Wind Power Plant Local Authentication to Reduce Hacking Risk
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing power plant control systems face challenges in ensuring data safety and reducing the risk of hacking and unwanted access, particularly in wind turbine networks, where central server communication can lead to vulnerabilities.
Innovation Solution
A method and system where a local computer system within the private network manages user access by checking credentials and authorizations locally and requests updates from a central system only when necessary, ensuring direct communication and secure data storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a central server manages user authentication for all components, then centralized control is achieved, but communication vulnerabilities and hacking risks increase
Solution Approach 1:
The patent segments the authentication system into multiple independent local computer systems, each capable of autonomous authentication decisions. Instead of a single central server, each component has its own local authentication capability, dividing the system into isolated security zones that cannot be compromised simultaneously.
Solution Approach 2:
Each local computer system is equipped with local credential storage and authentication capability, making security decisions locally rather than relying on centralized communication. This localizes the security function to where it is most needed, reducing communication vulnerabilities.
2Speed
If local computer systems store credentials locally, then authentication speed increases, but security management complexity increases
Solution Approach 1:
The patent implements a universal credential format and authentication protocol that can be used across all local computer systems. This allows credentials to be stored and verified locally at each component while maintaining consistent security management across the entire power plant system.
3Productivity
If credentials are stored at each component, then authentication is faster, but the attack surface increases
Solution Approach 1:
By segmenting credential storage across isolated local systems rather than having a centralized credential repository, the patent reduces the attack surface. Each local system contains only the credentials necessary for its specific component, so a compromise at one location does not expose credentials for the entire system.
4Reliability
If the local computer system autonomously manages credentials, then system availability increases, but update management becomes more complex
Solution Approach 1:
The local computer system is designed to autonomously manage its own credentials, including local storage, verification, and update operations. The system can independently request credential updates from other local systems or central authorities when needed, without requiring manual intervention or system downtime, thus maintaining high availability while managing update complexity through automated procedures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure provides a method for authenticating and authorising user access to a component of a power plant within a private network of a renewable power plant comprising one or more wind turbine generators. The method comprises a step of providing at a local computer system in the private network a list of credentials and authorisations representing a plurality of identifiers and authenticators of users and corresponding access authorisations. The local computer is in direct communication with components of the power plant and is configured to receive a request for access from a user via a computer interface in the component in the private network. The method comprises a step of checking if the requested access can be granted by consulting the list of credentials and authorisations, and in case access can be granted, communicating from the local computer the grant to the computer interface in the component, and in case access cannot be granted, communicating a request for update of the list of credentials and authorisations at the local computer system from the local computer system to a central computer system outside the private network.