Sandia National Laboratories Framework for Power System Communication Security
Power grid cybersecurity requires layered defenses — no single technology (firewall, encryption, IDS) protects against all threats. Sandia National Laboratories has developed a defense-in-depth architecture based on the Purdue Model and IEC 62443 zones & conduits, validated across utility SCADA, microgrids, and distributed energy resources (DERs). This page synthesizes Sandia's key publications (2014–2024) into a 7-layer security framework applicable to village-scale energy systems.
Village microgrids sit at the grid edge — historically unmonitored, now communication-enabled for prepaid metering, remote control, and utility interconnection (IEEE 2030.5). Each new protocol (DLMS, Modbus, MQTT, TLS) expands the attack surface. Sandia's framework shows how to layer physical security (Phase 1–2) with network security (Phase 3) without over-engineering or breaking the budget. Security is not binary — it's a graded approach matched to threat, value, and operational phase.
The Purdue Model separates control systems into 6 functional levels (0–5), from field sensors to enterprise IT. IEC 62443 adds security zones (logical/physical grouping of assets with common security requirements) and conduits (controlled channels between zones). Sandia applies this to grid: meters/inverters (L0-1), SCADA/DCU (L2), microgrid EMS (L3), enterprise/cloud (L4+).
Defense-in-depth principle: Attacker must breach multiple zones to reach critical control systems. If enterprise network (L4) compromised, industrial DMZ prevents lateral movement to SCADA (L2). If meter (L0) compromised, conduit firewall prevents attack spreading to DCU (L2).
Scope: Smart inverters, revenue meters, RTUs, battery management systems (Purdue L0-1)
Technologies: TLS 1.2+ mutual auth, X.509 certificates, firmware signing, secure boot, physical tamper detection
Village context: Phase 3 — IEEE 2030.5 mandates device certs for utility interconnection. Phase 1–2 — physical locks, tamper seals often sufficient if air-gapped.
Scope: OT networks connecting meters, DCUs, SCADA HMI (Purdue L2)
Technologies: VLAN segmentation, isolated RS-485/Modbus RTU, encrypted DLMS, protocol-aware firewalls
Village context: Village gateway (NSR Stellar Edge, ThunderCloud) = network chokepoint. All meter/inverter traffic passes through — enforce policy here.
Scope: Boundary between OT (control) and IT (enterprise/internet) networks
Technologies: Firewall, unidirectional gateway, data diode, jump host for admin access
Village context: Separates village LAN from cellular backhaul. Allows MQTT telemetry out, blocks inbound commands except via VPN/authenticated channel.
Scope: Encryption, authentication, integrity for data in transit
Technologies: TLS 1.2+, mutual TLS (mTLS), HTTPS, MQTT over TLS, SSH, IPsec VPN
Village context: Required for IEEE 2030.5 (utility DERMS), vendor cloud APIs, mobile money integrations. Optional for village-internal if physically secured.
Scope: Monitoring for malicious or anomalous activity, automated/manual mitigation
Technologies: Network IDS (Snort, Zeek), cyber-physical correlation (PIDMS), SIEM, ML-based anomaly detection
Village context: Gateway-based IDS monitors Modbus commands + feeder voltage/frequency. Alert on disconnect command during normal load, voltage manipulation, firmware update from unknown source.
Scope: Identity-based access control, "never trust, always verify"
Technologies: Software-Defined Networking (SDN), Security Group Tags (TrustSec), virtual chambers, dynamic VLAN assignment
Village context: Phase 3 — when multiple vendors/aggregators access same microgrid EMS. Phase 1–2 — defer (complexity/cost not justified for single-operator systems).
Scope: Prevent unauthorized physical access, hardware tampering, malicious firmware
Technologies: Locked enclosures, secure conduits, tamper seals, signed firmware, vendor trust verification
Village context: Primary defense for Phase 1–2 — cheaper and simpler than network security for air-gapped systems. Locked meter boxes, pole access control, feeder tap detection.
Five-year strategic plan for DER cybersecurity. Defines roles for vendors, utilities, standards bodies, and government. Covers stakeholder engagement, R&D priorities, standards development, and industry best practices. Essential starting point for understanding PV/DER security ecosystem.
Deep analysis of IEEE 2030.5 and California Smart Inverter Profile (CSIP) security requirements. Covers TLS 1.2 mutual auth, X.509 certificate lifecycle (provisioning, renewal, revocation), lFDI device identification, IoT-scale key management challenges, and alternative approaches (DTLS, NDN). Critical for IEEE 2030.5 implementations.
Accessible introduction to cybersecurity for non-experts. Establishes common taxonomy. Explains basic cryptography, communication protocols (IEEE 2030.5, Modbus, DNP3), and device/aggregator/utility-level best practices. Written for field engineers, not security researchers.
Argues for standalone cryptographic module (hardware security module or isolated firmware) to prevent implementation flaws in DER devices. Separates key storage from control logic. Discusses FIPS 140-2/3 compliance for utilities requiring certified crypto. Addresses IEEE 2030.5 Rule 21 requirements.
Bump-in-the-wire (BITW) intrusion detection device for smart inverter communications. Analyzes both network traffic (DNP3, Modbus) and physical power measurements (voltage, frequency, power) using machine learning. Detects cyber-physical attacks by correlating network commands with actual inverter behavior. MQTT peer-to-peer communication for distributed alerting. Tested in OPAL-RT hardware-in-the-loop environment.
