Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Cyber-security in Smart Grid Communication and Control
KTH, School of Electrical Engineering (EES), Communication Networks.
2014 (English)Doctoral thesis, comprehensive summary (Other academic)
Abstract [en]

Society is increasingly dependent on the reliable operation of power systems. Power systems, at the same time, heavily rely on information technologies to achieve efficient and reliable operation. Recent initiatives to upgrade power systems into smart grids target an even tighter integration with information technologies to enable the integration of renewable energy sources, local and bulk generation and demand response. Thus for the reliable operation of smart grids, it is essential that its information infrastructure is secure and reliable in the face of both failures and attacks. This thesis contributes to improving the security of power systems against attacks on their information infrastructures. The contributions lie in three areas: data integrity, data condentiality, and data availability of power system applications.

We analyze how characteristics of power system applications can be leveraged for detection and mitigation of data integrity attacks. We consider singleand multi-area power system state estimation. For single-area state estimation, we look at the integrity of measurement data delivered over a wide area communication network. We deffine security metrics that quantify the importance of particular components of the communication network, and that allow us to optimize the deployment of network, transport and application layer security solutions. For multi-area state estimation, we look at the integrity of data exchanged between the control centers of neighboring areas in face of a targeted trojan that compromises an endpoint of the secure communication tunnel. We deffine multiple attack strategies and show that they can signifficantly disturb the state estimation. Moreover, we propose schemes that could be used for detection, localization, and mitigation of data integrity attacks.

We investigate how to provide data confidentiality for power system applications when they utilize cloud computing. We focus on contingency analysis and propose an approach to obfuscate information regarding power flows and the presence of a contingency violation while allowing the operator to analyze contingencies with the needed accuracy in the cloud. Our empirical evaluation shows that the errors introduced into power flows due to the proposed obfuscation are small, and that the RMS errors introduced grow linearly with the magnitude of obfuscation.

We study how to improve data availability in face of gray hole attacks combined with traffic analysis. We consider two cases: SCADA substation to control center communication using DNP3, and inter-control center communication. In the first case, we propose a support vector machine-based traffic analysis algorithm that uses only the information on timing and direction of three consecutive messages, and show that a gray hole attack can be effectively performed even if the traffic is sent through an encrypted tunnel. We discuss possible mitigation schemes, and show that a minor modication of message timing could help mitigate the attack. In the second case, we study how anonymity networks can be used to improve availability at the price of increased communication overhead and delay. We show that surprisingly availability is not always improved with more overhead and delay. Moreover, we show that it is better to overestimate than to underestimate the attacker's capabilities when conguring anonymity networks.

Place, publisher, year, edition, pages
Stockholm: KTH Royal Institute of Technology, 2014. , vi, 48 p.
Series
TRITA-EE, ISSN 1653-5146 ; 2014:039
National Category
Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Electrical Engineering
Identifiers
URN: urn:nbn:se:kth:diva-152223ISBN: 978-91-7595-250-5 (print)OAI: oai:DiVA.org:kth-152223DiVA: diva2:749312
Public defence
2014-10-07, Hörsal F3, Lindstedtsvägen 26, KTH, Stockholm, 10:00 (English)
Opponent
Supervisors
Note

QC 20140924

Available from: 2014-09-24 Created: 2014-09-23 Last updated: 2014-09-24Bibliographically approved
List of papers
1. Network-Aware Mitigation of Data Integrity Attacks on Power System State Estimation
Open this publication in new window or tab >>Network-Aware Mitigation of Data Integrity Attacks on Power System State Estimation
2012 (English)In: IEEE Journal on Selected Areas in Communications, ISSN 0733-8716, E-ISSN 1558-0008, Vol. 30, no 6, 1108-1118 p.Article in journal (Refereed) Published
Abstract [en]

Critical power system applications like contingency analysis and optimal power flow calculation rely on the power system state estimator. Hence the security of the state estimator is essential for the proper operation of the power system. In the future more applications are expected to rely on it, so that its importance will increase. Based on realistic models of the communication infrastructure used to deliver measurement data from the substations to the state estimator, in this paper we investigate the vulnerability of the power system state estimator to attacks performed against the communication infrastructure. We define security metrics that quantify the importance of individual substations and the cost of attacking individual measurements. We propose approximations of these metrics, that are based on the communication network topology only, and we compare them to the exact metrics. We provide efficient algorithms to calculate the security metrics. We use the metrics to show how various network layer and application layer mitigation strategies, like single and multi-path routing and data authentication, can be used to decrease the vulnerability of the state estimator. We illustrate the efficiency of the algorithms on the IEEE 118 and 300 bus benchmark power systems.

