Configurable network security for networked energy resources, and associated systems and methods
Secure communication between users and resources of an electrical infrastructure and associated systems and methods. A representative secure distributed energy resource (DER) communication system provides for the creation of trust rules that govern the permitted communications between users and resources of an electrical infrastructure system, and the enforcement of the trust rules.
1. A method, performed by a computing system, to secure access to utility infrastructure, the method comprising:
maintaining, at the computing system, a trust policy comprised of a plurality of trust rules, wherein each trust rule comprises an origin identifier, a target identifier, and an action identifier;
generating an Information Centric Networking (ICN) command message based on a trust rule selected from the plurality of trust rules, wherein the origin identifier of the selected trust rule corresponds to a utility infrastructure user, the action identifier of the selected trust rule corresponds to a command in the ICN command message, and the target identifier of the selected trust rule corresponds to a utility infrastructure resource;
publishing, on a communication channel, the ICN command message, wherein publishing the ICN command message causes an enforcement computing system, on the communication channel and associated with the utility infrastructure resource, to maintain authorization information characterized by the origin identifier, target identifier, and action identifier of the selected trust rule; and
cryptographically signing a certificate associated with the utility infrastructure user, wherein the certificate includes a utility infrastructure user name defined in an ICN hierarchical namespace and a utility infrastructure user public key;
wherein the enforcement computing system associated with the utility infrastructure resource, in response to subscribing to the ICN command message:
determines, from the ICN command message, the target identifier and the action identifier of the ICN command message, wherein the target identifier of the ICN command message corresponds to the utility infrastructure resource; and
determines whether the utility infrastructure user of the ICN command message, associated with the utility infrastructure user name of the certificate, is authorized to perform an action, corresponding to the action identifier of the ICN command message, on the utility infrastructure resource, based on the maintained authorization information.
2. The method of claim 1 , wherein the ICN command message is cryptographically signed based on a private key associated with the utility infrastructure user, and wherein in response to subscribing to the ICN command message the enforcement computing system further:
validates, based on the cryptographically signed ICN command message and the utility infrastructure user public key, that the ICN command message was published by the utility infrastructure user and that the message was not altered after the message was cryptographically signed.
3. The method of claim 1 , wherein a second enforcement computing system, associated with the utility infrastructure user:
determines, from the ICN command message, a target identifier and an action identifier of the ICN command message; and
determines whether the utility infrastructure user, associated with the utility infrastructure user name, is authorized to publish the ICN command message based on the selected trust rule;
wherein the publishing of the ICN command message is based on the determination of whether the utility infrastructure user is authorized.
4. The method of claim 1 , wherein the utility infrastructure resource is a telecommunications infrastructure resource.
5. The method of claim 4 , wherein the command of the ICN command message corresponds to at least one of enabling a gated general purpose internet connection to the telecommunications infrastructure resource, configuring a firewall on the telecommunications infrastructure resource, configuring a virtual private network (VPN) on the telecommunications infrastructure resource, or performing a software upgrade on the telecommunications infrastructure resource.
6. The method of claim 4 wherein the telecommunications infrastructure resource is at least one of a cellular resource, a long range (LoRa) resource, a LoRa mesh resource, a wireless resource, a wired resource, or a fifth generation (5G) resource.
7. The method of claim 1 , wherein the utility infrastructure resource is at least one of a water purification resource, a water distribution resource, a wastewater resource, a gas infrastructure resource, a pipeline and distribution system resource, an industrial control system resource, a food processing system resource, a chemical processing resource, a mining resource, a gas pipeline resource, a hydrogen pipeline resource, or a sewage treatment facility resource.
8. The method of claim 1 , wherein the utility infrastructure user is an industrial control system owner, the utility infrastructure resource is an industrial control system resource, and the ICN command message corresponds to a supervisory control and data acquisition system (SCADA) command on the industrial control system resource.
