Abstract:
A system and method for providing time stamps protected from GPS timing signal attacks. A GPS receiver receives a GPS time data, and a local clock provides local time data. A controller initiates the local clock with the GPS time data. It continuously monitors the GPS time data by calculating any difference error between current GPS time data and local time data, and determining whether the error exceeds a threshold value. If the error does not exceed the threshold value, the GPS time data is used to discipline the local clock data and the disciplined output is used for the time stamp. If the error exceeds the threshold value, the local time data is used for the time stamp.

Description:
TECHNICAL FIELD OF THE INVENTION 
       [0001]    This invention relates to providing precision time stamps for data acquisition systems and various other equipment. 
       BACKGROUND OF THE INVENTION 
       [0002]    The Global Positioning System (GPS) is a space-based satellite navigation system that provides location and time information to anywhere on Earth where there is a line of sight to four or more GPS satellites. GPS provides critical capabilities to military, civil and commercial users around the world. It is maintained by the United States government and is freely accessible to anyone with a GPS receiver. 
         [0003]    GPS has non navigation as well as navigation applications. In typical GPS operation as a navigator, four or more satellites must be visible to obtain an accurate result. The solution of the navigation equations gives the position of the receiver along with the difference between the time kept by the receiver&#39;s on-board clock and the true time-of-day, thereby eliminating the need for a receiver-based clock. 
         [0004]    Applications for GPS such as time transfer, traffic signal timing, and synchronization of various distributed equipment, make use of this accurate timing. An example of a system having distributed units that uses GPS time synchronization is a cell phone system and its cell phone base stations. For time synchronization applications, it is claimed the accuracy of GPS time signals (±10 ns) is second only to the atomic clocks upon which they are based. 
         [0005]    GPS is vulnerable to “spoofing”, defined as the transmission of false GPS signals that GPS receivers accept as authentic ones. At its worst, GPS spoofing could allow hackers to disrupt or even to gain control over equipment that rely on GPS for navigation or timing. 
         [0006]    Advances are being made into countermeasures to make GPS navigation and timing applications less vulnerable to spoofing and other types of attacks. Of particular threat to timing applications, GPS is vulnerable to timing attacks that are not detectable with current technology. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0007]    A more complete understanding of the present embodiments and advantages thereof may be acquired by referring to the following description taken in conjunction with the accompanying drawings, in which like reference numbers indicate like features, and wherein: 
           [0008]      FIG. 1  illustrates a system of data acquisition units, each having a GPS-based time validation unit in accordance with the invention. 
           [0009]      FIG. 2  illustrates one embodiment of the time validation unit of  FIG. 1 . 
           [0010]      FIG. 3  illustrates the time validation process. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0011]    The following description is directed to a GPS-based time validation unit that provides precise time stamp data, that is, data representing the current time of an event as recorded. Threshold-timing differences are detected to prevent the manipulation of time stamps. The time stamps remain synchronized to an external reference clock source (GPS). 
         [0012]    More specifically and as explained in further detail below, the time validation unit has both a receiver for a GPS timing signal and a high-quality local clock. The local clock is initially seeded with the GPS timing signal and disciplined with the GPS timing signal insofar as the GPS timing signal is deemed trustworthy. Timing differences between the two time sources (GPS and local) are compared. A time difference above a threshold indicates that the GPS timing signal is suspect with regard to spoofing or other attacks. In this event, the local clock output provides precision timing. 
         [0013]    An example of an application of the time validation unit is for data acquisition equipment. Many data acquisition devices use GPS timing signals as a basis for synchronizing among themselves. The result is GPS-based timing synchronization for a system of cooperative distributed units. 
         [0014]    For purposes of example in this description, the time validation unit is used in connection with data acquisition devices known as phasor measurement units (PMUs). PMUs measure electrical waves on the electrical power grid, and thereby help manage and improve power systems. 
         [0015]    However, it should be understood that many other types of GPS timing signal receivers are subject to timing attacks. The time validation unit described herein can be used for any equipment using GPS-based time stamps. 
