Dynamic MACsec Link Mode Switching in Power Distribution IEDs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electric power distribution systems face difficulties in adjusting the mode of secure communication links between intelligent electronic devices (IEDs) and gateways, making it challenging to change the functionality of these links, such as blocking access to sensitive data.
Innovation Solution
The system includes processing circuitry and memory in IEDs that enable the establishment and adjustment of Media Access Control Security (MACsec) communication links, allowing for switching between modes by generating and distributing security association keys (SAKs) to establish secure communication links that can be either accessible or inaccessible to external devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure communication link is established in confidential mode to block access to communication traffic, then data security and confidentiality are improved, but the ability to adjust or change the functionality of the communication link deteriorates
Solution Approach 1:
The patent implements dynamic adjustability of MACsec communication links by allowing switching between confidential mode (blocking access to traffic) and non-confidential mode (allowing access). The system can change security parameters and reconfigure communication links on-demand, enabling the same physical link to adapt its security characteristics based on operational requirements without requiring hardware changes.
Solution Approach 2:
The patent changes security parameters of the MACsec communication link, specifically the confidentiality parameter, to switch between operational modes. By modifying security association parameters and reconfiguring the communication link settings, the system transitions between confidential and non-confidential modes, allowing flexible adjustment of data protection levels while maintaining the same physical communication infrastructure.
2Reliability
If a MACsec communication link is established in confidential mode, then access to communication traffic is blocked, but the complexity of establishing and managing the secure link increases
Solution Approach 1:
The patent implements self-service mechanisms where the system automatically manages MACsec security associations, key distribution, and mode switching without requiring manual configuration. The intelligent electronic device can autonomously establish secure links, negotiate security parameters, and transition between confidential and non-confidential modes based on operational context, reducing the operational complexity despite the advanced security features.
3Reliability
If secure communication links are established with different modes for different data, then data confidentiality is improved, but the number of communication links and management overhead increases
Solution Approach 1:
The patent makes the MACsec communication link universal by enabling it to operate in multiple modes (confidential and non-confidential) depending on the data being transmitted. Rather than requiring separate dedicated links for different security requirements, the same physical link can be dynamically reconfigured to provide appropriate security levels for different communication needs, reducing the total number of links required while maintaining confidentiality where needed.
Data Source
AI summary
An intelligent electronic device (IED) of an electric distribution system includes processing circuitry and a memory having instructions. The instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to perform operations that include receiving an indication to establish a media access control security (MACsec) communication link in accordance with a confidential mode configured to block access to communication traffic associated with the MACsec communication link, indicating that the MACsec communication link is to be established in accordance with the confidential mode, receiving establishment of the MACsec communication link in accordance with the confidential mode, and communicating data via the MACsec communication link.