Cyber Security in Energy Distribution System

Today‟s challenge: Presently Power industry (Generation, Transmission and Distribution) in India is going through huge losses. Commercial losses in 2010-11 in Energy Distribution sector were of the order of Rs. 60223 cr. annum. These losses are mainly due to Transmission & Distribution Losses, Peak Demand Load Management, along with revenue collection loss for consumed energy. Major challenge as on date is to bringing Operational and Commercial improvements. Tomorrows challenge: Integration and monitoring of tomorrow‘s energy generation (like, Solar: Roof Top Solar power generation) and storage sources (Automotive: Introduction of Plug in Hybrid Vehicles, storage batteries) with existing infrastructure Steps taken by Ministry of Power (MoP) -Indian Government: Realizing the importance of technology in improving the operational, commercial performance of the sector and to avoid blackout like conditions, MoP has constituted the Indian Smart Grid Task Force (ISTF) in 2010 chaired by Mr. Sam Pitroda, an advisor to Prime Minister of India. ISTF further carve up into 5 Working Groups viz. WG1-5. In parallel Ministry of Power (MoP), has released, its draft, An Smart Grid Vision and roadmap for India in Aug 2013. Accordance to it, all electricity meters will be converted into smart meter end point, in phase-wise manner. These smart meters, can transmit the consumption details, in real time using data communication technologies. This is a mammoth task considering the number of endpoints (Energy consumption point) in India, which has variation in geographical area, demography & usage pattern. And above all, it involves a huge investment in terms of Time & Money.

1. Timely and correct data collection, from end points in real time, at centralized place to help in improving Commercial challenges 2. Centralized real time control, for the electricity supply, till every end point, to help in improving Operational challenges 3. Introduction of New cutting edge Technologies may bring significant set of unprecedented challenges

Indian electricity distribution system at present is divided into 2 groups Central Grid (Integrated Northern, Eastern, and Western and North Eastern regional grid) and Southern Grid. Work to synchronize both the grids in to one is in progress. With the integration of two grids, optimal utilization and trading of power will happen, by transfer of power from resource centric region to load centric region. Every state has one or more distribution companies based of geographical needs, which are trading electricity from generation sources either from within the state or from outside the state. In the whole process of Transmission & Distribution (T&D), Losses are happening which were at (21%-25.7%) at all India level in 2009-10, in which Pondicherry at lowest (13.5%) and J&K at highest (63.0%). World average is just above 8% for same period. There are two major reasons of high T&D losses in India: Technical: Due to poor infrastructure, poor planning for rural electrification, Improper Load Management. Commercial: Due to electricity theft (tapping the wires, tampering the electricity meter and accounting systems) and unmetered supply, street lights. Main reason of estimation mistakes in T&D losses is unmetered supply as it is difficult to quantify that. Peak demand load management is another challenge. During peak load, India has shortage of around 10.3%. There are only two solutions as on date, Load shedding or purchase of electricity at very high price, which may not be available most of the time. As during non-peak hours also India has shortage of supply so peak demand management can‘t be done through supply side management. This can only be done through Demand side management by shutting down non-essential loads, during peak hours and continue supply to essential loads (Transport System, Hospitals, and Schools etc.).

Solution recommended by MoP is smart grid. Smart grid is an electrical grid with Automation, Communication and IT that can monitor power flow from point of generation to point of consumption & control the power flow and curtail the load to match generation in near real time. Backbone of whole smart grid concept is availability of data, hence the need of robust two way data communication technology. MoP recommended, lying down optical fiber cable till each substation by 2017 for data communication. So the challenge is to have 2 way communication between end points and substation, and from there on will be connected with Optical fiber. To achieve this communication modems needs to be installed, at all electricity measurement points in the flow path of the electricity from substation to endpoints. In year 2011-12 India had close to 20-25 cr. electricity meters considering electrification was close to 84% in India. All these meters need to be fitted with communication modems to achieve two way data communication by 2027, in phase wise manner, as per Smart Grid

