Securing substation communications using security groups based on substation configurations

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• obtain a substation configuration description for a particular substation, the substation configuration description indicative of one or more intelligent electronic devices (IEDs) in the particular substation, associated network communication devices of the particular substation, and communication configuration information for the one or more IEDs and associated network communication devices;
• create a mapping of the one or more IEDs and the associated network communication devices based on the substation configuration description, the mapping associating each of the one or more IEDs to a corresponding network port of the associated network communication devices;
• create network control parameters based on the substation configuration description, the network control parameters comprising one or more defined communication flows for the one or more IEDs and associated security group tags (SGTs) for the defined communication flows;
• and
• cause the SGTs to be imposed at mapped network ports of the network communication devices for the one or more IEDs according to security group access (SGA)-based network control to thereby establish secure network communication for the one or more IEDs within the particular substation.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a computer to execute a process, comprising:

• obtaining a substation configuration description for a particular substation, the substation configuration description indicative of one or more intelligent electronic devices (IEDs) in the particular substation, associated network communication devices of the particular substation, and communication configuration information for the one or more IEDs and associated network communication devices;
• creating a mapping of the one or more IEDs and the associated network communication devices based on the substation configuration description, the mapping associating each of the one or more IEDs to a corresponding network port of the associated network communication devices;
• creating network control parameters based on the substation configuration description, the network control parameters comprising one or more defined communication flows for the one or more IEDs and associated security group tags (SGTs) for the defined communication flows;
• and
• causing the SGTs to be imposed at mapped network ports of the network communication devices for the one or more IEDs according to security group access (SGA)-based network control to thereby establish secure network communication for the one or more IEDs within the particular substation.