Systems and methods for authorizing access to a component in an electric power distribution system

A proxy device for an electric power delivery system, the proxy device comprising:

• processing circuitry;
• and
• a memory comprising instructions that, when executed by the processing circuitry, are configured to cause the processing circuitry to perform operations comprising:
• receiving first permissions data associated with a first user from a first computing device;
• receiving second permissions data associated with a second user from a second computing device;
• receiving first data from the first computing device, wherein the first data comprises performing a first action associated with an intelligent electronic device (IED) of the electric power delivery system;
• processing the first data based on the first permissions data to determine that the first action is authorized;
• transmitting second data to the IED via a MACsec communication link in response to determining that the first action is authorized;
• receiving third data from the second computing device, wherein the third data comprises performing a second action associated with the IED of the electric power delivery system;
• processing the third data based on the second permissions data to determine that the second action is not authorized;
• blocking the second action from being performed in response to determining that the second action is not authorized;
• receiving fourth data from the second computing device, wherein the fourth data comprises a third action, different from the second action, associated with the IED of the electric power delivery system;
• processing the fourth data based on the second permissions data to determine that the third action is authorized;
• and
• transmitting fifth data to the IED via the MACsec communication link in response to determining that the third action is authorized.

A system comprising:

• a plurality of intelligent electronic devices (IEDs);
• and
• a proxy device communicatively coupled to each IED of the plurality of IEDs via a respective Media Access Control (MACsec) communication link, wherein the proxy device is configured to perform operations comprising:
• receiving first permissions data;
• receiving second permissions data;
• processing the first permissions data to map a first plurality of allowable behavior functions to the first permissions data;
• processing the second permissions data to map a second plurality of allowable behavior functions to the second permissions data;
• receiving a first request to perform a first action associated with an IED of the plurality of IEDs;
• determining that the first action is authorized based on the first plurality of allowable behavior functions mapped to the first permissions data;
• transmitting first data to the IED via a corresponding MACsec communication link in response to determining that the first action is authorized;
• receiving a second request to perform a second action, different from the first action, associated with the IED;
• determining that the second action is unauthorized based on the second plurality of allowable behavior functions mapped to the second permissions data;
• blocking transmission of second data to the IED via the corresponding MACsec communication link in response to determining that the second action is unauthorized;
• receiving a third request to perform a third action, different from the first action, the second action, or a combination thereof, associated with the IED;
• determining that the third action is authorized based on the second plurality of allowable behavior functions mapped to the second permissions data;
• and
• transmitting third data to the IED via a corresponding MACsec communication link in response to determining that the third action is authorized.