IEC GOOSE TRAFFIC MODELING AND GENERATION. Omar Hegazi, Eman Hammad, Abdallah Farraj, and Deepa Kundur

Transcription

1 IEC GOOSE TRAFFIC MODELING AND GENERATION Omar Hegazi, Eman Hammad, Abdallah Farraj, and Deepa Kundur Department of Electrical and Computer Engineering, University of Toronto, Canada {ehammad, abdallah, ABSTRACT The IEC standard for substation communication and automation presented a reliable alternative to legacy communication networks. IEC defined more than one type of messages, of which the Generic Object Oriented Substation Event (GOOSE) messaging was structured to handle control and commands with strict delay and reliability requirements. This paper details the modeling and implementation of a GOOSE traffic generator in the commercial communication network simulator Riverbed Modeler (formerly known as OPNET). Index Terms IEC-61850, GOOSE messaging, implementation 1. INTRODUCTION Integration and inter-operability in communication networks connecting devices from various vendors is essential for homogeneous operation and management of such networks. The Communications for Power System Automation standard, IEC-61850, is one of the protocols that was created with that purpose in mind [1]. The IEC standard and its extensions are designed to include defined standardized names, standardized meaning of data, and standardized device behaviour models. The standard employs a Substation Configuration Language (SCL), which is used to describe power substation systems and device configurations in a standardized way, eliminating ambiguity and reducing configuration costs [1]. IEC is currently widely used in power substation automation (SA) systems. Based on the standard s success in SA systems, it was extended to be used for communication between substations, and between control centers and substations [1]. The IEC standard relies on an ethernet-based multi-cast messaging architecture [1], where one device (publisher) would update several other devices (subscribers). This enables power substation equipment to define and arrange data in a standardized form across all vendors and then transfer it through a network of industrial switches [2]. IEC defines three types of data mappings/messages: 1) Sampled Value (SV): SV messages transmit instantaneous values of substation equipment (mainly currents and voltages) in a digitized manner [3]. 2) Generic Object Oriented Status Event (GOOSE): GOOSE messages offer a fast and reliable transmission of critical substation events including alarms and commands [4]. 3) Manufacturing Message Specification (MMS): MMS messages are used in control networks to transfer data between controllers as well as between substations and controllers [4]. GOOSE and SV messages offer fast and reliable messaging that uses IEEE 802.1Q ethernet frames to transmit control commands and raw sampled data. This data is generated by relays, controllers and sensors of equipment in the power system [5]. Of particular interest to this work is GOOSE messaging as it is the primary time-sensitive messaging that conveys control and protection commands. There exist Intelligent Electronic Device (IED) simulators that support generating IEC traffic such as OMI- CRON IEDScout [6]. Such simulators are generally commercial and are not open source, which limits the studies that utilize the tool. Nevertheless, it was used in [7, 8] where the generated GOOSE messages from the tool were verified against the standard. A generic IED model was implemented in OPNET [9], where the focus was on evaluating the performance of SA systems for different network topologies. Finally, in [10] an open source traffic generator (Scapy) was used to design and implement a GOOSE traffic generator. Its performance and reliability were evaluated in a simulated network using SMARTFlow (a substation communication network management tool). Modeling GOOSE messaging is challenging due to the fact that the frame length and the message rate are not constant. In this work we model and implement a detailed GOOSE messaging traffic generator in the widely used Riverbed Modeler [11], where the developed traffic generator is highly customizable. We evaluate the implemented traffic generator in terms of added processing delay due to encoding/decoding. The main contributions in this work are the detailed modeling of the GOOSE protocol and a flexible GOOSE traffic generator that can be extended to extract status and value data from IED configuration Extensible Markup Language (XML) files. 2. GOOSE MESSAGING GOOSE messaging enables fast and reliable exchange of data between two or more IEDs over IEEE 802.1Q networks. As /17/$ IEEE 1100 GlobalSIP 2017

