Hindawi Publishing Corporation

International Journal of Digital Multimedia Broadcasting

Volume 2011, Article ID 372020, 8 pages
doi:10.1155/2011/372020

Review Article
Cyber Security for Smart Grid, Cryptography, and Privacy

Swapna Iyer
Department of Electrical and Computer Engineering, Illinois Institute of Technology, Chicago, IL 60616-3793, USA

Correspondence should be addressed to Swapna Iyer, [email protected]

Received 1 December 2010; Revised 21 June 2011; Accepted 26 July 2011

Academic Editor: Pierangela Samarati

Copyright © 2011 Swapna Iyer. This is an open access article distributed under the Creative Commons Attribution License, which
permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

The invention of “smart grid” promises to improve the efficiency and reliability of the power system. As smart grid is turning out
to be one of the most promising technologies, its security concerns are becoming more crucial. The grid is susceptible to different
types of attacks. This paper will focus on these threats and risks especially relating to cyber security. Cyber security is a vital topic,
since the smart grid uses high level of computation like the IT. We will also see cryptography and key management techniques that
are required to overcome these attacks. Privacy of consumers is another important security concern that this paper will deal with.

1. Introduction supply, reduce carbon foot print, and minimize the costs
associated with power consumption.
One of the most important, complex, and intelligent network The smart grid system has many advantages, one of them
we have is the “power system”. This system consists of cir- being cost effectiveness. This is because the grid uses internet
cuits, wires, towers, transformers, sensors, and cables inter- for communication purpose. However, using the internet
linked to provide us with uninterrupted power supply. This means vulnerability to cyber attacks. As opposed to the
system is mainly a mechanical system and has very little elec- original power system, the smart grid uses ethernet, TCP/IP
tronics associated with it like sensors and communication. and other operating systems, thus making the grid more sus-
However, as technology has progressed rapidly and almost ceptible to attacks. The smart grid should enhance the
all the latest devices need electricity for their operation, it is security of the power system, but protecting the grid is a
necessary that we make our present power system more re- more challenging task now. Once the system is attacked,
liable and efficient [1]. the attacker may control several meters or disrupt the load
We can say the demand for electricity is greater than its balance of the system. Thus, we need to gain complete
supply. The demand is not only high but also fluctuating. We knowledge about cyber security, so we can eliminate it com-
could rely on renewable resources like solar energy and wind pletely. We also need to focus on the cryptographic methods
energy to meet the present need, but unfortunately, they turn proposed by the National Institute of Standards and Technol-
out to be fluctuating too. ogy (NIST) in order to avoid these cyber attacks.
The smart grid enhances the functionality of the power In this paper, we will study smart grid security in
delivery system. This is possible because smart grid uses sen- more depth. The goal of this paper is to cover the security
sors, communications, computation, and control in order challenges related to cyber security, and we will also study
to make the system smart and by applying intelligence to it how cryptography is used in order to eliminate cyber
in the form of control through feedback or in other words attacks. Finally, we will also discuss in brief privacy which
by using two way communication. In order to utilize the is another smart grid security concern. The rest of the paper
available resources, consumers need to change, and they need is organized as follows. We start by reviewing the challenges
to act more “smart”. They have to change from being passive and goals of smart grid in Section 2. This is followed by
consumers to being active consumers [1]. Smart grids aim to the smart grid architecture in Section 3. We focus on cyber
reduce the energy consumption, ensure reliability of power security in Section 4. Section 5 explains cryptography used
2 International Journal of Digital Multimedia Broadcasting

for smart grid security in depth. Privacy in context with

smart grid security is explained in Section 6. And finally, we
conclude in Section 7. Ensure reliability