Demand of electricity is growing rapidly in India from last few years. Even after all the efforts peak load shortage is still close to 10%. Only achievable way is to minimize the gap, by increase the generation capacity with more pace. In 2008-09 per capita electricity consumption in India was 770kwh per year, which is far lower than world average of 2429kwh per year for the same period. With the increase in per capita income and electrification of rest of villages (at present only 84% villages have electricity) demand of electricity will grow rapidly. Apart from that, National Mobility Electricity Mission Plan 2020 by Ministry of Heavy Industry & Public Enterprise has planned to bring 6 million electricity vehicles on Indian road by 2020. This will create more consumption point and will also increase the demand of electricity rapidly. Considering high dependency on natural resources like coal which is contributing 60% in generation in India, this may not be possible. The need can be fulfilled by rapidly increase in renewable energy apart from other sources. Ministry of new and renewable energy has goal to generate 20,000MW of power from Solar by 2022. This will give rise for implementation of mini solar power plant and roof top solar generation. This will add more complexity in the electricity flow, as now each consumer can also generate the electricity and if required can feed (Sell) it back to grid. This two way flow of electricity (Import/Export) and two way financial transactions needs precise measurement of electricity flow. This will help in increase of supply of electricity than demand. This will also give rise to the concept of supply side management of electricity. Where, we will have choice to decide on generation capacity of generation source at near real time based on demand.

Worldwide Low Power RF Mesh and PLC has maximum deployment for Data communication from smart meter. Modem manufacturer are using RF Mesh in UHF RFID band worldwide for smart meter data communication. In India this band is from 865-867 MHz. Major deployments are in North America, Canada, Australia, New Zealand and Japan. PLC is quite successful in European countries like UK. Apart from that one of the utility in India has also tried pilot with Zigbee + IEEE802.15.4. Selection of any communication technology for utility is depending on the demography of the area under the utility. Typical demographical conditions in India are:

Interoperability in communication technology needs to be understood at two levels. First Interoperability between energy meter and modem, second: interoperability between modem to modem. Interoperability at both the level is important, as this will give flexibility to the utility to buy meter and modem separately and also from any source. There is no single standard available worldwide that have dominated the market. Different countries and utilities have adopted the different approaches. At some places, smart meters manufacturers came together and formed the communication standard (IDIS) and testing standard, at other places utilities have formed the standard themselves (TEPCO) and at other places utilities are depending upon standard making bodies like IEC, IS, IEEE, ITU to provide the standards. Growth in the standards is very much like, in automotive sector during 1991-2000. In India most popular standard is DLMS, for which independent certification lab (CPRI Bangalore) for Meter to Modem data communication. For Modem to Modem

As, all new advancement in the energy sector & utilities are undergoing for evolution, with IT (Information Technology) & Telecommunication infrastructure, to ensure real time reliability of their generation, transmission & distribution, for example in Smart Grids, advanced meters at endpoints, data privacy,…. etc. Advance eco-system will become more-an-more smarter & increasingly interconnected, whereas critical infrastructure systems that were earlier isolated from other networks, are now connected with both critical and non-critical systems. So, Intromission of IT/Telecom, one way enhancing the operational efficiency, at the same point, demands extended infrastructure protections, from cyber hackers & cyber terrorist those having malicious intent. Cyber security is crucial from policy & technological point of view, which DISCOM‘s must address, because protection for critical infrastructure, for energy & utilities is vital for individuals‘ safety, nation economics & security. Cyber security addresses emerging threats to an interconnected electric system through cross-sector collaborative studies on cyber security standards, business processes, and technologies that protect the smart grid & advanced smart meter end points.

