1. Smart Grid Security Architecture Development based on IntelliGrid Methodologies Authors Joe Hughes Technical Manager jhughes@epri.com Madhava Sushilendra Sr. Project Manager msushilendra@epri.com

2. 2 © 2007 Electric Power Research Institute, Inc. All rights reserved. What is an Industry Level Architecture? Architecture: The Structure of Components, their relationships, and the principles and guidelines governing their design and evolution over time*. *DoD Integrated Architecture Panel, based on IEEE Std 610.12

3. 3 © 2007 Electric Power Research Institute, Inc. All rights reserved. Drivers behind Architecture Development Systems development lack an overall enterprise-wide implementation perspective Infrastructure is underspecified –Unable to scale up from demonstration “pilots” –Major issues not addressed systematically Integration across the enterprise Integration across the industry Data sharing, hardware resource sharing No Integrated System Management “Stovepiped” systems Disparate Standards Initiatives

4. Hard Real-Time Intra-Substations Distribution Field Equipment Comm Inter-Control Center Control Center  Customer Equip Inter-Corporation Inter-Customer Sites Hard Real-Time Inter-Substations Data Acquisition Control Centers  ESPs Control Center  Corporations DER Monitoring and Control Customer  ESP High security intra-substation Intra-Control Center RTOs  Market Participants Intra-CorporationIntra-Customer Site HV Generation Plant External Corporations Corporate Utility Market participants Management and Security Architecture Challenges: 1.The Industry is a Blend of Different Distributed Computing Environments

5. 5 © 2007 Electric Power Research Institute, Inc. All rights reserved. Security and Management Topics Cut Across IntelliGrid Architecture Domains Transmission Architecture Distribution Architecture Consumer Communications Architecture Security and Management

6. 6 © 2007 Electric Power Research Institute, Inc. All rights reserved. Management and Security Architecture Challenges: Enterprise Management Policy Sources In Progress Energy Industry Level Policies Regional Level Policies Federal Level Policies International Level Policies International Level Agreements, Rules of Governance, Resolutions, Business and Regulatory Practices Federal Policies on key topics, National Security, Communications Regulations, Critical Infrastructure Protection…Other… Energy Industry-Wide Policies: RTO and Market Operations… UN, European Union, International Standards, ITU, ISO, IEC, CIGRE…Other FCC, DHS, DOD, DOC, GAO, GSA, FBI, NSA… FERC, NERC, NARUC, NIST, DOE, DHS RTO/ISO Operations CAL ISO, PJM, MISO, North American Architects

7. 7 © 2007 Electric Power Research Institute, Inc. All rights reserved. Management and Security Architecture Challenges: 3.Consistent Approach to Architecture Governance Needed for Energy Industry Federal Enterprise Architecture Department of Defense Architecture Framework Energy Industry Architecture Federal CIO Council GSA, OMB, NIST Department of Defense Joint Architecture Working Group Branches of Military Service Regulators, North American Electric Reliability Council Utility Management ISO/RTO’s, Other, TBD Governance OrganizationsArchitectures

8. 8 © 2007 Electric Power Research Institute, Inc. All rights reserved. Key Standards Organizations Involved in the Development of Industry Level Infrastructure ISOIEC International standards- developing organizations National Organizations Trade, technical, and government Consortia and user groups JTC 1 ANSI(US) EIA/CEMA IEEE ASHRAE SAE UCA International Zigbee Alliance AEIC Meter Group BACnet™ Users ITU IEC 61970/68 CIM Users IEC 61850 Users Open AMI AHAM Utility AMI Open HAN BACnet™ Mfrs JTC 1 WG 25 *Representative Sample ASHRAE SSPC 135 UIWG ANSI C12 Series EPRI IWG ISA IETF CENELEC Other Projects NIST RD&D Projects EPRI ProjectsNIST ProjectsDOD ProjectsDOE Projects

9. 9 © 2007 Electric Power Research Institute, Inc. All rights reserved. Management and Security Related Standards Development (Sample) IEC TC 57 WG 15: (IEC/TR 62210) Also embedded within IEC 61850 ISO Common Criteria (ISO/IEC 15408) ITU X.805 also designated as ISO 18028-2 ISA: ANSI/ISA-99.00.01-2007 NIST 800 Series Documents and Federal Information Processing Standards (i.e. SP 800-82, SP 800-53) IETF: Several RFC’s ANSI C12: Embedded in Metering Standards ASHRAE SSPC 135 Other

10. 10 © 2007 Electric Power Research Institute, Inc. All rights reserved. Integration Across Both Information Technology (IT) and Field Equipment (“Real-Time”) is Required Customer Integration Distribution automation Substation automation Transmission Ops WAMAC PP integration DER integration Power System Resources Real Time Applications Communication Infrastructure Data Management Enterprise Applications Power procurement Market operations Regional Transmission Operator Distribution Control CenterExternal corporations DER integration

