Analysis of Security Threats and Vulnerability for Cyber-physical Systems

2013 3rd International Conference on Computer Science and Network Technology Analysis of Security Threats and Vulnerability for Cyber-physical Systems Yang Gao1, Yong Peng1, Feng Xie1, Wei Zhao1, Dejin Wang1, Xuefeng Han1, Tianbo Lu2, Zhao Li2 1. China Information Technology Security Evaluation Center, Beijing, China 2. Beijing University of Posts and Telecommunications,Beijing, China [email protected] Abstract—Governments, enterprises and research institutions (3C) [3]. Through the integration of 3C technology, CPS have participated the research and development of cyber- achieves the real-time perception, dynamic control and physical systems (CPS). However, the development of cyber- information services of large-scale engineering systems, physical systems will be restricted by security threats and making systems have characteristics of real-time, secure, vulnerabilities. We summarize security threats and to the cyber- reliable and high-performance. Cyber-physical systems focus physical systems to provide a theoretical reference for research on close integration and coordination of cyber resources and on cyber-physical systems and to provide effective security physical resources, being able to achieve real-time sensing and measures. The architecture of cyber-physical systems is used to dynamic monitoring of large-scale complex systems and broad classify threats in the physical layer, network layer and environments, and to provide more flexible, more intelligent application layer. This paper presents the security threats in the three layers. Then it lists the vulnerabilities of cyber-physical and more efficient network information service. CPS has systems from the three aspects of management and policy, become an important research area of research institutions and platform and network. Correspondingly, it also provides some is a rapidly developing industry field. security measures and recommendations for the security threats This paper introduces the definition of the cyber-physical and vulnerabilities in each section. systems, then sums up the security issues of each layer based on the three-layer CPS architecture, and provides effective Keywords-component; cyber-physical systems; security threats; security measures for each layer. At last, the security outlook vulnerabilities of the cyber-physical systems is provided. On the basis of it, we can further research on theoretical architectures and I. INTRODUCTION methods of CPS risk assessments. Nowadays the development of computer technology and network technology has brought great convenience to people's II. RELATING WORK lives. With the continuous improvement of computer processing capabilities and the rapid development of data A. Definition of Cyber-physical Systems communications technology, demand for computing systems The concept of cyber-physical systems was first proposed and engineering equipments is not limited to the expansion of by the U.S. National Science Foundation (NSF). This concept the function, but is more concerned about the integration of has got the worldwide attention, and is being in-depth studied information systems and physical devices, the rational by scholars from various countries on different levels such as allocation of system resources and optimization of system theoretical methods, system design and running environment. performance. Under the guidance of this demand, the cyber- CPS is the integration of a number of different technologies physical systems (CPS) emerged, and caught close attention of from various disciplines with high complexity. Therefore there governments, enterprises and research institutions. are some differences between the understandings of cyber- CPS is a kind of multi-dimensional complex system physical systems of researchers from different research areas. combined of computing, networking and physical world. And Lee pointed out that the CPS is a system tightly integrated by a it is a space-time multi-dimensional mixed heterogeneous series of components including computing processes and autonomous system, through a highly integrated and physical processes. Cyber systems of CPS monitor the interactive of a series of computational units and physical operation of the physical entities, while the physical entities objects in a network environment to enhance the ability of the achieve the perception and control of the environment using system in terms of information processing, real-time networking and computing components [1]. Baheti indicated communications, remote precision control and independent that cyber-physical systems are highly reliable systems in coordination of components [1-2]. CPS primarily considers the which a wide variety of computing elements and physical performance optimization in the aspect of functionality, and it elements closely integrated and coordinated in dynamic is a kind of intelligent technology which involves computation uncertain events [2-4]. From the perspective of computing technology, communication technology and control technology science, data processing