3.2_Securing Microgrids, Substations, and Distributed Autonomous Systems_Lawrence_EPRI/SNL Microgrid
•Descargar como PPTX, PDF•
1 recomendación•751 vistas
Presentation from the EPRI-Sandia Symposium on Secure and Resilient Microgrids: Securing Microgrids, Substations, and Distributed Autonomous Systems, presented by David Lawrence, Duke Energy Emerging Technology Office, Baltimore, MD, August 29-31, 2016.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Destacado
Destacado (10)
Similar a 3.2_Securing Microgrids, Substations, and Distributed Autonomous Systems_Lawrence_EPRI/SNL Microgrid
Similar a 3.2_Securing Microgrids, Substations, and Distributed Autonomous Systems_Lawrence_EPRI/SNL Microgrid (20)
Más de Sandia National Laboratories: Energy & Climate: Renewables
Más de Sandia National Laboratories: Energy & Climate: Renewables (20)
Último
Último (20)
3.2_Securing Microgrids, Substations, and Distributed Autonomous Systems_Lawrence_EPRI/SNL Microgrid
- 1. Duke Energy Emerging Technology Office Securing Microgrids, Substations, and Distributed Autonomous Systems Duke Energy’s Emerging Technology Office 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 1
- 2. Duke Energy Microgrid Test Site: Mount Holly, NC PV Installations Battery & Load-bank Behind the meter and control room Grid Equipment Copyright © 2016 Duke Energy Corporation All rights reserved. Islanding Switch 9/14/2016 page 2
- 3. Mount Holly Microgrid Components 250kW/250kWh ATL Battery Energy Storage SystemPadmount Recloser 1000kVA Transformer 1200A Disconnect 75kVA Transformer Meter Structure Secondary Cabinet 275kVA Step-up Transformer 100kW Output Hanwha model 305 HSL72 Parker 100kVA Inverter 380 Polycrystalline Panels 10kW Output 310Watt HSL72 ABB PowerOne Uno 8.6 kW 30 Polycrystalline Panels 500kW Avtron Load Bank Not Pictured 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 3
- 4. Substation Hardening and Physical Security 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 4
- 5. Transmission Security Program • Duke Energy’s approach to meeting CIP 014 physical security requirements is based on the loss of the substation, not on a single piece of equipment Requirements NERC CIP 14 Access Controls – Control House and Main Gate Cameras (Perimeter ) Cameras (Site coverage) Security Lighting Perimeter IDS Blue Light Perimeter System High Security Fence Equipment Ballistic Protection Control House Hardening Cable Duct Bank Hardening Gunshot Detection System Telecomm Building / Equipment Hardening Anti-Ram Vehicle Gate Vegetation Management Response Plans (LLE & FD) 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 5
- 6. Internet Duke Energy Networks DMZ Router Intrusion Detection Firewall Business Laptop Encryption Inbound Filter Antivirus Secure Web Delivery Web Filter Antivirus Antivirus Protection Intrusion Prevention E-MailWebServers/PCs Virtual Private Network Firewall Intrusion Detection Event Management Network Operations Intrusion Detection Firewall Antivirus Protection One-way Data Flow 2-Factor Authentication • Smart Grid •Generation • Transmission • Distribution • Customer • Financial • HR • Legal • Supply Chain • Customer apps • External web sites Event Management Data Loss Prevention 6 Defense in Depth Cyber Architecture 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved.
- 7. -7- Enhancing DER Integration with OpenFMB Key Observations: 1. Single-Purpose Functions 2. Proprietary & Silo’ed systems 3. Latent , Error-prone Data 4. OT/IT/Telecom Disconnected 5. No Field Interoperability! UTILITY CENTRAL OFFICE Head End A Vendor A Solution Private Carrier R Head End C Vendor C Solution Public Carrier 900MHz ISM EnterpriseServiceBus Head End B Vendor B Solution Proprietary Network R UTILITY CENTRAL OFFICE Head End A Head End B Head End C EnterpriseServiceBus Node 3G, LTE, Wi-Fi, Fiber, Ethernet, RF ISM, or PLC Node FieldMessageBus Any Medium Key Observations: 1. Multi-Purpose Functions 2. Modular & Scalable HW&SW 3. End-to-End Situational Awareness 4. OT/IT/Telecom Convergence 5. True Field Interoperability!
