Cyber Security Primer for DER Vendors, Aggregators, and Grid Operators
Total Page:16
File Type:pdf, Size:1020Kb
SANDIA REPORT SAND2017-13113 Unlimited Release Printed December 2017 Cyber Security Primer for DER Vendors, Aggregators, and Grid Operators Christine Lai, Nicholas Jacobs, Shamina Hossain-McKenzie, Cedric Carter, Patricia Cordeiro, Ifeoma Onunkwo, Jay Johnson Prepared by Sandia National Laboratories Albuquerque, New Mexico 87185 and Livermore, California 94550 Sandia National Laboratories is a multimission laboratory managed and operated by National Technology and Engineering Solutions of Sandia, LLC., a wholly owned subsidiary of Honeywell International, Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. Approved for public release; further dissemination unlimited. WORKING GROUP DRAFT FOR PUBLIC COMMENT PLEASE DO NOT REFERENCE OR CITE UNTIL FINAL SEND COMMENTS TO JAY JOHNSON ([email protected]) BY DEC 31, 2017. Issued by Sandia National Laboratories, operated for the United States Department of Energy by National Technology and Engineering Solutions of Sandia, LLC. NOTICE: This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government, nor any agency thereof, nor any of their employees, nor any of their contractors, subcontractors, or their employees, make any warranty, express or implied, or assume any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represent that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government, any agency thereof, or any of their contractors or subcontractors. The views and opinions expressed herein do not necessarily state or reflect those of the United States Government, any agency thereof, or any of their contractors. Printed in the United States of America. This report has been reproduced directly from the best available copy. Available to DOE and DOE contractors from U.S. Department of Energy Office of Scientific and Technical Information P.O. Box 62 Oak Ridge, TN 37831 Telephone: (865) 576-8401 Facsimile: (865) 576-5728 E-Mail: [email protected] Online ordering: http://www.osti.gov/scitech Available to the public from U.S. Department of Commerce National Technical Information Service 5301 Shawnee Rd Alexandria, VA 22312 Telephone: (800) 553-6847 Facsimile: (703) 605-6900 E-Mail: [email protected] Online order: http://www.ntis.gov/search 2 SAND2017-13113 Printed December 2017 Unlimited Release Cyber Security Primer for DER Vendors, Aggregators, and Grid Operators Christine Lai Nicholas Jacobs Shamina Hossain-McKenzie Cedric Carter Cyber Resilience R&D Patricia Cordeiro Mission Analytics Solutions Ifeoma Onunkwo Computer Systems Security Analysis R&D Jay Johnson Renewable and Distributed Systems Integration Sandia National Laboratories P. O. Box 5800 Albuquerque, New Mexico 87185 Abstract This report provides an introduction to cyber security for distributed energy resources (DER)— such as photovoltaic (PV) inverters and energy storage systems (ESS). This material is motivated by the need to assist DER vendors, aggregators, grid operators, and broader PV industry with cyber security resilience and describe the state-of-the-art for securing DER communications. The report outlines basic principles of cyber security, encryption, communication protocols, DER cyber security recommendations and requirements, and device-, aggregator-, and utility-level security best practices to ensure data confidentiality, integrity, and availability. Example cyber security attacks, including eavesdropping, masquerading, man-in-the-middle, replay attacks, and denial- of-service are also described. A survey of communication protocols and cyber security recommendations used by the DER and power system industry are included to elucidate the cyber security standards landscape. Lastly, a roadmap is presented to harden end-to-end communications for DER with research and industry engagement. 3 ACKNOWLEDGMENTS This work was funded by the Department of Energy (DOE) Energy Efficiency and Renewable Energy (EERE) Solar Energy Technologies Office (SETO). 4 TABLE OF CONTENTS Acknowledgments............................................................................................................................4 1. Overview ............................................................................................................................10 1.1. Report Structure .....................................................................................................11 2. Cyber Security Principals ..................................................................................................12 2.1. Confidentiality .......................................................................................................12 2.1.1. Symmetric Key Encryption ...................................................................13 2.1.2. Asymmetric Key Encryption ................................................................14 2.1.3. Key Exchange .......................................................................................15 2.2. Integrity ..................................................................................................................16 2.3. Availability ............................................................................................................17 2.4. Authentication and Authorization ..........................................................................18 2.5. Accountability and Non-Repudiation ....................................................................18 2.5.1. Public Key Infrastructure (PKI) ............................................................18 3. Cyber Security Attacks ......................................................................................................21 3.1. Types of Cyber Attacks .........................................................................................21 3.2. Known ICS Cyber Security Incidents ....................................................................23 4. Communication Protocols ..................................................................................................24 4.1. OSI Stack ...............................................................................................................24 4.2. DER Communication Requirements......................................................................25 4.2.1. California Rule 21 .................................................................................26 4.2.2. IEEE 1547 .............................................................................................27 5. Key Cyber Security Guidelines and Standards ..................................................................29 5.1. NIST .......................................................................................................................29 5.2. NERC / FERC ........................................................................................................30 5.3. ICS-CERT ..............................................................................................................31 5.4. IEC/ISO..................................................................................................................32 5.5. IEEE .......................................................................................................................33 5.6. IETF .......................................................................................................................33 5.7. CIGRE....................................................................................................................34 5.8. U.S Department of Energy (DOE) .........................................................................35 5.9. Electric Power Research Institute (EPRI) ..............................................................36 6. Cyber Security Recommendations for DER Networks .....................................................37 6.1. DER Cyber Security Recommendations ................................................................38 6.1.1. DER Cyber Security Techniques and Best Practices ............................39 6.2. Recommendations for Grid Operators ...................................................................40 6.2.1. Risk Management Suggestions .............................................................41 6.3. Recommendations for Aggregators .......................................................................43 6.4. Protocol-Specific DER Cyber Security Recommendations ...................................43 6.4.1. Modbus Recommendations ...................................................................45 6.4.2. IEEE 2030.5 Recommendations ...........................................................45 6.4.3. IEEE 1815 Recommendations ..............................................................45 6.4.4. IEC 61850 Recommendations...............................................................46 6.5. DER Cryptography Requirements and Recommendations....................................46 5 6.5.1. Motivation .............................................................................................46 6.5.2. Cryptography Challenges .....................................................................47 6.5.3.