Spoofing GPS Receiver Clock Offset of Phasor Measurement Units 1

Transcription

1 Spoofing GPS Receiver Clock Offset of Phasor Measurement Units 1 Xichen Jiang (in collaboration with J. Zhang, B. J. Harding, J. J. Makela, and A. D. Domínguez-García) Department of Electrical and Computer Engineering University of Illinois at Urbana-Champaign Power Affiliates Program Urbana, IL May 03, X. Jiang, J. Zhang, B. Harding, J. Makela, and A. D. Domnguez-Garca, Spoofing GPS Receiver Clock Offset of Phasor Measurement Units, IEEE Transactions on Power Systems, to appear. Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 1 / 29

2 Outline 1 Introduction and Motivation 2 Calculation of Receiver Position and Clock Offset 3 Mathematical Formulation of Attack 4 Case Study 5 Concluding Remarks Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 2 / 29

3 Phasor Measurement Unit (PMU) Basics Loosely speaking, a PMU provides a phasor description of a physical quantity in a power network, e.g., voltage, under the assumption that The quantity time dependence is accurately described by a sinusoid Let v i (t) denote the voltage in some bus of a power network, then Time domain representation: vi (t) = 2V i cos(ωt+θ i ) Phasor representation: V i = V i θ i 4,+,0 1./56/+2,+.2!!! $! %! "! '! *+,+-./0 *+,+-./0 1./+2.3! 1./+2.3!! " #$ "!! % #$ %! 1./ /+62! 789 )! )! (! 789 (! 4,+,0 1./56/+2,+.2! 4,+,0 &! 1./56/+2,+.2! #!! & #$ &! *+,+-./0 1./+2.3! PMUs are equipped with a GPS receiver to derive a time stamp in Coordinated Universal Time (UTC); this provides A common time reference to the phase angle measurements across a wide area Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 3 / 29

4 Motivation A GPS receiver acquires signals from satellites, decodes each satellite s navigation data, and estimates its position and UTC A spoofing attack on a GPS receiver can induce a faulty time stamp, which introduces errors in the PMU s phase measurements Such an attack can be implemented with a GPS simulator to generate rogue signals matching the genuine signals [Humphreys et al. 09] In this presentation: We demonstrate the feasibility of a spoofing attack on the GPS receiver of a PMU We show that such an attack can cause significant errors in the phase measurements provided by the PMUs We illustrate the effect of PMU receiver spoofing on a voltage stability monitoring algorithm Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 4 / 29

5 Outline 1 Introduction and Motivation 2 Calculation of Receiver Position and Clock Offset 3 Mathematical Formulation of Attack 4 Case Study 5 Concluding Remarks Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 5 / 29

6 GPS Receiver Position and Time Synchronization Basics A GPS receiver determines its distance from a satellite by measuring the time of signal transmission from the satellite, and multiplying that by the speed of signal propagation (speed of light) Given the satellites positions and ranges from receiver, the receiver location could be computed through a process known as trilateration Trilateration Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 6 / 29

7 GPS Receiver Position and Time Synchronization Basics In theory, three satellites are sufficient to determine the receiver s exact location, assuming: no noise in the measurements time between satellites clocks and receiver s are perfectly synchronized In reality, the receiver clock has an offset t u from the GPS time t E arising from internal hardware bias in the local clock oscillator We can express the clock offset as: where t r denotes the receiver clock time t u = t r t E, (1) Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 7 / 29

8 * t UTC * t UTC * t UTC * t UTC * t UTC PMUs and Time Synchronization Errors t UTC PMU measurements pre-attack PMU measurements post-attack The t UTC is offset from GPS time t E = t r t u by an integer number of leap seconds t UTC = 16 s Therefore, t UTC, which is used for PMU time synchronization, is computed as follows: t UTC = t E t UTC (2) A voltage phasor is measured at each bus and time-stamped using the reference time signal t UTC This time-stamp is common to all buses and provides the synchronization of the PMUs phasor measurements Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 8 / 29

9 Four Visible Satellites Let ρ i and r i be the i th satellite s pseudorange and true range Let x i, y i, and z i be the i th satellite s [Earth-Centered Earth-Fixed] ECEF coordinates Let x u, y u, z u, be the receiver s ECEF coordinates Let t u be the receiver clock offset. Then, ρ i = r i ct u, i = 1,2,3,4 (3) r i = (x i x u ) 2 +(y i y u ) 2 +(z i z u ) 2 (4) where c denotes the speed of light The GPS receiver computes x i, y i, and z i through a set of parameters contained in the GPS signal known as the ephemerides When four satellites are visible, the receiver location, x u, y u, z u, and the clock offset t u can be obtained by solving (3)-(4) Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 9 / 29

