# Security-Oriented Cyber-Physical Risk Assessment for Cyberattacks on Distribution System
## 3 Cybersecurity Analysis of CPPDS  
In CPPDS, the slave distribution stations are local key information and control hubs that connect the backbone layer and the terminal layer. By communicating with the main station center and remote terminal units in real time, functions such as fault diagnosis, isolation, and recovery in CPPDS are realized. Therefore, we mainly focus on the cybersecurity of the slave distribution stations in CPPDS.  
Figure 1: Framework of CPPDS.  
In order to analyze the cyber network of the slave distribution station in more detail, an information system model based on the IEC 61850 standard is constructed, which divides the cyber network into three levels: substation level, bay level, and process level. A cyber-physical system structure diagram of the slave distribution station is shown in Figure 2. The red dash lines denote the possible targets for attacking by intruders. The data, such as the protection setting values, telemetry data, and telesignaling data, are exchanged between the substation level and the bay level by using the Manufacturing Message Specification (MMS) protocol. The data, such as locking control and interlocking information, are transmitted in the bay level by using the Generic Object Oriented Substation Event (GOOSE) protocol. The real-time sampled data of the voltage transformer (VT) and current transformer (CT) in the merging unit are transmitted between the bay level and the process level by using the Sample Value (SV) protocol, and the controlled data of the FRTU, such as the trip signals, switch positions are transmitted by using the GOOSE protocol.  
On the one hand, the monitoring host, telecontrol devices, and distributed FRTUs in CPPDS lack effective physical isolation protection, and there exist security vulnerabilities that can be exploited by intruders. Some experienced attackers can use these vulnerabilities to invade information devices to obtain corresponding permissions. Then they take this as a springboard to attack other devices, and constantly improve the control authority to achieve the final attack purpose. On the other hand, the security of data transmission protocols used in CPPDS is not high enough, which makes it possible to attack the distribution station. The data packets through MMS, GOOSE, and SV protocols are all transmitted in plaintext through the TCP/IP and Ethernet protocol. In addition, the field devices lack enough encryption protection. The IEC 61850 standard [35] does not consider the corresponding security measures. Therefore, there may be the following risks and threats in CPPDS.  
1. CPPDS lacks complete firewall settings and IDS. The antivirus software is not updated in time, which leads to the low cybersecurity.
2. The MMS protocol lacks an identity authentication and access control mechanism, and the data are transmitted in plaintext, which will produce serious security risks.  
Figure 2: Cyber-physical system structure of the slave distribution station.  
For example, an attacker can exploit the overflow vulnerability of an MMS protocol stack to cause device downtime or offline.
3. The communication mode of GOOSE and SV protocols is based on subscriber/ publisher mode, which requires high real-time transmission. In order to ensure that the function and transmission time of relay protection are not affected, the data packets are encoded by ASN.1. Without any encryption measures, its security cannot be guaranteed, and the data in GOOSE and SV messages exist vulnerabilities, such as tampering, copying, and camouflage.