System and method for grid based cyber security

• US 9,647,994 B2
• Filed: 05/23/2015
• Issued: 05/09/2017
• Est. Priority Date: 06/09/2011
• Status: Active Grant

• Current Assignee: Dominion Enterprises (Landmark Media Enterprises LLC), TRC Companies Incorporated
• Original Assignee: Dominion Enterprises (Landmark Media Enterprises LLC), Astrolink International Llc (Qurate Retail Group (f/k/a Liberty Interactive Corporation))
• Inventors: Bernheim, Henrik F., Martin, Marcia Reid, Berens, Steven J., Loporto, John J., Niemann, Theodore V.
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/720,780
• Publication Number:
  US 20160112378A1
• Time in Patent Office: 717 Days
• Field of Search: None
• CPC Class Codes: G05F 1/66 Regulating electric power
• CPC Class Codes: H04B 2203/5433 Remote metering
• CPC Class Codes: H04B 3/54 Systems for transmission via power distribution lines
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method and system for providing a secure communication network using an electrical distribution grid is disclosed. A device connected to the electrical distribution grid initiates a request for a secured key token by signaling an intelligent communicating device residing at or near an edge of the grid. The intelligent communicating device forwards the request to a receiver at a distribution substation on the electrical grid. This receiver enhances the properties of the request such that a grid location for the request can be inferred. The enhanced request is forwarded to a server at the distribution substation, which compares the request grid location to a Grid Map and Policies of known secure grid locations. Any inconsistencies between the grid location inferred from the enhanced request and the Grid Map and Policies locations are considered evidence of tampering, and the server rejects the request.

Claims

1. A method for establishing a secure communication path over an electrical distribution grid, comprising:

receiving, by a computing device, a signal from a receiver coupled to the electrical distribution grid in an electrical substation, the signal comprising;

a request, received by the receiver via the electrical distribution grid from an intelligent communicating device (ICD) located at an edge of the electrical distribution grid, for a key token for use in secure communications;

an electrical phase on which the signal was received by the receiver; and

an electrical feeder on which the signal was received by the receiver;

based on the electrical phase and the electrical feeder, inferring an inferred location of the ICD;

based on the inferred location of the ICD, obtaining the key token; and

causing, by the computing device, the key token to be communicated to the ICD via the electrical distribution grid.

2. The method of claim 1 wherein the request further comprises a unique identifier (ID) that uniquely identifies the ICD, and wherein based on the inferred location of the ICD, obtaining the key token comprises:

accessing a grid map that correlates unique IDs of ICDs coupled to the electrical distribution grid to corresponding physical locations of the ICDs;

determining that the inferred location of the ICD matches the physical location of the ICD identified in the grid map; and

based on determining that the inferred location of the ICD matches the physical location of the ICD identified in the grid map, obtaining the key token.

3. The method of claim 1 wherein obtaining the key token comprises:

sending a request to a key distribution server for the key token; and

receiving the key token from the key distribution server.

4. A system for establishing a secure communication path over an electrical distribution grid, comprising:

a computing device comprising;

a communication interface; and

a processor device coupled to the communication interface and configured to;

receive a signal from a receiver coupled to the electrical distribution grid in an electrical substation, the signal comprising;

a request received by the receiver via the electrical distribution grid from an intelligent communicating device (ICD) located at an edge of the electrical distribution grid for a key token for use in secure communications;

an electrical phase on which the signal was received by the receiver; and

an electrical feeder on which the signal was received by the receiver;

based on the electrical phase and the electrical feeder, inferring an inferred location of the ICD;

based on the inferred location of the ICD, obtaining a key token; and

causing, by the computing device, a transmitter to transmit the key token to the ICD via the electrical distribution grid.

5. The system of claim 4 wherein the request further comprises a unique identifier (ID) that uniquely identifies the ICD, and wherein to obtain the key token the processor device is further configured to:

access a grid map that correlates unique IDs of ICDs coupled to the electrical distribution grid to corresponding physical locations of the ICDs;

determine that the inferred location of the ICD matches the physical location of the ICD identified in the grid map; and

based on determining that the inferred location of the ICD matches the physical location of the ICD identified in the grid map, obtain the key token.

6. The system of claim 4 wherein to obtain the key token the processor device is further configured to:

send a request to a key distribution server for the key token; and

receive the key token from the key distribution server.

7. The system of claim 4, further comprising:

the receiver; and

the transmitter.