UNDERSTANDING AND MITIGATING THE IMPACTS OF GPS/GNSS VULNERABILITIES - - PowerPoint PPT Presentation

▶
understanding and mitigating the
SMART_READER_LITE
LIVE PREVIEW

UNDERSTANDING AND MITIGATING THE IMPACTS OF GPS/GNSS VULNERABILITIES - - PowerPoint PPT Presentation

Nov 13, 2022 222 likes •401 views

ANNUAL INDUSTRY WORKSHOP NOVEMBER 6-7, 2013 UNDERSTANDING AND MITIGATING THE IMPACTS OF GPS/GNSS VULNERABILITIES NOVEMBER 2013 T.W. GEHRELS J.J. MAKELA, X. JIANG, A. DOMINGUEZ-GARCIA,G. GAO, R. BOBBA UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN

slide-1
SLIDE 1

ANNUAL INDUSTRY WORKSHOP NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.ORG

UNIVERSITY OF ILLINOIS | DARTMOUTH COLLEGE | UC DAVIS | WASHINGTON STATE UNIVERSITY

FUNDING SUPPORT PROVIDED BY DOE-OE AND DHS S&T

1

UNDERSTANDING AND MITIGATING THE IMPACTS OF GPS/GNSS VULNERABILITIES T.W. GEHRELS

J.J. MAKELA, X. JIANG, A. DOMINGUEZ-GARCIA,G. GAO, R. BOBBA

UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN NOVEMBER 2013

slide-2
SLIDE 2

2

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

MOTIVATION

  • PMUs are increasingly prevalent in power systems

– New opportunities in protection and control

  • GPS receivers used as a timing source for synchronization

– GPS timing signals are nanosecond accurate – GPS signal freely available

  • GPS receiver clock offset will cause error in the PMU’s

phase angle measurements

  • Error will be passed through PMU dependent algorithms

– Voltage stability algorithm – Fault impedance computation – Fault location algorithm

slide-3
SLIDE 3

3

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

GPS VULNERABILITY

  • The civilian GPS signal is unencrypted and highly

predictable

  • Simulated GPS signal can be generated that has the

same signal structure as the authentic signals

  • Development of attacks allows for better understanding of

vulnerabilities – Design effective detection and mitigation techniques

slide-4
SLIDE 4

4

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

TYPES OF GPS RECEIVER ATTACKS

  • Signal level attack / replay attack

– Change timing of signal, causing error in range measurements – Receiver position & clock offset not easily specified

  • Data level attack to cause crash

– Induce divide by zero, increment week number irreversibly – Non-stealth attack

  • Subtle data level attack

– Cause error in timing while still appearing to function normally – All encoded data remain realistic values – Receiver position change bounded to value of normal variation – Motivates the development of a more comprehensive, multi-layer detection scheme

slide-5
SLIDE 5

5

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

OVERVIEW OF VULNERABILITY EXPLOITATION

  • 1. Calculate the changes to the data contained in

the GPS signals that will:

  • Induce the maximum possible receiver clock offset
  • Not cause a significant change to the calculated

receiver location

  • 2. Take over tracking loops of the GPS unit using

spoofed signals

  • PMUs are at known locations, making the attack

easier than for a dynamic target

  • Demonstrated by Humphreys et al.
  • 3. Inject rogue data into the GPS unit and have it

accepted as legitimate data

  • Introduce the calculated clock offset
slide-6
SLIDE 6

6

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

OVERVIEW OF VULNERABILITY EXPLOITATION

  • 1. Calculate the changes to the data contained in

the GPS signals that will:

  • Induce the maximum possible receiver clock offset
  • Not cause a significant change to the calculated

receiver location

  • 2. Take over tracking loops of the GPS unit using

spoofed signals

  • PMUs are at known locations, making the attack

easier than for a dynamic target

  • Demonstrated by Humphreys et al.
  • 3. Inject rogue data into the GPS unit and have it

accepted as legitimate data

  • Introduce the calculated clock offset
slide-7
SLIDE 7

7

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

MAXIMIZING RECEIVER CLOCK OFFSET

  • A nonlinear optimization problem that maximizes

the receiver clock offset (phase measurement error) through perturbation of the satellite ephemerides

