Security event logging in process control
View Patent ↗A method and gateway are provided for extracting 61850 security events from general IEC 61850 events and merging them together with standard IT or other security events at station level or even higher system levels. Thus, the coexistence of two different protocols on the substation bus is allowed, providing greater flexibility in the design of a Substation Automation (SA) system, for example in SA systems with a mix of IEC 61850-compliant Intelligent Electronic Devices (IEDs) and SA devices that do not adhere to IEC 61850 communication protocols.
1. A method of handling security events in a Process Control (PC) system which includes a communication network interconnecting devices of the PC system, the method comprising:
transmitting, on the communication network, by first and second devices of the PC system, security event messages including security event information according to a first protocol and a second protocol, respectively, the first protocol being one of an International Electrotechnical Committee (IEC) 61850-7-4 protocol and a Syslog protocol, and the second protocol being the other one of the IEC 61850-7-4 protocol and the Syslog protocol;
receiving a first security event message according to the first protocol, and extracting security event information from the first security event message; and
mapping the extracted security event information to the second protocol,
wherein the first protocol is the IEC 61850-7-4 protocol and the second protocol is the Syslog protocol, and
wherein the method comprises:
by a gateway device connected to the communication network, converting the extracted security event information into a Syslog message;
providing the Syslog message to a Syslog archive;
by the gateway device, based on a security event severity indication of the first message indicating an alarm, converting the extracted security event information into an Network Control Center (NCC) message according to an NCC protocol; and
providing the NCC message to an NCC of the electrical power system.
2. The method according to claim 1 , wherein the first protocol is the IEC 61850-7-4 protocol and the second protocol is the Syslog protocol, and
wherein the method comprises:
by a log archive connected to the communication network, coding the extracted security event information as a security event log entry according to the Syslog protocol; and
storing the log entry at the log archive.
3. The method according to claim 1 , comprising:
converting a security event severity indication included in a Data Attribute of a Generic Security Application (GSAL) Logical Node hosted by a source Intelligent Electronic Device (IED) of the first message to a Syslog priority indication.
4. The method according to claim 1 , wherein the first protocol is the Syslog protocol and the second protocol is the IEC 61850-7-4 protocol, and
wherein the method comprises:
by a gateway device connected to the communication network, converting the Syslog message into an IEC 61850 message; and
forwarding the IEC 61850 message to a Network Control Center (NCC).
5. The method according to claim 4 , comprising:
comparing, by the gateway device, excerpts of a Syslog event message to a plurality of identifier character strings; and
identifying the first security event message based on an outcome of the comparison.
6. A gateway device for a Substation Automation (SA) system automating an electrical power substation,
wherein the gateway device is configured to be connected to a substation communication network interconnecting Intelligent Electronic Devices (IEDs) transmitting security event messages according to an International Electrotechnical Committee (IEC) 61850-7-4 protocol and to SA devices transmitting security event messages according to a Syslog protocol,
wherein the gateway device is configured to:
receive a security event message from an IED or from an SA device according to the respective protocol;
map security event information extracted from the security event message to the other respective protocol;
based on a security event severity indication of the message indicating an alarm, convert the extracted security event information into an Network Control Center (NCC) message according to an NCC protocol, and provide the NCC message to an NCC of the electrical power substation;
compare excerpts of a message received from an SA device to a plurality of identifier character strings;
identify the message as a security event message based on an outcome of the comparison;
convert the identified security event message into a message according to the IEC 61850-7-4 protocol; and
forward the converted IEC 61850 message to a Network Control Center (NCC) of the electrical power substation.
7. The method according to claim 1 , wherein the PC system is included in a Substation Automation (SA) system for a substation of an electrical power system.
8. The method according to claim 2 , comprising:
converting a security event severity indication included in a Data Attribute of a Generic Security Application (GSAL) Logical Node hosted by a source Intelligent Electronic Device (IED) of the first message to a Syslog priority indication.
9. A non-transitory computer-readable recording medium having a computer program recorded thereon that causes a processor of a computer processing device to handle security events in a Process Control (PC) system, which includes a communication network interconnecting devices of the PC system, wherein in the PC system, first and second devices transmit, on the communication network, security event messages including security event information according to a first protocol and a second protocol, respectively, the first protocol being one of an International Electrotechnical Committee (IEC) 61850-7-4 protocol and a Syslog protocol, and the second protocol being the other one of the IEC 61850-7-4 protocol and the Syslog protocol, wherein the computer program causes the processor to execute operations comprising:
receiving a first security event message according to the first protocol, and extracting security event information from the first security event message; and
mapping the extracted security event information to the second protocol,
wherein the first protocol is the IEC 61850-7-4 protocol and the second protocol is the Syslog protocol, and
wherein the operations comprise:
by a gateway device connected to the communication network, converting the extracted security event information into a Syslog message;
providing the Syslog message to a Syslog archive;
by the gateway device, based on a security event severity indication of the first message indicating an alarm, converting the extracted security event information into an Network Control Center (NCC) message according to an NCC protocol; and
providing the NCC message to an NCC of the electrical power system.
10. The non-transitory computer-readable recording medium according to claim 9 , wherein the PC system is included in a Substation Automation (SA) system for a substation of an electrical power system.