Traditional, norm in energy sector, was to have a single direction of power flow & date on isolated systems, whereas advance system compasses of integrated power generation, dynamic & bi-directional transmission & distribution and along with metering infrastructure. So, along with power, other Cyber threats broadly classified in categories 1. Un-authorized access 2. Impersonation 3. Denial of Service Cyber challenges include 1. Network Security • Due to Smart Grid modernization, challenges are in Integrating information technology (IT) and Operational Technology (OT) networks security. 2. Cyber Attack • As both IT/OT networks is on Internet, prone to cyber-attack. 3. Deliberated Blackouts • Internal threats posed by disgruntled employees and human error by authorized technicians 4. Virus Attacks • Prevention from virus & malware, e.g. Stuxnet virus 5. Privacy Intrusion • Prevention of personalized critical information of individual users 6. Electricity & Data theft • As same IT/OT system is interconnected, so lack of governance for the use of these tools in critical environments, from the widespread use of mobile devices, social media and portable USB drives. • Electricity theft by tampering at end points by changing meter billing charging mechanism

DISCOMs concerning utility governance & oversight plans to adapted to meet the new requirements for compliance. Key concern areas are as

2. Status and adequacy security policy and controls. 3. Budget for security expenditures. 4. Assign responsibility within organization for security policy, operations, enforcement, compliance & reporting.

Key considerations for securing the cyber space are as: 1. Cyber security is not optional, as its breech impact national security, public safety and economic of the nation. 2. Cyber security should be dynamic in nature and capable to detect, stop and prevent cyber-attacks. 3. Security is all about people awareness, business process and best technology for higher effectiveness. 4. Regular Cyber security initiatives & awareness

1. Identify potential threats, prevention and damage recovery a. Identify & classification for critical information. b. Identification & implementation of industry best security policies as per requirement. c. Periodic and random verification of security policies & its implementations. 2. Security Warning & Responses a. Report mechanism for any critical power cyber issues, to higher management to the national level b. To provide Minimal or Single access point for the outer world. And Identification & Implementation of best security preventive action at these access points. c. Regular assessment and certifications, to ensure organization compliance to international IT best practices, standard & guidelines a. To establish a top level plan to deal with cyber related incidents for rapid incident identification, information exchange, highly reactive response and curative actions for mitigation & recovery from malicious cyber

1. National Information Board (NIB): NIB is responsible of articulating national policy on information security & coordination on all aspects of information security governance in the country 2. National Crisis Management Committee (NCMC) NCMC is an apex body of Government of India for dealing with major crisis incidents that have serious or national ramifications. It will also deal with national crisis arising out of focused cyber attacks 3. National Security Council Secretariat (NSCS) NSCS is the apex agency looking into the political, economic, energy & strategic security concerns of India 4. Ministry of Home Affairs (MHA) MHA issues security guidelines from time to time to secure physical infrastructure. Kept update on every potential threat, including cyber 5. Ministry of Defense Ministry of Defense is the nodal agency for cyber security incident response with respect to Defense sector. And deal with all aspects of Information Assurance and operations 6. Department of Telecommunications (DoT) DoT coordinates with all ISPs and provides guidelines, regarding roles and responsibilities of Private Service Providers to ensure to have arrangements of alternate routing in case of physical attacks on these networks 7. National Cyber Response Centre - Indian Computer Emergency Response Team (CERT-In) CERT-In monitors Indian cyberspace and coordinates alerts and warning of imminent attacks and detection of malicious attacks among public 8. National Information Infrastructure Protection Centre (NIIPC) NIIPC gathers intelligence and keeps a watch on emerging and imminent cyber threats in strategic sectors. 9. National Disaster Management of Authority (NDMA) NDMA mitigate the damage and destruction caused by natural and man-made disasters 10. Standardization, Testing and Quality Certification (STQC) Directorate STQC provides quality assurance & conformity assessment services in IT. 11. Sectoral CERTs Sectoral CERTs would interact and work closely with CERT-In for mitigation of crisis affecting their constituency.

Even after the implementation of the best of the data technologies, there will be end points which are not able to communicate their data. This can happen due to poor network coverage or some tamper conditions. But this should be very less say 1-2%. For such end points, utilities need to plan data reading using traditional methods like hand held device which can be connected to meter hardwired communication port to download the data by a meter reader.

