SYSTEM AND METHOD FOR GRID BASED CYBER SECURITY

• US 20170180118A1
• Filed: 03/06/2017
• Published: 06/22/2017
• Est. Priority Date: 06/09/2011
• Status: Active Grant

• Current Assignee: Dominion Enterprises (Landmark Media Enterprises LLC), TRC Companies Incorporated
• Original Assignee: Dominion Enterprises (Landmark Media Enterprises LLC), Astrolink International Llc (Qurate Retail Group (f/k/a Liberty Interactive Corporation))
• Inventors: Bernheim, Henrik F., Martin, Marcia Reid, Berens, Steven J., Loporto, John J., Niemann, Theodore V.
• Granted Patent: US 10,356,055 B2
• Time in Patent Office: Days
• CPC Class Codes: G05F 1/66 Regulating electric power
• CPC Class Codes: H04B 2203/5433 Remote metering
• CPC Class Codes: H04B 3/54 Systems for transmission via power distribution lines
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method and system for providing a secure communication network using an electrical distribution grid is disclosed. A device connected to the electrical distribution grid initiates a request for a secured key token by signaling an intelligent communicating device residing at or near an edge of the grid. The intelligent communicating device forwards the request to a receiver at a distribution substation on the electrical grid. This receiver enhances the properties of the request such that a grid location for the request can be inferred. The enhanced request is forwarded to a server at the distribution substation, which compares the request grid location to a Grid Map and Policies of known secure grid locations. Any inconsistencies between the grid location inferred from the enhanced request and the Grid Map and Policies locations are considered evidence of tampering, and the server rejects the request.

Claims

1. A method for obtaining a decryption key for use in a secure communication session, comprising:

receiving, by an intelligent communicating device (ICD) via an electrical distribution grid on a low voltage side of a transformer, a first request from a computing device coupled to the electrical distribution grid via an electrical outlet for a decryption key for use in the secure communication session;

sending, via the electrical distribution grid to a receiver coupled to the electrical distribution grid on a high voltage side of the transformer, a second request for the decryption key;

receiving, from a transmitter coupled to the electrical distribution grid on the high voltage side of the transformer, the decryption key; and

sending the decryption key to the computing device via the electrical distribution grid.

2. The method of claim 1 wherein the second request includes a unique identifier (ID) that uniquely identifies the ICD from a plurality of other ICDs coupled to the electrical distribution grid.

3. The method of claim 1 wherein receiving the decryption key comprises receiving the decryption key and a first response ID;

further comprising receiving, prior to sending the decryption key to the computing device, a third request from the computing device for the decryption key, the third request including a second response ID; and

based on determining that the second response ID matches the first response ID, sending the decryption key to the computing device via the electrical distribution grid.

4. The method of claim 1 further comprising:

receiving, from the computing device via the electrical distribution grid, a message indicating the secure communication session has completed; and

notifying, via the electrical distribution grid, the receiver that the secure communication session has completed.

5. An intelligent communicating device (ICD) for obtaining a decryption key for use in a secure communication session, comprising:

a communication interface configured to be coupled to a low voltage side of an electrical distribution grid;

a processor device coupled to the communication interface and configured to;

receive, via the electrical distribution grid, a first request from a computing device coupled to the electrical distribution grid via an electrical outlet for a decryption key for use in the secure communication session;

send, via the electrical distribution grid to a receiver coupled to the electrical distribution grid on a high voltage side of the transformer, a second request for the decryption key;

receive, from a transmitter coupled to the electrical distribution grid on the high voltage side of the transformer, the decryption key; and

send the decryption key to the computing device via the electrical distribution grid.

6. The ICD of claim 5 wherein the second request includes a unique identifier (ID) that uniquely identifies the ICD from a plurality of other ICDs coupled to the electrical distribution grid.

7. The ICD of claim 5 wherein to receive the decryption key the processor device is further configured to receive the decryption key and a first response ID;

wherein the processor device is further configured to receive, prior to sending the decryption key to the computing device, a third request from the computing device for the decryption key, the third request including a second response ID; and

wherein the processor device is further configured to send, based on determining that the second response ID matches the first response ID, the decryption key to the computing device via the electrical distribution grid.

8. The ICD of claim 5 wherein the processor device is further configured to:

receive, from the computing device via the electrical distribution grid, a message indicating the secure communication session has completed; and

notify, via the electrical distribution grid, the receiver that the secure communication session has completed.