Resilience of IEC 61850 Sampled Values-Based Protection Systems Under Coordinated False Data Injections

TL;DR

This paper evaluates the vulnerability of IEC 61850 Sampled Values-based protection systems to coordinated false data injection attacks, demonstrating their feasibility and proposing resilience strategies using advanced experimental setups.

Contribution

It introduces an experimental framework for analyzing multi-vector FDIAs on IEC 61850 systems and proposes a resilience method based on trusted channels and data cross-verification.

Findings

Stealthy multi-vector FDIAs can trigger false protections or conceal faults.

Experimental setup confirms the feasibility of coordinated cyber-physical attacks.

Resilience strategies can mitigate identified vulnerabilities.

Abstract

This paper assesses the resilience of IEC 61850 digital substations under False Data Injection Attacks (FDIAs) targeting the Sampled Values (SV) protocol. The multicast nature of SV, while enabling time-critical automation, exposes substations to cyber intrusions capable of disrupting protection functions and causing large-scale outages. To evaluate these risks, coordinated attack vectors involving both physical and cyber access at the bay level are experimentally analyzed using an advanced setup based on industrial-grade intelligent electronic devices (IEDs). The proposed attacks simultaneously manipulate multiple electrical parameters in a coordinated and physically consistent manner. Experimental results confirm the feasibility of stealthy multi-vector FDIAs that can trigger false protection actions, conceal real faults, or block protection mechanisms while maintaining realistic signal behavior. The Power Hardware-in-the-Loop (PHIL) testbed enables closed-loop evaluation under strict timing, communication, and protection logic constraints, reflecting real device behavior beyond simulation and controller-level HIL environments. The findings reveal critical vulnerabilities in SV-based protection schemes that directly affect grid reliability, particularly under realistic attacker positioning. To address these challenges, a defense strategy covering deterrence, prevention, detection, mitigation, and resilience is analyzed, with emphasis on bay-level infrastructure. Furthermore, a resilience-oriented method based on trusted independent channels and cross-verification of SV data within the protection logic is outlined as a complementary countermeasure for scenarios where existing standardized security mechanisms are insufficient.