Blockchain cybersecurity audit platform

Patent metadata

Field	Value
Publication number	US-11621973-B2
Application number	US-201916503038-A
Country	US
Kind code	B2
Filing date	Jul 3, 2019
Priority date	Jul 3, 2019
Publication date	Apr 4, 2023
Grant date	Apr 4, 2023

Abstract

A cybersecurity distributed ledger is provided herein for managing, tracking, auditing, and securing assets in a power infrastructure. The cybersecurity distributed ledger may include a blockchain, and may combine with smart contract or smart negotiation technology, such as in a permissioned proof of authority blockchain. The cybersecurity distributed ledger may manage the complete life cycle of a grid asset, from asset requirement and specification, through production, testing, deployment, maintenance, and retirement. The cybersecurity distributed ledger may create an immutable record of the grid asset, which may be audited for regulatory compliance or build or development compliance. Further, the cybersecurity distributed ledger may store unique identifying information for a grid asset, which may be used to detect a security breach or other tampering with a grid asset. The cybersecurity distributed ledger may also track control or ownership of the grid asset, as well as changes or updates to the grid asset.

First claim

What is claimed is:

1. A method, implemented by one or more computing devices comprising at least one hardware processor and one or more tangible memories coupled to the at least one hardware processor, of securing an electrical grid asset, the method comprising:
providing, from a distributed ledger, a first record comprising a unique identifier for the electrical grid asset and/or a hash value based at least in part on the unique identifier, wherein the unique identifier is based at least in part on metadata defining the electrical grid asset, the first record further comprising a first cryptographically-signed data cluster;
receiving a second cryptographically-signed data cluster comprising additional metadata describing the electrical grid asset and/or status of the electrical grid asset;
confirming the second cryptographically-signed data cluster;
determining a hash of the first record; and
storing a second record in the distributed ledger in association with the first record, the second record containing the hash of the first record as a link to the first record, the second record further containing the second cryptographically-signed data cluster and the first cryptographically-signed data cluster, wherein the second record encapsulates the second cryptographically-signed data cluster and the first cryptographically-signed data cluster.

2. The method of claim 1 , wherein the distributed ledger is implemented using a blockchain.

3. The method of claim 1 , further comprising:
generating the unique identifier for the electrical grid asset;
generating the first record; and
storing the first record in the distributed ledger, the first record containing the first cryptographically-signed data cluster.

4. The method of claim 1 , wherein the confirming comprises:
validating the source of the second cryptographically-signed data cluster; and/or
executing a consensus algorithm to obtain approval to store the second cryptographically-signed data cluster in the distributed ledger.

5. The method of claim 1 , further comprising:
receiving the unique identifier and asset data of the electrical grid asset;
accessing one or more stored records of the electrical grid asset based at least in part on the unique identifier;
comparing cryptographically-signed data contained by the one or more accessed records to the asset data; and
returning a result of the comparison between the asset data from the electrical grid asset and cryptographically-signed data contained by the one or more accessed records.

6. The method of claim 1 , wherein the second cryptographically-signed data cluster is a nested cluster containing the first cryptographically-signed data cluster.

7. One or more non-transitory computer-readable storage media storing computer-executable instructions for causing a computing system to perform a method of securely updating an electrical grid asset, the method comprising:
providing a signed cryptographically-secured current data cluster comprising a unique identifier for the electrical grid asset and/or a hash value based at least in part on the unique identifier, the signed cryptographically-secured data cluster further comprising asset version data;
receiving a signed cryptographically-secured updated data cluster comprising the unique identifier for the electrical grid asset and/or the hash value, the signed cryptographically-secured updated data cluster further comprising updated asset version data, wherein the updated asset version data comprises patch data of a software patch of the electrical grid asset, the patch data comprising a software checksum for the software patch of the electrical grid asset;
confirming the signed cryptographically-secured updated data cluster; and
inserting, as part of a new record, the signed cryptographically-secured updated data cluster into a distributed ledger having the signed cryptographically-secured current data cluster
wherein the inserting the signed cryptographically-secured updated data cluster comprises:
hashing a preceding record that contains the signed cryptographically-secured current data cluster; and
storing the new record in the distributed ledger, the new record containing the signed cryptographically-secured updated data cluster and the signed cryptographically-secured current data cluster.

8. The one or more non-transitory computer-readable storage media of claim 7 , wherein the confirming comprises validating the source of the signed cryptographically-secured updated data cluster.

9. A system for electrical grid security, the system comprising:
one or more memories;
one or more processing units coupled to the one or more memories; and
one or more computer-readable storage media storing instructions that, when loaded into the one or more memories, cause the one or more processing units to perform distributed ledger operations comprising:
registering a unique identifier for an electrical grid asset in a distributed ledger;
generating a first asset record, wherein the first asset record comprises the unique identifier and/or a hash value based at least in part on the unique identifier, and wherein the first asset record further comprises a description of the electrical grid asset;
storing the first asset record in an asset record chain in the distributed ledger;
receiving production data for the electrical grid asset;
generating a second asset record based at least in part on the unique identifier and the production data;
storing the second asset record in the asset record chain in the distributed ledger;
receiving manufacturing data for the electrical grid asset;
generating a third asset record based at least in part on the unique identifier and the manufacturing data;
storing the third asset record in the asset record chain in the distributed ledger;
generating a fourth asset record based at least in part on the unique identifier and an aggregation of the description of the electrical grid asset, the production data, and the manufacturing data, the fourth asset record containing the aggregation of the description of the electrical grid asset, the production data, and the manufacturing data; and
storing the fourth asset record in the asset record chain in the distributed ledger.

10. The system of claim 9 , wherein the distributed ledger comprises a permissioned blockchain.

11. The system of claim 9 , wherein registering the unique identifier comprises receiving the unique identifier.

12. The system of claim 9 , wherein registering the unique identifier comprises generating the unique identifier.

13. The system of claim 9 , wherein the description of the electrical grid asset comprises an asset name, an asset type, one or more asset requirements, and/or an asset functional specification.

14. The system of claim 9 , wherein the production data comprises data for a component of the electrical grid asset.

15. The system of claim 9 , wherein the manufacturing data comprises a serial number, a part number, a software version, a software checksum, and/or a model number.

16. The system of claim 9 , the distributed ledger operations further comprising:
receiving verification data for the electrical grid asset;
generating a fifth asset record in the asset record chain based at least in part on the unique identifier and the verification data; and
storing the fifth asset record in the asset record chain in the distributed ledger.

17. The system of claim 16 , wherein verification data comprises asset testing information.

18. The system of claim 9 , the distributed le

Assignees

• Battelle Memorial Institute

Inventors

• Mylrea Michael E
• Gourisetti Sri Nikhil Gupta

Classifications

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• G05B2219/2639

  Energy management, use maximum of cheap power, keep peak load low · CPC title

• H04L9/0637

  Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM] · CPC title