Improved Jamming Resilience of GPS Timing for Phasor Measurement Units using Position-Information-Aided Vector Tracking

Transcription

1 1 Improved Jamming Resilience of GPS Timing for Phasor Measurement Units using Position-Information-Aided Vector Tracking Sriramya Bhamidipati, and Grace Xingxin Gao, Senior Member, IEEE Abstract In recent years, there has been a major push by the power industry to utilize Phasor Measurement Units (PMUs) for wide area monitoring and control. PMUs rely on Global Positioning System (GPS) to provide absolute time reference necessary to obtain synchronized phasor measurements. However, due to the low received signal strength and unencrypted nature of the civil GPS signals, PMU reliability is susceptible to both nonmalicious and malicious interference. To ensure the power grid stability, we aim to develop a robust GPS time transfer technique for PMUs. In this paper, we propose our Position-Information-Aided Vector Tracking (PIAVT), which leverages the inherent static properties of the GPS receiver to aid the underlying vector tracking loop. Vector tracking evaluates the closed feedback loop based navigation solution estimation thereby enhancing the tracking capability of the weak satellite channels. To demonstrate the impact of external jamming attack and accidental receiver malfunction on PMUs, we firstly conduct validation tests using Real-Time Digital Simulator (RTDS) with IEEE C Standard as reference. We then conduct field experiments to verify that the proposed PIAVT approach 1) enhances the robustness of GPS receiver against jamming and interference; and 2) is able to account for the satellite data anomalies and receiver errors. Later, we mimic the setup of power grid using Universal Software Radio Peripheral (USRP), hardware PMUs, RTDS to validate the increased robustness of PIAVT against external GPS attacks as compared to the conventional approach. Keywords Phasor Measurement Unit, Real time Digital Simulator, Power Systems, GPS, Jamming, Vector Tracking. I. INTRODUCTION Currently, power grids employ Supervisory Control And Data Acquisition (SCADA) system for collecting and monitoring the electrical wave observations for Wide Area Monitoring Systems (WAMS) [1]-[2]. The SCADA system generally polls the information from remote sites once every few seconds for critical systems and up to a few minutes for non-critical systems [3]. During system disturbances, the information collected by SCADA does not accurately represent the system and therefore the states cannot be precisely estimated [4]. A. Phasor Measurement Units While the current power grids depend on SCADA, the upcoming smart grid require more advanced devices with improved state estimations and sampling rates. Phasor Measurement Units (PMUs) are the devices that provide precise voltage and current measurements at frequencies up to 60 Hz. The high frequency measurements collected by PMUs are capable of providing the control stations with information at sub-second time frames, thereby allowing dynamic state measurements of the power system [5]-[6]. Fig. 1 illustrates the difference in measurements collected using the SCADA system and PMU during a voltage disturbance in a power grid in Oklahoma [7]. For this disturbance, the SCADA system displayed a delayed detection time of around 30 s and only updates the states once every few minutes. These values may change depending on the system and the collection points but even the most ideal SCADA system can collect a single sample in the time a PMU can collect upto hundreds. Fig. 1: Voltage comparison between SCADA and PMU during a disturbance [7]. SCADA measurements show a significant delayed detection time compared to PMU measurements. Robust PMU measurements pave the way for efficient energy distribution, improved grid resistance, robustness to disturbances, and decreased event response times. While PMU usage has rapidly increased in the recent years [8], these PMUs have yet to replace the SCADA system for automatic control of the power systems [9]. This is largely delayed due to the fact that PMUs are not yet fully secure against cyber and timing based attacks. For absolute time reference, PMUs rely on GPS to obtain synchronized phasor measurements. GPS provides up to µslevel accurate timing, has global coverage and is free to all users. However, due to the low received signal strength and un-encrypted nature of the civil GPS signals, PMUs are susceptible to external timing attacks. It has been demonstrated that the attack on PMUs can induce timing errors leading to destabilizing or unnecessary control responses from an automated system [10]. Since the security and stability of the power grid plays a crucial role, the GPS timing for PMU must be robust to any kind of external attacks and interference [11].

