arXiv:2607.26379v1 [cs.CR] 29 Jul 2026
QUIC-TRIP: A Triple-Redundant Journey Toward Secure Substation Communications Jorge David de Hoz Diego
Ioannis Zografopoulos
Anca Jurcut
School of Computer Science University College Dublin [email protected]
Engineering Department University of Massachusetts Boston [email protected]
School of Computer Science University College Dublin [email protected]
Abstract—Modern power systems rely on real-time substation communication protocols, such as the Routable Generic ObjectOriented Substation Event (R-GOOSE), for critical control and protection functions. However, these protocols often lack built-in security features and prioritize availability over confidentiality and integrity, making them susceptible to false data injection and denial-of-service attacks. This vulnerability is exacerbated when communications are transmitted over wide-area or public networks. Addressing these cyber threats is essential to comply with current security mandates, including the DOE’s defense-indepth and zero-trust guidelines. This paper introduces QUICTRIP, a transparent security methodology for low-latency IPbased industrial communications. By operating at the Open Systems Interconnection (OSI) Transport Layer (Layer 4), the solution encapsulates and protects data flows without affecting the operation of existing protocol endpoints. Baseline echo RoundTrip Time (RTT) results over a Frankfurt-Amsterdam communication path show that the underlying transport-layer proxy used by QUIC-TRIP achieves a lower average RTT than OpenVPN and only 2.88% higher average RTT than integrated DTLS 1.2, even with DTLS session reuse. We evaluate the resilience of QUIC-TRIP multipath communication under DoS flooding by securing R-GOOSE communications. In these tests, traffic is transparently delivered through three different paths, and QUICTRIP forwards the earliest-arriving duplicate while discarding later copies. The framework provides a triple-redundant defense scheme with a measured communication overhead of 32.18% per enabled proxied path, offering a bounded trade-off between resilience and bandwidth cost for time-critical grid operations. Index Terms—Communication, cybersecurity, GOOSE, resilience, substation.
I. I NTRODUCTION The modernization of power grid infrastructure has resulted in an extensively interconnected cyber-physical system where stability and reliability are critically dependent on highbandwidth data communication and embedded computing infrastructure [1]. Substation automation systems rely heavily on protocols, such as the generic object-oriented substation event (GOOSE) that follows the IEC 61850 standard, to facilitate essential, time-critical functions such as asset management, device coordination, protection, and control. However, the certain design characteristics of these protocols can potentially pose substantial cyber challenges. For protocols like GOOSE, the design inherently prioritizes availability and latency minimization over fundamental security traits, such as confidentiality and integrity. Although integrity was traditionally maintained via simple mechanisms, cryptographic methods were omitted. The use of mechanisms like cyclic redundancy checks (CRC),
for instance, in related synchrophasor standards like IEEE C37.118, offers weak integrity protection because an intruder can easily recalculate a new CRC after modifying the packet contents. Such security deficiencies become a serious issue with the introduction of internet-facing devices that route grid communication over potentially insecure wide-area networks. Furthermore, the complexity of cyber-physical energy systems (CPES) is exacerbated by the continuous integration of new system elements and the persistence of legacy infrastructure. Legacy devices often suffer from limited computational resources and low communication bandwidth. Many intelligent electronic devices (IEDs) and legacy components, being resource-constrained, make the implementation of rigorous security updates or over-the-air firmware upgrades challenging or infeasible. Although comprehensive security standards have been proposed, such as IEC 62351 for IEC 61850, vendors have yet to adopt them across all products. Reliance on vendorspecific development to incorporate security features into their products, risks creating additional and potentially unique threat vectors. Consequently, both existing and future infrastructures become susceptible to attacks, such as false data injection attacks (FDIA) and denial-of-service (DoS) [2]. To overcome these limitations and comply with modern mandates, such as the DOE’s defense-in-depth and zero-trust guidelines, we propose a novel triple-redundancy security scheme. The primary contributions of this work are as follows: 1 • We develop and open-source a transparent multipath proxying scheme operating at OSI Layer 4 (Transport Layer) to enhance security and provide redundancy for time-critical communication. • We analyze how the proposed multipath scheme secures data and provides resilient delivery. This mitigates threats (e.g., FDIA and DoS) targeting critical nodes, removing single-points-of-failure associated with centralized industrial gateways, data diodes or virtual private networks (VPNs), which reduce reliability and increase latency. • We test the solution and quantify the latency and communication overhead from securing R-GOOSE messages. II. BACKGROUND ON C OMMUNICATION P ROTOCOLS Securing industrial protocols is challenging, as these protocols are deployed in critical infrastructure systems with 1 All source code and supporting data for this study are publicly accessible to ensure reproducibility [3].
