Robust GPS-Based Timing for Phasor Measurement Units

Transcription

1 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG Robust GPS-Based Timing for Phasor Measurement Units October 3, 2014 Grace Xingxin Gao University of Illinois at Urbana-Champaign UNIVERSITY OF ILLINOIS DARTMOUTH COLLEGE UC DAVIS WASHINGTON STATE UNIVERSITY FUNDING SUPPORT PROVIDED BY DOE-OE AND DHS S&T 1

2 How to Make GPS-based Timing Robust? TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 2

3 Facts about GPS GPS provides timing for many applications, such as PMUs GPS civil signals are unencrypted Only GPS military signals are encrypted Civil users (e.g. PMUs) do not have access to the military codes GPS civil signal structures are completely open GPS civil signal definition is published in its Interface Control Documents (ICD) GPS received signals are extremely weak GPS satellites are 20,200 km (12,550 miles) away GPS is operational Satellites in orbits Signals being broadcast Billions of GPS receivers in use TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 3

4 Outline GPS Cooperative Authentication Pairwise check Decision aggregation Position-Information-Aided Vector Tracking Approach Implementation Experimental Results Conclusions TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 4

5 Outline GPS Cooperative Authentication Pairwise check Decision aggregation Position-Information-Aided Vector Tracking Approach Implementation Experimental Results Conclusions TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 5

6 Cooperative Authentication: Architecture Our proposed approach: cooperat ive aut hent icat ion I got my location. Can you guys check if I was spoofed? Cross-check receiver #1 Cross-check receiver #2 Your snippet matches mine. You are not spoofed! A snippet of baseband GNSS signal A high correlation! You are good, bro. User receiver It doesn t match mine. You might be spoofed. Cross-check receiver #N Merits: network and geographical redundancy 5 / 20 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 6

7 Pair-wise Checking: Cross-correlation of P(Y) Code Lo et al., 2009 Psiaki, Humphreys et al., 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 7

8 Outline GPS Cooperative Authentication Pairwise check Decision aggregation Position-Information-Aided Vector Tracking Approach Implementation Experimental Results Conclusions TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 8

9 Pairwise Check TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 9

10 Pairwise Check Ideal Results Pair-wise Check Ideal Results Not Spoofed Spoofed Pair-wise Check In-phase Baseband Correlation (C/A) 40 ms 40 Correlation peaks Quadraturephase Baseband Correlation (P(Y)) Single Correlation peak No Correlation peak Spoofer cannot generate TRUSTWORTHY CYBER INFRASTRUCTURE FOR FOR THE POWER THE POWER GRID GRID TCIPG.ORG TCIPG.ORG 24 10

11 Modeling Pairwise Check P(Y) codes don t match TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 11

12 Experiments with Different Scenarios 3000km San Francisco CA and Champaign IL, static 22km Rantoul IL, moving at ~45 mph and Champaign IL, static TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 12

13 Experiments: San Francisco & UIUC Everitt Lab GPS Front End Receiver SiGe Sampler 2 bit quantization Bandwidth: 2.72MHz Low cost, off the shelf Antenna Novatel Antenna GPS Front End Receiver SiGe Sampler 2 bit quantization Bandwidth: 2.72MHz TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 13

14 Pairwise Results for Different Separations 3000km separation 22km separation Almost no Residual Correlation Some Residual Correlation Near ideal Correlation Could detect spoofing Could detect spoofing TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 14

15 SNR Affects Pair-wise Check Performance TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 15

16 Outline GPS Cooperative Authentication Pairwise check Decision aggregation Position-Information-Aided Vector Tracking Approach Implementation Experimental Results Conclusions TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 16

17 Modeling Unreliable Cross-Check Receivers TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 17

18 Authentication Performance, Theoretical Results Pair-wise false alarm rate Pair-wise missed detection rate Probability of being spoofed by a different spoofer Probability of being spoofed by the same spoofer Authentication performance improves exponentially with increasing number of cross-check receivers. P SS causes twice as great performance deterioration as P SD does. Choose a cross-check receiver far from the user receiver. TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 18

19 Receiver Operating Characteristic (ROC) Curves TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 19

20 Performance of Cooperative Authentication Assume 20% of the cross-check receivers are spoofed (an extremely challenging assumption) Probability of missed detection (P MD = 1 - P D ) 10 0 P MD = P SS = 0, P SD = 0 P SS = 0.02, P SD = 0.18 P SS = 0.1, P SD = 0.1 P SS = 0.18, P SD = Number of cross-check receivers (N) Probability of missed detection Probability of false alarm (P FA ) P SS = 0, P SD = 0 P SS = 0.02, P SD = 0.18 P SS = 0.1, P SD = 0.1 P SS = 0.18, P SD = 0.02 P FA = Number of cross-check receivers (N) Probability of false alarm Robustness grows exponentially with the number of cross-check receivers A small number of unreliable cross-check receivers are on par with a reliable cross-check receiver. TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 20

