Mobile Terminal Cybersecurity for Bulk Electrical Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Bulk Electrical Systems (BES) assets in the electrical utilities industry face significant cyber security threats during testing and maintenance routines conducted by mobile terminals, which fail to meet the cyber security requirements as defined by NERC CIP standards.
Innovation Solution
A method and system for protecting mobile terminal devices by configuring them to disconnect from all but a selected physical serial interface and wired network interface during testing, disabling internal firewalls and unselected interfaces, and enabling communication only through these selected interfaces to prevent cyber-attacks, and reverting to a network state after testing to re-enable firewalls and other interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mobile terminal is connected to network interfaces during testing, then communication capability is improved, but cyber security vulnerability increases
Solution Approach 1:
The mobile terminal dynamically switches between network state and test state, adjusting the operational status of communication interfaces and firewall based on the current task. During testing, interfaces are disabled and firewall is disabled; during network operations, interfaces are enabled and firewall is enabled, making the system adaptable to different security requirements
Solution Approach 2:
The communication interfaces are segmented into selected interfaces (enabled during testing) and remaining interfaces (disabled during testing). This segmentation allows the system to maintain only necessary connections while isolating potential security threats from unselected interfaces
2Measurement precision
If firewall is disabled during testing, then testing accuracy is improved, but security protection deteriorates
Solution Approach 1:
The firewall's operational status is dynamically adjusted based on the device state. In test state, the firewall is disabled to allow accurate testing without interference. In network state, the firewall is re-enabled to restore security protection. This dynamic adjustment resolves the contradiction between testing accuracy and security protection
3Object-affected harmful factors
If all network interfaces are disabled during testing, then cyber security is improved, but communication capability deteriorates
Solution Approach 1:
Communication interfaces are divided into selected interfaces (which may be enabled for testing) and remaining interfaces (which are disabled for security). This selective segmentation maintains communication capability through necessary interfaces while isolating potential security threats from unselected interfaces
Solution Approach 2:
Different interfaces have different operational qualities during testing. Selected interfaces maintain communication functionality while remaining interfaces are disabled for security. This local differentiation allows the system to optimize both security and communication capability simultaneously
4Adaptability or versatility
If mobile terminal switches states frequently, then security adaptability is improved, but system complexity increases
Solution Approach 1:
The system uses dynamic state switching between network state and test state to achieve security adaptability. The processor automatically adjusts interface configurations and firewall status based on the current state, providing a flexible yet manageable approach to security adaptation without excessive complexity
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method for protecting a mobile terminal device from cyber security threats, including the steps of: detecting that the mobile terminal device is successfully connected only through one or both of a selected physical serial interface connected to a device for facilitating the testing or a wired network interface, which is connected to an electrical utility device. Prior to executing a test routine by the mobile terminal device, switching the mobile terminal device to a test state by: disabling an internal firewall, disabling one or more remaining network interfaces and serial interfaces, such that existing communications or connections are terminated and new communications and connections are prevented. Enabling communication to one or both of the selected physical serial interface and the wired network interface, performing the testing on the at least one electrical utility device according to the executed test routines under control of the mobile terminal device until completion.