2. The Smart Grid: Goals and Challenges Reinforcing

global Affordability
2.1. Goals. The present power grid has more than 9200 elec- competiveness
tric generating units, 1,000,000 plus megawatts of generating
capacity connected by using 300,000 miles of transmission Smart grid
lines [2].
Electricity has one basic requirement; it needs to be Accommodating
utilized as soon as it is generated. The present grid does so renewable Introducing
successfully. However, now, the grid is overburdened. The and traditional advancements
energy
reliability of the present grid is at stake, and this can be seen, sources
since we have been witnessing more brownouts and black- Reducing
outs recently. carbon
footprints
Another thing that needs to be addressed when we
consider the present grid is the efficiency. By making the
grid more efficient, we can save millions of dollars. There is Figure 1: Smart grid goals.
also a reverse case here; if there is an hour of power outage,
the nation loses a tremendous amount of money. Electricity
needs to be more affordable too. The rate of electricity is
increasing gradually which makes it less affordable.
Majority of the electricity produced in the United States Digitalization
of America comes by burning coal. The carbon footprints
that occur due to this contributes to global warming. If we
introduce the use of renewable energy in our grid, we can
reduce the carbon footprint. Customization Flexibility
We also need to compete globally with other countries
that have better technology for energy distribution.
And finally, the grids security is of major concern.
The current grid has a centralized architecture, and thus
making it more vulnerable to attacks. A failure can hamper
the country’s banking, traffic, communication, and security
system [2].
Resilience Intelligence
Thus, we introduce the smart grid system (Figure 1). We
now have a smart power grid that creates a link between elec-
tricity, communications, and computer control. Many coun-
Figure 2: Smart grid properties.
tries are actively participating in the development of smart
grid; for example, the ETP created a joint vision for the
European network of 2020 [3] and beyond, and the US estab-
lished a federal smart grid task force under the Department
technology. Resilience would mean that the system should
of Energy (DoE).
not be affected by any attacks. And lastly, customization
The aim is first to control the electricity supply with
means the system needs to be client tailored.
utmost efficiency and also reduce the carbon emissions.
The power grid today is already a very complex and
A smart grid system basically needs to have the following
intelligent system. It comprises thousands of miles of high
properties (Figure 2) [4]:
voltage lines, an intelligent control system that controls it,
(1) digitalization, and a communication system that distributes it. A smart grid
would help us improve the efficiency and availability of the
(2) intelligence, same power system by using better control strategies.
(3) resilience,
(4) customization, 2.2. Challenges. Let us see what are the problems related to
(5) flexibility. the current power grid system.
The current grid is “purpose built”. This means that it
Digitalization means to have a digital platform which makes is made in such a way that we cannot add any new control
the system fast and reliable. Flexibility would mean that points and any security functions. The grid is bandwidth lim-
the smart grid needs to be compatible, expandable, and ited, and this restricts us from adding any extra information
adaptable. Intelligence would mean to inherit an intelligent that would be required to ensure authentication. If there is
International Journal of Digital Multimedia Broadcasting 3

no room for security, it implies the protocols runs relying Power plant to
on trust, and thus ignoring the possibility of any unknown Transmission
system distribution
entity. Electricity subsystem
In case of the new smart grid, the practice has changed; delivery
initially the devices used were purpose built, and these days, network
function
they are multipurpose. Instead of using dedicated lines for Distribution
Distribution
communication, we use the TCP/IP. Though the technology system subsystem to
consumer
has drastically improved, the chances of being attacked have
also increased rapidly.
Figure 3: A general model.
Another issue is that smart meters would read the energy
usage of a particular residence multiple times in an hour,
which would lead to a loss of privacy for the consumer. That
is because if one has a smart grid, then one can know whether does not provide the real-time dynamic characteristics of the
a residence is occupied or not and also at what time what system whereas in the future, we will have a dynamic model
appliances are being used. This could lead to two different updates. Also, the future grid is expected to have a look ahead
types of attack, either a simple theft or pricing the signals for simulation capability.
monetary gains [5].
Controllability. In the present grid, operations like separat-
3. The Smart Grid Architecture ing, restoration, and so forth, depend on offline studies. In
the future, these will be real time and dynamic. Fixed values
3.1. A General Model. The electricity delivery network bas- are used for the protection and the control settings now, but
ically consists of two subsystems, a transmission system and in the future, proactive and adaptive approaches will be used.
a distribution subsystem (Figure 3). Also, there is no coordination when any decision is taken in
In the transmission network, electricity is moved in bulk the current technology. In future, there will be coordination
from 345 kV to 800 kV over AC and DC lines. Power flows in order to gain a better control.
in one direction and is distributed to consumers at 132 kV.
However, the smart grid will provide bidirectional metering
Interaction with Electricity Market. The main aim of a smart
unlike the present grid.
grid system is to achieve high efficiency. For this, we need a
The grid includes a monitoring system and a smart meter
control system that dynamically adjusts in accordance with
which keeps track of the electricity consumed. It includes
the market. Sophisticated tools are used for this purpose.
superconductivity transmission lines which help to reduce
Also, the smart grid needs to accommodate renewable energy
the resistive losses and also is compatible to other sources of
sources.
energy like wind, solar, and so forth.