and storage, Sastry pointed out that 978-1-4799-0561-4/13/$31.00 ©2013 IEEE 50 Dalian, China CPS which integrates the capacities of computing, environment states. The physical layer receives data communications and data storage, is a networked computer processing results from the network layer, sent them to the system that can monitor the various entities in the physical actuators in order to adapt to the cyber world and the physical worldˈand is able to operate real-timely, reliably, securely, world changes. stably and efficiently. Branicky and Krogh, from the perspective of embedded systems and device development, pointed out that "Cyber" is the integration of the technologies of computing, communications and control involving physical processes and biological characteristics, and the essence of CPS is a intelligent robot system integrated of reliable computing, communications and control capabilities [6-7]. Ma Wenfang indicated that CPS is a networked physical device system which is trusted, controllable, scalable, and deeply integrated of computing, communication and control capabilities on the basis of environmental perception, achieving real-time interaction through the feedback loop formed by the interaction of cyber processes and the physical processes [8]. Wang Zhongjie pointed out that the CPS is the next generation of intelligent system which emphasize the interaction of "Cyber-physical", and is provided with a high degree of self-perception, self-judgment and self-regulating ability to achieve the interconnection and collaboration of virtual world and physical world [9]. B. Architecture of Cyber-physical Systems Cyber-physical systems typically have three principal Fig 1. Architecture of cyber-physical systems characteristics: 1) Environment Coupling: Cyber-physical systems are 2) Network layer: Network layer is supported by the next very tightly coupled with their physical process and generation of networks for real-time communication and environment. Any changes in the behavior of the cyber- information exchange. The network layer implements data physical systems result in changes in the physical process and transmission and data interaction primarily through the Internet, environment and vice versa. private networks, local area networks, communication networks and other existing networks. Meanwhile the network 2) Diverse Capabilities: CPS is usually composed of layer is provided with the capabilities to process and manage different entities with diverse capabilities. For example, vast amounts of information in the system. sensors deeply embedded in physical processes for monitoring environment have limited capabilities, while the manager 3) Application layer: Application layer is the core part of entities which are in charge of managing the sensors are much cyber-physical systems. The application layer abstracts the more capable. data received from the network layer, produces control commands after the judgment of default rules and high-level 3) Networked: Cyber-physical systems, unlike traditional semantic specifications. Then the control commands are sent to stand-alone embedded systems, usually require a the underlying physical units on the physical layer through the communication channel between its components, either network layer, and executed by the actuators. Application layer embedded within the physical processes or external to it, in also combines the cyber-physical systems and the industry order to provide its (usually coordinated) services [10]. applications to achieve the intelligent application solutions, The architecture of cyber-physical systems is now such as intelligent transportation, smart grid and so on. generally divided into three layers: physical layer, network layer and application layer, shown in Fig. 1. III. SECURITY THREATS OF CYBER-PHYSICAL SYSTEMS The composition, function and performance of each layer A. Threats in physical layer are shown as follows: In the three-layer architecture of cyber-physical systems, 1) Physical layer: Physical layer contains sensors, physical layer is the important source of perception data and actuators, RFID tags, RFID readers, mobile intelligent the execution venue of the control commands. Most network terminals and other physical equipments, primarily responsible nodes of physical layer are deployed in unattended for the perception of physical world data and the execution of environments, and can easily become targets for attackers. And control commands from the system. The physical layer data processing capability, communications capability and interacts with the physical world through embedded sensors storage capacity of the nodes is limited, thus the traditional and actuators distributed in the physical devices, and in charge security mechanisms cannot be applied to the perception of large-scale distributed data acquisition and state network of physical layer directly. The main security threats of identification for data of material properties and the physical layer are listed in Table ĉ. 51  TABLE I. SECURITY THREATS OF PHYSICAL LAYER Security threats Explanations Physical attack