         [0016]      FIG. 1  illustrates two PMUs  11 , in use to measure the synchrophasor angle difference between a power generation unit  12  and an infrastructure station  13 . In practice, an electrical power system has a vast number of distributed PMUs  11 . The PMUs  11  provide accurate synchronized phasor (representation of a sinusoidal function) measurements (synchrophasors) from across the power system, enabling decision-making capabilities to help improve system reliability. PMUs  11  collect data from substations, such as station  13 , and from other locations within the grid to evaluate the grid&#39;s behavior. PMUs have been used recently to manage the Bulk Electric System (BES) consisting of generators, substations, and 100 kV and higher voltage transmission lines. 
         [0017]    PMUs  11  share a GPS time source, represented by receiving antenna  14 . PMU time synchronization is critical to the correct operation and maintenance of the above-described grid operations. For example, PMU measurement data may be fed back to a control center with various transmission delays. To obtain an accurate system operation status, the control center must align all collected measurements in the time domain, i.e., the data must be time synchronized. Typically, lock synchronization accuracies on the order of a few microseconds are necessary for proper management functionality. 
         [0018]    More specifically, as an example of operation of the PMUs  11 , each PMU  11  periodically samples grid operation state parameters, such as frequency and voltage. The sampling is triggered by the GPS timing signal from the GPS receiver. To cope with different data transmission delays of different measurements, it is necessary to attach the time values at which the measurements are sampled. This procedure is similar to posting a stamp to the measurements (hence called time stamp). The control center receives the collected measurements, aligns them according to their time stamps, and analyzes the system state for future control actions. By applying GPS timing as the grid-wide sampling reference time, all PMUs sample in a synchronous manner. 
         [0019]    Conventional PMUs are vulnerable to various GPS attack scenarios. Examples of attack scenarios are jamming, fast spoofing, slow spoofing, jitter, and clock start and stop. These attacks are collectively referred to herein as “time synchronization attacks”. 
         [0020]    To detect such attacks and to preserve time stamp integrity in accordance with the invention, each PMU  11  is equipped with a time validation unit  11   a.  As further explained below, time validation unit  11   a  has both a receiver for GPS signals and a local clock. It compares differences between these two time sources to verify the integrity of the GPS timing data. It uses its local clock during signal verification, and if the GPS signal is true, it corrects (“disciplines”) the local clock to match the GPS timing data. It then provides a clock output for timestamping. In this manner, time validation unit  11   a  prevents manipulation of the time stamps. 
         [0021]      FIG. 2  is a block diagram of time validation unit  11   a.  Its main elements are a GPS receiver  21 , a local clock  22  and a timing controller  23 . 
         [0022]    GPS receiver  21  receives a GPS signal, which contains conventional GPS timing data. GPS receiver  21  has whatever hardware or software is required to receive GPS signals and to interpret those signals to acquire GPS timing data. 
         [0023]    A local precision clock  22  provides local timing data. An example of a suitable local precision clock  22  is a chip scale atomic clock (CSAC). Commercially available CSAC&#39;s provide microsecond precision timing. Various other types of local precision clocks may be used. Local clock  22  may be implemented with various types of crystal oscillators with appropriate hardware and/or software for being initially seeded with GPS time and providing a local time output. Various integrated or discrete circuits are available for this purpose. 
         [0024]    Timing controller  23  implements various timing verification processes. Although validation unit  11   a  uses a GPS signal, a feature of validation unit  11   a  is that there is no assumption that the GPS signal is valid. The local timing data from clock  22  is used as a “truth source” if the GPS timing data has been attacked or is otherwise untrustworthy. This approach is different from conventional disciplined local oscillator approaches of stabilizing GPS clocks. Conventional disciplined local oscillators assume that the time acquired through the GPS signal is correct. In contrast, the method applied by validation unit  11   a  assumes the GPS signal cannot always be trusted, and only trusts it at local clock initialization. After that, the local clock  22  is used as a truth clock to determine if the GPS signal is under attack. If a GPS attack is detected, the GPS signal is not considered as truthful and is not used. 