Keyword
SCADA communication, state estimation, cyber-physical security
National Category
Telecommunications
Research subject
SRA - ICT
Identifiers
urn:nbn:se:kth:diva-92610 (URN)10.1109/JSAC.2012.120709 (DOI)000305984500009 ()2-s2.0-84863506343 (Scopus ID)
Projects
EU FP7 VikingACCESS
Funder
EU, FP7, Seventh Framework ProgrammeICT - The Next Generation
Note

QC 20140924

Available from: 2012-04-04 Created: 2012-04-04 Last updated: 2017-12-07Bibliographically approved
2. On the Security of Distributed Power System State Estimation under Targeted Attacks
Open this publication in new window or tab >>On the Security of Distributed Power System State Estimation under Targeted Attacks
2013 (English)In: Proceedings of the 28th Annual ACM Symposium on Applied Computing, 2013, 666-672 p.Conference paper, Published paper (Refereed)
Abstract [en]

State estimation plays an essential role in the monitoring and control of power transmission systems. In modern, highly inter-connected power systems the state estimation should be performed in a distributed fashion and requires information exchange between the control centers of directly connected systems. Motivated by recent reportson trojans targeting industrial control systems, in this paper we investigate how a single compromised control center can affect the outcome of distributed state estimation. We describe five attack strategies, and evaluate their impact on the IEEE 118 benchmark power system. We show that that even if the state estimation converges despite the attack, the estimate can have up to 30% of error, and bad data detection cannot locate theattack. We also show that if powerful enough, the attack can impede the convergence of the state estimation, and thus it can blind the system operators. Our results show that it is important to provide confidentiality for the measurement data in order to prevent the most powerful attacks. Finally, we discuss a possible way to detect and to mitigate these attacks.

Keyword
Cyber security, Power systems, state estimation, distributed
National Category
Communication Systems Computer Systems
Identifiers
urn:nbn:se:kth:diva-122442 (URN)10.1145/2480362.2480490 (DOI)2-s2.0-84877942955 (Scopus ID)978-1-4503-1656-9 (ISBN)
Conference
28th Annual ACM Symposium on Applied Computing (SAC)
Note

QC 20130522

Available from: 2013-05-21 Created: 2013-05-21 Last updated: 2014-09-24Bibliographically approved
3. Security of Fully Distributed Power System State Estimation: Detection and Mitigation of Data Integrity Attacks
Open this publication in new window or tab >>Security of Fully Distributed Power System State Estimation: Detection and Mitigation of Data Integrity Attacks
2014 (English)In: IEEE Journal on Selected Areas in Communications, ISSN 0733-8716, E-ISSN 1558-0008, Vol. 32, no 7, 1500-1508 p.Article in journal (Refereed) Published
Abstract [en]

State estimation (SE) plays an essential role in the monitoring and supervision of power systems. In today's power systems, SE is typically done in a centralized or in a hierarchical way, but as power systems will be increasingly interconnected in the future smart grid, distributed SE will become an important alternative to centralized and hierarchical solutions. As the future smart grid may rely ondistributed SE, it is essential to understand the potential vulnerabilities that distributed SE may have. In this paper, we show that an attacker that compromises the communication infrastructure of a single control center in an interconnected power system can successfully perform a denial-of-service attack against state-of-the-art distributed SE, and consequently, it can blind the system operators of every region. As a solution to mitigate such a denial-of-service attack, we propose a fully distributed algorithm for attack detection. Furthermore, we propose a fully distributed algorithm that identifies the most likelyattack location based on the individual regions' beliefs about the attack location, isolates the identified region, and then reruns the distributed SE. We validate the proposed algorithms on the IEEE 118 bus benchmark power system.

Place, publisher, year, edition, pages
IEEE Press, 2014
Keyword
distributed power system state estimation, data integrity attacks, detection, false data injection, mitigation, security
National Category
Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Electrical Engineering
Identifiers
urn:nbn:se:kth:diva-152219 (URN)10.1109/JSAC.2014.2332106 (DOI)000342913600016 ()2-s2.0-84906700148 (Scopus ID)
Projects
EIT ICTLabs ASES 13030
Funder
Swedish Research Council, 2010:5812
Note

QC 20140924

Available from: 2014-09-23 Created: 2014-09-23 Last updated: 2017-12-05Bibliographically approved
4. Confidentiality-preserving Obfuscation for Cloud-based Power System Contingency Analysis
Open this publication in new window or tab >>Confidentiality-preserving Obfuscation for Cloud-based Power System Contingency Analysis
2013 (English)In: 2013 IEEE International Conference on Smart Grid Communications (SmartGridComm), IEEE conference proceedings, 2013, 432-437 p.Conference paper, Published paper (Refereed)
Abstract [en]

Power system operators are looking to adopt and migrate to cloud technologies and third-party cloud services for customer facing and enterprise IT applications. Security and reliability are major barriers for adopting cloud technologies and services for power system operational applications. In this work we focus on the use of cloud computing for Contingency Analysis and propose an approach to obfuscate information regarding power flows and the presence of a contingency violation while allowing the operator to analyze contingencies with the needed accuracy in the cloud. Our empirical evaluation shows, i) that the errors introduced into power flows due to the obfuscation approach are small, and ii) that the RMS errors introduced grow linearly with the magnitude of obfuscation.