2 6. Length: total number of bytes of the following fields: Ethertype, AppID, Reserved1, Reserved2, and goosepdu. Fig. 1. Packet format of a GOOSE frame with the number of bits allocated to each field. If the number of bits is not specified, then it varies based on the IED. For the alldata field, the number of bits is based on the data encoded by the publisher. described in IEC [12], the data exchange is implemented using a publish-subscribe model, where one IED acts as the publisher by creating a GOOSE message that is transmitted to a group of subscriber IEDs simultaneously. GOOSE messages are immediately created once an event, such as the triggering of a circuit breaker, occurs within the substation and they are sent periodically through the network. Source and destination addresses for GOOSE frames are layer 2 Medium Access Control (MAC) addresses. A MAC address is a six byte identifier of the network interface card, but can also be assigned to virtual interfaces or multicast domains GOOSE Ethernet Frame Format The format of a GOOSE frame (Fig. 1) includes the following fields [2]: 1. Destination Address (Dst.): an ethernet MAC multicast address. The ethernet MAC addresses of IEC begin with 01:0C:CD. The fourth octet is 01 for GOOSE while the remaining two octets are used as individual addresses for the GOOSE message. 2. Source Address (Src.): unicast MAC address of the publisher. 3. Virtual Local Area Network (VLAN) Priority Tagging: separates time critical and high priority bus traffic for protection relevant applications from low priority busload. It consists of the following [12]: TPID: the Tag Protocol Identifier indicates the Ethertype assigned for 802.1Q VLAN ethernet frames and is given by 0x8100. TCI: the Tag Control Information separates timecritical GOOSE messages from low-priority busload. 4. Ethertype: type of the Ethernet frame and is given by 0x88b8 for GOOSE messages. 5. AppID: the application identifier. It has a default value of 0x0000 but a unique value should be enforced by the configuration system [12]. 7. Reserved1 and Reserved2: reserved for future standardized applications. They have a default value of 0x GOOSE Protocol Data Unit (PDU) (goosepdu), which consists of the following fields [7]: GOOSE Control Block Reference (gocbref): the name of the GOOSE control block in the IED, Time Allowed to Live (TAL): the maximum time the GOOSE frame remains alive after transmission, Data set (datset): the name of the GOOSE data set in the IED, GOOSE ID (goid): identifier associated with the IED, Timestamp (t): the generation time of the GOOSE frame, State Number (stnum): an integer assigned when a GOOSE frame is created due to an event in the substation, Sequence Number (sqnum): an integer assigned in increasing order to retransmitted GOOSE frames, Test: indicates if the GOOSE message is a test or not, Configuration Revision (confrev): indicates the version of the IED and must be the same for both the publisher and the subscriber, Needs Commission (NdsCom): indicates if the GOOSE frame is valid or not, Number of dataset entries (numdata): indicates the number of data entries in the GOOSE frame, and Data (alldata): the payload of the GOOSE frame Implementation of GOOSE Traffic Generator To perform network tests concerning IEC-61850, several switches and IEDs may be used to simulate a substation network, where the number of IEDs on the network directly impacts the performance of packets. The use of a GOOSE traffic generator instead of physical devices to perform tests on GOOSE frames is a more feasible approach, since a large number of IEDs is not usually available to researchers. Further, the developed software-based GOOSE traffic generator offers the flexibility to: 1) modify the formatting or content of a GOOSE frame to study its security or to emulate cyber attacks, and to 2) modify the number of IEDs to evaluate the performance of GOOSE frames. We use the C programming language to design and implement the GOOSE traffic generator on a Ubuntu LTS (64-bit) Linux-based virtual machine with 2.0 GB RAM and 3.40 GHz Intel Core i CPU. The traffic generator was developed in the environment of Riverbed Modeler In our development, the traffic generator is implemented in two stages: 1) a standalone GOOSE traffic generator utilizing raw network sockets, 2) integrating the traffic generator with the Modeler. 3. STAND-ALONE GOOSE TRAFFIC GENERATOR The stand-alone generator utilizes the libiec61850 open source library [13] to encode and decode frames based on 1101

