More Like this

1. The Ohio State Model For ICS Cybersecurity

   https://doi.org/10.1109/ICMIAM54662.2021.9715206  

   Allen, Theodore T.; McCarty, John; Feng, Tu; Tseng, Shih-Hsien; Buck, Vimal; Pardee, Robert (July 2021, 2021 International Conference on Maintenance and Intelligent Asset Management (ICMIAM))

   We propose a simple framework for Industrial Control System (ICS) system cybersecurity. The proposed system is based on considerations which include known vulnerabilities, safety issues, and the centrality of assets in hypothetical attack vectors. We relate the proposed system to the Purdue Model and two optimization formulations from the literature. We also relate our point system to the results of a recent penetration testing exercise on a manufacturing robotic cell. Finally, we discuss multiple challenges including that posed by legacy equipment and threats to manufacturing uptime. 

   more » « less
2. Protect the System Call, Protect (Most of) the World with BASTION

   https://doi.org/10.1145/3582016.3582066  

   Jelesnianski, Christopher; Ismail, Mohannad; Jang, Yeongjin; Williams, Dan; Min, Changwoo (March 2023, Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems)

   Tor M. Aamodt; Natalie D. Enright Jerger; Michael M. Swift (Ed.)

   System calls are a critical building block in many serious security attacks, such as control-flow hijacking and privilege escalation attacks. Security-sensitive system calls (e.g., execve, mprotect), especially play a major role in completing attacks. Yet, few defense efforts focus to ensure their legitimate usage, allowing attackers to maliciously leverage system calls in attacks. In this paper, we propose a novel System Call Integrity, which enforces the correct use of system calls throughout runtime. We propose three new contexts enforcing (1) which system call is called and how it is invoked (Call Type), (2) how a system call is reached (Control Flow), and (3) that arguments are not corrupted (Argument Integrity). Our defense mechanism thwarts attacks by breaking the critical building block in their attack chains. We implement Bastion, as a compiler and runtime monitor system, to demonstrate the efficacy of the three system call contexts. Our security case study shows that Bastion can effectively stop all the attacks including real-world exploits and recent advanced attack strategies. Deploying Bastion on three popular system call-intensive programs, NGINX, SQLite, and vsFTPd, we show Bastion is secure and practical, demonstrating overhead of 0.60%, 2.01%, and 1.65%, respectively 

   more » « less
3. The Cost on System Performance of Requirements on Differentiable Variables

   https://doi.org/10.1115/1.4049336  

   Hazelrigg, George A.; Stolfi, Philip (May 2021, Journal of Mechanical Design)

   Abstract System design is commonly thought of as a process of maximizing a design objective subject to constraints, among which are the system requirements. Given system-level requirements, a convenient management approach is to disaggregate the system into subsystems and to “flowdown” the system-level requirements to the subsystem or lower levels. We note, however, that requirements truly are constraints, and they typically impose a penalty on system performance. Furthermore, disaggregation of the system-level requirements into the flowdown requirements creates added sets of constraints, all of which have the potential to impose further penalties on overall system performance. This is a highly undesirable effect of an otherwise beneficial system design management process. This article derives conditions that may be imposed on the flowdown requirements to assure that they do not penalize overall system performance beyond the system-level requirement. 

   more » « less
4. Combining Dependency, Grades, and Adjoint Logic

   https://doi.org/10.1145/3609027.3609408  

   Hanukaev, Peter; Eades III, Harley (August 2023, ACM)

   We propose two new dependent type systems. The first, is a dependent graded/linear type system where a graded dependent type system is connected via modal operators to a linear type system in the style of Linear/Non-linear logic. We then generalize this system to support many graded systems connected by many modal operators through the introduction of modes from Adjoint Logic. Finally, we prove several meta-theoretic properties of these two systems including graded substitution. 

   more » « less
5. Blockchain Ensured Physical Visitor Access Control and Authentication

   Stock, Frederick; Hearst, Jarel; Kurt-Peker Yesem (October 2022, REUNS 2022: The 8th National Workshop for REU Research in Networking and Systems)

   In this study we explore the use of blockchain with IoT devices to provide visitor authentication and access control in a physical environment. We propose a “bracelet” using a NodeMCU that transmits visitor location information and cannot be removed without alerting a management system. Our results show that the proposed system has noticeable improvements over a similar system proposed last year, increasing the practicality of implementing such a system. 

   more » « less