring for Managing the Congestion Arising From Network Attacks on Smart Substation

The information security of smart substations has become a major issue, as substations become increasingly dependent on communication networks. This letter analyzes the data flows in the communication networks of smart substations and proposes a protection method based on message identification and flow monitoring for managing the congestion arising from network attacks. This method implements the rapid identification and filtering of messages by condensing key information into a message information tag and then examines the tag along with the traffic rates at switches to identify and discard counterfeit messages. OPNET simulation results show that the method successfully identifies and discards counterfeit messages and avoids timeouts and packet drops in the transmission process of authentic messages during periods of congestion.

Toward Threat of Implementation Attacks on Substation Security: Case Study on Fault Detection and Isolation

Modern and future substations are aimed to be more interconnected, leveraging communication standards like IEC 61850-9-2, and associated abstract data models and communication services like generic object oriented substation event, manufacturing message specification, and sampled measured value. Such interconnection would enable fast and secure data transfer, sharing of the analytics information for various purposes like wide area monitoring, faster outage recovery, blackout prevention, distributed state estimation, etc. This would require strong focus on communication security, both at system level as well as at embedded device level. Although communication level security is dealt in IEC 62351, implementation attack on the embedded system is not considered. Since the embedded system makes the core of the smart grid, in this paper, we take a deeper look into impact of implementation attacks on substation security. An overview of potential exploits is first provided. This is followed by a case study, where implementation attacks like malicious fault injection attacks and hardware Trojan are used to compromise a substation level intelligent electronic device. The studied scenario extends implementation attacks beyond its usual exploit of confidentiality to affect power grid integrity and availability.

Monitoring and Operation Analysis on Power Environment of Computer Room Based on Big Data

Based on the requirement of the Reduce of power information network failures, the power environment monitoring system based on big data is designed and implemented. The system includes five application modules: acquisition and monitoring module, resource management module, analysis and decision module, alarm center module and configuration management module. An improvement of Apriori algorithm by the unique design array which is used for data analysis can enhance efficiency of the algorithm. The system based on Big Data technology, by the efficient analysis of power data, environmental data, main data and external Data, to achieve a comprehensive perception of monitoring and operation analysis on power environment of computer room based on big data, intelligent auxiliary user decisions. Through research and implementation of the project, we can realize real-time monitoring of the video and the environment of the substation, besides we can locate and prevent the various alarms (fire, flooding and theft, etc.) timely. Providing effective technical support for staff remote inspection and troubleshooting. The project can prevent accidents, combat crime, protect property, ensure that the system is stable, and make the substation security technology improving to a new level.

Propogation characteristics of PD‐induced UHF signal in 126 kV GIS with three‐phase construction based on time–frequency analysis

Partial discharge (PD) detection of the gas-insulated switchgear (GIS) is an effective method for substation security. The GIS with three-phase construction is widely used for substations. The propagation characteristics of PD-induced ultra-high-frequency (UHF) signal in three-phase GIS is investigated in this study by time–frequency analysis method. The variation of peak-to-peak value (V pp) and cumulative energy, and especially the energy density in the time–frequency plane are used to represent the feature of the UHF signal. Furthermore, the different situation of the insulation defects and the detection point positions are compared, and the reason for the difference is explained as well. As a result, this study identified a novel method to determine the PD source position in the GIS with three-phase construction.

Physical and cyber security in a smart grid environment

As a critical infrastructure, the electric power grid is vulnerable with respect to malicious physical and cyber attacks. Indeed, the importance of physical and cyber security for smart grids has been highlighted by recent intrusion incidents worldwide. Various types of sensors, instrumentation, information and communications technology (ICT), computational methodologies, and security controls have been developed to enhance the physical and cyber security of the smart grid. In this paper, critical vulnerabilities of a smart grid that can be exploited for physical and cyber intrusions are discussed. A comprehensive survey is conducted on the state‐of‐the‐art research to enhance the physical and cyber security in a smart grid environment. Furthermore, the interdependency of physical and cyber security is illustrated with an intrusion scenario. The emphasis is on the physical and cyber security of power substations. Computer simulation results for a case study are presented. WIREs Energy Environ 2016, 5:519–542. doi: 10.1002/wene.202This article is categorized under: Energy Infrastructure > Systems and Infrastructure