3 a template IED XML file from [14]. We defined the fields as illustrated in Fig. 1 to generate GOOSE frames. For the ethernet MAC addresses, we extracted the MAC address of the Linux machine and then set the destination address to the default IEC multicast MAC address: //extract source address struct ifreq buffer; memset(&buffer, 0x00, sizeof(buffer)); strncpy(buffer.ifr_name, interfaceid, IFNAMSIZ); ioctl(sock, SIOCGIFHWADDR, &buffer); Fig. 2. A snapshot of the network simulation, where GOOSE frame number 4 is making its way to the subscriber from the publisher. uint8_t srcaddr[6]; memcpy(srcaddr, buffer.ifr_hwaddr.sa_data, 6); uint8_t defaultdstaddr[] = {0x01,0x0c,0xcd, 0x01,0x00,0x01}; uint8_t* dstaddr = defaultdstaddr; Local variables are used to store the values of the TPID, TCI, and Ethertype fields as well as the AppID, Reserved1, and Reserved2. uint16_t TPID; uint16_t TCI; uint16_t Ethertype; uint16_t AppId; uint16_t Reserved1; uint16_t Reserved2; We used a global structure to represent the length field as well as the fields within the goosepdu: struct GoosePublisher { uint8_t* buffer; int lengthfield; int payloadstart; }; char* goid; char* gocbref; char* datasetref; uint32_t confrev; uint32_t stnum; uint32_t sqnum; uint32_t timeallowedtolive; bool needscommission; bool test; struct time* timestamp; The buffer is used to store the hexadecimal values of the fields within the GOOSE frame Networking: Publish-Subscribe In our implementation, the publisher used an XML parser to extract the configuration information for the gocb, dat- Set, goid, and confrev fields from the template IED XML file. This information along with the other fields of the GOOSE message were encoded using the Basic Encoding Rules (BER) into the buffer, which is then sent as a GOOSE frame through a raw socket. Receiving this packet from the socket is the GOOSE subscriber: Fig. 3. Approach for generating GOOSE traffic in OPNET. Fig. 4. The 64-bit timestamp field is divided into eight 8-bit entities. recvfrom(sock, receiver->buffer, ETH_BUFFER_LENGTH, 0, 0, 0); The GOOSE subscriber decodes the packet to verify that the destination address is a multicast MAC address, and that the VLAN priority tagging indicates that it is a time-critical message in an 802.1Q VLAN ethernet frame. Further, it checks that the Ethertype is of type GOOSE, and that the unique appid matches the value expected by the subscriber. If these conditions are satisfied, then the rest of the packet will be decoded and stored for further analysis. 4. SIMULATION OF GOOSE TRAFFIC IN RIVERBED MODELER At this stage, the Riverbed Modeler is used to simulate a simple IEC network where GOOSE traffic is generated between a publisher node and a subscriber node as in Fig. 2. Riverbed Modeler comprises a suite of technologies and protocols that facilitate detailed modeling, simulation and analysis of a variety of networks [11]. The main challenges faced were that Modeler does not support IEC nor its mutlicast publisher-subscriber traffic architecture. Thus, we developed a customized process for generating GOOSE traffic such that the platform recognizes GOOSE frames. Our approach is outlined in Fig Modeler GOOSE Packet A GOOSE packet format is created matching the packet structure in Fig. 1. Because the fields are filled in a sequence of 1102

4 4.3. Modeler Node Model Fig. 5. Process model of the processor in Fig. 6. Within the Modeler environment, it is not possible to create sockets to transmit and receive GOOSE messages. To account for this, we created a generalized node model as in Fig. 6 for publisher and subscriber nodes. Generated GOOSE packets are sent to the processor which encodes data onto packets. The publisher then transmits the GOOSE message through the transmitter port (pt 0) and the subscriber receives it through the receiver port (pr 0). The GOOSE message travels to the processor which decodes the data encapsulated within the packet Evaluation Fig. 6. Node Model of the publisher and subscriber nodes. Fig. 7. The generation of GOOSE frames where the peaks represent the transmission of a GOOSE message. octets, each field is divided into multiples of eight. For example, the timestamp field, which requires 64 bits, was divided into 8 entities (Fig. 4). Furthermore, the ethernet links that connect the nodes in Fig. 2 were modified to support the GOOSE packet format Modeler Process Model A generalized process model was created for the publisher and subscriber (Fig. 5). The process model s init state represents the starting point where global variables are defined and the idle state controls the sending and receiving of GOOSE messages. When a packet is generated, the send pkt function is executed to encode data onto the fields of the GOOSE message. send pkt encodes the data by passing a pointer to the GOOSE packet, a particular field, and the data to be encoded to the Riverbed