Backup Secure Communication Link for Electric Power Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electric power distribution systems face challenges in maintaining secure communication links between intelligent electronic devices (IEDs) and other devices, as these links can become unavailable due to faults or failures, disrupting communication and operational continuity.
Innovation Solution
The implementation of a controller that determines the primary and backup switches within the electric power distribution system, distributing security association keys (SAKs) to these switches to establish primary and backup media access control security (MACsec) communication links, ensuring continuous communication even if the primary link becomes unavailable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single primary secure communication link is established between the IED and other devices, then communication security is maintained, but communication continuity is compromised when the link becomes unavailable
Solution Approach 1:
The system pre-establishes a backup secure communication link in advance, configured and ready before the primary link fails. The controller pre-distributes backup security association keys to the IED, so that when the primary link becomes unavailable, the backup link is already prepared and can be activated immediately without delay for key distribution or link establishment.
Solution Approach 2:
The system dynamically changes the operational state of communication links based on availability. When the primary link is available, it carries data traffic; when it becomes unavailable, the system transitions the backup link from an inactive standby state to an active data-carrying state, changing the operational parameters of the communication architecture to maintain continuity.
2Reliability
If a backup secure communication link is established, then communication continuity is improved, but system complexity increases
Solution Approach 1:
The controller acts as an intermediary that manages the complexity of backup link configuration. It automatically determines which switches should be configured as primary or backup based on network topology, and it handles the distribution of appropriate security keys to the IED. This intermediary management reduces the burden on individual switches and simplifies the overall system configuration while maintaining high availability.
3Reliability
If security association keys are distributed to multiple switches, then backup link capability is enabled, but key management complexity increases
Solution Approach 1:
The controller serves as a central intermediary for key management, maintaining secure storage of master security association keys. It intelligently determines which keys to distribute to which switches based on their role (primary or backup) in the communication architecture. This centralized intermediary approach simplifies key management compared to distributed key generation and distribution, reducing complexity while enabling backup capability.
Data Source
AI summary
A controller for an electric power distribution system includes processing circuitry and a memory that includes instructions. The instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to determine that a first switch of the electric power distribution system is a primary switch communicatively coupled to an intelligent electronic device (IED) of the electric power distribution system, determine that a second switch of the electric power distribution system is a backup switch communicatively coupled to the IED, and distribute a first copy of a security association key (SAK) to the first switch and a second copy of the SAK to the second switch in response to determining that the first switch is the primary switch and the second switch is the backup switch to enable the first switch and the second switch to establish respective media access control security (MACsec) communication links with the IED.