The IEC 61850/62351 Substation Automation System Crypt (SAS Crypt) IP core secures the strict real-time traffic used in substation automation systems and new smart grid sites. For example, it protects GOOSE and Sample Measurement Value (SMV) frames, which are used to communicate with critical devices in these venues, such as merged units or IEDs. The IP implements the new IEC 62351-6 standard, which ensures interoperability and allows both IEC 61850 protected and unprotected traffic in the same network. The standard defines the encryption and authentication mechanisms that will be applied to Layer 2 IEC 61850 frames. This low-latency IP energy is capable of encrypting, decrypting and authenticating GOOSE or SMV at wire speed.

A very important topic in the scope of IEC 62351 is key management and distribution for protection. The SAS Crypt IP Core allows different solutions for introducing security keys into devices. Since it is a static method of introducing keys into the IP, a fully automated solution for secure key management is defined in IEC 62351-9: “Cybersecurity key management for power system equipment”.

The SAS Crypt IP Core integrates a proprietary low-latency encryption cipher optimized specifically for this task. The cryptographic module delivers the required performance with optimal resource utilization and introduces a latency of a few microseconds. In practice, SAS Crypt IP allows the trade-off between the supported data throughput and the FPGA resources required for implementation to be modified at synthesis time.

The most relevant configurable parameters that allow optimization to be achieved are:

• Types of IEC 61850 messages that must be secured
• Multiplication delay used in passwords
• Multiplication engine used in passwords
• Implementation of key storage and management logic for up to 100 different IEC 61850 data sets

In addition to the protection features, the SASCrypt IP core supports the IEEE 1588 V2 One-Step Transparent Clock Peering (P2P) feature. This feature allows compensating for the dwell time of PTP frames as well as the latency of each link.

The SASCrypt IP core is used in conjunction with the SoC-e MES IP core as well as the HSR-PRP switch IP to combine security to introduce Ethernet switching functionality in the device.