On April 6, 2020, I gave a presentation for the UIUC ECE Power and Energy Systems group seminar, ECE 590i. My presentation was called "Cybersecurity Implications for DER Interoperability of IEEE 1547 Requirements," and it discussed the first seven months of my research with Al Valdes. In this presentation, I focus on the background of the IEEE 1547-2018 and motivate why cybersecurity is a concern with this standard. Understanding the standard and potential misuse of the standard by a cyber adversary was the core part of my first year of research on this project. Here are some highlights from the presentation.
The penetration of Distributed Energy Resources (DER) is growing at much higher rates than predicted 20 years ago. Far from being used only in residential settings, DER are now installed on distribution and transmission circuits. They do not have the same properties as traditional generators and are more flexible in many cases. The growing penetration and range of uses for DER motivates the need to reliably integrate safely and them into the grid. Operators must be able to rely on them not only for normal operation, but also in abnormal conditions like black starts or adverse cyber scenarios.
To that end, we study the communications, device interfaces, and potential consequences of DER operation under abnormal and adversarial conditions. The communications networks are found to be vulnerable to attack based on the industrial protocols used, even when authentication measures are in place. The device interfaces are found to be vulnerable to attack based on the requirements in the IEEE-1547 standard for DER interconnection and interoperability, which is expected to be adopted in the next ten years. In addition to exploring the requirements of the standard, we show that these vulnerabilities and others do appear and can be exploited in a modern DER. Consequences of these vulnerabilities range from exacerbating grid instability, to simultaneously losing large portions of DER penetration, to physical consequences on inverters or DER themselves and other sensitive equipment.
We tie these outcomes to specific vulnerabilities in an effort to give operators a better threat intelligence view that allows them to prioritize mitigations. Next steps for this project include building mitigations that could prevent many of the adversarial scenarios described. Some solutions can be added to existing infrastructure, while others may require longer term planning for grid modernization with consideration for security.