3.2. Functional Components. The three functional compo- 3.2.2. Smart Transmission Networks. There are new features
nents of a smart grid are smart control centers, smart trans- that are included in the smart grid which involves signal
mission networks, and smart substations. Let us take a look processing, sensing, advanced materials, power electronics,
at them one by one as follows [4]. communications and computing. These would improve the
efficiency, utilization, quality, and security of the present
system.
3.2.1. Smart Control Centers. The smart control centers will For long distance transmission, we use high-capacity AC
depend on the existing control centers. The main functions and DC facilities. When the overhead lines are not possible,
of a control center are as follows [4]. underground cables are used. High-temperature composite
conductors and high-temperature superconducting cables
Monitoring/Visualization. The present control center per- are used for electrical transmission, since they have a higher
forms monitoring based on the data collected via SCADA current carrying capacity, low voltage drop, reduced line
and RTUs (remote terminal units). In the future, information losses, light in weight, and better controllability. Six and
will be obtained from state measurement modules. It is better twelve phase transmission lines are used which provide great-
than the present module in terms of “running time” and er power transmission with reduced electromagnetic field
“robustness”. In the future, the outcomes will be combined and great phase cancellation.
with a wide area geographical information system (GIS), Flexible and reliable transmission is made possible by
and a visual display will be provided. In this manner, more using advanced flexible AC transmission system (FACTS)
information will be covered. Also, in the future, the control and high-voltage DC (HVDC) devices. FACTS are placed in
centers will provide the root cause of a problem rather than the transmission network, and they improve the dynamic
just giving an alarming signal. performance and stability. They will help grid to be free from
transmission congestions. HVDC is used as a cost-effective
Analytical Capability. The future is expected to have online alternative to AC lines.
time domain-based analysis. These would include voltage Intelligent sensors are used with advanced signal process-
stability and transient angular stability. The present grid ing to measure the line parameters and monitor the status
4 International Journal of Digital Multimedia Broadcasting

around the sensor location. These sensors can detect the 4.2. SCADA System. Supervisory control and data acqui-
conductor temperature, detect galloping lines, predict initial sition (SCADA) systems are basically centralized control
failures of insulators and towers, identify fault locations, and systems that are used by our power distribution system. It
so forth. is used for monitoring and controlling process [8].
Based on these parameters, the operating conditions can The main blocks that a SCADA system includes are the
be autonomously detected, analyzed, and responded in case following:
of emergencies, thus maintaining the reliability and security
of the transmission system. Also, smart grid systems have (i) HMI (human machine interface) presents processed
reduced catastrophic failures and less maintenance cost. Ex- data,
treme event facility hardening systems are used to manage (ii) a supervisory computer that collects all the data and
failure and restore the system rapidly [4]. uses it for processing purpose,
(iii) remote terminal units (RTUs),
3.2.3. Smart Substation. The equipments in the substation
(iv) programmable logic controller (PLC),
should be more reliable and efficient for functions like mon-
itoring, controlling, operating, protecting, and maintaining. (v) communication infrastructure.
The main functions are the following [4]:
By using the power system communication in the smart
(1) smart sensing and measurement, grid, the SCADA systems are connected to other systems like
the internet or by certain dedicated lines. The vendors are
(2) communication, using off the shelf products as part of the SCADA systems.
(3) autonomous control and adaptive protection, These products are similar to the personal computers we use
at home, and thus are susceptible to attacks and different
(4) data management and visualization,
threats [9].
(5) monitoring and alarming, A SCADA system is a necessary element in the grid
(6) diagnosis and prognosis, infrastructure. It is used for two purposes, first the public
transport system and second the public control system.
(7) advanced interfaces with distributed resources, The cyber security basically can be attacked in three steps
(8) real-time modeling. [10] as follows:
(1) the attacker has control over the SCADA system,
4. Cyber Security (2) the attacker identifies the system to launch an
4.1. Cyber Security Model. Like for any other network’s intelligent attack,
security, the three main objectives that cyber security focuses (3) attacker initiates the attack.
on is availability, integrity, and confidentiality, that is, avail-
ability of power with integrity of information and confiden- These SCADA systems are most vulnerable to attacks. In
tiality of customer’s information. order to prevent the attackers from gaining control of
SCADA system, automation will be required. The NIST has
established smart grid cyber security coordination task group
Availability. The reason why we have smart grid is “avail- (CSCTG) which addresses and evaluates processes leading to
ability”. The basic goal of our network is to provide un- comprehensive cyber security policies for smart grid [6].
interrupted power supply to the users and to match user The risks assessed by the CSCTG include [6, 11] the
requirements. following:

