QUIC-TRIP: A Triple-Redundant Journey Toward Secure Substation Communications

Technical Summary: QUIC-TRIP

Problem Statement
Modern power grid infrastructure relies heavily on real-time communication protocols, specifically the Routable Generic Object-Oriented Substation Event (R-GOOSE) under the IEC 61850 standard, for critical control and protection functions. However, these protocols were originally designed for air-gapped, local area networks (LANs) and prioritize low latency and availability over confidentiality and integrity. Consequently, they lack robust built-in security features, making them vulnerable to False Data Injection Attacks (FDIA) and Denial-of-Service (DoS) attacks, particularly when transmitted over wide-area or public networks.

Existing security solutions face significant hurdles in this domain. Integrated security often requires firmware updates that are infeasible for resource-constrained legacy Intelligent Electronic Devices (IEDs). Virtual Private Networks (VPNs) and data diodes introduce latency and create single points of failure. Furthermore, while newer protocols like DNP3-SAv6 and IEEE 2030.5 offer security extensions, their adoption is inconsistent, and retrofitting legacy systems with complex middleware often violates strict latency requirements (e.g., GOOSE requires ≤4ms). The paper identifies a need for a transparent, low-latency security methodology that does not require modifications to existing protocol endpoints or application-layer logic.

Methodology
The authors propose QUIC-TRIP, a transparent security methodology operating at the OSI Transport Layer (Layer 4). The solution utilizes a multipath proxying scheme based on SSH3 over QUIC (Quick UDP Internet Connections) to encapsulate and protect data flows without altering the application layer.

The core mechanism involves Triple Modular Redundancy (TMR) via active reflection and filtering:

1. Reflection: An application-agnostic reflector at the source duplicates incoming R-GOOSE datagrams. It appends a 4-byte label (containing a datagram number) to each copy.
2. Multipath Transmission: The duplicated datagrams are securely proxied through three distinct, pre-established communication paths (e.g., direct infrastructure, and paths via Stockholm and Milan datacenters). Each path is secured using QUIC with TLS 1.3 for authentication and encryption (AEAD).
3. Filtering: At the destination, a filter receives the replicated streams. It maintains a counter for received datagrams matching the label and forwards only the earliest-arriving copy to the application, discarding subsequent duplicates.

This architecture ensures that if one path is compromised or delayed by a DoS attack, the system can still receive the command via an alternative path, provided at least one path remains viable. The system is designed to be application-agnostic, meaning it secures the transport without requiring changes to the R-GOOSE protocol itself.

Key Contributions
The paper outlines three primary contributions:

1. Development of a Transparent Multipath Proxy: The authors developed and open-sourced a Layer 4 proxying scheme that enhances security and provides redundancy for time-critical industrial communications without modifying endpoints.
2. Resilience Analysis: The study analyzes how this multipath scheme mitigates FDIA and DoS threats by removing single points of failure associated with centralized gateways or single-path VPNs.
3. Quantitative Evaluation: The solution was tested to quantify the latency and communication overhead introduced by securing R-GOOSE messages, specifically measuring the trade-off between resilience and bandwidth cost.

Results
The evaluation was conducted using a testbed with Linode datacenters in Frankfurt, Amsterdam, Stockholm, and Milan, simulating wide-area IP transport under controlled congestion.

• Latency Overhead: In baseline echo Round-Trip Time (RTT) tests, the QUIC-based proxy (SSH3) achieved an average RTT of 6.43 ms. This was lower than OpenVPN (6.97 ms) and only 2.88% higher than integrated DTLS 1.2 (6.25 ms) with session reuse.
• Communication Overhead: For 162-byte R-GOOSE datagrams, the total measured overhead per enabled proxied path was 32.18%. This includes a 16.86% per-datagram expansion (due to reflector labels, SSH3 metadata, and QUIC/AEAD protection) and additional control traffic (15.32%).
• DoS Resilience: Under DoS flooding attacks targeting intermediate infrastructure:
  • Non-reflected traffic experienced latency spikes up to 100 ms as buffers filled.
  • Reflected and filtered traffic successfully mitigated the impact by discarding delayed duplicates and forwarding the earliest-arriving copy from an alternative path (e.g., via Milan). The filter added minimal latency (100–300 µs) because ordering and authentication were handled by the underlying QUIC/TLS layers.
  • Even when attacks were extended to target the proxy relayers in alternative datacenters, the multipath scheme allowed for the establishment of new paths in the background to maintain delivery, though eventual latency increases were noted if all paths were saturated.

Significance and Claims
The paper positions QUIC-TRIP not as a "silver-bullet solution" but as a practical, bounded trade-off between resilience and bandwidth cost. Its significance lies in providing a triple-redundant defense scheme that:

• Complies with modern security mandates (e.g., DOE's defense-in-depth and zero-trust guidelines) without requiring firmware updates on legacy, resource-constrained devices.
• Offers a transparent layer of security that protects against both FDIA and DoS attacks by leveraging path diversity.
• Maintains the low-latency characteristics required for time-critical grid operations, with an RTT overhead comparable to integrated security solutions.

The authors conclude that while the 32.18% bandwidth overhead is a cost, it is a viable exchange for ensuring packet delivery assurance in mission-critical systems where sporadic, time-sensitive communications (like R-GOOSE) are essential for grid stability. Future work is identified as involving real-time co-simulation to assess the specific impact of these communication delays on power system stability.