SYSTEM AND METHOD FOR CONDUCTING INTEROPERABILITY, PERFORMANCE AND CYBERSECURITY TESTS IN DIGITAL ELECTRICAL POWER SUBSTATIONS

Description

30 SYSTEM AND METHOD FOR CONDUCTING INTEROPERABILITY, PERFORMANCE AND SECURITY TESTS Cybernetics in Digital Electrical Power Substations TECHNICAL FIELD

[001] The present invention is situated in the field of automation and cybersecurity for digital electrical substations and relates to a platform for interoperability and cybersecurity testing in substation automation systems (SAS). More particularly, the invention relates to a solution that enables the evaluation of the performance of communication devices and protocols, ensuring compliance with the IEC 61850 standard, as well as the identification of vulnerabilities and the enhancement of resilience against cyberattacks. FUNDAMENTALS OF THE INVENTION

[002] With the constant pursuit of improved efficiency in the processes involved and reliability in energy supply, significant advances have been observed in recent years in the automation and digitalization of substations, with the replacement of electromechanical equipment and copper wiring by intelligent electronic devices (IEDs) and fiber optic communication infrastructure.

[003] With these advances, a large amount of information began to flow through the process, bay and station levels, which intensified the need for standardization of communication protocols, aiming at complete interoperability between the various intelligent equipment and systems employed, enabling the use of equipment from different manufacturers.

[004] The objective of the protocols of the IEC 61850 standard and other applicable standards is to transmit and receive information in an assertive and Petition 870250109983, dated 01 / 12 / 2025, page 12 / 59 / 30 reliable among the various equipment and systems that make up the SAS, using open and non-proprietary standards, aiming to reduce engineering, commissioning, monitoring, diagnostics and maintenance costs.

[005] The application of these standards relating to digital substations has different degrees of maturity in the electricity sector, with the transmission sector being the most developed. For solutions employed in the distribution sector, the applications found can be divided into three main stages: substations with digital relays, which in the most advanced cases use GOOSE (Generic Object Oriented Substation Event) messages for exchanging control messages between themselves; substations with digital relays and station busbars, using GOOSE and MMS (Manufacturing Message Specification) messages; and complete digital substations with station and process busbars.

[006] Most distribution substations, both in Brazil and in the rest of the world, are in the first and second stages. The state of the art does not include distribution substations with complete implementations of the IEC 61850 standard.

[007] Furthermore, with the large amount of data available and the possibility of exchanging information and sending commands remotely by various equipment and systems, concerns arise both regarding the performance of equipment and protection and control logics in situations of high information traffic, as well as with the growth of cases of cyberattacks on energy distribution companies, which can cause interruptions in the energy supply for thousands of consumers.

[008] Within this scenario, the present invention relates to an automation platform that allows the performance of tests relating to Petition 870250109983, dated 01 / 12 / 2025, page 13 / 59 / 30 all levels of a digital substation, including interoperability testing between equipment from various manufacturers, dynamic testing of equipment, systems and control and protection logic, analyses regarding high information traffic, as well as cybersecurity testing, with the investigation of existing vulnerabilities in SAS and the proposal of improvements.

[009] The automation system of a substation can be divided into three levels, as defined by the IEC 61850 standard: station level: composed of the HMI (human-machine interface), supervisory system (SCADA), Ethernet switch and GPS for time synchronization via PTP protocol (precision time protocol); bay level: composed of the control and protection logics, implemented in the intelligent electronic devices that perform the operation of the circuit breakers and motorized switches; and, process level: sensors, MUs (merging units) and actuators connected in an Ethernet network.

[010] The connection between the different levels is made through network buses, which can be divided into two types: station bus and process bus.

[011] Regarding the exchange of information between equipment, there are two main types of messages: GOOSE and SV (from the English: sampled values). GOOSE messages are used for exchanging command signals between LEDs. SV messages consist of the digital sampling of an analog quantity obtained from an instrument transformer (voltage or current) and its transmission to the IEDs. There are also MMS-DNP3 messages exchanged between the LEDs and the supervisory systems through a station bus.

[012] The state of the art describes several automation platforms, which, however, do not achieve the technical characteristics of Petition 870250109983, dated 01 / 12 / 2025, page 14 / 59 / 30 present invention. Document CN106789274 describes a security testing system and method for smart substations in the context of smart grid technology. This document aims to solve the technical problem of existing simulation platforms failing to adequately simulate both the interaction between physical and information systems and the complex attack and defense scenarios. The system comprises: (i) a real-time simulation subsystem with simulation models of the substation, a real-time simulator, and a synchronization device such as GPS; (ii) a secondary device simulation subsystem with various simulators of real devices and equipment connected to the real-time simulator; (iii) a communication simulation subsystem with simulators of communication protocols such as IEC 61850, MODBUS, among others; and (iv) a simulation model.

[013] Furthermore, document CN202384838 describes a real-time test platform for the secondary electrical system of a smart substation and attempts to solve the problems regarding the need to perform full-scale tests for the secondary system of smart substations and current limitations on clock synchronization and network traffic testing in substations, which impact on-site installation and debugging. The invention aims to solve the aforementioned limitations with a test platform that allows full access to the secondary system, where the platform simulates and tests the entire secondary system of the substation, verifying everything from devices to communication networks. It also performs high-precision synchronization tests using GPS and rubidium clocks and network traffic tests at process layers and station levels using the SNMP protocol, without interrupting other tests.The platform for this document comprises: (i) a real-time simulator, (ii) analog output interface devices, (iii) integration devices and. Petition 870250109983, dated 01 / 12 / 2025, page 15 / 59 / 30 conversion, (iv) clock synchronization test system and (v) network test systems.

