Vulnerability of IEEE 1588 under Time Synchronization Attacks

Time Synchronization is critically important in the alignment of signals resulting from a power system event or the measurement of data required to perform a protection and control action. IEEE 1588 Precision Time Protocol (PTP) achieves sub-microsecond accuracy via Ethernet with the aid of hardware timestamping techniques. Although PTP is being deployed in more newly-built IEC 61850 substations, the cybersecurity perspectives are often ignored or receive inadequate attention. Time Synchronization Attacks (TSA) targeting on IEEE 1588 may result in timing errors or cause the loss of synchronization, which may potentially lead to catastrophic failures of monitoring, protection and control applications. In this paper, mathematical analysis is first presented to illustrate the impact of TSA on PTP. A hardware testbed was then implemented to perform TSA including delay attacks, packet modification attacks, spoofing attacks and excessive traffic injection attacks on commercial PTP devices. The characteristics of PTP clocks under attack are compared, and the severity of different types of TSA are discussed.