Network Scheduling for Secure Cyber-Physical Systems

Lesi, Vuk; Jovanov, Ilija; Pajić, Miroslav

doi:10.1109/rtss.2017.00012

Cited by 25 publications

(22 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For both studies, sensor values are transmitted over an internal vehicle's network, such as commonly used CAN bus. Note that in [14], we provide additional automotive case-studies (and the overall scheduling framework) for intermittent authentication of CANbus messages from system sensors, and in [15] we show benefits of intermittent authentication on vehicle's ECU scheduling.…”

Section: Case Studiesmentioning

confidence: 98%

Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems

Jovanov

Pajić

2019

IEEE Trans. Automat. Contr.

Self Cite

View full text Add to dashboard Cite

The increase in network connectivity has also resulted in several high-profile attacks on cyber-physical systems. An attacker that manages to access a local network could remotely affect control performance by tampering with sensor measurements delivered to the controller. Recent results have shown that with network-based attacks, such as Man-in-the-Middle attacks, the attacker can introduce an unbounded state estimation error if measurements from a suitable subset of sensors contain false data when delivered to the controller. While these attacks can be addressed with the standard cryptographic tools that ensure data integrity, their continuous use would introduce significant communication and computation overhead. Consequently, we study effects of intermittent data integrity guarantees on system performance under stealthy attacks. We consider linear estimators equipped with a general type of residual-based intrusion detectors (including χ 2 and SPRT detectors), and show that even when integrity of sensor measurements is enforced only intermittently, the attack impact is significantly limited; specifically, the state estimation error is bounded or the attacker cannot remain stealthy. Furthermore, we present methods to:(1) evaluate the effects of any given integrity enforcement policy in terms of reachable state-estimation errors for any type of stealthy attacks, and (2) design an enforcement policy that provides the desired estimation error guarantees under attack. Finally, on three automotive case studies we show that even with less than 10% of authenticated messages we can ensure satisfiable control performance in the presence of attacks.

show abstract

Section: Case Studiesmentioning

confidence: 98%

Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems

Jovanov

Pajić

2019

IEEE Trans. Automat. Contr.

Self Cite

View full text Add to dashboard Cite

show abstract

“…(1) Initialize a MINITEE context through invoking MINITEE-Driver: Time since the real-time task calls API TEE_InitializeContext until MINITEE-Driver issues a world switching using SMC 0; (2) SMC from Normal world handling: Time since the processor enters in the monitor's vector table until restore the Secure world context; (3) Create a new TEE task or resume a previous suspended one: Time since MINITEE scheduler occupies the CPU until the called TA starts to execute on TEE task's stack; (4) Suspend MINITEE scheduler: Time since TA finishes its execution until MINITEE scheduler issues a SMC 0 to switch world back to Normal World; (5) Handle SMC from Secure world in Monitor module: Time since the processor enters in the monitor's vector table until restore the Normal world context ; (6) Finalize the MINITEE context: Time since the processor gets back to Normal world until MINITEE-Driver frees up the shared memory and goes back to the execution of the calling real-time task. Table 4 presents the collected results.…”

Section: A Partition Ta Invokingmentioning

confidence: 99%

“…If those information are tampered with an ill-intentioned entity, the entire drone can be mis-routed, leading failed delivery [1]. Complex authentication mechanisms can improve system security, but at the price of introducing large overhead and degrading the real-time performance of the system [2]. Therefore, a platform-level security solution for such systems should not only enhance the security but also minimize the negative influence to the real-time performance.…”

Section: Introductionmentioning

confidence: 99%

MiniTEE—A Lightweight TrustZone-Assisted TEE for Real-Time Systems

et al. 2020

View full text Add to dashboard Cite

While trusted execution environments (TEEs) provide industry standard security and isolation, TEE requests through secure monitor calls (SMCs) attribute to large time overhead and weakened temporal predictability. Moreover, as current available TEE solutions are designed for Linux and/or Android initially, it will encounter many constraints (e.g., driver libraries incompatible, large memory footprint, etc.) when integrating with low-end Real-Time Operating Systems, RTOSs. In this paper, we present MINImathsizesmallTEE to understand, evaluate and discuss the benefits and limitations when integrating TrustZone-assisted TEEs with RTOSs. We demonstrate how MINImathsizesmallTEE can be adequately exploited for meeting the real-time needs, while presenting a low performance overhead to the rich OSs (i.e., low-end RTOSs).

show abstract

“…[22], we only focus on the computational aspect of the problem and show how to guarantee timeliness for security-aware control tasks, while Ref. [21] presents our initial attempt to ensure timeliness of communication messages. Yet, Refs [21] and [22] only consider decoupled scenarios where the only concern for incorporating security is either ECU processing time (with the assumption that the network is not congested) or network bandwidth (while ECUs are not considered).…”

Section: Introductionmentioning

confidence: 99%

“…However, the problem of providing integrated QoC and security guarantees while ensuring timeliness in scenarios where both ECU processing time and network bandwidth are limited remains open, as both solutions from Refs [21] and [22] fall short in such case. Essentially, the methods from Ref.…”

Section: Introductionmentioning

confidence: 99%

Integrating Security in Resource-Constrained Cyber-Physical Systems

Lesi

Jovanov

Pajić

2020

ACM Trans. Cyber-Phys. Syst.

Self Cite

View full text Add to dashboard Cite

Defense mechanisms against network-level attacks are commonly based on the use of cryptographic techniques, such as lengthy message authentication codes (MAC) that provide data integrity guarantees. However, such mechanisms require significant resources (both computational and network bandwidth), which prevents their continuous use in resource-constrained cyber-physical systems (CPS). Recently, it was shown how physical properties of controlled systems can be exploited to relax these stringent requirements for systems where sensor measurements and actuator commands are transmitted over a potentially compromised network; specifically, that merely intermittent use of data authentication (i.e., at occasional time points during system execution), can still provide strong Quality-of-Control (QoC) guarantees even in the presence of false-data injection attacks, such as Man-in-the-Middle (MitM) attacks. Consequently, in this work, we focus on integrating security into existing resource-constrained CPS, in order to protect against MitM attacks on a system where a set of control tasks communicates over a real-time network with system sensors and actuators. We introduce a design-time methodology that incorporates requirements for QoC in the presence of attacks into end-to-end timing constraints for real-time control transactions, which include data acquisition and authentication, real-time network messages, and control tasks. This allows us to formulate a mixed integer linear programming-based method for direct synthesis of schedulable tasks and message parameters (i.e., deadlines and offsets) that do not violate timing requirements for the already deployed controllers, while adding a sufficient level of protection against network-based attacks; specifically, the synthesis method also provides suitable intermittent authentication policies that ensure the desired QoC levels under attack. To additionally reduce the security-related bandwidth overhead, we propose the use of cumulative message authentication at time instances when the integrity of messages from subsets of sensors should be ensured. Furthermore, we introduce a method for the opportunistic use of the remaining resources to further improve the overall QoC guarantees while ensuring system (i.e., task and message) schedulability. Finally, we demonstrate applicability and scalability of our methodology on synthetic automotive systems as well as a real-world automotive case-study.

show abstract

Network Scheduling for Secure Cyber-Physical Systems

Cited by 25 publications

References 16 publications

Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems

Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems

MiniTEE—A Lightweight TrustZone-Assisted TEE for Real-Time Systems

Integrating Security in Resource-Constrained Cyber-Physical Systems

Contact Info

Product

Resources

About