2 2 B. Background of GPS GPS is designed as a satellite-based radio navigation system that provides Position, Velocity, and Time (PVT) information to any GPS receiver [12]. Each satellite in the GPS constellation is equipped with multiple network synchronized atomic clocks. Given this, the user receiver can effectively synchronize to the satellite atomic clocks for near µs level accurate time, without incurring the cost of owning an atomic clock [13]. GPS receivers require a minimum of four or more satellites in view to calculate the unknown 3-Dimensional (3D) user position and clock bias. 1) Estimation of PVT navigation solution Most commonly used civilian GPS signals broadcast at L1 = MHz frequency and are modulated with publicly known pseudo-random noise (PRN) codes and the navigation message. By tracking the code frequency ( fcode i ) and phase (φcode i ) of the ith satellite, the corresponding signals are decoded and used to determine the signal travel time (ttravel i ), satellite positions (S i ), and the satellite clock biases (Tb i ). The pseudorange (ρ i ) which represents the distance between the user receiver and the i th satellite can then be calculated as ρ i = c ttravel i. Once the pseudorange, satellite positions, and satellite clock biases are known, we implement tri-lateration [14] using Newton-Raphson method or least-squares technique to determine the user location: ρ i = ((xs i x) 2 + (y i s y) 2 + (z i s z) 2 + c(t b Tb i ) + εi (1) where S i = (xs,y i i s,z i s) is the 3D position of the i th satellite, X = (x,y,z) is the 3D position of the user receiver, T b is the receiver clock bias and ε i is the range measurement error. Given that we have 4 or more satellites in view, the four unknowns (X and T b ) can be solved by minimizing ε i. loop. Vector tracking enhances performance by enabling closed loop information flow between the channels [18]. C. IEEE-C Standard for Synchrophasors PMU measurements are to be synchronized to UTC time with accuracy that meets the accuracy requirements of IEEE- C Standard [19]-[21]. A phase error of 0.01 rad (0.57 ) in the PMU measurements causes 1% total vector error (TVE), which is the maximum steady-state error allowed. A 0.01 rad phase error corresponds to a time error of ±26 µs for a 60 Hz system, and ±31 µs for a 50 Hz system. D. Effect of GPS Vulnerabilities on PMUs GPS vulnerabilities have a direct impact on the smooth functioning of PMUs which in turn effect the stability of the power grid. The weak signal strength and un-encrypted nature of the civil GPS signals leave receivers at risk for external interference which potentially alters the position and timing accuracy of the GPS receivers. Different types of external disturbances are explained as follows: 1) Unintentional interference: There are many sources of unintentional interference to GPS signals [22], such as naturally occurring electromagnetic (EM) fields [23]-[25], solar flares [26], and other navigational systems that shares part of the GPS band [27]. 2) Jamming: As shown in Fig.2(a), a jammer transmits high-powered signals in the GPS frequency band which effectively raises the noise floor and prevents a user receiver from acquiring and tracking the GPS signal [28]-[30]. In the case of jamming and unintentional interference, the GPS time becomes completely unavailable for PMUs. 2) Scalar and Vector Tracking Loop Tracking loops play a critical role in continuously tracking the dynamically changing code ( fcode i, φ code i ) and carrier ( fcarr, i φcarr) i parameters of the incoming GPS signal. However, the code and carrier tracking loops are vulnerable to low signal-to-noise ratio (SNR) and high dynamics [15]. In a traditional GPS receiver, acquisition is done first to determine the satellites in view and their corresponding initial code phase and carrier Doppler frequency. Based on the initial acquisition, the scalar tracking loops track the satellite signals independently and estimate the corresponding pseudoranges. In scalar tracking, there is no information exchange between the tracking loops and navigation block. Also in scalar tracking, the dependency between the satellite channels based on the same user position and velocities is neglected [16]. In order to leverage the inherent connections of the system, vector tracking loop was developed by Spilker in 1996 [17]. Unlike the scalar tracking loops, a vector tracking loop combines the tracking and PVT estimation blocks into a single (a) (b) Fig. 2: Types of timing attacks that affect the robustness; (a) broadcast high power noise signals in L1 frequency range; (b) record-and-replay of high power spurious GPS signals. 3) Spoofing: Since the structure of the civil GPS signals is publicly known, a spoofer can generate falsified GPS signals to mislead the target receiver as in Fig.2(b). There are many types of spoofing attacks [31]. One type of spoofing is known as

3 3 meaconing, also known as bent-pipe spoofing and record-andreplay attack. A spoofer employing meaconing attack records the authentic GPS signals in one location and rebroadcasts them at a later time towards the target receiver with a higher power [32]. 4) Accidental receiver malfunction: In some cases, a GPS receiver yields significantly incorrect timing information due to accidental receiver malfunctions or satellite broadcast data anomalies. According to the GPS statistics of 2009 [33], 0.34% of the navigation messages recorded by the GPS receivers of International GNSS Service (IGS) were incorrect. On 31 st July 2006, 29 out of 245 GPS receivers in the IGS network misinterpreted the navigation message [34]. Unlike spoofing which requires the attacker to be smart and possess sophisticated equipment, GPS receivers are more prone to easy-to-cause vulnerabilities like jamming, unintentional noise and external interference [35]-[37]. The jamming attackers only require proximity and simple off-the-shelf equipment to cause disastrous impacts. Therefore, we aim to provide reliable GPS-based timing to PMUs which: improve the robustness of GPS against interference and jamming attacks; increase the receiver robustness against GPS navigation message anomalies. E. Contribution of our work The contribution of this thesis is in three major aspects: 1) We proposed a robust Position-Information-Aided Vector Tracking (PIAVT) architecture [38] that utilizes the static PVT information of the GPS receiver to improve its robustness against external timing attacks. PIAVT is based on the vector tracking, a closed feedback loop that combines the tracking and navigation blocks into a single process thereby enhancing the SNR of weak satellites. 