The risk from power line‐ how to sniff the G3 and Primedata and detect the interfere attack
Lei Ji (brianaus@163.com)

Abstract
Power line communication (PLC) is a kind of communication technology
which is used the power line as the communication media. The PLC
technology is divided with 2 sub‐field: narrow‐band PLC and wide‐band
PLC. For the narrow‐band PLC, there are 2 very import standards: Primeand G3.
Both the standards are wide used in AMR and electric monitor system andit lead to the rise of threat in AMR system security and electric safety.
This topic will talk about how to get the PLC data stream in a PLC
communication system which would use G3 or Prime standard, and will
also talk about how to detect attacking in the net.
We will focus on how to identify which kind of standard the system using
and how to sniff the PLC data in physical level.

The following section will show the outline of white paper:
1 PLC classification
2 The current low bandwidth AMR PLC standard
3 How to Identify the G3 and PRIME in PLC system

4 Demolition G3/PRIME physical layer data
6 Detect interfere attack

PLC classification
PLC is divide into 2 sub‐class, Low bandwidth PLC and High bandwidth PLC.
The features are as below:
Classification Modulation Datarate(bps) Benefit

Application

Low

Power‐FSK,OFDM

5K~100K

bandwidthLongcommunication meter
distance, cross AMR,
transformer

Municipal
facilities,
Smart gridHighbandwidth

DMT

Up to 100M

High‐speed

Internet

data access

access

The current low bandwidth AMR PLC standard

PLC has many standards, G3 and PRIME are the most widely used. In manystandards, the total of G3 pay more attention to robustness. Consider tothe PLC would work on a variety of environment and the environment ofthe existence of the different kinds of disturbances, with standard G3
tolerance of noise robustness often makes itself become a more global
application projects favored by selection.
G3 managed by the G3 alliance. In Europe, G3 works in the CENELEC‐Aband, and can be extended to the entire FCC band in other countries toprovide a high data rate. G3 is a two‐way communication standard, with
an effective data rate of 20 Kbps to 40 Kbps. It can coexist with S‐FSK andother traditional PLC technologies.
Other standards other than G3While many countries around the G3 implementation of Standardization(especially in France), but some countries (such as Spain) then chose othertechnologies, such as: PRIME. However, the real standard of competition
is just just started. Countries such as China, Indonesia and Japan have notyet shown signs of standardization around the PLC.
G3 and PRIME compare

Parameter

PRIME (OFDM)

G3 (OFDM)

Base band clock 250kHz

400kHzSimbol leng

2240 μs

735 μsPreamble leng

2048 μs

715 μs x 9.5=6792 μs

Data sub‐carrier 84（Header）,96（Payload）36
frequency
Navigation sub‐ 84（Header）,1（Payload）
carrier frequency
Modulation

DBPSK / DQPSK/D8PSKDBPSK / DQPSK/ (D8PSK)

Band

42 ~ 89 kHz

36 ~ 91 kHz

MAC

PRIME MAC

802.15.4/G3

Net

IEC61334‐4‐32/IPv6

6LoWPAN/IPv6

How to Identify the G3 and PRIME in PLC system
For G3 and PRIME, their symbol length, carrier frequency, communication
band are different. So the power Spectrum will be different. The first step
will get the Power Spectrum of Communication signal. The A/D ofprocessor will do the time domain, then calculate the power spectrum.
The Power Spectrum can be calculate as:

P x (ej) r x ( k )e jk k 

The Second Step will calculate the standard OFDM Power Spectrum:
The S(f ) of DBPSK and DQPSK areN 1

S BPSK (f )   Tb sin c 2((f  fck )Tb )  sin c 2((f f ck)Tb ) / 4
ck  0N 1S QPSK (f )   Tb [sin(2(f  fck )Tb ) /(2(f  fc )Tb )]2  [sin(2(f  fck )Tb ) /(2(f  fc )Tb )]2ck  0

The third step is judge the matching degree of the signal powerspectrum standard power spectrum.

 xy (0) N2x(n )y(n ) / rx(0) * ry(0)
n N
 1

 xy(0) is more than a accepted value, two power spectrum matched.

Demolition G3/PRIME physical layer data
After testing the standard to be carried out OFDM demodulation, OFDM
is a high‐speed serial data through the frequency division multiplexing toachieve parallel transmission of multi carrier transmission technology. Themodulation and demodulation system block diagram is as followsThe symbol rate is T, the bit rate is Ts, because the relationship of serial toparallel transform, so T=NTs.
Each subcarrier signal is demodulate bynmN 1 NTj 2t
1 NTs N 11sj 2 f n t  j 2  f m t
NTs()()
d ( m) dneedt
dne
dt  d (m)0NTs 0 n 0NTsn 0Modulation process can be calculated using FFT and IFFT,N 1s (t )   d (n)ej 2 ( f 0 n)tNTsn0N 1

j 2ntNTs [  d ( n)e] e j 2 f 0 tn0sl ( t )We take the sl (t ) equivalent baseband signal. The baseband signal issampled to obtain the baseband signal sl (k ) :N 1sl (k )   d (n)ej 2

ntNTsn 0t  kTsSoN 1d ( n )   sl ( k ) e

 j 2

nk
N,0  n, k  N  1k 0

Detect interfere attack
In the PLC network, the open broadcast characteristic of the channel
makes the data transmission between nodes susceptible to noise orinterference. Intentional interference is called interference. This kind ofattack only through passive interception to obtain the current network
node communication frequency band, can quickly launch attacks, simpleand effective.
With checking the signal Power Spectrum, we can detect the interference
attack signal.

About Author
Lei Ji is the regional marketing manager in North China worked for Cypress
semiconductor. Advisor of Qihu360 Unicorn Team. Before joining Cypress,
he took charge of the wireless product supporting for Texas Instrument inNorth China.

Reference
Wireless Communication Principles and Practices by Theodore SRappaport.

PLC G3 Physical Layer Specification by G3 alliance

PRIME‐Spec (1.3)