21 Outline GPS Cooperative Authentication Pairwise check Decision aggregation Position-Information-Aided Vector Tracking Approach Implementation Experimental Results Conclusions TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 21

22 Approach: Position-Information-Aided (P.I.A.) Vector Tracking Approach: Vector tracking Reduces the search space Aided by the true position Kalman filtering Recursively predict and update the errors Narrowband loop filter TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 22

23 Scalar Tracking Incoming Signal GPS Front-end Channel 1-N f d, φ NCO Correlator Code and Carrier Discriminators Navigation Processing Position and Time Solutions (x, y, z, t) TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 23

24 Implementation: P.I.A. Vector Tracking Channel 1-N LOS Projection Navigation Prediction Code and Carrier Predictions Position, Velocity, Timing, Code, and Carrier Correction Incoming Signal GPS Front-end NCO f d, φ Correlator Timing Errors Position analysis Known True Position (x, y, z) Code and Carrier Discriminators Kalman Filter: Navigation Prediction Time Solution (t) TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 24

25 Implementation: Kalman Filter Filter States: δx, δv, δt, δt State Transition Matrix Predictions: δx = X (X + V Δt) δv = V V Calculation of receiver clock bias: t = 1 ω F = Δt Δt Δt Δt ω (ρ x x ) X = δx δy δz δv δv δv δt δt 1/var ε Psuedorange Satellite Position Known true position TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 25 14

26 P.I.A. Vector Tracking Improves Accuracy Loop filter bandwidth of 5Hz for both scalar and P.I.A tracking loops. 9 satellites in view Maximum errors: Traditional tracking ~50ns Proposed vector tracking ~15ns No Noise Added TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 26

27 P.I.A. Tracking Increases Noise Tolerance Increased noise leads to loss of lock in scalar tracking. At 4 db of additional noise, the scalar tracking was able to produce navigation bits for 4 satellites. Noise Added 0 db 9 1 db 8 3 db 5 4 db 4 # of Satellites Tracked 1 db Noise Added 4 db Noise Added TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 27

28 P.I.A. Tracking is Robust Against Jamming Scalar tracking fails at 5 db of added noise. P.I.A. Vector Tracking continued to operate up until 9 db of additional noise (5 db more noise tolerance over scalar tracking) Reduces a jammer s effective radius. 5 db Noise Added 9 db Noise Added Scalar tracking fails P.I.A. still tracking Scalar tracking fails P.I.A. still tracking TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 28

29 P.I.A. Tracking Detects Meaconing Meaconing: record and replay legitimate GPS signal. Meaconing attack simulated. P.I.A. Vector Tracking loop fails to converge in the event of a meaconing attack. 200 meter difference in known position and meaconing position. Meaconing attack begins TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 29

30 Outline GPS Cooperative Authentication Pairwise check Decision aggregation Position-Information-Aided Vector Tracking Approach Implementation Experimental Results Conclusions TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 30

31 Conclusions GPS cooperative authentication A modest number of low-reliable cross-check receivers outperform a high-quality reliable receiver. Robustness grows exponentially with the number of cross-check receivers. Position-Information-Aided Vector Robust against jamming (5dB more noise tolerance compared with scalar tracking); Successfully detects meaconing attacks; Improves the accuracy of the timing solutions (15 ns vs 50 ns). TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 31

32 Acknowledgement Prof. Jonathan Makela TCIPG References Daniel Chou, Liang Heng, and Grace Xingxin Gao, Robust GPS-Based Timing for Phasor Measurement Units: A Position-Information-Aided Vector Tracking Approach, ION GNSS+ 2014, Tampa FL, Sep 2014, Best Presentation of the Session Award. Liang Heng, Daniel Chou, and Grace Xingxin Gao, Cooperative GPS Signal Authentication from Unreliable Peers, ION GNSS+ 2014, Tampa FL, Sep 2014, Best Presentation of the Session Award. Liang Heng, Jonathan Makela, Alejandro Dominguez-Garcia, Rakesh Bobba, William Sanders, and Grace Xingxin Gao, Reliable GPS-based Timing for Power System Applications: A multi-layered Multireceiver Approach, the 2014 IEEE Power and Energy Conference at Illinois (IEEE PECI 2014), Champaign, IL, Feb Liang Heng, Daniel B. Work, and Grace Xingxin Gao, Reliability from Unreliable Peers: Cooperative GNSS Authentication, Inside GNSS Magazine, September October Liang Heng, Daniel B. Work, and Grace Xingxin Gao, GNSS Signal Authentication from Cooperative Peers, IEEE Transactions on Intelligent Transportation Systems, submitted. TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 32

33 Backup Slides TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 33

34 Multi-layer Countermeasures TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID TCIPG.ORG 34