Security and Privacy in Cyber-Physical Systems

Foundations, Principles, and Applications

Houbing Song, Glenn A. Fink, Sabina Jeschke, Houbing Song, Glenn A. Fink, Sabina Jeschke

• Publisher: Wiley-IEEE Press
• Year: 2017
• ISBN:
  9781119226062
• Edition: 1
• Topic: Informatique
• Subtopic: Cryptographie

Written by a team of experts at the forefront of the cyber-physical systems (CPS) revolution, this book provides an in-depth look at security and privacy, two of the most critical challenges facing both the CPS research and development community and ICT professionals. It explores, in depth, the key technical, social, and legal issues at stake, and it provides readers with the information they need to advance research and development in this exciting area.

Cyber-physical systems (CPS) are engineered systems that are built from, and depend upon the seamless integration of computational algorithms and physical components. Advances in CPS will enable capability, adaptability, scalability, resiliency, safety, security, and usability far in excess of what today's simple embedded systems can provide. Just as the Internet revolutionized the way we interact with information, CPS technology has already begun to transform the way people interact with engineered systems. In the years ahead, smart CPS will drive innovation and competition across industry sectors, from agriculture, energy, and transportation, to architecture, healthcare, and manufacturing. A priceless source of practical information and inspiration, Security and Privacy in Cyber-Physical Systems: Foundations, Principles and Applications is certain to have a profound impact on ongoing R&D and education at the confluence of security, privacy, and CPS.

Chapter 1
Overview of Security and Privacy in Cyber-Physical Systems

Glenn A. Fink¹, Thomas W. Edgar¹, Theora R. Rice¹, Douglas G. MacDonald¹ and Cary E. Crawford²

¹Pacific Northwest National Laboratory, National Security Directorate, USA

²Oak Ridge National Laboratory, Nuclear Science and Engineering Directorate, USA

1.1 Introduction

Cyber-physical systems (CPSs) are broadly used across technology and industrial domains to enable process optimization and previously unachievable functionality. However, CPSs have been key targets in some of the most highly publicized security breaches over the last decade. Neither cyber- nor physical-security concepts alone can protect CPSs because the complex interdependencies and crossover effects can introduce unexpected vulnerabilities: Physical attacks may damage or compromise the information system on the device, and cyber-attacks can cause physical malfunctions. Because of the many critical applications where CPSs are employed, either kind of attack can result in dire real-world consequences. As a result, security and privacy must be key concerns for CPS design, development, and operation.

In this chapter, we discuss CPSs from a security perspective. We explain classical information and physical-security fundamentals in the context of CPSs deployed across application domains. We give examples where the interplay of functionality and diverse communication can introduce unexpected vulnerabilities and produce larger impacts. We discuss how CPS security and privacy are inherently different from pure cyber or physical systems and what may be done to secure these systems, considering their emergent cyber-physical properties. Finally, we discuss security and privacy implications when infrastructural and personal CPSs merge. While helping the general users cope with the risks inherent in existing products is important, our goal is to help designers of emerging CPSs to build more secure, privacy-enhanced products in the future by incorporating lessons learned from the recent past and present.

1.2 Defining Security and Privacy

Before we can discuss security and privacy of CPSs, it is crucial to understand the definitions and intricacies of the terms. Security is a set of measures to ensure that a system will be able to accomplish its goal as intended, while mitigating unintended negative consequences. When features are added to a system, security is applied to ensure that the additions neither compromise intended functionality nor introduce new attack vectors.

The National Institute of Standards and Technology (NIST) defines privacy as “Assurance that the confidentiality of, and access to, certain information about an entity is protected” (Barker et al., 2013, p. 94). “Entity,” in this case, can be a corporation or facility as well as an individual person. “Certain information” may refer to any sensitive information such as personally identifiable information (PII).

Security and privacy have in common the concepts of appropriate use and protection of information. Privacy is often thought of as freedom from observation, disturbance, or unwanted public attention and the ability of an individual or group to limit its self-expression. Privacy is often seen as an aspect of security, an affordance of confidentiality, because a secure system should protect the privacy of its users. Confidentiality usually means that information is not released to unauthorized parties, but privacy has a more dynamic dimension of allowing owners to control the dissemination of their information themselves. At the same time, security may be considered contrary to privacy. For instance, politicians and industry leaders endure reduced privacy to protect the public trust they hold.

1.2.1 Cybersecurity and Privacy

The concepts of security and privacy can be applied to both the cyber and physical sides of CPSs. There are many overlapping terms for these concepts including cybersecurity, information security, information assurance, and others. For our purposes, we are concerned in this section with the nonphysical, informational side of CPSs. Thus, the term information security as defined by NIST will suffice:

A condition that results from the establishment and maintenance of protective measures that enable an enterprise to perform its mission or critical functions despite risks posed by threats to its use of information systems. Protective measures may involve a combination of deterrence, avoidance, prevention, detection, recovery, and correction that should form part of the enterprise's risk management approach.

