Review of Deployable Endogenous Security Technologies for Smart Grids
1000-3428
Abstract
The smart grid is a critical infrastructure in the modern energy system that couples cyberspace with physical operation processes, and it has become a key pillar of national energy security. With the widespread use of massive heterogeneous devices such as distributed energy resources, energy storage systems, and smart meters, the "cloud—network—edge—terminal" collaborative architecture has become the mainstream paradigm. However, the continuous evolution of attack techniques has led to increasingly frequent cyberattacks targeting Supervisory Control and Data Acquisition (SCADA) systems, intelligent terminals, and communication networks. The inherent lag of conventional ″patch-and-block″ passive defense techniques and their dependence on prior knowledge cause difficulty in effectively countering security threats deeply embedded in system architectures and operational processes. Endogenous security issues caused by inherent defects such as vulnerabilities and backdoors in information systems cannot easily be completely eliminated during the design and development phases; this creates a fundamental bottleneck that restricts the improvement of smart grid security protection capabilities. To address these issues, this paper systematically reviews endogenous security technologies that can be deployed in smart grids. First, the six major threats facing smart grids—supply-chain attacks, vulnerability exploit attacks, Distributed Denial of Service/Denial of Service (DDoS/DoS) attacks, data tampering and forgery attacks, physical and side-channel attacks, and Advanced Persistent Threats (APTs)—are considered as research entry points. Typical entry points, impact levels, and the technical difficulties and limitations of traditional defenses for each type of attack are analyzed, combined with the Smart Grid Architecture Model (SGAM) and typical attack cases. The analysis reveals that the direct sources of most attacks are concentrated at the component and communication layers, and that the attack impacts can propagate across layers. Second, according to core functional positioning, deployable endogenous security technologies are categorized into attack-resistant and trusted authentication technologies. Attack-resistant technologies include software diversification, Dynamic Heterogeneous Redundancy (DHR), Physical Unclonable Function (PUF)-based authentication mechanisms, and attack-resistant routing, while trusted authentication technologies include zero-trust architecture, trusted computing, and quantum-secure trusted authentication. This paper systematically reviews the research progress, defense objectives, operational layers, and verification results of these seven technologies based on their working mechanism, applicable threats, deployment layers, performance overhead, and engineering conditions. It also summarizes the applicable conditions and main limitations of each technology. The review reveals five key findings. First, a single endogenous security technology usually acts on only partial segments of an attack chain and cannot independently cope with composite attacks such as APTs. The key to multi-technology collaboration lies in clarifying the division of labor according to attack phases and the sharing of information such as identities, device statuses, abnormal outputs, and network statuses. Follow-up research should evaluate collaboration effectiveness using metrics such as attack chain blocking rate, false judgment rate, worst-case latency, and recovery time. Second, most existing technical solutions are still in the prototyping, simulation, or small-scale verification stages, and large-scale deployment verification has not been performed in real smart grid scenarios, where performance overhead and real-time constraints are key obstacles to technology implementation. Third, supply chain security is the foundation for the reliable operation of endogenous security technologies. Software diversification relies on a trusted compilation chain, while dynamic heterogeneous redundancy relies on trusted execution body sources, and zero-trust and trusted computing solutions rely on accurate asset and firmware information. Accordingly, a closed-loop process from component identification and integrity verification to anomaly response should be established. Fourth, Artificial Intelligence (AI) can assist endogenous security detection and authentication, but both recognition capability and model security must be considered. Evaluations should simultaneously report detection performance, inference latency, resource overhead, and update mechanisms. Fifth, quantum security technologies should be migrated progressively according to their current development status. Post-Quantum Cryptography (PQC) can be prioritized for deployment via pure software solutions with cryptographic agility mechanisms, while Quantum Key Distribution (QKD) can be used for priority application in fixed high-value links.