On-line physical security monitoring of power substations

Summary Power grid facilities can be vulnerable with respect to malicious physical attacks. An advanced system to monitor physical security of substations and other facilities is essential to maintain system integrity. This paper describes a substation physical security monitoring (SPSM) system for remote monitoring of power substations. The proposed methodology consists of video surveillance for outdoors, motion detectors for indoors, and the classification of intrusion events. An important feature of the proposed method is the ability to determine the response to a threat based on the result of physical security monitoring. In addition, industry experience from two transmission system operators (TSOs) is incorporated in the development of the methodology. To validate the proposed SPSM system, an experiment was performed at a critical substation involving two physical intrusion scenarios. Copyright © 2015 John Wiley & Sons, Ltd.

Authentication and authorization mechanisms for substation automation in smart grid network

Supervisory control and data acquisition systems are used extensively to control and monitor critical infrastructure including power, gas, oil, and water. To integrate intelligent electronic devices in smart grid infrastructure, the utilities are deploying substation automation systems (SASs) and extensive communication networks, but there is growing concern about SCADA security including substation security. Although there are several solutions utilized to prevent security threats in SCADA networks, existing SCADA networks still have severe shortcomings. In this article, we propose a lightweight and efficient security solution for SASs that provides multilevel multi-factor authentication and attribute-based authorization by deploying public key certificates, and zero-knowledge protocol-based server-aided verification and access control mechanisms using attribute certificates. It can be seen that the proposed approach is efficient and robust.

Security of industrial sensor network-based remote substations in the context of the Internet of Things

The main objective of remote substations is to provide the central system with sensitive information from critical infrastructures, such as generation, distribution or transmission power systems. Wireless sensor networks have been recently applied in this particular context due to their attractive services and inherent benefits, such as simplicity, reliability and cost savings. However, as the number of control and data acquisition systems that use the Internet infrastructure to connect to substations increases, it is necessary to consider what connectivity model the sensor infrastructure should follow: either completely isolated from the Internet or integrated with it as part of the Internet of Things paradigm. This paper therefore addresses this question by providing a thorough analysis of both security requirements and infrastructural requirements corresponding to all those TCP/IP integration strategies that can be applicable to networks with constrained computational resources.

Unmanned substations employ multimedia network RTUs

The so-called multimedia network RTU featured in this article integrates real-time video capturing and transmission, audio analysis and electric equipment diagnosis, global positioning system (GPS), substation security supervision, and Internet protocol (IP) communication into traditional RTUs. This article: Describes three key features of the proposed system distinguishing it from the existing RTUs Details the hardware and software architecture and functions of MNRTU Provides a typical application example in Shanxi province that verifies the availability and advance of MNRTU.

An expert system for comprehensive on-line economic-security controls of distribution systems

This paper presents an architecture which assists the system operator to perform comprehensive controls in a distribution SCADA environment. A typical zone substation and open-ended multiple outgoing feeder group is used as an example for testing the validity of the approach. The paper first reviews a prototype expert system which was developed by the authors to help operators provide sufficient security margins against overloading by meeting certain heuristic operating guidelines. Next, the paper describes new functions of the expert system aiming for comprehensive controls of each zone substation: (1) generalized operating guidelines for meeting security constraints for all loads; (2) additional procedures for removing any existing busbar/feeder overload, restoring customer loads after each feeder fault and/or repair, reconfiguring busbar connections after each supply transformer outage, and reducing distribution losses on one feeder group at a time; (3) tracking substation load variations for continuous security monitoring and assessment of substation security; (4) additional numerical modules for minimizing overall distribution losses, and knowledge-based assessment of overvoltages due to inter-zone substation switching.