(Kissel, 2013, p. 94).

Information security is generally characterized by three core principles, which Pfleeger and Pfleeger (2007) and Cherdantseva and Hilton (2013) defined as follows:

• Confidentiality – Only authorized parties can access computer-related assets.
• Integrity – Assets can be modified only by authorized parties or only in authorized ways.
• Availability – Assets are accessible to authorized parties at appropriate times.

Together these are known as the “CIA triad,” and they ensure reliable access to correct information for the right people/programs/machines. The CIA triad is the heart of information security but is widely thought to be incomplete. Cherdantseva and Hilton (2013) discuss attempts to amend the triad and propose an information assurance and security octet that starts with CIA but also includes accountability, authentication and trustworthiness, auditability, nonrepudiation, and privacy. The complete list of security goals has not been definitively agreed upon, but we elect to add to the triad two additional elements that are most germane to the physical side of our discussion of CPSs. The last two principles are often bundled into the principle of integrity, but they are important enough to deserve separate attention:

• Authentication – Verifies the identity, often as a prerequisite to access (Committee on National Security Systems, 2010).
• Nonrepudiation – Protects against an individual's false denial of having performed a particular action and captures whether a user performed particular actions (i.e., sending or receiving a message) (NIST, 2013).

There are a number of means of implementing each of these cybersecurity principles. For example, encryption provides confidentiality, protecting data and system functions from unauthorized use. Digital signatures and secure hashes provide integrity, ensuring data or software updates are not modified. Redundancy of resources keeps the system available for the intended users for proper use at any time even under stress. Identities, certificates, and passwords are examples of authentication mechanisms that guarantee only authorized users may access resources protected by confidentiality measures. Authentication ensures integrity by verifying the authority of actors who would change an asset. Automatically collected records and logs of these changes may show which user accessed or modified specific parts of the system. When these logs are protected by some integrity mechanism, the result is a system with nonrepudiation. Nonrepudiation makes violations of integrity clear and provides forensically useful information when security fails.

Privacy in the information sense of the word usually refers to the principle of confidentiality, but it is also related to controlled disclosure of information. People want to be able to disclose information to some and not to others and they want to be able to control what is done with the information disclosed. Thus, privacy is a facet of personal information integrity because although data about a person may be transmitted, the information it bears is always the property of the person identified by it.

1.2.2 Physical Security and Privacy

Physical protection aims to defend an area in space according to the following principles adapted from the U.S. Department of Defense (2016) and U.S. Department of Energy (2005):

• Deterrence – A credible threat of countermeasures that prevents actions against the system by making the perceived cost of an attack outweigh the perceived benefits.
• Detection – The positive assessment that a specific object caused the alarm and/or the announcement of a potential malevolent act through alarms.
• Delay – Impediments that slow or prevent an adversary from accessing a protected asset or from completing a malevolent act.
• Response – Actions taken with appropriate force and at locations and times designed to stop the advancement of the adversary.
• Neutralization – Rendering enemy forces incapable of interfering with a particular operation.

Deterrence can be as innocuous as a sign indicating the presence of physical-security components or a guard posted in a visible location to warn the potential adversary of the consequences of an attack. Beyond this, detection is usually accomplished with surveillance technologies, human watchers, or operational processes. Alarms may be coupled with detection to alert those protecting the asset (the trusted agents) or to scare off the attacker. Barriers such as protective forces, walls, deployed obstacles, storage containers, locks, and tamper-resistant devices take time for an adversary to penetrate, providing delay (and some deterrence if the measures are visible). The response to intrusion events must be immediate and effective and may include summoning authorities with sufficient force to halt the attack. Without a timely response, no threat can be completely neutralized. The responders neutralize all of the attackers by arresting them or in some other way making it impossible for them to attack the system in that way again. If these physical-security elements are not properly utilized, even the most impenetrable defenses will eventually be defeated.

Privacy in the realm of physical security often entails trade-offs with security. Access controls, surveillance, detection and assessment, and response are all principles of physical protection that require individuals to be positively identified, tracked, and monitored while in the secured area. Allowing these physical protection systems to track a person's every move must be coupled with the assumption that this information will be utilized for the intended purpose only and protected against any malicious usage or unauthorized access. However, the agreement to provide this information to other trusted agents to further enhance security is usually made explicit.

1.3 Defining Cyber-Physical Systems

Cyber-physical systems, or CPSs, is an umb...