Place, publisher, year, edition, pages
IEEE conference proceedings, 2013
Keyword
Cloud services, Cloud technologies, Contingency analysis, Empirical evaluations, Operational applications, Power system operators, Security and reliabilities, System contingencies
National Category
Electrical Engineering, Electronic Engineering, Information Engineering
Identifiers
urn:nbn:se:kth:diva-134821 (URN)10.1109/SmartGridComm.2013.6687996 (DOI)000330174800073 ()2-s2.0-84893549292 (Scopus ID)978-1-4799-1526-2 (ISBN)
Conference
The 4th IEEE International Conference on Smart Grid Communications (SmartGridComm) in Vancouver, Canada, 21-24 October, 2013
Note

QC 20140107

Available from: 2013-11-29 Created: 2013-11-29 Last updated: 2014-09-24Bibliographically approved
5. Mitigating Gray Hole Attacks in Industrial Communications using Anonymity Networks: Relationship Anonymity-Communication Overhead Trade-off
Open this publication in new window or tab >>Mitigating Gray Hole Attacks in Industrial Communications using Anonymity Networks: Relationship Anonymity-Communication Overhead Trade-off
(English)Manuscript (preprint) (Other academic)
Abstract [en]

Gray hole attacks are a significant threat to mission critical communication infrastructures, such as industrial control systems. They are relatively easy to perpetrate, as an attacker that has access to communication links or equipment could observe the source and destination addresses for every message, and can identify and discard the messages exchanged between particular communication participants. Anonymity networks could render these attacks more difficult by providing anonymous communication via relaying. Nevertheless, relaying introduces overhead as it increases end-to-end message delivery delay and introduces additional traffic, which both in practice must often be low. Hence, an important question is how to optimize anonymity for limited overhead. In this paper we address this question by studying two anonymity networks: MCrowds, an extension of Crowds, which provides unbounded communication delay and Minstrels, which provides bounded communication delay. We derive exact analytical expressions for the relationship anonymity for these systems. Using MCrowds and Minstrels we show that, contrary to intuition, increased overhead does not always improve anonymity. We investigate the impact of the system’s parameters on anonymity and on the optimal anonymity network parameters, and the sensitivity of anonymity to the misestimation of the number of attackers.

National Category
Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Electrical Engineering
Identifiers
urn:nbn:se:kth:diva-152222 (URN)
Note

QS 2014

Available from: 2014-09-23 Created: 2014-09-23 Last updated: 2014-09-24Bibliographically approved
6. Peekaboo: A gray hole attack on encrypted SCADA communication using traffic analysis
Open this publication in new window or tab >>Peekaboo: A gray hole attack on encrypted SCADA communication using traffic analysis
2014 (English)In: 5th IEEE International Conference on Smart Grid Communications 2014 (SmartGridComm 2014) in Venice, Italy, IEEE, 2014, 902-907 p.Conference paper, Published paper (Refereed)
Abstract [en]

We consider a potential gray hole attack against SCADA substation to control center communications using DNP3. We propose a support vector machine-based traffic analysis algorithm that relies on message direction and timing information only, and we use trace-based simulations to show that even if SCADA traffic is sent through an encrypted tunnel, as often done in practice, the gray hole attack can be effectively performed based on the timing and direction of three consecutive messages. Our results show that the attacker does not need accurate system information to be successful, and could affect monitoring accuracy by up to 20%. We discuss possible mitigation schemes at different layers of the communication protocol stack, and show that a minor modification of message timing could help mitigate the attack.

Place, publisher, year, edition, pages
IEEE: , 2014
Keyword
Different layers, Encrypted tunnels, Mitigation schemes, Monitoring accuracy, System information, Timing information, Trace-based simulation, Traffic analysis
National Category
Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Electrical Engineering
Identifiers
urn:nbn:se:kth:diva-152221 (URN)10.1109/SmartGridComm.2014.7007763 (DOI)2-s2.0-84922423976 (Scopus ID)9781479949342 (ISBN)
Conference
2014 IEEE International Conference on Smart Grid Communications, SmartGridComm 2014; Venice; Italy; 3 November 2014 through 6 November 2014
Projects
EIT ICTLabs activity SES 14306
Note

QC 20140924

Available from: 2014-09-23 Created: 2014-09-23 Last updated: 2015-05-27Bibliographically approved

Open Access in DiVA

Vukovic-PhDthesis2014-g5-Intro(545 kB)651 downloads
File information
File name FULLTEXT01.pdfFile size 545 kBChecksum SHA-512
4bac0d177d38097c7d7b75223eee3bb27da873781023609134ef8c24cc9ba1305183af3070d176aa3d9c22e1e6149faef4f919299f6ed0ca072a78b045145599
Type fulltextMimetype application/pdf

Search in DiVA

By author/editor
Vuković, Ognjen
By organisation
Communication Networks
Electrical Engineering, Electronic Engineering, Information Engineering

Search outside of DiVA

GoogleGoogle Scholar
Total: 651 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

isbn
urn-nbn

Altmetric score

isbn
urn-nbn
Total: 1614 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf