No abstract

Positive Train Controller (PTC) is a communication based system designed to enforce PTC safety objectives for trains such as train-to-train collisions, train derailments, and ensure railroad worker safety. Existing PTC designs consider risks due to operational environment such as location of other trains, switches, and speed limits. We propose to enhance PTC by using a multi-tiered cognitive radio network that considers multiple risks such as those due to bandwidth congestion, packet length limitations, propagation losses, detectable exploitation of Software Defined Radio vulnerabilities, and protocol vulnerabilities. Radios operating at PTC nodes (such as train, WIU and Base station) is equipped with a cognitive layer, which communicates with other nodes to create a cognitive radio network. The proposed network as a whole strives to provide spectrum management and security for the radio communication system, which can enhance the PTC functionality. Each cognitive radio in our proposed network consists of multiple tiers. The upper tier consists of a master cognitive engine that holistically evaluates the operational risks of the network and acts to mitigate them using the lower tiers. The lower tier (immediate slave tier to the master) consists of sub cognitive engines for cryptographic operations and spectrum management. The traditional PTC protocol is implemented at a lower tier module that interface with the master Cognitive Engine (CE). The master-slave communications within one radio is implemented using middleware. The proposed cognitive radio network can be modeled as a cyber-physical system by incorporating train movement dynamics, radio transmission characteristics and cryptographical computations, thereby constituting a distributed system of communicating hybrid automatons. This design enables us to verify safety and the security of the system using formal methods, which constitutes our ongoing work. We also discuss potential issues such as FRA mandated safety cases that needs to be addressed if the proposed features are to be added to the PTC systems.

Network forensics is an extension of the network security model, which traditionally emphasizes prevention and detection of network attacks. It addresses the need for dedicated investigative capabilities for investigation of malicious behavior in networks. Modern-day attackers tend to use sophisticated multi-stage, multihost attack techniques and anti-forensics tools to cover their attack traces. Due to the current limitations of intrusion detection and forensic analysis tools, reconstructing attack scenarios from evidence left behind by the attackers of an enterprise system is challenging. In particular, reconstructing attack scenarios by using the information from IDS alerts and system logs that have a large number of false positives is a big challenge.

American railroads are planning to introduce the Positive Train Control System (PTC), a wireless communication system to control passenger and cargo train movements. By design PTC has two networks, the main control network that disseminates trackage rights and a wayside interface unit (WIU) network that beacons track status. One of the main constraints for adopting this system for high-speed trains is the limited bandwidth availability in USA, as higher speeds require more control packets to be communicated using the same radio channel. In this paper we propose an architecture that manages available bandwidth between control and WIU networks by considering the maximum number of trains that has to be simultaneously accommodated by a control point and allocate control channels for the uplink and downlink communication between trains and control points accordingly. The rest of the channels are assigned to wayside devices to minimize interference. Control point locations are decided so that there is proper communication between any train and a control point until the train is handed over to the next control point. The proposed architecture addresses the congestion management, power control and interference avoidance aspects of communication planning for high-speed rail operations. We demonstrate the applicability of our frequency management architecture for a hypothetical train intersection.

American Railroads are planning to complete implementing their Positive Train Control (PTC) systems by 2020. Safety objectives of PTC are to avoid inter-train collisions, train derailments and ensuring railroad worker safety. Under published specifications of I-ETMS (the PTC system developed by Class I freight railroads), the on-board PTC controller communicates with two networks; namely, the Signaling network and the Wayside Interface Unit network to gather navigational information such as the positions of other trains, the status of critical infrastructure (such as switches) and any hazardous conditions that may affect the train path. By design, PTC systems are predicated on having a reliable radio network operating in reserved radio spectrum, although the PTC system itself is designed to be a real-time fail safe distributed control systems. Secure Intelligent Radio for Trains (SIRT) is an intelligent radio that is customized to train operations with the aim of improving the reliability and security of the radio communication network. SIRT has two tiers. The upper tier has the Master Cognitive Engine (MCE) which communicates with other SIRT nodes to obtain signaling and wayside device information. To do so, the MCE communicates with cognitive engines at the lower tier of SIRT; namely the Cryptographic Cognitive Engine (CCE) (that provide cryptographic security and threat detection) and the Spectrum Management Cognitive Engine (SCE) (that uses spectrum monitoring, frequency hopping and adaptive modulation to ensure the reliability of the radio communication medium). We presented the architecture and the prototype development of the CCE in [1]. This paper presents the design of the MCE and the SCE. We are currently developing a prototype of the SCE and the MCE and testing the performance of our cognitive radio system under varying radio noise conditions. Our experiments show that SIRT dynamically switches modulation schemes in response to radio noise and switches channels in response to channel jamming.