Communication Requirement for Reliable and Secure State Estimation and Control in Smart Grid Husheng Li, Lifeng Lai, and Weiyi Zhang

Transcription

1 476 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 3, SEPTEMBER 2011 Communication Requirement for Reliable and Secure State Estimation and Control in Smart Grid Husheng Li, Lifeng Lai, and Weiyi Zhang Abstract System state estimation and control are important issues to ensure the stability and reliability of the smart grid system. In this paper, the problem of how to securely estimate the system state and control the smart grid is studied. In the setup studied, the sensor(s) and the controller communicate with each other through a wireless channel subjected to monitoring by an eavesdropper. The channel capacity requirement that ensures negligible information leakage to the eavesdropper about the system state and control messages is studied from the information theoretic perspective. Two scenarios with single sensor or multiple sensors are studied. Numerical simulations are used to evaluate the capacity requirement in typical configurations of the smart grid. Index Terms Channel capacity, smart grid, topological entropy, wiretap channel. I. INTRODUCTION I N RECENT years, the technology of smart grid has attracted much attention in the communities of power systems, communications, networking, and control systems [12], [14], [18]. In a smart grid, modern information technologies are applied for power systems to report the instantaneous information on the power grid state to a center which carries out the corresponding system state monitoring or control [2], [16]. In a smart grid, communications play a key role since the system state information and control messages need to be delivered over the communication network. Two fundamental issues exist for the communication in a smart grid: Capacity: The communication link should be able to convey the system state information to the destinations like control center with negligible error in a realtime manner. Security: It is important to preserve the privacy of the system state in a smart grid. If the information is leaked, an eavesdropper could use this information to break the stability of the power grid or steal personal private information. Manuscript received September 28, 2010; revised February 21, 2011; accepted June 05, Date of publication August 08, 2011; date of current version August 24, This work was supported by the National Science Foundation under grants CCF and ECCS Paper no. TSG H. Li is with the Department of Electrical Engineering and Computer Science, University of Tennessee, Knoxville, TN USA ( husheng@eecs. utk.edu). L. Lai is with the Department of Systems Engineering, University of Arkansas, Little Rock, AR USA ( lxlai@ualr.edu). W. Zhang is with the Network Evolution Research Department, AT&T Labs Research, Middletown, NJ USA ( Weiyi.Zhang@ndsu.edu). Color versions of one or more of the figures in this paper are available online at Digital Object Identifier /TSG Fig. 1. An illustration of the sensor report subject to eavesdropper. The information leakage could occur during both the information transmission and information storage stages. In this paper, we address the above two issues for the information transmission stage. As illustrated in Fig. 1, the sensor encodes the observation on the system state into a bit string and then sends to the control center, which decodes the codeword and then uses the information for further actions such as control or power quality evaluation. Note that only one sensor is illustrated in Fig. 1 while we will also study the multiple sensor case in this paper. The transmitted channel symbols are contaminated by Gaussian noise at the decoder of the control center. Meanwhile, an eavesdropper overhears the received signal at the control center and the signal is further contaminated by an independent Gaussian noise. 1 Then, the goal of the communication in a smart grid is to convey messages to the control center for reliable system estimation and stabilizable control without any information leakage. Note that only one hop is considered between the sensor and the control center. For example, each sensor can send its measurement to a base station using technologies like WiMAX or LTE. Since the communication link between the base station and control center is typically securely wired (e.g., using an optical fiber communication link), the base station and the controller can be considered to be co-located, thus making the communication one hop. In practice, the information could be conveyed through a multihop mesh network, which is complicated and is beyond the scope of this paper since it concern the network information which is still open problem itself. To our best knowledge, this is the first study on the secure system state estimation and control via a communication channel in a dynamic system. We focus on the fundamental limit, i.e., how much channel capacity is needed to guarantee the secure and reliable system 1 We assume that the eavesdropper is a passive one, i.e., it only intercepts the messages between the sensors and controllers and does not launch proactive attacks. We assume that the attacker is intelligent and has sufficient computational power. Moreover, we assume that the attacker knows the protocol of the communication in a smart grid but does not know the common random sequence between the sensors and controller /$ IEEE

