Patent Application
20060269066
The present invention generally relates to power system protection, and more specifically, to a system and method for converting serial data into secure data packets configured for wireless transmission (e.g., IEEE 802.11b) in a power system.
Electric utility systems or power systems are designed to generate, transmit and distribute electrical energy to loads. In order to accomplish this, power systems generally include a variety of power system elements such as electrical generators, electrical motors, power transformers, power transmission lines, buses and capacitors, to name a few. As a result, power systems must also include intelligent electronic devices (IEDs) such as programmable logic controllers (PLCs), remote terminal units (RTUs), industrial computers, and protective devices and associated procedures, to name a few.
In general, protective devices and procedures act to isolate some power system element(s) from the remainder of the power system upon detection of the abnormal condition or a fault in, or related to, the protected power system element(s). More specifically, different protective relays utilizing a variety of protective schemes (e.g., differential current comparisons, magnitude comparisons, frequency sensing), are designed to protect the variety of power system elements. For example, using power system voltage and current information derived via secondary current and voltage signals, a directional overcurrent relay is designed to provide directional protection against faults occurring in a line protection zone (e.g., protected transmission, sub-transmission or distribution lines). That is, for power systems having several generation sources or looped or non-radial line configurations, the overcurrent relay is directionally sensitive to operate when a ground fault occurs only on its protected line (e.g., an A-phase-to-ground fault).
When a fault does occur and its direction is determined, the directional overcurrent relay issues a tripping signal to an associated power circuit breaker(s) or recloser causing it to open and isolate the faulted overhead transmission line from the remainder of the power system. Automatic re-energization of the power circuit breaker(s) or recloser may then be initiated by the relay or a recloser control after a pre-selected time, thereby restoring the power to the previously faulted overhead transmission line.
An IED such as a directional overcurrent relay is often pole-mounted in a weather-resistant enclosure, high above the ground. Other IEDs are often enclosed in a substation. As a result, maintenance and test activities such as adjusting relay settings, setting configuration files, collecting status and event reports have traditionally been burdensome for the engineers conducting them, especially if the engineers are conducting the activities in dangerous environments or during inclement weather conditions.
In the past, the engineer was required to physically access the weather-resistant enclosure, open the enclosure door and access the necessary serial port in order to conduct the maintenance and test activities. In addition exposing the components inside the enclosure to the environment, the engineers themselves were often exposed to dangerous conditions.
Recently, wireless links such as Wireless Fidelity or WiFi links (i.e., IEEE 802.11b) have been used during the maintenance and test activities to download and upload data between an engineer's computer and the relay (and recloser control), thereby permitting the engineer to conduct the activities from the relative comfort of a vehicle parked near the relay. While providing a useable link for downloading and uploading data, wireless links such as WiFi links are not cryptographically secure. This, despite enabling existing wired equivalency privacy (WEP) (i.e., encryption algorithm used to provide a privacy equivalent to that of a wired LAN) currently available when implementing a WiFi link. Thus, most relay maintenance and test data (“relay data”) being uploaded to the relay (e.g., relay settings) and downloaded from the relay (e.g., relay operation data) via the WiFi link may be detected by malicious intruders.
In accordance with the invention, provided is a system and method for converting serial data into secure data packets, preferably configured for wireless transmission (e.g., IEEE 802.11b) in a power system.
Provided is a system for converting serial data associated with an intelligent electronic device (IED), for example, a protective relay of a power system, into secure data packets configured for wireless transmission during an IED maintenance session. The system includes a first intelligent assembly operatively coupled to the IED. The first intelligent assembly includes a first I/O module and a first microcontroller operatively coupled to the first I/O module, and is adapted to apply at least two independent security algorithms to the serial data to form the secure data packets and to the secure data packets to form the serial data. The system also includes a second intelligent assembly. The second intelligent assembly includes a plurality of legacy software applications, a second I/O module and a second microcontroller operatively coupled to the second I/O module and the plurality of legacy software applications. The second intelligent assembly is adapted to apply the two independent security algorithms to the serial data to form the secure data packets and to the secure data packets to form the serial data. The plurality of legacy software applications are executable by the second microcontroller to enable the IED maintenance session to be conducted by an operator from a location of the second intelligent device upon establishment of a virtual serial port.
