Secure Communication of Intelligent Electronic Devices in Digital Substations

Abstract

This paper presents a communication “bump-in-the-wire” Security Filter device connected between the digital relays and the IEC 61850 communication buses to secure digital substation communications. Security Filter authenticates and verifies the designated Ethernet packets transmitted between protection and control devices by appending a message authentication code based on symmetric cryptography, which is compliant with the new mechanisms described in IEC 61850 and suitable for embedded system implementation. A prototype development and testing on a low cost commodity embedded system has proved that Security Filter can fully protect digital substation communication against replay attacks with time delays within the range of the most stringent IEC 61580 performance class requirements. The paper also presents multimode Security Filter operation design, which provides a practical interoperable way to upgrade and secure legacy substations with minimal modification or interruption to the existing systems.