Apurva Mohan

Himanshu Khurana

IMPLEMENTING CYBER SECURITY REQUIREMENTS AND MECHANISMS IN MICROGRIDS

Keywords: Microgrids, cyber security, NERC-CIP standards, threat modeling

A microgrid is a collection of distributed energy resources, storage and loads under common coordination and control that provides a single functional interface to enable its management as a single unit. Microgrids provide several advantages such as power quality control, uninterrupted power supply and integration of renewable resources. However, microgrids are increasingly connected to the Internet for remote control and management, which makes them susceptible to cyber attacks. To address this issue, several pilot deployments have implemented bolt-on security mechanisms, typically focused on securing the protocols used in microgrids. Unfortunately, these solutions are inadequate because they fail to address some important cyber security requirements.

This chapter describes the µGridSec methodology, which is intended to provide comprehensive cyber security solutions for microgrid deployments. First, cyber security requirements are derived from relevant industry standards and by studying pilot microgrid deployments. Next, the µGridSec methodology is applied to ensure that appropriate mechanisms are applied to microgrid architectures to meet the cyber security requirements. Finally, a high-level threat model for a representative microgrid architecture is used to identify security threats and demonstrate how µGridSec can address the threats.

Introduction

A microgrid is a collection of local electricity generation and energy storage systems, and electrical loads that are under common coordination and control. Although a microgrid consists of multiple entities, it can be controlled as if it were a single entity. The integration of distributed energy resources (DERs), storage and loads increases the efficiency of the entire system. It also makes it possible to connect multiple microgrids to create a "power enclave" with high voltage capacity [START_REF] Wang | Task 1: Coupling Low-Voltage Microgrids into Mid-Voltage Distribution Systems[END_REF]. A single microgrid can function in the "grid connected" mode in which the microgrid is connected to the main power grid and jointly provides power. Alternatively, a microgrid can operate in the "islanded" mode where the microgrid functions autonomously as a self-contained system that provides power to a local site.

Microgrids offer advantages such as enhanced power quality via voltage sag correction, increased power factors, enhanced reliability for critical loads, greater energy security, higher local power distribution efficiency due to shorter distances, better sustainability by integrating renewable resources and clean fuel sources, and the potential for greater physical and cyber security. Due to these advantages, microgrids are being hailed as critical components of future energy systems. Microgrids are in operation around the world and the adoption and deployment of microgrids is increasing [START_REF]SPIDERS Microgrid Project secures military installations[END_REF].

Microgrids are currently deployed at a variety of organizations, including university campuses, military bases, hospitals, residential communities and rural areas. They provide energy security and constitute an important part of the critical energy infrastructure. At sensitive sites such as military bases, hospitals and safety-critical facilities, it is vital to ensure that the power supply is not disrupted by adversaries. For example, a military base may rely on a microgrid for uninterrupted power supply during periods of grid downtime or grid peak loads, and its operational capability can be significantly affected by physical or cyber attacks on the microgrid. This chapter focuses on the cyber security of microgrids; securing microgrids from physical attacks is outside the scope of this work.

This chapter formulates cyber security requirements for microgrids. Some of the relevant standards that can be used to derive smart grid cyber security requirements are: NIST IR 7628 [START_REF]Smart Grid Interoperability Panel[END_REF], NERC-CIP-002 to CIP-009 [14], NIST 800-53 [START_REF]Security and Privacy Controls for Federal Information Systems and Organizations[END_REF], NIST 800-82 [START_REF] Stouffer | Guide to Industrial Control Systems (ICS) Security[END_REF], ISO 27002 [7] and the Department of Homeland Security (DHS) Catalog of Control Systems Security [START_REF]Recommendations for Standards Developers[END_REF]. In this chapter, the NERC-CIP Standards CIP-002-1 through CIP-009-2 [14] are used to derive the cyber security requirements. Although the NERC-CIP standards are widely used in the bulk electricity generation infrastructure and are not directly applicable to microgrids, they are, nevertheless, among the most relevant standards for electrical systems. Additional cyber security requirements are derived by considering microgrid pilot project deployments [START_REF]SPIDERS Microgrid Project secures military installations[END_REF]. This chapter presents the µGridSec methodology, which ensures that appropriate mechanisms are applied to microgrid architectures to meet the cyber security requirements. A high-level threat model for a representative microgrid architecture is used to identify security threats and demonstrate how µGridSec can address the threats.

Security Requirements for Microgrids

This section articulates the cyber security requirements for microgrids. The requirements are derived from the North American Electric Reliability Corporation -Critical Infrastructure Protection (NERC-CIP) Standards CIP-002-1 through CIP-009-2 [14] and from pilot microgrid deployments [START_REF]SPIDERS Microgrid Project secures military installations[END_REF]. Note that the NERC-CIP requirements are formally defined for electric power infrastructure assets such as utilities, but they are re-interpreted for microgrids in this work. In particular, each requirement was formally analyzed and applied to a microgrid environment. A number of NERC-CIP requirements are administrative in nature and only the technical requirements are considered in this work. An analysis of pilot microgrid deployments revealed that the NERC-CIP requirements do not completely cover the cyber security requirements for microgrids. To address this gap, additional cyber security requirements for microgrids were formulated by studying some pilot microgrid deployments [START_REF]SPIDERS Microgrid Project secures military installations[END_REF].

The enhanced set of cyber security requirements for microgrids includes:

1. Critical Asset Identification: The critical assets related to microgrid operations and communications should be identified. This is done to ensure adequate protection of critical assets.

Cyber Vulnerability Assessment:

Cyber vulnerability assessments should be performed for: (i) electronic access points; (ii) electronic security perimeters; and (iii) critical assets. A comprehensive architectural risk analysis should be performed to identify the cyber security threats in the architecture and the security controls to address the threats.

Electronic Security Perimeter:

Every critical cyber asset should be within the electronic security perimeter.

Identity Management:

The microgrid system should provide digital identity management to all internal and external entities. This is important for all communications, coordination and control activities in a single microgrid and when multiple microgrids interact.

Access Control:

Appropriate access control should be enforced to mediate access to: (i) all critical assets; and (ii) all electronic access points at the perimeter. This includes the implementation of secure authentication mechanisms.

6. Information Protection: Appropriate measures should be taken to identify, classify and protect sensitive information associated with microgrid operations and communications.

7. Anomaly Detection: Remote entities should be allowed to perform only a well-defined set of actions associated with their accounts or roles. The sets of actions may be further broken down into sequences of commands that can be executed by remote entities. Any deviation from a sequence should be rejected and the anomaly should be logged.

