Spoofing GPS receiver clock offset of phasor measurement units

We demonstrate the feasibility of a spoofing attack on the GPS receiver of a phasor measurement unit (PMU). We formulate the attack as an optimization problem where the objective is to maximize the difference between the PMU's receiver clock offset (with respect to the GPS time measured by the onboard satellite clocks) before and after the attack. Since the PMU uses this clock offset to compute a synchronized time stamp for its measurements, an error in the receiver clock offset introduces a proportional phase error in the voltage or current phase measurements provided by the PMU. For the most general case, the decision variables in the optimization problem are the satellites' ephemerides, pseudoranges, and the receiver's Earth-Centered Earth-Fixed (ECEF) coordinates. The constraints are cast such that the decision variables and the satellite positions computed from the solution of the optimization problem are close to their pre-attack values, so as to avoid possible detection schemes that check for large jumps in the values of these variables. We show that the spoofing attack is feasible for any number of visible satellites. As an illustration of the impact of such spoofing attacks, we present simulation results in which the attack induces errors in a real-time voltage stability monitoring algorithm that relies on the phase information from measurements provided by PMUs.