TABLE I OVERVIEW OF P OWER S YSTEMS C OMMUNICATION P ROTOCOL R EQUIREMENTS Protocol / Std. Application Limitations Security IEC 61850 Substation automation (GOOSE,SV) Complexity, high bandwidth Limited encryption IEC 60870-5 SCADA (101: Serial, 104: TCP/IP) 101: Low rates, 104: IP risks Vulnerable to injection attacks Wide-area monitoring (PMUs) IEEE C37.118 Data processing, GPS dependent GPS spoofing, no encryption IEEE 1815 Automation, SCADA Latency in large-scale setups Security extensions available DNP3 MODBUS ICS, Power meters Poor error detection, no sync Vulnerable to command injection IEEE 2030.5 DER Internet-based communication Computational overheads TLS 1.2
long operational lifespans. Protocols are supported by heterogeneous devices from various manufacturers (many of which are resource-constrained), making updates difficult or infeasible. This challenge is further exacerbated in missioncritical deployments, such as electrical systems, where timesensitive operations and the prohibitive costs of downtime necessitate meticulous planning for upgrades. Potential solutions would require that legacy devices can be retrofitted with secure and up-to-date communication protocols or complemented with sidecar hardware without compromising performance. CPES often consists of multiple subsystems and industrial processes that demand strict adherence to latency, availability, and performance requirements. Consequently, protocol upgrades must be carefully designed to align with these constraints. In the following subsections, we provide an overview of widely used industrial protocols in electrical systems, their operational and security requirements, and recent advancements aimed at enhancing their security. Finally, we demonstrate how the proposed approach, whilst not a “silver-bullet solution”, can significantly improve the security and reliability of most CPES protocols, without introducing substantial performance overheads or necessitating major investments in infrastructure modernization. A. Security Analysis of Protocols in Electrical Systems Power system monitoring, operation, and control rely on a diverse range of protocols. These are selected based on the specific application domain and technical requirements, such as latency, availability, reliability, and real-time constraints. Some of the most commonly used protocols include IEC 61850, IEC 60870, IEEE C37.118, IEEE 1815 (DNP3), MODBUS, and IEEE 2030.5. An overview of the characteristics of each protocol and their security oversights is outlined in Table I. The IEC 61850 and IEC 60870 families refer to protocol standards that are widely adopted in substations for remote monitoring, automation, and control. IEC 61850 enables real-time communications through the Generic ObjectOriented Substation Event (GOOSE) and Sampled Values (SV) messaging, ensuring low-latency and high-reliability communication. Typically, the low latency requirements of IEC 61850 are achieved through wired communication channels, which prohibit the wide adoption of the protocol over longer distances. On the other hand, IEC 60870 can be utilized in both wired and wireless deployments, through standardized communication over TCP/IP networks, for the remote monitoring and control of substations and power plants. Another protocol that prioritizes low latency over security is
Timing GOOSE: ≤4ms, SV: ≤1ms 101:1 – 2s, 104:100ms 16 – 100 ms/frame Reports: 500ms – 2s Alarms: ≤100ms 100ms – 1s Unsuitable for real-time
IEEE C37.118, which is the de-facto standard enabling the transmission of high-resolution time-synchronized data from phasor measurement units (PMU) to control centers. IEEE C37.118 supports wide-area monitoring, event analysis, and stability assessment to improve grid reliability. However, its high-throughput and near real-time transmission requirements have to date prioritized measurement availability and offer limited options for security considerations. DNP3 is extensively used in SCADA systems to facilitate secure and reliable communication between industrial, master and outstation devices. It is designed to operate efficiently over long distances and supports robust error checking and timestamped data for event-driven reporting. Especially its current version, i.e., DNP3-SAv6 [4], has been updated to include secure authentication, access control, hash-based message authentication codes (HMAC), and elliptic key cryptography. Similarly, MODBUS was initially developed for industrial automation, facilitating communication between control devices and field equipment such as sensors and actuators. Its simplicity contributed to its widespread adoption, particularly in wired configurations. However, the absence of built-in security mechanisms has raised significant concerns. To address these security vulnerabilities, the SunSpec MODBUS variant was introduced, but its adoption still remains limited [5]. Last, the IEEE 2030.5 is the newest protocol, originally introduced in 2018. IEEE 2030.5 facilitates secure communication between utilities, distributed energy resources (DERs), and customers, playing a crucial role in demand response and grid-edge management. The latest IEEE 2030.5-2023 standard incorporates cybersecurity measures, including transport layer security (TLS) for encrypted communications, certificatebased authentication, and role-based access control, ensuring protection against cyber threats and unauthorized access [6]. The majority of industrial protocols used today have available upgraded versions or extensions that provide valuable security features that were missing in past versions. However, their correct implementation in real deployments is not straightforward, as they rely on secure mechanisms originally designed for general information technology (IT) environments (such as TLS), where operational constraints are more relaxed. Thus, any bolt-on solution involving protocol translation would incur higher latency requirements, more complex middleware, and difficulty in maintaining and scaling secure infrastructure.
Fig. 1. Triple modular redundancy through QUIC proxying (reflected & filtered communications).
Fig. 2. DoS causing communication delays in intermediate infrastructure to proxied communications (non-reflected communications).
III. M ETHODOLOGY
TABLE II RTT BASELINE STATISTICS COMPARISON BETWEEN F RANKFURT AND A MSTERDAM L INODES
This work investigates the communication mechanisms of substation automation systems, emphasizing the operational characteristics and security of GOOSE. GOOSE transmits critical protection and control commands, such as trip or interlocking signals. GOOSE was originally designed for air-gapped, decentralized local area networks (LANs) using multicast Ethernet with transfer times below 4 ms. However, with increasing digitalization, a routable version of GOOSE (R-GOOSE) emerged to facilitate substations transitioning toward integrated architectures in which human–machine interfaces and gateways aggregate data for transmission to control centers. This work aims to develop an application-agnostic, backward-compatible communication scheme that enhances integrity, security, and attack tolerance in modern substations. As demonstrated in Fig. 1, our QUIC-TRIP solution establishes a secure triple modular redundant tunnel between the network endpoints (e.g., substation and system operator center), providing end-to-end encryption to ensure the confidentiality and integrity of the encapsulated messages while traversing the insecure channels, as well as resilience (i.e., triple modular redundancy) via the multipath transmission. A. Threat Model As described in [7], the remote attacker (see Fig. 2) is modeled as an oblivious adversary having essentially no knowledge of the power system topology, classified as either Class I or Class II, based on the resources and skills required to compromise the CPES. This effort is considered a targeted attack aimed at destabilizing the power grid by obstructing crucial control commands to substations, requiring the attack to be performed iteratively and multiple times to maximize its impact [8]. Physical access is not required, as the attack occurs in the cyber domain, namely at the network level. The adversarial objectives are FDIA or DoS attacks, which target asset availability by tampering with control commands targeting Level 2 assets. The adversaries could leverage the spoofing and resource exhaustion tactics, to induce anomalous incidents and degrade system operations.
Metric
Integrated DTLS 1.2* OpenVPN SSH3 Proxy (OpenSSL 3.0.13) (2.6.14) (QUIC–TLS 1.3)
RTT Avg. (ms) RTT σ (ms)
6.25 0.11
6.97 0.13
6.43 0.13
RTT Avg. increase RTT σ increase
— —
11.52% 18.18%
2.88% 18.18%
*To achieve these results, each DTLS datagram reuses the same session.
