Advanced connectivity in substations brings along cybersecurity considerations. Especially, the use of standardized data objects and message structures stipulated by IEC 61850 makes them much more vulnerable to unauth...Advanced connectivity in substations brings along cybersecurity considerations. Especially, the use of standardized data objects and message structures stipulated by IEC 61850 makes them much more vulnerable to unauthorized access and manipulation. In order to tackle these vulnerabilities, different methods are investigated by researchers all over the world. An important aspect of such efforts is the real-time performance consideration since power systems are bound by the rules of physics and all control/communication tasks need to be completed in a certain time frame. Security schemes for substation communication have been proposed in the recent literature. However, they must be improved to ensure a full security solution. Recently published IEC 62351 standard aims to fill this gap. Node authentication is vital for substation communication networks based on IEC 61850 to mitigate a variety of attacks such as man-in-the-middle(MITM) attack. This short communication presents a node authentication mechanism based on transport layer security(TLS) with certificates to address this knowledge gap. It also investigates the real-time performance by implementing the proposed scheme with Python.展开更多
文摘网络攻击正向工业控制系统渗透。电能量采集关系到各方面经济利益,及时获取精准的电量数据尤为重要。基于IEC 62351标准对采用网络传输的102规约进行了网络安全性改造,在传输层增加传输层安全(transport layer security,TLS)协议,应用层采用哈希运算消息认证码(Hash-based message authentication code,HMAC)对报文应用服务数据单元(application service data unit,ASDU)进行安全性校验,实现电能量采集系统主子站间通信加密、认证和完整性校验功能。测试电能量采集系统102规约改造前后主子站间通信的认证时间、单帧数据增加时间等关键数据指标。测试结果表明:应用层改造环节消耗较多时间,在报文帧数量大的情况下会严重影响通信效率。综合比较,当TLS使用国密SM4加密套件时,整体性能较优。
文摘Advanced connectivity in substations brings along cybersecurity considerations. Especially, the use of standardized data objects and message structures stipulated by IEC 61850 makes them much more vulnerable to unauthorized access and manipulation. In order to tackle these vulnerabilities, different methods are investigated by researchers all over the world. An important aspect of such efforts is the real-time performance consideration since power systems are bound by the rules of physics and all control/communication tasks need to be completed in a certain time frame. Security schemes for substation communication have been proposed in the recent literature. However, they must be improved to ensure a full security solution. Recently published IEC 62351 standard aims to fill this gap. Node authentication is vital for substation communication networks based on IEC 61850 to mitigate a variety of attacks such as man-in-the-middle(MITM) attack. This short communication presents a node authentication mechanism based on transport layer security(TLS) with certificates to address this knowledge gap. It also investigates the real-time performance by implementing the proposed scheme with Python.