  • Decision variables

– satellites’ ephemeris

  • Objective function

– receiver clock offset

  • Constraints

– bounds on the satellites’ ephemerides – bounds on change to the computed receiver position

slide-8
SLIDE 8

8

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

GPS CLOCK BIAS SIMULATION

Clock offset

(objective function)

Perceived position

(constraint) Time of attack

Phase angle

(impact)

slide-9
SLIDE 9

9

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

MAXIMIZING RECEIVER CLOCK OFFSET

  • A nonlinear optimization problem that maximizes

the receiver clock offset (phase measurement error) through perturbation of the satellite ephemerides

  • Decision variables

– satellites’ ephemeris

  • Objective function

– receiver clock offset

  • Constraints

– bounds on the satellites’ ephemerides – bounds on change to the computed receiver position

slide-10
SLIDE 10

10

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

MAXIMIZING RECEIVER CLOCK OFFSET

  • A nonlinear optimization problem that maximizes

the receiver clock offset (phase measurement error) through perturbation of the satellite ephemerides

  • Decision variables

– satellites’ ephemeris

  • Objective function

– receiver clock offset

  • Constraints

– bounds on the satellites’ ephemerides – bounds on change to the computed receiver position User defined!

slide-11
SLIDE 11

11

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

OVERVIEW OF VULNERABILITY EXPLOITATION

  • 1. Calculate the changes to the data contained in

the GPS signals that will:

  • Induce the maximum possible receiver clock offset
  • Not cause a significant change to the calculated

receiver location

  • 2. Take over tracking loops of the GPS unit using

spoofed signals

  • PMUs are at known locations, making the attack

easier than for a dynamic target

  • Demonstrated by Humphreys et al.
  • 3. Inject rogue data into the GPS unit and have it

accepted as legitimate data

  • Introduce the calculated clock offset
slide-12
SLIDE 12

12

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

IMPLEMENTATION TESTBED

Oscilloscope NI Signal Generator Desktop CPU GPS receiver

Spoofed signal Signal control Position data 1 PPS Timing (Spoofed) 1k PPS Timing (True) GPS simulator Receiver data

slide-13
SLIDE 13

13

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

RESULTS – PASSING FALSE EPHEMERIS

  • True ephemeris

received at t = -120 s

  • Modified ephemeris

values at t = 0 s

  • Modified ephemeris

accepted by receiver

  • New values result in

change in perceived receiver position

slide-14
SLIDE 14

14

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

RESULTS – INDUCING CLOCK OFFSET

8 3

  • 2
  • 7

x position (m)

  • 100
  • 200
  • 300
  • 400
  • 500

Clock offset (µs)

  • No jump in position
  • Meets bounding

constraints from derivation Time of attack

  • Clock offset: 500 µs
  • Phase offset: 10.8o
slide-15
SLIDE 15

15

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

EFFECT OF SPOOFING

  • Applications dependent on PMUs are vulnerable to spoofing

– Fault identification algorithms – Equivalent network calculations – Stability monitoring algorithms

  • Theoretical demonstration of voltage stability monitoring

algorithm

𝑎 𝑢ℎ = 𝑊 𝑢2 − 𝑊 𝑢1 𝐽 𝑢1 − 𝐽 𝑢2 𝑎 𝑢ℎ = 𝑊 𝑢2 𝑓𝑘ε𝜄 − 𝑊 𝑢1 𝐽 𝑢1 − 𝐽 𝑢2 𝑓𝑘ε𝜄 True Spoofed

slide-16
SLIDE 16

16

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013

TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G

MITIGATION

  • Software

– Check position against known PMU location – Monitor signal power, quality – Intelligent filtering of the PMU data – Check time against reference clock

  • Network

– Check ephemerides against external archives (e.g., IGS) – Cross-correlation of military P(Y) code amongst GPS receiver.

  • Hardware

– Narrow-band tracking loop, since PMUs are static – Multi-receiver vector tracking loops – Reverse-calculate satellite positions by trilateration from multiple receivers, compare to received ephemerides

Complexity