Confidentiality. The grid network is responsible for the pro- (i) complexity of grid leading to weak point and open-
tection of a user’s information. If the data is not protected, ings to attackers,
ample information about the user can be revealed to the (ii) cascading errors as a result of interconnected net-
attacker. works,
(iii) DoS (denial of service) attack,
Integrity. The messages received from the user end should
be authenticated. The network must ensure the information (iv) attack on consumer privacy to excessive data gather-
is not tampered. Also, the source of message should be ing,
authentic. (v) attacks from annoyed employees and terrorists,
The smart grid’s cyber infrastructure consists of elec- (vi) as number of nodes increases the number of entry
tronic information and communication systems and services points for an attacker also increases.
along with the information contained in these systems and
services. This includes both the hardware and software too. In order to obtain cyber security, we also need to have a
Their basic functions are to process, store, and communicate robust hardware. We can discuss this further by dividing
information. This is done using a control system (SCADA) the hardware section in two parts: (a) new substations and
[6, 7]. The SCADA is a neutral system. (b) existing systems. In case of new substations, we can
International Journal of Digital Multimedia Broadcasting 5

completely design the system to be immune against cyber the various aspects related to cryptography and key man-
security threats. For this, we can use managed switches. agement. We will first go through the different constraints
These are smart switches which perform multifunctions like related to cryptography followed by the cryptographic issues
access control, traffic prioritization, managing data flow, and solutions [16].
and so forth. However, since we already have an ethernet-
based system laid, we must make changes to these systems 5.1. Constraints
such that they can withstand cyber attacks. For this, we
can either update the present infrastructure or Install Se- 5.1.1. Computational Constraints. Residential meters will
curity appliances. Security appliances are present between have limitations when it comes to computational power
the ethernet connections and are used for examining and and the ability to store cryptographic materials. The future
monitoring purposes. Another addition to existing systems devices are bound to have the basic cryptographic capabil-
would be the use of firewalls. They block unauthorized access ities including the ability to support symmetric ciphers for
to any network and work according to the user defined authentication. The use of low-cost hardware with embedded
rules. We could also use a technology called VPN (virtual cryptography is necessary but not enough to achieve high
private network), where the connection between two stations availability, integrity and confidentiality in the smart grid.
is secured [12].
The Cyberspace Policy Review initiated by President 5.1.2. Channel Bandwidth. The communications that will
Obama advised that “the Federal government should work take place in a smart grid system will take place over different
with the private sector to define public-private partnership channels that have different bandwidths. AES is a cipher that
roles and responsibilities for the defense of privately owned produces the same number of output bits as input bits. These
critical infrastructure and key resources.” Specifically, the bits cannot be compressed too, since they are encrypted
review recommended that as “the United States deploys and random in nature. In case we need to compress this
new Smart Grid technology, the Federal government must data, we need to do so before encryption. Another factor
ensure that security standards are developed and adopted to be taken into consideration is the cipher-based message
to avoid creating unexpected opportunities for adversaries authentication code (CMAC), which is added as a fixed
to penetrate these systems or conduct large-scale attacks overhead to a message and is typically 64 bits or 96 bits. These
[11, 13].” overheads turn out to be significant when we are dealing
The Department of Energy should work with the federal with short messages, since they would need large channel
Bandwidth.
energy regulatory commission to determine whether addi-
tional security mandates and procedures should be devel-
oped for energy-related industrial control systems. In addi- 5.1.3. Connectivity. Standard public key infrastructure-based
tion, the United States deploys new smart grid technology, on peer-to-peer key establishment model where any peer
may need to communicate with another is not desirable from
the federal government must ensure that security standards
a security standpoint for components. Many devices may
are developed and adopted to avoid creating unexpected