2 LI et al.: COMMUNICATION REQUIREMENT FOR RELIABLE AND SECURE STATE ESTIMATION AND CONTROL IN SMART GRID 477 state estimation and control in a smart grid, from the information theory perspective. The study on secure communications in the information theory community traces back to 1975 [19], when A. D. Wyner proposed the information theoretic study on wire-tap channels. Subsequently, the information theorists have studied the capacity requirement with security for different channels, like additive white Gaussian noise (AWGN) channel [4]. Recent years witnessed the resurrection of the information theoretic study on security issues, like channel capacity requirements for secure transmission in fading channels [5], [6], multiple access channels [17], broadcast channels [7], [8] and interference channels [9]. A survey on these studies can be found in [10]. However, the traditional information theoretic studies on communications with security usually focus on stationary and ergodic information sources. The smart grid is a dynamic system, which may not be stationary and ergodic. Therefore, these fundamental studies on secure communications must be revisited for the context of a smart grid. We will first define the metric to measure the security of the information transmission. Then, we will study the channel capacity requirement for system state estimation and control for both the single sensor and multiple sensor cases. The main mathematical tool is the topological entropy [1], which is a measure of the complexity of the dynamic system. The main results will be given in Propositions 1, 2 and 3. These general results are further illustrated using two examples, namely the power market dynamics and synchronous generator control. The remainder of this paper is organized as follows. The system model of the smart grid is given in Section II. Then the metric for measuring the security of the information transmission is studied in Section III. The channel capacity requirement is studied for both single sensor and multiple sensor cases in Sections IV and V, respectively. Numerical results and conclusions are provided in Sections VI and VII, respectively. II. SYSTEM MODEL The system model contains two parts, namely the system dynamics and the communication link(s) from the sensor(s) to the controller. A. System Dynamics For simplicity, we consider a discrete time system with an -dimensional system state, in which the time is divided into time slots, for the smart grid. There are sensors and one controller. We consider the following general dynamics of a smart grid, which is given by where is the -dimensional vector of system state at time slot (the alphabet of the state vector is denoted by ), is a random factor at time slot, is the action taken by the controller at time slot, is a function mapping the previous state vector, control action and random factor to the next state vector. The observation on the system state is given by (1) (2) Fig. 2. Timing structure of communication and control system in smart grid. where is a function of the system state and random vector. A special case of the system is the noiseless linear system, in which the system evolution is given by and the observation is given by where, and are all known matrices. For simplicity, we assume that the matrices are time-invariant. B. Communication Link(s) We introduce the models of communication link(s) for both single and multiple sensor cases. 1) Single Sensor Case: When there is only one sensor, we assume that the sensor can send a coded message about the state vector every time slots, denoted by at time slot. When the control center receives a message at time slot,it will decode the message for further processing. We assume that there are channel uses in time slot. 2 This timing structure is illustrated in Fig. 2. Such a communication scheme is similar to the bursty communication using ultra wideband (UWB) signaling which has a low duty cycle. Note that, in many applications, it is also possible to transmit the message in time slots, i.e., using all possible time for transmitting the messages. The codeword could be either adaptive to the newest received observations or fixed from time slot. However, the corresponding analysis is much more complicated and is beyond the scope of this paper. The coding and decoding functions at the sensor and controller are given below, for the tasks of system state estimation and control, respectively. System State Estimation: At time slot, the coding function is given by 2 It is straightforward to extend to the case of arbitrarily many channel uses in the time slot. (3) (4) (5)

3 478 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 3, SEPTEMBER 2011 i.e., the message is a function of all previous observations. The system state estimation is obtained at the controller, which is given by i.e., the message is a function of all the previous observations at the corresponding sensor. The control action is given by i.e., the system state estimations during time slots are functions of all previous received messages. Control: For the purpose of control, the coding function has the same form as that of system state estimation in (10) (but the function may be different). The controller does not necessarily estimate the system state. After receiving the message, it generates the control actions in the subsequent time slots, which are given by i.e., the control actions are dependent on all previous received messages. We assume that the transmitter satisfies the average transmit power constraint and denote by the maximal average transmit power. We also denote by the transmission rate, i.e., the average number of bits transmitted in each time slot, or equivalently the average number of bits per channel use, since there are also channel uses in the time slots. We assume that the channel between the sensor and the control center is an additive white Gaussian noise channel. At the th channel use, the received signal is given by where is the transmitted channel symbol and the Gaussian noise is assumed to have a zero mean and a unit variance. The received signal during channel uses, as a vector, is then denoted by. We also assume that there is an eavesdropper monitoring the system state of the smart grid by listening to the received signal at the controller,. The signal received at the eavesdropper, denoted by, is given by where is the channel power gain and is the additive white Gaussian noise at the eavesdropper, which is independent of the noise at the controller. For simplicity, we also assume that has a zero expectation and a unit variance. It is easy to extend to the general cases of arbitrary noise variance. 