Block-Based Authentication for Substation Message Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing message securing methods in industrial process control systems, particularly substation automation, face significant delays and high costs due to large processing overheads, which violate real-time constraints and hinder the application of enhanced security measures like asymmetrical encryption.
Innovation Solution
A method for securing multi-block messages using block-based authentication and integrity checks, where authentication information of each block is generated based on the previous block's residue, allowing on-the-fly processing and transmission, and integrity checks are performed in parallel to reduce computation costs and meet real-time requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication algorithms are used to generate signatures from entire messages, then message security is improved, but processing time and delays increase significantly
Solution Approach 1:
The message is divided into fixed-size blocks, and authentication is performed block-by-block using a chain MAC algorithm. Each block's authentication code is generated based on the previous block's code, allowing incremental processing rather than waiting for the entire message, thus reducing processing time while maintaining security
Solution Approach 2:
Authentication codes are generated for each block as soon as the block is received, before the complete message is available. This preliminary action allows parallel processing and reduces the overall authentication time by not waiting for the entire message to be received before starting authentication
2Reliability
If asymmetrical encryption algorithms are used for digital signatures, then authentication security is improved, but real-time constraints are violated due to high computation time
Solution Approach 1:
The message processing is segmented into fixed-size blocks that can be processed independently and incrementally. This segmentation enables the system to work on smaller units of data, improving throughput and meeting real-time constraints while maintaining security through the chain MAC algorithm that processes blocks sequentially with carry-over authentication state
Solution Approach 2:
The system changes the authentication approach from traditional full-message signature generation to a block-based chain MAC algorithm with configurable block sizes. This parameter change allows optimization of processing speed while maintaining authentication security, enabling real-time processing in substation automation systems
3Reliability
If integrity check operations are performed on complete messages, then data integrity is ensured, but transmission and forwarding delays increase
Solution Approach 1:
The integrity check is applied to segmented blocks rather than complete messages. Each block undergoes authentication code generation that contributes to the overall integrity verification, allowing incremental integrity checking as blocks are received and transmitted, reducing the total time required for integrity verification
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention is concerned with securing messages 100 within a communication network of an industrial process control system, in particular of a substation automation system. Specifically, the present invention relates to a method of and a system for securing messages 100. A multi-block message 100 to be transmitted via a communication network is secured by a block-based authentication, encryption and/or integrity information. Only residue of the previous block 101, 102, 103, 104, 107 in form of block based information is needed to generate the block based information of the next block 101, 102, 103, 104, 107. Therefore, the previous block 101, 102, 103, 104, 107 can already be transmitted while block based information of the next block 101, 102, 103, 104, 107 is generated. This enables on-the-fly authentication of the multi-block message 200 and authentication at an increased rate.