This paper presents a new authentication protocol for control systems that draws from Extensible Authentication Protocol and Kerberos. Traditional authentication schemes do not meet control system requirements of very high availability, failsafe operation, noninterruption of devices and networks, and resilience to loss of connectivity. Our hybrid protocol meets the requirements and provides device-to-device authentication both within a remote station and between remote stations and control centers.