Systems and methods for configuring a secure communication link in an electric power distribution system
AssigneeSchweitzer Engineering Laboratories, Inc.
InventorColin Gordon
Life of this patent
Estimating the term…
Abstract
A control system of an electric power distribution system includes processing circuitry and a memory having instructions that, when executed by the processing circuitry, cause the processing circuitry to perform operations that include receiving an indication of a profile, generating a connectivity association key (CAK) based on the profile, distributing a copy of the CAK to a device of the electric power distribution system, and establishing a connectivity association with the device in accordance with the profile based on a verification that the device possesses the copy of the CAK.
Claims19
A gateway of a control system of an electric power distribution system, the gateway comprising:
- processing circuitry;
- and a memory comprising instructions that, when executed by the processing circuitry, are configured to cause the processing circuitry to perform operations comprising:
- receiving an indication of a profile;
- generating a media access control security (MACsec) connectivity association key (CAK) based on the profile;
- distributing a copy of the CAK to a device of the electric power distribution system;
- and establishing a connectivity association with the device in accordance with the profile based on a verification that the device possesses the copy of the CAK, wherein the gateway is configured to perform operations comprising:
- receiving an additional indication of an additional profile, wherein the additional profile defines an additional set of variables;
- generating an additional CAK based on the additional profile;
- distributing a copy of the additional CAK to the IED;
- and establishing an additional connectivity association with the IED based on the additional set of variables defined by the additional profile in response to a verification that the IED possesses the copy of the additional CAK, wherein the additional connectivity association replaces the connectivity association.
A system, comprising:
- an intelligent electronic device (IED);
- and a gateway configured to perform operations comprising:
- receiving an indication of a profile, wherein the profile defines a set of variables;
- generating a media access control security (MACsec) connectivity association key (CAK) based on the profile;
- distributing a copy of the CAK to the IED;
- and establishing a connectivity association with the IED based on the set of variables defined by the profile in response to a verification that the IED possesses the copy of the CAK, wherein the gateway is configured to perform operations comprising:
- receiving an additional indication of an additional profile, wherein the additional profile defines an additional set of variables;
- generating an additional CAK based on the additional profile;
- distributing a copy of the additional CAK to the IED;
- and establishing an additional connectivity association with the IED based on the additional set of variables defined by the additional profile in response to a verification that the IED possesses the copy of the additional CAK, wherein the additional connectivity association replaces the connectivity association.
An intelligent electronic device (IED) of an electric power distribution system, the IED comprising a tangible, non-transitory, computer-readable medium that comprises instructions, wherein the instructions, when executed by processing circuitry, are configured to cause the processing circuitry to perform operations comprising:
- receiving a media access control security (MACsec) connectivity association key (CAK) from a gateway, wherein the CAK is associated with a first identifier of a profile;
- comparing the first identifier with respective identifiers of a plurality of profiles, wherein each profile of the plurality of profiles defines a respective set of variables;
- selecting a selected profile from the plurality of profiles based on a match between the first identifier of the profile and a second identifier of the selected profile;
- and establishing a MACsec connectivity association with the gateway based on a set of variables defined by the selected profile, wherein the gateway is configured to perform operations comprising:
- receiving an additional indication of an additional profile, wherein the additional profile defines an additional set of variables;
- generating an additional CAK based on the additional profile;
- distributing a copy of the additional CAK to the IED;
- and establishing an additional connectivity association with the IED based on the additional set of variables defined by the additional profile in response to a verification that the IED possesses the copy of the additional CAK, wherein the additional connectivity association replaces the connectivity association.
Dependencies are inferred from the claim text.