Security framework for transmitting communication messages between a substation LAN and packet-switched WAN
View Patent ↗The invention relates to the field of a security framework for transmitting communication messages between a Substation LAN and packet-switched WAN, in particular, a network interface for transmitting protection data in a power network. The present invention provides a network interface for transmitting communication data including protection data of a power communication network, between a Substation Ethernet LAN and a packet-switched WAN usually in Layer 2. The network interface comprises: a firewall and a Layer 3 router being connected with each other and adapted to transmit the communication data excluding the protection data; and a Layer 2 bypass being in parallel with the firewall and the Layer 3 router, and adapted to transmit the protection data. According to a further aspect, the present invention also provides a method for transmitting such communication data.
1. A network interface for transmitting communication data including protection data of a power communication network between a Substation LAN and a packet-switched WAN, comprising:
a firewall and a Layer 3 router being connected with each other, and configured to transmit the communication data excluding the protection data via a first communication channel;
a Layer 2 bypass being in parallel with the firewall and the Layer 3 router, and configured to transmit the protection data via a second communication channel; and
a Layer 2 switch arranged between the WAN and the Layer 2 bypass, the firewall and the Layer 3 router, wherein the Layer 2 switch is configured to merge or separate the protection data with or from the communication data.
2. The network interface according to claim 1 ,
wherein the Layer 2 bypass is configured to filter the protection data from the communication data based on parameter of the protection data.
3. The network interface according to claim 1 ,
wherein the Layer 2 bypass is configured to authenticate the protection data using a digital signature.
4. The network interface according to claim 1 ,
wherein the Layer 2 bypass is configured to provide the protection data with network routing information.
5. The network interface according to claim 1 ,
wherein the Layer 2 bypass is configured to verify the routing information and the digital signature of the protection data.
6. The network interface according to claim 1 ,
wherein the Layer 2 bypass is configured to filter the protection data from the communication data based on parameter of the protection data; and
wherein the Layer 2 bypass is configured to authenticate the protection data using a digital signature.