not have connectivity to key servers, certificate authorities,
opportunities for adversaries to penetrate these systems or
online certificate status, and protocol Servers. Many connec-
conduct large-scale attacks [11]. tions between smart grid devices will have longer duration
Chairman Thompson issued the following statement than typical internet connection.
regarding the legislation: “Any failure of our electric grid,
whether intentional or unintentional would have a signifi-
cant and potentially devastating impact on our nation. We 5.2. General Cryptographic Issues
must ensure that the proper protections, resources and reg-
Entropy. Cryptographic key generation requires a good
ulatory authorities are in place to address any threat aimed
source of entropy that creates randomness which is unavail-
at our power system. This legislation addresses these critical
able for many devices.
issues by providing a common sense approach to ensure
continued security of the nation’s electric infrastructure
[14],”. Cipher Suite. A cipher suite that is open is needed in order
The security concerns are increasing as the numbers of to achieve interoperability. A decision about which block
cipher, their modes, key sizes, and asymmetric ciphers forms
connections are increasing. There have been cases where
the base of authentication operation.
cyber spies from China, Russia, and other countries are re-
ported to have entered the United States electrical grid and
tried to attack the system. The ability to resist attacks is one Key Management Issues. Security protocols depend on secu-
of the inevitable functions of the smart grid [15]. rity associations. There can be two types in which the
security is authenticated: (1) use of Secret key and (2)
use of certificate authority. In case we use secret keys, the
5. Cryptography and Key Management keys have to be transported from a device to another. To
transport these keys, we need a set of keys for each pair
In order to obtain cyber security, we must secure data using of communicating devices and all this needs to be well co-
cryptography and different keys. In this section, we will study ordinated. There is also a hardware alternative for this, but
6 International Journal of Digital Multimedia Broadcasting

that is a costlier option and involves a large amount of not expired. If this certificate is issued to a device, that is,
overhead. Digital certificates turn out to be cost effective so- no longer reliable, either lost or stolen, then the certificate
lution as coordination is not required as it was in the case can be revoked. A certificate revocation list is used for this
of public key system. Each device needs just one certificate purpose. A device that uses the information in a certificate
for key management and one private key that is fixed from is called relying party (RP). RP has a checklist that must be
the time of installation. However, generating PKI and also considered when accepting a certificate.
having certificate authorities will also have a certain amount The points that need to be checked are as follows
of overhead unnecessary for smaller systems.
(i) if the certificate was issued by a trusted CA,
Elliptic Curve Cryptography. A cryptographic Interoperabil- (ii) if certificate is still valid and not expired,
ity strategy (CIS) initiated by National Security Agency (iii) certificate should be in an authoritative CRL,
(NSA) for government systems selects approved crypto- (iv) verification of the certificate subject and policy for
graphic techniques. It consists of AES for encryption with which certificate is being used.
128 or 256 bits. Ephemeral unified model and Diffie-Hell-
man key agreement schemes, elliptic curve digital signature
algorithm and secure hash algorithm (SHA) for hashing. 5.4. Approved Algorithms
Symmetric Key. Advanced encryption standards (AESs),
5.3. Cryptographic and Key Management Solutions triple data encryption algorithm (TDEA), or triple data en-
cryption standard (TDES).
5.3.1. General Design Considerations
(i) Selection of cryptographic technique should be such Asymmetric Key. Digital signature standard (DSS), digital
that the design is robust and the algorithm is free of signature algorithm (DSA), RSA digital signature algorithm
flaws. (RSA), elliptic curve digital signature algorithm (ECDSA).
(ii) Entropy issue can be solved by seeding a deterministic
Secure Hash Standard. Secure hash standards (SHSs) and
random bit generator (RBG) before distribution or
secure hash algorithm (SHA).
use a key derivation function which comes with the
device.
Message Authentication. CMAC, CCM, GCM/GMAC (Galois
(iii) Use of cryptographic modules that is used to protect counter mode), and HMAC (hash message authentication
the cryptographic algorithm. We need to upgrade code).
these modules timely, since smart grid equipments
would be used for around twenty years and also re-
placing them would be a costlier affair. Key Management. SP800-108 KDF’s.