B. Baseline latency overhead of major security strategies Securing communications from legacy systems can be addressed through three main strategies. Either i) by integrating a security technology, combining secure access control with isolated demilitarized zones (VPN-based), by ii) using perdevice security elements such as sidecar devices, or iii) via stand-alone proxying mechanisms. Including security in devices has been the standard procedure, mirroring the development processes followed in standard IT systems. However, as discussed in Section I, novel solutions are required for resource-constrained legacy systems. We compare baseline latency overhead between the three aforementioned secure communication methods, i.e., integrated, VPN-based, and proxy-based. In this evaluation we quantify the round-trip time (RTT) of communications between two different data centers in Europe included in the Linode infrastructure [9]. Table II provides the RTT between Linodes in Frankfurt and the Amsterdam, when performing user datagram protocol (UDP) echo tests secured using i) Datagram Transport Layer Security (DTLS), ii) OpenVPN, and iii) a QUIC-based proxy based on SSH3 [10]. To achieve a fair comparison with DTLS, we developed a custom echo server/client program to fine-tune communications and measure RTTs for each technology analyzed. This enables us to use the same UDP client/server in either a DTLS-secure mode for integrated security evaluation, or in an unsecured mode for VPN and proxy-based solutions. In industrial environments with legacy systems, VPN-based solutions are the standard for securing communication that must leave the operational technology (OT) network. They
operate at OSI level 3 (Network Layer) and are expected to be faster than external solutions operating at higher levels. Still, the efficiency of the QUIC protocol enables the development of streamlined communication technologies, such as SSH3 [10], that allow developing flexible proxying capabilities with minimum average latency increase (i.e., 2.88%) [11]. Although integrated security using DTLS performs slightly better, it requires that the same session be maintained throughout the tests. Since establishing a session can take several seconds, TLS 1.3 can be employed to speed the process thanks to 0-RTT handshake session resumption. However, this special feature is generally avoided for security reasons unless “an explicit specification exists for the application protocol in question to clarify when 0-RTT is appropriate and secure,” as is the case with HTTP/3 [12]. C. QUIC for Low-latency and Multi-path Redundancy Redundancy for critical communications has been used systematically, with dedicated hardware and protocols that increase reliability and ensure operation below maximum latency limits. However, they are not readily applicable to arbitrary deployments, as such redundancy requires planning during design phases. To address this issue, Saldana et al. [13] proposed an application-agnostic communication method that works independently of the application protocol by replicating critical datagrams multiple times, which are later filtered at the destination. This approach mitigates the disruptive effects of packet loss in unreliable environments while preserving low latency. However, it comes at the expense of additional bandwidth usage for actively replicating datagrams in blasts. Building on this idea, we explore using multipath to send these copies, further mitigating potential communication effects by introducing multipath diversity. This is achieved in a controlled manner by exploiting a proxy-based solution that allows planning the path that duplicated datagrams should follow in advance [14]. In our scheme, application-agnosticity is also preserved, i.e., datagrams are proxied at an OSI level below the application level. Furthermore, we provide security guarantees and the ability to duplicate datagrams through pre-established and secure communication paths. Our approach leverages an SSH3-based standalone proxy solution [11], which provides finer-grained access control compared to VPNs or virtual LANs (up to the process level [14]), but without having to integrate into the application layer. In this regard, the QUIC working group is developing an extension for QUIC that will support multipath natively [15]. However, it is not designed to constantly replicate datagrams across all available paths. Thus, in this work, we propose a low-latency multipath redundancy scheme using an active reflector on the sender side and a filter on the receiver side. Three paths are used as a practical minimum for path diversity and triple-modular redundancy, while keeping bandwidth overhead bounded. The approach is not limited to three paths and can be generalized to N paths, with the corresponding traffic overhead scaling as discussed in Section IV-A. This approach leverages a proxying layer, which allows a precise mapping of features into inde-
IPv4
UDP
QUIC
SSH3
Reflector
R-GOOSE
AEAD
AEAD protected QUIC security envelope
QUICQUIC-proxied Proxied security
20
8 10 2 4
Direct Direct R-GOOSE R-GOOSE
20
8
security
0
162
16
162
50
100 150 Size (Bytes)
200
250
Fig. 3. Packet structure comparison between unsecured and QUIC-TRIP secured proxied R-GOOSE communication of a 162-byte datagram.
