Security Analysis of CPS: Understanding Current Concerns as a Foundation for Future Design

Abstract

Cyber-Physical Systems (CPS) or Embedded Systems are now so wide spread that we see applications in almost every aspect of our everyday activities. Application fields include industrial process control, health care, transportation, financial transaction systems, building security systems, home electronics, and automobiles, among others. The "Physical" aspect of CPS indicates that these systems interact mainly with the physical world and thus can significantly impact human and environmental safety as well as large physical infrastructure systems. CPS failure can therefore have catastrophic consequences. It is thus very important that CPS operate in a safe, reliable and secure manner. While these systems have seen a lot of technological improvements resulting in increased functionality, the issue of security has been a low priority in their design, thus exposing them to several security threats. If we are to benefit fully from the many applications of CPS then security needs to take a central role in their design. The challenges of security design for CPS are aggravated by the lack of standardization in hardware, operating systems, networking and the diverse physical environment. Addressing such challenges needs a strong collaboration between those skilled in CPS component design as well as those skilled in security and other aspects of these complex systems. This study includes an analysis of the available literature and design practices in several CPS application fields, with an emphasis on design for security. The Information Technology community has a rich background in security analysis, although not generally applied to CPS design. Thus a security analysis methodology for CPS was developed from recognized security analysis techniques for conventional computing. Assets, security threats and risks are analyzed relative to a CPS environment. Current security solutions are presented and compared. We discuss evolutionary changes of CPS leading to their growing importance within computing disciplines and their increasing role in large, heterogeneous distributed systems. Finally the integrative nature of CPS design is discussed and the role of Information Technology as a major contributor to CPS design for security is emphasized.