Methods of securely controlling utility grid edge devices
Methods of securely controlling a utility grid edge device are provided. A method of securely controlling a utility grid edge device includes receiving renewed security information at a node that includes cryptographic circuitry. Moreover, the method includes controlling an operation of the utility grid edge device via the node, after receiving the renewed security information. Related nodes and utility grid edge devices are also provided.
1. A method of securely controlling a utility grid edge device, the method comprising:
receiving renewed security information, from a distributed certification authority (CA) server on a first node in a cluster of nodes, at a second node within the cluster of nodes and that is adjacent the utility grid edge device and that includes cryptographic circuitry comprising a Trusted Platform Module (TPM), wherein the first node, the second node receiving the renewed security information, and the utility grid edge device are each outside of a data center, wherein the second node comprises a memory comprising an agent and a workload, wherein the workload comprises an application that controls an operation of the utility grid edge device, and wherein receiving the renewed security information at the second node comprises:
receiving the renewed security information at the agent from the distributed CA server on the first node,
providing the renewed security information from the agent to the workload, wherein the renewed security information comprises a private digital security key and a public digital security key and automatically expires in no more than one hour, and
patching or updating the workload using a Public Key Infrastructure (PKI); then controlling the operation of the utility grid edge device via the second node.
2. The method of claim 1 , wherein the method further comprises using the renewed security information to provide identity-based encrypted communications between the workload and another workload that is on the second node or on another node within the cluster of nodes that is different from the first and second nodes.
3. The method of claim 2 , wherein the encrypted communications are provided via a data broker that is on the second node or on the another node in the cluster of nodes.
4. The method of claim 1 ,
wherein the utility grid edge device comprises a first utility grid edge device, and
wherein the method further comprises controlling, via the second node, an operation of a second utility grid edge device that is adjacent the second node.
5. The method of claim 4 , wherein adjacent the second node comprises no more than thirty meters from the second node.
6. The method of claim 4 , wherein controlling the operation of the first utility grid edge device and controlling the operation of the second utility grid edge device are performed via first and second workloads, respectively, on the first and second nodes.
7. The method of claim 1 , wherein controlling the operation of the utility grid edge device is performed via a direct, wired communications link that is between the second node and the utility grid edge device.
8. The method of claim 1 , wherein controlling the operation of the utility grid edge device is performed via a wireless communications link that is between the second node and the utility grid edge device.
9. The method of claim 1 ,
wherein the method further comprises providing trust bundles from a certificate authority (CA) to a distributed CA node orchestrator that communicates with the second node and a third node within the cluster of nodes, and
wherein the trust bundles comprise digital certificates and/or digital keys and enable communications, or other operations, with respect to utility grid edge devices.
10. The method of claim 1 , wherein the utility grid edge device is at a customer premise.
11. The method of claim 1 , wherein the utility grid edge device is a first utility grid edge device of a feeder and is adjacent a recloser of the feeder.
12. The method of claim 11 ,
wherein the feeder further comprises a second utility grid edge device and a third node within the cluster of nodes and that is adjacent to the second utility grid edge device, and
wherein the method further comprises using the renewed security information to provide encrypted communications between the second node and the third node.
13. The method of claim 1 ,
wherein the utility grid edge device is a first utility grid edge device of a microgrid,
wherein the microgrid further comprises a second utility grid edge device that is adjacent a third node, and
wherein the method further comprises using the renewed security information to provide encrypted communications between the second node and the third node.
14. The method of claim 1 , wherein controlling the operation of the utility grid edge device via the second node comprises:
removing a first workload from the second node and/or adding a second workload to the second node.
15. The method of claim 1 , further comprising, before
receiving the renewed security information:
powering-on the second node;
accessing a digital security key at the second node by using the cryptographic circuitry;
sending the digital security key from the second node to the distributed CA server on the first node;
receiving encrypted data at the second node from the distributed CA server on the first node;
decrypting the data at the second node;
transmitting the decrypted data from the second node to the distributed CA server on the first node; and
receiving a digital certificate at the second node from the distributed CA server on the first node, in response to transmitting the decrypted data from the second node to the distributed CA server on the first node.