Systems and methods for establishing a secure communication link in an electric power distribution system
An intelligent electronic device (IED) of an electric power distribution system includes processing circuitry and a memory that includes instructions. The instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to transmit a first data frame and a second data frame to a switch of the electric power distribution system, determine whether the switch transmits the first data frame and not the second data frame, and establish a media access control security key agreement (MKA) based on a determination of whether the switch transmits the first frame and not the second data frame.
1. A first intelligent electronic device (IED) of an electric power distribution system, the first IED comprising:
processing circuitry; and
a memory comprising instructions, wherein the instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to perform operations comprising:
transmitting, to a switch and via a communication link, a first data frame and a second data frame for subsequent transmission to a second IED;
receiving a first indication that the second IED received the first data frame and the second data frame or receiving a second indication that the second IED received the first data frame but not the second data frame;
based on receiving the first indication, establishing a first configuration of a media access control security (MACsec) key agreement (MKA) connectivity association for communication with the second IED; and
based on receiving the second indication, establishing a second configuration of the MKA connectivity association for communication with the second IED.
2. The first IED of claim 1 , wherein the instructions, when executed by the processing circuitry, are further configured to cause the processing circuitry to establish the MKA connectivity association via an MKA protocol.
3. The first IED of claim 1 , wherein the instructions, when executed by the processing circuitry, are further configured to cause the processing circuitry to communicate data based on the first data frame in response to a determination that the switch successfully transmitted the first data frame and not the second data frame to the second IED.
4. The first IED of claim 1 , wherein the instructions, when executed by the processing circuitry, are further configured to cause the processing circuitry to perform operations comprising:
determining that the switch successfully transmitted the second data frame to the second IED based on a receipt of the second data frame at the first IED; and
determining that the switch did not successfully transmit the second data frame to the second IED based on a receipt of the first data frame at the first IED.
5. The first IED of claim 1 , wherein the first IED is communicatively coupled to the second IED, and the instructions, when executed by the processing circuitry, are further configured to cause the processing circuitry to determine whether the switch transmits to the second IED the second data frame based on additional data communicated by the second IED.
6. The first IED of claim 1 , wherein the instructions, when executed by the processing circuitry, are further configured to cause the processing circuitry to establish a MACsec communication link based on the MKA connectivity association.
7. The first IED of claim 1 , wherein the instructions, when executed by the processing circuitry, are further configured to cause the processing circuitry to use a connectivity association key (CAK) to communicate data via the MKA connectivity association.
8. The first IED of claim 1 , wherein the first data frame is a first MKA frame comprising first destination media access control (DMAC) information, first EtherType information, or both; the second data frame is a second MKA frame comprising second DMAC information, second EtherType information, or both; and the first DMAC information is different from the second DMAC information, the first EtherType information is different from the second EtherType information, or both.
9. The first IED of claim 1 , wherein the instructions, when executed by the processing circuitry, are further configured to cause the processing circuitry to automatically adjust device settings of the first IED based on a determination of whether the switch successfully transmitted the first data frame and not the second data frame to the second IED to establish the MKA connectivity association.