8. Critical Asset Protection: Critical assets should be identified and protected from damage due to the actions of remote entities. The mechanisms should work in conjunction with the safety features of the identified critical assets.

µGridSec Methodology

This section discusses some representative microgrid architectures and provides details about their operation along with their information and communication components. Following this, the µGridSec methodology is described in detail.

Information and Communications

Figures 1 and2 show two microgrid architectures. Figure 1 shows an architecture where multiple microgrids are coupled together in a large deployment. Figure 2 shows a microgrid bank with multiple microgrid campuses connected together to create an energy farm along the lines of the architecture proposed in [START_REF] Bossart | DoE perspective on microgrids[END_REF]. These large and complex deployments are considered because the proposed methodology is intended to cover the security requirements for large, complex, current and future architectures.

Figure 1 shows a large deployment with multiple microgrids coupled together to meet the demands of a large campus. EN1 and EN2 are enterprise networks that provide electronic entry points to the microgrid. EN1 and EN2 are connected to the Internet and host a range of enterprise services for campus users. They also host control centers that enable users such as operators, technicians and administrators to control and manage the microgrids. The microgrids have two types of connections: (i) electrical wires for power flow; and (ii) network cables for communications and control. The network cables, which connect the microgrid controllers (Figure 1), typically use smart grid protocols such as DNP3 or IEC 61850. Information flowing along the channels is rarely encrypted and access control mechanisms are rarely used to access information and resources in the microgrids. The enterprise networks host control centers, which typically implement weak or no authentication mechanisms. The controllers execute the commands they receive without any authentication and a requestor can see information or access any component without any access control checks.

Figure 2 shows a futuristic energy farm in which multiple microgrid deployments coordinate to supply power to a utility by connecting to its distribution system. At this time, several technical limitations exist related to the power engineering aspects of such a deployment; however, research efforts are underway to address the challenges. The microgrids in Figure 2 connect to each other and to the utility distribution system using electrical wires for power flow and network cables for communications and control. Since microgrid based energy farms are not deployed as yet, an initial architecture is expected to be developed to meet the cyber security requirements.

µGridSec Components and Details

µGridSec is a methodology for providing comprehensive cyber security to microgrids. It incorporates security processes and mechanisms to meet the cyber security requirements identified in Section 2. The µGridSec methodology involves the four main steps described below.

Step 1: Refinement of High-Level Requirements. The first step considers the high-level cyber security requirements derived from industry standards and pilot deployments and breaks them down into low-level requirements for specific microgrid deployments. The security mechanisms needed to secure a microgrid deployment depend on the characteristics of the specific site and, hence, breaking down the requirements into low-level requirements based on the deployment environment helps select the right security mechanisms.

Step 2: Detailed Risk Analysis via Threat Modeling. The second step conducts an architectural cyber security risk analysis using threat modeling. The goal is to identify the security threats that the microgrid architecture faces and to select the appropriate security controls. In µGridSec, the threat modeling process is also used to identify the critical cyber assets in the architecture. Threat modeling is then performed on the critical cyber assets to identify the threats and vulnerabilities in the architecture that an adversary can exploit to attack the system. Finally, security controls are selected and implemented to effectively address the security threats and vulnerabilities. Threat modeling can be performed using the Microsoft SDL tool [START_REF]SDL Threat Modeling Tool[END_REF] or other popular threat modeling tools. The next section presents a threat modeling process assuming that the SDL tool is used to achieve Requirements 1 and 2 listed in Section 2.

Threat modeling involves the following steps:

Identify the main components responsible for microgrid operation and communications. For example, in Figure 1, the components are the power generation resources, storage and loads. The communications and control components are the controllers, communications channels and master controller. These components can be modeled using a threat modeling tool such as SDL [START_REF]SDL Threat Modeling Tool[END_REF].

Draw the trust boundaries. Boundaries are drawn for the security zones and conduits model, which creates trust zones in the system architecture that communicate through channels called conduits. (Optional) Prioritize the threats using the CVSS2 system [START_REF]NVD Common Vulnerability Scoring System Support v2[END_REF].

Select security controls that address the identified threats. Standards such as NIST SP 800-53 [START_REF]Security and Privacy Controls for Federal Information Systems and Organizations[END_REF], NIST SP 800-82 [START_REF] Stouffer | Guide to Industrial Control Systems (ICS) Security[END_REF] and ISA-99 [START_REF]ISA99: Industrial Automation and Control Systems Security[END_REF] can be used to select the appropriate security controls.

Step 3: Information Protection Mechanisms. The third step in the µGridSec methodology defines security mechanisms for information protection. These mechanisms, which help comply with Requirements 3 through 6, protect information in transit and at rest, and implement network security, identity management, and authentication and access control to secure information and critical assets.

The first mechanism defines the trust domains in the architecture. The zones in Figure 1 represent different trust domains. Each trust domain is protected by systems such as firewalls and access control lists. The level of perimeter protection depends on the level of trust associated with each domain. For example, in Figure 1, each microgrid is at the same trust level, therefore, some access-control-list-based perimeter protection should suffice. For conduits that connect microgrid trust domains to the enterprise network, firewalls with advanced capabilities are recommended. This architecture provides a layered approach with strong perimeter protection and additional layers of protection within the main perimeter.

The second mechanism enforces strong authentication and access control in a microgrid system. Strong authentication is enforced for users who access information and/or resources. Several authentication technologies can be used as outlined in NIST SP 800-53 [START_REF]Security and Privacy Controls for Federal Information Systems and Organizations[END_REF]. Role-based access control [START_REF] Sandhu | The NIST model for role-based access control: Towards a unified standard[END_REF] is recommended for access control. Since a small number of roles exist in microgrid systems, the management of access control policies would be efficient and less prone to errors. Authenticated subjects are mapped to one or multiple roles. The access control policy defines each role and its level of access to the information and microgrid components.

The third mechanism protects information at rest and in transit. µGridSec engages standard cryptographic mechanisms to protect information. The networks are protected using TLS 1.2 for channel encryption and AES-256 for message encryption; AES-256 is used to encrypt all data at rest. Messages incorporate sequence numbers to guarantee message freshness. Public-key certificates based on the X.509 v3 standard are used; depending on the deployment, the certificates are either self-signed or certificate-authority-provided. Certificate management and key management are performed according to best practices [START_REF] Barker | Recommendation for Key Management[END_REF]. Digital signatures can be used optionally for messages to ensure non-repudiation. The ability to affix and verify digital signatures is provided, but is not mandatory. Also, hash message authentication codes may be used to provide message authenticity at the application level.