2) Multiple Sensor Case: When there are sensors, we assume that they make independent decisions on the codewords. For the multiple sensor case, we consider only the system state control. The timing structure is the same as the single sensor case. We denote by the message generated by sensor at time slot, which is given by (6) (7) (8) (9) (10) (11) i.e., the action is determined by all previous received messages. The average power limit of sensor is denoted by. If the -dimensional codeword of sensor is during the th time slot, the received signal at the controller is given by (12) where we have assumed that the channel gain from each sensor to the controller is 1. It is straightforward to extend to the unequal channel gain case. We assume that the received signal at the eavesdropper is also given by (9). III. SECURITY METRIC We need a metric to measure how secure the communication is in the smart grid. In the traditional communication systems, where the information source, denoted by, is an ergodic one, the security metric is defined as the normalized equivocation, which is given by [4] (13) where is the entropy, is the conditional entropy, is the received signal at the eavesdropper and every source outputs are encoded into a -vector. Obviously, represents the residual uncertainty about at the eavesdropper. When, i.e.,, the eavesdropper completely knows the source outputs. When, i.e.,, the received signal does not provide any information about for the eavesdropper. However, in our context, we cannot follow the same definition since we are facing a dynamic system which may not be ergodic. For example, if the absolute values of all eigenvalues in matrix in (3) are less than 1, the system state will converge to 0 when (no control). Then, all the nonzero system state will be transient. Moreover, the source considered in [4] has a finite alphabet while the source alphabet in the smart grid dynamic system is continuous. Hence, we need a new (but intuitively similar) definition for the equivocation in the dynamic system of the smart grid. Motivated by the application of topological entropy [1] in the remote estimation and control of dynamic systems [11], we seek help from the concepts of spanning set and topological entropy. We first introduce the concept of the spanning set of dynamic system in (1) (more details can be found in [11]), as illustrated in Fig. 3. Note that is defined as the set of all possible, i.e., the system state from time slot 1 to time slot, generated by the dynamic system. Definition 1: For and, a finite set is called a -spanning set if, for any, we can always find an in such that,.if

4 LI et al.: COMMUNICATION REQUIREMENT FOR RELIABLE AND SECURE STATE ESTIMATION AND CONTROL IN SMART GRID 479 Then, we define the secure communication for the system state estimation/control as follows: Definition 4: If the communication between the sensor and the controller satisfies that, for all, we can always find a and a coding-decoding scheme such that, for, we say that the communication is secure. We define the observability as follows [11]. Definition 5: The system in (1) is called observable if for any, there exist an and a coder-decoder pair such that (17) Fig. 3. An illustration of a spanning set. there exists at least one finite -spanning set, we denote by the least cardinality of any -spanning set. If there is no finite -spanning set, we define. Definition 2: The topological entropy of the system in (1) is defined as (14) We assume that the topological entropy in our dynamic system is finite. Obviously, the topological entropy represents the uncertainty of the dynamic system. For an arbitrary, is the number of bits needed for describing an approximation (with precision ) of the system s dynamic behavior during the time slots. Notice that the denominator in (13) measures the uncertainty of the information source. Hence, we can replace the denominator of the equivocation in (13) with the topological entropy. Now, we deal with the counterpart of the numerator, i.e., the conditional entropy, in (13) in the context of dynamic systems. Denote by the -spanning set with the least cardinality. The elements of can be denoted by. We consider a random variable taking values over these elements. Then, the value of is determined by the randomness of the dynamic system: for a realization of the dynamic system, we define as the label of the in that is the closest to the system realization. It is easy to observe that the topological entropy is equal to the entropy of as. Now, considering a random variable dependent on the dynamic system s behavior during the time slots, we have the following definition of conditional topological entropy. Definition 3: The conditional topological entropy of the system during time slots is defined as (15) On assuming that the conditional entropy in (15) exists, we define the equivocation of the dynamic system in (1) with respect to the overheard message as (16) where is the recovered system state at the controller. We define the stabilizability as follows [11]. Definition 6: The system in (1) is called stabilizable if for any, there exist an and a coder-decoder pair such that (18) A more stringent concept of stabilizability is the uniform and exponential stabilizability [11], which is defined as below and will be used in Section V. Definition 7: A controller is said to uniformly and exponentially stabilize a linear system at rate if (19) where and are constants. Remark 1: The definition of reliable and observable/stabilizable system is valid for both single sensor and multiple sensor cases. Note that the definition of equivocation is very similar to that of single user Gaussian wiretap systems. However, it is quite different from the definition in multiple user wiretap communication systems. There are two types of secrecy metrics, namely the individual and collective secrecy metrics, whose detailed definitions can be found in [17]. In both cases of the individual and collective secrecy metrics, there is one quantity measuring the security of the data of each subset of users. Therefore, for an user system, there are metrics. In a sharp contrast, there is only one metric for the dynamic system. The reason for this difference is that, in pure data communication systems, the data generation of each user is usually independent, while the data of each sensor is the observation on the same source in the dynamic system. IV. SINGLE SENSOR SYSTEM In this section, we study the single sensor system. We first study the communication capacity requirement for the task of estimating the system state. Then, we study the requirement for system state control. For the former case, we consider the general system dynamics in (1) while we study only the linear system in (3) for the latter case. A. Capacity Requirement for System State Estimation The following proposition discloses the requirement of the capacity for the reliable and secure communication for system state estimation in the dynamic system. The proof is given in Appendix I.