[014] The development of an automation platform with the scope highlighted by the present invention has a highly innovative character. Furthermore, the methodology developed and the tests performed for the implementation of a process bus at the distribution level, with the evaluation of equipment interoperability and message performance, as well as methodology and tests related to cybersecurity, also demonstrate the originality of the product and the applications performed.

[015] Thus, with the aim of improving the efficiency, reliability and operational safety of digital substations, promoting a safer transition to energy distribution infrastructures based on advanced communication technologies, the present invention describes a system for conducting interoperability, performance and cybersecurity tests in digital electrical power substations comprising: a) a test architecture structured in three levels, comprising: (i) a station level, comprising human-machine interface, SCADA servers, Ethernet switches and GPS for time synchronization via PTP protocol; (ii) a bay level, comprising intelligent electronic devices (IEDs) configured for control and protection of substation equipment; (iii) a process level, comprising sensors, MU and actuators connected in an Ethernet network for exchanging SV and GOOSE messages; (b) a communication bus infrastructure;(c) a set of equipment for generating electrical signals and simulating events in the system; (d) a cybersecurity monitoring and evaluation system; and (e) a set of communication analysis and configuration software. Petition 870250109983, dated 01 / 12 / 2025, page 16 / 59 / 30

[016] In addition, the invention also describes a method for conducting interoperability, performance, and cybersecurity tests on digital electrical power substations, comprising the steps of: (a) simulating the operation of a digital substation by implementing a three-level structured test environment; (b) conducting interoperability tests between intelligent electronic devices (IEDs) by verifying the communication of GOOSE, SV, and MMS messages; (c) analyzing the performance of communication messages by segregating them into specific virtual local area networks; (d) executing simulations of cyberattacks targeting the substation automation system; (e) identifying vulnerabilities. BRIEF DESCRIPTION OF THE FIGURES

[017] Figure 1 represents the single-line diagram of the fictitious substation used as the basis for the test platform, illustrating the configuration of the circuit breakers, disconnect switches and transformers.

[018] Figure 2 shows the architecture of the test platform, detailing the station, bay and process levels, interconnected by means of the station and process buses.

[019] Figure 3 shows the components of the station bus mounted in an industrial rack, including servers, Ethernet switches, network security equipment (firewall) and other infrastructure equipment.

[020] Figure 4 shows the equipment for the bay and process buses mounted in an industrial rack, including IEDs, MUs and communication switches.

[021] Figure 5 illustrates the synchronization status of the smart electronic device via PTP protocol, as well as the activation of the GOOSE and SV communication channels. Petition 870250109983, dated 01 / 12 / 2025, page 17 / 59 / 30

[022] Figure 6 shows the display of analog and digital information in the SCADA system, including the monitoring of signals from the digital substation devices.

[023] Figure 7 represents the electrical system configuration and simulation scenario in the electrical system protection simulation and testing software, illustrating the modeling of the electrical arrangement used in the tests.

[024] Figure 8 shows the initial system configuration in the electrical system protection simulation and testing software before the simulated fault occurs, with the parameterization of the protection devices.

[025] Figure 9 shows the SCADA interface displaying circuit breaker information, including operating states and control signals.

[026] Figure 10 shows the single-line diagram of the SCADA after the protection was activated in the system, indicating the devices that responded to the simulated electrical fault.

[027] Figure 11 represents the oscillograms collected from the equipment during the protection tests, demonstrating the waveforms of the measured currents and voltages.

[028] Figure 12 illustrates the method adopted for SV message performance testing, considering different traffic conditions on the process bus.

[029] Figure 13 shows the infrastructure used in the SV message performance tests, highlighting the devices responsible for publishing and consuming the signals. Petition 870250109983, dated 01 / 12 / 2025, p. 18 / 59 / 30

[030] Figure 14 shows the description of the test cases applied to the platform, including signal injection, publication and consumption of SV messages, as well as the operation of the protection.

[031] Figure 15 shows the analysis of process bus traffic during testing, demonstrating transmission rates and the impact of load conditions on communication.

[032] Figure 16 represents the operating time of the intelligent electronic device during SV message tests, highlighting the device's response to the simulated event.

[033] Figure 17 shows the operating time of the intelligent electronic device during SV message tests, evaluating the communication latency on the process bus.

[034] Figure 18 shows the operating time of the smart electronic device during SV message tests, comparing its performance in different traffic scenarios.

[035] Figure 19 presents the scenarios and types of cyberattacks carried out on the platform, including brute force tests, packet interception and analysis tests, denial of service (DoS) and backdoor insertion.

[036] Figure 20 illustrates obtaining the station switch password hash in the brute-force test, demonstrating vulnerabilities in the equipment authentication.

[037] Figure 21 shows the results of the packet interception and analysis test performed before the network security equipment, showing the capture of packets on the station bus network. Petition 870250109983, dated 01 / 12 / 2025, page 19 / 59 / 30

[038] Figure 22 shows the packet interception and analysis test performed directly on the Ethernet port of the smart electronic device and control, revealing communication information from the equipment.

[039] Figure 23 represents the identification of privilege escalation and unauthorized remote access / hiding utilities (rootkit / backdoor) installed during the penetration test, demonstrating the possibility of system compromise.