Provided is another system for converting serial data associated with an IED, for example, a protective relay of a power system, into secure data packets configured for wireless transmission during an IED maintenance session. The IED includes a first serial port. The system includes an encrypting/decrypting transceiver and an intelligent portable device. The encrypting/decrypting transceiver includes a second serial port adapted to enable a serial data exchange with the first serial port, a first microcontroller operatively coupled to the second serial port and adapted to apply at least two independent security algorithms to the serial data to form the secure data packets and to the secure data packets to form the serial data, and a first wireless module operatively coupled to the first microcontroller and adapted to enable wireless transmission and receipt of the secure data packets over a wireless communication link. The intelligent portable device includes a second wireless module adapted enable to wireless transmission and receipt of the secure data packets over the wireless communication link, a second microcontroller operatively coupled to the second wireless port/module and adapted to apply the at least two independent security algorithms to the serial data to form the secure data packets and to the secure data packets to form the serial data, and a plurality of legacy software applications executable by the second microcontroller to enable the IED maintenance session to be conducted by an operator from a location of the intelligent portable device upon establishment of a virtual serial port. The virtual serial port enables the serial data exchange between the plurality of legacy software applications and the IED during the IED maintenance session.
Provided is a method for converting serial data associated with an IED into secure data packets configured for transmission between an encrypting/decrypting transceiver and a portable intelligent device during an IED maintenance session. The encrypting/decrypting transceiver is operatively coupled to the IED and includes a first microcontroller. The portable intelligent device includes a second microcontroller. The method includes establishing a communication link between the encrypting/decrypting transceiver and the portable intelligent device, and executing a session authentication frame exchange between the encrypting/decrypting transceiver and the portable intelligent device to verify the portable intelligent device. The session authentication frame exchange includes application of at least two independent security algorithms. The method also includes, upon successful execution of the session authentication frame exchange, executing a serial data exchange during the IED maintenance session between a plurality of legacy software applications of the portable intelligent device and the IED. The serial data exchange includes application of the two independent security algorithms.
Provided is another method for converting serial data associated with an IED into secure data packets configured for transmission between an encrypting/decrypting transceiver and a portable intelligent device during an IED maintenance session. The encrypting/decrypting transceiver is operatively coupled to the IED and includes a first microcontroller. The portable intelligent device includes a second microcontroller. The method includes establishing a wireless communication link between the encrypting/decrypting transceiver and the portable intelligent device, and executing a session authentication frame exchange between the encrypting/decrypting transceiver and the portable intelligent device to verify the portable intelligent device. The session authentication frame exchange includes application of an Advance Encryption Standard (AES) encryption/decryption function and a Hashed Message Authentication Code (HMAC) authentication function. The method also includes, upon successful execution of the session authentication frame exchange, executing a serial data exchange during the IED maintenance session between a plurality of legacy software applications of the portable intelligent device and the IED. The serial data exchange includes application of the AES encryption/decryption function and the HMAC authentication function.
It should be understood that the present invention includes a number of different aspects or features which may have utility alone and/or in combination with other aspects or features. Accordingly, this summary is not exhaustive identification of each such aspect or feature that is now or may hereafter be claimed, but represents an overview of certain aspects of the present invention to assist in understanding the more detailed description that follows. The scope of the invention is not limited to the specific embodiments described below, but is set forth in the claims now or hereafter filed.
For ease of discussion, aspects of the invention can be more fully understood via discussing a pole-mounted recloser control configured to protect an overhead transmission line, where the recloser control is operatively coupled to both the overhead transmission line (via current and voltage transformers) and a recloser, and includes a directional overcurrent relay with a recloser control element, a battery(s) and a power supply. It should be noted however, that the invention is applicable to any IED having a microcontroller including a microprocessor, a serial port and a memory, or an FPGA or equivalent. Further, although discussed in terms of a wireless fidelity (WiFi) link, the invention is applicable to any wireline (e.g., Ethernet) or wireless link such as, for example enhanced Bluetooth (IEEE 802.15.x) or WiMax (IEEE 802.16), where data authentication and security is a high priority.
As previously mentioned the power system 10 includes protective devices and associated procedures to protect the power system elements from faults or other abnormal conditions. For example, a protective device 52a is operatively coupled to the transmission line 20c and is configured as a recloser control (e.g., includes a directional overcurrent relay with a recloser control element, a battery(s) and a power supply) that utilizes power system voltage and current information to determine a fault and its direction in the transmission line 20c. Another protective device 52b is similarly configurable and operable.
