US 11,283,613 B2Granted

Secure control of intelligent electronic devices in power delivery systems

AssigneeSchweitzer Engineering Laboratories, Inc.

InventorsDennis Gammel, Josh Powers, Jason A. Dearien, Joshua Thomas Pereyda

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods are disclosed herein relating to the secure configuration of intelligent electronic devices. Intelligent electronic devices are used in electric power generation and transmission systems for protection, control, automation, and/or monitoring of equipment. The use of tokens and token-based digital signatures in the configuration process of intelligent electronic devices reduces the likelihood of malicious acts or unintended errors. Tokens distributed to engineers, technicians, intelligent electronic devices, computing devices, and/or software decrease the likelihood of errors being introduced in the configuration process.

Claims22

Dependent claims

An access control system to restrict access to an intelligent electronic device (IED) in a power delivery system, comprising:

a token generating server to:
provide an engineer token to be associated with a configuration package for an IED to:
validate that the configuration package was developed by an authorized entity, and
identify a device type for which the configuration package is intended, and
provide a technician token that is different from the engineer token to a technician to validate that the technician is authorized to install the configuration package on the IED,
wherein the technician token comprises at least one of a cryptographic key, an asymmetric token, a symmetric token, and a digital signature;
a communications network to transmit token-authenticating information from the token generating server to the IED;
and
an authorization subsystem of the IED to:
(1) authenticate the technician token in response to an installation request using the token-authenticating information from the token generating server,
(2) authenticate the engineer token associated with the configuration package using the token-authenticating information from the token generating server, including authenticating that the configuration package is intended for the device type of the IED,
(3) reject installation of the configuration package upon failure to authenticate one or both of the engineer token and the technician token, and
(4) log access and authentication results.

10 more elements

A method for intelligent electronic device (IED) access control, comprising:

generating an engineer token that includes a hash of a configuration package to be used to validate that:
(1) the configuration package was developed by an authorized entity, and
(2) the configuration package is intended for the device type of the IED;
generating a technician token that is different than the engineer token, wherein the technician token facilitates validation that a technician is authorized to install the configuration package on the IED;
providing token-authenticating information to the IED to enable the IED to subsequently authenticate each of the engineer token and the technician token;
receiving a request by the technician to install the configuration package;
receiving the technician token from the technician;
authenticating the technician token to validate that the technician is authorized to install the configuration package;
receiving the configuration package for installation on the IED, wherein the configuration package is signed by the authorized entity;
authenticating the engineer token to validate the configuration package and the device type of the IED;
and
modifying at least one setting of the IED as dictated within the configuration package in response to authentication of both the technician token and the engineer token.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/655,642Filed 17 Oct 2019
Published: US 2021/0119795 A122 Apr 2021
Granted: 22 Mar 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 9/3213
Involving a third party or a trusted authority: using tickets or tokens, e.g. Kerberos
G05B 19/0426
Using digital processors: programming the control sequence
H04L 63/0807
For authentication of entities: using tickets, e.g. Kerberos
H04L 63/083
For authentication of entities: using passwords

Family

US 2021/0119795 A1Pre-grant publication · published 22 Apr 2021
US 11,283,613 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key