[040] Figure 24 illustrates the verification of the persistence of rootkit / backdoor utilities in the system, evaluating the resilience of the implemented protection measures.

[041] Figure 25 shows the initial state of the station bus before the execution of the denial-of-service (DoS) attack.

[042] Figure 26 represents the execution of the DoS (denial of service) attack on the station bus, simulating the impact of high request traffic on the network.

[043] Figure 27 shows the execution of the DoS attack on the process bus, evaluating the stability of the communication under attack.

[044] Figure 28 shows the state of the station bus after the execution of the DoS attack, highlighting the effects of malicious traffic on the network.

[045] Figure 29 shows the state of the process bus after the execution of the DoS attack, demonstrating the system's response to excessive requests. DESCRIPTION OF THE INVENTION

[046] The detailed description below refers to the figures in which, by way of illustration and not limitation, modalities of are represented. Petition 870250109983, dated 01 / 12 / 2025, page 20 / 59 / 30 execution of the present invention. These embodiments are described in such a way as to allow a person skilled in the art to reproduce its results. Other embodiments are possible and can be carried out without departing from the concept and scope of the present invention. The detailed description below should therefore not be understood in a restrictive or limiting manner.

[047] After a detailed analysis of the existing infrastructure, including a survey of existing equipment, systems and protection and control logic, as well as benchmarking carried out to survey the technologies currently used in national and international substations, it was possible to develop an architecture for the platform.

[048] As a basis for the tests, a fictitious substation with a breaker-and-a-half arrangement in the high-voltage sector was used, consisting of circuit breakers 6006, 6016 and 6026, in addition to their respective switching disconnectors, and there is also the step-down transformer T1 that feeds the low-voltage circuits AL1 and AL2, as shown in Figure 1.

[049] Based on the single-line diagram, the developed architecture is shown in Figure 2, and includes equipment based on the IEC 61850 standard.

[050] Communication between levels is done redundantly through station and process buses, through which the necessary messages travel according to the level, devices and need.

[051] At the station level are located the interface and gateway computers, which may be concentrated in a single piece of equipment. This bus consists of four Ethernet switches. At the bay level are located the intelligent electronic devices responsible for the protection and control functions of the substation.

[052] At the process level, analog signals from the field are converted into digital signals via MUs, so that they are Petition 870250109983, dated 01 / 12 / 2025, page 21 / 59 / 30 sent to the protection devices through the process bus network. Considering the possibility of using a single piece of equipment to control multiple circuit breakers, in addition to the possibility of acquiring equipment that functions as both an IED and a MU, the number of physical devices can be reduced.

[053] The infrastructure also has a signal generator to simulate the fault current and voltage values ​​observed in the field, as well as GOOSE messages and SV messages that are inserted directly into the process bus to simulate different traffic conditions.

[054] Although listed as station-level equipment in the following items, the invention uses GPS connected to both station switches and process bus switches, aiming to perform synchronization via PTP through this bus.

[055] From this, the necessary equipment and their quantities for the development of the integrated test platform are identified. These are then presented according to the level at which they are located in the substation system.

[056] According to the preferred embodiment, the equipment and systems that may comprise the platform station level, as well as their quantities and models, are presented in Table 1. Other equipment and systems with equivalent or similar functions may be employed without the solution departing from the present invention. Equipment Quantity Model HMI 1 HP Z2 Tower G4 Workstation Gateway 2 HPE ProLiant DL380 Gen10 Server GPS 1 GE RT430 Workstation Switch 2 Aruba 6200F 24G Class4 PoE 4SFP+ 370W Switch Workstation Switch 2 GE Reason S20 Rack 1 HPE 22U 600x1075mm Advanced G2 Shock Rack Firewall 1 Fortinet Firewall FG-100F Petition 870250109983, dated 01 / 12 / 2025, page 22 / 59 / 30 SCADA System 2 Spin Action.NET Software 2 Microsoft Server MS WS19 Software 1 VMware vSphere Ess Table 1

[057] Also according to the preferred embodiment of the invention, the equipment that can comprise the bay and process levels of the platform, as well as their quantities and models, are presented in Table 2. Other equipment with equivalent or similar functions may be employed without the solution departing from the present invention. Equipment Quantity Model IED 1 ABB REF620 1 GE T60 1 SEL 421-7 Merging Unit 1 MU320 Process Switch 2 GE Reason S20 Table 2

[058] The three IEDs can be from different manufacturers, such that: One may contain various protection functions, enabling its use for different purposes; another may enable the sending of SV messages, a function of MUs; and the last one may be an IED that can have centralized protection and control.

[059] The invention adopts a MU proper, in addition to evaluating the use of IEDs, which can also perform analog data conversion as described above. For the process network, two ethernet switches are used that allow PRP (parallel redundancy protocol) redundancy and PTP (precision time protocol) synchronization, according to the desired test.

[060] In addition to the station, bay and process level equipment, there are also the equipment and software presented in Table 3, according to the preferred embodiment of the invention. Other equipment with equivalent or similar functions may be used without the solution deviating from the present invention. Petition 870250109983, dated 01 / 12 / 2025, p. 23 / 59 / 30 Equipment Quantity Model Test Case 1 Omicron CMC 356 Software 1 Omicron RelaySimTest Software 1 Omicron IEDScout Software 1 Omicron SVScout Software 1 Omicron GOOSE Configuration Software 1 Omicron Sampled Values ​​Configuration Table 3

[061] The Omicron CMC 356 equipment was chosen for the platform's signal generation equipment, but this choice should not be considered as limiting the scope of the present invention. Any equivalent equipment could be used without departing from the spirit of the present invention. It is a universal solution for testing all generations and types of protection relays. It has six current sources (three-phase mode: up to 64 A / 860 VA per channel) with an excellent dynamic range. In addition, the equipment has digital inputs for receiving the trip or drive signals from the IEDs. This simulator equipment has several software applications.