Physical attack mainly refers to the physical damage for the nodes. Equipment failure Equipments reduce or lose performance due to external forces, environment or aging. Line fault Line failure is the failure of power lines on the nodes. Electromagnetic leakage By processing electromagnetic signal equipments at work radiated out, attackers can restore the original data. Unwanted electromagnetic signals or commotions make negative impacts on useful signals, resulting in system Electromagnetic interference performance degradation. Denial of Service (DoS) Attacker makes the target system stop providing services through network bandwidth consumption. Channel blocking Data cannot be transmitted for communication channel has been occupied for a long time. Sybil attack Single malicious node has multiple identities, to attack the system by controlling most of the nodes. Replay attack Attacker resends the legitimate data obtained before, to get the trust of the system. Perception data destruction The unauthorized addition, deletion, modification and destruction of perception data. Data intercept Illegal access to the data resources through intercepting the communication channel. Data tampering Attacker intercepts and modifies the data, then sends modified data to the recipient. Unauthorized access Resources are accessed by unauthorized users. Passive attack Attacker passively collects data by sniffing and information collection. Node capture Gateway node or ordinary node is controlled by attackers. TABLE II. SECURITY THREATS OF NETWORK LAYER Security threats Explanations DDoS Plenty of malicious nodes attack target server as the sources of DoS at the same time. Routing attack Attacker interferes with the normal routing process by sending forged routing information. Sink node attack Interrupting data transmission between physical layer and network layer by attacking the sink node. Direction misleading attack Malicious node modifies the source and destination addresses of data packets then sends it to a wrong path, resulting in network routing confusion. Black hole attack Malicious node cheats other nodes to establish routing connections with it, and then discard the packet should be forwarded, causing packet loss. Flooding attack Exhausting the resources of the network servers on network layer by Smurf and DDoS. Trapdoor Allow the exception of security policy when specific data transporting. Sybil attack Malicious node illegally has multiple identities, to obstruct data transmission by controlling most of the nodes. Sinkhole attack Malicious node attracts normal nodes around as a point in the routing path, so that all data will flow through it. Wormhole attack Malicious nodes attack together to get the routing right by the less routing hops between the malicious nodes. Routing loop attack Malicious node modifies the data path to cause an infinite routing loop. HELLO flooding attack Malicious node makes nodes in the network aware that it is their direct neighbor by using strong signal to broadcast routing information. Spoofing attack Malicious node spoofs normal nodes to send data through an inefficient path or to a failure node. Selective forwarding Malicious node deliberately loses some or all of the key information in the forwarding. Tunnel attack Malicious nodes hide the real link distance between them to lure the other nodes to establish routing path through them. False routing information Malicious node attacks network layer network by tampering with the routing information. Security issues of physical layer involve physical security x Strengthen the legislation. Make clear the cost for the of infrastructure of each node, acquisition of perception data illegal behaviors concerning cyber-physical systems. and execution of control commands. Security measures for this layer are expected to ensure the safety of the sensors, actuators, x Research on the technologies of cryptographic [11-12], RFID devices, image capture devices and other equipments. privacy protection [13-17], security routing [18-19], Security of physical layer is the basis of the security of cyber- security data fusion [20-22] and safety positioning [23- physical systems. Principal security measures for physical 24] combining with cyber-physical systems. layer are shown as follows: B. Threats in network layer x Enhance the management and protection of the Network layer of cyber-physical systems utilizes “next- identity of the node. This will extend the node generation network” as its core bearer network. Architecture, certification time to a certain extent. In the practical access methods and network equipment of “next-generation applications administrators can weigh the security and network” will bring a certain amount of security threats for efficiency of the system, to develop a more balanced CPS. The mass nodes and huge amounts of data on network node authentication strategy. layer may cause network congestion, and make the system x To provide better protection of perception data by vulnerable to DoS/DDoS attacks. Data exchange, gateway applying biometric technology and near-field authentication and