Abstract
Under the trend of deregulated Volt/VAR ancillary service market, power distribution grid (PDG) is seeing a growing demand for personally owned distributed energy resources (DERs) installed behind-the-meter as value adding participants. A trustworthy cyber-physical network thus becomes essential for coordinating these decentralized participants (e.g., by aggregators) in supporting Volt/VAR optimisation, a critical conservation voltage reduction (CVR) operation. Meanwhile, oversized inverters, which reserve a larger reactive power (VAR) capacity than needed for real power generation, provide incentive payouts during market participation; they are thus likely to be adopted by future customers. This adoption, as our findings show however, inaugurates a fundamental reliability-security tradeoff, when the surplus VAR capacity, in the wrong hands of cyber attackers, can become a stronger weapon for damaging voltage control as a malicious intent. This paper presents novel analysis of key mechanisms and impacts of a class of data integrity attacks against voltage control during CVR. Evaluation results using a realistic 118-bus test system show that tampering with Volt/VAR control in prosumer-side DER and metering devices, which service D-STATCOM, can cause harmful power quality degradation (e.g., excessive voltage dips) or even power interruption. The results also quantify (i) trade-offs between better Volt/VAR control (i.e., increased reliability) and heightened potency of data integrity attacks (i.e. weakened security) under DER inverter oversizing; and (ii) impacts of these attacks under salient global trends such as increasing DER adoption.