2) We designed a sophisticated power test-bed in University of Illinois at Urbana-Champaign involving PMUs, USRPs and RTDS that mimics the authentic arrangement of a power sub-station. We thereby verified the dangerous impacts of jamming attacks on commercial clocks that supply timing to the PMUs. 3) Using our above-designed test-bed, we demonstrated the violation of the IEEE-C Standard for Synchrophasors using traditional GPS approach while our PIAVT algorithm supplied attack-resilient GPS timing. Thereby, we validated the improved jamming resilience and stability of power grid by incorporating our proposed PIAVT algorithm. The rest of the paper is organized as follows: Section II describes our PIAVT algorithm and its underlying concepts in detail. This section also outlines the initialization of PIAVT and its Kalman Filter tuning. Section III verifies the increased resilience of our PIAVT using GPS experimental setup against external attacks. Section IV demonstrates the impact of jamming attack on commercial clocks and thereafter validates the improved power grid stability by implementing PIAVT using a virtual power grid testbed. Section VI concludes the paper. II. PIAVT For timing applications in power grids, since the receivers are static, receiver position information is provided to vector tracking, called PIAVT [38]. Given this, the basic idea is to leverage the known position information of GPS receivers to accurately track the code and carrier measurements. By projecting the relative position and velocity between satellites and the receiver onto the Line of sight (LOS) direction, these tracking parameters are precisely estimated. Tracking robustness is also improved through the use of Kalman Filtering. The parameters of the tracking loops are adaptively chosen to narrow the loop filter bandwidth based on the static position of the GPS receiver. The narrow-band tracking loop limits receiver noise, which reduces the effective radius of any jamming attacks. A. Defining the Parameters PIAVT is used in conjunction with the existing scalar loops to enhance the performance of the system. The vector tracking loops loosely depend on scalar tracking for initialization which is done after the scalar loop gains a strong fix on the signal. In our PIAVT, the receiver processes the raw GPS signals from N visible satellites. The objective is to improve the robustness of the clock bias and clock drift at any t th time epoch, so that accurate timing signal is given as input to the PMU. X t : 3D position of the receiver at t th time epoch = [x,y,z] V t : 3D velocity of the receiver at t th time epoch = [ẋ,ẏ,ż] T t : Clock parameters of the receiver at t th time epoch = [cδt,cδṫ] The incoming GPS signal is dependent on four signal parameters as defined in the Eq. (2). The parameters in Eq. (3) need to be estimated accurately at each time epoch to track the satellite signal continuously. R : raw received GPS signal Y : signal replica of the GPS signal = N Y i i=1 Y i : signal replica corresponding to i th satellite = D i (t) G i ( f i code (t) + φ i code ) e j2π( f i carr(t)+φ i carr) D i (t) : Navigation databit from i th satellite G i (t) : L1 C/A code chip from i th satellite (2)

4 4 φ i code : Code phase of the ith satellite signal = f C/A c ( X ECI Sx,y,z,ECI i ) + (T b Tb i ) fcode i : Code frequency of the ith satellite signal = f C/A + f C/A fdcarr i f L1 φcarrier i : Carrier phase of the i th satellite signal f i carrier : Carrier frequency of the i th satellite signal = f IF + f i dcarr los i x,y,z : LOS vector for i th satellite in ECI frame = (X ECI S i x,y,z,eci ) X ECI S i x,y,z,eci fdcarr i : Carrier Doppler frequency of the ith satellite = f L1 c ( losi x,y,z.(v ECI Sẋ,ẏ,ż,ECI i ) + (T d Td i )) (4) where, f C/A : Chiprate of C/A code, MHz f L1 : Frequency of L1 signal carrier, MHz f IF : Intermediate frequency (IF), Hz ECI : Earth Centered Inertial coordinate system. B. Architecture The structure of PIAVT is shown in Fig. 3. After initialization, the PIAVT first predicts the satellite corrections and navigation solution ( ˆX t, ˆV t, ˆT t ) for the t th time epoch. The early, prompt and late code replicas are generated for each of the satellite channels using the predicted Doppler frequency and code phase at the t th time epoch. The code replicas are then correlated with the incoming GPS signal and evaluated using the code and carrier discriminators. The discriminators from each channel contain the code and carrier errors, which are then projected onto the LOS vectors and used to generate the Kalman Filter measurement vector. In our PIAVT, we consider the state vector of the Kalman Filter to include 3D position error (δx), velocity error (δv ), clock bias (T b ) and clock drift error (δt d ) as in (5). Z (t) = δx (t) δv (t) T b,(t) δt d,(t) (3) (5) By incorporating the position and velocity errors as states in the Kalman Filter, we account for the accumulated errors in the pre-determined true position due to antenna misalignments, earth rotation etc. Since the position, velocity and timing equations are coupled, the errors in position and velocity project to clock domain and thereby limit the timing accuracy obtained. Based on the prior position information of the GPS receiver, we correct the output obtained from the Kalman Filter. Th output which in-turn is given as input to the PMU. Fig. 3: Architecture of PIAVT. By assisting the tracking loop with the known location, the GPS receiver increases its robustness against interference. Based on the state transition matrix of the Kalman Filter, we can estimate the predicted state vector for the next (t +1) th time epoch. Thereafter, this is used to create a closed feedback loop wherein the predicted signal replica for the next time epoch is generated. As a result, the information is shared between the satellite channels and thereby used to aid the channels with weak SNR. C. Algorithm The process for the PIAVT algorithm can be broken down into four main blocks which are as follows: 1) Error estimation using discriminators 2) Kalman Filtering based measurement update 3) Position-Information-Aiding (PIA) 4) Kalman Filtering based time update 5) Generation of the satellite signal replica 1) Error estimation using discriminators: The Numerically Controlled Oscillators (NCO) generates early, prompt, and late replicas which are used to create correlations with the incoming signals. We will denote the inphase early, prompt, and late correlations as I E, I P, and I L. Similarly, quadrature correlations will be denoted as Q E, Q P, and Q L. Given the low dynamic nature of the power grid, we opt for carrier frequency and code phase discriminators that are well suited for low SNR (case of interference or jamming). The code phase discriminator known as the non-coherent early minus late is given by: e code,(t) = 1 E L (6) 2 E + L where E = IE 2 + Q2 E and L = IL 2 + Q2 L. This discriminator is normalized by E + L to remove amplitude sensitivity. We chose to use a normalized decision directed frequency discriminator as described in table 5.4 of [39]: e carr,(t) = cross sign(dot) 2π( t)(i 2 t + Q 2 t ), (7) where cross = I t 1 Q t I t Q t 1 and dot = I t 1 I t Q t 1 Q t. The error values obtained as outputs from the above discriminators are then used to generate the Kalman Filter measurement matrix.