[062] RelaySimTest is a solution for simulating realistic events in the power system, regardless of the relay type and manufacturer. Other equivalent software could be used without the solution departing from the spirit of the present invention. This software can detect errors in the settings and logic of the protection system. This allows for the verification of the correct behavior of the protection system during tests quickly and with high quality.

[063] lEDScout is the tool for searching for IEC devices. 61850. Another equivalent tool could be used without the solution departing from the spirit of the present invention. It works with devices from all suppliers and can be used for analysis and simulation of IEDs. It allows testing the IEC 61850-related functionalities of the IED, in addition to... Petition 870250109983, dated 01 / 12 / 2025, page 24 / 59 / 30, regarding factory acceptance testing up to commissioning for troubleshooting.

[064] SVScout makes Sampled Values ​​(SV) visible to the substation engineer and IED developer. Other equivalent software could be used without departing from the spirit of the present invention. It subscribes to receive continuous SV data streams from MU and displays the waveforms of the primary voltages and currents in an oscilloscope view. The details of the values ​​can be consulted and compared with each other using the cursor functions. The RMS (Root Mean Square) values ​​and phase angles are calculated from the sampled values ​​and displayed in a phasor diagram and a measurement table. The captured sampled values ​​can be saved in COMTRADE files, or any other equivalent file format, for further analysis. SV traffic on the network, saved in Packet Capture (PCAP) files, or any other equivalent file format, can also be analyzed in SVScout.

[065] The GOOSE Configuration software allows the publication of GOOSE messages on the network, and the Sampled Values ​​Configuration software allows the publication of SV messages, to simulate the system components. Other software with equivalent functions could be used without the solution departing from the spirit of the present invention. In conjunction with the CMC 356 signal generator, these modules enable comprehensive testing of the protection system in an IEC 36850 environment. The GOOSE module allows messages to be efficiently distributed throughout the network, while the SV module sends digitized current and voltage values ​​throughout the communication network. They allow the simulation of power systems and testing of digital protection devices.

[066] The software suite acquired is part of Omicron's testing suite for the CMC generator family. A Petition 870250109983, dated 01 / 12 / 2025, page 25 / 59 / 30: The combination of modules allows for optimized testing according to the needs of each test. However, as previously mentioned, equivalent software and equipment could be used to perform tests without the solution deviating from the spirit of the present invention.

[067] The equipment can be mounted in a suitable industrial rack. Figure 3 shows a preferred arrangement of the equipment, which are: Monitor and keyboard integrated into the HPE 22U rack (1); Aruba 6200F switch (2); Aruba 6200F switch (3); Fortinet Firewall FG-100F hardware (4); HPE DL380 server (5); and, HPE DL380 server (6).

[068] The HPE servers function as a SCADA gateway, with a protective barrier provided by the Aruba 6200F switches via the FG-100F Firewall. The Aruba switches connect to GE Reason S20 switches (located in the bay and process level racks) to form the workstation bus. The workstation functions as an HMI / Operations Center for testing.

[069] Regarding the configuration of workstation-level equipment, server and operating system activations are performed, involving software and firmware updates. Following this, virtual machines are configured on the servers so that they can function as communication gateways in the project simulations.

[070] The configuration of the ARUBA 6200F station switches involves registering users and passwords, IPs, virtual local networks and security settings, and the Fortinet FG-100F firewall.

[071] With regard to bay and process levels, equipment is mounted in racks, electrical design is prepared and Petition 870250109983, dated 01 / 12 / 2025, page 26 / 59 / 30 communication, execution of electrical and optical connections, equipment configuration and testing for platform commissioning.

[072] The equipment was mounted in the industrial rack as shown in Figure 4, namely: GPS - Reason RT430 (7); Station bus switches - Reason S20 (8); Process bus switches - Reason S20 (9); Merging Unit - Reason MU320 (10); IED ABB REF620 (11); IED - SEL-421 (12); IED - GE T60 (13); Field circuit breaker simulator - GE Multilin C650 (14); and, TekSea Tekpower SWP power supply (15).

[073] Figure 4 also shows the Omicron CMC 356 test case (16) and the workstation (17), used for configuration and carrying out the tests, as well as serving as an HMI / Operation Center emulator.

[074] The following will present the tests performed for the implementation of process bus at the distribution level, including interoperability tests between equipment and message performance tests, as well as simulation of cyberattacks in substations. Interoperability Tests

[075] The verification of equipment interoperability began with their synchronization, which can be performed via PTP protocol, using a GPS connected to the process bus. Synchronization is essential to ensure the correct exchange of messages, coordinated action of protections and evaluation of events.

[076] Initial tests consider exchanging all types of messages (general, synchronization, SV, and GOOSE) through a single communication channel. In this configuration, synchronization between devices may be constantly lost, and several message packets may be lost. To overcome this problem, segregation is performed. Petition 870250109983, dated 01 / 12 / 2025, page 27 / 59 / 30 messages on virtual local area networks as follows: General messages: virtual local area network 1; SV messages: virtual local area network 10; GOOSE messages: virtual local area network 11; Messages for synchronization: virtual local area network 400.