pendent components. Specifically, i) the application generates communication datagrams using the R-GOOSE protocol every 10ms [16], ii) the reflector copies each arriving UDP datagram and appends a 4-byte label that includes a datagram number shared across each set of replicated datagrams. Then, iii) each duplicated datagram is securely proxied through different end-to-end secured communication paths. At the destination, iv) a filter maintains a counter of the set of received replicated datagrams that match the label of incoming duplicated datagrams. These datagrams are securely delivered to the filter by the stand-alone secure proxy, and the filter provides the destination-side application with only the first-arriving datagram of each set of copies (i.e., modular redundancy). D. QUIC-based Testbed Setup The Linode-based testbed is not intended to reproduce substation LAN latency, but to emulate wide-area IP transport between substation and control-center endpoints under controlled congestion. This enables repeatable evaluation of path diversity and DoS-induced delay without disrupting operational infrastructure. As shown in Fig. 1, alternative routes are selected across different datacenters to maximize resilience. We place the IED sender in the Frankfurt datacenter and consider three routes to the remote terminal unit (RTU) receiver in Amsterdam. Route 1 follows the direct path through the existing intermediate infrastructure. A Linode is placed as a standard network router (OSI Layer 3) through which all traffic to Amsterdam must pass, allowing DoS progression to be modeled by targeting this router. Routes 2 and 3 are alternative paths through the Stockholm and Milan datacenters, respectively. In each location, a Linode acts as a proxy relayer (OSI Layer 4 gateway), enabling the IED sender and RTU receiver to establish proxying sessions for secure end-to-end communication [14]. The QUIC-based proxy mechanism in Fig. 1 relies on SSH3 over QUIC for transport and security [11]. As shown in Fig. 3, the SSH3 forwarding metadata, reflector tag, and R-GOOSE datagram are carried inside the QUIC-protected payload. QUIC uses TLS 1.3 for connection establishment, authentication, and packet-protection key derivation, while encryption and authentication are applied by QUIC rather than conventional TLS records. The negotiated TLS 1.3 cipher suite selects the Authenticated Encryption with Associated Data (AEAD) algorithm, such as AES-GCM or ChaCha20Poly1305, which adds a 16-byte tag binding the encrypted
TABLE III B REAKDOWN OF THE MEASURED FORWARDING OVERHEAD WHEN COMPARED TO PLAIN R-GOOSE UNSECURED TRAFFIC Component Per-datagram expansion Extra client-to-server control traffic Server-to-client responses Total measured overhead
Overhead 16.86% 0.68% 14.64% 32.18%
payload to the QUIC header context. Packets failing AEAD verification are discarded. To evaluate the resilience of the proposed secure multipath proxying mechanism, we use a standard DoS flooding attack aimed at saturating network capacity. The first scenario targets only the intermediate infrastructure (Fig. 2), while the second also targets the proxy relayers in the alternative datacenters (Fig. 1). Because Linode is a commercial Infrastructure-as-aService (IaaS) provider, unrestricted flooding against production resources is neither appropriate nor permissible. Therefore, the router and proxy-relayer links are limited to 5 Mbps, allowing controlled stress testing without disrupting provider infrastructure or other tenants. In each attack, we evaluate the following two configurations simultaneously: 1) Non-reflected communications (Fig. 2): R-GOOSE emitter is secured through proxying without reflection through the intermediate networking infrastructure utilizing the default fastest route. 2) Reflected & Filtered communications (Fig. 1): R-GOOSE emitter is secured through our proposed reflection mechanism through three routes (intermediate infrastructure, Milan path, and Stockholm path). The fastest route (Route 1) uses the existing intermediate infrastructure where the DoS-targeted router is located. This router is shared by both configurations (since one of the redundant paths of the second configuration also flows through the intermediate infrastructure). The other two paths flow through secure communication paths established with proxy relayers running on Linodes, placed in Milan and Stockholm datacenters [14]. These paths incur higher latency, but provide redundant communication paths decoupled from the intermediate network infrastructure used in the default fastest communication path. IV. R ESULTS AND D ISCUSSION Building on the testbed and attack scenarios described above, this section evaluates QUIC-TRIP overhead and resilience. It quantifies QUIC/SSH3 proxying and reflection costs through theoretical per-datagram expansion and measured bidirectional overhead, before assessing DoSinduced latency against a non-reflected proxied baseline. A. Communication Overhead Analysis From the packet structure in Fig. 3, the forwarding overhead is estimated at 32 bytes per forwarded R-GOOSE datagram. In the traces, original IPv4-layer packets were about 189-191 bytes, compared with 221-223 bytes for the corresponding QUIC/SSH3 data-only packets, giving
Fig. 4. Attack trace to the intermediate infrastructure. Reflected traffic avoids the affected datacenter (Frankfurt). The filter processes the earliest-arriving copied datagrams (Milan datagrams).