5 5 The discriminators output the code phase and carrier frequency errors which contain the corresponding LOS projections of the discrepancies between the estimated position and velocity and the known true position and velocity. By utilizing the calculated LOS projections (los (i) ), we rewrite Eq. (8)-(9) (t) as functions of the clock bias and change in clock drift: e i code,(t) = ˆφ i (t) φ i (t) = T b,(t) + δx (t). los i (t) e i carrier,(t) = ˆf i carrier,(t) f i carrier,(t) = T d,(t) + δv (t). los i (t) where e i code,(t) and φ i (t) are in m, and ei carrier,(t), and f i carrier,(t) are in m/s. 2) Kalman Filtering based measurement update: The Kalman Filter measurement update equations are defined as follows: H (t) : Observation matrix, 2N 8 los 1 (t) los 1 (t) 0 1 : : : : = : : : : los N (t) los N (t) 0 1 e (t) : Measurement error vector = e 1 code,(t) e 1 carrier,(t) : : e N code,(t) e N carrier,(t) K (t) : Kalman gain matrix = ˆP (t) H T (t) (H (t) ˆP (t) H T (t) + R (t)) 1, where ˆP (t) : Predicted state error covariance matrix R (t) : measurement noise covariance matrix. Z (t) : State error vector = K (t) e (t) Z (t) : Corrected state vector = Ẑ (t) + Z (t) P (t) : Corrected state error covariance matrix = (I K (t) H (t) ) ˆP (t) (8) (9) (10) (11) Since the states of the Kalman filter were chosen to be error of the position, velocity, clock bias, and clock drift, we can then correct our predictions as: 3) Position-Information-Aiding: X (t) = ˆX (t) + δx (t) = X known + δx (t) (12) V (t) = ˆV (t) + δv (t) = V known + δv (t) (13) Once the position and velocity predictions have been corrected by the Kalman Filter, we compare the corrected predictions with the known receiver position and velocity to estimate the corrected signal parameters for the same time epoch using Eq. (14). φ i code,(t) = ˆφ i code,(t) + δx (t). los i (t) + T b,(t) fcode,(t) i = ˆf code,(t) i ( + T d,(t) + δv (t). los i (t) f i carr,(t) = ˆf i carr,(t) ) fc/a + (T d,(t) + δv (t). los i (t) ) f L1 c c (14) The corrected predictions shown here are then output as our navigation solutions. Based on this, we can accurately calculate the clock bias of the receiver as a weighted average of the difference between the calculated pseudorange and actual range [29]: T b,(t) = 1 σ N i=1 ω i N i=1 ω i ( ˆρ i S i X known ), (15) where ω i is the weighting term calculated by ω i = 1 var(ε i ), εi is the noise in the channel corresponding to (i) th satellite, and ˆρ (i) is the calculated pseudorange between the user and the (i) th satellite. This corrected clock bias is obtained as the overall output from PIAVT, which is then given as input to the PMUs in power grid. 4) Kalman Filtering based time update: We linearly propagate the clock parameters based on the first order state transition matrix to predict the receiver states for the next time epoch (t + 1). Given this, the time update equations of the Kalman Filter are formulated as follows: δ ˆX (t+1) δ ˆV (t+1) ˆT b,(t+1) δ ˆT d,(t+1) = F δx (t) δv (t) T b,(t) δt d,(t) (16)

6 6 The time update equations are as follows: T : Update interval F : State transition matrix, t t t 0 0 = t Q (t) : State process noise covariance matrix Ẑ (t+1) : Predicted state vector for the (t + 1) th instant = FZ (t) ˆP (t+1) : Predicted state error covariance matrix = FP (t) F T + Q (t) (17) parameters at the (t + 1) th time epoch as in (19). ˆφ code,(t+1) i = φ code,(t) i + c t [( ) + Sx,y,z,(t+1) i Si x,y,z,(t) t δv i ( ) T ] ˆf code,(t+1) [1 i = + T d,(t) + Sẋ,ẏ,ż,(t) i δv (t) i los i (t) f i code,(t) c ˆf i carr,(t+1) = [1 + T d,(t) + f L1 c ˆT d,(t+1) = T d,(t) + T d,(t), ( ) T ] Sẋ,ẏ,ż,(t) i δv (t) i los i (t) (t)] T los i (t) (19) where δv (t) is the velocity error and t is the time interval for update. From these estimated code phase and carrier Doppler frequency, signal replicas are generated and then correlated with the incoming GPS signal. These corrected values serve as a reference to predict the signal parameters using NCO for the next time epoch and thereby PIAVT loop continues. 5) Generation of satellite signal replica: The function of NCO in our PIAVT is to generate the signal replica based on four signal parameters. We observe that the carrier Doppler frequency and code phase are directly dependent on the geometry and relative motion of the satellites with respect to the GPS receiver. Therefore, these signal characteristics are predicted using the 3D satellite position and velocity as well as the known position and velocity of the static GPS receiver. The ephemeris values are decoded from either the scalar tracking results or obtained through external sources. The predicted position and velocity are given by the following equations: ˆX (t+1) = X known ˆV (t+1) = V known = 0 (18) where (t +1) th denotes the time epoch for which the clock bias and clock drift parameters are being calculated. Also, X known and V known denotes the pre-determined 3D position and velocity of the static GPS receiver. The signal parameters from the (t) th time epoch and the change in the satellite position and velocity projections are collectively used for the calculation of the predicted signal D. Initialization At a specific time epoch, the following are extracted from the