A Bandwidth-Efficient Secure Authentication Module for Smart Grid DNP3 Protocol

DNP3 is one of the oldest and widely used communication protocols for smart power grid, which has been upgraded to DNP3 Secure Authentication (SA) to address the increasing security needs of power grid applications. However, in practice, such upgrade was only deployed for critical operations due to its major overhead while non-critical operations are still not protected. Nevertheless, with the ongoing transformations in power grid, the underlying infrastructure is no longer isolated and needs to support a wide variety of applications. Consequently, this transformation requires applying DNP3-SA for all operations, whether they are critical or not. This requirement creates additional challenges since it will reduce network bandwidth availability by causing additional overhead on communication links especially if the underlying infrastructure is legacy. Therefore, in this paper, we propose a revision for DNP3-SA module to eliminate such overhead concerns on the bandwidth due to security operations. Specifically, we introduce a new authentication module that utilizes dynamic key-generation schemes to support mutual authentication for DNP3 in 0-Round Trip Time (RTT) and provides replay-attack prevention. The evaluation on a realistic low-bandwidth wireless LoRa testbed shows that the proposed extensions improve the security of DNP3-SA while significantly decreasing the message overhead of currently used authentication module. Thus, it is suitable for ongoing power grid transformation and supports evolving security needs.