- 8. Field Message Bus Meter Recloser / PCC Open Field Message Bus: Operation page 8 Pub / Sub Messages KW A/B/C KVAR A/B/C V A/B/C I A/B/C PhAngle A/B/C KWh SOC TimeStamp Rssi Pub / Sub Status, Events, Alarms, and Control Trip / Open TimeStamp • Pub each 2 seconds or real time • Status – real time on change Microgrid optimization rules engine Microgrid Controller ESSPV Meter Behavior Analyst observes the white-listed Microgrid for correctness Copyright © 2016 Duke Energy Corporation All rights reserved.9/14/2016 Security Behavior Analyst
- 9. Security Analytics Framework page 9 Secure Pub/Sub Secure Transport Data Model Use Case Describe “Commission, Update, Operate, Retire” Trust: PKI, white-listing, authentication, authorization, and access control. Behavior Analysis Copyright © 2016 Duke Energy Corporation All rights reserved.9/14/2016 Define Actors, Topics, Profiles, Semantics, Behavior, Security Messaging Best practice Secure Messaging: AMQP, DDS, MQTT on top of the TCP/IP – UDP stack Transport TLS 1.2 Transport Security Security Behavior Analysis IDS with Protocol Knowledge Deep Learning -Circuit Understanding Detect, Isolate, Restore
- 10. Distributed System of Systems 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 10
- 11. 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 11 Thank you
- 12. OpenFMB™ Logical Architecture Copyright © 2016 Duke Energy Corporation All rights reserved. Field Applications Adapters (Modbus, DNP3, IEC 61850 GOOSE/MMS, ANSI C12, CoAP, XMPP, Others) OpenFMB™ Interface Layer (Data Models and Profiles, Configurations, Interaction Patterns, Security) AMQP DDS MQTT Other Pub/Sub Middleware Application Layer Interface Layer Pub/Sub Layer End Device 1 End Device 2 End Device 3 Layered Security Approaches
- 13. OpenFMB™ Management Services Logical Architecture OpenFMB™ Management Services Layer (Plug-ins, Updates, Installation, Health Monitoring, Alerting, Auditing) OpenFMB™ Interface Layer (Data Models and Profiles, Configurations, Interaction Patterns, Security) AMQP DDS MQTT Other Pub/Sub Middleware Clients Services Layer Interface Layer Pub/Sub Layer ConfigurationsMiddleware Applications Adapters Layered Security Approaches Middleware Broker Middleware Client Management Services Administration Copyright © 2016 Duke Energy Corporation All rights reserved. Administration Layer
- 14. Why Distributed Systems are Important • Distributed Energy Resources, Microgrids, and Advanced Demand Response require field devices to work together with little latency or delay. • Key to more efficient, cost-effective, and secure grid – Leverage existing grid network infrastructure / underutilized assets – Reduces effort in device configuration, management, and commissioning – Improves Situational Awareness of OT and IT systems – Resiliency when Portions of the Grid are Segmented • Back office integration is expensive and time consuming – Hidden costs and inefficiencies with siloed, single-function solutions – “Big Data” complexity caused by lots of “Small Data” problems • Open Standards does NOT mean interoperable page 14 Copyright © 2016 Duke Energy Corporation All rights reserved. 9/14/2016
- 15. Typical List of Cybersecurity Requirements -1 • Secure the Supply Chain with extremely specific procurement language • Work with Vendors to assure robust secure development, testing, manufacturing, and shipping practices • Reduce complexity page 15 • Deny-by-Default, however you cannot deny what you must permit • Deep packet inspection and policy management for OT / IT / perimeter • Traffic Engineering: ICS white-listing, SDN, Topics • Reliability & Determinism of Network • System wide visualization • Detect, Isolate, and Inoculate the Threat; Restore the system and power • Measure resiliency 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved.
