Security-Aware Scheduling of Embedded Control Tasks

Abstract

In this work, we focus on securing cyber-physical systems (CPS) in the presence of network-based attacks, such as Man-in-the-Middle (MitM) attacks, where a stealthy attacker is able to compromise communication between system sensors and controllers. Standard methods for this type of attacks rely on the use of cryptographic mechanisms, such as Message Authentication Codes (MACs) to ensure data integrity. However, this approach incurs significant computation overhead, limiting its use in resource constrained systems. Consequently, we consider the problem of scheduling multiple control tasks on a shared processor while providing a suitable level of security guarantees. Specifically, by security guarantees we refer to control performance, i.e., Quality-of-Control (QoC), in the presence of attacks. We start by mapping requirements for QoC under attack into constraints for security-aware control tasks that, besides standard control operations, intermittently perform data authentication. This allows for the analysis of the impact that security-related computation overhead has on both schedulability of control tasks and QoC. Building on this analysis, we introduce a mixed-integer linear programming-based technique to obtain a schedulable task set with predefined QoC requirements. Also, to facilitate optimal resource allocation, we provide a method to analyze interplay between available computational resources and the overall QoC under attack, and show how to obtain a schedulable task set that maximizes the overall QoC guarantees. Finally, we prove usability of our approach on a case study with multiple automotive control components.

Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems

“…For both studies, sensor values are transmitted over an internal vehicle's network, such as commonly used CAN bus. Note that in [14], we provide additional automotive case-studies (and the overall scheduling framework) for intermittent authentication of CANbus messages from system sensors, and in [15] we show benefits of intermittent authentication on vehicle's ECU scheduling.…”

“…Related results from [20], [23], focus only on the detection function g k = z T k Q −1 z k and show only sufficient conditions for stealthy attacks -i.e., that in this case from a robustness condition ∆z k Q −1 ≤ α it follows that the the stealthiness condition β a k ≤ β + ε is satisfied. However, the equivalence between conditions ∆z k Q −1 ≤ α and β a k ≤ β +ε will enable us to reduce conservativeness of our analysis as well as analyze boundness of the reachability region for the general type of detection functions from (15), by allowing us to employ both conditions interchangeably.…”

“…Lemma 2. For a system with the detector function g a k of the form from (15), the set of all stealthy attacks at time k, A k , can be overapproximated by the set…”

Security-Aware Synthesis Using Delayed-Action Games

“…For localization, the UAV mainly relies on a GPS sensor that can be compromised to effectively steer the UAV away from its original path. While aggressive attacks can be detected, some may remain stealthy by introducing only bounded errors at each step [20,26,22,16]. For example, Fig.…”

An Information Matrix Approach for State Secrecy

“…We only deal with eavesdropping attacks here, but other types of attacks have also been studied [2]. Those include denialof-service attacks [3] and data-integrity attacks [4]- [8].…”