ESIF and Security at the Edge of Smart Grids

I attended the NREL ESIF Cybersecurity Workshop last month. ESIF names the Energy Systems Integration Facility. The workshop demonstrated both what should be done to secure future energy systems, and how difficult, labor intensive, and non-scalable this is using standard practice.

The first morning showed off the ESIF’s model of how to secure the un-securable. Using a rat’s nest of proprietary products, all communications to and from every sensor were firewalled and only specific interactions enabled. No messages were encrypted so every message could be inspected for appropriateness. The security infrastructure was itself secured and logged.

The rest of the conference aimed at specific interoperable approaches to accomplish the goals of securing Operational Technology or OT.

Part of the problem with securing OT is a fundamentally outmoded approach to operation. At a time when computing was expensive, phone lines cheap, and data logging infrequent, a model developed of putting every sensor and every actuator directly connected to a single computer. This model has long been named SCADA (Supervisory Control and Data Acquisition).

Two things happened to break the SCADA model. Phone companies moved out of the business of providing actual wires to connect sites, and moved toward shared networks. SCADA systems have never been fully secure in shared networks. Systems became more complex, and required faster response. In power distribution, this is due to a combination smaller operating margins (excess power available at every moment), more systems to control, including smart meters, and the arrival of distributed energy resources (DER).

As we move further into DER, we will see more diversity in ownership and in technology.

An owner of an expensive power production or storage system in a microgrid will want to operate it for their own benefit. As sophisticated owners add their own local monitoring and control software, they will begin to see how often remote operators mis-operate the locally-owned equipment, increasing maintenance requirements while shortening its life.

Distributed ownership and operation will also move toward diverse technology. A local owner will make his own investment decisions, and a remote operator such as a distribution utility may not know how to operate it. From the earliest efforts by utilities to tell owners operate buildings, following the energy price shocks of 1973, we have seen smart people forget that the primary purpose of a building system is not to provide managed load. (Consider the role of energy “efficiency” recommendations that did not consider health implications of short cycling HVAC in a Philadelphia Hotel in 1976).

The future of smart grids is on the edge, in autonomous systems that are built around a deep understanding of each buildings role and services. Edge based-operation offers both challenges and benefits to security. Incorporating systems with different ownership, and operated for different purposes makes security more complex. For now, regulatory mandates require that utilities still maintain detailed situation awareness into edge-based microgrids. Abstract interactions, including those based on the common transactive services, simplify security while reducing the attack surface. We will be rebalancing this border continually over the next decade.

The solution is abstract interactions between autonomous systems that can be locally operated and maintained. In power markets, this means that systems can negotiate whether to provide power or not, or to purchase power or not, while the inner workings of each system remain private. The interaction between the grid and a wind farm that occasionally sells power to the grid and a district associate that never buys power but occasionally sells it should be identical. Large system integration relies on integration using abstract communications, that is, the exchange of information that does not change often. Fragile or concrete information, such as the specific internal operations that are directly affected by changes in technology or equipment, are kept internal to the systems. This approach to integration is characterized as an “anti-fragile pattern”.

Until we reduce the attack surface, how will we increase security while increasing interaction? The ESIF security model requires too much hand-work, and does not support multiple ownership.

The Security Fabric Alliance has spent four years defining a more forward looking approach within the Object Management Group (OMG). OMG specifications are cookbooks for interoperable implementations of complex combinations of specifications by multiple vendors. The OMG Security Fabric, due out in February in 2018, incorporates best practices in military telemetry with directory-enabled security. Any communications must mutually authenticate before exchanging information. Despite this requirement, the Security Fabric has already been demonstrated in synchrophasor telemetry, a high volume, high frequency application. I look to the Fabric appearing in microgrids at the edge soon after its initial release.

Other efforts incorporate technologies to reduce wide area communications requirements and the effort to require detailed point-to-point security. Blockchain-style distributed immutable databases will replaces some requirements for remote data harvesting, and perhaps move into directory services to support security and policy. Edge-based Artificial Intelligence (AI) will reduce the manual set-up required for point-to-point and message-content based rules. I hope to write about these approaches later.

Architectural Principals of Transactive Energy

This post is part of the continuing Paths to Transactive Energy series. You can find them all listed by clicking on the matching metatag at the bottom of each post.

Transactive energy describes a pattern of integration where parties exchange the value or a commodity resource [power] over time and make forward commitments to sell or purchase that commodity. The Common Transactive Services (CTS) can be used in central auction-type systems, where a single entity announces or broadcasts prices or in markets were two or more parties come to a mutual agreement on price and delivery.

All forward transactions are committed, that is one party commits to delivering the service or commodity, one commits to buying it. If a provider wishes not to deliver, or if a purchaser wishes not to take delivery, they can participate in a separate negotiation, with a separate price, that can be netted against the original committed transaction. Such a buy-back resembles today’s Demand Response.

If one purchaser wishes to acquire more power at the last minute, and one wishes to acquire less, they can negotiate an exchange on the spot market. Different market structures and market rules will change the format, but not the substance of this transaction.

The CTS are essentially identical for any commodity resource or service. CTS works for transmission rights and ancillary services, as well as for other resource markets such as transactive water or transactive thermal markets. In each case, the product is delivery of the commodity at the designated time at the designated rate.

The CTS can work in many market structures. CTS can be used with a single (for the microgrid / micromarket) brokered trading floor or with peer-to-peer transactions. Compound transactions can link multiple simple transactions, such as paired transmission and delivery. Different circumstances will work best with different market structures, but in all cases, the communications can use the CTS.