convergence of security policies between communications technology. heterogeneous networks will also bring new security issues for 52 network layer of cyber-physical systems. Table Ċ lists the privacy data of users as well. Main security measures for principal security threats of network layer. physical layer are shown as follows: Security measures for network layer of cyber-physical x Strengthen access control policy of the system. systems ensure the security of communication data in the system, including data integrity, confidentiality and x Strengthen the authentication mechanism and consistency. Security measures for network layer can take encryption mechanism in different scenarios. advantage of both point-to-point encryption mechanism and x Improve network forensics mechanism to strengthen end-to-end encryption mechanism [25]. the capacity of network forensics [26]. x Point-to-point encryption mechanism ensures the x Establish a centralized, efficient security management security of data in the process of hop-by-hop platform for the various applications of cyber-physical transmission. Since each node in the path can get the systems. plaintext data, this mechanism requires a higher credibility of each node. The security mechanisms IV. VULNERABILITIES OF CYBER-PHYSICAL SYSTEMS include node authentication, hop by hop encryption and authentication of inter-network. For the vulnerabilities of the cyber-physical system, this paper classifies them as management and policy, platform, and x End-to-end encryption mechanism achieves end-to- network. end data confidentiality, and can also provide flexible security policies for different security levels. However, Vulnerabilities listed in this section do not fully reflect the end-to-end encryption mechanism cannot hide the vulnerability of all the CPS, the usual CPS system will include source and destination of the data, and this information the following as part of the vulnerabilities, some individual could be utilized by attackers. The security CPS system may also have specific vulnerabilities which we mechanisms include end-to-end authentication, key do not mentioned. negotiation and key management. A. Vulnerabilities of management and policy C. Threats in application layer Vulnerability is usually introduced through vulnerability. Some applications on application layer collect privacy data For example, policy and implementation guideline (process) is of users, such as the states of health and consumption habits, incomplete, inappropriate, or does not exist. Safety therefore the privacy protection of information on application documentation and management support is the cornerstone of layer must be considered in cyber-physical systems. Since any security plan. Appropriate security policies can reduce the there are a wide range of applications of the system with number of vulnerabilities. The Potential policy Program various security needs, the development of security measures vulnerability is as following. for application layer is enormously challenged. The major x No adequate ICS security policies security threats of application layer are listed in Table ċ. x No formal safety training and recognition programs TABLE III. SECURITY THREATS OF APPLICATION LAYER x No adequate security architecture or design Security threats Explanations x No specific written safety procedures according to ICS Privacy data Leaking of privacy data of users due to the security policy leaking insecurity of data transmission, storage and presentation. x ICS equipment Installation Guide does not exist or is Unauthorized Illegal access to the network and system data. access absent Malicious code Code in the system with no effect but may have x Lack of safety measures to implement management security risks. Forged control Attackers maliciously use the system or damage mechanisms commands the system by forging control commands. x ICS Security Review is absent or does not exist Loophole Attacking the system by using the loopholes in the applications on application layer. x No specific ICS operational continuity or Disaster Viruses, Trojan Viruses and Trojan horses are the generally Recovery Plan (DRP) horses security threats of applications on application layer. x Lack of change management on ICS specific SQL injection SQL injection is a common mean of attack on attack database of the system. configuration B. Vulnerabilities of platform Application layer is the core part of cyber-physical systems In CPS, the vulnerability may be due to defects in the which is responsible for making decisions and providing platform, misconfigured or poorly maintained, including control commands. Huge amounts of data on application layer hardware, operating systems and applications CPS These of cyber-physical systems require strong data processing vulnerabilities can be relieved through a variety of security capability on this layer and the comprehensive protection of controls, such as the operating system and application patching, 53 physical access control, security software (such as antivirus systems design, analyzes the security threats of the three layers software).Table