5 480 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 3, SEPTEMBER 2011 Proposition 1: When the following inequality holds, in which 3 (20) The linear system in (3) is neither secure nor stabilizable if the following inequality holds: (27) the reliable and secure communication is assured. 4 When the following inequality holds: (21) (22) (23) the reliable communication is guaranteed; however, the security of the system is not guaranteed. Furthermore, when (24) neither reliable communication nor the security of the system is guaranteed. Remark 2: The physical meaning of the proposition is quite intuitive. The right hand sides of both (20) and (23) are the secrecy capacity of Gaussian wiretap channels [4]. For ergodic sources with entropy rate smaller than the secure capacity, the information can be reliably transmitted to the receiver without providing any information to the eavesdropper. The left hand sides of both (20) and (23) (the second inequality) equal the minimal requirement of the channel capacity when there is no eavesdropper. However, since the source is a dynamic system, the conclusions for the ergodic information sources do not apply directly. B. Capacity Requirement for System Control For the stabilizability of the system, we consider only linear systems. Unfortunately, we are still unable to obtain a conclusion for nonlinear systems. Similarly to the system estimation case, we have the following conclusion, whose proof is given in Appendix II. Proposition 2: The linear system in (3) is secure and stabilizable if the following inequality holds: (25) where is the th eigenvalue of. The linear system in (3) is not both secure and stabilizable if the following inequality holds: (26) 3 We set 2 as the default base of logarithm. 4 Note that the noise variance has been assumed to be unit. Hence, P here is actually the signal-to-noise ratio (SNR). V. MULTIPLE SENSOR SYSTEM In this section, we discuss the case of multiple sensors and a single controller. Since the communication links become a multiple access channel (MAC), there will be a significant difference from the single sensor case. For simplicity, we discuss only the linear dynamic system in (3). It is still an open problem to analyze the communication capacity required for stabilizing a nonlinear system even if there is no requirement for security. We will first discuss the general case of the MAC channel. Then, we discuss a special case of multiple access schemes, i.e., time division multiple access (TDMA) scheme. Moreover, we focus on the case of security and stabilizability. The system state estimation can be analyzed in a similar way. A. General Case First, we need to define the unobservable subspace for each set of sensors. Denote by the unstable subspace of matrix. 5 We assume that is not empty, i.e., there exists at least one eigenvalue of such that. Otherwise, there is no need to control the system; the system state will converge to 0 automatically. Then, for sensor, its unobservable subspace is given by (28) where is the submatrix of generating the observation at sensor. For any set of sensors, the unobservable subspace is defined as (29) Then, we obtain the following proposition which states a necessary condition for the secure and stabilizable system. Note that we are still unable to obtain a sufficient condition due to the difficulty of finding a stabilizing coding scheme. Proposition 3: Assume that [11, Assumptions 3.4.2, , ] hold. 6 Suppose that Gaussian codebook is used. If the system in (3) is secure and stabilizable, then the following inequalities hold: (30) 5 The unstable subspace of matrix A is an invariant subspace corresponding to the eigenvalues satisfying jj > 1. 6 The assumptions are quite lengthy. Therefore, we do not list the technical assumptions here. The details can be found in [11].