The fourth and final mechanism provides digital identity management in µGridSec. Each component that is addressable by a communication has a unique identity in a microgrid and the corresponding mapping is stored in a database. Each microgrid has a unique identifier that is appended to the component identity in the case of multiple connected microgrids to resolve namespace clashes. The database also contains other information about microgrid components that might aid in providing identity management services.

Step 4: Anomaly Detection and Component Protection Mechanisms. The fourth and final step of the methodology provides anomaly detection and microgrid component protection. This involves two phases. In the first phase, µGridSec proposes command validation such that only validated commands can be executed on critical assets. This functionality can be achieved by command whitelisting. The access control engine can perform whitelist checking or a commercial whitelisting product may be integrated with µGridSec to assist with command whitelisting. Whitelisting of commands can be performed per role to enhance its effectiveness. The access control engine can also track entities (and roles) that repeatedly send commands that are prohibited and raise alarms. Logs should be analyzed to identify entities that display erroneous or potentially malicious behavior.

In the second phase, the component protection manager (CPM), which is inside the controller, communicates with the power and voltage controller (PVC) (Figure 1). A command to a microsource is executed only after the power and voltage controller verifies that it does not violate the safety limits of the microsource. The component protection manager along with the whitelist manager in the access control engine ensure that the setpoints of the power and voltage controller are not modified by unauthorized entities. These two steps guarantee the integrity of setpoints and that microsources are not damaged by adversaries who execute arbitrary commands on the microsources.

Implementing µGridSec

This section discusses some widely-available commercial and open-source technologies that can be used to implement the security controls listed above.

Threat modeling for a microgrid architecture can be performed using a manual approach or an automated tool. The popular Microsoft SDL tool [START_REF]SDL Threat Modeling Tool[END_REF] may be used for modeling the threats to a microgrid architecture or system.

µGridSec recommends the use of network firewalls for perimeter protection. Several vendors provide network firewalls with advanced features that can be used for microgrid deployments. While it is important to find the right vendor to meet the deployment requirements, it is even more important to maintain secure configurations of the firewalls. Most firewalls allow remote configuration and maintenance by administrators; this feature should be protected very carefully if it is employed.

Authentication and access control are two other features that can be deployed using a combination of commercial technologies and custom implementation. Authentication is supported by protocols such as IEC 62351 [5] and OLE for Process Control Unified Architecture (OPC UA) [START_REF]OPC Foundation, Unified Architecture[END_REF]. Standard usernamepassword based authentication is provided by these protocols. Secure authentication can be implemented for privileged users such as administrators via two-factor authentication mechanisms. The second factor can be implemented using a commercial solution.

Access control should be implemented on microgrid devices and in the network. In the case of microgrid devices, access control lists on Linux platforms can be leveraged to provide fine-grained access control to resources and operations. In the case of a network, role-based access control may be implemented to provide strong access control. One solution is OpenRBAC, an open-source implementation of the ANSI/INCITS Standard 359-2004 (Role Based Access Control) [START_REF]Directory Applications and Advanced Security and Information Management International[END_REF]. This solution is flexible, configurable and easily integrated into microgrid networks.

µGridSec proposes TLS 1.2 for channel protection and AES-256 for message protection. The popular OpenSSL library [START_REF]Welcome to the OpenSSL Project[END_REF] may be integrated in a microgrid system to provide TLS 1.2 and AES-256 mechanisms.

Finally, command validation may be implemented via command whitelisting. This can be performed by custom software integrated with the access control engine or by a commercial whitelisting product. Whitelisting of commands can be performed per role to enhance its effectiveness. Command validation provides protection from command injection attacks and also limits the invocation of sensitive executables to certain roles.

Cyber Security Requirements

This section revisits the cyber security requirements laid out in Section 2 and discusses how they are met by different µGridSec components.

Critical Asset Identification:

This requirement is met by the threat modeling process in µGridSec, where the first step is to identify the critical assets in a microgrid.

Cyber Vulnerability Assessment:

This requirement is also met by the threat modeling process in µGridSec, where the potential cyber vulnerabilities and threats are identified in a microgrid architecture after the critical assets have been identified. The vulnerability assessment is performed using the SDL tool, which engages an attack library based on the STRIDE model.

Electronic Security Perimeter:

A strong electronic security perimeter is built into a microgrid system using external firewalls with advanced features and secure configurations. Additionally, trust domains are created within the perimeter for additional defense. The internal trust domain boundaries can be based on access control lists.

Identity Management:

The digital identity of each resource in a microgrid is stored in a database and is used whenever the resource is referred to by a communications or control message. When multiple microgrids are integrated in a microgrid bank, the domain name of a specific microgrid is appended before an asset name to avoid namespace clashes. This identity is used as the primary username by the authentication mechanism.

Access Control:

Strong authentication and access control are enforced in a microgrid system. Role-based access control is prescribed for accessing all sensitive information and critical physical assets.

Information Protection and Authenticity:

Strong mechanisms are in place to protect sensitive information in transit or at rest. µGridSec uses a combination of standard symmetric and asymmetric cryptographic algorithms such as AES-256 and ECC/RSA with strong key management to provide the required functionality. Hash message authentication codes are proposed to ensure message-level authenticity and digital signatures are used to achieve non-repudiation. A public-key infrastructure is employed to enable trust based on digital signatures.

Anomaly Detection:

Anomaly detection is implemented at the command interface based on whitelisting. The whitelist is manually populated by the administrator and is used to verify that each role is only allowed to execute authorized commands. An anomaly is reported if a role attempts to execute unauthorized commands repeatedly.

Critical Asset Protection:

A component protection manager is implemented on controllers. The component protection manager ensures the integrity of setpoints in power and voltage controllers and that the safety limits of microsources are not violated. The component protection manager and access control lists prevent unauthorized access to configuration and safety data, and, even in the case of authorized access, ensure that the safety limits of the microsources are not violated.

Threat Model

This section presents a cyber security threat model for the microgrid architectures presented in Figures 1 and2. The threats are divided into seven categories. The manner in which µGridSec protects a microgrid against each of the identified threat categories is also discussed.

Unauthorized Access

In this threat category, the attacker can:

Access the setpoints in a power and voltage controller in an attempt to violate the safety limits and damage equipment.

Access the energy manager and send malicious messages to microgrid components in order to consume resources or damage the components.

Access sensitive information in transit or at rest, and remove traces from the system by deleting entries from the access log.

