Power protectors: Charlotte’s Meera Sridhar and CESAR team lead in grid cybersecurity

Meera Sridhar, associate professor of software and information systems in UNC Charlotte’s College of Computing and Informatics, has devoted her career to safeguarding the systems that power the lives of the billions of people around the world who depend on electricity to work, play and live in comfort.

While keeping the lights on has never been a simple task, it’s only gotten more complicated. Thanks to the explosive proliferation of internet of things devices like voice-powered assistant devices Amazon Alexa and Google Home as well as other web-powered smart home devices like electric vehicle charging stations and home solar panel hookups, the average person has more devices than ever before connected to both the internet and the electrical infrastructure built upon our power grids.

“Now, all of a sudden, you have these ‘edge devices’ which are internet-connected and therefore vulnerable to attacks that are also connected to the grid,” Sridhar said. She explained how clever hackers could take advantage of these vulnerabilities, with the capability of causing widespread blackouts through distributed cyberattacks.

“With the rapid advancement of AI, everything is becoming AI-integrated, including a lot of these power system devices,” Sridhar said. “That introduces a whole new slew of attack vectors.”

Sridhar joined UNC Charlotte 11 years ago, upon completing her doctoral studies at the University of Texas at Dallas. Her main area of expertise is in systems and software security, with a strong specialization in formal methods, the ways that advanced math is used to prove high-assurance failure-proof security properties in software.

CESAR’S START

Back in 2014, as IoT smart home devices grew in popularity, Sridhar helped establish the college’s Smart Home IoT Lab, creating a dedicated testing ground for evaluating these web-enabled consumer devices and any cybersecurity vulnerabilities they may have. In the intervening years, the potential vulnerabilities presented by the widespread adoption of these devices only grew, as did cybercriminals’ ability and interest in disrupting them. The need to invest in this type of research became more apparent with each passing day.

In 2023, Sridhar collaborated with faculty in the college and the William States Lee College of Engineering’s Energy Production and Infrastructure Center, or EPIC, and with N.C. State and N.C. A&T partners to secure a North Carolina Research Opportunities Initiative grant from the state aimed at advancing North Carolina’s energy security research capabilities. That grant led to CESAR’s official founding in 2023, and thus began the research center’s efforts to inform the world’s growing need for clean, secure energy sources.

As CESAR’s principal investigator and director, Sridhar works hand in hand with college cybersecurity faculty and EPIC partners, including executive director and the Duke Energy Distinguished Scholar in Power Engineering Systems Robert Cox, to solve crucial problems that affect power grid safety. Along with N.C. A&T and N.C. State faculty partners, CESAR employs and trains dozens of graduate students in both engineering and computing disciplines, giving them real-world experience in devising complex power grid safety solutions.

Real-World Risks and Partnerships

Take residential solar panels, for example. In order to connect to the power grid, solar panels use devices called photovoltaic inverters, which are also typically connected to the internet to offer users additional functionality and flexibility. “What hackers can do is they can exploit vulnerabilities in that gateway or the inverter, and they can do it at scale,” Sridhar said.

“If they can do that, they can switch off and on, let’s say, a million homes at once. And that can really impact the grid. That can cause blackouts,” she said.

In addition to devising methods to shore up vulnerabilities like this, CESAR actively partners with prominent private- and public-sector organizations involved in electricity creation and distribution to solve their needs related to power grid security.

One current collaboration involves the American nonprofit Electric Power Research Institute and tech giant NVIDIA, whose data processing units, or DPUs, are used by EPRI to advance threat detection efforts within critical electrical infrastructure systems. Sridhar and her CESAR team play the role of the “red team” hackers, attacking the DPUs to try to uncover hidden vulnerabilities in closed environments to prevent them from exploitation in the real world. Another EPRI project involves building a “digital twin” of a widely used gas turbine system used in power generation systems in order to test their cybersecurity capabilities.

Training Future Security Leaders

On top of their graduate student research team, CESAR and Sridhar routinely offer research opportunities to enterprising undergraduates seeking to learn more about hands-on grid security research from both electrical engineering and cybersecurity backgrounds. Through dedicated special topics course offerings taught in conjunction with engineering faculty and ongoing programs like NSF’s summer Research Experience for Undergraduates program, Sridhar is intentional about devoting time to spreading the love of research to as many students as possible.

These students don’t just gain a love of solving tricky problems with real-world impact. They’re also prepared for increasingly growing job opportunities in the world of power grid security that will only grow in the years ahead.

“We have a lot of industry here in Charlotte that is very interested in our work,” Sridhar said, “and we’ve also gotten a lot of awareness at the federal level. The fact is, being in the Charlotte region is very important for us. We’re not just ivory-tower theorists solving academic problems: Our research and problem-solving is driven by industry, government and national security needs.”

Written by Schaefer Edwards