A Formal Approach to Physics-based Attacks in Cyber-physical Systems

Abstract

We apply formal methods to lay and streamline theoretical foundations to reason about Cyber-Physical Systems (CPSs) and physics-based attacks, i.e., attacks targeting physical devices. We focus on a formal treatment of both integrity and denial of service attacks to sensors and actuators of CPSs, and on the timing aspects of these attacks. Our contributions are fourfold. (1) We define a hybrid process calculus to model both CPSs and physics-based attacks. (2) We formalise a threat model that specifies MITM attacks that can manipulate sensor readings or control commands in order to drive a CPS into an undesired state; we group these attacks into classes, and provide the means to assess attack tolerance/vulnerability with respect to a given class of attacks, based on a proper notion of most powerful physics-based attack.(3) We formalise how to estimate the impact of a successful attack on a CPS and investigate possible quantifications of the success chances of an attack. (4) We illustrate our definitions and results by formalising a non-trivial running example in Uppaal SMC, the statistical extension of the Uppaal model checker; we use Uppaal SMC as an automatic tool for carrying out a static security analysis of our running example in isolation and when exposed to three different physics-based attacks with different impacts. * This document extends the paper "A Formal Approach to Physics-Based Attacks in Cyber-Physical Systems" that will appear in ACM Transactions on Privacy and Security by providing proofs that are worked out in full details.In this section, we introduce our Calculus of Cyber-Physical Systems and Attacks, CCPSA, which extends the Calculus of Cyber-Physical Systems, defined in our companion papers [37,41], with specific features to formalise and study attacks to physical devices.Let us start with some preliminary notation.3 Intuitively, attacks of classes weaker than C can do less with respect to attacks of class C.

Relational Analysis of Sensor Attacks on Cyber-Physical Systems

“…Formal analysis of sensor attacks Lanotte et al [16], [17] propose formal approaches to model and analyze sensor attacks with a process calculus. The threat model allows attacks that manipulate sensor readings or control commands to compromise state.…”

“…However, relatively little work considers formal verification of such systems in the presence of sensor attacks. Some recent work emphasize timing aspects of sensor-related attacks [16], [17]; however, the work model the system's dynamics as a deterministic discrete time dynamical system, whereas most cyber-physical systems are best modeled with a nondeterministic combination of discrete and continuous dynamics.…”

Impact Analysis of Cyber-Physical Attacks on a Water Tank System via Statistical Model Checking

“…In this respect, the two main options were Uppaal-SMC [8] and modes. In [24], we tested Uppaal-SMC for the security analysis of the simple engine verified in [23] using prohver. From these two experiences, we realized that HMODEST provides us with a better and clearer representation of complex cyber-physical systems and cyber-physical attacks.…”

Runtime Enforcement of Programmable Logic Controllers

“…Fist of all, we introduce a formal language to specify controller programs. For this very purpose, we resort to process calculi, a successful and widespread formal approach in concurrency theory for representing complex systems, such as mobile systems [11] and cyberphysical systems [30], and used in many areas, including verification of security protocols [1,2] and security analysis of cyber-physical attacks [29]. Thus, we define a simple timed process calculus, based on Hennessy and Regan's Timed Process Language (TPL) [21], for specifying controllers, finite-state edit automata, and networks of communicating monitored controllers.…”