6 LI et al.: COMMUNICATION REQUIREMENT FOR RELIABLE AND SECURE STATE ESTIMATION AND CONTROL IN SMART GRID 481 where and (31) (32) Proof: Denote by the average transmission rate of sensors. According to [11, Th ], the following inequality is required for the stabilizability of the system: (33) Now, we need to prove that the following inequality is necessary: (34) Proof: Follows directly from the proof of Prop. 3 and the conclusion in Theorem 1 of [4]. For the special case of two sensors, there are two subspaces concerned, namely the subspace that sensor 1 is unable to observe and the subspace unobservable to sensor 2. We denote by the larger one of the products of the absolute values of eigenvalue corresponding to these two subsapces. We assume that the two sensors have equal power constraints. When the time proportions and are not adjustable and the system dynamics are unknown before the deployment of the sensors, a practical method is to set. For this special but practical case, we have the following corollary. Corollary 2: For the two sensor and TDMA case, if and, the following condition is necessary for the security and stabilizability of the system: (37) when. Remark 3: When the channel gain of the eavesdropper is sufficiently large, e.g.,, the system cannot be both reliable and stabilizable. Fix a set of sensors.for, we can also define the equivocation in a similar way to in Definition 16. Obviously, implies since the leakage of information in subspace also means the information leakage of the whole system. Consider the sensors not in set as a composite sensor with power constraint and transmission rate. For this composite sensor, (34) is necessary due to the conclusion on the single sensor case in Prop. 3. Note that the term in (32) is the interference from the sensors in set. The strategy of the decentralized sensor case is a special case of that of the composite sensor. Therefore, the inequality (34) is also necessary for the decentralized sensor case. This concludes the proof. B. TDMA Case A practical multiple access scheme is TDMA, in which the sensors transmit in different channel uses. Since there is no collision, the controller can easily distinguish the reports from different sensors. Denote by the proportion of time during which sensor transmits. Obviously, we have. Then, we obtain the following conclusion for TDMA as a corollary of Prop. 3. Corollary 1: Suppose that Gaussian codebook and TDMA are used. Assumptions 3.4.2, , in [11] hold. If the system in (3) is secure and stabilizable, then the following inequalities hold: (35) VI. NUMERICAL SIMULATION In this section, we use numerical simulations to study the impact of different factors on the channel capacity requirement in smart grid. We consider two systems, namely the power market system and the power grid dynamics. For the former case, we consider the system state estimation; for the latter case, we consider the system control. A. Secrecy Capacity for System State Estimation in Power Market 1) Alvarado Model: We adopt the Alvarado model [3], [13] for the power market. In this model, there are four variables in the system state: : the amount of generated power; : the amount of consumed power; : the time integral of the difference in power supply and power demand; : the price of a unit of power. In the continuous time, the system state satisfies the following dynamics: (38) (39) (40) (41) where (36) where, and are parameters controlling the rate at which the supply, demand, and price change due to market changes, and,,, and are also parameters, whose physical meanings can be found in [3] and [13].

7 482 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 3, SEPTEMBER 2011 We can take a very small time interval and convert the continuous time model into a discrete time one, which is given by where (42) (43) and (44) Fig. 4. Topological entropies for various large c and c. and the system state is given by (45) Note that the system dynamics are not linear due to the existence of. 2) Communication Capacity: The following proposition discloses the channel capacity requirement for the reliable and secured state estimation for the power system model discussed in this section. The proof is given in Appendix III. Proposition 4: When, the reliable and secure system estimation requires zero channel capacity, when the system is stable, and requires nonzero channel capacity, when the system is unstable, when and the matrix is reachable and stable, the reliable and secure system estimation can never be achieved with a communication channel with a finite capacity. Remark 4: When the reliable and secured system estimation cannot be achieved, it does not mean that the system state can no longer be estimated in practice. It only means that the estimation error is not vanishing. When the estimation error is sufficiently small, it is still valid for practical systems. When the channel capacity requirement is 0, it does not mean that the communication system is trivial since an important issue, the communication delay, is omitted in the information theoretic analysis. 