Once installed in the power system, such protective devices 52a and 52b require periodic maintenance and testing by an engineer. For those protective devices (or other IEDs) not easily accessible due to their physical placement, wired or wireless links may be available to facilitate periodic data collection, diagnostic checking and testing. Such wired or wireless links however, are generally insecure against malicious intruders.
Referring to
In general, during operation of the relay 56, secondary current and voltage waveforms received via respective step-down current and voltage transformers (not separately illustrated) coupling the relay 56 to the transmission line 20c are filtered, multiplexed, sampled and digitized to form corresponding digitized current and voltage signals. The corresponding digitized current and voltage signals are digitally filtered to eliminate DC and unwanted frequency components, and are then processed by the relay 56 to extract phasors representative of their corresponding primary current and voltage waveforms. Various calculations using the phasors are performed to determine the condition of the transmission line 20c.
In addition to the second serial port 62, the encrypting/decrypting transceiver 58 also includes a first microcontroller 64 operatively coupled to the second serial port 62, and a random number generator (RNG) 67 operatively coupled to the first microcontroller 64. The RNG 67 is configured to generate random bits that are utilized to create a 128-bit AES encryption/decryption session key and a 128-bit HMAC session key (discussed below) for use during a relay maintenance session between the protective device 52 and the PC 54. The encrypting/decrypting transceiver 58 also includes an I/O module, in this example, a first wireless port/module 66, operatively coupled to the first microcontroller 64, and configured to enable wireless transmission and reception of encrypted relay data. If communicating via a wireline link to the PC 54 however, another suitable I/O port or communication module, operatively coupled to the first microcontroller 64, may be utilized rather than the first wireless port/module 66.
In general, the first microcontroller 64 includes a microprocessor, or CPU, and a memory (not separately illustrated) operatively coupled to the microprocessor where the memory may include a program memory (e.g., a Flash EPROM) and a parameter memory (e.g., an RAM). As will be appreciated by those skilled in the art, other suitable microcontroller configurations (or FPGA configurations) may be utilized.
Referring again to
The PC 54 may also include one or more operator input devices 78 which may include a keyboard, a scanner, a mouse, a touch pad, and/or an audio input device and/or a video input device, a display device 76 configured in any suitable manner, and an output device 26, such as a printer, a fax/modem, etc., all operatively coupled to the second microcontroller 70 via an I/O circuit 72.
Although not separately illustrated, each of the first and second wireless port/modules 66 and 68 may include their own microcontroller-based platform adapted to cause a number of portions or routines of one or more computer programs to be executed to enable a wired equivalency privacy (WEP) encryption/decryption function and wireless transmission/receipt.
As discussed in connection with
The two independent levels of security are preferably provided by a 128-bit AES encryption/decryption function with a hash function based keyed-hash message authentication code. A 104-bit WEP encryption/decryption function may also be utilized in addition to the two independent security algorithms. It is contemplated however, that the two independent levels of security may be provided by other encryption/decryption functions such as a Wi-Fi protected access (WPA) function and a triple-Data Encryption Standard (DES) encryption/decryption function, to name a few.
Prior to providing secure relay data capability, initialization of the encrypting/decrypting transceiver 58 and the PC 54 is performed. Initialization includes inserting, via respective serial ports, an HMAC authentication system key 63 and an AES encryption/decryption system key 65 into the encrypting/decrypting transceiver 58 and the PC 54. Not to be confused with an HMAC authentication session key generated during a session authentication dialog, or frame exchange, for later use during the relay maintenance session (see,
Initialization of the encrypting/decrypting transceiver 58 and the PC 54 further includes initializing a WEP system key to enable the WEP encryption/decryption function. As described in connection with FIGS. 3 and 4, the WEP system key 110 is included as an option with the first and second wireless port modules 66, 68. Initialization of the encrypting/decrypting transceiver 58 also requires (1) initializing the AES encryption/decryption system key 65 and the HMAC authentication system key 63, (2) programming the encrypting/decrypting transceiver 58 with a service set identifier (i.e., an SSID is a 1-32 byte alphanumerical name given to the encrypting/decrypting transceiver 58 and the PC 54), an IP address and a session password, and (3) programming the PC 54 with an SSID and an IP address.