[077] Configurations are performed on each of the devices to exchange messages through the specified channels. Through these configurations, significantly superior synchronization performance was obtained, and the activation of the GOOSE and SV message communication channels can be observed. Figure 5 shows the synchronization status and online communication channels (GOOSE and SV) for the GE T60 IED. Figure 6 shows the equipment information displayed on the SCADA system interface via MMS.

[078] To verify the exchange of messages between equipment, complete protection performance tests are carried out with the publication and consumption of GOOSE and SV messages, in addition to verifying communication via the MMS protocol with the SCADA system. The results of one of the tests will be presented below.

[079] Using the RelaySimTest program, the substation diagram is configured as shown in Figure 7. The scenario is that of a fault occurring in Feeder AL1 and an operational failure of DJ4012, so that the backup protection on the secondary of transformer T1 is activated via DJ4018. DJ4012 is physically controlled by the ABB REF620 IED, which has overcurrent protection parameterization, while DJ4018 is physically controlled by MU320, which is configured to send and receive SV messages to the GE T60 IED, which also has overcurrent protection parameterization. Furthermore, the GE T60 IED monitors the actions of the ABB REF620 IED via GOOSE. Petition 870250109983, dated 01 / 12 / 2025, page 28 / 59 / 30

[080] Figure 8 shows the pre-fault state configuration, also using RelaySim Test.

[081] After the start of the fault simulation in AL1, overcurrent occurs in the ABB REF620 equipment, without the physical activation of the physical equipment (DJ2012) protected by it.

[082] The fault in the Feeder is also sensed by the DJ4018 on the secondary side of transformer T1. The DJ4018 is physically monitored and controlled by the GE MU320 equipment, which does not perform protection functions. The measurements are communicated to the GE T60 via SV for analog measurements and via GOOSE for status control and command reception. The fault information reaches the SCADA system (via MMS), allowing the operator to identify the protection activation, as shown in Figure 9.

[083] Through the correct exchange of SV messages between the equipment, the GE T60 IED correctly detects the fault location (distribution feeder) and executes the programmed protection functions, sending commands (GOOSE) to open and close field equipment. The final state of the system, with the opening of the DJ4018 that protects the transformer secondary, is shown in Figure 10.

[084] The oscillograms of the equipment were collected and are presented in Figure 11. The currents shown, from top to bottom, are from the CMC356 case, the ABB REF620, and the GE T60. The digital data, from top to bottom, are overcurrent activation points (pick-up) of the ABB, ABB trip captured in the CMC356 case, overcurrent activation point of the T60, and trip captured in the CMC356 case of the MU320 which is controlled by the T60. The trip time results of the equipment are captured by the case and are presented in Table 4. Petition 870250109983, dated 01 / 12 / 2025, page 29 / 59 / 30 Status Fault Type Angle of Incidence [°] Fault Resistance (RF) [Ω] Time 4012 (ABB) [s] Time 4018 (T60) [s] Executed AB 90 1.5 0.018060241 0.034760241 Table 4

[085] The results obtained in this test allow us to validate the exchange of GOOSE, SV, and MMS messages between equipment. The response times of the equipment protection can also indicate adequate performance of GOOSE and SV messages, and the protection and control tests presented below allow for a more detailed evaluation of SV message performance. Tests for Verifying SV Message Performance

[086] To verify the performance of SV messages and validate the configurations of the implemented process bus, tests are performed to compare simulation times, considering different bus traffic conditions, as well as different combinations of equipment for publishing and consuming SV messages.

[087] Regarding message traffic conditions on the bus, three different conditions are simulated. The first refers to analog signal injection and direct protection action by the same equipment, without using the bus. This case will provide reference times for the others.

[088] In the second and third cases, current injection is performed on a specific piece of equipment with SV message publication, with consumption and protection activation by another piece of equipment. To differentiate the cases, additional SV messages are published to increase traffic on the bus. Figure 12 illustrates the simulation cases. Petition 870250109983, dated 01 / 12 / 2025, p. 30 / 59 / 30

[089] According to the test infrastructure shown in Figure 13, the publication of SV messages on the process bus can be done by the following equipment: MU320 - 4 voltage channels and 4 current channels; ABB REF620 - 4 voltage channels and 4 current channels; SEL 421-7 - 4 voltage channels and 4 current channels.

[090] Using the CMC 356 test kit, current or voltage is injected into the listed equipment, which in these test cases functions as a MU.

[091] The CMC 356 can also directly publish SV messages (4 current channels and 4 voltage channels) directly to the process bus, a useful feature for testing with high message traffic on the bus.

[092] The consumption of SV messages for the activation of protection logic can be done by two devices: ABB REF620 - 4 voltage channels; GE T60 - 4 voltage channels and 4 current channels.

[093] Figure 14 describes each of the tests, showing the equipment where current injection was performed, the bus traffic situation, the equipment where protection was activated, and whether the activation was self-protected (P) or through the consumption of process bus messages (BP). This figure also illustrates one of the test cases (case 2.1), with current injection and SV message publication by the SEL 421-7 IED, SV message consumption and protection activation by the ABB REF620 and GE T60 IEDs, as well as direct activation (without bus) of the SEL 421-7 IED. The MU320 and CMC 356 equipment publish SV messages to increase message traffic on the bus.

