This paper assesses the resilience of IEC 61850 digital substations under False Data Injection Attacks (FDIAs) targeting the Sampled Values (SV) protocol. The multicast nature of SV, while enabling time-critical automation, exposes substations to cyber intrusions capable of disrupting protection functions and causing large-scale outages. To evaluate these risks, coordinated attack vectors involving both physical and cyber access at the bay level are experimentally analyzed using an advanced setup based on industrial-grade intelligent electronic devices (IEDs). The proposed attacks simultaneously manipulate multiple electrical parameters in a coordinated and physically consistent manner. Experimental results confirm the feasibility of stealthy multi-vector FDIAs that can trigger false protection actions, conceal real faults, or block protection mechanisms while maintaining realistic signal behavior. The Power Hardware-in-the-Loop (PHIL) testbed enables closed-loop evaluation under strict timing, communication, and protection logic constraints, reflecting real device behavior beyond simulation and controller-level HIL environments. The findings reveal critical vulnerabilities in SV-based protection schemes that directly affect grid reliability, particularly under realistic attacker positioning. To address these challenges, a defense strategy covering deterrence, prevention, detection, mitigation, and resilience is analyzed, with emphasis on bay-level infrastructure. Furthermore, a resilience-oriented method based on trusted independent channels and cross-verification of SV data within the protection logic is outlined as a complementary countermeasure for scenarios where existing standardized security mechanisms are insufficient.

翻译：本文评估了IEC 61850数字化变电站在遭受针对采样值（SV）协议的虚假数据注入攻击（FDIAs）时的韧性。SV的多播特性虽支持时间关键型自动化，却使变电站面临能够破坏保护功能并引发大规模停电的网络入侵风险。为评估这些风险，本研究基于工业级智能电子设备搭建先进实验平台，在间隔层对涉及物理与网络访问的协同攻击向量进行了实验分析。所提出的攻击能同时以协同且物理一致的方式操纵多个电气参数。实验结果证实了隐蔽多向量FDIAs的可行性，这些攻击可在维持真实信号行为的同时，触发虚假保护动作、掩盖真实故障或阻塞保护机制。功率硬件在环（PHIL）测试平台能够在严格时序、通信及保护逻辑约束下实现闭环评估，反映出超越仿真及控制器级硬件在环环境的真实设备行为。研究结果揭示了直接影响电网可靠性的基于SV保护方案的关键漏洞，尤其在攻击者实际定位场景下更为显著。为应对这些挑战，本文分析了涵盖威慑、预防、检测、缓解和韧性在内的防御策略，重点关注间隔层基础设施。此外，针对现有标准化安全机制不足的场景，本文概述了一种基于可信独立通道及保护逻辑内部SV数据交叉验证的韧性导向方法，作为补充性对抗措施。