Mitigation:

The µGridSec methodology uses strong authentication to determine the identity of a remote user and to map the user identity to the associated roles. A user can only assume roles that are associated with his/her identity. Each asset in the system has an access control list that determines the access rights of a given role for the asset (an asset is any physical component of a microgrid or any information that is protected). This prevents unauthorized access to assets. Since the number of assets and the number of roles in a microgrid are limited, the access control lists would be limited in size and easily manageable by system administrators.

Privilege Escalation

In this threat category, the attacker can:

Gain higher privileges in the system. For example, an attacker can leverage implementation weaknesses or lenient access control lists to elevate his/her privilege level and abuse the new access rights gained as a result.

Gain access to privileged information. For example, an attacker can launch an SQL injection attack on a controller that uses an SQL database to access privileged information stored in the database.

Mitigation:

The µGridSec methodology uses role-based access control and implements a least-privilege access control architecture. Thus, each role is granted the minimum privileges to perform the required tasks; this prevents unauthorized or unintended access. It is still necessary to protect against other implementation weaknesses such as those exploited by SQL injection attacks. However, using a least-privilege architecture ensures that higher privileges than are absolutely necessary are not provided by default.

Spoofing

In this threat category, the attacker can:

Spoof accounts by stealing credentials or exploiting storage, guessing credentials by exploiting weak account management, brute-forcing user passwords and recovering passwords by exploiting weak password policies.

Mitigation:

The µGridSec methodology defines secure account and password management policies. Some of the principal features are:

Strong and secure authentication mechanisms that always use secure channels to perform authentication.

Strong password policies covering password entropy, password resets, password expiry, etc.

Passwords are stored as hashes generated by the PBKDF2 function.

Denial-of-Service

In this threat category, the attacker can:

Launch denial-of-service attacks on a microgrid system. A common example is a network flooding attack using SYN or ICMP packets. Another common denial-of-service attack (at the application layer) is flooding an application with service requests that cannot be filtered at the network layer.

Mitigation: The µGridSec methodology enforces firewalls with advanced features at the network perimeter for effective perimeter protection. Also, the various trust domains are protected by firewalls and access control lists that provide an additional layer of defense. Additionally, access control lists restrict the roles that can send requests to an asset. Note that applications typically use additional mechanisms such as rate limitation or context-based request processing to handle flooding attacks at the application layer.

Software and Firmware Integrity

In this threat category, the attacker can:

Download malware-infected firmware on a device such as a controller and gain complete control of the device.

Mitigation:

The µGridSec methodology uses a public-key infrastructure to enforce digital signatures on hashes of firmware. Each device verifies the integrity of the firmware before it is downloaded.

Unauthorized Network Access

In this threat category, the attacker can:

Access confidential information in the absence of adequate transport layer protection.

Mitigation:

The µGridSec methodology uses TLS 1.2 for transport layer protection. This ensures strong network level protection for communications both within and outside a microgrid system.

Repudiation

In this threat category, the attacker can:

Deny sending or receiving certain messages. This can be critical for financial transactions (e.g., market price data and units of electricity sold or purchased). This type of attack can be launched by compromising a microgrid component or by relying on a dishonest or compromised employee.

Mitigation:

The µGridSec methodology mandates the use of digital signatures for financial and other sensitive transactions. The use of digital signatures is optional for non-sensitive transactions, but they can be used at the discretion of an administrator. µGridSec supports a public-key infrastructure in which each entity has a public-key certificate and a corresponding private key. The private key is used to sign the hash of a sensitive message or transaction.

Related Work

The Smart Power Infrastructure Demonstration for Energy Reliability and Security (SPIDERS) Project is executed jointly by the Department of Energy, Department of Defense and Department of Homeland Security [START_REF]SPIDERS Microgrid Project secures military installations[END_REF]. The goal of the SPIDERS microgrid demonstration project is to provide secure control of electricity generation at U.S. military bases. This will be achieved by building smart, secure and robust microgrids that incorporate renewable resources. The SPIDERS Project is the first of its kind to provide cyber security for microgrid control and operations. Cyber security is provided by commercially-available technologies and, therefore, the SPIDERS cyber security technology itself is not novel. Also, SPIDERS does not provide a methodology that comprehensively addresses the possible attack vectors as in the case of µGridSec.

The CERTS MicroGrid concept integrates distributed energy resources in a microgrid to seamlessly separate or island them from the grid and reconnect them to the grid [START_REF] Lasseter | Integration of Distributed Energy Resources: The CERTS MicroGrid Concept[END_REF]. To the external entity, the entire microgrid appears as a single entity instead of a collection of distributed energy resources. The traditional method has been to integrate a small number of distributed energy resources and to shut down a microgrid when a problems arises, as detailed in the IEEE P1547 standard. The CERTS MicroGrid architecture serves as the base model for µGridSec with respect to microgrid architecture and operations. However, the CERTS model does not consider cyber security issues whereas µGridSec is focused on entirely on cyber security for microgrids.

Wang and Lemmon [START_REF] Wang | Task 1: Coupling Low-Voltage Microgrids into Mid-Voltage Distribution Systems[END_REF] have proposed a method for coupling low voltage microgrids into mid-voltage distribution systems. They propose a hierarchical control architecture to maximize the real power exported to a mid-voltage distribution network by coupling low voltage microgrids. Their architecture is similar to the microgrid coupling architecture considered in this work. However, Wang and Lemmon consider the electrical architecture of microgrids whereas µGridSec is focused on cyber security for microgrids. Note that the work of Wang and Lemmon as well as other efforts related to microgrid infrastructures could serve as platforms on which µGridSec could be deployed.

Mueller [START_REF] Mueller | Cyber-Physical Aspects of Energy Systems for the 21st Century: A Perspective from the NSF ERC FREEDM Project[END_REF] has published details of the NSF ERC FREEDM Project on microgrids. This project investigates the challenges of the cyber-physical aspects of microgrids and highlights novel opportunities for selective power delivery during power outages. It also recognizes the need to secure microgrids because distributed control systems are highly vulnerable to cyber attacks. Mueller makes a case for securing microgrids, but does not propose any solutions. In contrast, µGridSec recognizes the need and challenges involved in implementing cyber security for microgrids. µGridSec also derives requirements from established standards and deployments and presents a comprehensive methodology that meets the requirements.