[094] The bus condition during testing was monitored and captured by Wireshark software. Other equivalent software could be used without departing from the spirit of the present invention. For Petition 870250109983, dated 01 / 12 / 2025, page 31 / 59 / 30: In normal bus conditions, traffic values ​​are around 5 Mbps in total, with 4.5 Mbps of SV data. For high-traffic bus conditions, the values ​​are around 48 Mbps in total, with 42 Mbps of SV data. And, for a different virtual local area network under high traffic conditions, the values ​​are around 150 Mbps in total, with 42 Mbps of SV data. Figure 15 below shows the bus conditions and values ​​per protocol for normal traffic.

[095] For each of the tests, oscillograms are collected to verify the time interval between the start of the simulation and the activation of the equipment protection. Figures 16, 17, and 18 show the oscillograms collected for case 2.1, with the activation of the ABB REF-620, GE T60, and SEL 421-7 IEDs, respectively.

[096] From the collected oscillograms, the equipment actuation times are determined for each test. Table 5 presents the results obtained. The first three columns of results show the times from the start of the simulation until the activation of the equipment protection. The following three columns show the calculated differences between the simulation times for different equipment. Test Case Results Test Location Current Injection Situation Busbar T60 Activation (ms) ABB Activation (ms) SEL Activation (ms) Difference ABB and T60 (ms) Difference SEL and ABB (ms) Difference SEL and GE (ms) 1.0 MU320 Normal 58.036 49.844 8.192 2.0 SEL Normal 53.693 46.719 21.059 6.974 25.66 32.634 3.0 ABB Normal 56.428 42.188 14.240 1.1 MU320 Loaded 55.862 46.719 9.143 2.1 SEL Loaded 54.999 46.719 20.496 8.280 26,223 34,503 Petition 870250109983, dated 01 / 12 / 2025, page 32 / 59 / 30 3.1 ABB Loaded 56,827 42,369 14,458 1.2 MU320 Very loaded 56,832 49,844 6,988 2.2 SEL Very loaded 54,693 46,719 27,171 7,974 19,548 27,522 3.2 ABB Very loaded 57,209 42,625 14,584 Table 5

[097] Regarding the results obtained for the GE T60 IED, whose protection action occurs through the consumption of SV messages in all tests, an average response time of 56.064ms and a variance of 1.898ms were obtained.

[098] The low variance observed indicates non-significant differences in processing, generation, and transmission time of SV messages between equipment from different manufacturers, reinforcing the issue of interoperability between equipment from different manufacturers. It is also possible to infer that, for the cases tested, there was no significant influence of the process bus traffic situation on the performance of SV messages.

[099] The cases tested with a heavily loaded bus situation demonstrate the importance of segregating the network into virtual local area networks. Even with the simulation of network traffic that could cause delays and packet loss, because it was not performed on the virtual local area network of the SV messages, no significant differences were observed in the simulation times.

[0100] Results of tests performed with the ABB IED operating system REF620 can be divided into self-operation (without a bus) and operation with consumption of SV messages through the process bus.

[0101] Regarding cases with direct intervention (3.0, 3.1 and 3.2), the average time from the start of protection to IED sensitization was Petition 870250109983, dated 01 / 12 / 2025, page 33 / 59 / 30 42.394ms, with a variance of 0.048ms. Again, the low variance observed indicates non-significant differences in processing, generation, and transmission time of SV messages between equipment from different manufacturers.

[0102] In relation to cases with action via process bus, the average time from the start of protection to IED sensitization was 47.761ms, with a variance of 2.604ms.

[0103] The following considerations are made between the example cases: Time difference between the averages for cases with self-actuation and action via process bus: 5.367ms; Greatest time difference between cases with self-actuation and cases with action via process bus: 7.656ms; Smallest time difference between cases with self-actuation and cases with action via process bus: 4.094ms.

[0104] To analyze the performance of the process bus and the feasibility of implementing it in distribution substations, the message propagation times (latency) on the bus should not exceed 10ms, according to the definitions of the IEC61850 standard.

[0105] Considering that the observed time differences between self-operation and operation through the process bus refer predominantly to the bus latency, for the cases analyzed, no propagation times greater than 10ms were observed, which indicates the satisfactory implementation of the process bus. Cybersecurity Tests

[0106] The test consists of defining the requirements to be met, the configuration to be implemented in the equipment and systems to meet these requirements (defense in depth), and finally, carrying out Petition 870250109983, dated 01 / 12 / 2025, page 34 / 59 / 30 simulation of attacks to verify the resilience of the electrical system and propose improvements.

[0107] The IEC62351, 2007a standard defines the main security requirements to be met: Confidentiality, preventing unauthorized access to information; Integrity, to prevent unauthorized modifications or theft of information; Availability, in order to prevent DoS attacks and ensure authorized access to information; and Non-repudiation or liability, that is, preventing denial of authorship by identifying the attacker.

[0108] The term defense in depth consists of applying several layers of protection, from the substation access point to the equipment located in the field, including the SCADA system, communication infrastructure, and intelligent electronic devices. In this way, if one of the layers is breached by an attack, there are additional layers to prevent possible activation of the equipment located in the substation. In addition to reducing the probability of a successful attack, defense in depth helps identify the problem and provides more time for the utility to implement emergency measures to combat the problem.

[0109] Considering that equipment failures and message exchange failures (GOOSE, SV) can generate significant interruptions and damage to equipment, the use of redundant architecture is recommended whenever possible.

