Security of Information Flow in the Electric Power Grid

Abstract

The confidentiality of information in a system can be breached through unrestricted information flow. The formal properties of non-deducibility and non-inference are often used to assess information flow in purely cyber environments. However, in a "cyber-physical system" (CPS), i.e., a system with significant cyber and physical components, physical actions may allow confidential information to be deduced or inferred. This paper conducts an information flow analysis of a CPS using formal models of confidentiality. The specific CPS under study is the advanced electric power grid using cooperating flexible alternating current transmission system (FACTS) devices. FACTS devices exchange confidential information and use the information to produce physical actions on the electric power grid. This paper shows that even if the information flow satisfies certain security models, confidential information may still be deduced by observation or inference of a CPS at its cyber-physical boundary. The result is important because it helps assess the confidentiality of CPSs.

The Security Implication of Multiple Observers in a Distributed System

“…The nature of the attack can be physical, cyber, or both. Divulging the confidentiality of the cyber system through these external observations, in particular, forms a type of information leakage [4] from the confidential domain of the control system to an external observer. Note that, this question does not necessarily require that the full system state be known.…”

A review of European low-voltage distribution networks

“…For the theoretical network, power grid modelling methods and tools have been thoroughly reviewed in the literature [38] [39]. The modelling methods can be generally categorised into four types: single-node model [40], transshipment model [41], direct current model [42], and alternating current power flow model [42]. Simulation tools include, amongst other, OpenDSS [43], GridLAB-D [44], and Modelica [45].…”

Nondeducibility-Based Analysis of Cyber-Physical Systems

“…Thus, some aspects of the cyber domain decisions eventually manifest themselves in the physical domain as flow changes in power lines. Prior work [12] has shown that, in terms of information flow security, an external observer could deduce the local action on a particular power line or lines, and infer the overall state of the system based on external flow change measurements. However, this paper does not address the question of how many cooperating observers are required to fully discover changes in the system state.…”