Covert channels in stochastic cyber‐physical systems

Abstract

A covert channel is a communication channel that is not intended to exist, and that can be used to transfer information in a manner that violates the system security policy. Attackers can abuse such channels to exfiltrate sensitive information from cyber-physical systems (CPSs), for example to leak the confidential or proprietary parameters in a control system. Furthermore, attacks against CPSs can exploit the leaked information about the implementation of the control system, for example to determine optimal false data injection attack values that degrade the system performance while remaining undetected. In this study, a control theoretic approach for establishing covert channels in stochastic CPSs is presented. In particular, a scenario is considered where an attacker is able to inject malware into the networked controller and arbitrarily alter the control logic. By exploiting such capability, an attacker can establish an illegitimate communication channel, for example to transmit sensitive plant parameters, between the networked controller and an eavesdropper intercepting the sensor measurements. The authors show that such a channel can be established by exploiting the closed-loop system operations, a decoding mechanism based on an unknown input observer, and an error-correcting coding scheme that exploits the control loop to obtain an implicit acknowledgement. A simple proof of concept implementation of the covert channel is presented, and its performance is evaluated by resorting to a numerical example. Finally, some defences and countermeasures are proposed against the proposed covert channel.This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

Edge-Based Detection and Localization of Adversarial Oscillatory Load Attacks Orchestrated By Compromised EV Charging Stations

“…We assume that the attacker can launch covert attacks [42] as illustrated in Figure 2. The adversary, as shown in Step 2, controls a considerable number of EVCSs and can command a coordinated oscillatory load attack against the grid.…”

Analysis of Reversible Network Covert Channels

“…We point out that a more fine-grained classification scheme has been proposed, especially to uniform discrepancies between different research works dealing with network steganography and covert channels, even not limited to the network-wide case [11], [24]. Unfortunately, information hiding techniques are proliferating in almost every new protocol or network/computing framework [17], [18], IoT environment [19], [25], smart vehicle [26], or industrial control system [27], [28], just to mention the most popular or emerging scenarios. Concerning recent examples, [20] analyzes many opportunities that an attacker can exploit for creating a covert channel within the Network Time Protocol, whereas [13] investigates whether timing channels can be used to implement long-range communications across different continents.…”