3) Numerical Results: The default setup is,,,,,, and, unless stated otherwise, which is the same as those used in [13] except that we set. Note that the topological entropy is computed using (55) in Appendix III. The numerical results are given below: Impacts of and : Recall that the parameters and represent the increasing rates of the cost and benefit with respect to the generated power and consumed power, respectively. We plot the topological entropies in Figs. 4 and 5 for large and small values of and, respectively. We observe that the topological entropy increases with the absolute values of and. When the absolute values of and are sufficiently small, the topological entropy could be zero. This demonstrates that the communication Fig. 5. Topological entropies for various small c and c. requirement is increased when the rates of cost and benefit are increased. Impacts of and : In the Avarado model, the parameters and represent the response times of the power generator and the power consumer, respectively. The topological entropy with various and is shown in Fig. 6. We observe that the topological entropy decreases with and. An intuitive explanation is that an increasing response time makes the system less dynamic, thus facilitating the system state estimation. Impacts of and : In the Avarado model, the parameter means the market clearing time and scales the additional cost when there is a history of supply excess. The corresponding topological entropy is shown in Fig. 7. We observe that the topological entropy decreases with since it makes the system less dynamic. Meanwhile, the topological entropy increases with, which adds more dynamical factors to the system. B. Secrecy Capacity for Power System Control 1) Linear Model: We adopt the linear model for the power system in [2, Example 6.2], in which the system is described using the following continuous-time dynamics: (46)

8 LI et al.: COMMUNICATION REQUIREMENT FOR RELIABLE AND SECURE STATE ESTIMATION AND CONTROL IN SMART GRID 483 Since we discuss the discrete-time model in this paper, we approximate the continuous-time model by setting a small time step, which is given by Therefore, we assume the following discrete-time model: (48) (49) Fig. 6. Topological entropies for various and. Fig. 7. Topological entropies for various and k. where the matrix is given by and the matrix is given in (47) at the bottom of the page. The details of the model can be found in [2]. where we ignore the step in the index. 2) Single Sensor Case: We first assume that the system state is reported by a single sensor. The secrecy channel capacity obtained from the right hand side of (25) is plotted with respect to different s and different s. We observe that the secrecy channel capacity decreases rapidly when the channel gain to the eavesdropper,, is increased. The left hand side of (25), i.e., the minimal communication rate for stabilizing the system is also plotted. From the figure, we can read the maximal that the system can combat with the assurance of both security and stabilizability. 3) Two Sensor Case: Now, we assume that there are two sensors which monitor the dimensions of the system state 1, 3, 5, 7 and 2, 4, 6, respectively. Fig. 9 shows the minimal required for assuring the system stabilizability and security under different ratios of and different s, obtained from the conclusion in Prop. 3. We observe that, as increases, the required is significantly increased. We also observe that a much larger does not help much. We repeat the simulation in Fig. 9 by considering the TDMA scheme. The minimal required is obtained from the conclusion in Corollary 2. We observe that, when, the power requirement is very similar to that of the general case, thus proving that the TDMA scheme is near-optimal when. When, there is an obvious performance drop compared with the general MAC scheme. The power decrease of due to the increase of the ratio is only marginal in TDMA. This implies that, for the specific system and configuration, it is desirable to use TDMA if the two sensors are symmetric. However, if the two sensors are asymmetric, it may save power to consider other MAC schemes. (47)

9 484 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 3, SEPTEMBER 2011 Fig. 8. The secure capacity for different power levels. Fig. 10. The minimal power required for sensor 1 for system stabilizability and security when the two sensors use TDMA scheme. Fig. 9. The minimal power required for sensor 1 for system stabilizability and security when there are two sensors. VII. CONCLUSIONS We have studied the reliable and secure system estimation and control when the sensor and controller are separated. We have combined the theory of estimation and control over communication networks and the information theoretic study on secure communications, by assuming a Gaussian wiretap channel. Conditions, based on the concept of topological entropy, have been obtained for the reliable and secure system estimation and control. We have applied the conclusion for general dynamic systems to simplified dynamic models of power systems. It has been found that, under certain conditions, the reliable and secure system state estimation and control may require zero or infinite channel capacity. We have carried out numerical simulations for the power market and power grid for evaluating the corresponding communication requirements. APPENDIX I PROOF OF PROP. 1 Proof: The proof follows an argument similar to [11, Th ] and [4, Th. 1]. We first prove the conclusion from inequality (20), i.e., when the topological entropy of the system is smaller than the secrecy capacity of the Gaussian wiretap channel, we