10 More than Four Visible Satellites It is almost always the case that more than four satellites are visible at a particular instant of time (more equations than unknowns) The solution, x u, y u, z u, and t u is obtained by solving a Least Squares Errors Estimation (LSE) problem of the form: minimize f 0 = n (ρ i r i +ct u ) 2 (5) i=1 where n > 4 denotes the number of visible satellites The GPS receiver solves the LSE problem in (5), which can be solved numerically using the Gauss-Newton method We use GPS receivers mostly for locational purposes, i.e., we care about x u, y u, z u PMUs care about the clock offset t u Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 10 / 29

11 Keplerian Elements The accurate characterization of the GPS satellites orbits is essential for determining the receiver s position. In the absence of external perturbations, the trajectory of a satellite is solely governed by the gravitational force of Earth: where d 2 s i ds 2 i + G s 3 s i = 0, (6) i si = [x i, y i, z i ] T is the position vector of the i th satellite G = m 3 /s 2 is the product of the universal gravitation constant and the mass of the Earth si is defined as: s i = x 2 i +y2 i +z2 i. The solution of (6) is characterized by six constants of integration known as Keplerian elements These six parameters allow the receiver to compute the position and velocity vectors of the satellite at any point Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 11 / 29

12 Ephemerides In order to describe a satellite s orbit even more accurately, the additional forces acting on the satellite must be considered These forces include the so-called third-body gravitation from the Sun and the Moon, and Earth s tidal variations, among others It is still possible to completely characterize the satellite s motion under full perturbation with the Keplerian elements however, these are no longer constants In order to characterize how the Keplerian elements change over time, a set of parameters is added to the satellite s navigation signal This expanded parameter set which contains the Keplerian elements is known as the satellite s ephemerides Up-to-date ephemerides are uploaded from the GPS control segment to the satellites once per day and then broadcast to the receiver Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 12 / 29

13 Computation of Satellite s ECEF Coordinates The information contained in the ephemerides is used by the GPS receiver to compute the position of a satellite s ECEF coordinates Denote by δ i (j) the j th ephemeride of satellite i Define δ i = [δ i (1), δ i (2),..., δ i (m)] T as the vector that contains the ephemerides broadcasted by the i th satellite We can express the ECEF position of the satellite as a function δ i such that x i = f(δ i,t), y i = g(δ i,t), z i = h(δ i,t), where t denotes the time elapsed since the last ephemerides update (7) Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 13 / 29

14 Outline 1 Introduction and Motivation 2 Calculation of Receiver Position and Clock Offset 3 Mathematical Formulation of Attack 4 Case Study 5 Concluding Remarks Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 14 / 29

15 Impact of Spoofing on PMU Phase Information Time synchronization across PMUs is crucial for maintaining an accurate measurement of phase angles We seek to maximize the difference of the receiver clock offset t u (post-attack) with respect to its pre-attack value t u For a 60-Hz signal, the PMU s phase measurement error ε θ is related to the receiver clock offset error through the linear relationship ε θ = [60 (t u t u) 360 ] mod 360 (8) * t UTC * t UTC t UTC Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 15 / 29

16 Four Visible Satellites The problem can be formulated as an optimization of the maximum clock offset error as follows: max (t u t u) 2 subject to ρ i = r i ct u, i = 1,2,3,4 s u (l) s u (l) ε s u (l), l = 1,2,3 δ i (j) δ i (j) ε δ i (j), j = 1,2,...,m s i (k) s i (k) ε s i (k), k = 1,2,3 where s u = (x u,y u,z u ) and s i = (x i,y i,z i ) are the receiver s and i th satellite s ECEF coordinates, δ i are the i th satellite s ephemerides The difference between the decision variables and their pre-attack values (denoted by *) is bounded by ε su (l), ε δi (j), and ε si (k) These bounds are specified to demonstrate that the spoofing can still succeed even if the receiver checks for abrupt changes to these parameters from their pre-attack values [a possible countermeasure] Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 16 / 29

17 Spoofing Attack When Four Satellites are Visible Each of the satellites ephemerides are limited to ±2% of their pre-attack values The GPS receiver location is also restricted to vary at most 15 m from its pre-attack position xu [m] time [s] time [s] time [s] yu [m] zu [m] (a) Receiver ECEF Coordinates. tu [ms] εθ [degrees] time [s] time [s] (b) Receiver clock offset and phase angle. Receiver Position, Clock Offset, and PMU Phase Error Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 17 / 29

