Using high-level synthesis and formal analysis to predict and preempt attacks on industrial control systems

Abstract

Industrial control systems (ICSes) have the conflicting requirements of security and network access. In the event of large-scale hostilities, factories and infrastructure would more likely be targeted by computer viruses than the bomber squadrons used in WWII. ICS zero-day exploits are now a commodity sold on brokerages to interested parties including nations. We mitigate these threats not by bolstering perimeter security, but rather by assuming that potentially all layers of ICS software have already been compromised and are capable of launching a latent attack while reporting normal system status to human operators. In our approach, application-specific configurable hardware is the final authority for scrutinizing controller commands and process sensors, and can monitor and override operations at the lowest (I/O pin) level of a configurable system-on-chip platform. The process specifications, stability-preserving backup controller, and switchover logic are specified and formally verified as C code, and synthesized into hardware to resist software reconfiguration attacks. To provide greater assurance that the backup controller can be invoked before the physical process becomes unstable, copies of the production controller task and plant model are accelerated to preview the controller's behavior in the near future.

A Survey of Practical Formal Methods for Security

“…The authors utilized semi-automatic co-verification methodology using a toolchain comprised of Boogie [34] as intermediate verification language, through Corral software verifier [160] and SMACK [210] for bit-precise checking with an ultimate goal of producing secure SoCs. The author of [165] consider that all software layers could be compromised and have developed an application specific hardware monitor based on a formally analysed C code and a junction box validated in a hardware description language with a goal to monitor the hardware controller for malicious activity. The authors model their hardware monitor in Frama-C [76] with Jessie plugin, allowing for automatic deductive verification using Why [98].…”