A Detection and Mitigation Model for PTP Delay Attack in an IEC 61850 Substation

Smart grid applications demand the availability of a reliable and accurate time signal. Measurements and events need to be correctly aligned to enable proper actions and decisions. Precision time protocol (PTP) is the favored protocol for time distribution across smart grid domains. The correct functionality of PTP is of paramount importance and its security is of high priority. To harden its security, detection, and prevention mechanisms against attacks targeting PTP are needed. In this paper, we propose detection and mitigation mechanisms against the known PTP delay attack. We apply model checking to quantify the effect of the delay attack. Moreover, the validity of the proposed mechanism is formally proven. The suggested approach is tested on a physical system. The collected results support the usefulness of the mechanism in detecting the delay attacks targeting PTP, and preserving the system functionality.