Conclusions

Microgrids are an important component of current and future energy systems. They provide several benefits, including enhanced power quality, uninterrupted power supply and integration of renewable sources in the power distribution system. Since microgrids are a key component of the energy critical infrastructure, it is important that they are not disrupted or damaged by cyber attacks. The µGridSec methodology presented in this chapter is an architecture-agnostic approach that provides standards-based high security for microgrid deployments. In particular, the methodology can be applied to ensure that appropriate mechanisms are applied to microgrid architectures in order to meet cyber security requirements derived from the NERC-CIP standards and pilot microgrid deployments. A security evaluation of a representative microgrid architecture demonstrates that the µGridSec methodology can comprehensively address the identified threats. In cases where legacy devices in a microgrid do not support cryptographic mechanisms such as TLS or integrity validation, security can be implemented in the form of bump-in-the-wire hardware solutions; this concept is illustrated in a companion chapter in this volume [START_REF] Mohan | A cyber security architecture for microgrid deployments[END_REF]. The µGridSec methodology can enable the wider adoption of microgrids, especially in sensitive installations such as military bases and hospitals, thus enhancing energy security.

Future research will explore other relevant standards and derive additional cyber security requirements that will extend the µGridSec methodology. Although the threat modeling and architectural risk analysis presented in this chapter demonstrate that µGridSec effectively addresses cyber threats, the incorporation of requirements from additional standards will render the methodology more comprehensive and will help achieve compliance with smart grid standards.

Figure 1 .

 1 Figure 1. Architecture with coupled microgrids.

Figure 2 .

 2 Figure 2. Architecture with an energy bank comprising independent microgrids.


Apurva Mohan

Gregory Brainard

Himanshu Khurana

Scott Fischer

A Cyber Security Architecture for Microgrid Deployments

Keywords: Microgrids, cyber security architecture, threat modeling

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

A microgrid is a collection of distributed energy resources (DERs), storage and loads under common coordination and control that provides a functional interface to enable its management as a single unit. The U.S. Department of Energy defines a microgrid as: "[A] group of interconnected loads and distributed energy resources within clearly defined electrical boundaries that acts as a single controllable entity with respect to the grid. A microgrid can connect and disconnect from the grid to enable it to operate in the grid-connected or island-modes" [START_REF] Bossart | DoE perspective on microgrids[END_REF]. A microgrid acts as a single point of integration for generating (renewable and non-renewable) and non-generating sources. A microgrid accumulates all the generation capacity at a site and provides power to a local site not only in cases of blackouts, but also as ancillary capacity to lower energy usage from the main electric power grid. Microgrids are currently deployed at military bases, hospitals, universities, residential communities and government buildings to enhance energy efficiency and energy security. Microgrids can be deployed in a variety of architectures -as a single microgrid that provides power to a site, as multiple microgrids that function in isolation at a site, or as multiple microgrids deployed as power enclaves, where each enclave is served by a single microgrid unit, but all the units are connected via electrical power lines for load balancing and via communications lines for common control and coordination.

In many critical infrastructures, operations sites are often distributed and multiple sites are connected to a common control center. Also, the control center needs to communicate with the enterprise network. To enable all the required communications, microgrids/control centers are often connected to the Internet directly or via a control center. Typically, the control center to microgrid communications use distributed control system (DCS) protocols such as DNP3 and Modbus; IP-based protocols such as DCS IP or TCP/IP are typically used for longer distances. The Internet connectivity exposes microgrids to numerous cyber threats. Cyber attackers could target microgrid operations and potentially disrupt the power supply. Attacks on microgrids installed at sensitive sites such as military bases, hospitals or government buildings could have serious consequences.

This chapter describes the novel Secure Network of Assured Power Enclaves (SNAPE) cyber security architecture, which enforces network separation in microgrid communications to reduce the attack surface while enhancing communications efficiency and security. In particular, SNAPE segregates the communications networks needed for fast, real-time control from networks used for external control signals and monitoring. The SNAPE architecture was created for a large U.S. Army base where multiple power enclaves with secure communications were envisioned. A deployed microgrid system based on the SNAPE architecture would contribute to the energy security and net-zero goals of the U.S. Department of Defense. The architecture uses cryptographic mechanisms to enforce network separation and provide strong cyber security.

The research described in this chapter has three main contributions. The first is the development of a conceptual cyber security architecture for microgrids with a cryptographic network separation strategy that minimizes control network latency and the control network attack surface. The second is a practical deployment architecture for microgrids that provides security and scalability. The third contribution is the use of certified hardware devices for cryptographic network separation, which significantly reduces the certification burden for microgrid deployments at U.S. military bases.

Problem Description

Current distributed control system and SCADA environments typically rely on the IEC 61850 standard for communications between power substations. It is also a natural choice for connecting power enclaves defined in the SNAPE architecture, where multiple microgrids coordinate command and control. This environment has a very strict timeframe of a few milliseconds for commandresponse messages and any additional latency adversely impacts system performance in terms of the established requirements.

As mentioned above, microgrid systems are being connected to external networks such as enterprise networks and the Internet, which significantly increases cyber threats. Cyber attackers can attack microgrid power enclaves and compromise critical operations by exploiting vulnerabilities at the network, system and/or application levels. Microgrid deployments are being planned with network and information technology security postures that are not compliant with standards such as NIST 800-53 [START_REF]Security and Privacy Controls for Federal Information Systems and Organizations[END_REF] or IEC 62443 [5]. Most systems rely on perimeter protection with the internal systems designed with lower security because they were intended to be part of a closed network. As such, achieving defense-in-depth in these microgrid systems and networks is a major challenge.

Another related problem in power networks is that communications protocols (e.g., IEC 61850) were not designed for security and they do not inherently support security features. As a result, providing communications security for these protocols requires considerable ad hoc and ancillary security mechanisms. These mechanisms inadvertently introduce security vulnerabilities that are easily exploited by cyber attacks. Recent standards such as IEC 62351 focus on securing IEC 61850 based communications [4], but even IEC 62351 does not cover the entire gamut of security vulnerabilities in networked microgrid deployments. OLE for Process Control -Unified Architecture (OPC UA) [START_REF]OPC Foundation, Unified Architecture[END_REF] presents a framework with a standards-based communications backbone and built-in security that covers a larger set of cyber security threats. However, it does not address microgrid-specific threats such as the exposure of sensitive control networks, the integration of legacy components and the complexities involved in achieving cyber security certifications.

