# US 10,375,108 B2 · Time signal manipulation and spoofing detection based on a latency of a communication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,108 B2 - Document ID: US10375108B2 - Status: Granted - Kind: B2 - Application number: 15/394,097 - Filed: 2016-12-29 - Published: 2017-07-06 - Granted: 2019-08-06 - Earliest claimed: 2015-12-30 - Assignees: Schweitzer Engineering Laboratories, Inc. - Applicants: Schweitzer Engineering Laboratories, Inc. - Inventors: Edmund O. Schweitzer, III; Cody W. Tews; David E. Whitehead - Web page: https://patentgrep.com/patent/US10375108B2 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - H04L 43/0852: Delays - H04L 43/16: Threshold monitoring - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 2463/121: Timestamp - Y04S 40/00: Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them - Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract This disclosure relates to detecting manipulation or spoofing of a time based on a latency of a communication system. In one embodiment, a system includes a time input to receive a time signal. The system includes a first interface to receive a first representation of a first condition at a first location at a first time and a second interface to receive a second representation of a second condition at a second location and at the first time. A latency determination subsystem may determine a latency based on a comparison of the time of arrival of the second measurement and the first time. A threshold subsystem may generate an indication of whether the latency satisfies a threshold. An anomalous condition subsystem may identify an anomalous condition based on the indication, and a remedial action may be implemented based on the anomalous condition. ## Claims ### Claim 1 An intelligent electronic device (IED), comprising: a time input configured to receive a time signal; a monitored equipment interface in electrical communication with an electric power system at a first location, wherein the monitored equipment interface is configured to obtain a first measurement of electrical conditions at the first location at a first time based on the time signal; a communications interface configured to receive via a communication system a second measurement of electrical conditions obtained at a second location by another IED and at the first time based on the time signal; a latency determination subsystem in communication with the time input, monitored equipment interface, and communications interface and configured to determine a latency based on a comparison between a second time in which the second measurement is received by the IED via the communication system and the first time; a threshold subsystem configured to generate an indication of whether the latency exceeds a first threshold; an anomalous condition subsystem configured to identify an anomalous condition based on the indication; and a remedial action subsystem configured to exclude the second measurement from a control action of the electric power system when the latency exceeds the first threshold. ### Claim 2 (depends on 1) The IED of claim 1, wherein the anomalous condition comprises spoofing of the time signal at one of the first location and the second location. ### Claim 3 (depends on 1) The IED of claim 1, wherein the anomalous condition comprises a configuration change in the communication system. ### Claim 4 (depends on 1) The IED of claim 1, wherein the time system input is configured to receive the time signal from a Global Navigation Satellite System. ### Claim 5 (depends on 1) The IED of claim 1, wherein the latency determination subsystem is configured to generate a dataset based on the latency at a plurality of times. ### Claim 6 (depends on 5) The IED of claim 5, wherein the threshold subsystem is further configured to generate the first threshold based on the dataset. ### Claim 7 (depends on 1) The IED of claim 1, wherein the remedial action comprises suppressing the control action configured to reconfigure the electric power system. ### Claim 8 (depends on 1) The IED of claim 1, wherein the communication system comprises a deterministic communication system. ### Claim 9 (depends on 1) The IED of claim 1, wherein the threshold subsystem is further configured to generate the indication based on whether the communication system latency is less than the first threshold and greater than a second threshold. ### Claim 10 (depends on 9) The IED of claim 9, wherein the first threshold comprises a first product of a first multiplier and a statistical representation of the latency of the communication system, and the second threshold comprises a second product of a second multiplier and the statistical representation of the latency of the communication system. ### Claim 11 (depends on 1) The IED of claim 1, further comprising a fault detection module configured to detect a fault in the electric power system based on the first measurement of electrical conditions at the first location and the second measurement of electrical conditions at the second location, and wherein the fault detection module is further configured to generate a control instruction to clear the fault. ### Claim 12 (depends on 11) The IED of claim 11, wherein the first measurement of electrical conditions and the second measurement of electrical conditions represent a traveling wave generated by the fault. ### Claim 13 A method, comprising: receiving a time signal at each of a first location and a second location; generating, via a first intelligent electronic device (IED) at the first location, a first measurement of electrical conditions at the first location at a first time based on the time signal; generating, via a second IED at the second location, a second measurement of electrical conditions at the second location at the first time based on the time signal; transmitting the second measurement from the second IED through a communication system to the first IED; determining a latency based on a comparison between a second time in which the second measurement is received by the first IED and the first time; generating an indication of whether the latency exceeds a first threshold; identifying an anomalous condition based on the indication; and excluding the second measurement from a control action of an electric power system when the latency exceeds the first threshold. ### Claim 14 (depends on 13) The method of claim 13, wherein the anomalous condition comprises spoofing of the time signal at one of the first location and the second location. ### Claim 15 (depends on 13) The method of claim 13, further comprising generating a dataset based on the latency at a plurality of times. ### Claim 16 (depends on 15) The method of claim 15, further comprising generating the first threshold based on the dataset. ### Claim 17 (depends on 13) The method of claim 13, wherein the remedial action comprises suppressing the control action configured to reconfigure the electric power system. ### Claim 18 (depends on 13) The method of claim 13, further comprising: detecting a fault in the electric power system based on the first measurement of electrical conditions at the first location and the second measurement of electrical conditions at the second location; and generating a control instruction to clear the fault. ### Claim 19 A system, comprising: a time input configured to receive a time signal; a monitored equipment interface configured to receive, via measuring conditions of a power delivery system, a first representation of a first condition at a first location at a first time based on the time signal; a communications interface configured to receive, via a communication system, a second representation of a second condition at a second location and at the first time based on the time signal; a latency determination subsystem in communication with the time input, monitored equipment interface, and the communications interface and configured to determine a latency based on a comparison between a second time in which the second measurement is received by the second interface through the communication system and the first time; a threshold subsystem configured to generate an indication of whether the latency exceeds a threshold; an anomalous condition subsystem configured to identify an anomalous condition based on the indication; and a remedial action subsystem configured to exclude the second measurement from a control action of an electric power system when the latency exceeds the first threshold.