Č shows the vulnerabilities of platform. of cyber-physical systems, and the vulnerabilities in three aspects, then provides the corresponding security measures. C. Vulnerabilities of network The development of cyber-physical systems can bring huge economic development opportunities, and simultaneously it The vulnerabilities in CPS derive from defects, will bring numerous new problems of information security. misconfigurations, CPS network mismanagement or network Therefore the collaboration of academia and industries is connectivity with others. These vulnerabilities can be expected to jointly promote the development of cyber-physical eliminated or reduced through a variety of security controls, systems. such as network design defense, defense in depth, network traffic encryption, network link limit, physical access control on network components and so on. Details are as show in TABLE V. VULNERABILITIES OF NETWORK Table V. Type vulnerability Fragile network security architecture TABLE IV. VULNERABILITIES OF PLATFORM Data flow control is not used Improperly configured security devices Classification vulnerability Network device configuration is not saved or Network platform Operating system and application software patches backuped vulnerability develop is delayed or not maintained the password is not encrypted during transport Platform Using the default configuration Password devices can exist on the network Configuration Important configuration is not saved or backup indefinitely Vulnerability No protection for the data in Portable Devices Insufficient access control applications Lack of adequate password policy Inadequate physical protection to the network Lack of testing on security changes device No physical protection for critical systems unsafe Physical port Network hardware Unauthorized personnel can physically access the Lack of environmental controls vulnerability device Non-essential personnel can access devices and Platform remote access to ICS component network connections hardware dual network interface card Connected to the network Lack of critical network redundancy vulnerability Unregistered assets No defined security perimeter Radio frequency and electromagnetic pulse (EMP) Firewall does not exist or is not configured No standby power Network perimeter properly Lack of environmental controls vulnerabilities Applying control network to non-control link Important component with no redundant Control network service is not within the control Buffer Overflow network Installing security functions can’t be start through the network monitoring Lack of firewalls and routers log default startup and logging ICS network with no security monitoring Improper Handling with the undefined, ill-defined, or vulnerabilities "illegal" conditions not identifying critical monitoring and control unsafe Industry-wide agreement path using plain text using plain text in Standard, archive intact Platform software Running unnecessary services Communication communication protocols communication vulnerability proprietary software discussed in conferences or vulnerability protocols journals Authenticated user data or device is defective or authentication and access control of Inadequate does not exist configuration and programming software integrity checks on Communication is in shortage Intrusion detection and prevention software has not No sufficient certification between The client and network connection been installed the access point vulnerability Logs is not maintained No sufficient data protection between The client Event is not excavated and the access point Malware Protection is not installed Malware protection software of definition of malware ACKNOWLEDGMENTS. Platform malware is not up to date This work is supported by the following programs: the vulnerabilities protection software of Malware software is not tested National Natural Science Foundation of China under Grant in detail No.61170273; Open Project Foundation of Information V. CONCLUSION Technology Research Base of Civil Aviation Administration of China (NO.CAAC-ITRB-201201); 2010 Information Researching on cyber-physical systems requires knowledge Security Program of China National Development and Reform of computer technology, network technology, control Commission with the title “Testing Usability and Security of technology, communications technology, physics, life science, Network Service Software”. sociology and other related fields to improve the theoretical study of cyber-physical systems and to carry out the research on properties of cyber-physical systems such as real-time, REFERENCES security, autonomy and performance. This paper provides an [1] Lee E. “Computing Foundations and Practice for Cyber-Physical overview of the definition of cyber-physical systems, discusses Systems: a Preliminary Report, Technical Report UCB/EECS-2007-72”. USA: University of California, 2007. the security issues should be considered in cyber-physical 54 [2] Baheti R, Gill H. “Cyber-physical systems. IEEE. The Impact of Distributed Computing Systems (ICDCS). Toronto, Canada: IEEE, Control Technology”. Washington D. C., USA: IEEE, 2011: 161-166. 