Foundational document mapping TCP/IP protocol stack security to microgrid control networks. Covers application layer (Modbus, DNP3, HTTP), transport layer (TCP, UDP), network layer (IP), and link layer protocols. Recommends TLS/SSL "at any layer" for encryption. Explains control system network vs enterprise network separation using industrial DMZ.
Real-world application of Purdue Model + IEC 62443 to networked microgrid (NJ Transit rail system). Segments vehicle charging, solar PV, battery storage into protected OT enclaves separated from enterprise IT by industrial DMZ. Deploys intrusion detection (Snort, Zeek) and response tools. Shows how to apply zones & conduits in practice with network diagrams, firewall rules, and chokepoint design.
The TRANSITGRID report (above) covers industrial DMZ design. The Trust and Encryption report (Layer 1 section) covers TLS 1.2 application-layer security for IEEE 2030.5. For in-depth TLS protocol mechanics, see TLS 1.2 deep-dive page.
Proposes 3-tier sensor architecture for cross-domain data sharing: local (device-level), enclave (substation/microgrid), global (utility-wide). Explores next-generation communication technologies: Named Data Networking (NDN), Software-Defined Networking (SDN), Wi-Fi 6. Discusses privacy-preserving aggregation, anonymization, and distributed AI/ML at the edge. Mnemosyne Logger for high-throughput, resilient event logging over NDN.
The PIDMS report (Layer 1 section above) is also core Layer 5 research — demonstrates cyber-physical event correlation for intrusion detection.
Investigated SDN (OpenFlow controllers) for dynamic VLAN assignment and microsegmentation in DER networks. Explored trust-based policy enforcement where device network access changes based on behavior (e.g., failed auth attempts trigger quarantine VLAN). Practical deployment at Sandia Distributed Energy Technologies Laboratory. Aligned with Cisco TrustSec Security Group Tagging used in TRANSITGRID.
Defines security zones with physical boundaries (locked cabinets, secure cable conduits, hardened walls) and logical boundaries (VLANs, firewalls). Explains chokepoints — force all traffic through monitored entry control point (e.g., single firewall to enter critical zone). Graded approach: assign security levels to zones based on function criticality. Defense-in-depth: systems with redundant functions placed in separate zones so attacker must compromise multiple zones to achieve goal.
Uses game-theoretic modeling to determine optimal zone placement for critical digital assets. Performance-based design: simulate attacker strategies, measure defender win rate with different zone configurations. Example: cameras and fence sensors in separate zones (redundant physical security functions) vs single zone (both compromised together). Validates DCSA principles with quantitative analysis.
Applying Sandia's 7-layer framework to ISV Phase 1–2 deployment (50–500 connections, prepaid metering, no utility interconnection yet):
| Security Layer | Technology | ISV Phase 1–2 Implementation | ISV Phase 3 Addition (Utility Interconnect) |
|---|---|---|---|
| L1: Device | Physical tamper detection, firmware signing | Locked meter boxes, tamper seals on revenue meters. Signed firmware updates from DCU. | + IEEE 2030.5 device certificates (mutual TLS), lFDI registration with utility DERMS |
| L2: Network | VLAN segmentation, protocol-aware firewall | Village gateway = chokepoint. All DLMS/Modbus traffic passes through. Air-gapped from internet if no remote monitoring. | + Segmented VLANs: meters (VLAN 10), inverters (VLAN 20), EMS (VLAN 30). Firewall rules between. |
| L3: Industrial DMZ | Firewall, unidirectional gateway, VPN | If cellular backhaul for telemetry: firewall allows MQTT out, blocks inbound except VPN for admin. | + Data diode for one-way telemetry to utility SCADA. Separate IEEE 2030.5 conduit with mutual TLS + cert validation. |
| L4: Transport/App | TLS 1.2+, MQTT over TLS, HTTPS | Optional — TLS overhead not justified if physically secured. Plaintext MQTT / HTTP to local gateway acceptable. | + Mandatory TLS 1.2 for IEEE 2030.5 (utility), HTTPS for vendor cloud APIs, SSH for remote admin. |
| L5: Intrusion Detection | Network IDS, cyber-physical correlation | Gateway-based: monitor Modbus commands + feeder voltage/frequency. Alert on disconnect during high load, firmware update from unknown IP. | + PIDMS-style device at IEEE 2030.5 conduit. ML anomaly detection on DERMS commands vs grid state. |
| L6: Zero Trust | SDN, microsegmentation, identity-based access | Defer — complexity/cost not justified for single-operator village. | + Relevant if multiple aggregators/vendors access EMS. Dynamic VLAN assignment per user role. |
| L7: Physical | Locked enclosures, pole access control | Primary defense. Locked DCU cabinet, pole-mounted equipment caged, feeder tap detection via CT anomaly. | + Same. Physical security never optional — always Layer 7 even with network defenses. |
For village-internal systems (no internet exposure, no utility control), physical security (Layer 7) + basic network segmentation (Layer 2) are sufficient. TLS, mTLS, IDS, Zero Trust are Phase 3 concerns driven by utility interconnection requirements (IEEE 2030.5, NERC CIP). Don't over-engineer — budget and training capacity are finite. A locked meter box prevents more theft than an IDS that nobody monitors.