An active command mediation approach for securing remote control interface of substations

Electrical substation is a crucial component in power grids. A number of international standards, such as IEC 60870 and 61850, have emerged to digitize and automate substations for efficient and timely control. However, owing to insufficient security consideration and implementation, the resulting systems could be vulnerable to cyber attacks. In fact, the digitization and automation of a large number of connected substations can dramatically increase the scale of potential damage on power grids. In this paper, we focus on attacks that inject malicious remote control commands targeting substations and discuss a practical, standards-based design of an active command mediation mechanism deployed in each substation to offer an additional layer of defense against attacks that somehow bypass other cyber security measures. Furthermore, as a concrete example of mitigation mechanism implemented on the command mediation system, we discuss autonomous command-delaying and evaluate its effectiveness. The simulation results show that our approach can significantly reduce the attack impact on power grid stability.