a theoretical overhead of 16.8-16.9% per datagram. This accounts for the reflector label, SSH3 forwarding metadata, and QUIC protection, including AEAD, but excludes PINGs, ACKs, control packets, and server-to-client responses needed to maintain the QUIC/SSH3 session. Therefore, we also measured attack-free R-GOOSE traffic over 10 minutes. For 162-byte R-GOOSE datagrams, the complete added overhead was 32.18%, as described in Table III. The overhead of one proxied path is incurred on every redundant path. Therefore, relative to a single original RGOOSE communication, the total overhead for N paths is: Ototal (N ) = N (1 + Opath ) − 1, where Opath is the overhead ratio of one proxied path and N is the total number of communication paths. B. Resilience Under DoS Flooding Attacks The first flooding attack targets the router in the intermediate infrastructure used by both configurations. As shown in Fig. 4, the latency impact has three stages. First, early attack packets (0–8s) reach the attacked router, through which traffic arrives at the destination RTU in both the non-reflected configuration and one reflected path. This causes a moderate latency increase in both cases, between 10-16 ms. Then, flooding bursts accumulate in the router buffers, producing short-lived spikes of up to 100 ms in the non-reflected configuration. By contrast, the reflected-and-filtered configuration discards higher-latency datagrams when lower-latency counterparts have already arrived through alternate routes. In this example, the selected route traverses Milan, with a baseline end-to-end latency of ∼ 17 ms, while the Stockholm alternate-failover route is ∼ 22 ms. In the reflected-and-filtered configuration, QUIC provides security and ordered delivery over each proxied path, simplifying the design of the filter and reflector. This enables a highly optimized standalone implementation with minimal latency overhead (100–300 µs). During an attack, the filter forwards only the first-arriving datagram of each duplicate set to the application. It therefore does not need to handle ordering, authentication, or security checks, which are provided by QUIC, TLS 1.3, and the proxying layer.
DoS flooding, relative to the non-reflected proxied baseline, by forwarding the earliest-arriving duplicate and discarding later copies. This resilience comes with a measured communication overhead of 32.18% per enabled proxied path when securing 162-byte R-GOOSE datagrams. Future work will involve realtime co-simulation and deployment to assess the impact of communication delays on power system stability. ACKNOWLEDGMENT
Fig. 5. Attack trace to the intermediate infrastructure and alternative paths. Non-reflected traffic and reflected traffic through the infrastructure overlaps. Filter minimizes the effects by forwarding to the application only the fastest datagram of each reflected set.
However, this comes with increased bandwidth due to traffic replication as seen in Table III. The second attack extends its influence to the proxy relayers used by the securely proxied reflected datagrams. To facilitate trace analysis, flooding toward Milan’s proxy relayer is delayed by 10 s, while flooding toward Stockholm’s proxy relayer is delayed by 20 s, as shown in Fig. 5. The reflected and filtered configuration mitigates the attack by forwarding reflected datagrams that arrive faster to the destination and discarding later duplicates. If the attack continues and intensifies simultaneously across all paths, eventual increases in latency become unavoidable. Still, the multipath scheme allows new paths to be established in the background through different routes, enabling a congested proxied path to relay the reflected datagram stream to a newly established secure path. The presented multipath communication scheme provides a systematic way to control latency under attacks affecting intermediate networking infrastructures. Furthermore, it enables trading additional communication bandwidth for packet delivery assurance, which is viable in mission-critical systems with sporadic communications such as R-GOOSE. With QUIC-TRIP, it is possible to balance attack-mitigation costs against the baseline latency of the available detours. Likewise, the degree of reliability