The Protection of Substation Communications

The last few years have seen considerable investment in the security of industrial control systems. In the power sector, there has been a focus on operational measures directed by NERC, while technical solutions have been proposed through the IEC and the ISA. Many of these proposals use cryptography to secure communications, so that some of the defensive effort can be moved from the perimeter to the end systems. However the security mechanisms need to take into account implementation costs as well as operational challenges. In this paper, we discuss these challenges in the context of protecting communications within substations. Proposals to use digital signatures are impractical because of both performance and cost. We analyse the complexities of these solutions both from security economics as well as engineering perspectives and argue that the right technology for this application is shared-key, namely message authentication codes: it gives the necessary performance at a fraction of the cost.