Configurable network security for networked energy resources, and associated systems and methods
Secure communication between users and resources of an electrical infrastructure and associated systems and methods. A representative secure distributed energy resource (DER) communication system provides for the creation of trust rules that govern the permitted communications between users and resources of an electrical infrastructure system, and the enforcement of the trust rules.
1. A method, performed by a computing system, to secure access to networked electrical power generation load control and storage resources, the method comprising:
maintaining, at a computing system, a trust policy comprised of a plurality of trust rules, wherein each trust rule comprises an origin identifier, a target identifier, and an action identifier;
generating a first Information Centric Networking (ICN) message based on a trust rule selected from the plurality of trust rules, wherein the target identifier of the selected trust rule corresponds to a networked electrical power generation load control and storage resource (NEPGLSR);
publishing, on a communication channel, the first ICN message, wherein the publication of the first ICN message causes an enforcement computing system, on the communication channel and associated with a first entity, to maintain authorization information characterized by the origin identifier, target identifier, and action identifier of the selected trust rule;
cryptographically signing a certificate associated with a second entity, wherein the second entity corresponds to the origin identifier of the selected trust rule, and wherein the certificate includes a second entity name defined in an ICN hierarchical namespace and a second entity public key; and
wherein the enforcement computing system, in response to subscribing to a second ICN message, the second ICN message including the second entity name defined in the ICN hierarchical namespace:
determines, from the second ICN message, a target identifier and an action identifier of the second ICN message, wherein the target identifier of the second ICN message corresponds to the NEPGLSR; and
determines whether the second entity, associated with the second entity name, is authorized to perform an action, corresponding to the action identifier of the second ICN message, on the NEPGLSR, based on the maintained authorization information.
2. The method of claim 1 , wherein the second ICN message is cryptographically signed based on a private key associated with the second entity, and wherein in response to subscribing to the second ICN message the enforcement computing system further:
validates, based on the cryptographically signed second ICN message and the second entity public key, that the second ICN message was published by the second entity and that the second ICN message was not altered after it the second ICN message was cryptographically signed.
3. The method of claim 2 , wherein the certificate associated with the second entity has a cryptographic signing chain including a trust anchor key, and wherein in response to subscribing to the second ICN message the enforcement computing system further:
determines, based on the cryptographically signed second ICN message and the second entity public key, that the second entity is authorized by the trust anchor key.
4. The method of claim 1 , wherein the first ICN message is generated based on at least two trust rules selected from the plurality of trust rules.
5. The method of claim 1 , wherein the origin identifier and the target identifier of the second ICN message are each defined in the ICN hierarchical namespace.
6. The method of claim 1 , wherein the first ICN message and the certificate associated with the second entity have a signing chain with a common trust anchor key, and wherein determining whether the second entity is authorized to perform the action of the second ICN message is based further on validating the first ICN message and the certificate with a trust anchor certificate.
7. The method of claim 1 , further comprising:
publishing a third ICN message, associated with the same target identifier as the first ICN message, wherein the third ICN message characterizes actions permitted to be performed by a third entity on the NEPGLSR.
8. The method of claim 1 , wherein at least one trust rule of the plurality of trust rules further comprises a condition.
9. The method of claim 8 , wherein the condition of the at least one trust rule specifies a window of time during which an entity associated with the origin identifier of the at least one trust rule can perform an action, based on the action identifier of the trust rule, on an entity associated with the target identifier of the at least one trust rule.
10. The method of claim 8 , wherein the condition of the at least one trust rule specifies a status, and wherein an entity associated with the origin identifier of the at least one trust rule can perform an action on an entity associated with the target identifier of the at least one trust rule, when a status associated with the entity associated with the target identifier of the at least one trust rule matches the at least one trust rule status.
11. The method of claim 10 , wherein the at least one trust rule status is one of normal operation, maintenance operation, or emergency operation.
12. The method of claim 1 , wherein the second ICN message comprises a software image, and wherein determining that the second entity is allowed to perform the action corresponding to the action identifier of the second ICN message causes software associated with the NEPGLSR to be updated based on the software image.
13. The method of claim 1 , wherein the target identifier of at least one trust rule is associated with a plurality of solar cells.
14. The method of claim 1 , wherein the origin identifier of at least one trust rule is a user associated with an infrastructure provider, a user associated with a NEPGLSR vendor, or an end-user.
15. The method of claim 1 , wherein the communication channel over which the second ICN message is published utilizes Institute of Electrical and Electronics Engineers (IEEE) 2030.5, Distributed Network Protocol 3 (DNP3), modbus, long range (LoRa) mesh communication, or Transmission Control Protocol/Internet Protocol (TCP/IP).
16. The method of claim 1 , wherein the first entity corresponds to the origin identifier of the selected trust rule.
17. The method of claim 1 , wherein the first entity corresponds to the target identifier of the selected trust rule.