[Paper Review] Time Synchronization Attack in Smart Grid-Part I: Impact and Analysis

Zhenghao Zhang, Shuping Gong+2 more|arXiv (Cornell University)|Apr 2, 2012

Smart Grid Security and Resilience14 references3 citations

TL;DR

This paper proposes a Time Synchronization Attack (TSA) that compromises smart grid monitoring by spoofing GPS signals to corrupt time stamps on phasor measurement unit (PMU) data. The attack causes significant errors in fault detection, voltage stability monitoring, and event location estimation, with simulations showing mislocation of disturbances by hundreds of kilometers due to timing offsets as small as 10 ms.

ABSTRACT

Many operations in power grids, such as fault detection and event location estimation, depend on precise timing information. In this paper, a novel Time Synchronization Attack (TSA) is proposed to attack the timing information in smart grid. Since many applications in smart grid utilize synchronous measurements and most of the measurement devices are equipped with global positioning system (GPS) for precise timing, it is highly probable to attack the measurement system by spoofing the GPS. The effectiveness of TSA is demonstrated for three applications of phasor measurement unit (PMU) in smart grid, namely transmission line fault detection, voltage stability monitoring and event locationing. The validity of TSA is demonstrated by numerical simulations.

Motivation & Objective

• To identify a novel cyber-physical attack vector targeting time synchronization in smart grid wide-area monitoring systems (WAMS).
• To analyze the impact of GPS spoofing on critical PMU-based applications such as fault detection, voltage stability monitoring, and event locationing.
• To demonstrate that TSA can bypass traditional data filtering mechanisms by introducing time-domain errors rather than amplitude-based false data.
• To quantify the sensitivity of event location estimation to timing offsets induced by GPS spoofing.

Proposed method

• Proposes a Time Synchronization Attack (TSA) that manipulates GPS signals to alter the sampling time of PMUs without physical access to monitoring devices.
• Uses forged GPS signals to introduce controlled time offsets (Δt) in PMU measurements, corrupting the time stamps used for synchronization.
• Applies analytical models to derive the error in event location estimation based on time offset, using coordinate transformation and parametric equations for location error propagation.
• Derives partial derivatives of event location error with respect to time offset (Δt) to quantify sensitivity, incorporating system parameters like distance, velocity, and geometry.
• Employs numerical simulations to validate the analytical model, particularly for event location estimation under various Δt values.
• Models the transformation of error in a rotated coordinate system to compute the resulting error in the original geographic coordinate system.

Experimental results

Research questions

• RQ1 How does a GPS spoofing-based Time Synchronization Attack (TSA) affect the accuracy of PMU-based fault detection in transmission lines?
• RQ2 To what extent does TSA degrade voltage stability monitoring by distorting the timing of measurements?
• RQ3 How sensitive is event location estimation to time offsets introduced by TSA, and can it lead to large-scale mislocation of disturbances?
• RQ4 Why is TSA more difficult to detect than traditional false data injection attacks (FDIA)?
• RQ5 What is the quantitative relationship between time offset (Δt) and the resulting error in event location estimation?

Key findings

• TSA can significantly degrade fault location accuracy and increase false alarm rates in transmission line fault detection by introducing time-domain errors.
• The attack can exaggerate power system margins, delaying or disabling voltage instability alarms, thereby increasing the risk of cascading failures.
• Numerical simulations show that a 10 ms time offset can mislocate a disturbance event from Mississippi to Tennessee, demonstrating a location error of over 300 km.
• The relationship between time offset (Δt) and location error is nonlinear, with error increasing rapidly beyond small offset thresholds.
• TSA bypasses standard filtering techniques because it corrupts time stamps rather than measurement amplitudes, making it stealthier than traditional false data injection attacks.
• The analytical model shows that the error in event location is highly sensitive to the time offset, with partial derivatives indicating strong dependence on system geometry and signal velocity.