Systems and methods for managing secure communication sessions with remote devices
According to various embodiments, a session manager generates, stores, and periodically updates the login credentials for each of a plurality of connected IEDs. An operator, possibly via an access device, may provide unique login credentials to the session manager. The session manager may determine the authorization level of the operator based on the operator's login credentials, defining with which IEDs the operator may communicate. According to various embodiments, the session manager does not facilitate a communication session between the operator and a target IED. Rather, the session manager maintains a first communication session with the operator and initiates a second communication session with the target IED. Accordingly, the session manager may forward commands transmitted by the operator to the target IED. Based on the authorization level of the operator, a session filter may restrict what may be communicated between an operator and an IED.
1. A method for managing login credentials and communication sessions of a plurality of intelligent electronic devices (IEDs), comprising:
connecting each of a plurality of IEDs to a session manager, the plurality of IEDs comprising a first subset and a second subset, the first subset of IEDs being the only IEDs in the plurality of IEDs to support an advanced security feature;
generating a plurality of login credentials for each of the plurality of IEDs using the session manager;
storing the plurality login credentials in a database accessible by the session manager;
creating a first communication session between the session manager and an operator access device, the operator access device requesting access to an IED in the second subset;
creating a second communication session between the session manager and the requested IED by the session manager providing login credentials of the requested IED; and
simulating the advanced security feature by using the session manager as a proxy for communications between the first communication session and the second communication session, the session manager enforcing the advanced security feature in the second communication session.
2. The method of claim 1 , wherein the plurality of login credentials each comprise a username and a password.
3. The method of claim 1 , wherein generating the plurality of login credentials for each of the plurality of IEDs comprises generating unique login credentials for a plurality of access levels of at least one of the plurality of IEDs.
4. The method of claim 1 , wherein connecting each of the plurality of IEDs comprises connecting each IED to the session manager using at least one of an Ethernet cable, a serial cable, a coaxial cable, an optical cable, and a wireless connection.
5. The method of claim 1 , wherein simulating the advanced security feature further comprises:
associating a plurality of operator login credentials with a plurality of operators, each of the plurality of operator login credentials having an authorization level specifying the access level of the associated operator.
6. A method of claim 5 , further comprising:
receiving one of the plurality of operator login credentials by the session manager;
determining the authorization level of the received operator login credentials using the session manager.
7. The method of claim 6 , further comprising:
receiving a request from the operator access device to communicate with a connected IED within the authorization level of the received operator login credentials; and
the session manager selectively relaying communications received from the operator access device in the first communication session to the requested IED in the second communication session.
8. The method of claim 6 , further comprising:
suppressing communications between the operator and the IED that exceed the authorization level of the operator.
9. The method of claim 6 , further comprising recording access events associated with the login credentials of the operator using the session manager.
10. The method of claim 6 , further comprising the session manager:
providing the operator access device with a list of connected IEDs;
receiving a request from the operator access device to communicate with one of the listed IEDs within the authorization level of the received operator login credentials;
initiating a second communication session between the session manager and the requested IED by the session manager providing login credentials of the requested IED; and
selectively relaying communications received from the operator access device in the first communication session to the requested IED in the second communication session.
11. The method of claim 10 , wherein the list comprises only those IEDs within the authorization level of the received operator login credentials.
12. The method of claim 1 , further comprising translating a first data protocol to a second data protocol.
13. The method of claim 1 , wherein the advanced security feature comprises one of an expanded character for use in connection with the plurality of logic credentials.
14. The method of claim 1 , wherein the advanced security feature comprises requiring a user to update an associated login credential at a specified time interval.
15. A session manager for managing login credentials and communication sessions of a plurality of intelligent electronic devices (IEDs), comprising:
a bus;
a processor in communication with the bus;
a plurality of ports in communication with the bus and configured to allow for the connection of a plurality of IEDs to the session manager, the plurality of IEDs comprising a first subset and a second subset, the first subset of IEDs being the only IEDs in the plurality of IEDs to support an advanced security feature; and
a computer-readable storage medium in communication with the bus, the computer-readable storage medium comprising:
an IED credential manager module executable on the processor and configured to:
generate login credentials for each connected IED;
store the login credentials of the connected IEOs in a database accessible to the session manager;
initiate a first communication session between the session manager and an operator access device, the operator access device requesting access to an IED in the second subset;
initiate a second communication session between the session manager and the requested IED by the session manager providing login credentials of the requested IED;
simulate the advanced security feature by proxying communications between an IED in the second subset of IEDs and an operator access device, the session manager configured to enforce the advanced security feature in communication with the operator access device; and
the session manager accessing the IED in the second subject of IEDs using the plurality of login credentials.
16. The session manager of claim 15 , wherein the plurality of login credentials each comprise a username and a password.
17. The session manager of claim 15 , wherein the IED credential manager module is configured to generate login credentials for a plurality of access levels of at least one of the plurality of IEDs.
18. The session manager of claim 15 , wherein the plurality of ports comprises at least one of an Ethernet port, a serial port, a coaxial port, an optical port, and a wireless port.
19. The session manager of claim 15 , wherein the computer-readable storage medium further comprises:
an access device credential manager module executable on the processor and configured to associate a plurality of operator login credentials with a plurality of operators, each of the plurality of operator login credentials having an authorization level specifying the access level of at least one of the plurality of IEDs.
20. The session manager of claim 19 , wherein the computer-readable storage medium further comprises:
an access control manager module executable on the processor and configured to:
receive one of the plurality of operator login credentials from an operator access device; and
determine an authorization level of the operator login credentials.
21. The session manager of claim 20 , wherein the access control manager module is further configured to:
receive a request from the operator access device to communicate with an IED within the authorization level of the received operator login credentials; and
relay communications received from the operator access device in the first communication session to the requested IED in the second communication session.
22. The session manager of claim 20 , wherein the computer-readable storage medium further comprises:
a session filter module executable on the processor and configured to suppress communications that exceed the determined authorization level of the provided operator login credentials.
23. The session manager of claim 20 , wherein the access control manager module is further configured to:
provide the operator access device with a list of IEDs;
receive a request from the operator access device to communicate with one of the listed IEDs within the authorization level of the received operator login credentials; and
relay communications received from the operator access device in the first communication session to the requested IED in the second communication session.
24. The session manager of claim 23 , wherein the list comprises only those IEDs within the authorization level of the received operator login credentials.
25. The session manager of claim 19 , wherein the computer-readable storage medium further comprises:
an access event logging module executable on the processor and configured to record access events associated with the provided operator login credentials.
26. The session manager of claim 15 , wherein the computer-readable storage medium further comprises:
a protocol translator module executable on the processor and configured to translate a first data protocol to a second data protocol.