skip to main content
Explore Scholarly Publications and Datasets in the NSF-PAR

Title: PAtt: Physics-based Attestation of Control Systems
Ensuring the integrity of embedded programmable logic controllers (PLCs) is critical for safe operation of industrial control systems. In particular, a cyber-attack could manipulate control logic running on the PLCs to bring the process of safety-critical application into unsafe states. Unfortunately, PLCs are typically not equipped with hardware support that allows the use of techniques such as remote attestation to verify the integrity of the logic code. In addition, so far remote attestation is not able to verify the integrity of the physical process controlled by the PLC. In this work, we present PAtt, a system that combines remote software attestation with control process validation. PAtt leverages operation permutations—subtle changes in the operation sequences based on integrity measurements—which do not affect the physical process but yield unique traces of sensor readings during execution. By encoding integrity measurements of the PLC’s memory state (software and data) into its control operation, our system allows to remotely verify the integrity of the control logic based on the resulting sensor traces. We implement the proposed system on a real PLC controlling a robot arm, and demonstrate its feasibility. Our implementation enables the detection of attackers that manipulate the PLC logic to change process state and/or more » report spoofed sensor readings (with an accuracy of 97% against tested attacks). « less
Authors:
; ; ; ; ; ; ;
Award ID(s):
1705135
Publication Date:
NSF-PAR ID:
10211575
Journal Name:
22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019)
Sponsoring Org:
National Science Foundation
More Like this
  1. ; ; ; ; ; ; ; ; ; ; et al ( , IEEE security & privacy)
    Abstract—Safety violations in programmable logic controllers (PLCs), caused either by faults or attacks, have recently garnered significant attention. However, prior efforts at PLC code vetting suffer from many drawbacks. Static analyses and verification cause significant false positives and cannot reveal specific runtime contexts. Dynamic analyses and symbolic execution, on the other hand, fail due to their inability to handle real-world PLC pro- grams that are event-driven and timing sensitive. In this paper, we propose VETPLC, a temporal context-aware, program analysis- based approach to produce timed event sequences that can be used for automatic safety vetting. To this end, we (a)more »perform static program analysis to create timed event causality graphs in order to understand causal relations among events in PLC code and (b) mine temporal invariants from data traces collected in Industrial Control System (ICS) testbeds to quantitatively gauge temporal dependencies that are constrained by machine operations. Our VETPLC prototype has been implemented in 15K lines of code. We evaluate it on 10 real-world scenarios from two different ICS settings. Our experiments show that VETPLC outperforms state-of-the-art techniques and can generate event sequences that can be used to automatically detect hidden safety violations.« less
  2. ; ; ; ; ; ; ; ; ; ; et al ( , IEEE Symposium on Security and Privacy (SP))
    Safety violations in programmable logic controllers (PLCs), caused either by faults or attacks, have recently garnered significant attention. However, prior efforts at PLC code vetting suffer from many drawbacks. Static analyses and verification cause significant false positives and cannot reveal specific runtime contexts. Dynamic analyses and symbolic execution, on the other hand, fail due to their inability to handle real-world PLC programs that are event-driven and timing sensitive. In this paper, we propose VetPLC, a temporal context-aware, program analysis-based approach to produce timed event sequences that can be used for automatic safety vetting. To this end, we (a) perform staticmore »program analysis to create timed event causality graphs in order to understand causal relations among events in PLC code and (b) mine temporal invariants from data traces collected in Industrial Control System (ICS) testbeds to quantitatively gauge temporal dependencies that are constrained by machine operations. Our VetPLC prototype has been implemented in 15K lines of code. We evaluate it on 10 real-world scenarios from two different ICS settings. Our experiments show that VetPLC outperforms state-of-the-art techniques and can generate event sequences that can be used to automatically detect hidden safety violations.« less
  3. ; ; ; ( , Conference on Game Theory and Decision Theory for Security)
    Internet of Things (IoT) devices and applications can have significant vulnerabilities, which may be exploited by adversaries to cause considerable harm. An important approach for mitigating this threat is remote attestation, which enables the defender to remotely verify the integrity of devices and their software. There are a number of approaches for remote attestation, and each has its unique advantages and disadvantages in terms of detection accuracy and computational cost. Further, an attestation method may be applied in multiple ways, such as various lev- els of software coverage. Therefore, to minimize both security risks and computational overhead, defenders need tomore »decide strategically which attestation methods to apply and how to apply them, depending on the characteristic of the devices and the potential losses. To answer these questions, we first develop a testbed for remote attestation of IoT devices, which enables us to measure the detection accuracy and performance overhead of various attestation methods. Our testbed integrates two example IoT applications, memory-checksum based attestation, and a variety of software vulnerabilities that allow adversaries to inject arbitrary code into running applications. Second, we model the problem of finding an optimal strategy for applying remote attestation as a Stackelberg security game between a defender and an adversary. We characterize the defender’s optimal attestation strategy in a variety of special cases. Finally, building on experimental results from our testbed, we evaluate our model and show that optimal strategic attestation can lead to significantly lower losses than naive baseline strategies.« less
  4. ; ; ( , NSF-ATE National Conference)
    A low-cost remote supervisory control capability is added to a packaging process, in which a low-voltage signal is used to communicate between a distant HMI control panel and a PLC network using the AC power line as a communication medium. The network is a star-topology and uses a Mater-slave protocol. Remote Supervisory control is achieved using a user-defined toolbox of control functions. In this system, a Programmable Logic Controller (PLC) is used to control a process and interface with the operator through a Human Machine Interface (HMI) Panel. A star topology ethernet network is used to connect the PLCs andmore »the HMI panel.« less
  5. ; ; ; ; ; ; ( , 2019 SoutheastCon)
    In this paper we demonstrate two applications of a low-cost remote supervisory control and data acquisition system in two models. The first model is demonstrated with a Profibus-DP protocol based system in which a master Programmable Logic Controller (PLC) unit with control inputs and display outputs controls the speed and monitors the overload condition of a DC motor that is connected to a slave PLC in real time. In the upgraded model, a Profinet protocol is used to connect PLCs, and a power-line communication link is used to remotely connect the control HMI to the network. In both models, remotemore »Supervisory control is achieved using user-defined control functions that act altogether as a block-oriented function library or toolbox. High levels of performance are achieved in real time control and data acquisition in both models.« less
  • Citation Formats
  • MLA
  • APA
  • Chicago
  • BibTeX
  • Save / Share this Record
  • Send to Email