(iv) Failure in encryption systems may occur due to im-

Deterministic Random Number Generators. FIPS 186–2
plementation errors, compositional failures, insecure
APPENDIX 3.1 RNG, FIPS 186–2 APPENDIX 3.2 RNG,
algorithms, or insecure protocols. These categories
ANSI X9.31-1998 APPENDIX A2.4 RNG, ANSI X9.62-1998
should be taken into consideration while designing.
ANNEX A.4 RNG, and ANSI X9.31 APPENDIX A.24 RNG
(v) Since a random number generator is an integral part using TDES and AES RNG, SP 800-90 RNG.
of the security system, its failures would result in a
compromise of cryptographic algorithm or protocol. Nondeterministic Random Number Generators. Currently
(vi) There must be alternatives for authentication and None.
authorization procedures in case we cannot connect
to another system. Symmetric Key Establishment Techniques. FIPS 140–2 1G
(vii) Availability must always be there since dropping or D.2.
refusal to re-establish a connection may affect the
critical communication. Asymmetric Key Establishment Techniques. SP 800–56 A, SP
800–56 B, and FIPS 140–2 1G D.2.
(viii) The algorithms and key lengths should be such that
These algorithms can be studied in detail from [17–34].
the desired security strength is attained.
(ix) In order to maintain security of the keying materials
and authentication data, we must protect it from un-
6. Privacy
authorized access or any device tampering. Physical Privacy cannot be defined. The basic definition of privacy
security is required for this purpose. would be “the right to be left alone”. Privacy should not be
confused with confidentiality. Confidentiality of information
5.3.2. Key Management System for Smart Grid. We use is information that can be accessed only by a few. In reference
certificates that have validity, that is, certificates that have to the smart grid privacy means considering the rights, values
International Journal of Digital Multimedia Broadcasting 7

