Cyber-security in substation automation systems

The cyber-security of several industrial plants has been compromised for last years by some worms and viruses, such as Stuxnet, which was able to take control of the Supervisory Control And Data Acquisition (SCADA) system of a nuclear plant in Iran. The research community and the international standardization committees raised their awareness about protecting information in Substation Automation Systems (SAS). IEC 61850-5 and IEC 62351-6 standards respectively describe communication models and the security mechanisms to be deployed in current substations, but they present some inconsistencies. On the one hand, this standard mandates that RSA cryptosystem must be used to provide source authenticity of GOOSE and SV messages. However, despite expensive processors with crypto accelerators were utilized, execution times would exceed the maximum transfer times stated in the standard for most time critical applications. On the other hand, the recommended synchronization solution is the Precision Time Protocol (PTP), as defined in IEEE 1588-2008, which introduced an optional security extension based on old keyed hash algorithms that has also been demonstrated to be suboptimal due to latency times and required resources. The aim of this paper is to explore current available security solutions and study their applicability to the substation environment. Furthermore, as part of the future security framework, a MACsec-based security approach that allows different communication services with diverse performance and security requirements to live together within the substation network is proposed.