1. Each party represents a node that acts in its own interests to support its own purposes.
2. The internal mechanisms and systems of a node are not communicated as part of the CTS.
3. The system of systems that make up a node may choose to organize some or part of their internal operations using transactive energy / transactive agents.
4. Actors inside a node interact with the internal market, not the external; there is no direct market interaction with things / markets / prices external to the node.
5. The purpose of an transactive node is to support the purposes of its owners and occupants, and not to support the things outside the node.
6. Economic signals or availability from outside the node might influence the market, if any, inside the node, but only as the market interface on the node relays that information. This may include markups, smoothing, discounts or any other means or mechanism that the owner of the node chooses to use (or that the maker of the system that operates the node chooses to use so that the owner of the node box will choose that system).
7. Parties external to the node should not use the possible existence of an economic entity inside the box as an excuse to penetrate the veil of the black box.

Fractal Energy: Galvin Perfect Power Updated

This post is part of the continuing Paths to Transactive Energy series. You can find them all listed by clicking on the matching metatag at the bottom of each post.

One of the most influential insights into smart energy was defined by Robert Galvin in his vision for Perfect Power. Perfect Power turned the vision for the grid upside down, with each facility and each home responsible for its own power, acting as microgrids. These building-based microgrids would interact with their nearby peers, to gain resilience in operation and quality of supply across a neighborhood. Groups of neighborhoods would then interact at a larger scale. The Galvin Project promulgated the vision of Perfect Power, reliable, efficient, without single points of failure—and eventually the best way to incorporate distributed energy resources (DER) into the power supply.

The Galvin Perfect Power Model was abstracted into fractal microgrids, and demonstrated in the Camp Pendleton Fractal Microgrid Project. Fractal patterns are self-referential and self-similar.

A fractal system is one in which each part of has the same statistical character as the whole. Fractals are useful in modeling structures in which similar patterns recur at progressively smaller scales, and in describing partly random or chaotic phenomena such as crystal growth, fluid turbulence, and galaxy formation. In biological systems, simple genetic rules can create complex systems through re-application of simple genetic processes. There are no inherent limits to scaling fractal patterns up or scaling them down.

Transactive microgrids abstract complex components into self-similar systems that interact through common patterns of economic competition for resources. Whether the smallest system or the largest aggregate of systems that consumes, generates, or stores power, common interaction patterns define how each interacts with its peers.

Within each system of systems, these interaction patterns support efficient allocation and coordination of energy use within and among the smallest systems to create larger system or microgrid. These microgrids act as components that allocate and coordinate of energy use within and among their peers to operate still more complex systems. At each level, complexity and diversity, diversity of technology, of purpose, and of mission, is contained locally and managed locally.

Fractal system integration is inherently resilient. Systems command and control is managed locally, and only the information necessary to exchange services is shared. New systems can be integrated as components without increasing overall complexity. Larger systems can respond to degraded or damaged components by creating new spontaneous order.

Each node interacts with its peer nodes only in terms of the services, buying and supplying energy, consuming or curtailing use, and not in terms of process. Inside the box, which might be the BAS, is an algorithm or many that is outside the scope of the service interactions.

More than a decade ago, there was discussion on the smart toaster, the theoretical minimal system that could interact with the smart grid. Prices to devices was often discussed. The notion is that the grid does not need or want to understand a toaster, but only the toaster’s use or non-use of energy over a load curve. Transactive Energy, expressed as what we now call the common transactive services, defines the interaction patterns between systems that buy and sell power over time.

In this model, each integration, each customer gets to decide when transactive services stops and more traditional integration begins. So long as a system can participate in the containing grid with the common transactive services, the contents of the system are a black box; internal technology and algorithm are out of scope.

The Common Transactive Services (CTS) simplify define the interactions between and system and the microgrid it is participating in. CTS handles resources other than power, such as transport costs, congestion management, and ancillary services. Only the scale facto changes as we move up and down the fractal.

IOT Apps and Competition for Resources in Seattle

Tomorrow, I am talking about a Resource Framework for the Internet of Things (IoT) at the summit of the AllSeen Alliance.

Traditional consumer programming has concerned itself with only a few resources, i.e., RAM (memory), storage (disk space), and communication (network speed). These programs live atop operating systems and device drivers that engage directly with physical things.

Third-wave Apps in the IoT, though, deal directly with resources. The second wave of the IoT, what I call the Internet of Sensors, may measure resources, but Apps are not competing for resources except, perhaps, bandwidth to report them. Two measurements of air temperature do not compete. And one does not “use up” the temperature that the other one wants.

Third-wave IoT Apps do things, and can only do things to the extent that have access to resources. Resources may be electrical power or heat or water or water pressure, or anything that the systems controlled by an App need to support their purposes.

Some resources exist as a fixed pool that is then drained over time. Other resources may have a steady supply over time. As other IoT Apps require the same resources, the size of the pool varies not by the schedule of its own ebb and flow (think power provided by Solar PV), but the supply changes as other Apps consume the same resources, or perhaps can even be induced to supply more of that resource. Resource availability, the net of supply and demand, is always changing over time.

With a predictable budget for a given resource at any moment in time, Apps must avoid interfering with each other. Sometime this is a competition, but often it may be as simple as avoiding the time that other Apps are using the same resource. Two Apps that use the same resource at the same time may both fail if there is a shortage of resources adequate for simultaneous operation. This is a problem of a moment in time. If one can delay its operation, or the other can accelerate its operation, they may be able to perform all functions, to get access to all of the resource each needs, by simply avoiding each other.

Traditional solutions to this problem posit a master controller, a single controlling program that understands each application and its needs. This works best when all systems and apps are provided by the same manufacturer, and the systems work together as slaves do: on command, as directed, and interchangeably.

With a resource framework, we hope to define a framework within which Apps in the same space can negotiate for resources over time. We can use the specifications built for Smart Energy, to negotiate power use and supply, for other commodities as well.