Cyber-Physical Systems Security

Abstract

In recent years, cyber-physical systems (CPSs) have received much attention from both the academic world and the industrial world, which refer to a deep integration and coordination of physical and computational resources [1,2]. Typical examples of CPSs can be found in smart grids, smart transportation systems, industrial control systems, water supply systems, and so on. Furthermore, many military systems are also CPSs. The key characteristic of CPSs is the integration of computing, control and communication. The increased in-terconnection between the cyber and physical spaces make CPSs vulnerable to various malicious attacks. A well-known example of an attack of CPSs is the Stuxnet which infected the control system of nuclear-fuel centrifuges of Bushehr nuclear power plant in Iran. Stuxnet makes people beware of the grave consequences of a cyber-attack on a CPS. Since many national critical infrastructures are applications of CPS, ensuring security and safety of such systems is of great importance. In traditional information technology (IT) systems, three security objectives are confidentiality, integrity and availability , where confidentiality is in the first place. While in CPSs, availability ranks the first. Besides, there are some differences between IT systems and CPSs. For examples, in CPSs, a long-term safe and reliable operation is necessary. In CPSs, components are rarely replaced and difficult to upgrade. In CPSs, the control performance of the system should be taken into account. The traditional IT security methods such as data encryption and authentication can protect the confidentiality of data and keep from unauthorized access to some extent

Security Requirements Engineering: A Framework for Cyber-Physical Systems

“…This breach of integrity in the physical layer can have critical, even catastrophic results, as faulty input data results in non-ideal control decisions that may lead to entirely unpredicted effects in the physical realm. These attacks can be conducted by accessing and manipulating internal nodes of the network, or employing external nodes to obtain system information or incapacitate the system operation [90].…”

Design-time Quantification of Integrity in Cyber-physical Systems

“…Gollmann and Krotofil highlight in [26] that "to work on cyberphysical systems, one has to combine the devious mind of the security expert with the technical expertise of the control engineer. " Unfortunately, this expertise is "not commonly found in the IT security community, " according to the authors of [25]. Moreover, this lack of expertise is worsened by the language barrier between the disciplines of control theory and IT security.…”

“…However, as stated in [13], the major distinction of control systems with respect to other IT systems is the interaction with the physical world. In [25], the authors state that CPSs security is specifically concerned with attacks that cause physical impact; since IT security mechanisms do not usually account for the physical part of the system, they are thus ineffective against attacks that either target or exploit the physical components of CPSs. In this section, we present an Information Flow (IF) inspired integrity analysis for CPSs which accounts for the physical process.…”