Power grid universal detection and countermeasure overlay intelligence ultra-low latency hypervisor

• US 10,075,460 B2
• Filed: 10/16/2014
• Issued: 09/11/2018
• Est. Priority Date: 10/16/2013
• Status: Active Grant

• Current Assignee: Remtcs Inc.
• Original Assignee: Remtcs Inc.
• Inventors: Malinowski, Richard E., Xaypanya, Tommy
• Primary Examiner(s): Dolly, Kendall
• Assistant Examiner(s): Fields, Courtney
• Application Number:
  US14/516,438
• Publication Number:
  US 20150106934A1
• Time in Patent Office: 1,426 Days
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

Any system with an interface may be attacked by a bad actor. If that interface is exposed to a network, the bad actor may launch a remote attack or cause other systems to attack the system. Many attacks exploit vulnerabilities that are unknown to the system operators (e.g., zero-day attacks). Power grid components, such as electricity meters, are increasingly networked and, therefore, increasingly attacked. By determining a pattern of behavior for a meter and then looking for a variation of the pattern, an attack may be identified. Once an attack is discovered, countermeasures may be launched to restore the system to normal operations, harden the system against future attack, and/or retaliate against the attacker.

Claims

1. A power grid information system infrastructure, comprising:

a memory for storing instructions and a processor coupled to the memory and configured to execute the instructions, by the processor, when the executed instructions call;

a network interface operable to receive data, the received data comprising profile data packets received from and regarding operation of an electricity meter;

a processing unit operable to derive a usage profile from the received data;

an analysis engine operable to detect an anomaly in the usage profile, wherein the analysis is performed by the analysis engine during system interrupts enabling the analysis engine to execute additional computations even though the processing unit is not executing any code; and

a response engine operable to respond or suggest a response to the anomaly; and

wherein the response engine performs the selection of a security update and causes the network interface to transmit the security update to the electricity meter for execution by the electricity meter, in response to the analysis engine detecting the anomaly and wherein the anomaly is determined by the analysis engine to be mitigated by the operation of the electricity meter executing a set of instructions comprising the security update;

wherein the response engine is further configured to, in response to the anomaly being associated with an existing operational session of at least one component of the power grid information system infrastructure, launch a new operational session and transition the existing operational session to a virtual environment; and

wherein the response engine maintains the operation of the anomaly in the virtual environment and performs forensic analysis on the anomaly.

2. The power grid information system infrastructure of claim 1, further comprising:

the network interface is operable to receive a security protocol; and

wherein the response engine is further operable to respond to the anomaly in accord with the security protocol.

3. The power grid information system infrastructure of claim 1, further comprising:

the network interface receives a security risk signature; and

wherein the analysis engine is further operable to detect the anomaly as associated with the security risk signature.

4. The power grid information system infrastructure of claim 1, further comprising:

the network interface receives security response updates; and

wherein the response engine is further operable to respond to the anomaly with the response update.

5. The power grid information system infrastructure of claim 1, further comprising:

the network interface receives a power saving indicator; and

wherein the response engine is further operable to signal a power generation controller of a power saving opportunity associated with the power saving indicator.

6. The power grid information system infrastructure of claim 1, wherein the response engine is operable to select a security update and cause the network interface to transmit the security update to the electricity meter for execution by the electricity meter.

7. The power grid information system infrastructure of claim 1, wherein the analysis engine is further operable to determine a source of the anomaly, select a counterattack, and cause the response engine to launch the counterattack at the source.

8. The power grid information system infrastructure of claim 1, wherein the analysis engine is further operable to determine a physical improvement to the power grid information system infrastructure and cause a message comprising the physical improvement to be sent to a resource responsible for implementing the physical improvement.

9. A computer, comprising:

a memory for storing instructions and a processor coupled to the memory and configured to execute the instructions, by the processor, when the executed instructions call;

a network interface operable to receive data, the received data comprising profile data packets received from and regarding operation of an electricity meter;

a processing unit operable to derive a usage profile from the received data;

an analysis engine operable to detect an anomaly in the usage profile, wherein the analysis is performed by the analysis engine during system interrupts enabling the analysis engine to execute additional computations even though the processing unit is not executing any code; and

a response engine operable to respond or suggest a response to the anomaly; and

wherein the response engine performs the selection of a security update and causes the network interface to transmit the security update to the electricity meter for execution by the electricity meter, in response to the analysis engine detecting the anomaly and wherein the anomaly is determined by the analysis engine to be mitigated by the operation of the electricity meter executing a set of instructions comprising the security update;

wherein the response engine is further configured to, in response to the anomaly being associated with an existing operational session of at least one component of the power grid information system infrastructure, launch a new operational session and transition the existing operational session to a virtual environment; and

wherein the response engine maintains the operation of the anomaly in the virtual environment and performs forensic analysis on the anomaly.

10. The computer of claim 9, wherein:

the network interface is further operable to receive a power saving indicator; and

wherein the response engine is further operable to signal a power generation controller of a power saving opportunity associated with the power saving indicator.

11. The computer of claim 9, wherein:

the computer, via the network interface, is further operable to receive a security protocol; and

wherein the response engine is further operable to respond to the anomaly in accord with the security protocol.

12. The computer of claim 9, wherein:

the computer, via the network interface, is operable to receive a security risk signature; and

the analysis engine is further operable to detect the anomaly as associated with the security risk signature.

13. A non-transitory computer readable medium with instructions thereon that when read by a computer cause the computer to perform:

accessing data comprising profile data packets received from and regarding an electricity meter;

derive a usage profile from the accessed data;

detect an anomaly in the usage profile, wherein the detection is performed by an analysis engine during system interrupts enabling the analysis engine to execute additional computations even though a processing unit executing the analysis engine is not executing any code; and

respond to the anomaly;

select a security update and transmit a security update to the electricity meter for execution by the electricity meter;

determine whether the anomaly is associated with an existing operational session of at least one component of the power grid information system infrastructure;

upon determining that the anomaly is associated with the existing operational session of the at least one component of the power grid information system infrastructure, launch a new operational session and transition the existing operational session to a virtual environment; and

maintain the operation of the anomaly in the virtual environment and perform forensic analysis of the anomaly operating therein.

14. The non-transitory computer readable medium of claim 13, further comprising instructions to:

determine a source of the anomaly;

select a counterattack; and

launch the counterattack on the source.