What protection engineers need to know about networking

Abstract

The communications infrastructure of the electric grid has been evolving rapidly in the last decades due to the need for transporting ever more sophisticated information, both data and control. More recently Ethernet based networks have been added into the picture, as modern relays need to communicate with control and dispatch centers and centralized management systems over local and wide area networks. Notably, the need to support IEC 61850 standards encouraged relay vendors into speeding up the development of Ethernet as a preferred method of communication.The benefits of Ethernet networking are huge. Flexibility and easy deployment are only two of them. However Ethernet networking comes with features that protection engineers need to be aware of, if they wish to take full advantage of its capabilities. It also comes with new challenges that protection engineers need to be aware of. Network latency and availability must be carefully considered for. Cybersecurity must be planned, the risk of cyberattacks evaluated and protection measures implemented. This paper explores the network architecture of the modern protection and control (P&C) systems including protective relays themselves. It discusses aspects such as the use and benefits of routing, the need and solutions for maximum availability and real time response, as well as security measures that can be taken to reduce the risk of cyberattacks inherent when connecting over Ethernet. The paper also highlights some of the best practices when using Ethernet networking in the grid, providing examples drawn from the protective relaying and cybersecurity practice. It offers simple solutions to typical security challenges possibly encountered during the commissioning phase and in the daily operations of relay devices.

A Survey of Protocol-Level Challenges and Solutions for Distributed Energy Resource Cyber-Physical Security

“…It might also exploit the fact that upon disconnection of the host from a network, the connection between the socket and switch is not lost, thereby leaving wall sockets connected to switches. The network can be expanded without authorization by installing one's own wireless access points and switches and adding other users to them [69][70][71][72].…”

“…The MAC address table used by a switch to store the MAC addresses of different devices, each connected to a specific port of that switch, could be subjected to a flooding attack triggered by the attacker, which results in overuse of memory, potential bottlenecks in communications that in turn causes delays or a drop of legitimate MAC addresses from the table. Hence, MAC flooding can be viewed as a DoS attack at this layer [71,101,102].…”