Inherent vulnerability of demand response optimisation against false data injection attacks in smart grids

The transition of energy networks to so-called smart grids benefits from advancements in Internet of Things technology. Energy management systems enable efficient and effective demand response (DR) schemes optimising load distribution. The increased user involvements through such DR schemes creates a new vector for false data injection attacks (FDIA), where authentic users themselves inject false data. Unlike in most existing FDIAs, no breaches to communication or devices are needed to execute this type of FDIA. In this work, we depict that this new FDIA can impact any optimisation-based DR scheme. Further, we show that adversaries achieve financial benefits independently from the actual algorithm used for optimisation, as long as they are able to inject false demand predictions. Compared to traditional FDIAs, reliable security mechanisms such as proper authentication, security protocols, security controls or sealed/controlled devices cannot prevent this new type of FDIA. Additionally, we show that there is no straightforward solution and we highlight the need for highly reliable FDIA detection mechanisms to thwart this type of attacks.