11. 11 © 2007 Electric Power Research Institute, Inc. All rights reserved. Examples of Intelligrid Architecture Recommendations Apply ASHRAE BACnet™ for Building Automation Apply ANSI C12 for Revenue Metering Apply IEC 61850 for Real-Time Controls Apply IEC 61970 and 61968 for Enterprise Data Sharing R&D: Harmonize IEC 61850 and 61970 Standards Develop and implement consistent systems management and security policies

12. 12 © 2007 Electric Power Research Institute, Inc. All rights reserved. Key Points of Technical Interoperability Content –Migration to Consistent Industry Policies –Common Well Defined Industry-Level Requirements Management, Security and Energy Applications –Applications Level Semantics and Syntax Management, Security and Energy Applications –Common Well Defined Communications Interfaces –“Bracketing” and Robustness Development Methods –Migration to Improved Systems Engineering and Architecture Development Approaches –Migration to Use of Industry Tools and Models

13. 13 © 2007 Electric Power Research Institute, Inc. All rights reserved. User Groups Reference Designs Standards Architecture Development Ingredients for Successful Industry Level Interoperable and Managed Systems Development Three Legged Stool: For Interoperable Products 2) Involved User Group: Interoperability Agreements, Labeling, Testing, Marketing UCA International, BACnet Mfgs. Assoc. Assoc. of Edison Illuminating Cos 3) Reference implementations and Designs: Developer Tools, Standards Implementations and test implementations 1) Open Mature Standards: Protocols, test schemas, object models IEC TC57, ANSI C12, ASHRAE SPC135, Other

14. 14 © 2007 Electric Power Research Institute, Inc. All rights reserved. Architecture Vision Uses Consistent Policies Across Operating Domains Integrates a Wide Variety of Networks Integrates a Wide Variety of Physical Media Enables Interoperability among Intelligent equipment Uses a Carefully Integrated Set of Standards from Different Industries Standards are Supported by Effective User Groups Industry Requirements are Shared across the industry Interoperable Equipment is available Across the Industry Conformance and Interoperability Testing widely adopted Standardized Notation and Systems Engineering is Widely Used to Specify and Manage Systems

15. 15 © 2007 Electric Power Research Institute, Inc. All rights reserved. Architectural Gaps Policies for management and security need to be further developed and consistently applied Network and Systems Management Infrastructures need to be further specified, evaluated and adopted/developed Security Architecture Needs to be Developed/Adopted for Advanced Automation and Customer Communications Physical Media Options Need to be Better Understood for Power System Specific Functions, Designs Developed Implemented and Tested Networking Infrastructure Options Need to be Better Understood and Designs Developed, Implemented and Tested

16. 16 © 2007 Electric Power Research Institute, Inc. All rights reserved. General “Methods”: Requirements Driven Process Industry Policies (In Progress, but fragmented) Technical Requirements In Progress, but fragmented Systems Engineering …needs to be applied

17. 17 © 2007 Electric Power Research Institute, Inc. All rights reserved. Recommended Approaches: Develop Functional and Non-Functional Requirements Together Applications: –System must support the requirements coming from power engineering and industry application needs Systems and Network Management: –Networks and intelligent equipment must be able to scale and managed: Fault, Configuration, Accounting, Performance, Security, Application Management Security: –System must include adherence to existing and emerging security policies including system “hardening” as well as managing residual risk

18. 18 © 2007 Electric Power Research Institute, Inc. All rights reserved. Architecture Development Applications and Infrastructure Development Needs to Occur in Parallel: Designs are Critical to Architecture Requirements Analyses Designs Implement Bench/Develop Field Test Small/Develop Field Test Large/Demo Commercial Rollout Energy Specific Standards User Groups Manufacturer Individual Project work Interoperable Equipment Adoption Refinement Feedback Iterate QA and Testing

19. 19 © 2007 Electric Power Research Institute, Inc. All rights reserved. Areas of Technical Development Focus Industry Assessments: –Where is the Industry Today with Respect to Systems Management and Security Infrastructure/Architecture Development? Requirements Assessment and Development: –Does the industry have a robust set of requirements for management and security of “smart grid” systems and environments? –Does the industry have a mature set of policy sources for smart grid deployment, management and operations?

20. 20 © 2007 Electric Power Research Institute, Inc. All rights reserved. Areas of Technical Development Focus Reference Designs and Implementations: –Develop Reference Designs for key equipment based on emerging open standards –Develop Initial Implementations (Bench Top First) Security Vulnerability Analyses –Evaluate Security Vulnerabilities in Reference Implementations, Penetration Testing –Propose resolutions and identify technical issues Industry Collaboration –Develop contributions to standards and consortia as appropriate –Refine designs and iterate, Transfer to Industry

21. 21 © 2007 Electric Power Research Institute, Inc. All rights reserved. Questions ??? Madhava Sushilendra Senior Project Manager, Power Delivery & Utilization Electric Power Research Institute (EPRI) 942 Corridor Park Blvd. Knoxville, TN 37932 O: 865-218-8150 C: 865-382-6201 msushilendra@epri.com www.epri.com “Together... Shaping the Future of Electricity ”

22. 22 © 2007 Electric Power Research Institute, Inc. All rights reserved. Together…Shaping the Future of Electricity