# US 8,789,182 B2 · Security event logging in process control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,182 B2 - Document ID: US8789182B2 - Status: Granted - Kind: B2 - Application number: 13/572,247 - Filed: 2012-08-10 - Published: 2013-02-28 - Granted: 2014-07-22 - Earliest claimed: 2011-08-31 - Assignees: ABB Technology AG - Applicants: Fernando Alvarez; Frank Hohlbaum; Gunnar Hilpert - Inventors: Fernando Alvarez; Frank Hohlbaum; Gunnar Hilpert - Web page: https://patentgrep.com/patent/US8789182B2 ## CPC - H04L 41/0609: {based on severity or priority} - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 41/0226: Mapping or translating multiple network management protocols - H04L 41/069: using logs of notifications; Post-processing of notifications - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - Y04S 40/00: Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them - Y04S 40/18: Network protocols supporting networked applications, e.g. including control of end-device applications over a network - Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract A method and gateway are provided for extracting 61850 security events from general IEC 61850 events and merging them together with standard IT or other security events at station level or even higher system levels. Thus, the coexistence of two different protocols on the substation bus is allowed, providing greater flexibility in the design of a Substation Automation (SA) system, for example in SA systems with a mix of IEC 61850-compliant Intelligent Electronic Devices (IEDs) and SA devices that do not adhere to IEC 61850 communication protocols. ## Claims ### Claim 1 A method of handling security events in a Process Control (PC) system which includes a communication network interconnecting devices of the PC system, the method comprising: transmitting, on the communication network, by first and second devices of the PC system, security event messages including security event information according to a first protocol and a second protocol, respectively, the first protocol being one of an International Electrotechnical Committee (IEC) 61850-7-4 protocol and a Syslog protocol, and the second protocol being the other one of the IEC 61850-7-4 protocol and the Syslog protocol; receiving a first security event message according to the first protocol, and extracting security event information from the first security event message; and mapping the extracted security event information to the second protocol, wherein the first protocol is the IEC 61850-7-4 protocol and the second protocol is the Syslog protocol, and wherein the method comprises: by a gateway device connected to the communication network, converting the extracted security event information into a Syslog message; providing the Syslog message to a Syslog archive; by the gateway device, based on a security event severity indication of the first message indicating an alarm, converting the extracted security event information into an Network Control Center (NCC) message according to an NCC protocol; and providing the NCC message to an NCC of the electrical power system. ### Claim 2 (depends on 1) The method according to claim 1, wherein the first protocol is the IEC 61850-7-4 protocol and the second protocol is the Syslog protocol, and wherein the method comprises: by a log archive connected to the communication network, coding the extracted security event information as a security event log entry according to the Syslog protocol; and storing the log entry at the log archive. ### Claim 3 (depends on 1) The method according to claim 1, comprising: converting a security event severity indication included in a Data Attribute of a Generic Security Application (GSAL) Logical Node hosted by a source Intelligent Electronic Device (IED) of the first message to a Syslog priority indication. ### Claim 4 (depends on 1) The method according to claim 1, wherein the first protocol is the Syslog protocol and the second protocol is the IEC 61850-7-4 protocol, and wherein the method comprises: by a gateway device connected to the communication network, converting the Syslog message into an IEC 61850 message; and forwarding the IEC 61850 message to a Network Control Center (NCC). ### Claim 5 (depends on 4) The method according to claim 4, comprising: comparing, by the gateway device, excerpts of a Syslog event message to a plurality of identifier character strings; and identifying the first security event message based on an outcome of the comparison. ### Claim 6 A gateway device for a Substation Automation (SA) system automating an electrical power substation, wherein the gateway device is configured to be connected to a substation communication network interconnecting Intelligent Electronic Devices (IEDs) transmitting security event messages according to an International Electrotechnical Committee (IEC) 61850-7-4 protocol and to SA devices transmitting security event messages according to a Syslog protocol, wherein the gateway device is configured to: receive a security event message from an IED or from an SA device according to the respective protocol; map security event information extracted from the security event message to the other respective protocol; based on a security event severity indication of the message indicating an alarm, convert the extracted security event information into an Network Control Center (NCC) message according to an NCC protocol, and provide the NCC message to an NCC of the electrical power substation; compare excerpts of a message received from an SA device to a plurality of identifier character strings; identify the message as a security event message based on an outcome of the comparison; convert the identified security event message into a message according to the IEC 61850-7-4 protocol; and forward the converted IEC 61850 message to a Network Control Center (NCC) of the electrical power substation. ### Claim 7 (depends on 1) The method according to claim 1, wherein the PC system is included in a Substation Automation (SA) system for a substation of an electrical power system. ### Claim 8 (depends on 2) The method according to claim 2, comprising: converting a security event severity indication included in a Data Attribute of a Generic Security Application (GSAL) Logical Node hosted by a source Intelligent Electronic Device (IED) of the first message to a Syslog priority indication. ### Claim 9 A non-transitory computer-readable recording medium having a computer program recorded thereon that causes a processor of a computer processing device to handle security events in a Process Control (PC) system, which includes a communication network interconnecting devices of the PC system, wherein in the PC system, first and second devices transmit, on the communication network, security event messages including security event information according to a first protocol and a second protocol, respectively, the first protocol being one of an International Electrotechnical Committee (IEC) 61850-7-4 protocol and a Syslog protocol, and the second protocol being the other one of the IEC 61850-7-4 protocol and the Syslog protocol, wherein the computer program causes the processor to execute operations comprising: receiving a first security event message according to the first protocol, and extracting security event information from the first security event message; and mapping the extracted security event information to the second protocol, wherein the first protocol is the IEC 61850-7-4 protocol and the second protocol is the Syslog protocol, and wherein the operations comprise: by a gateway device connected to the communication network, converting the extracted security event information into a Syslog message; providing the Syslog message to a Syslog archive; by the gateway device, based on a security event severity indication of the first message indicating an alarm, converting the extracted security event information into an Network Control Center (NCC) message according to an NCC protocol; and providing the NCC message to an NCC of the electrical power system. ### Claim 10 (depends on 9) The non-transitory computer-readable recording medium according to claim 9, wherein the PC system is included in a Substation Automation (SA) system for a substation of an electrical power system.