[0110] For the network architecture, peer-to-peer and client-server communication were combined, aiming to meet the reliability and security requirements of a substation.

[0111] Regarding communication protocols, redundant high-availability protocols are applied, such as HSR (high availability). Petition 870250109983, dated 01 / 12 / 2025, page 35 / 59 / 30 seamless redundancy) and PRP (parallel redundancy protocol), which offer greater security for the recovery of communication packets, in addition to the application of high-precision synchronization protocols, such as PTP (precision time protocol).

[0112] To increase security in communication between equipment and systems, it is proposed to segment the substation communication network into two main zones, separated by a firewall, namely: Zone 1: Central SCADA, Gateway Servers, Human-Machine Interface and Station Bus; Zone 2: Process Buses, Protection and Control Equipment, Physical Devices Installed in the Field.

[0113] For the tests, two scenarios are conceptualized, as presented in Figure 19: i) attacks via the Station Bus (prior to the Firewall), in order to verify the results of the invention, and; ii) attacks via the Process Bus, with the intention of assessing the result of attacks in a traditional electrical substation network topology.

[0114] To stress the platform, attacks that converge on the defense of the SAS, and consequently, the SCADA, can be used. Therefore, the attacks foreseen and recommended for simulation on substation platforms will be the following.

[0115] Packet interception and analysis test (type: Discovery): According to the MITRE ATT&CK for ICS database, packet interception and analysis (or sniffing) (MITRE code T1040) is an attack that monitors or captures information from a given network, specifically from an asset on that network, regardless of packet flow. This practice generally exploits essential information for a more elaborate future attack, called an exploit. In the context of the platform, it will be used to visualize network traffic in SCADA. Petition 870250109983, dated 01 / 12 / 2025, page 36 / 59 / 30

[0116] Brute Force (type: Credential Access): Considered a sub-attack category by MITRE's ATT&CK for ICS, the brute force attack, code T1110, consists of gaining access to networks when passwords are unknown or when their hashes are obtained. This can also be done systematically by the attacker using mechanisms for repeating or iterating through credential validation services. Brute force access leverages knowledge gained from other post-compromise behaviors, such as operating system credential dumping, account discovery, or password policy discovery, or combinations of these attacks. For the platform, wordlist executor software (generated via script) will be used for secondary intrusion into the SCADA system.

[0117] Rootkit + Backdoor (type: Defense Evasion): A Rootkit is a set of actions aimed at covering the tracks of a primary attack. According to MITRE's ATT&CK for ICS (code T1014), it serves to hide the presence of malicious or non-malicious programs, files, network connections, services, drivers, and other system components. It intercepts and modifies operating system interfaces. The ultimate goal of a Rootkit is almost total control of the system, capturing the administrator role (the "root" credential). This can result in commands being ignored and false information being fed to the master device. In the context of the platform, this will be the third step after the two initial attacks, with total intrusion into the SCADA system and the implementation of vulnerabilities (backdoors) for future attacks.

[0118] DoS (Availability): Considered one of the most common attacks in the world, even predating the infamous ransomware, Denial of Service (DoS) aims to take down a specific system, service, or server by sending a massive number of requests, which may or may not be legitimate. It is executed by bots that generate these requests. The current context presents the scenario of Distributed DoS (DDoS), which is conceived by a large network of bots. However, for the simulation, the simple sending of large Petition 870250109983, dated 01 / 12 / 2025, page 37 / 59 / 30 volume for the SCADA or for the network will serve for the platform efficiency test.

[0119] The attacks mentioned above are considered sufficient to test the real cybersecurity potential of the simulation platform. As these attacks are part of the final incident, called an APT (Advanced Persistent Threat), the success of at least two of the three attacks can be considered a "security breach". Brute strength tests

[0120] In brute-force tests prior to the firewall, it was initially possible to extract a password hash from the Aruba 6200F switch, as shown in Figure 20. This password hash was cracked using an open-source password cracking tool. The stronger the password, the greater the complexity and time spent by the program to perform the decryption, which shows the importance of using passwords with a large number of characters, using letters, numbers and special characters, as well as changing them periodically.

[0121] Regarding brute force tests after the firewall, it was not possible to obtain the password hash for the process bus switches.

[0122] Online brute-force tests were performed after the firewall, using the Hydra tool, where it was possible to obtain the switch's IP address via an Ethernet connection to the network, connect to the authentication page, and test a password list to authenticate to the equipment. Because the switch was configured with a strong password, the attempt was aborted before completion, as the simulation duration had already exceeded 30 hours and could last several additional days. This test demonstrates the importance of hardening the equipment by disabling unused communication ports, as well as employing strong passwords and changing them periodically. Packet interception tests Petition 870250109983, dated 01 / 12 / 2025, page 38 / 59 / 30

[0123] For pre-firewall testing, after breaking the authenticity of the station switch, performing packet interception and analysis tests on network ports was trivial, using packet analysis tools such as TCPDump and Wireshark. Several important pieces of information were revealed in penetration testing cases, such as station bus IPs and ports. Knowing the existing messages, it was possible to plan the following types of attacks, which will be described in the next sections.

[0124] Figure 21 shows the results of the packet interception and analysis test before the network security equipment.

[0125] Regarding the tests after the firewall, since the brute force test in this situation was unsuccessful, it was not possible to perform the packet interception and analysis test of the communication ports of the process bus switches.