This chapter focuses on three problems. First, the internal networks in a microgrid deployment comprise several sub-networks such as the SCADA network and microgrid control network, and maintain connections to the enterprise network. Since these networks are interconnected, the exposure of microgrid control networks to attacks is increased. A malicious entity could exploit an attack vector to break into any one of the sub-networks and then attempt to disrupt operations elsewhere in the microgrid control network. Second, many legacy devices are unable to implement security mechanisms such as encryp- tion, message signing and message hashing. This makes it difficult to enforce a strong and uniform security policy in the system. If the security policy is chosen for varying levels of security based on device capabilities, then attackers could compromise the lower-end devices with weaker security and then pivot to other networked devices. Third, in the case of microgrids at U.S. Department of Defense installations, the deployments have to obtain DIACAP or the more recent DIARMF (Department of Defense Information Assurance Risk Management Framework) certifications. Since a microgrid network comprises several sub-networks, the task of security assessment and certification of the microgrid control network becomes very complex and challenging.

SNAPE Cyber Security Architecture

The SNAPE architecture enables secure communications and control for multiple microgrid systems at a site, where each microgrid corresponds to a power enclave. A SNAPE microgrid can function in the grid connected mode or in the islanding mode to provide power to a local site. SNAPE SCADA control systems accept external automated demand response (ADR) signals and participate in automated demand response programs for energy efficiency.

Figure 1 presents a conceptual architecture of the SNAPE system. The system has two power enclaves, APECS-1 and APECS-2. Each enclave is at-tached to critical and non-critical mission buildings. An enclave may have one or more diesel generators powering it. The microgrid has a point of common coupling (PCC) main breaker that can disconnect the microgrid from the main grid to bring it into the islanding mode. The lines connecting the substation to APECS-1 and APECS-2 correspond to the secure control network, whereas the lines connecting the SCADA controls to APECS-1 and APECS-2 correspond to the secure SCADA network. The control and SCADA networks are isolated from each other. The isolation can be physical or logical in nature.

Security Properties

The SNAPE architecture provides a number of security properties to address the cyber security concerns discussed above. The main security properties are: Confidentiality of information, command-response and power system operations.

Channel integrity -integrity of data and communications flowing in and out of the microgrid.

Message integrity -message level integrity protection in addition to channel protection.

Application integrity -protection of the integrity of applications installed in the microgrid system.

Availability of communication channels and microgrids to participate in command-response communications.

Authenticity of information sources.

Protection and isolation from the enterprise network and external networks.

Auditing and forensic analysis capabilities.

Reduction of the cyber attack surface.

Architecture

This section presents the details of the SNAPE cyber security architecture and describes its functioning via some use cases. Also, it discusses how the architecture acquires the security properties listed above.

The secure control network in Figure 1 is isolated from the secure SCADA network. This isolates the control network from access from the enterprise network and other external networks, including the Internet. The isolation also improves the response time in the control network, which is critical to synchronizing microgrids. Additionally, it reduces the attack surface of the control network because no direct communications path exists. In the SNAPE architecture, OLE for Process Control -Unified Architecture (OPC UA) is used to implement the communications backbone. OPC UA is backward compatible with distributed control system protocols such as IEC 61850. OPC UA provides authentication and authorization services at the application layer. Availability in a network is provided by two mechanisms. First, the isolation of the control network from external networks ensures that the control network communications can meet the low latency requirement and critical infrastructure components are not unavailable due to large latencies or disruptions caused by microgrid components being out of sync. Second, cryptographic protection of messages and the network, as well as network firewalls, ensure that attackers cannot compromise the network or launch denialof-service attacks against network components. It is important to emphasize Figure 3. OPC UA security model [START_REF]OPC Foundation, Unified Architecture[END_REF].

that the closed loop control network is enclosed within the secure enclaves and the control network is physically isolated, hence it cannot be reached from the communications network. The communications network uses high-end cryptographic protection to enforce cyber security without adding additional latency to the control network due to its isolation.

Finally, important events, accesses and messages are logged to enable auditing and forensic analysis. This helps identify anomalous behavior and perform root cause analysis if an attack is suspected.

OPC UA Integration

This section describes how OPC UA is integrated with the SNAPE architecture to provide a secure communications backbone. Details of the OPC UA security model are provided to demonstrate that the SNAPE architecture has the security properties listed above.

The OPC UA standard was created by the OPC Foundation [START_REF]OPC Foundation, Unified Architecture[END_REF]. It improves on the earlier OPC Classic standard, which was restricted to the Windows operating system. OPC UA builds on OPC Classic with several significant updates, including an open platform architecture, a built-in security model and a feature-rich data model. It is also backward compatible with standards such as IEC 61850. This makes OPC UA an excellent choice for integration within the SNAPE architecture.

Figure 3 shows the OPC UA security model. The model has two layers, the communications layer and the application layer. In the communications layer, a secure channel provides confidentiality and integrity of the communications. Another feature that is supported is application authentication, which allows only authenticated applications to participate in microgrid operations. In the application layer, user authentication and authorization are used to establish a secure session over a secure channel. An important point to note is that availability itself is not provided by the OPC UA security model. It relies on the minimal processing of messages prior to authentication and defers availability to the server implementation. The SNAPE architecture complements these mechanisms by providing strong availability properties via features such as network segmentation, cryptographic separation and network firewalls.

The OPC UA security model is comprehensive and offers multiple options for achieving security properties in the communications and application layers [START_REF]OPC Foundation, Unified Architecture[END_REF].

In the application layer, authentication may be achieved by three different means: username/password, an X.509v3 certificate or a WS-SecurityToken. An X.509v3 certificate involves multiple asymmetric cryptographic operations that are computationally intensive and are not well suited for authentication in resource-constrained environments. However, username/passwords and WSsecurity tokens provide comparatively efficient authentication. During system implementation, it would be necessary to compare the different mechanisms against the real-time system requirements and select the most efficient form of authentication for the SNAPE architecture. Authorization in the OPC UA security model is more open ended and can integrate already-deployed authorization solutions. Since the SNAPE architecture targets microgrids, existing authorization mechanisms in the form of access control lists are integrated to provide fine-grained authorization for microgrid resources.

In the communications layer, confidentiality is provided by encryption within a secure channel, message signatures for message integrity and digital signatures for application authentication. Like the application layer, the OPC UA stack provides multiple options to implement each security mechanism. The optimal combination of asymmetric and symmetric cryptographic algorithms was selected for the SNAPE architecture to meet microgrid performance requirements. OPC UA is flexible and allows any combination of the mechanisms to be selected to suit a specific deployment. For example, a combination of mechanisms such as transport layer security (TLS) for channel protection and symmetric algorithms for message integrity may suit a microgrid deployment environment. This would allow SNAPE to leverage the benefits of TLS for channel protection and the advantages of symmetric algorithms such as AES256 and HMAC(SHA1) for improved real-time performance with regard to message integrity protection.

