  The power flexibility from smart buildings makes them suitable candidates for
providing grid services. The building automation system (BAS) that employs
model predictive control (MPC) for grid services relies heavily on sensor data
gathered from IoT-based HVAC systems through communication networks. However,
cyber-attacks that tamper sensor values can compromise the accuracy and
flexibility of HVAC system power adjustment. Existing studies on
grid-interactive buildings mainly focus on the efficiency and flexibility of
buildings' participation in grid operations, while the security aspect is
lacking. In this paper, we investigate the effects of cyber-attacks on HVAC
systems in grid-interactive buildings, specifically their power-tracking
performance. We design a stochastic optimization-based stealthy sensor attack
and a corresponding defense strategy using a resilient control framework. The
attack and its defense are tested in a physical model of a test building with a
single-chiller HVAC system. Simulation results demonstrate that minor
falsifications caused by a stealthy sensor attack can significantly alter the
power profile, leading to large power tracking errors. However, the resilient
control framework can reduce the power tracking error by over 70% under such
attacks without filtering out compromised data.