[0126] However, to verify functionality, an attack attempt was made on one of the (ABB REF620) devices used in the project directly, via the Ethernet port on the front panel. The result showed a vulnerability in the port, in addition to revealing trivial information, such as the IED's IP address. Such exposure could lead to an opening to detect the device's hash.

[0127] Figure 22 shows the result of the packet interception and analysis test for the IED using the TCPdump tool. Rootkit / Backdoor Testing

[0128] Rootkit / backdoor tests aim to establish a channel for a main attack, as well as ensuring connectivity and guaranteeing that this channel remains hidden. Having gained access to the station bus and after verifying the information exchanged between devices, a test was performed to Petition 870250109983, dated 01 / 12 / 2025, page 39 / 59 / 30 rootkit employing the dbd program, with the installation of utilities that ensured connectivity and invisibility of the connection, as shown in Figure 23.

[0129] A system scan was performed using a rootkit detection tool, such as the rkhunter program, to verify whether the utilities were successfully installed, and it was found that 06 (six) of the 400 secret files initially planned were successfully installed.

[0130] To ensure that no legitimate hidden files were detected, filtering was performed on the scan, focusing only on the sizes of rootkit utilities. These vulnerabilities (backdoors) were successfully installed, as shown in Figure 24. DoS Tests

[0131] The DDoS test consists of sending a large amount of information (overload of SV requests), simulating an attack that could cause the substation equipment to malfunction.

[0132] To simulate an overload of SV requests, it is necessary to conceptualize the protocol in question with the same characteristics as a TCP communication (transmission control protocol), in the transport layer, since the test box cannot generate a quantity of SV requests in the proportion of a DDoS attack, and there is no DoS penetration testing tool that generates SV protocols.

[0133] Thus, it was necessary to simulate a network of compromised devices (botnet) that sends numerous TCP requests to the process bus, without the firewall, as if they were SV requests to the IEDs. Figure 25 shows the initial state of the station bus, before the attack. Petition 870250109983, dated 01 / 12 / 2025, p. 40 / 59 / 30

[0134] Figures 26 and 27 show the state of the station and process buses during the execution of DoS attacks.

[0135] From a cybersecurity standpoint, the result proved highly satisfactory, as the switches themselves (Aruba and GE), in their current updates, are able to reject requests originating from DoS or DDoS overloads. It was possible to verify the rejection of TCP requests at the workstation (COI operation). The results obtained for the workstation and process buses are presented in Figures 28 and 29.

[0136] Through the tests carried out, it was possible to verify the importance of the following actions regarding the cybersecurity of substations: Installation of a firewall to segregate IT and OT levels, maintenance of the license and periodic updates; Use of strong passwords on all assets and periodic changes to them; Blocking (fortification) of physical ports and ethernet / USB ports of the assets; Periodic updating of equipment software and firmware, since manufacturers provide the latest cybersecurity solutions in these updates; Use of the whitelist method, restricting any applications that are not on this list; Blocking of unencrypted and unauthorized remote access; Conducting periodic cybersecurity training. Petition 870250109983, dated 01 / 12 / 2025, pp. 41 / 59

Claims

1 / 3 CLAIMS 1. A system for conducting interoperability, performance, and cybersecurity tests on digital electrical substations, characterized in that it comprises: a) a test architecture structured in three levels, comprising: (i) a station level, comprising human-machine interface, SCADA servers, Ethernet switches, and GPS for time synchronization via PTP protocol; (ii) a bay level, comprising intelligent electronic devices configured for control and protection of substation equipment; (iii) a process level, comprising sensors, MUs, and actuators connected in an Ethernet network for exchanging SV and GOOSE messages; (b) a communication bus infrastructure; (c) a set of equipment for generating electrical signals and simulating events in the system; (d) a cybersecurity monitoring and evaluation system; and (e) a set of communication analysis and configuration software.

2. System according to claim 1, characterized in that the communication bus infrastructure comprises a station bus and a process bus, configured for transmission of GOOSE, SV and MMS messages.

3. System, according to claim 1, characterized in that the set of equipment for generating electrical signals and simulating events in the system comprises signal generators for current and voltage injection, software for simulating electrical events, and tools for analyzing the performance of messages exchanged on the network.

4. System, according to claim 1, characterized in that the cybersecurity monitoring and evaluation system comprises analysis of network traffic, denial-of-service (DoS) attacks, unauthorized access attempts, and simulation of manipulation of messages exchanged between substation devices.

5. Method for conducting interoperability, performance, and cybersecurity tests on digital electrical substations, characterized by comprising the following steps: (a) simulating the operation of a digital substation by implementing a three-level structured test environment; (b) conducting interoperability tests between intelligent electronic devices, verifying the communication of GOOSE, SV, and MMS messages; (c) analyzing the performance of communication messages by segregating them into specific virtual local area networks; (d) executing simulations of cyberattacks targeting the substation's automation system; (e) identifying vulnerabilities.

6. Method, according to claim 5, characterized in that the three-level structured test environment comprises a station level, a bay level, and a process level, interconnected via station bus and process bus, using equipment from different manufacturers.

7. Method, according to claim 5, characterized in that the step of analyzing the performance of communication messages comprises verifying the latency and reliability of data traffic on the network buses of the digital substation.

8. Method, according to claim 5, characterized in that the step of performing cyberattack simulations comprises brute-force attacks, packet interception testing and analysis, denial of service (DoS), and backdoor insertion. Petition 870250040828, dated 05 / 19 / 2025, pp. 45 / 60

Images