Increased connectivity is required to implement novel coordination and control schemes. IEC 61850-based communication solutions have become popular due to many reasons—object-oriented modeling capability, interoperable connectivity and strong communication protocols, to name a few. However, communication infrastructure is not well-equipped with cybersecurity mechanisms for secure operation. Unlike online banking systems that have been running such security systems for decades, smart grid cybersecurity is an emerging field. To achieve security at all levels, operational technology-based security is also needed. To address this need, this paper develops an intrusion detection system for smart grids utilizing IEC 61850’s Generic Object-Oriented Substation Event (GOOSE) messages. The system is developed with machine learning and is able to monitor the communication traffic of a given power system and distinguish normal events from abnormal ones, i.e., attacks. The designed system is implemented and tested with a realistic IEC 61850 GOOSE message dataset under symmetric and asymmetric fault conditions in the power system. The results show that the proposed system can successfully distinguish normal power system events from cyberattacks with high accuracy. This ensures that smart grids have intrusion detection in addition to cybersecurity features attached to exchanged messages.

With the introduction of advanced monitoring and communication technologies, the legacy power system is evolving toward fully digitalized smart grid. The IEC 61850 standards have emerged as popular standards for automation of the power grid systems. However, modernization of the power grid has an unintended consequence of increased vulnerability to cyber-attacks. Among the emerging cyber threats, in this article we focus on false data injection attacks against generators in IEC 61850 compliant systems since this subject is not yet intensively studied in literature. We conduct the study on attack vectors against automated control logic for parallel generators and their feasibility, and conduct simulation experiments to demonstrate the attack impact. Based on the identified attack vectors, we further propose an efficient message authentication scheme. We investigate real-world control logic taken from the state-of-the-art smart grid test-bed for enumerating attack vectors. We further create virtual test-bed that is fully compliant to IEC 61850 standards for simulation study. The proposed message authentication schemes are implemented and intensively evaluated to demonstrate advantages over the other schemes. While effectively countering the identified attack vectors, the proposed message authentication scheme improves the latency by 16% compared to the scheme recommended in IEC 62351 standards.

Electrical substations play a crucial role in power grids. A number of international standards, such as IEC 60870 and 61850, have emerged to modernize substations for efficient and timely control. However, owing to insufficient security consideration and implementation, the digitization of a large number of connected substations could dramatically increase the scale of damage on power grids caused by cyber attacks. In this paper, we discuss the practical design, implementation, and deployment of active command mediation defense (A*CMD), a distributed cybersecurity solution to counter attacks injecting malicious remote control commands. A*CMD takes advantage of artificial command-delaying to realize an additional layer of security for each substation in an autonomous, decentralized manner. In particular, for grid operators to make appropriate delay configuration, the procedure to find tolerable delay for a power grid model of interest is formulated and demonstrated with multiple power grid models of different sizes. We further show practical deployment options of A*CMD along with proof-of-concept implementations, whose performance and stability are evaluated with a software-based smart-grid testbed.

The state-of-the-art digital signatures incur undesirable delays, hence are impractical for time-stringent Industrial Control Systems (ICSs). The recent revision to IEC 62351–6 standard stepped back from digital signatures in favor of symmetric key based solutions, thereby sacrificing key properties, e.g., scaling well for multiple destinations, easy key distribution and management, public verifiability, and non-repudiation. Inspired by the Online/Offline signatures, this paper presents a new digital signature model to provide the key properties of digital signatures within the delay requirements, hinting that this step back can be avoided. The Online/Offline signatures concept divides the signature generation into two phases; offline (before the message is given), online (using the outputs of the former for faster signing after the message is given). The conventional solutions following this concept potentially reduce the delay, yet do not meet IEC 61850 delay requirements as they still involve expensive operations in the online phase, and their offline phase hinders throughput. This paper introduces Less-online/More-offline Signatures (LoMoS) to enable minimal end-to-end delay and high message throughput. LoMoS entails avoiding expensive operations entirely during the online phase. We present a construction that converts any digital signature scheme into LoMoS, retains its properties, and unlike existing solutions, benefits from shorter messages.

Programmable Logic Controllers (PLCs) are essential components for enabling remote monitoring and automated control in industrial control systems. Recently PLCs are often utilized in a modernized power grid system for implementing an additional layer of automated control, such as operation of circuit breakers under specific conditions. Thus, in order to create a software-based smart grid testbed (or ‘cyber range’ for cyber security experiments); emulation of the PLC is imperative. OpenPLC is a software widely used for emulating PLCs, but unfortunately it does not support IEC 61850 standard, which is the globally adopted standard for substation automation in smart power grid systems. Thus, in this paper, the enhancement of OpenPLC to support IEC 61850 protocol and information models is discussed. The performance of the implementation has been validated to corroborate its application for use cases in the smart grid paradigm. Subsequently, the implementation is demonstrated in a smart grid cyber range to evaluate the impacts of attacks and thereby, the effectiveness of security measures and robustness of PLC control logic. The implementation, named ‘OpenPLC61850’, is made available as an open-source project for the wider research and industry community.

Climate change is increasing the frequency and the intensity of weather events, leading to large-scale disruptions to critical infrastructure systems. The high level of interdependence among these systems further aggravates the extent of disruptions. To mitigate these impacts, models and methods are needed to support rapid decision-making for optimal resource allocation in the aftermath of a disruption and to substantiate investment decisions for the structural reconfiguration of these systems. In this paper, we leverage infrastructure simulation models and Machine Learning (ML) algorithms to develop resilience prediction models. First, we employ an interdependent infrastructure simulation model to generate infrastructure disruption and recovery scenarios and compute the resilience value for each scenario. The infrastructure-, disruption-, and recovery-related attributes are recorded for each scenario and ML algorithms are employed on the synthetic dataset to develop accurate resilience prediction models. The results of the prediction models are analyzed and possible design strategies suggested based on the resilience enhancement attributes. The proposed methodology can support infrastructure agencies in the resource-allocation process for pre- and post-disaster interventions.