Modelling and Analysing Security Threats Targeting Protective Relay Operations in Digital Substations

Digitalization of power substations is mandatory to increase the efficiency, stability and reliability of smart grids. In digital substations, protective relays (e.g., overcurrent relays) can communicate using the IEC 61850 GOOSE protocol to provide fast response and discrimination capabilities to clear and isolate grid faults (e.g., short circuit events). However, exploitation of the GOOSE protocol vulnerabilities by cyber- attackers may lead to catastrophic failures in power substation equipment. Recent works consider the security vulnerabilities of the GOOSE protocol. However, a holistic approach to study different attack techniques and strategies that can be used by cyber-attackers to hijack communication channels between relays is currently missing. For example, the timing of injecting attack and the operation mode of the protective relay during the attack could lead to different impact. Moreover, a masquerade attack, mimicking the GOOSE protocol behaviour, is harder to be detected. This paper presents a comprehensive study of attack techniques and strategies and their respective impact, utilizing an integrated simulation model of the protective relays and their physical, communication and cybersecurity operations in a digital substation. Moreover, an assessment method for cyber-attacks is proposed based on the impact and the warnings caused by these attacks. Six simulation scenarios are modelled and analyzed, demonstrating the applicability of the proposed method.1- This work was partially supported by the European Union's Horizon 2020 research and innovation programme under grant agreement No 101021936 (ELECTRON) and No 101016912 (Smart5Grid), and by the European Union's Horizon 2020 research and innovation programme under grant agreement N0 739551 (KIOS CoE –TEAMING) and from the Republic of Cyprus through the Deputy Ministry of Research, Innovation and Digital Policy. 2- Copyright note:© 2023 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. 3- Citation: M. F. Elrawy, L. Hadjidemetriou, C. Laoudias and M. K. Michael, "Modelling and Analysing Security Threats Targeting Protective Relay Operations in Digital Substations," 2023 IEEE International Conference on Cyber Security and Resilience (CSR), Venice, Italy, 2023, pp. 523-529, doi: 10.1109/CSR57506.2023.10224964