scalar tracking results and used to initialize the PIAVT: code phase, code frequency, carrier frequency, signal transmit time, clock bias, and clock drift. Since the PIAVT is loosely dependent on these initial values, we choose to initialize our tracking loop after the scalar loop has gained a strong fix on the signal. In PIAVT, bandwidth is controlled by Kalman Filter which makes it difficult to quote the exact bandwidth used to set the adaptive Kalman filter gain (K), which is proportional to the bandwidth. Thus, in this work, the bandwidth was set empirically by controlling the Kalman filter Q and R matrices which represent the uncertainty in the dynamics of the user and the noise in the discriminator outputs. Q and R are defined as: Q = diag(σ 2 x,σ 2 y,σ 2 z,σ 2 v x σ 2 v y,σ 2 v z,σ 2 t b ) R = diag(σ 2 code,1,σ2 carrier,1,...,σ 2 code,n,σ2 carrier,n), where, σ 2 is the covariance of the process noise, σcode 2 and σcarrier 2 are the covariances of the noise for code and carrier measurements, respectively. To compare the scalar and PIAVT results, the tracking loop bandwidths should be relatively similar. Therefore, we empirically adjusted the Q and R matrices such that the basic vector tracking loop s performance closely matched that of the scalar tracking with 5 Hz loop bandwidths, due to the receiver being static, and then used these Q and R values as constants throughout our PIAVT. III. GPS EXPERIMENTS In order to compare the performance of PIAVT with that of traditional tracking, we conducted field tests using an off-the-shelf GPS receiver. We collected raw GPS signals

7 7 using SiGe GN3S GPS sampler, an A/D converter with a bandpass filter. The raw GPS signals are then processed using a software-defined receiver (SDR), shown in Fig. 4(a). It uses a sampling frequency from 4 MHz to 16 MHz and a quantization resolution of 2 bits. The antenna used in this experiment was a fixed-reference choke ring antenna mounted on the roof of the Everitt building at UIUC as shown in Fig. 4(b). We collected the data in an open sky environment and later post-processed using our developed SDR for both scalar and PIAVT known as pygnss. (a) (b) Fig. 4: (a) Off-the-shelf GPS front-end: SiGe sampler; (b) GPS antenna on the roof of the Everitt building at the University of Illinois at Urbana-Champaign (UIUC). A. Noise tolerance and anti-jamming performance To determine the noise tolerance and anti-jamming performance of the PIAVT algorithm, we added varying levels of simulated Gaussian noise (between 1 15 db) to the raw GPS signals and analyzed the resulting signal. (a) With no added jamming (b) With 9dB added jamming (c) With no added jamming (d) With 9dB added jamming Fig. 5: PIAVT is more robust to jamming attacks than the scalar tracking. (a) carrier Doppler frequency residual with no added jamming; (b) carrier Doppler frequency residual with 9 db added jamming; (c) code frequency residual with no added jamming; (d) code frequency residual with 9 db added jamming. The red line depicts the trend of scalar tracking while the blue line depicts that of PIAVT. Under 9 db added jamming, scalar tracking lost track while PIAVT continues robust tracking. (a) With no added jamming (b) With 4 db added jamming (c) With 9 db added jamming Fig. 6: PIAVT demonstrates improved jamming resilience compared to scalar tracking; (a) with no added jamming, PIAVT produces timing with maximum errors of ±10 ns, while scalar tracking has maximum errors of ±45 ns; (b) with 4 db of added jamming, PIAVT shows maximum time errors of ±13 ns, while scalar tracking has ±60 ns; (c) with 9 db of added jamming, scalar tracking failed completely while PIAVT continued operating with a maximum timing error of ±20 ns. Fig. 5 is indicative of the increased noise tolerance and antijamming performance of the PIAVT algorithm as compared to scalar tracking. Under 9 db added jamming, scalar tracking lost track of the raw signal and diverges. However, PIAVT robustly tracks the raw signal till 16 db of added jamming thereby providing 7 db additional noise tolerance. In addition, the variance in the code frequency residuals is significantly smaller than the scalar tracking. Fig. 6(a) shows that with no added noise, the maximum time errors for the scalar results were close to ±45 ns whereas the time errors for the PIAVT were around ±10 ns. Scalar tracking was able to produce decodable navigation bits up until an added jamming of 4 db. However, with every db of additional noise, we observed an increase in the number of channels that experience loss-of-lock. At 4 db of added jamming, the scalar tracking was only able to lock onto 4 out of the 10 visible satellites. The scalar tracking exhibited maximum timing errors of ±60 ns as shown in Fig. 6(b) while the PIAVT results showed maximum errors of ±13 ns. At 9 db of added jamming as shown in Fig. 6(c), the scalar tracking failed completely while the PIAVT loop continued operating with time errors of within ±20 ns, thereby evaluating the increased jamming robustness of PIAVT as compared to scalar tracking. In addition to the clock residuals, the Fig. 7, 8 depict the low error corrections in the position and velocity thereby demonstrating our position-information-aiding approach.