         [0025]    In this manner, timing controller  23  uses either the locally disciplined GPS time or the local clock time to generate time stamp data. In other words, if the GPS time is not deemed trustworthy, a local trusted time source is used. If the GPS time is trusted, it is used and disciplines the local clock. 
         [0026]    It is assumed that timing controller  23  has appropriate software or hardware for performing these tasks. Various process elements of  FIG. 2  are shown as discrete processes. However, it is a design choice how these tasks are distributed among various software and hardware processing or logic devices, and/or integrated into a single processor-based controller. 
         [0027]      FIG. 3  illustrates the tasks performed by timing controller  23 . It should be understood that this monitoring, verifying and local clock disciplining process is performed on a repeated and continuous basis. 
         [0028]    Referring to both  FIGS. 2 and 3 , a main controller  23   a  receives the local clock signal from local clock  22 . It performs an initial local clock discipline process, which disciplines the local clock output so that it complies with the GPS timing data. Thus, the GPS timing data is initially trusted and used to initiate the local timing data. This process is illustrated as Step  31  in  FIG. 3 . 
         [0029]    An error detector  23   a  receives both the GPS timing data from and the local clock data. It compares the GPS timing data to the local clock data, to determine a current timing difference (error) value. 
         [0030]    A threshold comparator  23   c  determines whether the time difference exceeds a predetermined and stored threshold value. The threshold value may vary, but an example of a suitable threshold value is 100 nanoseconds. In other words, if the time difference between the GPS timing data and the local clock data is greater than 100 nanoseconds, the error exceeds the threshold. In general, the difference threshold is chosen to be a time difference that exceeds a “reasonable” drift, with “reasonable” depending on factors such as the equipment and the application. 
         [0031]    If the timing error exceeds the threshold, that information is sent to a delay/reject process  23   d . Process  23   d  uses the time from the past; it looks from previous positions thus allowing it to detect a GPS attack before it determines whether to accept the GPS time to discipline the local clock  22 . It is a decision step whether to use the time that is coming from the GPS signal or to use the time from the local clock for the time stamp. 
         [0032]    The processes performed by error detector  23   b , threshold comparator  23   c  and delay/reject process  23   d  are represented as Step  32  of  FIG. 3 . 
         [0033]    A proportional integral (PI) controller  23   e  is used to discipline the time of the local clock  22 . Controller  23   e  sets its output in proportion to the error (proportional) and the magnitude of the error and the duration of the error (integral). 
         [0034]    In the case where GPS time is accepted, the local time is proportionally adjusted based on the GPS time. This step is illustrated as Step  33  of  FIG. 3 . As explained above, this disciplined time is used for a time stamp, which may then be stored along with whatever associated data being recorded and/or transmitted to a central station. 
         [0035]    In the case GPS time has been rejected by delay/reject process  23   d,  the time adjustment stays at the most recent adjustment value provided by the PI controller  23   e.  This step is illustrated by Step  34  of  FIG. 3 . 
         [0036]    Additionally, if GPS time has been rejected, main controller  23   a  generates an alarm signal and continues to monitor the timing signals until the alarm is cleared. Until the alarm is cleared, the local clock  22  continues to be used as the time source. This process is indicated in Step  35  of  FIG. 3 . Once the alarm is cleared, the main controller  23   a  may then re-initiate the local clock with the GPS signal. 
         [0037]    During an alarm condition, the local clock  22  provides precision timing for a sufficiently long duration to allow for verification of the quality of the GPS timing data, prior to using it for updates in the disciplining procedure. It is this time data that is used for time stamps. 
         [0038]    Main controller  23   a  may be further programmed to determine not only that an attack is ongoing but also the type of GPS attack. Various types of attacks to be identified are spoofing, jamming, jitter, stop and start, or other types of attacks. 
         [0039]    Experimentation has indicated that time validation unit  11   a  is at least capable of detecting any deviation between the GPS signal and the local clock signal to within 25 nanoseconds.