and interests of customers (like their personal information, Its implementation will result in numerous benefits for the
electric signatures, etc.). The data used by smart grid could society. However, it has to face a few challenges and concerns
be used to violate individuals [35]. when it comes to security. We have studied these challenges
A privacy impact assessment (PIA) is used for determin- in this paper. Cyber security is an integral part of the grids
ing the privacy, confidentiality, and secure risks that arise due security concern. As the grid develops and expands in the
to the collection, use, and disclosure of personal information. future, the number of nodes that will be not susceptible to
PIA findings and recommendations are as follows [35]. cyber attacks will increase. Domain architecture which is
used to evaluate these challenges is explained in one of the
(1) Management and Accountability. People should be ap- sections. We then explain cryptography and key management
pointed to ensure that the documented policies for infor- techniques which are used to secure the system against cyber
mation security and privacy are followed. Audit functions attacks. In this section, we covered the constraints for cryp-
should be present in order to check the data access activity. tography and also the proposed solutions. The last part of
the paper deals with consumer privacy which is another
(2) Notice and Purpose. Before collecting data, using it, or important security parameter that cannot be neglected. In
sharing it, a notice must be prepared and exchanged. order to make the smart grid more popular, it should be free
from any security drawbacks and hazards in order to have a
better future.
(3) Choice and Consent. The consumer should be provided
with the choices present in context to the energy usage data
that could be revealed and their consent should be obtained. Acknowledgment
(4) Collection and Scope. Only the information that is really I would like to thank Dr. Zuyi Li for his guidance and the
necessary should be collected from the user by appropriate help and inspiration he extended for this paper.
lawful means and with their consent.
References
(5) Use of Retention. The information that is collected
should be used only for those purposes for what they were [1] C. W. Gellings, The Smart Grid: Enabling Energy Efficiency and
taken. Also, the information should be saved in such a way Demand Response, The Fairmont Press, 2009.
that no activity or information about the consumer can be [2] “The smart grid: an introduction,” http://energy.gov/oe/dow-
found out from it. The data should be discarded once its nloads/smart-grid-introduction-0.
purpose is over. [3] “European smart grids technology platform,” http://www
.smartgrids.eu/documents/vision.pdf.
[4] F. Li, W. Qiao, H. Sun et al., “Smart transmission grid: vision
(6) Individual Access. Consumers should be able to see their
and framework,” IEEE Transactions on Smart Grid, vol. 1, no.
individual data and can also request for correction if any of 2, Article ID 5535240, pp. 168–177, 2010.
the data is inaccurate. They also have the right to know where [5] S. Clements and H. Kirkham, “Cyber-security considerations
their information is being shared. for the smart grid,” in Proceedings of the Power and Energy
Society General Meeting (2010 IEEE), pp. 1–5, July 2010.
(7) Disclosure and Limiting Use. The personal information [6] G. Iyer and P. Agrawal, “Smart power grids,” in Proceedings
cannot be shared by anyone not present in the initial notice of the 2010 42nd Southeastern Symposium on System Theory
and should only be used for the reason stated in the notice. (SSST 2010), pp. 152–155, March 2010.
[7] Z. Vale, H. Morais, P. Faria, H. Khodr, J. Ferreira, and P.
Kadar, “Distributed energy resources management with cyber-
(8) Security and Safeguards. The personal information
physical SCADA in the context of future smart grids,” in
should be secure and must be protected from thefts, mod- Proceedings of the 15th IEEE Mediterranean Electrotechnical
ification or unauthorized access. Conference (MELECON 2010), pp. 431–436, April 2010.
[8] “SCADA,” http://en.wikipedia.org/wiki/SCADA.
(9) Accuracy and Quality. The personal information should [9] G. N. Ericsson, “Cyber security and power system commu-
be as accurate as possible and related to the purpose men- nication—essential parts of a smart grid infrastructure,” IEEE
tioned in the notice. Transactions on Power Delivery, vol. 25, no. 3, Article ID
5452993, pp. 1501–1507, 2010.
(10) Openness, Monitoring, and Challenging Compliance. A [10] F. Boroomand, A. Fereidunian, M. A. Zamani et al., “Cyber
service recipient should be able to access the personal data security for smart grid: a human-automation interaction
framework,” in Proceedings of the IEEE PES Innovative Smart
and should be able to challenge the organizations com-
Grid Technologies Conference Europe (ISGT Europe 2010), pp.
pliance. 1–6, October 2010.
[11] “Cyberspace policy review,” http://www.whitehouse.gov/
7. Conclusion assets/documents/Cyberspace Policy Review final.pdf.
[12] A. Dreher and E. Byres, “Get smart about electrical grid cyber
The various security concerns related to smart grid was security,” http://www.belden.com/pdfs/techpprs/PTD Cyber
proposed in this paper. Smart grid is an emerging project. SecurityWP.pdf.
8 International Journal of Digital Multimedia Broadcasting

