CVSS Based Attack Analysis Using a Graphical Security Model: Review and Smart Grid Case Study

PP–GSM: Privacy-preserving graphical security model for security assessment as a service

The conventional power grid has gone into transition and converted into what is called "smart grid The smart grid helps to bring reliability, monitoring, controllability, and efficiency. It provides a bidirectional flow of energy and communication. The major element of the smart grid is the communication networks. The smart grid system is comprised of different types of smart devices and heterogeneous networks. These communication networks are prone to many kinds of attacks such as Distributed Denial of Service (DDoS), Man In The Middle (MITM) and replay attacks. As a result, the smart grid is becoming a major target for cybercriminals. In this paper, the vulnerabilities and security issues exist in the smart grid are presented. Finally, the solutions for mitigating the attacks are discussed. It provides an overview of security issues present in the communication system in the smart grid. With this paper, readers can gain more understanding of security issues present in the smart grid communication systems, networks, and devices.

It is technically challenging to conduct a security analysis of a dynamic network, due to the lack of methods and techniques to capture different security postures as the network changes. Graphical Security Models (e.g., Attack Graph) are used to assess the security of network systems, but it typically captures a snapshot of a network state to carry out the security analysis. To address this issue, we propose a new Graphical Security Model named Time-independent Hierarchical Attack Representation Model (Ti-HARM) that captures security of multiple network states by taking into account the time duration of each network state and the visibility of network components (e.g., hosts, edges) in each state. By incorporating the changes, we can analyse the security of dynamic networks taking into account all the threats appearing in different network states. Our experimental results show that the Ti-HARM can effectively capture and assess the security of dynamic networks which were not possible using existing graphical security models.

Nowadays electricity is one of the most significant requirements and base of life facilities. Any interruption in supplying and providing power, like widespread blackouts will cause irreparable effects on different aspects of a society. Technology increasing progress provides remote control and monitoring of power grid through the supervisory control and data acquisition (SCADA) system and substation automation which decreases the costs of power transition and control, increases the efficiency and motivates to smart grid. These kinds of technologies create new opportunities to remote monitoring and control of the power substations and equipment for the regional electricity companies. Some of these achievements have been used before but modern systems provide more facilities in operation and maintenance of power system. It is noticeable that this opportunity may convert to threat if cyber security encounters with lack of attention in the smart grid. Therefore, providing sensitive and secure equipment is one of most significant and vital problems to increase the cyber safety and decrease cyber-attack risk in the smart grid. Therefore the facilities equipment, their risks and vulnerabilities should be detected and appropriate methods should be propounded to encounter with these problems. In this paper, substructures of smart grids are firstly discussed. After this introduction, threats, risks and security requirements will be considered in the smart grid. In the following, different types of cyber-attacks and the best architectural and security strategies will be offered.

With the rapid development of national economy, our demand for power resources has also increased rapidly. The traditional power grid can not be achieved operational status of equipment for effective monitoring and control, we will not be able to ensure the quality and quality of electricity service. Cloudbased build smart grid information platform enables gathering the parameter of grid operation state, greatly increasing the economic efficiency of power enterprises. Firstly, cloud computing and smart grid briefly described, and then pointed out that cloud computing applications in the smart grid information platform, and specialized of cloud-based smart grid information platform, in order for the power grid enterprises to enhance their level of service and provide effective reference. KEYWORD: cloud computing; smart power grids; information platform; Application 4th International Conference on Mechanical Materials and Manufacturing Engineering (MMME 2016) © 2016. The authors Published by Atlantis Press 202 3 THE MAIN PROBLEM IS STILL THE SMART GRID INFORMATION PLATFORM FACING The transition to a cloud computing data center. Our data center because of the different regions and the degree of information presents different characteristics, some data centers already have a basic cloud computing capabilities, but most data centers still remain in the initial level, to ensure the normal operation of the existing data center power under the premise, gradual transition to cloud computing data center in order to meet future requirements of the development of smart grid. Restricting data transmission problem. State Grid Corporation between provincial branches and there are a lot of data needs to be transmitted, will bring massive data transmission efficiency decreases, taking into account the load balancing device between the cloud node, thus building a wide area network channels to resolve data transmission problem. Security of data transmission. Data Center for Cloud Computing power companies to build internal private cloud, capable of self-maintenance and management, system wide area network data transmission services, according to the third security zone defined security partition, and install proprietary equipment production area and external public network isolation . 4 CLOUD COMPUTING APPLICATIONS IN THE SMART GRID INFORMATION POLICY PLATFORM Integrate and optimize the management of heterogeneous resources. Among the smart grid systems, data resources, information systems between various platforms and mutually dispersed, severe heterogeneity, thus leading to the integration of the quality of information sharing to increase difficulty, unable to effectively improve network management efficiency for the power distribution system electrical work quality management and marketing operations system maintenance upgrade will not be able to effectively meet demand (Jie Yang, 2014). Cloud computing technology enables the power system to effectively integrate the various business data and computing resources on the basis of information for business collaboration platform built on effective, able to satisfy the huge demand for smart grid information resource sharing. Cloud computing network virtualization and application virtualization technology, the server virtualization technology and other resources to achieve each service abstraction, and then realize the difference between the system and the software effectively eliminated by the appropriate method to achieve the effective integration of information resources, and then to optimize the management, greatly improving the efficiency of heterogeneous resources management applications. Distributed storage and management of large volume of data. After application of smart grid information platform construction, customer service requests varied, huge data volume information brought it to the storage and management of data provides a great challenge. Cloud computing technology in general face amount of data each smart grid system and unit collected using forms distributed storage of data to achieve the effective storage, greatly to ensure the security and reliability of data storage. GFS effective use of technology with each node, the master server is responsible for the effective management of the whole file system, the file system and complete the work of the metadata stored in the data block is the main server for data storage block sliced, and by saving three or more redundant backup storage. At the same time, client access and complete access to the main block server information. Fast Power System Parallel Computation and Treatment. Smart grids and information platform for the large volume of data to provide stable operation of the power grid data base, but more critical is the analysis and design of each system operating data, planning and decision-making, and even failures and transient stability, state estimation and intelligent a variety of computing and content analysis and decision-making process, its huge computing needs, general computing system can not reach its goal (Wang, Mengxue, 2015). Cloud computing technology through parallel computing technology has greatly enhanced parallel processing capability of the power system, which provides parallel programming model makes more simple and efficient parallel algorithms. MapReduce as Google made an important parallel programming model, and its role in large data sets in parallel computing plays a very prominent. Parallel processing job results by the client to achieve effective user submitted, via decomposition automated master role, the corresponding task scheduling to working nodes and nodes work completed by the specific calculations and perform the appropriate task. 5 SMART GRID INFORMATION PLATFORM CLOUD COMPUTING ANALYSIS Cloud Computing Smart Grid Information Platform Architecture. Smart grid technology information platform architecture cloud computing include the following several levels and aspects (Yan Cui, 2015): First, that the platform infrastructure layer is the integration of the various hardware resources and related management capabilities of virtualized using virtual technology to achieve the corresponding hardware devices such as computers and network storage devices abstraction, and then complete the automation and optimization of resource data and load management; secondly, the main platform for the integration of the various layers of software