Generally the WEP encryption and decryption function utilizes a symmetric RC-4 encryption/decryption algorithm with a 40-bit (or 104-bit) WEP system key. When WEP is enabled, both the encrypting/decrypting transceiver 58 and the PC 54 are assigned the WEP system key 110. Once initialized, the WEP system key 110 is used to encrypt, or scramble, the data contents of a relay data packet at the transmitting end. An integrity check and decryption of the data packets, via the WEP system key, is performed at the receiving end to ensure that the relay data was not modified in transit.
As is known, the HMAC is implemented by utilizing an underlying iterative cryptographic hash function over data (or the message), and a shared key. As illustrated in
As mentioned above, maintenance and test activities conducted during an IED maintenance session traditionally required the engineer to gain entry to the relay 56, often pole-mounted in an enclosure high above the ground, to access the desired relay data via a serial port. With the advent of wireless links such as those provided via 802.11 protocols, engineers can now access the relay data without gaining physical access to the relay 56. While providing a useable link for downloading and uploading data however, wireless links such as WiFi links are typically not secure, even with the WEP encryption/decryption function enabled. Accordingly, most relay data being uploaded and downloaded via the wireless link is susceptible to detection by malicious intruders.
The virtual serial port 120 is established only after successfully completing the session authentication dialog. Establishment of the virtual serial port 120 allows relay data (e.g., request for metering data, request for fault location data, relay pickup settings) from the relay 56 to be provided to the legacy software applications 114-116 to facilitate determinations about the state of the relay 56. Establishment of the virtual serial port 120 also allows relay data (e.g., relay settings) from the legacy software applications 114-116 to be provided to the relay 56, according to the embodiment of the invention.
As noted in connection with
The second microcontroller 70 includes a virtual encryption engine 112, and the legacy software applications 114-116. A virtual switch 119 is included to allow the legacy software applications 114-116 to select the virtual serial port 120 for “serial” transmission of unencrypted (serialized) relay data. It should be noted however, that the virtual serial port is not established until successful completion of the session authentication dialog between the PC 54 and the encryption/decryption transceiver 58. The virtual encryption engine 112 includes the AES encryption/decryption and HMAC SHA-1 authentication function 118 (“AES/HMAC security function 118”), the associated AES encryption/decryption system key 65, the HMAC authentication system key 63 (see,
Although discussed in terms of receiving and utilizing relay data, it will be appreciated by one skilled in the art that the PC 54 is also adapted to convert relay data generated via the legacy software applications 114-116 into secure data packets, and then transmit the secure data packets via the communication link 53 to the protective device 52.
Referring to
The first microcontroller 64 includes the AES/HMAC security function 118, the associated AES encryption/decryption system key 65 and the associated HMAC authentication system key 63 (see,
In summary, the method 200 begins with the session authentication dialog between the second microcontroller 70 of the PC 54 and the first microcontroller 64 of the encrypting/decrypting transceiver 58. Successful execution of session authentication dialog establishes or verifies that the PC 54 is permitted to exchange relay data with the protective device 52. The session authentication dialog preferably consists of an exchange of encrypted and authenticated frames (via the AES/HMAC security function 118, the associated AES encryption/decryption system key 65 and associated HMAC authentication system key 63). For example, five frames exchanged may include a connection request frame from the PC 54, a first challenge frame from the encrypting/decrypting device 58, a first challenge response frame from the PC 54, a key transport and second challenge frame from the encrypting/decrypting device 58, and a key ack and second challenge response frame from the PC 54.
Upon successful completion of the session authentication dialog, the virtual serial port 120 is established in the PC 54. This allows the relay data to be uploaded and downloaded as secure data packets 117 transmitted between the PC 54 and the protective device 52 via the communication link 53. AES encryption/decryption and HMAC authentication session keys 122, 124, resulting from the session authentication dialog are used for subsequent encryption and authentication by AES/HMAC security function 118 during the relay maintenance session. The relay data contained in the secure data packets from the protective device 52 is initially passed as unencrypted relay data 55a from the relay 56 to the encrypting/decrypting transceiver 58 via the first and second serial ports 60, 62. Similarly, the relay data contained in the secure data packets from the PC 54 is received via the virtual serial port 120 as unencrypted relay data 55b from the legacy software applications 114-116.
