Systems and methods for establishing a secure communication link in an electric power delivery system
AssigneeSchweitzer Engineering Laboratories, Inc.
InventorsDuane C. Skelton, Colin Gordon
Life of this patent
Estimating the term…
Abstract
A non-transitory computer readable medium includes instructions that, when executed by processing circuitry, are configured to cause the processing circuitry to operate in a recovery mode after initiating a startup operation, transmit a data frame to a device of an electric power delivery system during the recovery mode, the data frame indicating a request for a security association key (SAK), receive the SAK from the device in response to transmitting the data frame, and use the SAK to communicate data via a media access control security (MACsec) communication link.
Claims18
A non-transitory computer readable medium, comprising instructions, wherein the instructions, when executed by processing circuitry, are configured to cause the processing circuitry to perform operations comprising:
- operating in a recovery mode after initiating a startup operation;
- converting a stored connectivity association key (CAK) to an initial security association key (SAK) during the recovery mode;
- using the initial SAK to communicate data via an initial media access control security (MACsec) communication link;
- transmitting a data frame to a device of an electric power delivery system during the recovery mode, wherein the data frame is indicative of a request for a SAK;
- receiving the SAK from the device in response to transmitting the data frame;
- using the SAK received from the device instead of the initial SAK converted from the stored CAK to communicate data via the MACsec communication link instead of via the initial MACsec communication link;
- and
- using the SAK received from the device instead of the initial SAK converted from the stored CAK to communicate the data via the MACsec communication link instead of via the initial MACsec communication link.
An intelligent electronic device (IED) of an electric power delivery system, wherein the TED comprises:
- processing circuitry;
- and
- a memory comprising instructions, wherein the instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to perform operations comprising:
- receiving a request for a security association key (SAK) from an additional TED of the electric power delivery system, the request including an initial SAK converted from a stored connectivity association key (CAK), communicated via an initial media access control security (MACsec) communication link;
- verifying an identity of the additional TED based on the request;
- and
- in response to verifying the identity of the additional TED, transmitting a copy of a stored SAK to the additional TED for communicating data via a MACsec communication link instead of via the initial MACsec communication link using the stored SAK instead of the initial SAK.
A system, comprising:
- a first intelligent electronic device (IED) configured to communicate data via a security association key (SAK) and configured to perform operations comprising:
- converting a stored connectivity association key (CAK) to copy of an SAK during a recovery mode;
- using the copy of the SAK to communicate data via an initial media access control security (MACsec) communication link;
- and
- a second TED configured to perform operations comprising:
- transmitting, during operation in a recovery mode of the first TED, a request to the first TED for an available SAK;
- receiving the copy of the SAK from the first TED in response to the request;
- transmitting an indication to the first TED regarding usage of the copy of the SAK to communicate data via a MACsec communication link instead of the initial MACsec communication link using the SAK instead of the copy of the SAK.
Dependencies are inferred from the claim text.