8 8 Fig. 7: Position errors obtained from PIAVT after Position- Information-Aiding under 9 db of added jamming. IV. STABILITY ANALYSIS OF THE POWER GRID In this section, we demonstrated the impact of jamming attack on the grid. Later, we conduct post-processed stability analysis of the grid to compare the improved jamming resilience using our PIAVT algorithm as compared to that of scalar tracking. Different set of raw GPS signals as compared to Section-III are collected on the rooftop of Electrical and Computer Engineering (ECE) building and analyzed. According to the IEEE standard for Synchrophasors as described in Section I-C, without any timing and magnitude errors, the max allowable phase angle error between two PMUs should not exceed Fig. 8: Velocity errors obtained from PIAVT after Position- Information-Aiding under 9 db of added jamming. B. Robustness against receiver and satellite errors In this, a simulated satellite broadcast data error of 80 m was added to the ephemeris of PRN-14 satellite 9secs after the initial time epoch. (a) Fig. 10: Hardware and testbed at the University of Illinois at Urbana-Champaign: (a) RTDS of power systems, (b) PMU; to validate the improved resilience of PIAVT against GPS timing attacks on the power system. The hardware used to implement this test as shown in Fig. 10 include Real-Time Digital Simulator (RTDS), a Universal Software Radio Peripheral (USRP) [40], a commercial clock (SEL-2488 Satellite Synchronized Clock), a GPS receiver, and a two hardware PMUs; the equipment was then connected. A. Impact of Jamming on Power Grid To test and quantify the impact of jamming on commercial clocks, we triggered the clock using raw GPS signals added with simulated effect of jamming. This is done using the GNURadio block code shown in Fig. 11, with a variable noise voltage to be introduced. (b) Fig. 9: Timing errors during the presence of the satellite broadcast data anomaly of 80 m in ephemeris. The red line depicts the scalar tracking while the blue line depicts PIAVT. PIAVT mitigates the effect of the satellite ephemeris errors to within 20 ns while the scalar tracking shows timing errors of 60 ns. Fig. 9 demonstrates the increased resilience of the PIAVT as compared to the scalar tracking approach. Scalar tracking projects a timing error of 60 ns while PIAVT depicts an error of 20 ns due to its closed feedback loop architecture thereby mitigating the effect of the satellite broadcast error. Fig. 11: GNURadio code to generate added jamming based GPS signal. Fig. 12 shows decrease in satellite signal strengths with increase in noise voltage of the jamming signal introduced.

9 9 Commercial clocks require to detect and track a minimum of 4 satellites with signal strength more than 30 db above the noise floor. Based on these conditions, a jamming threshold of 11.2 V added noise voltage is computed, above which sufficient number of strong satellite signals can no longer be tracked and therefore the GPS timing is no longer available to PMUs. Fig. 13: Flow chart shows our power testbed at UIUC. The performance of one hardware PMU triggered by the USRP+WBX supplying authentic or malicious signals is compared to another hardware PMU triggered using the PIAVT based timing signals. Our testbed validates the improved resilience of our proposed PIAVT algorithm to that of the traditional approach implemented in the commercial clocks. Fig. 12: Variation of satellite signal strength with jamming. The black dotted line represents the threshold for scalar tracking as it requires a minimum of 4 satellites. The results in this section illustrate the disastrous effects of the GPS jamming signals on the power grid. In the scenario where the PMUs are used as feedback sensors in a generator control system, an attacker can lead the generator to believe that the system was unstable; and the generator, in the process of adjusting its outputs, could be tripped. If properly planned, several tripped generators have the potential to cause severe grid instabilities, leading to wide-area cascading blackouts. B. Timing Resilience using PIAVT After having analyzed the impact of jamming, we performed stability analysis of the grid, in the presence of timing attacks using our testbed shown in Fig. 13. In the upper thread, USRP+WBX sends the GPS signals to a commercial clock that in turn supplies the timing signals to a hardware PMU. In the lower thread, USRP+LFTX triggers another hardware PMU using our PIAVT based timing. We use an external Microsemi Quantum SA.45s Chip Scale Atomic Clock (CSAC) [41] for synchronizing the USRPs and RTDS in Fig. 10(b) for simulating wide network power system. To validate attack resilience of our PIAVT at the power grid level, we analyzed the TVE error of PMU by recording the voltage magnitude and phase angle measurements. In the experiments below, the PMU labelled GTNET is the reference one which always supplies the authentic signals and the PMU labelled Double High is the one attacked by the malicious GPS signals. (a) Phase voltage: Angle (b) Phase voltage: magnitude Fig. 14: Phasor measurements under jamming attack. The red dotted line corresponds to the unjammed GTNET PMU, while the blue solid line represents the jammed Double High PMU. The phase angle of the jammed signal fluctuates randomly thereby violating the IEEE-C standard for PMU measurements. For the jamming case, a 1.12 V added noise voltage is mixed with authentic signals and the results are analyzed. We observe from Table. I that PIAVT has higher threshold to jamming which can be verified through Fig. 14. In the case of jamming, the GPS timing information is unavailable for one of the PMUs because of which the voltage and current measurements recorded are zero while the phase angle fluctuates randomly. TABLE I: Threshold to external attacks. PIAVT offers higher tolerance to jamming attack than scalar tracking. Algorithm Jamming (in V ) Scalar 1.12 PIAVT 1.8 V. CONCLUSIONS In order to ensure the security and robustness of GPS-based timing for PMUs, we proposed the PIAVT approach. Vector tracking combines the information from all satellite into a single block and operates in a closed loop manner thereby aiding the weak SNR satellite channels. PIAVT incorporates the static known position of the GPS receiver to enhance the performance of the vector tracking loop.