can always find a coding and decoding scheme such that the legitimate receiver Fig. 11. Procedure of coding and decoding for secure and reliable communications for system state estimation. can reliably obtain the system state while the eavesdropper can obtain no information about the system state. The coding and decoding procedures are illustrated in Fig. 11. Fix a. Find the -spanning set having the least cardinality. Given the system realization, choose the closest element such that (50) which is guaranteed by the definition of -spanning set. Then, the label of the element in is converted into a binary sequence, which is the realization of the random variable. This sequence is then encoded into a codeword using a stochastic coding approach in the proof of [4, Th. 1]. Roughly speaking, in a stochastic coding scheme, each message is associated with a group of codewords. To transmit, a codeword is randomly selected from its corresponding group. This

10 LI et al.: COMMUNICATION REQUIREMENT FOR RELIABLE AND SECURE STATE ESTIMATION AND CONTROL IN SMART GRID 485 additional randomness increases the transmission rate. However, as long as the sum of the message rate and the randomness rate is less than the capacity of the channel between the source and the receiver, the receiver can successfully decode the codeword and find its corresponding. The receiver can then find the element in that is associated with, which will be used as the estimated state vector by the receiver. The property of the -spanning set assures that the communication is reliable. Meanwhile, due to the conclusion of secrecy channel capacity in [4], the conditional entropy is very close to. Let, the conclusion of (20) is obtained. Now, if, according to the first part of [11, Th ], the transmission rate over the channel must be larger than or equal to, which is larger than the capacity of the legitimate user. As the result, the legitimate user is not able to decode the message, which means that the reliability is not guaranteed. Hence, the claim in (24) is true. When, according to the first part of Theorem in [11], the transmission rate over the channel must be larger than or equal to. The receiver is still able to decode the message, i.e., the reliability requirement is satisfied. However, the transmission rate is larger than the secrecy capacity of the Gaussian wiretap channel, according to Theorem 1 in [4], which means that there exists a constant such that. And hence, meaning that. Hence, from, the eavesdropper can infer information about in (23) is valid. APPENDIX II PROOF OF PROP. 2. Hence, the claim Proof: We prove the conclusions incurred by (25) (27) separately. For proving the conclusion incurred by (25), we need to find a coding scheme to assure both the sufficiency and stabilizability. The proof follows the sufficiency part in proof of [11, Th ], which is quite lengthy (pages 31 35). Due to the limited space, we only provide the key part of the coding scheme in the proof. The remaining identical part can be found in [11]. Suppose the transmission rate satisfies (51) which is guaranteed by the inequality (25) For an, we find a sufficiently large, where is a constant satisfying such that we can find a set, such that and, for any solution of equation, we can always find an element such that (52) Note that the existence of is guaranteed by [11, Lemma 2.4.3]. Let be the index of in. Then, the message transmitted from the sensor to the controller is the index. Due to (25) and the sufficiently large, we can always find a channel coding scheme such that. The proof of the stabilization follows the remainder proof of [11, Th ]. If (26) holds, the transmission rate of the sensor must satisfy one of the following inequalities: and (53) (54) Again, according to [11, Th ], (53) means that the system is not stabilizable. Due to the same argument as in the proof of Prop. 1, the system is not secure if (54) holds. Therefore, the system cannot be both secure and stabilizable if either (53) or (54) holds. If (27) holds, the conclusion is obtained directly from [11, Th ] and the proof of Prop. 1. APPENDIX III PROOF OF PROP. 4 Proof: We discuss the secure state estimation for the following cases. : For this case, we have. According to the physical meaning and, the marginal cost of the power generator is given by and the marginal benefit of the power consumer is for this situation. This means that the marginal cost and marginal benefit are both proportional to the amount of power generated or consumed, i.e., there is no constant cost or benefit. According to [11, Th ], the topological entropy of the system in (42) is given by (55) where are the eigenvalues of the matrix. Obviously, when the absolute values of all eigenvalues are smaller than 1 (i.e., the system is stable), the topological entropy is 0, thus requiring zero channel capacity. Otherwise, the topological entropy is nonzero. : In this case, there exist constant marginal cost and marginal benefit, which are independent of the power generated or consumed. According to [11, Prop ], the topological entropy is infinite, when the matrix is reachable and stable. The topological entropy is still unknown for other cases. ACKNOWLEDGMENT The authors would like to thank Prof. Fangxing Li in the Dept. of EECS in the University of Tennessee, Knoxville, for the discussion on the dynamics of power market.