More specifically, the method 200 begins when the PC 54 requests establishment of a relay maintenance session with the protective device 52 via generation and transmission of an encrypted and authenticated connection request frame (step 202). In an embodiment, the PC 54 requests establishment of the relay maintenance session subsequent to receipt of an operator request via the input device 78 (see,
Referring to
Using the HMAC authentication system key 63 and the message 102 (e.g., the generated connection request frame), an HMAC function 132 generates a 160-bit, fixed length HMAC hash value 134. The HMAC hash value 134 represents a condensed key-dependant fingerprint or signature of the message 102. The HMAC hash value 134 is then appended to the message 102 to form a composite message 136.
Next, the composite message 136 is encrypted by an AES encryption/decryption function 138 via the 128-bit AES encryption/decryption system key 65. As a result, the composite message 136 is encrypted to form an encrypted composite message 140 that is a function of the composite message 136 and the AES encryption/decryption system key 65. The encrypted composite message 140 is then forwarded to the second wireless port/module 68 for WEP encryption to form a WEP encrypted composite message 142 (see,
For example, after generation and application of the HMAC hash value 134 to the connection request frame, it is AES encrypted to form an encrypted composite connection request and then WEP encrypted via the WEP encryption/decryption function 108 to form the encrypted and authenticated connection request frame suitable for transmission via the first wireless transceiver 106.
Referring again to
For example,
Next, using the HMAC authentication system key 63, the HMAC function 132 is applied to the composite message 136 to derive an HMAC hash prime value 154. If the HMAC hash prime value 154 matches the original HMAC hash value 134, the HMAC hash value is removed from the composite message 136 and the resulting message 102 is accepted as valid by the first microcontroller 64. If the resulting message 102 is not valid, the session authentication dialog is terminated.
Referring again to
When received by the wireless transceiver 106 of the PC 54 via the wireless port/module 68 (step 210), the first challenge frame is decrypted via the WEP function 108 using the WEP system key 110 and further decrypted and finally authenticated via the AES/HMAC security function 118 using the AES encryption/decryption system key 65 and the HMAC authentication system key 63 (step 212).
If the first random challenge value of the first challenge frame is authenticated (step 213), a password previously entered by the operator via the input device 78 of the PC 54 is combined with the first random challenge value to form a first challenge response frame. The first challenge response frame is then encrypted and authenticated via the AES/HMAC security function 118 using the AES encryption/decryption system key 65 and the HMAC authentication system key 63. It is further encrypted via the WEP function 108 using the WEP system key 110 to form the encrypted and authenticated first challenge response frame, and then transmitted to the encrypting/decrypting transceiver 58 of the protective device 52 (step 214).
When received by the wireless transceiver 106 of the encrypting/decrypting transceiver 58 (step 216), the encrypted and authenticated first challenge response frame is decrypted via the WEP function 108 using the WEP system key 110 and further decrypted and finally authenticated via the AES/HMAC security function 118 using the AES encryption/decryption system key 65 and the HMAC authentication system key 63 (step 218). If the password entered by the engineer and included in the first challenge response frame matches a password previously programmed into the encrypting/decrypting transceiver 58 during initialization and the first random challenge value extracted from the first challenge response frame matches the first random challenge value caused to be previously generated by the first microcontroller 64 (step 219), then the microcontroller 64 generates another large random challenge value, or (1) a second random challenge value, (2) an AES encryption/decryption session key 122, and (3) a HMAC authentication session key 124 to form a key transport and second challenge frame. Upon completion of a successful session authentication dialog, both the AES encryption/decryption session key 122 and the HMAC authentication session key 124 will be used to authenticate and encrypt/decrypt relay data subsequently transmitted during the relay maintenance session between the protective device 52 and the PC 54.
The key transport and second challenger frame is encrypted and authenticated via the AES/HMAC security function 118 using the AES encryption/decryption system key 65 and the HMAC authentication system key 63. It is further encrypted via the WEP function 108 using the WEP system key 110 to form an authenticated and encrypted key transport and second challenger frame, and then transmitted via the wireless transceiver 106 of the encrypting/decrypting transceiver 58 to the PC 54 (step 220).