Traditional Indian Utility model: Step 1: Float a tender for given meter specification Step2: Bidding by multiple meter suppliers Step 3: Request for sample meters for testing from all bidders Step 4: Testing of all submitted meters from all bidders either in Utilities own lab or external labs Step 5: Distribute the order quantity among technically successful bidders based on their offered Price Step6: Purchase the meters from different successful manufacturers and store it in Utilities multiple stores. In the present model, once meters are purchased, there is very less or no role for supplier of the meter. But in case of smart meter, as installation of the meter will be with communication modem, so utility will have huge dependency on supplier at multiple points. For any communication technology deployment, network planning & deployment is a very critical role, this requires a lot of inputs in the form of demographical inputs (Lat./Long. coordinates), line conditions, installation position, network element placement. Once the network is deployed, it will require continuous maintenance in the form of non-functional modems, change in demographical conditions between the paths of the data communication etc. In the present model, utility is replacing the single or multiple meters based on need but in proposed system utility need to plan mass rollouts of meters to have better network deployment planning.

Installation of data communication technology alone itself will not solve all the problem of Power sector; it needs support from IT infrastructure. In a typical smart meter deployment below architecture is used

1. Reduction in Theft This will help utilities in identification of units which are causing distribution losses either due to technical or tamper conditions 2. Reduction in Technical losses

3. Improvement in bill collection 4. Improvement in read to bill time 5. Reduction in manual meter reading cost Accurate data collection will help in proper and timely generation of bills. In the absence of payment of bill it will have warning and electricity disconnection from centralized place 6. Reduced Problem Investigation time 7. Better demand forecasting This will help utilities to reduce the losses they are incurring due to purchase of electricity at higher prices due to poor demand forecasting 8. Reduction in maintenance of transformers 9. Better billing generations and collection system

1. Absence of Full Proof Standards a. Communication technology standards b. Security standards c. Interoperability standards d. Meter Standards 2. Cost No clear visibility on implementation and running cost of such infrastructure 3. Ecosystem Not much competitive environment for above mentioned technologies in India. At present in this field only one or two experienced manufacturers have presence in India 4. Political Environment a. In India it is difficult to cut the electricity of anyone without having proper evidence b. Electricity to the farmers will remain subsidize due to financial condition of farmers and political environment

In this paper we have studied and analyzed various energy distribution systems eco system and implementation of advance technologies. We also covered various distribution technologies and possible communication technologies. Covered cyber security threats & challenges in the energy distribution eco system. This also covered important & key consideration for cyber security and define key points for securing cyber space for business continuity

1. "Network Security Tips". Cisco. Retrieved 2011- 04-19. 2. "The Hidden Downside Of Wireless Networking". Retrieved 2010-10-28. 3. "How To: Define Wireless Network Security Policies". Retrieved 2008-10-09. 4. "Wireless Security Primer (Part Ii)". Windowsecurity.Com. Retrieved 2008-04-27. 5. "Fitting The Wlan Security Pieces Together". Pcworld.Com. Retrieved 2008-10-30. 6. "Security Vulnerabilities And Risks In Industrial Usage Of Wireless Communication". Ieee Etfa 2014 - 19th Ieee International Conference On Emerging Technology And Factory Automation. Retrieved 2014-08-04. 7. "Top Reasons Why Corporate Wifi Clients Connect To Unauthorized Networks". Infosecurity. Retrieved 2010-03-22. 8. "Smac 2.0 Mac Address Changer". Klcconsulting.Com. Retrieved 2008-03-17. 9. Lisa Phifer. "The Caffe Latte Attack: How It Works—And How To Block It". Wi-Fiplanet.Com. Retrieved 2008-03-21. 10. "Caffé Latte With A Free Topping Of Cracked Wep". Airtightnetworks.Com. Retrieved 2008-03- 21. 11. Pci Security Standards Council 13. "Simple Wireless Security For Home". Retrieved 2010-03-10. 14. "The Six Dumbest Ways To Secure A Wireless Lan", George Ou, March 2005, Zdnet 15. "What Is A Wep Key?"Lirent.Net. Retrieved 2008- 03-11. 16. Indian Smart Grid Task Force 17. Annual Report 2011-12 on working of State Power Utilities & Electricity Departments - http://planningcommission.gov.in/reports/genrep/arep_seb11_12.pdf 18. One Nation-One Grid (2013). Retrieved Nov, 2013, from http://www.powergridindia.com/ 19. Electric power transmission and distribution losses (% of output) (World bank – 2009-13) -http://data.worldbank.org/indicator/EG.ELC.LOSS.ZS 20. http://www.teriin.org/upfiles/pub/papers/ft33.pdf 21. http://smartgrid.ieee.org/july-2011/96-what-the-smart-grid-means-and-doesnt-mean-for-india 22. http://www.mnre.gov.in/solar-mission/jnnsm/introduction-2/ 23. Implementation – Ground realities and challenges by D.P. Chauhan Vadodra, Gujarat in Metering India 2011 Seminar 24. http://deity.gov.in/hindi/sites/upload_files/dithindi/files/ncsp_060411.pdf 25. http://deity.gov.in/content/national-cyber-security-policy-2013-1 26. http://indiasmartgrid.org/en/isgtf/wg/wg5/Pages/default.aspx 27. http://www.isgtf.in/Forms/WorkingGroupV.aspx 28. http://www.itu.int/dms_pub/itu-t/opb/tut/T-TUT-HOME-2010-PDF-E.pdf 29. http://www.idis-association.com/about.html Below is the data from Smart Grid Vision and Roadmap 2013