SNAPE Threat Model Analysis

This section identifies the potential cyber threats that exist in the microgrid deployment scenarios presented in Figures 1 and2, and demonstrates that the SNAPE architecture mitigates the threats.

Remote Sabotage:

Threat: An adversary can remotely access the microgrid and launch a privilege elevation attack to gain higher rights. The adversary can then perform unauthorized operations to disrupt the microgrid system and potentially the power supply.

Mitigation:

The SNAPE architecture implements a number of security controls to mitigate this threat. Secure network communications protects against threats such as session hijacking. Identity management with strong account management protects against account spoofing attacks. The access control implementation in the microgrid system prevents unauthorized access to microgrid resources and operations.

Tampering with Power Enclave Synchronization:

Threat: The adversary can disrupt power enclave synchronization by reporting incorrect power measurements to other entities. This could potentially destabilize the power enclaves and disrupt their operations.

Mitigation: In the SNAPE architecture, the control network and the SCADA network are isolated from each other. This isolation drastically reduces the attack surface from the SCADA network to the energy network. Moreover, authentication and access control protection in the microgrid system prevent unauthorized access. As such, it is highly unlikely that an adversary could reach the control network and disrupt its operation.

Sensitive Information Disclosure:

Threat: An attacker can view sensitive microgrid information that is at rest or in transit.

Mitigation:

The SNAPE architecture implements authentication and access control in the microgrid system, so that only authorized entities can view or operate on sensitive data. Additionally, information in transit is protected by strong network security involving encrypted communications channels using TLS. Thus, sensitive information at rest or in transit is protected from unauthorized disclosure.

Denial of Service:

Threat: An attacker can launch a denial-of-service attack by flooding a network to disrupt microgrid operations and potentially the power supply.

Mitigation:

The SNAPE architecture uses secure network topologies derived from reports and standards such as NIST SP 800-53 and IEC 62443 to deploy firewalls and demilitarized zones to isolate the SCADA and control networks from the enterprise network. The firewalls protect against network flooding attacks. Also, the SCADA and control networks are isolated, which further reduces the control network attack surface. Additionally, the OPC UA communications backbone performs minimal processing of unauthenticated messages to mitigate the denial-of-service threat.

Targeting Legacy Devices:

Threat: Legacy devices in the microgrid system are unable to implement encryption for secure communications channels. An attacker can target these channels to view sensitive information or to inject or manipulate commands.

Mitigation:

The SNAPE architecture positions bump-in-the-wire hardware in front of legacy devices to implement secure communications. The bump-in-the-wire devices provide network security via TLS, which makes legacy devices compatible with other devices and provides uniform and strong network security. The bump-in-the-wire devices can be DIACAPor DIARMF-certified to provide strong, standards-compliant network security regardless of end device capabilities.

Malware Installation:

Threat: An attacker can install malware on microgrid devices.

Mitigation:

The SNAPE architecture provides two types of protection against malware installation. First, software or firmware installation on a device is a privileged action that can only be performed by an administrator; it would be very difficult for an attacker to compromise a highly-secure administrator account to install malware. Second, software and firmware integrity checks are performed by validating their digital signatures; only firmware and software that pass the validity checks can be installed. These security mechanisms protect against the installation of malware on the microgrid system.

Discussion

Whenever security considerations are included in an architecture, certain trade-offs have to be made to balance security versus performance, cost, development time and usability. The SNAPE architecture uses bump-in-the-wire devices to support the secure integration of legacy devices. This provides uniform security in a microgrid network by enabling legacy devices to communicate using strong encryption algorithms. The downside, however, is that these devices can be expensive, depending on their functionality and the desired level of security. However, this is an optional feature in the SNAPE architecture, although it may be mandatory for microgrids at sensitive locations such as military bases.

Another trade-off is that network separation using bump-in-the-wire devices may increase network complexity and latency. However, the separation offers the choice of cryptographic algorithms for network protection. The bump-inthe-wire devices are DIACAP-certified and perform cryptographic operations end-to-end. The added latency is very low and is only introduced in the communications network. The control network is part of the secure enclaves where there is no additional latency related to cryptographic operations.

The SNAPE architecture proposes the use of TLS for strong network protection. The architecture also provides end device authentication, which is especially useful in sensitive installations and helps achieve DIACAP or DIARMF compliance. The downside of using TLS is that public-key infrastructure certificates must be installed and managed by the network. Using symmetric encryption is possible with TLS, but this is a non-standard mode of operation that is not recommended for regular deployments.

The final trade-off is related to the integration of OPC UA in SNAPE. The integration increases complexity and the cost of system development. However, on the positive side, it provides standards-based communications security. Also, it inherits a versatile and feature-rich communications backbone from SNAPE.

Massie [START_REF] Massie | Implementation of a cyber secure microgrid control system[END_REF] has presented a proposal for microgrid cyber security based on a distributed control approach that uses IPv6 for communications. IPv6 provides some benefits such as making host scanning and identification more difficult from outside a network because of the large number of possible IP addresses, and supporting end-to-end encryption and secure name resolution that helps counter attacks such as ARP poisoning. The SNAPE architecture provides all the benefits of an IPv6-based network. Indeed, the SNAPE architecture was developed by performing threat modeling and risk analysis, and security controls and mechanisms were subsequently incorporated to address the identified threats. In the SNAPE architecture, a microgrid deployment uses a private network with strong perimeter protection. Secure firewalls disable network scanning and identification. End-to-end encryption is implemented using TLS. Also, TLS used for network-level authentication can be configured for the mutual authentication of clients and servers; this eliminates ARP attacks. Additionally, SNAPE uses bump-in-the-wire devices to provide end-to-end authentication of legacy devices.

Massie's approach [START_REF] Massie | Implementation of a cyber secure microgrid control system[END_REF] suffers from several security issues compared with the SNAPE architecture. First, a decentralized peer-to-peer control architecture means that every node is trusted equally and can even take over the functionality of other nodes, especially during automated recovery. In addition to introducing complexity, this approach potentially opens new attack vectors. The adversary needs to compromise just one node and then pivot to sabotage the system. In a centralized model, a server has much stronger security than a client node. Maintaining trust in an open decentralized peer-to-peer system is a hard problem [START_REF] Kamvar | The Eigentrust algorithm for reputation management in P2P networks[END_REF][START_REF] Mohan | AttributeTrust -A framework for evaluating trust in aggregated attributes via a reputation system[END_REF] and even controlled system deployments would inherit some of its threats if they are connected to the Internet. Second, since control and coordination are distributed to every node, it is not possible to segment the network and isolate it for higher security and performance, something that is inherently supported and demonstrated in the SNAPE architecture. Third, Massie's approach assumes that all control devices are deployed with the peerto-peer functionality and there are no legacy devices (actually, the approach is unable to integrate legacy devices). On the other hand, SNAPE has a method to integrate legacy devices; this is important because most network deployments are incremental in nature and it is exceedingly rare not to encounter legacy devices in a deployment.

