Vulnerabilities and countermeasures in electrical substations

Abstract

The impending and continued threat of cyberattacks on modern utility grids has called for action from the different stakeholders of the electricity sector. This calls for a thorough investigation and review of the weaknesses present in the distribution substations – the backbone of the grid – that can attract attackers to achieve their malicious objectives. The present survey deals with this issue and identifies both the common and specific vulnerabilities present in substations that can be exploited by potential attackers. This work approaches the topic, for the first time, from an attacker's perspective, in order to categorize the possible attack vectors that could be used to first access the substation network, and then disrupt the substation operations under the purview of IEC standards. The reported literature in the field was critically analyzed from an attacker's perspective to highlight the potential threats that can become a liability in cyberattacks on substations. Countermeasures pertaining to these cyberattacks are then detailed and the main elements required for a comprehensive electrical substation cybersecurity solution are finally outlined.

Introduction

The conventional power system began its journey with generation of alternating current (AC) which was widely accepted over direct current (DC) mainly due to its capacity of safely reaching longer distances with more power. The power plants utilize various sources of energy such as hydral, thermal and nuclear to convert mechanical energy into electricity through AC generators. The generated electricity is then transmitted towards the consumers through transmission lines over towers and poles. At substations, transformers step up and step down voltage levels at generation and distribution sides respectively. The distribution substations step down the voltage levels according to the requirements of different types of consumers such as industrial, commercial and residential. In order to keep the entire operation running smoothly, system operators used to communicate on telephones across generation, transmission and distribution sections of power system.

The electrical power system has now transitioned to smart grids, which include advanced technology for remote and real-time monitoring, control and protection of the grid [1]. With the advancement of technology, both the electrical equipment and communication network have evolved nowadays. The system components have shifted from telephones to computers, from copper cables to ethernet/fiber-optic cables and from simple relays to intelligent controllers [2]. The monitoring and control is possible from remote locations in real time due to internet relying on fiber optic cables. Presently, the communication network of electric grids has enlarged in the form of transmission and distribution control centers. They monitor and control the events and actions from the substations. Moreover, there are growing awareness and continuous shift worldwide to adopt and increase reliance on clean energy. Hence, energy producers are incorporating renewable energy sources (RESs) such as solar and wind into the grid both at generation and distribution levels. As a result, the electric grid is becoming more complex (e.g., bidirectional power flows) and distributed in nature [3].

Future utilities will be even more advanced in the integration of power system with communication technology [4,5] as shown in Fig. 1. The communication network of electric grid today is expanding over the consumers enabling them to contribute their excess energy to the grid, from renewable installations. Moreover, the electric vehicles and energy storage devices at generation and distribution levels will be incorporated in future grids, making the grid more flexible and distributed. Both the electric vehicles and energy storage devices will be scheduled to consume energy from the grid in off peak hours and will be allowed to deliver energy to the grid in peak hours. This remote real-time monitoring and control is beneficial for the system operators in control centers, and to accommodate evolving and distributed technology. However, such advanced communication networks also increase the attack surface and could be exploited by hackers with malicious intent. While smart grids greatly improve the efficiency and operations of electrical distribution, they are also prone to cyberattacks and other new challenges [6,7]. To cope with such challenges and issues related to the cyber security of smart grids, new standards have been developed to achieve safe grids with secure communications [8], [9], [10]. We therefore believe that it is important to simultaneously study the current and future standards, the cyberattacks methodology and the existing countermeasures in order to develop a cybersecurity solution compatible with the evolving electrical substations in the smart grids.

The literature already features several surveys and position papers on smart grids cybersecurity [8,[11], [12], [13], [14]] that we have considered. The literature also includes vulnerability analyses, various attacks on network and data with their modeling, detection of these attacks and their mitigation methods [15], [16], [17], [18], [19]. Researchers have even analyzed the standards related to smart grids and cybersecurity and identified the gaps in them [9,10,20]. The standards associated with power system involves both the legacy and recent standards such as IEC-101/104 and IEC-61850 respectively [12,29]. In modern smart grids, especially with the integration of renewables, IEC-61850 has been widely adopted as de facto standard and it is continuously evolving. The standard was originally developed for interoperability and automation inside a substation but has now extended its scope to microgrids with distributed generation. The protocols involved in any standard are initially designed exclusively for communication purposes, without security in mind. Due to this reason, there is a huge amount of work in present literature on cybersecurity of smart grids in general [21], [22], [23], [24]. However, a thorough investigation of vulnerabilities targeting modern electrical substations based on IEC-61850 automation protocols is seldom addressed. This work has insightful contribution in this direction and apart from background and evolution of electrical substations, its novelty can be summarized by the following points:

• Our survey discusses in detail the vulnerabilities, exploitations, cyberattacks and countermeasures with focus on electrical substations evolving with ICT.

• Our analysis further classifies the methodology, scenarios and impact of cyberattacks in the substation domain according to a security taxonomy . This helps in identifying gaps in current research that will be addressed in future work.

In order to design an efficient cyber security solution for electrical substations, the vulnerabilities that can represent a potential cybersecurity threat have first to be identified and categorized. The main contribution of this work is an analysis of electrical distribution substation architecture, in particular from the perspective of cyber security, in order to frame the attack surface, and identify vulnerabilities that could be exploited by an attacker through accessing and remotely disrupting the operations of such substations. To this end, after the introduction in Section 1, we begin the review with background of electrical substations, cyberattacks and countermeasures in Section 2. This is followed by explaining the differences between conventional and modern substations, SASs and the related IEC standards in Section 3. The common security requirements for the electrical sector are described in Section 4, along with the general cyberattack methodology, attack scenarios and impact of cyberattacks on electrical substations. Section 5 focuses on the instantiation of the aforementioned general principles to the particular case of distribution substations, and shows the attack vectors used by attackers to disrupt the operations of substations. Section 6 describes rationale and categorization of countermeasures development with various problem specific countermeasures reported in the literature. Section 7 illustrates a cybersecurity solution based on sections 6 intended for electrical substations and finally, Section 8 concludes the paper.