10 10 Our PIAVT allows continued operation in the presence of 9 db of added jamming while complying with the IEEE- C standard for PMU measurements. We designed a power grid testbed using RTDS, USRP, PMU and a commercial GPS clock to showcase the impact of external timing attacks. Later, by incorporating emulated timing attacks to the GPS signals collected, we validated the improved jamming resilience of our PIAVT approach in maintaining the power grid stability. ACKNOWLEDGMENT I would also like to thank Cyber Resilient Energy Delivery Consortium (CREDC) team members at University of Illinois: Alfonso Valdes, Prosper Panumpabi, Jeremy Jones, David Emmerich for helping me in setting up the power grid testbed and also in collecting and analyzing the data. This material is based upon work supported by the Department of Energy under Award Number DE-OE This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof. REFERENCES [1] Office of the Press Secretary, Presidential policy directivecritical infrastructure security and resilience, house.gov/thepress-office/2013/02/12/presidential-policy-directi ve-criticalinfrastructure-security-and-resil, [2] P. Kundur, N. J. Balu, and M. G. Lauby, Power system stability and control, McGraw-hill New York, 1994, vol. 7. [3] D. Hart, Use of SCADA data for failure detection in wind turbines, in IEEE Power and Energy Society General Meeting- Conversion and Delivery of Electrical Energy in the 21st Century, July [4] H. Bentarzi, Improving monitoring, control and protection of power grid using wide area synchro-phasor measurements, in Proceedings of the 12th WSEAS international conference on Automatic control, modelling and simulation. World Scientific and Engineering Academy and Society (WSEAS), 2010, pp [5] A. G. Phadke and J. S. Thorp, Synchronized phasor measurements and their applications, Springer Science and Business Media, [6] M. Patel, S. Aivaliotis, E. Ellen et al., Real-time application of synchrophasors for improving reliability, NERC Report, October [7] United States Energy Information Administration, Today in energy, cfm?id=5630, March [8] A. Silverstein, An update on synchrophasor tech across America, Intelligent Utility Magazine, November [9] D. Shi, D. J. Tylavsky, K. M. Koellner, N. Logic, An Adaptive Method for Detection and Correction of Errors in PMU Measurements, Ieee Trans. on Smart Grid, vol. 3, no. 4, pp , Dec [10] P. Shepard, T. E. Humphreys, and A. A. Fansler, Evaluation of the vulnerability of phasor measurement units to GPS spoofing attacks, International Journal of Critical Infrastructure Protection, vol. 5, no. 3, pp , [11] L. Heng, J. J. Makela, A. D. Dominguez-Garcia, R. B. Bobba, W. H. Sanders, and G. X. Gao, Reliable GPS-based timing for power systems: A multi-layered multi-receiver architecture, in Power and Energy Conference at Illinois (PECI), IEEE, 2014, pp [12] G. Wing, Interface Specification IS-GPS-200E, June [13] Misra and P. Enge, Global Positioning System: Signals, Measurements and Performance, Second Edition. Lincoln, MA: Ganga-Jamuna Press, [14] B. W. Parkinson and J. J. Spilker, Progress In Astronautics and Aeronautics: Global Positioning System: Theory and Applications, AIAA, [15] A. Dierendonck, P. Fenton, and T. Ford, Theory and performance of narrow correlator spacing in a GPS receiver, Navigation, vol. 39, no. 3, pp , [16] M. Lashley, D. M. Bevly, and J. Y. Hung, Performance analysis of vector tracking algorithms for weak GPS signals in high dynamics, Selected Topics in Signal Processing, IEEE Journal of, vol. 3, no. 4, pp , [17] S. Zhao and D. Akos, An open source GPS/GNSS vector tracking loop-implementation, filter tuning, and results, in Proceedings of the 2011 International Technical Meeting of The Institute of Navigation, January 2011, pp [18] Z. Sun, X. Wang, S. Feng, H. Che, J. Zhang, Design of an adaptive GPS vector tracking loop with the detection and isolation of contaminated channels, GPS Solutions (2017) 21: 701. doi: /s [19] IEEE Standard for Synchrophasors for Power Systems, IEEE Std C (Revision of IEEE Std ), vol., no., pp , [20] K.E Martin, D.Hamai, M.G Adamiak, S. Anderson, M. Begovic, G. Benmouyal, G. Brunello, J. Burger, J. Y. Cai, B. Dickerson, V. Ghapure, B. Kennedy, D. Karlsson, A.G. Phadke, J. Salj, V. Skendizic, J. Sperr, Y. Song, C. Huntley, B. Kastenny and E. Price, Exploring the IEEE Standard C Synchrophasors for Power Systems, IEEE Trans. on Power Del.,Vol. 23, no. 4, pp , Oct, [21] M. Lixia, C. Muscas, and S. Sulis, On the accuracy specifications of phasor measurement units, in Proc. IEEE I2MTC, May 2010, pp [22] N. D. Pham, The economic benefits of commercial GPS use in the US and the costs of potential disruption, NDP Consulting, Tech. Rep., June [23] GPS.gov, GPS spectrum and interference issues, gps.gov/spectrum/, March [24] Federal Communications Commission, Deere submission: Light- Squared Interference to GPS and StarFire, May [25] C. H. Kang, S. Y. Kim, C. G. Park, A GNSS interference identification using an adaptive cascading IIR notch filter, GPS Solut (2014) 18: 605. doi: /s [26] R. B. Langley, GPS, the Ionosphere, and the Solar Maximum, GPS World, vol. 11, no. 7, pp , 2000.

