Diversity, Safety and Security in Embedded Systems: Modelling Adversary Effort and Supply Chain Risks

Abstract

Abstract-We present quantitative considerations for the design of redundancy and diversity in embedded systems with security requirements. The potential for malicious activity against these systems have complicated requirements and design choices. New design trade-offs have arisen besides those already familiar in this area: for instance, adding redundancy may increase the attack surface of a system and thus increase overall risk. Our case study concerns protecting redundant communications between a control system and its controlled physical system. We study the effects of using: (i) different encryption keys on replicated channels, and (ii) diverse encryption schemes and implementations. We consider two attack scenarios, with adversaries having access to (i) ways of reducing the search space in attacks using random searches for keys; or (ii) hidden major flaws in some crypto algorithm or implementation. Trade-offs between the requirements of integrity and confidentiality are found, but not in all cases. Simple models give useful design insights. In this system, we find that key diversity improves integrity without impairing confidentiality -no trade-offs arise between the two -and it can substantially increase adversary effort, but it will not remedy substantial weaknesses of the crypto system. Implementation diversity does involve design trade-offs between integrity and confidentiality, which we analyse, but turns out to be generally desirable for highly critical applications of the control system considered.

Redundancy-based intrusion tolerance approaches moving from classical fault tolerance methods

“…Others, instead, concentrated on architectural solutions for specific application domains, smart grids (Babay et al, 2018), autonomous driving (Vöelp and Verissimo, 2018), or web servers (Saidane et al, 2009). Specific security architectures tailored to problems generated by specific vulnerabilities are the subject of the works of Gorbenko et al (2020) and Garcia et al (2014), while investigations on trade-offs between competing requirements are conducted by Gashi et al (2016).…”

“…Notice, though, that scattering data and code among on-premises and/or commercial data centers may degrade confidentiality, depending on the accessibility conditions to the chosen diverse sites (see the works of Gashi et al (2016) or Khan and Babay (2021) for specific examples). Thus, side effects of location diversity have to be carefully analyzed and managed.…”

“…In this paper, two layers of protection will be considered, indicated as L 0 , L 1 , where L 0 is the most stringent one, as also done in other studies (e.g., Rodriguez et al, 2015;Gashi et al, 2016;Hardekopf et al, 2001). Of course, a higher number of protection levels could be needed, to properly address requirements of specific contexts/application domains.…”

Programming the CLEARSY Safety Platform with B

“…The CLEARSY Safety Platform is made up of a hardware execution platform, an IDE enabling the generation of diverse binaries from a single B model, and a certification kit describing its safety features as well as the safety constraints exported to the hosting system. Diversity intentional differences between redundant components, to reduce the likelihood of common failures due to systematic causes that would reduce the benefit of redundancy [3].…”

Characterizing Sets of Systems: Representation and Analysis of Across-Systems Properties

“…─ Diversity: Each system of the set of systems is implemented in a different language or technology. A set composed of a C++ application, a JAVA application and a Python application highly supports diversity property [24]. ─ Redundancy: Each system of the set of systems offers the same functions.…”