Cybersecurity in electric power systems

Patent metadata

Field	Value
Publication number	US-12289344-B2
Application number	US-202218046671-A
Country	US
Kind code	B2
Filing date	Oct 14, 2022
Priority date	Oct 14, 2022
Publication date	Apr 29, 2025
Grant date	Apr 29, 2025

Abstract

Disclosed herein are systems, devices, and methods for improving cybersecurity in electric power systems. In one embodiment, a local controller configured for use in an electric power system may include a measurement subsystem to receive a plurality of conditions related to electrical conditions in a microgrid. A communication subsystem may communicate a set of data related to conditions in the microgrid to a remote controller; and receive a plurality of requests for control actions from the remote controller. An analysis subsystem may generate an assessment of the plurality of requests for control actions in relation to the plurality of conditions related to electrical conditions in the microgrid and identify a subset of the plurality of requests for control actions from the remote controller for execution based on the assessment. A control action subsystem may then issue a control action to an asset in the microgrid.

First claim

The invention claimed is:

1. A local controller system configured for use in an electric power system, comprising:
a measurement subsystem to receive a plurality of conditions related to electrical conditions in a microgrid;
a communication subsystem to:
transmit a set of data related to conditions in the microgrid to a remote controller using a data diode connected to the local controller system to allow the transfer of data in only one direction such that the data diode physically ensures that communication from the local controller system to the remote controller includes no possibility of a hidden alternate path back to the local controller system through a downstream path; and
receive a plurality of requests in a non-routable fixed format for control actions from the remote controller;

an analysis subsystem to:
generate an assessment of the plurality of requests for control actions in relation to the plurality of conditions related to electrical conditions in the microgrid; and
identify a subset of the plurality of requests for control actions from the remote controller for execution based on the assessment; and

a control action subsystem to issue a control action to an asset in the microgrid corresponding to the subset of the plurality of requests for control actions from the remote controller.

2. The local controller system of claim 1 , wherein the local controller is configured to treat the plurality of requests for control actions from the remote controller as an untrusted stream of requests.

3. The local controller system of claim 1 , wherein the local controller system is configured to communicate with the remote controller via a non-routable communication protocol.

4. The local controller system of claim 3 , wherein the non-routable communication protocol comprises a plurality of fixed format data values.

5. The local controller system of claim 4 , wherein the non-routable communication protocol is configured to be transmitted via a serial data connection.

6. The local controller system of claim 1 , wherein the communication subsystem is configured to interface with an IT security and communication device.

7. The local controller system of claim 6 , wherein the IT security and communication device is configured to connect to the Internet.

8. The local controller system of claim 1 , wherein the communication subsystem comprises a data diode.

9. The local controller system of claim 8 , wherein the data diode comprises a plurality of logic gates coupled to a plurality of data storage elements.

10. The local controller system of claim 9 , wherein the plurality of data storage elements comprises a disable feature accessible to an operator.

11. A method of controlling a microgrid using a local controller system, comprising:
receiving, using a measurement subsystem, a plurality of conditions related to electrical conditions in a microgrid;
transmitting, using a communication subsystem, a set of data related to conditions in the microgrid to a remote controller using a data diode connected to the local controller system to allow the transfer of data in only one direction such that the data diode physically ensures that communication from the local controller system to the remote controller includes no possibility of a hidden alternate path back to the local controller system through a downstream path;
receiving, using the communication subsystem, a plurality of requests for control actions from the remote controller;
generating, using an analysis subsystem, an assessment of the plurality of requests for control actions in relation to the plurality of conditions related to electrical conditions in the microgrid;
identifying, using the analysis subsystem, a subset of the plurality of requests for control actions from the remote controller for execution based on the assessment; and
selectively implementing, using a control action subsystem, a subset of the plurality of requests for control actions from the remote controller based on the assessment.

12. The method of claim 11 , further comprising the local controller system treating the plurality of requests for control actions from the remote controller as an untrusted stream of requests.

13. The method of claim 11 , further comprising communicating the set of data related to conditions in the microgrid to a remote controller and the plurality of requests for control actions from the remote controller using a non-routable communication protocol.

14. The method of claim 13 , wherein the non-routable communication protocol comprises a plurality of fixed format data values.

15. The method of claim 14 , further comprising transmitting the non-routable communication protocol via a serial data connection.

16. The method of claim 11 , further comprising interfacing the communication subsystem with an IT security and communication device.

17. The method of claim 16 , wherein the IT security and communication device is configured to connect to the Internet.

18. The method of claim 11 , wherein the communication subsystem comprises a data diode.

19. The method of claim 18 , wherein the data diode comprises a plurality of logic gates coupled to a plurality of data storage elements.

20. The method of claim 19 , wherein the plurality of data storage elements comprises a disable feature accessible to an operator.

Assignees

• Schweitzer Engineering Lab Inc

Inventors

• Zweigle Gregary C
• Hewitt Eric J
• Halladay Matthew J

Classifications

• H04L63/164 Primary

  at the network layer · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title