The next phase of my master's thesis moved from smart homes to power grids, and offensive testing needs somewhere to land. Real substations are off limits, so the work runs on an IEC 61850 digital substation simulator: a fork of a substation lab built by a colleague of my thesis supervisor, extended in two directions. More protocol support on the simulation side, and attack functionality aimed at the virtual devices in the station on the other. It exists for one purpose — a playground where pentest-style operations against grid protocols run safely, repeatedly, and with measurements on everything.
It runs in GNS3 on Docker containers and simulates a realistic substation with the two-bus structure real digital substations use: a station bus carrying control traffic, and segmented process buses carrying the raw measurements. Enough realism that protocol-level attacks behave the way they would against real gear.
| Device | Count | Role |
|---|---|---|
| Station IEDs | 2 | Station-bus control nodes |
| Bay IEDs | 9 | Protection functions, dual-homed onto both buses |
| Merging units | 9 | Publish the Sampled Value waveform streams |
| SAMU concentrators | 2 | Aggregate MU streams per process bus, run boundary clocks |
| PTP clocks | 2 | Grandmaster election via BMCA |
| Gateway | 1 | Dashboard: live circuit diagram, breaker/switch control |
Protocol-wise the station speaks the IEC 61850 stack: MMS for control with SBO Enhanced select-before-operate sequences, GOOSE for real-time event messaging between IEDs, 9-2LE Sampled Values from the merging units (sample rate configurable from 1000 up to 4000 samples per second), and IEEE 1588 PTP for time sync — with real linuxptp slaves on every IED and merging unit rather than a simulated clock.
The layout:
STATION BUS - control traffic, level 1
IED_Q01, IED_Q02, Gateway, PTP-01/PTP-02 (BMCA grandmaster election)
E01-E09 (station side) - MMS/GOOSE, dual-homed to the process buses
|
+------------+------------+
| |
PROCESS BUS A PROCESS BUS B
level 0, VLAN 110 level 0, VLAN 120
IEDs E01-E05 IEDs E06-E09
MU_E01-MU_E05 MU_E06-MU_E09
SAMU_A concentrator SAMU_B concentrator
The focus: SV and PTP
Two protocols get the attention, and most of my additions live here.
Sampled Values (SV/SMV) are the raw current and voltage waveform streams that merging units publish onto the process bus, and protection functions consume them to decide whether the grid is faulting. The lab publishes real 9-2LE streams and lets me ask the question that matters: what does a skewed, stale, or manipulated stream do to the protection logic downstream?
PTP (IEEE 1588) is the time sync everything else leans on. In this substation the protection functions are sync-supervised — they block when time sync is lost — which makes the grandmaster election itself a target. The lab reproduces a published PTP attack chain (Akbarzadeh et al., Electronics 2023) end to end: passive reconnaissance, rogue grandmaster election through BMCA manipulation, an announce-only hold that keeps slaves freewheeling, coherent time skew pushed through Sync/Follow_Up messages, and then recovery measurement. That replication, along with the attacker container and the measurement tooling that make a full attack-measure-recover cycle a single script, is my addition to the base lab.
The lab is also honest about its limits: software timestamping puts sync accuracy in the millisecond range rather than sub-microsecond, and no intrusion detection is modeled — a documented negative, not an oversight. Both differences from the published testbed are written down where the attacks are.
Links
- Platform: Red Code — the same scaffold and harness drive the assessment work here
- Previous phase: 37 devices, zero passwords — the smart home lab this project succeeded