Modeler function: op pk nfd set. Once all of the fields are encoded, the GOOSE message is sent across the packet stream. The switch in Fig. 2 gets the message from the packet stream and sends it to the destination address specified in the packet. When a packet is received, the rcv pkt function is executed to decode the GOOSE message. Similarly, rcv pkt makes use of the Riverbed Modeler function op pk nfd get to decode the data within the GOOSE message. Simulation tests were performed in Modeler to study the performance of GOOSE messages. We controlled the GOOSE traffic by introducing arbitrary sampling rates to send GOOSE messages. For example, we implemented the generator such that it will send GOOSE messages more frequently when a substation event occurs [15]. In our hypothetical scenario, a circuit breaker trips at the 22 ms mark and causes the publisher to send several GOOSE messages in a short period of time, as is observed in Fig. 7. The generator then gradually returns to normal operation, sending GOOSE messages every 10 ms. To test the performance of the GOOSE traffic generator, we ran various simulation tests with a GOOSE frame size of 128 bytes, ethernet link capacity of 100 Mbps and simulation time of ms. The frame size is based on the GOOSE packet format (Fig. 1) as well as the configuration information of the template IED XML file. The simulation ran the network presented in Fig. 2, where several performance metrics were collected such as: end-to-end (ETE) delay, delay caused by the processor, and queuing delay. The ETE delay was observed to be 2 ms which is below the IEC requirement of 3 ms [12]. Delay introduced by the processor was found to be ms, and queuing delay was 0.02 ms. As shown in the results, delays introduced by our customized processing overhead are negligible. Hence, the developed GOOSE traffic generator can be used to communicate time-sensitive GOOSE messages fast and reliably, and can be used for further cyber-security and resilience studies. 5. CONCLUSION AND FURTHER WORK In this paper, we presented our detailed IEC GOOSE messaging traffic generator. The developed generator was integrated in Riverbed Modeler, where a customised model has been developed to establish the support of IEC in Modeler. Simulation results were shown to illustrate the negligible overhead of the customised models. Future work will utilize the developed simulator for the simulation of digital substation events and for cyber security studies including: traffic analysis, attack detection and for the assessment of standardbased mitigation approaches. 1103

5 6. REFERENCES [1] Ralph Mackiewicz, IEC Technical Overview, [2] Juan Hoyos, Mark Dehus, and Timthy X Brown, Exploiting the goose protocol: A practical attack on cyberinfrastructure, in 2012 IEEE Globecom Workshops. IEEE, 2012, pp [14] stevenblair, Rapid-prototyping protection and control schemes with IEC 61850, [15] Farel Becker, Stefan Nohe, and Alex Echeverria, Designing non-deterministic pac systems to meet deterministic requirements, PAC World, [3] OMICRON, Sampled Values in IEC Environments, [4] Carl A. Gunter Jianqing Zhang, IEC Communication Networks and Systems in Substations,. [5] Hanno Georg, Nils Dorsch, Markus Putzke, and Christian Wietfeld, Performance evaluation of time-critical communication networks for smart grids based on iec 61850, in Computer Communications Workshops (IN- FOCOM WKSHPS), 2013 IEEE Conference on, 2013, pp [6] OMICRON, IEDScout - Versatile software tool for working with IEC devices, [7] Chilton Fernandes, Samarth Borkar, and Jignesh Gohil, Testing of goose protocol of iec61850 standard in protection ied, International Journal of Computer Applications, vol. 93, no. 16, [8] Carl Kriger, Shaheen Behardien, and John-Charly Retonda-Modiya, A detailed analysis of the goose message structure in an iec standard-based substation automation system, International Journal of Computers Communications & Control, vol. 8, no. 5, pp , [9] Tarlochan S Sidhu and Yujie Yin, Modelling and simulation for performance evaluation of iec61850-based substation communication systems, IEEE transactions on power delivery, vol. 22, no. 3, pp , [10] Yona Lopes, Débora C Muchaluat-Saade, Natalia C Fernandes, and Marcio Z Fortes, Geese: A traffic generator for performance and security evaluation of iec networks, in 2015 IEEE 24th International Symposium on Industrial Electronics (ISIE), 2015, pp [11] Riverbed, Riverbed Modeler, [12] International Electrotechnical Commission, IEC Communication networks and systems in substations Part 8-1: Specific Communication Service Mapping (SCSM) Mappings to MMS (ISO and ISO ) and to ISO/IEC , [13] Open source libraries for IEC and IEC ,