Measurable and Composable Security, Privacy, and Dependability for Cyberphysical Systems: The SHIELD Methodology

479 Pages·2017·25.77 MB·English

by  Andrea Fiaschetti, Josef Noll, Paolo Azzoni, Roberto Uribeetxeberria

Measurable and
Composable
Security, Privacy, and
Dependability for
Cyberphysical Systems
The SHIELD Methodology

Measurable and
Composable
Security, Privacy, and
Dependability for
Cyberphysical Systems
The SHIELD Methodology
Edited by
Andrea Fiaschetti, Josef Noll,
Paolo Azzoni, and
Roberto Uribeetxeberria
MATLAB® and Simulink® are trademarks of the MathWorks, Inc. and are used with permission. The
MathWorks does not warrant the accuracy of the text or exercises in this book. This book’s use or
discussion of MATLAB® and Simulink® software or related products does not constitute endorse-
ment or sponsorship by the MathWorks of a particular pedagogical approach or particular use of the
MATLAB® and Simulink® software.
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2018 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed on acid-free paper
International Standard Book Number-13: 978-1-138-04275-9 (Hardback)
This book contains information obtained from authentic and highly regarded sources. Reasonable
efforts have been made to publish reliable data and information, but the author and publisher cannot
assume responsibility for the validity of all materials or the consequences of their use. The authors
and publishers have attempted to trace the copyright holders of all material reproduced in this
publication and apologize to copyright holders if permission to publish in this form has not been
obtained. If any copyright material has not been acknowledged please write and let us know so we
may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known
or hereafter invented, including photocopying, microfilming, and recording, or in any information
storage or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copy-
right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222
Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro-
vides licenses and registration for a variety of users. For organizations that have been granted a
photocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and
are used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Foreword ...............................................................................................................vii
Preface ......................................................................................................................xi
Editors .....................................................................................................................xv
Contributors .........................................................................................................xix
1. Introduction .....................................................................................................1
Andrea Fiaschetti, Josef Noll, Paolo Azzoni, and Roberto Uribeetxeberria
Section I SHIELD Technologies and Methodology
for Security, Privacy, and Dependability
2. Security, Privacy, and Dependability Concepts .....................................17
Andrea Fiaschetti, Paolo Azzoni, Josef Noll, Roberto Uribeetxeberria, John
Gialelis, Kyriakos Stefanidis, Dimitrios Serpanos, and Andreas Papalambrou
3. Security, Privacy, and Dependability Technologies ..............................29
Paolo Azzoni, Luca Geretti, Antonio Abramo, Kyriakos Stefanidis, John
Gialelis, Andreas Papalambrou, Dimitrios Serpanos, Konstantinos Rantos,
Andrea Toma, Nawaz Tassadaq, Kresimir Dabcevic, Carlo Regazzoni,
Lucio Marcenaro, Massimo Traversone, Marco Cesena, and Silvano Mignanti
4. The SHIELD Approach .............................................................................105
Andrea Fiaschetti, Paolo Azzoni, Josef Noll, Roberto Uribeetxeberria,
Antonio Pietrabissa, Francesco Delli Priscoli, Vincenzo Suraci, Silvano
Mignanti, Francesco Liberati, Martina Panfili, Alessandro Di Giorgio,
and Andrea Morgagni
5. Security, Privacy, and Dependability Metrics ......................................159
Andrea Morgagni, Andrea Fiaschetti, Josef Noll, Ignacio Arenaza-Nuño,
and Javier Del Ser
Section II SHIELD Application Scenarios,
New Domains, and Perspectives
6. Airborne Domain .......................................................................................195
Cecilia Coveri, Massimo Traversone, Marina Silvia Guzzetti, and Paolo
Azzoni
v
vi Contents
7. Railway Domain .........................................................................................243
Paolo Azzoni, Francesco Rogo, and Andrea Fiaschetti
8. Biometric Security Domain ......................................................................283
Paolo Azzoni, Konstantinos Rantos, Luca Geretti, Antonio Abramo, and
Stefano Gosetti
9. Perspectives in Secure SMART Environments ....................................337
Josef Noll, Iñaki Garitano, Christian Johansen, Javier Del Ser, and
Ignacio Arenaza-Nuño
10. SHIELD Technology Demonstrators ......................................................359
Marco Cesena, Carlo Regazzoni, Lucio Marcenaro, Andrea Toma,
Nawaz Tassadaq, Kresimir Dabcevic, George Hatzivasilis, Konstantinos
Fysarakis, Charalampos Manifavas, Ioannis Papaefstathiou, Paolo
Azzoni, and Kyriakos Stefanidis
11. Applying SHIELD in New Domains ......................................................413
Paolo Azzoni, Francesco Rogo, Cecilia Coveri, Marco Steger, Werner
Rom, Andrea Fiaschetti, Francesco Liberati, and Josef Noll
Index .....................................................................................................................449
Foreword
The Internet of Things (IoT), cyber-physical systems (CPSs), Industry 4.0,
Swarm Systems, and the Human Intranet are all based on similar principles:
interaction between the physical world and cyberspace, and the massive
use of distributed, wireless devices, machine to machine, and machine to
humans. They are all safety critical, heterogeneous, and of a scale never seen
before. The technical hurdles to overcome are many, but possibly the most
serious challenge to the vision of the instrumented world is security. We
need to guarantee protection from intrusion or unauthorized access so that
we can help prevent an adversary from affecting safety and bringing a level
of chaos to human society of unimaginable consequences as the following