2007: 23. [3] CPS Steering Group. “Cyber-physical systems executive summary”. [16] Kamat P, ZHANG Yanyong, “Trappe W, et al. Enhancing source- (March 6, 2008). http://precise.seas.upenn.edu/events/iccps11/ Location privacy in sensor network routing”. Proceedings of the 25th doc/CPS-Executive-Summary.pdf. IEEE International Conference on Distributed Computing Systems [4] Lin J, Sedigh S, Miller A. “A general framework for quantitative (ICDCS). Washington DC, USA: IEEE, 2005: 599-608. modeling of dependability in cyber-physical systems: a proposal for [17] Ganesan P, Venugopalan R, Peddabachagari P, et al.” Analyzing and doctoral research”. Proceedings of the 33rd Annual IEEE International modeling encryption overhead for sensor encryption overhead for Computer Software and Applications Conference. Seattle, USA: IEEE, sensor network nodes”. Proceedings of the 2nd ACM International 2009: 668-671. Conference on Wireless Sensor Networks and Applications. New York, [5] Sastry S S. “Networked embedded systems: from sensor websto cyber- USA: Association for Computing Machinery, 2003: 151-159. physical systems”. Proceedings of the 10th International Conference on [18] Nasser N, CHEN Yunfeng. “Secure multipath routing protocol for Hybrid Systems: Computation and Control. Berlin, Germany: Springer, wireless sensor networks”. Proceedings of the 27th International 2007: 1-1. Conference on Distributed Computing Systems Workshops. Toronto, [6] Branicky M. “CPS initiative overview”. Proceedings of the IEEE/RSJ Canada: IEEE, 2007: 12. International Conference on Robotics and Cyber-Physical Systems. [19] ZHANG Kun, WANG Cong, WANG Cuirong. “A secure routing Washington D. C., USA: IEEE, 2008. protocol for cluster-based wireless sensor networks using group key [7] Krogh B, Ilic M D, Sastry S S. “Networked Embedded Control for management”. Proceedings of the 4th International Conference on Cyber-Physical Systems: Research Strategies and Roadmap, Technical Wireless Communications, Networking and Mobile Computing Report”. USA: Team for Research in Ubiquitous Secure Technology, (WiCOM 08). Dalian, China: IEEE, 2008: 12-14. 2007. [20] SUN Bo, JIN Xing, WU Kui, et al. “Integration of secure in network [8] MA Wenfang. “CPS: sensor-net to sensor-acuator-net”. China aggregation and system monitoring for wireless sensor networks”. Information World, 2010, 25. Proceedings of IEEE International Conference on Communications (IEEE ICC 07). Politecnico di Milano, Italy: IEEE, 2007: 1466-1471. [9] WANG Zhongjie, XIE Lulu. “Cyber-physical Systems: A Survey. ACTA AUTOMATICA SINICA”, 2011, 37(10): 1157-1166. [21] ZHANG Wei, LIU Yonghe, Das S K, et al. “Secure data aggregation in wireless sensor networks: A watermark based authentication supportive [10] E. A. Lee. “Cyber physical systems: Design challenges. In International approach”. Pervasive Mobile Computing, 2008, 4(5): 658-680. Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing (ISORC)”, May 2008. Invited Paper. [22] Ferrer J D. “A provably secure additive and multiplicative privacy homomorphism”. Proceedings of the 5th International Conference on [11] Eschenauer L, Gligor V. “A key-management scheme for distributed Information Security. London, U K: Springer, 2002: 471-483. sensor networks. Proceedings of the 9th ACM Conference on Computer and Communications Security”. New York, USA: Association for [23] Chang C-C G, Snyder W E, Wang C. “A new relaxation labeling Computing Machinery, 2002: 41-47. architecture for secure localization in sensor networks”. Proceedings of the Communications (ICC 07). Glasgow, Scotland: IEEE, 2007: 3076- [12] ZHANG Wensheng, “Tran M. A random perturbation-based scheme for 3081. pairwise key establishment in sensor networks”. Proceedings of the 8th ACM International Symposium on Mobile ad Hoc Networking and [24] ZHONG Sheng, Jadliwala M, Upadhyaya S, et al. “Towards a theory of Computing. New York, USA: Association for Computing Machinery, robust localization against malicious beacon nodes”. Proceedings of the 2007: 90 - 99. 27th Conference on Computer Communications. Phoenix, USA: IEEE, 2008: 1391-1399. [13] HE Wenbo, LIU Xue, Nguyen H, et al. “PDA: Privacy preserving data aggregation in wireless sensor networks”. Proceedings of the 26th IEEE [25] TANG Huang, TAN Feng, SONG Bin, et al. “Cyber-Physical System International Conference on Computer Communications. Anchorage, Security Studies and Research”. Proceedings of the International USA: IEEE, 2007: 2045-2053. Conference on Multimedia Technology (ICMT 2011). 2011: 4883-4886. [14] ZHANG Wensheng, WANG Chuan, FENG Taiming. “GP2S: Generic [26] YANG Guang, GENG Guining, DU Jing, et al. “Security threats privacy-preservation solutions for approximate aggregation of sensor andmeasures for the Internet of Things”. J Tsinghua Univ (Sci and data (concise contribution)”. Proceedings of the 6th Annual IEEE Tech), 2011, 51(10): 1335-1340. Communications (PerCom). Hong Kong, China: IEEE, 2008: 179-184. [15] Kamat P, XU Wenyuan, “Trappe W, et al. Temporal privacy in wireless sensor networks”. Proceedings of the 27th International Conference on 55