In-Network GOOSE Encryption with eBPF-based Programmable Network Architecture

Retrofitting cybersecurity to digital substations is a costly and challenging effort. Communication encryption and device authentication are two of the most important techniques to ensure confidentiality, integrity and availability. However, most common grid devices do not support modern cryptography due to limited computational capacity of legacy devices. In this paper, we perform detailed performance comparison of several encryption protocols on GOOSE traffic, taking into consideration entire payload encryption, encryption of only critical fields, and CPU performance. We compared the efficiency of five algorithms and their effect on end-to-end latency on resource-constrained single board devices. Finally, we propose an in-network eBPF-based programmable data plane solution which performs encryption and decryption in–network as opposed to grid devices and therefore eliminates the need for replacing the power grid IEDs or buying additional encryption / decryption cards. We implemented the best performing algorithm – Chacha20 in-network and tested the proposed architecture achieving end-to-end latency under 0.5 ms during normal operation and under 1 ms under heavily loaded network and high messages frequency, thus complying with the GOOSE latency limit.