examples show.
On October 21, 2016, the domain name service provider Dyn suffered a
distributed denial of service (DDoS) attack leading to a significant collapse
of fundamental infrastructures comprising the Internet. In a DDoS attack,
a number of compromised or zombie computers, forming a botnet, send a
flood of traffic to the target server, causing a denial of service by exhausting
computation and/or communication resources. The relevance of this attack
for our arguments is the fact that many of the compromised computers
launching the attack were relatively small devices including printers, web-
cams, residential gateways, and baby monitors, that is, the IoT.
On February 23, 2017, many of Google’s smart gateway (router) devices
called OnHub failed for about 45 minutes mainly because of the failure of
the connection of the devices to the cloud, making it impossible to authen-
ticate them on Google’s servers. This led to Internet connection problems to
major websites including Twitter, Netflix, Spotify, and the Financial Times.
The lesson learned in the Google OnHub case is that depending on remote
cloud servers for authentication and authorization may be a liability.
The first known example of an attack on a physical plant was a uranium
enrichment plant in Iran whose centrifuges were monitored and controlled
with Siemens process control systems (PCS). This attack was perpetrated
via a worm named Stuxnet. Stuxnet consisted of two parts: one part of the
program was designed to lie dormant for long periods, then speed up the
centrifuges so that the spinning rotors in the centrifuges wobbled and then
destroyed themselves. The other part sent out false sensor signals to make
the system believe everything was running smoothly. This part prevented a
safety system from kicking in, which would have shut down the plant before
it could self-destruct. This attack did not use the Internet to spread the worm
inside the plant since the plant was physically isolated. The point of entry
was memory sticks containing apparently innocuous data that were read
inside the plant perimeter by unaware workers.
vii
viii Foreword
In 2010, an important study by the University of California, San Diego, and
the University of Washington outlined the many points of attack in the elec-
tronic control system of automobiles. Examples of hijacked cars abound on
YouTube. Intruders could create havoc in transportation systems (trains and
ships are as amenable to intrusion), yielding catastrophic events that may
jeopardize the lives of many people.
On December 23, 2015, a cyberattack on the Ukrainian power grid
demonstrated another instance of the gravity of security issues in networks
of things. The attackers gained control over the supervisory control and
data acquisition (SCADA) system of the Ukrainian power grid and caused a
blackout for several hours across a large area of Ukraine’s Ivano-Frankivsk
region populated by 1.4 million residents.
These last three cases show that, unlike cyberattacks in the past, the conse-
quences from attacks on the IoT could be much more devastating than infor-
mation theft or financial loss.
The safety and security characteristics of a CPS and the IoT are quite dif-
ferent from those of “standard” Internet applications. Indeed, in the CPS
community, it is widely agreed that the main challenges to the security of a
CPS/IoT include heterogeneity, scarce computing and power resources, scalability
and operation in open environments.
It is impractical to adopt security measures that are successfully used in
the Internet such as transport layer security/secure sockets layer (SSL/TLS),
and in the wireless sensor network (WSN) and the mobile ad hoc network
(MANET) due to their heavy computational burden. For sensor networks,
for example, performance is not at a premium as in mobile payment applica-
tions, but being able to connect thousands, if not millions, of devices and to
keep them “alive” for a long time is (this is related to the scarce computing
and power resources issue).
Many expect that there will be tens of billions of connected devices by
2020, far exceeding the world population, and billions of terabytes (1012
bytes) of Internet Protocol (IP) traffic, a significant portion of which will be
generated by the instrumented world. Hence, the security solution must scale
accordingly; in particular, the overhead of adding and removing devices to/
from the security solution should be minimal.
In CPSs and the IoT, the lifetime and availability of the devices and of their
interconnections are as important as data security, if not more. For some sen-
sors such as environment data, privacy is of no interest, in others such as
medical data it is of paramount importance. This heterogeneity requires dif-
ferent privacy and security mechanisms for the same network while tradi-
tional security mechanisms are valid for homogeneous networks.
CPSs and the IoT must support safety-critical components in open, untrusted,
and even hostile environments. Due to their open nature, CPS and IoT networks
are susceptible to entirely new classes of attacks, which may include illegiti-
mate access through mediums other than traditional networks (e.g., physical
access, Bluetooth, and radios). For instance, an attack on a traffic controller
Foreword ix
on the streets of Ann Arbor, Michigan, including the manipulation of actual
traffic lights was demonstrated; this attack was made possible via direct
radio communication with the traffic controller. Jamming attacks on wire-
less communication channels can also be a threat to the availability of the IoT
operating over wireless networks.
To the best of my knowledge, integrated security solutions for CPS/IoT
have not been widely accepted; only a few have carried out research on the
topic. This book is an important step to fill this gap in research: it presents
a methodology, called SHIELD, and an innovative, modular, composable,
expandable, and highly dependable architectural framework conceived
and designed with this methodology. This framework allows to achieve the
desired security, privacy, and dependability (SPD) level in the context of
integrated and interoperating heterogeneous services, applications, systems,
and devices in a CPS framework.
Alberto Sangiovanni Vincentelli
The Edgar L. and Harold H. Buttner Chair
Department of EECS, University of California, Berkeley