11 486 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 3, SEPTEMBER 2011 REFERENCES [1] R. L. Adler, A. G. Konheim, and M. H. MacAndrew, Topological entropy, Trans. Amer. Math. Soc., vol. 114, pp , [2] P. M. Anderson and A. A. Fouad, Power System Control and Stability, 2nd ed. New York: IEEE Press and Wiley-Interscience, [3] F. L. Alvarado, The Dynamics of Power System Markets Dept. Elect. Comput. Eng., Univ. Wisconsin, Madison, WI, Tech. Rep. PSERC-91-01, [4] S. K. Leung-Yan-Cheong and M. Hellman, The Gaussian wire-tap channel, IEEE Trans. Inf. Theory, vol. IT-24, pp , Jul [5] P. K. Gopala, L. Lai, and H. El Gamal, On the secrecy capacity of fading channels, IEEE Trans. Inf. Theory, vol. 54, pp , Oct [6] Y. Liang, H. V. Poor, and S. Shamai (Shitz), Secure communication over fading channels, IEEE Trans. Inf. Theory, vol. 54, pp , Jun [7] R. Liu and H. V. Poor, Secrecy capacity region of a multi-antenna Gaussian broadcast channel with confidential messages, IEEE Trans. Inf. Theory, vol. 55, pp , Mar [8] R. Liu, T. Liu, H. V. Poor, and S. Shamai (Shitz), Multiple-input multiple-output Gaussian broadcast channels with confidential messages, IEEE Trans. Inf. Theory, vol. 56, no. 9, pp , Sep [9] Y. Liang, A. Somekh-Baruch, H. V. Poor, S. Shamai (Shitz), and S. Verdu, Capacity of cognitive interference channels with and without secrecy, IEEE Trans. Inf. Theory, vol. 55, no. 2, pp , Feb [10] Y. Liang, H. V. Poor, and S. Shamai, Information Theoretic Security. Hanover, MA: Now, [11] A. S. Matveev and A. V. Savkin, Estimation and Control Over Communication Networks. Basel, Switzerland: Birkhauser, [12] K. Moslehi and R. Kumar, Smart grid A reliability perspective, in Proc. IEEE Innov. Smart Grid Technol. Conf. (ISGT), 2010, pp [13] J. Nutaro and V. Protopopescu, The impact of market clearing time and price signal delay on the stability of electric power markets, IEEE Trans. Power Syst., vol. 24, pp , Aug [14] Smart Grid Working Group ( ), Challenge and opportunity: Charting a new energy future, Working Group Reports, [15] S. Stoft, Power System Economics-Designing Markets for Electricity. New York: IEEE/Wiley, [16] C. W. Taylor, D. C. Erickson, K. E. Martin, R. E. Wilson, and V. Venkatasubramanian, WACS-Wide-area stability and voltage control system: R&D and online demonstration, Proc. IEEE, vol. 93, no. 5, pp , May [17] E. Tekin and A. Yener, The Gaussian multiple access wire-tap channel, IEEE Trans. Inf. Theory, vol. 54, pp , Dec [18] J. Wen, P. Arons, and E. Liu, The role of remedial action schemes in renewable generation integrations, in Proc. IEEE Innov. Smart Grid Technol. Conf. (ISGT), 2010, pp [19] A. D. Wyner, The wire-tap channel, Bell Syst. Tech. J., vol. 54, pp , Oct Husheng Li (S 00-M 05) received the B.S. and M.S. degrees in electronic engineering from Tsinghua University, Beijing, China, in 1998 and 2000, respectively, and the Ph.D. degree in electrical engineering from Princeton University, Princeton, NJ, in From 2005 to 2007, he worked as a Senior Engineer at Qualcomm Inc., San Diego, CA. In 2007, he joined the EECS department of the University of Tennessee, Knoxville, as an Assistant Professor. His research is mainly focused on statistical signal processing, wireless communications, networking, smart grid and social networks. Particularly, he is interested in studying the communication network in cyber physical systems such as smart grid. Dr. Li is the recipient of the Best Paper Award of EURASIP Journal of Wireless Communications and Networks, 2005 (together with his Ph.D. advisor: Prof. H. V. Poor), the Best Demo Award of IEEE Globecom 2010 and the Best Paper Award of IEEE ICC Lifeng Lai (M 07) received the B.E. and M.E. degrees from Zhejiang University, Hangzhou, China, in 2001 and 2004 respectively, and the Ph.D. degree from the Ohio State University, Columbus, in He was a Postdoctoral Research Associate at Princeton University, Princeton, NJ, from 2007 to He is now an Assistant Professor at the University of Arkansas, Little Rock. His research interests include wireless communications, information security, and information theory. Dr. Lai was a Distinguished University Fellow of the Ohio State University from 2004 to He is a co-recipient of the Best Paper Award from IEEE Global Communications Conference (Globecom), 2008, the Best Paper Award from IEEE Conference on Communications (ICC), He received the National Science Foundation CAREER Award in Weiyi (Max) Zhang (M 07) received the Ph.D. degree in computer science and engineering from Arizona State University, Tempe, in He was an Assistant Professor with the Computer Science Department at North Dakota State University, Fargo. He is currently a member of the Network Evolution Research Department at AT&T Labs Research, Middletown, NJ. His research interests include routing, scheduling and cross-layer design in computer networks, localization and coverage issues in wireless sensor networks, survivable design and QoS provisioning of communication networks, and pervasive and ubiquitous computing.