[13] “Introduction to NISTR 7628 guidelines for smart grid cyber [33] E. Barker, D. Johnson, and M. Smid, “Recommendation for
security,” 2010, http://csrc.nist.gov/publications/nistir/ir7628/ pair wise key establishment schemes using discrete logarithmic
introduction-to-nistir-7628.pdf. cryptography (revised),” 2007, http://csrc.nist.gov/publicatio-
[14] “Critical electric infrastructure protection act,” http://ciip ns/nistpubs/800-56A/SP800-56A Revision1 Mar08-2007.pdf.
.wordpress.com/2009/04/30/critical-electric-infrastructure- [34] “Implementation guidance for FIPS PUB 140-2 and the
protection-act/. cryptographic module validation,” 2010, http://csrc.nist.gov/
[15] “The security vulnerabilities of smart grid,” 2009, http://www groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf.
.ensec.org/index.php?option=com content&view=article& [35] “Guidelines for smart grid cyber security vol. 2, privacy
id=198:the-security-vulnerabilities-of-smart-grid&catid=96: and smart grid,” 2010, http://csrc.nist.gov/publications/nistir/
content&Itemid=345. ir7628/nistir-7628 vol2.pdf.
[16] “Guidelines for smart grid cyber security vol. 1, smart grid
cyber security, architecture and high-level requirements,”
2010, http://csrc.nist.gov/publications/nistir/ir7628/nistir-
7628 vol1.pdf.
[17] “Advanced encryption standard (AES),” 2001, http://csrc.nist
.gov/publications/fips/fips197/fips-197.pdf.
[18] M. Dworkin, “Recommendation for block cipher modes
of operation-methods and techniques,” 2001, http://csrc.nist
.gov/publications/nistpubs/800-38a/sp800-38a.pdf.
[19] M. Dworkin, “Recommendation for block cipher modes of
operation-the XYS-AES mode for confidentiality on stor-
age device,” 2010, http://csrc.nist.gov/publications/nistpubs/
800-38E/nist-sp-800-38E.pdf.
[20] W. C. Barker, “Recommendation for the triple data encryption
algorithm (TDEA) Block Cipher,” 2008, http://csrc.nist.gov/
publications/nistpubs/800-67/SP800-67.pdf.
[21] “Digital signature standards,” 2009, http://csrc.nist.gov/publi-
cations/fips/fips186-3/fips 186-3.pdf.
[22] “FIPS PUB 186-2,” 2000, http://csrc.nist.gov/publications/fi-
ps/archive/fips186-2/fips186-2-change1.pdf.
[23] “Secure hash standard,” 2008, http://csrc.nist.gov/publicatio-
ns/fips/fips180-3/fips180-3 final.pdf.
[24] M. Dworkin, “Recommendation for block cipher modes of
operation-the CMAC Mode for authentication,” 2005, http://
csrc.nist.gov/publications/nistpubs/800-38B/SP 800-38B.pdf.
[25] M. Dworkin, “Recommendation for block cipher modes
of operation-the CCM mode for authentication and con-
fidentiality,” 2004, http://csrc.nist.gov/publications/nistpubs/
800-38C/SP800-38C.pdf.
[26] M. Dworkin, “Recommendation for block cipher modes
of operation-galois/counter mode (GCM) and GMAC,”
2007, http://csrc.nist.gov/publications/nistpubs/800-38D/SP-
800-38D.pdf.
[27] “The keyed hash message authentication code(HMAC),” 2002,
http://csrc.nist.gov/publications/fips/fips198/fips-198a.pdf.
[28] L. Chen, “Recommendation for key derivation using pseu-
dorandom functions,” 2009, http://csrc.nist.gov/publications/
nistpubs/800-108/sp800-108.pdf.
[29] “Recommendation guidance for FIPS PUB 140-1 and
cryptographic module validation program,” 2002, http://
csrc.nist.gov/groups/STM/cmvp/documents/fips140-1/
FIPS1401IG.pdf.
[30] S. S. Keller, “NIST-recommended random number gener-
ator based on ANSI X9.31 appendix A2.4 using the 3
key triple DES and AES algorithms,” 2005, http://csrc.nist
.gov/groups/STM/cavp/documents/rng/931rngext.pdf.
[31] E. Barker and J. Kelsey, “Recommendation for random num-
ber generation using deterministic random bit generator
(revised),” 2007, http://csrc.nist.gov/publications/nistpubs/
800-90/SP800-90revised March2007.pdf.
[32] E. Barker, L. Chen, A. Regenscheid, and M. Smid, “Rec-
ommendation for Pair wise key establishment schemes us-
ing integer factorization cryptography,” 2009, http://csrc.nist
.gov/publications/nistpubs/800-56B/sp800-56B.pdf.