Authentication of intelligent electronic devices (IEDs) using secure association keys (SAKs)

An intelligent electronic device (IED), comprising:

• a memory;
• and
• a processor operatively coupled to the memory, wherein the processor is configured to:
• establish, over a communication network of the power system, a communication link between the IED and a key server according to media access control security (MACsec) key agreement (MKA) protocol;
• receive a plurality of access control secure association keys (SAKs) secured by a connectivity association key (CAK) associated with the communication link;
• receive one or more checked-out SAKs indicating a request to access the IED;
• and
• allow access to the IED based at least in part on the one or more checked-out SAKs matching at least one of the plurality of access control SAKs.

A method, comprising:

• establish, over a communication network of a power system, a communication link between an intelligent electronic device (IED) and a key server according to media access control security (MACsec) key agreement (MKA) protocol;
• receive, at the IED, a plurality of access control secure association keys (SAKs) secured by a connection association key (CAK) associated with the communication link;
• receive, at the IED, one or more checked-out SAKs indicating a request for an operator to access the IED;
• and
• allow the operator access to the IED based at least in part on the one or more checked-out SAKs matching at least one of the plurality of access control SAKs.