depends on the number of alternative paths, the diversity of infrastructures/datacenters involved, and the allocated bandwidth, as the QUIC-TRIP number of reflected paths can be easily extended to improve resilience. V. C ONCLUSIONS This paper introduces QUIC-TRIP, a triple-redundant reflector and filter methodology that enhances substation communication security and data-delivery resilience under adverse cyber conditions. In a UDP echo RTT benchmark over the Frankfurt-Amsterdam Linode path, the SSH3/QUIC proxy showed lower average RTT than OpenVPN and was only 2.88% higher than integrated DTLS 1.2 with session reuse. This low RTT overhead motivated its use as a feasible substrate for QUIC-TRIP, enabling transparent multipath delivery through active reflection and filtering. In the RGOOSE testbed, the scheme reduced the latency impact of
This work is funded in part by the National Science Foundation (NSF) Award Number #2501975. This work is supported in part by the European Union’s Horizon Europe research and innovation programme under the Marie Skłodowska-Curie Actions grant agreement No. 101149974 (Project CMXsafe). R EFERENCES [1] I. Zografopoulos et al., “Cyber-physical interdependence for power system operation and control,” IEEE Transactions on Smart Grid, vol. 16, no. 3, pp. 2554–2573, 2025. [2] G. Liang et al., “A review of false data injection attacks against modern power systems,” IEEE Transactions on Smart Grid, vol. 8, no. 4, pp. 1630–1638, 2016. [3] J. D. de Hoz Diego, “UDP Reflector Testbed: Udp reflector and filter testbed,” https://github.com/jdhozdiego/udp-reflector-testbed, 2025. [4] IEEE P1815 Working Group, “Draft Standard for DNP3 Secure Authentication Version 6,” IEEE, Tech. Rep., 2025, draft; access restricted via IEEE SA. [5] SunSpec Alliance, “Sunspec modbus interface specification and information models for distributed energy resources,” SunSpec Alliance, Tech. Rep., 2026, includes Device Information Model, DER Information Model, and SunSpec Modbus IEEE 1547-2018 profile. [Online]. Available: https://sunspec.org/specifications/ [6] IEEE Power and Energy Society, IEEE Standard for Smart Energy Profile Application Protocol, Institute of Electrical and Electronics Engineers (IEEE) Std. IEEE Std 2030.5-2023, 2023. [Online]. Available: https://standards.ieee.org/ieee/2030.5/11216/ [7] I. Zografopoulos et al., “Cyber-physical energy systems security: Threat modeling, risk assessment, resources, metrics, and case studies,” IEEE Access, vol. 9, pp. 29 775–29 818, 2021. [8] I. Zografopoulos, A. P. Kuruvila, K. Basu, and C. Konstantinou, “Time series-based detection and impact analysis of firmware attacks in microgrids,” Energy Reports, vol. 8, pp. 11 221–11 234, 2022. [9] L. Linode, “Global infrastructure,” 2025, accessed: 2025-03-16. [Online]. Available: https://www.linode.com/global-infrastructure/ [10] F. Michel and O. Bonaventure, “Towards ssh3: How http/3 improves secure shells,” 2023. [Online]. Available: https://arxiv.org/abs/2312.08396v1 [11] J. D. de Hoz Diego, I. Zografopoulos, and A. Jurcut, “Let’s get QUIC: Securing IP-based industrial protocols by proxying,” in Proceedings of the IEEE Consumer Communications and Networking Conference (CCNC), Las Vegas, NV, USA, Jan. 2026, to appear. [12] Y. Sheffer, P. Saint-Andre, and T. Fossati, “Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS),” Nov. 2022. [Online]. Available: https://www.rfc-editor.org/info/rfc9325 [13] J. Saldana et al., “Fast and reliable sending of generic object oriented substation event frames between remote locations over loss-prone networks,” Sensors, vol. 23, no. 21, 2023. [14] J. D. de Hoz Diego, T. Madi, and C. Konstantinou, “Cmxsafe: A proxy layer for securing internet-of-things communications,” IEEE Trans. on Information Forensics and Security, vol. 19, pp. 5767–5782, 2024. [15] Y. Liu et al., “Multipath extension for quic,” IETF, Internet-Draft draftietf-quic-multipath-16, 2025, work in Progress. [Online]. Available: https://datatracker.ietf.org/doc/draft-ietf-quic-multipath/16/ [16] S. Hussain et al., “End-to-end performance evaluation of r-sv / r-goose messages for wide area protection and control applications,” in 2023 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT), 2023, pp. 1–5.