System and method for grid based cyber security
A method and system for providing a secure communication network using an electrical distribution grid is disclosed. A device connected to the electrical distribution grid initiates a request for a secured key token by signaling an intelligent communicating device residing at or near an edge of the grid. The intelligent communicating device forwards the request to a receiver at a distribution substation on the electrical grid. This receiver enhances the properties of the request such that a grid location for the request can be inferred. The enhanced request is forwarded to a server at the distribution substation, which compares the request grid location to a Grid Map and Policies of known secure grid locations. Any inconsistencies between the grid location inferred from the enhanced request and the Grid Map and Policies locations are considered evidence of tampering, and the server rejects the request.
1. A method for establishing a secure communication path over an electrical distribution grid, comprising:
receiving, by a computing device, a signal from a receiver coupled to the electrical distribution grid in an electrical substation, the signal comprising:
a request, received by the receiver via the electrical distribution grid from an intelligent communicating device (ICD) located at an edge of the electrical distribution grid, for a key token for use in secure communications;
an electrical phase on which the signal was received by the receiver; and
an electrical feeder on which the signal was received by the receiver;
based on the electrical phase and the electrical feeder, inferring an inferred location of the ICD;
based on the inferred location of the ICD, obtaining the key token; and
causing, by the computing device, the key token to be communicated to the ICD via the electrical distribution grid.
2. The method of claim 1 wherein the request further comprises a unique identifier (ID) that uniquely identifies the ICD, and wherein based on the inferred location of the ICD, obtaining the key token comprises:
accessing a grid map that correlates unique IDs of ICDs coupled to the electrical distribution grid to corresponding physical locations of the ICDs;
determining that the inferred location of the ICD matches the physical location of the ICD identified in the grid map; and
based on determining that the inferred location of the ICD matches the physical location of the ICD identified in the grid map, obtaining the key token.
3. The method of claim 1 wherein obtaining the key token comprises:
sending a request to a key distribution server for the key token; and
receiving the key token from the key distribution server.
4. A system for establishing a secure communication path over an electrical distribution grid, comprising:
a computing device comprising:
a communication interface; and
a processor device coupled to the communication interface and configured to:
receive a signal from a receiver coupled to the electrical distribution grid in an electrical substation, the signal comprising:
a request received by the receiver via the electrical distribution grid from an intelligent communicating device (ICD) located at an edge of the electrical distribution grid for a key token for use in secure communications;
an electrical phase on which the signal was received by the receiver; and
an electrical feeder on which the signal was received by the receiver;
based on the electrical phase and the electrical feeder, inferring an inferred location of the ICD;
based on the inferred location of the ICD, obtaining a key token; and
causing, by the computing device, a transmitter to transmit the key token to the ICD via the electrical distribution grid.
5. The system of claim 4 wherein the request further comprises a unique identifier (ID) that uniquely identifies the ICD, and wherein to obtain the key token the processor device is further configured to:
access a grid map that correlates unique IDs of ICDs coupled to the electrical distribution grid to corresponding physical locations of the ICDs;
determine that the inferred location of the ICD matches the physical location of the ICD identified in the grid map; and
based on determining that the inferred location of the ICD matches the physical location of the ICD identified in the grid map, obtain the key token.
6. The system of claim 4 wherein to obtain the key token the processor device is further configured to:
send a request to a key distribution server for the key token; and
receive the key token from the key distribution server.
7. The system of claim 4 , further comprising:
the receiver; and
the transmitter.