Time signal manipulation and spoofing detection based on a latency of a communication system

• US 10,375,108 B2
• Filed: 12/29/2016
• Issued: 08/06/2019
• Est. Priority Date: 12/30/2015
• Status: Active Grant

• Current Assignee: Schweitzer Engineering Laboratories, Incorporated
• Original Assignee: Schweitzer Engineering Laboratories, Incorporated
• Inventors: Schweitzer, III, Edmund O., Tews, Cody W., Whitehead, David E.
• Primary Examiner(s): Kanaan, Simon P
• Application Number:
  US15/394,097
• Publication Number:
  US 20170195362A1
• Time in Patent Office: 950 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: Y04S 40/00 Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

This disclosure relates to detecting manipulation or spoofing of a time based on a latency of a communication system. In one embodiment, a system includes a time input to receive a time signal. The system includes a first interface to receive a first representation of a first condition at a first location at a first time and a second interface to receive a second representation of a second condition at a second location and at the first time. A latency determination subsystem may determine a latency based on a comparison of the time of arrival of the second measurement and the first time. A threshold subsystem may generate an indication of whether the latency satisfies a threshold. An anomalous condition subsystem may identify an anomalous condition based on the indication, and a remedial action may be implemented based on the anomalous condition.

Claims

1. An intelligent electronic device (IED), comprising:

a time input configured to receive a time signal;

a monitored equipment interface in electrical communication with an electric power system at a first location, wherein the monitored equipment interface is configured to obtain a first measurement of electrical conditions at the first location at a first time based on the time signal;

a communications interface configured to receive via a communication system a second measurement of electrical conditions obtained at a second location by another IED and at the first time based on the time signal;

a latency determination subsystem in communication with the time input, monitored equipment interface, and communications interface and configured to determine a latency based on a comparison between a second time in which the second measurement is received by the IED via the communication system and the first time;

a threshold subsystem configured to generate an indication of whether the latency exceeds a first threshold;

an anomalous condition subsystem configured to identify an anomalous condition based on the indication; and

a remedial action subsystem configured to exclude the second measurement from a control action of the electric power system when the latency exceeds the first threshold.

2. The IED of claim 1, wherein the anomalous condition comprises spoofing of the time signal at one of the first location and the second location.

3. The IED of claim 1, wherein the anomalous condition comprises a configuration change in the communication system.

4. The IED of claim 1, wherein the time system input is configured to receive the time signal from a Global Navigation Satellite System.

5. The IED of claim 1, wherein the latency determination subsystem is configured to generate a dataset based on the latency at a plurality of times.

6. The IED of claim 5, wherein the threshold subsystem is further configured to generate the first threshold based on the dataset.

7. The IED of claim 1, wherein the remedial action comprises suppressing the control action configured to reconfigure the electric power system.

8. The IED of claim 1, wherein the communication system comprises a deterministic communication system.

9. The IED of claim 1, wherein the threshold subsystem is further configured to generate the indication based on whether the communication system latency is less than the first threshold and greater than a second threshold.

10. The IED of claim 9, wherein the first threshold comprises a first product of a first multiplier and a statistical representation of the latency of the communication system, and the second threshold comprises a second product of a second multiplier and the statistical representation of the latency of the communication system.

11. The IED of claim 1, further comprising a fault detection module configured to detect a fault in the electric power system based on the first measurement of electrical conditions at the first location and the second measurement of electrical conditions at the second location, and wherein the fault detection module is further configured to generate a control instruction to clear the fault.

12. The IED of claim 11, wherein the first measurement of electrical conditions and the second measurement of electrical conditions represent a traveling wave generated by the fault.

13. A method, comprising:

receiving a time signal at each of a first location and a second location;

generating, via a first intelligent electronic device (IED) at the first location, a first measurement of electrical conditions at the first location at a first time based on the time signal;

generating, via a second IED at the second location, a second measurement of electrical conditions at the second location at the first time based on the time signal;

transmitting the second measurement from the second IED through a communication system to the first IED;

determining a latency based on a comparison between a second time in which the second measurement is received by the first IED and the first time;

generating an indication of whether the latency exceeds a first threshold;

identifying an anomalous condition based on the indication; and

excluding the second measurement from a control action of an electric power system when the latency exceeds the first threshold.

14. The method of claim 13, wherein the anomalous condition comprises spoofing of the time signal at one of the first location and the second location.

15. The method of claim 13, further comprising generating a dataset based on the latency at a plurality of times.

16. The method of claim 15, further comprising generating the first threshold based on the dataset.

17. The method of claim 13, wherein the remedial action comprises suppressing the control action configured to reconfigure the electric power system.

18. The method of claim 13, further comprising:

detecting a fault in the electric power system based on the first measurement of electrical conditions at the first location and the second measurement of electrical conditions at the second location; and

generating a control instruction to clear the fault.

19. A system, comprising:

a time input configured to receive a time signal;

a monitored equipment interface configured to receive, via measuring conditions of a power delivery system, a first representation of a first condition at a first location at a first time based on the time signal;

a communications interface configured to receive, via a communication system, a second representation of a second condition at a second location and at the first time based on the time signal;

a latency determination subsystem in communication with the time input, monitored equipment interface, and the communications interface and configured to determine a latency based on a comparison between a second time in which the second measurement is received by the second interface through the communication system and the first time;

a threshold subsystem configured to generate an indication of whether the latency exceeds a threshold;

an anomalous condition subsystem configured to identify an anomalous condition based on the indication; and

a remedial action subsystem configured to exclude the second measurement from a control action of an electric power system when the latency exceeds the first threshold.