18 More than Four Visible Satellites The system is overdetermined and assuming noise in measurements, an exact solution to (3) no longer exists The constraints arising from (3) are replaced by the condition in (5) Since (5) itself is an optimization problem, it cannot be stated as a regular constraint readily However, we can exploit the convexity of the LSE problem, and use the fact that the first-order optimality conditions that the solution of (5) must satisfy are also sufficient conditions: where f 0 x u = 0, f 0 x u = 2 f 0 y u = 0, i=1 f 0 z u = 0, n [ ] (ρi r i +ct u )(x i x u ), r i f 0 t u = 0, (9) (10) with similar expressions for f 0 y u, f 0 z u, and f 0 t u Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 18 / 29

19 More than Four Visible Satellites Optimization when more than four satellites are visible becomes max (t u t u) 2 subject to f 0 x u = f 0 y u = f 0 z u = f 0 t u = 0 s u (l) s u(l) ε su (l), l = 1,2,3 δ i (j) δ i(j) ε δi (j), j = 1,2,...,m s i (k) s i (k) ε s i (k), k = 1,2,3 (11) The variable t u in the objective function can be solved from any of the expressions in equation (9): t u = 1 n (ρ i r i ). (12) nc i=1 The constraint (3) [for the four satellite case] is replaced by the first order optimality conditions of (9) as to satisfy the LSE conditions Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 19 / 29

20 Spoofing Attack When Seven Satellites are Visible Each of the satellites ephemerides are limited to ±2% of their pre-attack values The GPS receiver location is also restricted to vary at most 15 m from its pre-attack position xu [m] time [s] time [s] time [s] yu [m] zu [m] (a) Receiver ECEF Coordinates. tu [ms] εθ [degrees] time [s] time [s] (b) Receiver clock offset and phase angle. Receiver Position, Clock Offset, and PMU Phase Error for Spoofing Seven Satellites Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 20 / 29

21 Outline 1 Introduction and Motivation 2 Calculation of Receiver Position and Clock Offset 3 Mathematical Formulation of Attack 4 Case Study 5 Concluding Remarks Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 21 / 29

22 Effect of Spoofing Applications that rely on PMU measurements are vulnerable to PMU receiver spoofing Health monitoring algorithms Automatic closed-loop control systems Remedial Actions schemes Consider a voltage-stability monitoring algorithm based on computation of Thévenin equivalents System is deemed stable if load impedance magnitude is larger than Thévenin impedance magnitude Thévenin impedance is computed as Z th = V(t 2) V(t 1 ) I(t 1 ) I(t 2 ) Voltage and current phasors are provided by the PMU for two time instances (13) Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 22 / 29

23 Thévenin Equivalent Power System Z l Z th Load Bus I() t E Vt () + _ Z l Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 23 / 29

24 Voltage Stability Monitoring Algorithm Spoofing attack introduces a phase error ε θ in the phase measurements The relation between pre-attack and post-attack measurements is Z th = V(t 2 ) = V(t 2 )e jε θ I(t 2 ) = I(t 2 )e jε θ (14) The computed Thévenin impedance from the spoofed measurements is V(t 2 ) V(t 1 ) I(t 1 ) Ĩ(t 2) False alarms and misdetections are possible = V(t 2)e jε θ V(t 1 ) I(t 1 ) I(t 2 )e jε θ (15) Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 24 / 29

25 Pre- and Post-attack Load and Thévenin Impedances 3-machine, 9-bus WECC system model False alarm when phase angle is shifted by 10 at 108% of base case loading Misdection when phase angle is shifted by 2 at 200% of base case loading impedance [p.u.] 10 x Z l false alarm Z th misdetection Z th Z th percent of base case load 200 Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 25 / 29

26 A Case of False Alarm Fix loading at 108% and vary the phase angle Phase angle shift of 0 corresponds to no error Negatively shifting phase angle causes false alarms impedance [p.u.] 10 x Z th Z l phase shift [degrees] Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 26 / 29

27 A Case of Misdetection Fix loading at 200% and vary the phase angle Shifting phase angle in range of 0 to 4 causes misdetections impedance [p.u.] 2.65 x Z th Z l phase shift [degrees] Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 27 / 29

28 Outline 1 Introduction and Motivation 2 Calculation of Receiver Position and Clock Offset 3 Mathematical Formulation of Attack 4 Case Study 5 Concluding Remarks Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 28 / 29

29 Future Work To extend the domain of optimization from an instant in time to a duration over which the PMU can be potentially spoofed Subsequent experimental work includes a demonstration of this attack on a PMU by building a GPS spoofer The optimization algorithm will be used to compute the optimal spoofing attack for a particular time well in advance of the attack The solution of the optimization problem will then be downloaded onto the GPS simulator for execution at a later time Given the feasibility of such an attack, the effects of erroneous phase measurements must be assessed and countermeasures be developed. Jiang (Illinois) Spoofing GPS receiver of PMUs Power Affiliates Program 29 / 29