Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Synchrophasor Timing Security

739 views

Published on

2012 Technologies for Security and Compliance Summit
August 1, 2012

Published in: Business, Technology
  • Be the first to comment

  • Be the first to like this

Synchrophasor Timing Security

  1. 1. Synchrophasor Timing Security Todd Humphreys | Aerospace Engineering The University of Texas at Austin 2012 Technologies for Security and Compliance Summit | August 1, 2012
  2. 2. • University of Texas Radionavigation Lab graduate students Jahshan Bhatti, Kyle Wesson, Ken Pesyna, Zak Kassas, and Daniel Shepard • Mark Psiaki, Brady O’Hanlon, Ryan Mitch (Cornell) • Brent Ledvina (Coherent Navigation) • Aaron Fansler (Northrop Grumman) Acknowledgements
  3. 3. UTC Hours MetersError 4:00 AM May 2, 2000
  4. 4. GPS Jammers
  5. 5. GPS Spoofer
  6. 6. GPS Spoofer
  7. 7. GPS Spoofer
  8. 8. GPS Spoofer
  9. 9. GPS Spoofer
  10. 10. GPS Spoofer
  11. 11. University of Texas Spoofing Testbed
  12. 12. UAV Video
  13. 13. • PMUs are smart grid technology used to measure “synchrophasors,” standard voltage and current phasors referenced to an absolute time reference • State estimation (using power flow meters)  state measurement • Synchrophasors must be measured simultaneously • PMU time synchronization provided by GPS time reference receivers Phasor Measurement Units
  14. 14. • Demonstrate that the IEEE C37.118 Standard “Synchrophasors for Power Systems” can be broken by a spoofer – Defines required accuracy as <1% Total Vector Error (TVE), where – Violated once the timing has been altered by 26.5 µs (0.573o phase angle difference) • Show that spoofing can affect PMU-based control schemes PMU Test Goals
  15. 15. Test Setup: PNNL Dec. 2011
  16. 16. Test Results • Phase angle difference should nominally be 0, since the PMUs were in the same room • Points 1-5 on the plot indicate benchmarks in the test • The phase angle difference is greater than 70 degrees after half an hour
  17. 17. Test Results (cont’d)  Point 1: Start of the test shows time and phase alignment between PMUs  Left plot shows Pulse-Per-Second output from receivers with the reference in yellow  Right plot shows phase angle from the PMUs with the reference in red
  18. 18. Test Results (cont’d)  Point 2: 620 seconds into the test  2 µs time offset has been introduced  Receiver is considered fully capture at this point  Spoofer-induced time rate begins accelerating
  19. 19. Test Results (cont’d)  Point 3: 680 seconds into the test  Spoofer has broken the IEEE C37.118 Standard  A 26.5 µs timing offset and a 0.573 degree phase angle offset have been introduced
  20. 20. Test Results (cont’d)  Point 5: 1370 seconds into the test  A 2 ms timing offset and a 45 degree phase angle offset have been introduced  Spoofed signals removed  The receiver’s time offset continued to increase anyways
  21. 21. Example Vulnerability • PMUs are being pushed for both automated and human-in- the-loop power grid control • Currently operational system in Mexico using automated PMU-based control on the Chicoasen-Angostura transmission line: – Connects hydroelectric generators to large loads – Two 400-kV lines and one 115-kV line – Protects against generator instability caused by double fault by shutting down generators if phase angle difference exceeds 10 degrees • Spoofing could cause this system to falsely trip in a matter of minutes
  22. 22. Summary of Findings • A spoofing attack can cause PMUs to violate the IEEE C37.118 Standard • Large phase angle offsets can be induced in a matter of minutes (>10 degrees) • These effects can have significant impacts on PMU- based power grid control systems • Local PMU-driven automated control is most vulnerable (e.g., Chicoasen-Angostura system)
  23. 23. radionavlab.ae.utexas.edu

×