- 16. Typical List of Cybersecurity Requirements -2 • Authentication, PKI, and Certificates • Encryption • Role-based Authorization • Access Control Lists page 16 • Account, Session, Password Management • Logging and Auditing • Malware Detection and Protection • Heartbeat Signals • Reliability and Adherence to Standards • Documentation and Tracking of Vulnerabilities • Problem Reporting • Patch Management and Firmware Updates • Vendor Access Management • Secure Hardware and Software Delivery 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved.
- 17. Typical List of Cybersecurity Requirements -3 • Configuration and Commissioning • Patch Management and Extensibility page 17 Copyright © 2016 Duke Energy Corporation All rights reserved. • Security (inside & outside datacenter); cyber and physical • Data aggregation and local storage • Modularity, Flexibility, and Upgradability • Cyber-defense must be built into system security • Policy based management to define and model appropriate device behavior and govern response to significant events • Common operational picture of cybersecurity health for rapid fault assessment, analysis, and response • Integrate with additional systems such as physical security, physical access control, and user access control to make grid operations more resilient 9/14/2016
- 18. Beautiful Day – No Clouds 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 18
- 19. Beautiful Day – Cirrus Clouds on the Move 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 19
- 20. DDS Security Overview • Configured at the DDS layer • Transparent to apps and adapters • Runs over any transport – Including low bandwidth, unreliable – Multicast for scalability, low latency – Does not require TCP, (D)TLS or IP • Plugin architecture – Built-in defaults – Customizable via standard API • Completely decentralized – High performance and scalability – No single point of failure Secure DDS library Authentication Access Control Encryption Data Tagging Logging App / Adapter Any Transport (e.g., TCP, UDP, multicast, shared memory, ) 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 20
- 21. Standard Security Capabilities Authentication X.509 Public Key Infrastructure (PKI) with a pre- configured shared Certificate Authority (CA) Digital Signature Algorithm (DSA) with Diffie-Hellman and RSA for authentication and key exchange Access Control Specified via permissions file signed by shared CA Control over ability to join systems, read or write data topics Cryptography Protected key distribution AES128 and AES256 for encryption HMAC-SHA1 and HMAC-SHA256 for message authentication and integrity Data Tagging Tags specify security metadata, such as classification level Can be used to determine access privileges (via plugin) Logging Log security events to a file or distribute securely over DDS 9/14/2016 Copyright © 2016 Duke Energy Corporation All rights reserved. page 21
Notas del editor
- The Emerging Technology Office at Duke Energy is tasked with looking into the future and trying to solve problems that may negatively impact our company and our industry. Over the past five years, we have watched as interoperability is discussed and debated at various industry groups and standards bodies but have seen no real breakthroughs in technology. In order to achieve true interoperability, vendors and manufactors will have to fully buy in and change their proprietary approaches. To date , this has not happened this coalition work is Duke’s way to try and kick start the industry down this path. By no means do we think we have all the answers; but we wanted to show that real interoperability is achievable In its simplest form – interoperability in the utility between devices and systems will reduce costs for the utility and their customers and provide greater operational benefits including enhanced reliability Packaged solutions do not allow for utilities to get the best of breed hardware, communications, and software
- The Emerging Technology Office at Duke Energy is tasked with looking into the future and trying to solve problems that may negatively impact our company and our industry. Over the past five years, we have watched as interoperability is discussed and debated at various industry groups and standards bodies but have seen no real breakthroughs in technology. In order to achieve true interoperability, vendors and manufactors will have to fully buy in and change their proprietary approaches. To date , this has not happened this coalition work is Duke’s way to try and kick start the industry down this path. By no means do we think we have all the answers; but we wanted to show that real interoperability is achievable In its simplest form – interoperability in the utility between devices and systems will reduce costs for the utility and their customers and provide greater operational benefits including enhanced reliability Packaged solutions do not allow for utilities to get the best of breed hardware, communications, and software
- Completely decentralized, no broker or servers High performance No single point of failure or unplanned downtime Secures internal and external communication Runs over any transport protocol, network type Does not require IP or a high bandwidth, reliable network Supports multicast for scalability, low latency Select encryption or message authentication Only private data incurs encryption overhead Up to 100x faster Customizable plugin architecture Integrate with existing security infrastructures Leverage hardware acceleration Data Distribution Service (DDS) compliant Interoperability across suppliers Works with unmodified existing DDS applications