Implementing A Real-Time Cyber-Physical System Test Bed in RTDS and OPNET
Implementing A Real-Time Cyber-Physical System Test Bed in RTDS and OPNET
Implementing A Real-Time Cyber-Physical System Test Bed in RTDS and OPNET
Ana Goulart
Department of Engineering
Technology and Industrial Distribution
I.
INTRODUCTION
Deepa Kundur
Department of Electrical and
Computer Engineering
University of Toronto
Toronto, ON, Canada
dkundur@comm.utoronto.ca
(implemented in RTDS)
Power System
(implemented in RTDS)
Physical IEDs
Data
Exchange
Socket
Control/dispatch commentsPackets
Communication
Network
(implemented in OPNET)
Packets
Packets
Gen1
6 7
10
11
Gen2
CASE STUDY
A. Test System
To evaluate the proposed test bed, an 11 bus test system
was modeled in RTDS. The parameters of the test system are
available in [5]. The single line diagram is shown in Figure 3.
A static var compensator (SVC) was connected to bus 11. The
performance of SVC under both normal condition and
contingency condition can be found in [5]. Figure 3 also
shows the communication network of a single substation.
Future work will develop a communication network that
includes a control center and multiple substations.
B. Man-In-The-Middle Attack
In the case study, a man-in-the-middle (MITM) attack was
assumed to be launched on the control IED of SVC. As shown
in Figure 5, to launch a MITM attack, the attacker or the virus
will disconnect the connection between the MU in process
level and the control IED in bay level, then make two
independent connections to the MU and the control IED,
respectively. The attacker can act as a mediator between the
MU and the control IED by pretending the data source or the
data target, hence making the MU and the control IED believe
that they are still communicating with each other directly.
After intercepting the connections, the attacker can get control
of the message by delaying or modifying the payload of the
packets [27]. In this study, the attacker recorded the
measurement values derived from the MU, and injected them
to the control IED. Thus the control IED continued to receive
the values that were replayed repeatedly by the attacker.
C. Impact of MITM Attack
The MITM attack was assumed to be launched under
normal condition. A 3-phase bolted fault happened at bus 7 at
time 1.0 s, and cleared after 67 ms (4 cycles) by opening line
3-7. The attacker kept injecting the measurement values that
recorded under normal condition to the control IED of SVC.
IV.
400
200
0
-200
200
0
-200
-400
0
0.5
1.5
2
2.5
3
Time (second)
3.5
4.5
[6]
600
500
[7]
400
300
[8]
200
[9]
100
0
-100
0
[10]
0.5
1.5
2
2.5
3
Time (second)
3.5
4.5
[11]
1.05
1
0.95
[13]
0.9
[14]
0.85
0.8
[15]
0.75
0.7
0
0.5
1.5
2.5
3
Time (second)
3.5
4.5
V.
REFERENCES
[2]
[3]
[4]
[5]
[16]
[12]
[17]
[18]
[19]
[20]
[21]
[22]
[23]
[24]
[25]
[26]
[27]