9. The method of claim 1 , the method further comprising revoking the certificate.
10. The method of claim 9 , wherein the certificate is revoked based on at least one of a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).
11. The method of claim 1 , wherein the certificate is an X.509 certificate.
12. A method, performed by a computing system, to secure access to utility infrastructure, the method comprising:
maintaining, at the computing system, a trust policy comprised of a plurality of trust rules, wherein each trust rule comprises an origin identifier, a target identifier, and an action identifier;
generating an Information Centric Networking (ICN) response message based on a trust rule selected from the plurality of trust rules, wherein the origin identifier of the selected trust rule corresponds to a utility infrastructure resource, the action identifier of the selected trust rule corresponds to a response in the ICN response message, and the target identifier of the selected trust rule corresponds to a utility infrastructure user;
publishing, on a communication channel, the ICN response message, wherein publishing the ICN response message causes an enforcement computing system, on the communication channel and associated with the utility infrastructure user, to maintain authorization information characterized by the origin identifier, target identifier, and action identifier of the selected trust rule; and
cryptographically signing a certificate associated with the utility infrastructure resource, wherein the certificate includes a utility infrastructure resource name defined in an ICN hierarchical namespace and a utility infrastructure resource public key;
wherein the enforcement computing system associated with the utility infrastructure user, in response to subscribing to the ICN response message:
determines, from the ICN response message, the target identifier and the action identifier of the ICN response message, wherein the target identifier of the ICN response message corresponds to the utility infrastructure user; and
determines whether the utility infrastructure resource of the ICN response message, associated with the utility infrastructure resource name of the certificate, is authorized to respond, corresponding to the action identifier of the ICN response message, to the utility infrastructure user, based on the maintained authorization information.
13. The method of claim 12 , wherein the ICN response message is cryptographically signed based on a private key associated with the utility infrastructure resource, and wherein in response to subscribing to the ICN response message the enforcement computing system further:
validates, based on the cryptographically signed ICN response message and the utility infrastructure resource public key, that the ICN response message was published by the utility infrastructure resource and that the message was not altered after the message was cryptographically signed.
14. The method of claim 13 , wherein the private key is stored in a Trusted Platform Module (TPM).
15. The method of claim 12 , wherein the utility infrastructure resource is a telecommunications infrastructure resource.
16. The method of claim 15 , wherein the response of the ICN response message corresponds to at least one of responding to a gated general purpose internet connection command of an ICN command message from a telecommunications infrastructure user, responding to a firewall configuration command of an ICN command message from a telecommunications infrastructure user, responding to a VPN configuration command of an ICN command message from a telecommunications infrastructure user, or responding to a software upgrade command of an ICN command message from a telecommunications infrastructure user.
17. The method of claim 15 wherein the telecommunications infrastructure resource is at least one of a cellular resource, a LoRa resource, a LoRa mesh resource, a mobile edge computing resource, a wireless resource, a wired resource, or a 5G resource.
18. The method of claim 12 , wherein the utility infrastructure resource is at least one of a water purification resource, a water distribution resource, a wastewater resource, a gas infrastructure resource, a pipeline and distribution system resource, an industrial control system resource, a food processing system resource, a chemical processing resource, a mining resource, a gas pipeline resource, a hydrogen pipeline resource, or a sewage treatment facility resource.
19. The method of claim 12 , wherein the utility infrastructure resource is an industrial control system resource, the utility infrastructure user is an industrial control system user, and the ICN response message corresponds to a supervisory control and data acquisition system (SCADA) response to a command, wherein the command is associated to an industrial control system user.
20. The method of claim 12 , wherein a second enforcement computing system, associated with the utility infrastructure resource:
determines, from the ICN response message, the target identifier and the action identifier of the ICN response message; and
determines whether the utility infrastructure resource, associated with the utility infrastructure resource name, is authorized to publish the Information Centric Networking (ICN) response message based on the selected trust rule;
wherein the publishing of the ICN response message is based on the determination.