Additionally, deploying IPv6-based networks potentially opens a number of security holes. If IPv6 and IPv4 are being run simultaneously, then IPv6 should be tunneled over IPv4 or run independently. In the tunneling mode, configuration problems can create security holes in the system [START_REF] Lyne | Why IPv6 matters for your security[END_REF]. If the two protocols are run in parallel, then firewalls have to be configured to filter the IPv6 traffic, which is not very common. A normal firewall does not filter IPv6 traffic; this insecure channel can be leveraged by an attacker to enter the system. Also, administrators must employ new (and better) ways to deploy, configure and monitor networks. Important tasks include troubleshooting networks, configuring firewalls, enforcing secure configurations, monitoring security logs, analyzing real-time behavior and performing network audits. Most intrusion detection/prevention systems are still not very effective at handling IPv6 traffic, which increases the potential of attacks.

Related Work

Strickland [START_REF] Strickland | Microgrid security considerations in military base deployments[END_REF] has presented an approach for protecting military microgrids from cyber attacks. However, the approach relies primarily on security best practices and does not consider some key issues that are addressed in the SNAPE architecture such as the vulnerabilities originating from SCADA networks and legacy devices.

The CERTS MicroGrid is a novel approach for integrating distributed energy resources in a microgrid to seamlessly island it from and reconnect it to the power grid [START_REF] Lasseter | Integration of Distributed Energy Resources: The CERTS MicroGrid Concept[END_REF]. To the control center, all the distributed energy resources appear to be a single entity for coordination and control. The traditional method has been to integrate a small number of distributed energy resources and to shut down the microgrid when problems arise (according to the IEEE P1547 standard). However, unlike the SNAPE architecture, the CERTS model does not specifically focus on cyber security for microgrids.

The Smart Power Infrastructure Demonstration for Energy Reliability and Security (SPIDERS) Project is conducted jointly by the Department of Energy, Department of Defense and Department of Homeland Security [START_REF]SPIDERS Microgrid Project secures military installations[END_REF][START_REF] Stamp | The SPIDERS Project -Smart power infrastructure demonstration for energy reliability and security at U.S. military facilities[END_REF]. The project goal is to provide secure control of on-base generation at military bases by building secure and robust microgrids that incorporate renewable energy resources. Cyber security is provided by commercially-available technologies, so the technology itself is not novel. Unlike SNAPE, SPIDERS does not provide a comprehensive architecture to address all possible attack vectors.

Mueller [START_REF] Mueller | Cyber-Physical Aspects of Energy Systems for the 21st Century: A Perspective from the NSF ERC FREEDM Project[END_REF] discusses research undertaken under the NSF ERC FREEDM Project [START_REF] Mueller | Cyber-Physical Aspects of Energy Systems for the 21st Century: A Perspective from the NSF ERC FREEDM Project[END_REF]. The project investigates the challenges of the cyber-physical nature of microgrids and highlights novel opportunities for providing selective power delivery during power outages. Mueller recognizes the need to secure microgrids from cyber attacks. However, the FREEDM Project does not propose any security solutions. SNAPE stands out because it recognizes the need to secure microgrids and presents a comprehensive cyber security architecture that adheres to industry standards and satisfies actual microgrid requirements.

Massie [START_REF] Massie | Implementation of a cyber secure microgrid control system[END_REF] presents a distributed control framework for microgrids to enhance coordination, communications and security. The framework, which uses IPv6-based communications, attempts to leverage security from IPv6 and the peer-to-peer distributed model, but it also inherits their problems. SNAPE provides all the security features provided by the framework and introduces many additional security mechanisms.

Conclusions

Microgrids are being deployed at military bases and other mission-critical facilities to reduce the dependence on the power grid, to provide power during outages and to achieve the net-zero goal imposed by the U.S. Department of Defense. The SNAPE architecture is designed specifically for the secure deployment of military microgrids. It introduces several key concepts such as the physical or logical separation of microgrid control networks from SCADA networks, bump-in-the-wire devices that integrate legacy devices in a secure manner and standards-based security controls for microgrid network protection.

Current efforts are focused on realizing the SNAPE architecture in a microgrid facility under construction at a U.S. military base. The design divides the power network into several power enclaves, each served by a microgrid unit. These units will be connected using the SNAPE architecture to support common control and coordination. An OPC UA based communications backbone will be implemented along with the additional security mechanisms described in Section 3. An architectural risk analysis of the system has revealed that SNAPE effectively addresses all the identified risks. During the microgrid design phase, security threat use cases will be evaluated using the SNAPE architecture to verify that the threats are comprehensively addressed. During the deployment phase, strong efforts will be taken to ensure that all the architectural and design considerations will be implemented and tested.

Figure 1 .

 1 Figure 1. Conceptual architecture of a SNAPE microgrid.

Figure 2 .

 2 Figure 2. Communications security architecture based on the SNAPE concept.

Figure 2

 2 Figure2presents the SNAPE architecture from the communications, network and system security point of view. It shows the external communications with the enterprise network and the local network that connects to the microgrid. "Bump-in-the-wire" devices are used to integrate legacy equipment or microgrid devices that cannot perform cryptographic operations required by secure communications networks. The bump-in-the-wire devices have the ability to encrypt communications using standard protocols. They also provide cryptographic isolation of the networks.In the SNAPE architecture, OLE for Process Control -Unified Architecture (OPC UA) is used to implement the communications backbone. OPC UA is backward compatible with distributed control system protocols such as IEC 61850. OPC UA provides authentication and authorization services at the application layer. Availability in a network is provided by two mechanisms. First, the isolation of the control network from external networks ensures that the control network communications can meet the low latency requirement and critical infrastructure components are not unavailable due to large latencies or disruptions caused by microgrid components being out of sync. Second, cryptographic protection of messages and the network, as well as network firewalls, ensure that attackers cannot compromise the network or launch denialof-service attacks against network components. It is important to emphasize