Simple Cracking of (Noise-Based) Dynamic Watermarking in Smart Grids

Mehmet Yildirim,Nasir Kenarangui,Robert Balog,Laszlo B. Kish,Chanan Singh

2024-06-27

Abstract:Previous research employing a conceptual approach with a digital twin has demonstrated that (noise-based) dynamic watermarking is incapable of providing unconditional security in smart electrical grid systems. However, the implementation of digital twins can be prohibitively costly or infeasible due to limited available data on critical infrastructure. In this study, we first analyze the spectral properties of dynamic watermarking and its associated protocol. Subsequently, we present a straightforward attack inspired by the digital twin method, which extracts and utilizes the grid noises and completely breaches the security of dynamic watermarking without requiring knowledge of the private watermarking signal. The attacker can fully expose the grid while evading detection by the controller. Our findings indicate that in the absence of secure and authenticated communications, dynamic watermarking offers neither conditional nor unconditional security. Conversely, when communication lines, sensors, and communicators are equipped with tamper-resistant and secure/authenticated links, dynamic watermarking becomes redundant for grid security.

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is to evaluate and break the security of noise - based Dynamic Watermarking (DW) in smart grids. Specifically, the authors explore the security and effectiveness of dynamic watermarking in smart grid systems and propose a simple and low - cost attack method to prove that dynamic watermarking cannot provide unconditional security.

### Main problems:
1. **Security of dynamic watermarking**: Previous studies have shown that dynamic watermarking cannot provide unconditional security, especially in the absence of secure communication. This paper further analyzes the spectral characteristics of the dynamic watermarking protocol and its operating conditions.
2. **Feasibility of the attack method**: This paper proposes a simple attack method that does not require expensive digital twin technology, and completely breaks the security of dynamic watermarking by extracting and using grid noise.
3. **Effectiveness of dynamic watermarking**: When communication lines, sensors, and communication devices have tamper - proof and secure authentication links, dynamic watermarking becomes redundant because these basic security measures are sufficient to protect the power grid.

### Core contributions of the paper:
- **Spectral analysis**: A detailed analysis of the spectral characteristics of the dynamic watermarking protocol is carried out, revealing its limitations in practical applications.
- **Simple attack scheme**: A simple hardware scheme and protocol are proposed, which can successfully attack the dynamic watermarking system without relying on private watermarking signals.
- **Security conclusion**: It is pointed out that in the absence of secure communication and authentication, dynamic watermarking can neither provide conditional security nor unconditional security. On the contrary, if the communication and sensors themselves have sufficient security, dynamic watermarking is redundant.

### Summary of key formulas:
1. The line voltage under ideal conditions is expressed as:
\[
V_L(t) = a_0\sin(2\pi f_g t+\phi_0)
\]
where \(a_0\) is the peak voltage, \(f_g\) is the grid frequency (60Hz), and \(\phi_0\) is the phase angle.

2. The line voltage after dynamic watermarking is expressed as:
\[
V_{Lw}(t) = a_0[1 + N_w(t)]\sin(2\pi f_g t+\phi_0)
\]
where \(N_w(t)\) is the injected Gaussian noise.

3. The dynamic watermarking envelope is expressed as:
\[
E_w(t) = a_0[1 + N_w(t)]
\]

4. Bandwidth limitation of the noise power density spectrum:
\[
B\leq0.3\text{Hz}
\]

5. The detected envelope is expressed as:
\[
E_{wdp}(t) = a_0[1 + N_{wd}(t)+N_{pd}(t)]
\]

6. The method for the attacker to extract the noise component:
\[
E_{wdpN}(t)=E_{wdp}(t)-a_0 = a_0[N_{wd}(t)+N_{pd}(t)]
\]

7. The formula for synthesizing a false signal:
\[
S_f(t)=R_f + N_{wd}^f(t)+N_{pd}^f(t)=\alpha R+\beta N_{wd}(t)+\gamma N_{pd}(t)
\]

Through these analyses and experimental results, the authors conclude that dynamic watermarking in smart grids is not as secure as expected and propose suggestions for more effective security measures.