Search

Cyber-physical systems (CPS) are often defended in the same manner as information technology (IT) systems -- by using perimeter security. Multiple factors make such defenses insufficient for CPS. Resiliency shows potential in overcoming these shortfalls. Techniques for achieving resilience exist; however, methods and theory for evaluating resilience in CPS are lacking. We argue that such methods and theory should assist stakeholders in deciding where and how to apply design patterns for resilience. Such a problem potentially involves tradeoffs between different objectives and criteria, and such decisions need to be driven by traceable, defensible, repeatable engineering evidence. Multi-criteria resiliency problems require a system-oriented approach that evaluates systems in the presence of threats as well as potential design solutions once vulnerabilities have been identified. We present a systems-oriented view of cyber-physical security, termed Mission Aware, that is based on a holistic understanding of mission goals, system dynamics, and risk.

While design assurance and testing methods for safety-critical systems have been widely researched and studied for years across a number of industry domains, there are few efforts reported in the literature on the actual application of software testing methods to nuclear power digital I&C systems or devices. We see this as a gap in the knowledge basis. The motivation for this research was to investigate the efficacy and challenges that arise when planning, automating and conducting systematic software testing on actual real-time embedded digital devices. In this paper, we present results on the application of a systematic testing methodology called Pseudo-Exhaustive testing. The systematic testing methods were applied at the unit and module integration levels of the software. The findings suggest that Pseudo Exhaustive testing supported by automated testing technology is an effective approach to testing real-time embedded digital devices in critical nuclear applications.

Systems modeling practice lacks security analysis tools that can interface with modeling languages to facilitate security by design. Security by design is a necessity in the age of safety critical cyber-physical systems, where security violations can cause hazards. Currently, the overlap between security and safety is narrow. But deploying cyber-physical systems means that today's adversaries can intentionally trigger accidents. By implementing security assessment tools for modeling languages we are better able to address threats earlier in the system's lifecycle and, therefore, assure their safe and secure behavior in their eventual deployment. We posit that cyber-physical systems security modeling is practiced insufficiently because it is still addressed similarly to information technology systems.

An Unmanned Aerial System (UAS) Flight Control System (FCS) is an example of a Cyber Physical System (CPS), in that it integrates computation, networking, and the control of a physical system, i.e., the aircraft. An FCS contains a Central Processing Unit (CPU), typically in the form of a microcontroller, referred to as the autopilot, connected to many subsystems to measure its environment, including accelerations, angular rates, dynamic and absolute pressures, and position. The autopilot periodically extracts data from the on-board sensors and processes those using navigational algorithms. The results of these computations are used to position actuators connected to the control surfaces of the UASs, causing it to fly in a correct way to perform the required mission. This process is performed in real-time, typically at the rate of 50 Hz or more. Any interruption or corruption of this process can cause the UAS to fail to perform its mission, or ultimately crash and be destroyed. This can result in significant loss of property, or even loss of life. A security compromised UAS can pose a serious threat, and the security vulnerabilities in their control system need to be minimized, if not completely eliminated [1].

One of the essential concepts being postulated for next generation nuclear power plants (NPPs) that could include Gen IV reactors—small modular reactors—is the notion of resilient and survivable in...

With the recent popularity of model-based design and verification (MBDE), fault injection testing at the functional model level is gaining significant interest. The reason for this interest is it aids in detecting design errors and incorrect requirements on fault detection and tolerance features, very early in the development lifecycle. This is evidenced by the fact that functional safety standards like IEC 61508 and ISO 26262 identify fault injection testing as a highly recommended technique for SIL-3 and SIL-4. The main challenges to date with model-based fault injection are lack of completeness in the fault injection space, semi-manual integration and insertion of fault injection modules into the models and manual identification of fault activation conditions. The work presented in this paper describes a novel model-based fault injection technique that is property-based and applies formal model checking verification methods at the functional model level of design thereby guaranteeing a near-exhaustive state, input and fault space coverage. This method also introduces the usage of properties and model checking capabilities to automate the identification of fault activation conditions for all the faults within the fault space. We describe the workflow and implementation of the property-based Fault injection using Simulink Design Verifier and its application on the functional model of a representative safety-critical system.

Cyber-physical systems (CPS) are composed of various embedded subsystems (often realized on system on chip technology) and require specialized software, firmware and hardware to coordinate with the rest of the system. These multiple levels of integration expose attack surfaces which can be susceptible to attack vectors that require novel architectural methods to effectively secure against. We present a multilevel monitor architecture cybersecurity approach applied to a flight control system (FCS). We develop formal framework for the architecture using Event Calculus to define the interactions among the monitors and the system under observation.

Digital systems built based on field-programmable-gate-arrays (FPGAs) are increasingly being used in safety-critical computer systems. These systems typically require high levels of integrity, reliability, and performance to ensure the correct operation of the critical application in which the digital systems are embedded. To achieve the safety and functional objectives, many hardware architectural scenarios based on fault tolerance techniques were proposed. This research paper presents a new dependable digital system (DDS) that consists of fault tolerant blocks (FTBs), spare functional blocks (SFBs), synchronization units, and input output units. Markov-based chain have been used to model the correct operation of the proposed hardware system that is targeted to be realized on FPGA-based technology. This system was designed to be reliable against transient faults (TF), permanent faults (PF), and hardware common cause failures (CCF). The reliability analysis of the proposed system was accomplished with Markov modeling techniques which could express the regenerative behavior of the digital system. Certain states in the system represent system failure, while others represent fault-free behavior in the presence of faults. Finally, based on the MathWorks Simulink simulation results of modeling the DDS digital system, the system does meet its functionality and reliability requirements.

Modeling cyber-physical systems (CPS) presents a unique challenge due to their numerous heterogeneous components, complex physical interactions, and disjoint communication networks. Modeling CPS to aid security analysis further adds to these challenges, because securing CPS requires not only understanding of the system architecture but also the system’s role within its broader mission. This is due to the infeasibility of completely securing every single component, network, and part within a CPS. As such it is necessary to be cognizant of the system’s expected service, or mission, so the effects of an exploit can be mitigated, and the system can at least perform its mission in a partially degraded manner. A security analysis methodology based on this philosophy is greatly aided by the creation of a model that combines system architecture information, its admissible behaviors, and its mission context. This paper presents a technique for creating such a model using the Systems Modeling Language.

Applying security as a lifecycle practice is becoming increasingly important to combat targeted attacks in safety-critical systems. Among others there are two significant challenges in this area: (1) the need for models that can characterize a realistic system in the absence of an implementation and (2) an automated way to associate attack vector information; that is, historical data, to such system models. We propose the cybersecurity body of knowledge (CYBOK), which takes in sufficiently characteristic models of systems and acts as a search engine for potential attack vectors. CYBOK is fundamentally an algorithmic approach to vulnerability exploration, which is a significant extension to the body of knowledge it builds upon. By using CYBOK, security analysts and system designers can work together to assess the overall security posture of systems early in their lifecycle, during major design decisions and before final product designs. Consequently, assisting in applying security earlier and throughout the systems lifecycle.