A flexible OT testbed for evaluating on-device implementations of IEC-61850 GOOSE

Matthew Boeding; Michael Hempel; Hamid Sharif; Juan Lopez; Kalyan Perumalla

doi:10.1016/j.ijcip.2023.100618

A flexible OT testbed for evaluating on-device implementations of IEC-61850 GOOSE

Matthew Boeding
, Michael Hempel
, Hamid Sharif
, Juan Lopez
, Kalyan Perumalla

Research output: Contribution to journal › Article › peer-review

6 Scopus citations

Abstract

The growing convergence of Information Technology and Operational Technology has enhanced communication and visibility across power grids. This, coupled with the growing use of Distributed Energy Resources in power grids, has enhanced the grid capabilities while also creating a larger attack surface for malicious actors. A common protocol vulnerable to these attacks is the IEC-61850 GOOSE protocol due to its low-latency requirements, multicast packet delivery method, and lack of encryption. In this paper, we evaluate the security implications of different hardware implementations of this protocol by contrasting device response and recovery of two commercial off-the-shelf Intelligent Electronic Devices from separate manufacturers. The cyberattacks utilized in this paper are research-established GOOSE attacks with results measured in device latency and GOOSE endpoint response success.

Original language	English
Article number	100618
Journal	International Journal of Critical Infrastructure Protection
Volume	42
DOIs	https://doi.org/10.1016/j.ijcip.2023.100618
State	Published - Sep 2023

Funding

This research has been supported in part by the Department of Energy Cybersecurity for Energy Delivery Systems program, and the Oak Ridge National Laboratory , under grants 4000175929 and 4000193048 . It has also been supported in part by the University of Nebraska-Lincoln’s Nebraska Center for Energy Sciences Research (NCESR) under Cycle 16 Grant# 20-706 .

Keywords

Cyber-physical systems
GOOSE
IEC-61850
Industrial control systems
Operational technology
Smart grid
Vulnerability

Access to Document

10.1016/j.ijcip.2023.100618

Cite this

@article{4f9cdc873eb34492aee8aed617e6147d,

title = "A flexible OT testbed for evaluating on-device implementations of IEC-61850 GOOSE",

abstract = "The growing convergence of Information Technology and Operational Technology has enhanced communication and visibility across power grids. This, coupled with the growing use of Distributed Energy Resources in power grids, has enhanced the grid capabilities while also creating a larger attack surface for malicious actors. A common protocol vulnerable to these attacks is the IEC-61850 GOOSE protocol due to its low-latency requirements, multicast packet delivery method, and lack of encryption. In this paper, we evaluate the security implications of different hardware implementations of this protocol by contrasting device response and recovery of two commercial off-the-shelf Intelligent Electronic Devices from separate manufacturers. The cyberattacks utilized in this paper are research-established GOOSE attacks with results measured in device latency and GOOSE endpoint response success.",

keywords = "Cyber-physical systems, GOOSE, IEC-61850, Industrial control systems, Operational technology, Smart grid, Vulnerability",

author = "Matthew Boeding and Michael Hempel and Hamid Sharif and Juan Lopez and Kalyan Perumalla",

note = "Publisher Copyright: {\textcopyright} 2023",

year = "2023",

month = sep,

doi = "10.1016/j.ijcip.2023.100618",

language = "English",

volume = "42",

journal = "International Journal of Critical Infrastructure Protection",

issn = "1874-5482",

publisher = "Elsevier",

}

TY - JOUR

T1 - A flexible OT testbed for evaluating on-device implementations of IEC-61850 GOOSE

AU - Boeding, Matthew

AU - Hempel, Michael

AU - Sharif, Hamid

AU - Lopez, Juan

AU - Perumalla, Kalyan

PY - 2023/9

Y1 - 2023/9

N2 - The growing convergence of Information Technology and Operational Technology has enhanced communication and visibility across power grids. This, coupled with the growing use of Distributed Energy Resources in power grids, has enhanced the grid capabilities while also creating a larger attack surface for malicious actors. A common protocol vulnerable to these attacks is the IEC-61850 GOOSE protocol due to its low-latency requirements, multicast packet delivery method, and lack of encryption. In this paper, we evaluate the security implications of different hardware implementations of this protocol by contrasting device response and recovery of two commercial off-the-shelf Intelligent Electronic Devices from separate manufacturers. The cyberattacks utilized in this paper are research-established GOOSE attacks with results measured in device latency and GOOSE endpoint response success.

AB - The growing convergence of Information Technology and Operational Technology has enhanced communication and visibility across power grids. This, coupled with the growing use of Distributed Energy Resources in power grids, has enhanced the grid capabilities while also creating a larger attack surface for malicious actors. A common protocol vulnerable to these attacks is the IEC-61850 GOOSE protocol due to its low-latency requirements, multicast packet delivery method, and lack of encryption. In this paper, we evaluate the security implications of different hardware implementations of this protocol by contrasting device response and recovery of two commercial off-the-shelf Intelligent Electronic Devices from separate manufacturers. The cyberattacks utilized in this paper are research-established GOOSE attacks with results measured in device latency and GOOSE endpoint response success.

KW - Cyber-physical systems

KW - GOOSE

KW - IEC-61850

KW - Industrial control systems

KW - Operational technology

KW - Smart grid

KW - Vulnerability

UR - https://www.scopus.com/pages/publications/85163940666

U2 - 10.1016/j.ijcip.2023.100618

DO - 10.1016/j.ijcip.2023.100618

M3 - Article

AN - SCOPUS:85163940666

SN - 1874-5482

VL - 42

JO - International Journal of Critical Infrastructure Protection

JF - International Journal of Critical Infrastructure Protection

M1 - 100618

ER -

A flexible OT testbed for evaluating on-device implementations of IEC-61850 GOOSE

Abstract

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this