GPS World, August 2012

TIMING Infrastructure Going Up Against Time The Power Grids Vulnerability to GPS Spoofing Attacks Spoofing tests against phasor measurement units demonstrate their vulnerability to attack A generator trip in an automatic control scheme could be falsely activated by the GPS spoofing possibly leading to cascading faults and a large scale power blackout Daniel P Shepard Todd E Humphreys and Aaron A Fansler A V HOHFWULF SRZHU JULGV FRQWLQXH WR H SDQG WKURXJKRXW WKH ZRUOG DQG DV WUDQVPLVVLRQ OLQHV DUH SXVKHG WR WKHLU RSHUDWLQJ OLPLWV WKH G QDPLF RSHUDWLRQ RI WKH SRZHU V VWHP KDV EHFRPH D VHULRXV FRQFHUQ DQG LQFUHDVLQJO GLIILFXOW WR DFFXUDWHO PRGHO 0RUH HIIHFWLYH UHDO WLPH V VWHP FRQWURO LV QRZ VHHQ DV NH WR SUHYHQWLQJ ZLGH VFDOH FDVFDGLQJ RXWDJHV OLNH WKH 1RUWKHDVW ODFNRXW RU HDUV HOHFWULF SRZHU FRQWURO FHQWHUV KDYH HVWLPDWHG WKH VWDWH RI WKH SRZHU V VWHP WKH SRVLWLYH VHTXHQFH YROWDJH PDJQLWXGH DQG SKDVH DQJOH DW HDFK QHWZRUN QRGH IURP PHDVXUHPHQWV RI SRZHU IORZV XW IRU LPSURYHG DFFXUDF LQ WKH VR FDOOHG SRZHU V VWHP VWDWH HVWLPDWHV LW ZLOO EH QHFHVVDU WR IHHG H LVWLQJ HVWLPDWRUV ZLWK D ULFKHU PHDVXUHPHQW HQVHPEOH RU WR PHDVXUH WKH JULG VWDWH GLUHFWO OWHUQDWLQJ FXUUHQW TXDQWLWLHV KDYH EHHQ DQDO HG IRU RYHU HDUV XVLQJ D FRQVWUXFW GHYHORSHG E KDUOHV 3URWHXV 6WHLQPHW LQ NQRZQ DV D SKDVRU Q SRZHU V VWHPV WKH SKDVRU FRQVWUXFW KDV FRPPRQO EHHQ XVHG IRU DQDO LQJ TXDQWLWLHV DVVXPLQJ D FRQVWDQW IUHTXHQF UHODWLYHO QHZ V QFKURQL DWLRQ WHFKQLTXH ZKLFK DOORZV UHIHUHQFLQJ PHDVXUHG FXUUHQW RU YROWDJH SKDVRUV WR DEVROXWH WLPH KDV EHHQ GHYHORSHG DQG LV FXUUHQWO EHLQJ LPSOHPHQWHG WKURXJKRXW WKH ZRUOG 7KH PHDVXUHPHQWV SURGXFHG E WKLV WHFKQLTXH DUH NQRZQ DV V QFKURQL HG SKDVRU PHDVXUHPHQWV RU V QFKURSKDVRUV 6 QFKURSKDVRUV SURYLGH D UHDO WLPH VQDSVKRW RI FXUUHQW DQG YROWDJH DPSOLWXGHV DQG SKDVHV DFURVV D SRZHU V VWHP DQG VR FDQ FIGURE 1 Block diagram of the University of Texas spoofer used to attack the phasor unit JLYH D FRPSOHWH SLFWXUH RI WKH VWDWH RI D SRZHU V VWHP DW DQ LQVWDQW LQ WLPH 7KLV PDNHV V QFKURSKDVRUV XVHIXO IRU FRQWURO PHDVXUHPHQW DQG DQDO VLV RI WKH SRZHU V VWHP GHYLFH XVHG WR PHDVXUH V QFKURSKDVRUV LV FDOOHG D SKDVRU PHDVXUHPHQW XQLW 308 Q D W SLFDO GHSOR PHQW 308V DUH LQWHJUDWHG LQ SURWHFWLYH UHOD V DQG DUH VDPSOHG IURP ZLGHO GLVSHUVHG ORFDWLRQV LQ WKH SRZHU V VWHP QHWZRUN 7KH DUH V QFKURQL HG ZLWK UHVSHFW WR WKH FRPPRQ WLPH VRXUFH RI D 36 FORFN 308V EDVLFDOO PHDVXUH YROWDJH RU FXUUHQW DQG DEVROXWH SKDVH DQJOHV DW VHOHFWHG ORFDWLRQV LQ DQ HOHFWULF WUDQVPLVVLRQ RU GLVWULEXWLRQ V VWHP GPS Spoofing 36 VSRRILQJ LV WKH DFW RI SURGXFLQJ D IDOVLILHG YHUVLRQ RI WKH 36 VLJQDO ZLWK WKH JRDO RI WDNLQJ FRQWURO RI D 36 UHFHLYHU V SRVLWLRQ YHORFLW WLPH 397 VROXWLRQ 7KLV LV PRVW HIIHFWLYHO DFFRPSOLVKHG ZKHQ WKH VSRRIHU KDV NQRZOHGJH RI WKH 36 VLJQDO DV VHHQ E WKH WDUJHW UHFHLYHU VR WKDW WKH VSRRIHU FDQ SURGXFH D PDWFKHG IDOVLILHG YHUVLRQ RI WKH VLJQDO Q WKH FDVH RI PLOLWDU VLJQDOV WKLV W SH RI DWWDFN LV QHDUO LPSRVVLEOH EHFDXVH WKH PLOLWDU VLJQDO LV HQFU SWHG DQG WKHUHIRUH XQSUHGLFWDEOH 2Q WKH RWKHU KDQG WKH FLYLO 36 VLJQDO LV SXEOLFO NQRZQ DQG UHDGLO SUHGLFWDEOH Q UHFHQW HDUV FLYLO 36 VSRRILQJ LV EHFRPLQJ UHFRJQL HG DV D VHULRXV WKUHDW WR PDQ FULWLFDO LQIUDVWUXFWXUH DSSOLFDWLRQV ZKLFK UHO KHDYLO RQ WKH SXEOLFO NQRZQ FLYLO 36 VLJQDO QXPEHU RI SURPLVLQJ PHWKRGV DUH FXUUHQWO EHLQJ GHYHORSHG WR GHIHQG DJDLQVW FLYLO 36 VSRRILQJ DWWDFNV EXW LW ZLOO VWLOO WDNH D QXPEHU RI HDUV EHIRUH WKHVH WHFKQRORJLHV PDWXUH DQG DUH LPSOHPHQWHG RQ D ZLGH VFDOH XUUHQWO WKHUH LV D FRPSOHWH DEVHQFH RI DQ RII WKH VKHOI GHIHQVH DJDLQVW D 36 VSRRILQJ DWWDFN 6HH GENERATION TRANSMISSION VLGHEDU IRU EDFNJURXQG RQ WKH IROORZLQJ WHVWV The Tests 7KH PLQLPXP WKUHVKROG IRU VXFFHVV ZDV WR VKRZ WKDW D 36 VSRRIHU GPS World August 2012 www gpsworld com 34