ISGF Indian Smart Grid Task Force The India Smart Grid Task Force is an inter-ministerial group and will serve as government focal point for activities related to SMART GRID. WG Working Group DT Distribution Transformer A distribution transformer is a transformer that provides the final voltage transformation in the electric power distribution

in the distribution lines to the level used by the customer Jhugi/Jhopadi Small huts J&K Jammu & Kashmir State in India T&D Transmission & Distribution CEA Central Electrical Authority of India The CEA advises the government on matters relating to the National Electricity Policy and formulates short-term and perspective plans for the development of electricity systems. Cr Crore Equals to 10 million Kwh Kilo Watt Hour The kilowatt hour is a unit of energy equal to 1000 watt-hours or 3.6 mega joules MW Megawatt Unit of Power. The megawatt is equal to one million watts RF Radio Frequency UHF Ultra High Frequency RFID Radio Frequency Identification Radio-frequency identification (RFID) is the wireless non-contact use of radio-frequency electromagnetic fields to transfer data, for the purposes of automatically identifying and tracking tags attached to objects MHz Mega Hertz Unit of Frequency PLC Power Line Communication Power line communication (PLC) carries data on a conductor that is also used simultaneously for AC electric power transmission or electric power distribution to consumers

IDIS

Interoperable Device Interface Standard companies which are committed to providing interoperable products based on open standards. The current members include Elster, Iskraemeco, Itron and Landis+Gyr TEPCO Tokyo Electric Power Company

IEC

International Electrotechnical Commission IS Indian Standard

IEEE

Institute of Electrical and Electronics Engineers

ITU

International Telecommunication Union

DLMS

Device Language Message Specification A transporting method to carry the information between the metering equipment and the data collection system CPRI Central Power Research Institute G.hnem ITU-T standard on narrowband PLC Technology

ETSI

The European Telecommunications Standards Institute produces globally-applicable standards for Information and Communications Technologies (ICT), including fixed, mobile, radio, converged, broadcast and internet technologies

NIST

National Institute of Standards & Technology

CENELEC

European Committee for Electrotechnical Standardization ANSI American National Standards Institute Lat Latitude Long Longitude HAN Home Area Network RF Mesh Radio Frequency Mesh WLAN Wireless Local Area Network Zigbee Wi-Fi LAN Local Area Network

MDMS

Meter Data Management System An MDM system performs long term data storage and management for the vast quantities of data delivered by smart metering systems SAP KW Kilo Watt Unit of Power. The kilowatt is equal to one thousand watts ToU Time of Use Time-based pricing is a pricing strategy where distribution companies, may vary the price of electricity depending on the time-of-day when the service is provided. These are preplanned and pre communicated to customers. Ph. Phase

Electricity Meters are 1Ph and 3Ph.

Research Scholar, Department of Computer Science & Engineering, Mewar University