## 5 Communication Dependability
### Cybersecurity for IEC61850 Multicast Communication in Wide-Area Applications
#### 5.2.2 Secured Communication Path
received in the expected time, (for example when a new key has not been pushed to the GM, and 95 percent of the existing TEK's lifetime has passed), the GM registers with the second KS in the ordered list. In this list, all the KSs have a secondary role except for the first one, the primary KS, which has the highest priority. This KS periodically synchronizes with the secondary KSs by exchanging one-way announcement messages. If the secondary KS does not receive any information from the primary KS within 60 s, the COOP reelection process [41] is activated to select a new primary KS. This provides a fault recovery mechanism for KS failure in a GET VPN network. COOP KS can handle up to 8 KSs, and the GMs can register to either a primary or a secondary KS. However, only the primary KS sends rekey information to the GMs. IPsec Tunnel for Public WAN  
In the case of public WAN (Figure 6), transmitting IP-multicast traffic (R-SV/R-GOOSE) over the public IP network is challenging because public networks are normally designed for IP-unicast communication. Moreover, public WAN routers are administered by the Internet Service Provider (ISP) company, and end-users have no access to these routers to configure them for IP-multicast communication. Therefore, IP-multicast frames must be tunneled. This is achieved by encapsulating them with a new IP header and sending the tunneled frames over a public WAN. IPsec [42] is a popular tunneling protocol that provides encapsulation as well as security. It consists of two main components: Encapsulating Security Payload (ESP) and Internet Key Exchange (IKE). ESP provides confidentiality, integrity, and authentication mechanisms for encapsulated IP packets. IKE is used between communication peers to negotiate security policies and to generate a secret key for securing the data communication. IPsec can be operated in two modes: Tunnel mode or Transport mode. In Tunnel mode, the original IP packet and IPsec header (ESP header) are encapsulated into the new IP header. In Transport mode, the IPsec header is added to the original IP header. These IPsec modes  
Figure 14: Secured messages in the secured communication path (Defense-in-Depth Security for multicast communication via private WAN). use direct encapsulation (between two endpoints) and can secure communication in smart grid applications [5; 26] that use IP-unicast communication over public WAN. However, IPsec direct encapsulation cannot be used for encapsulating IP-multicast traffic because [41] multicast replication must be carried out before tunnel encapsulation and encryption at the edge routers. Consequently, multicast repetition cannot be accomplished in public WAN since the encapsulated IP-multicast messages appear to intermediary WAN routers as IP-unicast. Nevertheless, IPsec can secure IP-multicast traffic over the public WAN when it is used in combination with GRE [34]. For each packet, GRE adds the GRE header and delivery header containing protocol type and tunnel endpoint addresses, respectively. GRE can also encapsulate IP-multicast over the public IP network but lacking any security mechanisms. To satisfy security requirements, GRE is often deployed with IPsec to secure the communication. Therefore, IP-multicast traffic (R-SV/R-GOOSE) can be securely transmitted over the public WAN using GRE over IPsec, i.e., encapsulation by GRE and encryption by IPsec as shown in Figure 15.  
Figure 15 shows multicast communication of secured R-SV/R-GOOSE from Substation 1 to Substation 2 and 3. FHR and LHRs should be configured for GRE over IPsec communication. GRE tunnels are established between these routers by defining tunnel endpoint addresses. These tunnels are capable of transporting IP-multicast traffic (R-SV/R-GOOSE) between substations but without any cybersecurity measures. Therefore, IPsec tunnels must also be used between the edge routers to provide security mechanisms. First, FHR and LHRs use IPsec IKE [42] that operates in two phases.