It is important to assess the cost benefits of IT security investments. Typically, this is done by manual risk assessment process. In this paper, we propose an approach to automate this using graphical security models (GSMs). GSMs have been used to assess the security of networked systems using various security metrics. Most of the existing GSMs assumed that networks are static, however, modern networks (e.g., Cloud and Software Defined Networking) are dynamic with changes. Thus, it is important to develop an approach that takes into account the dynamic aspects of networks. To this end, we automate security investments analysis of dynamic networks using a GSM named Temporal-Hierarchical Attack Representation Model (T-HARM) in order to automatically evaluate the security investments and their effectiveness for a given period of time. We demonstrate our approach via simulations.

An efficient dependable smart power grid relies on the secure real-time data collection and transmission service provided by a monitoring system. In such a system, the measuring units, such as phasor measurement units (PMUs) and smart meters (SMs), are critical. These measuring equipments function as sensors in the smart grid. Data exchanges between these sensors and the central controller are protected by various security protocols. These protocols usually contain computationally intensive cryptographic algorithms that cause heavy energy overhead to the sensor nodes. Since PMUs and SMs are mostly energy-constrained, the problem of how to ensure the secure communication with minimum energy cost becomes a critical issue for the functionality of the whole smart grid. In this article, we focus on the low power secure communication of the PMUs and SMs. We take two wireless sensor platforms as examples to experimentally investigate the approaches and principles of reconciling the two conflicting system requirements-communication security and low energy consumptions. The proposed methods are general ones and applicable to other energy-constrained yet security sensitive systems.

Smart Grid is referred as next generation power system, and considered new revolutionary changes in existing traditional power system. Information Communication and Technologies (ICT) Integration in power grid enhance efficiency and reliability of future power systems. Power sector requires a secure distributed intelligence and customer demand based response along with an effective reusability of renewable energy resources. Despite, many silent features of Smart Grid, cyber attack risks are threatening the smart grid security. Malicious activities could be harm smart meters in distributed system and take out the power system in simulated attacks. Cyber attacks against Critical Infrastructures, like as Smart Grids, are especially dangerous, because they are tailored to disrupt assets, which are essential to the functioning of the society as whole. Critical Infrastructure sectors include Transportation, Communication and Technology utilities. Among these, the power system is possibly most critical, due to its strong dependency of all other Critical Infrastructures and involvement of Information Communication and Technology. In this paper, we illustrate introduction of smart grid, cyber attack. Current smart grid scenario in India and other countries in section I section II includes related work of cyber security and standard for smart grid while section III illustrated risk assessment, section IV elaborated proposed risk assessment framework and in last we conclude and describe further scope in this field paper in section V

SUMMARY This paper discusses optimal energy management considering battery characteristics for smart grid and microgrid systems. Energy storage systems are very important for energy peak shifting and peak load cutting in microgrid and smart grid systems, but optimal battery formulation and energy management in the use of expensive energy storage system and methods of taking account of battery characteristics are still in the developmental stage. First, the optimal battery placement for a smart grid system with lithium-ion batteries is considered as a means of lifetime extension. The battery choice index for this optimal battery utilization problem of optimal energy management is discussed. Second, a smart grid system with a distributed battery system for grid frequency control with consideration of distributed control and battery characteristics is discussed. Optimal controllers for distributed battery systems to reduce the battery load and to expend the battery lifetime are designed. Simulations are used to demonstrate the effectiveness of the proposed method in comparison with conventional methods.