When received by the wireless transceiver 106 of the PC 54 (step 222), the authenticated and encrypted key transport and second challenger frame is decrypted via the WEP function 108 using the WEP system key 110 and further decrypted and finally authenticated via the AES/HMAC SHA-1 security function 118 using the AES encryption/decryption system key 65 and the HMAC authentication system key 63 (step 224).
After extracting and authenticating the second random challenge value (step 225), and the AES encryption/decryption session key 122 and the HMAC authentication session key 124 for subsequent use, the second microcontroller 70 forms a key acknowledgement and second challenge response frame using the second random challenge value. The key acknowledgement and second challenge response frame is then encrypted and authenticated via the AES/HMAC security function 118 using the AES encryption/decryption system key 65 and the HMAC authentication system key 63. It is further encrypted via the WEP function 108 using the WEP system key 110 to form the encrypted and authenticated key acknowledgement and second challenge response frame, and then transmitted via the wireless transceiver 106 of the PC 54 (step 226).
In addition to forming, authenticating, encrypting and transmitting the key acknowledgement and second challenge response frame, the second microcontroller 70 establishes the virtual serial port to enable subsequent serial relay data to be passed to and from the legacy software applications 114-116 (step 228).
When received by the wireless transceiver 106 of the encrypting/decrypting transceiver 58 (step 230), the encrypted and authenticated key acknowledgement and second challenge response frame is decrypted via the WEP function 108 using the WEP system key 110 and further decrypted and finally authenticated via the AES/HMAC security function 118 using the AES encryption/decryption system key 65 and the HMAC authentication system key 63 (step 232). If the key acknowledgement and second challenge response frame authenticates properly and if the second random challenge value matches the second random challenge value caused to be previously generated by the first microcontroller 64 (step 233), then the microcontroller 64 begins the relay maintenance session using the AES encryption/decryption session key 122 and the HMAC authentication session key 124, thereby enabling relay data originating via legacy software applications to be converted from serial relay data into secure data frames suitable for wireless transmission to the protective device 52, and vice versa, and enabling relay data originating via the relay 56 to be converted from serial data into secure data frames suitable for transmission to the PC 54, and vice versa. (step 234).
Thus, after establishment of the virtual serial port 120 following successful completion of the session authentication dialog, the relay data provided by the relay 56 to the PC 54 is provided to the first microcontroller 64 via the first and second serial ports 60 and 62 using well-known methods (e.g., data terminal equipment (DTE) interface to a universal asynchronous receiver/transmitter (UART) to a complementary data communication equipment (DCE) interface. The relay data is then authenticated and encrypted and transmitted to the PC 54 via the communication link 53. When received by the PC 54, the second microcontroller 70, applying the decryption and authentication methods described above, establishes that the relay data is authentic.
Similarly, after establishment of the virtual serial port 120 following the successful session authentication dialog, the relay data provided via the legacy software applications 114-116 of the PC 54 to the relay 56 is provided to the second microcontroller 70 via the virtual serial port 120. The relay data is then authenticated and encrypted and transmitted to the protective device 52 via the communication link 53. When received by the encrypting/decrypting device 58, the first microcontroller 64, applying the decryption and authentication methods described above, establishes that the relay data is authentic. If authenticated, the relay data is provided to the relay 56 via the second and first serial ports, 62, 60, respectively.
While this invention has been described with reference to certain illustrative aspects, it will be understood that this description shall not be construed in a limiting sense. Rather, various changes and modifications can be made to the illustrative embodiments without departing from the true spirit, central characteristics and scope of the invention, including those combinations of features that are individually disclosed or claimed herein. Furthermore, it will be appreciated that any such changes and modifications will be recognized by those skilled in the art as an equivalent to one or more elements of the following claims, and shall be covered by such claims to the fullest extent permitted by law.
This application claims benefit under 35 U.S.C. §119(e) of U.S. Provisional Application No. 60/678,886 entitled “A System and Method for Converting Serial Data Into Secure Data Packets Configured for Wireless Transmission in a Power System”, filed on May 6, 2005, naming Dave Whitehead and Peter LaDow as inventors, the complete disclosure thereof being incorporated by reference.
| Number | Date | Country | |
|---|---|---|---|
| 60678886 | May 2005 | US |