11 11 [27] G. X. Gao, H. Denks, A. Steingassnd, M. Meurer, T. Walter, and P. Enge, DME Interference Mitigation Based on Flight Test Data Over European Hot Spot, GPS Solutions, vol. 17, issue 1, January [28] J. Warburton and C. Tedeschi, GPS Privacy Jammers and RFI at Newark: Navigation Team AJP-Results, in 12th International GBAS Working Group Meeting (I-GWG-12), Atlantic City, New Jersey, November [29] C. Tedeschi, The Newark Liberty International Airport (EWR) GBAS Experience, in 12th International GBAS Working Group Meeting (IGWG-12), Atlantic City, New Jersey, November [30] A. Pinker, C. Smith, Vulnerability of the GPS Signal to Jamming, GPS Solutions (1999) 3: 19. doi: /pl [31] X. Jiang, J. Zhang, B. J. Harding, J. J. Makela, and A. D. Dominguez-Garcia, Spoofing GPS receiver clock offset of phasor measurement units, IEEE Transactions on Power Systems, vol. 28, no. 3, p , [32] J. S. Warner and R. G. Johnston, A simple demonstration that the Global Positioning System (GPS) is vulnerable to spoofing, Journal of Security Administration, vol. 25, no. 2, pp , [33] G. X. Gao, H. Tang, J. Blanch, J. Lee, T. Walter and P. Enge, Methodology and Case Studies of Signal-in-Space Error Calculation Top-down Meets Bottom-up, ION Global Navigation Satellite Systems Conference 2009, Savannah, Georgia, September [34] L. Heng, G. X. Gao, T. Walter and P. Enge, GPS Signal-in- Space Performance Evolution: Data Mining 400 Million Navigation Messages of the Last Decade from a Global Network of 360 receivers, IEEE Transactions on Aerospace and Electronic Systems, vol. 48, no. 4, October [35] Y. Fan, Z. Zhang, M. Trinkle, A. D. Dimitrovski, J.B. Song, H. Li, A Cross-Layer Defense Mechanism Against GPS Spoofing Attacks on PMUs in Smart Grids, IEEE Trans. Smart Grid 2015, 6, [36] Z. Zhang, S. Gong, A. Dimitrovski and H. Li, Time synchronization attack in smart grid: impact and analysis, IEEE Transactions on Smart Grid, vol. 4, no. 1, pp , Mar [37] M. T. Gamba, M. D. Truong, B. Motella, E. Falletti, T. H. Ta, Hypothesis testing methods to detect spoofing attacks: A test against the TEXBAT datasets, GPS Solutions; Springer: Berlin/Heidelberg, Germany, 2016; pp [38] D. Chou, L. Heng, and G. X. Gao, Robust GPS-Based Timing for Phasor Measurement Units: A Position-Information-Aided Vector Tracking Approach, in Proceedings of the ION GNSS+ conference, Tampa, [39] E. D. Kaplan and C. J. Hegarty, Understanding GPS: Principles and Applications, 2nd ed. Artech House Inc, MA, [40] Ettus Research, [Online]. Available: /content/files/ [41] Microsemi, [Online]. Available: document-portal/docview/ quantum-sa-45s-csac Sriramya Bhamidipati is a graduate student under Prof. Grace Gao in the Department of Aerospace Engineering at the University of Illinois at Urbana- Champaign. She received her M.S degree in Aerospace Engineering from University of Illinois at Urbana-Champaign in She received her B.Tech. with honors in Aerospace Engineering and minor in Systems and Controls Engineering from Indian Institute of Technology Bombay, India in Her research interests include GPS, power and control systems, computer vision and UAVs. Grace Xingxin Gao received the B.S. degree in mechanical engineering and the M.S. degree in electrical engineering from Tsinghua University, Beijing, China in 2001 and She received the PhD degree in electrical engineering from Stanford University in From 2008 to 2012, she was a research associate at Stanford University. Since 2012, she has been with University of Illinois at Urbana- Champaign, where she is presently an assistant professor in the Aerospace Engineering Department.