A systematic review of environmental and economic impacts of smart grids

Current power grid and market development, characterized by large growth of distributed energy sources in recent years, especially in Europa, are according energy storage systems an increasingly larger field of implementation. Existing storage technologies, e.g. pumped-storage power plants, have to be upgraded and extended by new but not yet commercially viable technologies (e.g. batteries or adiabatic compressed air energy storage) that meet expected demands. Optimal sizing of storage systems and technically and economically optimal operating strategies are the major challenges to the integration of such systems in the future smart grid. This paper surveys firstly the literature on the latest niche applications. Then, potential new use case and operating scenarios for energy storage systems in smart grids, which have been field tested, are presented and discussed and subsequently assessed technically and economically.

WSNs (Wireless Sensor Networks) have been considered one of the very promising technologies for the implementation of smart grid. And security of WSNs becomes a central concern. The security solutions for generic wireless sensor networks cannot be directly used in smart grid WSNs. In this paper, the applications of sensor networks in electric power systems are discussed and analyzed first. Then, the characteristics of smart grid WSNs are summarized. Threats and security requirements special for wireless sensor networks used in smart grid systems are presented. Based on these works, reference security architecture was proposed to guide the development and the design of the security solutions of wireless sensor networks in smart grid systems, considering the information security requirements of electric power systems. Moreover, open security issues needed solve to protect WSNs applied in smart grid, and research challenges are introduced.

Cyber-physical systems (CPS) are aimed at combining the physical system with the cyber ones to provide a better control and improve the management of physical systems around us. Recently, the CPS and its applications, e.g., health-care and smart grid, have gained attention of the research community. In this paper, we consider the privacy aspect of users in a CPS, particularly in smart grid system as our use-case, and provide a mechanism that utilizes the advances in network coding to maintain data privacy. We address privacy issues associated with gathering metering information of clients in a smart grid system. In smart grid systems, wireless multi-hop communications are mainly used to gather metering information through exchanging data and control messages between smart meters and the utility. We argue that any communication paradigm used in a smart grid should support all aspects of privacy such as anonymity, unlinkability, unobservablity, and undetectablity. We propose innovative schemes for traffic routing and encryption that benefit from the enhanced network coding technology. Our analysis shows that our schemes maintain privacy of users despite the possibility of detecting metering data by an adversary. In addition, our scheme has extra favorable features such as less computation complexity, reliable, and robust communication.

Most of today's infrastructure systems can be efficiently operated thanks to the intelligent power supply of the smart grids. However, smart grids are highly vulnerable to malicious attacks, that is, because of the interplay between the components in the smart grids, the failure of some critical components may result in the cascading failure and breakdown of the whole system. Therefore, the question of how to identify the most critical components to protect the smart grid system is the first challenge to operators. To enable the system's robustness, there has been a lot of effort aimed at the system analysis, designing new architectures, and proposing new algorithms. However, these works mainly introduce different ranking methods for link (transmission line) or node (station) identification and directly select most the highest degree nodes or common links as the critical ones. These methods fail to address the problem of interdependencies between components nor consider the role of users that is one of critical factors impacting on the smart grid vulnerability assessment. This motivates us to study a more general and practical problem in terms of smart grid vulnerability assessment, namely the Maximum-Impact through Critical-Line with Limited Budget (MICLLB) problem. The objective of this research is to provide an efficient method to identify critical components in the system by considering a realistic attack scenario.

In smart power grid systems, real-time electricity data sharing can bring many benefits. However the security and privacy challenges have been a concern. This is because shared data may contain some private and sensitive information of data owners or users. So it has been an important issue to balance data utilization, data privacy and users privacy. Privacy-preserving multi-authority attribute-based encryption (MA-ABE) is a promising tool to tackle this issue, but it cannot be directly applied to addressed scenario of smart power grid systems. In this paper, we propose a framework to achieve secure data sharing in smart grid. The scheme uses the technique of inner product encryption (IPE). Under this framework, the access policy and the attribute set are fuzzy by converting them into two vectors. Only when the two vectors are orthogonal, users can successfully obtain the sharing data. Besides, our scheme allows that the threshold access policy only involves attribute name indexes, and sensitive attribute values are not sent along with the shared data so the attribute privacy is preserved. In addition, in order to improve efficiency, our scheme adds a testing phase to avoid the unnecessary operation before recovering data. Finally, our performance analysis and experiments confirm the merits of the proposed framework.