Search

This paper contributes a formal framework for quantitative analysis of bounded sensor attacks on cyber-physical systems, using the formalism of differential dynamic logic. Given a precondition and postcondition of a system, we formalize two quantitative safety notions, quantitative forward and backward safety, which respectively express (1) how strong the strongest postcondition of the system is with respect to the specified postcondition, and (2) how strong the specified precondition is with respect to the weakest precondition of the system needed to ensure the specified postcondition holds. We introduce two notions, forward and backward robustness, to characterize the robustness of a system against sensor attacks as the loss of safety. To reason about robustness, we introduce two simulation distances, forward and backward simulation distances, which are defined based on the behavioral distances between the original system and the system with compromised sensors. Forward and backward distances, respectively, characterize upper bounds of the degree of forward and backward safety loss caused by the sensor attacks. We verify the two simulation distances by expressing them as modalities, i.e., formulas of differential dynamic logic, and develop an ad-hoc proof system to reason with such formulas. We showcase our formal notions and reasoning techniques on two non-trivial case studies: an autonomous vehicle that needs to avoid collision and a water tank system., Comment: Preprint submitted to Elsevier

Cyber-physical systems, such as self-driving cars or autonomous aircraft, must defend against attacks that target sensor hardware. Analyzing system design can help engineers understand how a compromised sensor could impact the system's behavior; however, designing security analyses for cyber-physical systems is difficult due to their combination of discrete dynamics, continuous dynamics, and nondeterminism. This paper contributes a framework for modeling and analyzing sensor attacks on cyber-physical systems, using the formalism of hybrid programs. We formalize and analyze two relational properties of a system's robustness. These relational properties respectively express (1) whether a system's safety property can be influenced by sensor attacks, and (2) whether a system's high-integrity state can be affected by sensor attacks. We characterize these relational properties by defining an equivalence relation between a system under attack and the original unattacked system. That is, the system satisfies the robustness properties if executions of the attacked system are appropriately related to executions of the unattacked system. We present two techniques for reasoning about the equivalence relation and thus proving the relational properties for a system. One proof technique decomposes large proof obligations to smaller proof obligations. The other proof technique adapts the self-composition technique from the literature on secure information-flow, allowing us to reduce reasoning about the equivalence of two systems to reasoning about properties of a single system. This technique allows us to reuse existing tools for reasoning about properties of hybrid programs, but is challenging due to the combination of discrete dynamics, continuous dynamics, and nondeterminism. To evaluate, we present three case studies motivated by real design flaws in existing cyber-physical systems., Comment: This is an extended version of the paper with the same title that appeared in the 2021 Computer Security Foundations Symposium

Low-energy positive and negative parity collective states in the equilibrium minimum, and the dynamics of induced fission of actinide nuclei are investigated in a unified theoretical framework based on the generator coordinate method (GCM) with the Gaussian overlap approximation (GOA). The collective potential and inertia tensor, both at zero and finite temperature, are computed using the self-consistent multidimensionally constrained relativistic mean field (MDC-RMF) model, based on the energy density functional DD-PC1. Pairing correlations are treated in the BCS approximation with a separable pairing force of finite range. A collective quadrupole-octupole Hamiltonian characterized by zero-temperature axially-symmetric deformation energy surface and perturbative cranking inertia tensor, is used to model the low-lying excitation spectrum. The fission fragment charge distributions are obtained by propagating the initial collective states in time with the time-dependent GCM+GOA that uses the same quadrupole-octupole Hamiltonian, but with the collective potential and inertia tensor computed at finite temperature. The illustrative charge yields of $^{228}$Th, $^{234}$U, $^{240}$Pu, $^{244}$Cm, and $^{250}$Cf are in very good agreement with experiment, and the predicted mass asymmetry is consistent with the result of a recent microscopic study that has attributed the distribution (peak) of the heavier-fragment nuclei to shell-stabilized octupole deformations., Comment: 10 pages, 8 figures. arXiv admin note: text overlap with arXiv:1809.06144

Imprecise and incomplete specification of system \textit{configurations} threatens safety, security, functionality, and other critical system properties and uselessly enlarges the configuration spaces to be searched by configuration engineers and auto-tuners. To address these problems, this paper introduces \textit{interpreted formalisms based on real-world types for configurations}. Configuration values are lifted to values of real-world types, which we formalize as \textit{subset types} in Coq. Values of these types are dependent pairs whose components are values of underlying Coq types and proofs of additional properties about them. Real-world types both extend and further constrain \textit{machine-level} configurations, enabling richer, proof-based checking of their consistency with real-world constraints. Tactic-based proof scripts are written once to automate the construction of proofs, if proofs exist, for configuration fields and whole configurations. \textit{Failures to prove} reveal real-world type errors. Evaluation is based on a case study of combinatorial optimization of Hadoop performance by meta-heuristic search over Hadoop configurations spaces.