CSC5930/9010: Security and Privacy in Cyber-physical Systems

Lecture 1: Introduction to CPS/IoT

Slide 2

What are “Cyber- Physical Systems”?

• Cyber – computation, communication, and control that are discrete, logical, and switched

• Physical – natural and human-made systems governed by the laws of physics and operating in continuous time

• Cyber-Physical Systems – systems in which the cyber and physical systems are tightly integrated at all scales and levels.

Slide 3

What are “Cyber- Physical Systems”?• Cyber-physical systems (CPSs) are physical and engineered systems

whose operations are monitored, coordinated, controlled and integrated by a computing and communication core.

• By merging computing and communication with physical processes, CPS brings many benefits: – Safer and more efficient systems – Reduce the cost of building and operating systems– Build complex systems that provide new capabilities

Slide 4

What are “Cyber- Physical Systems”?

• Technological and Economic Drivers – The decreasing cost of computation, networking, and sensing – Computers and communication are ubiquitous, enables national or global scale

CPSs – Social and economic forces require more efficient use of national

infrastructure.

Slide 5

Characteristics of Cyber-physical Systems• Some defining characteristics:

– Cyber – physical coupling driven by new demands and applications •Cyber capability in every physical component •Large scale wired and wireless networking •Networked at multiple and extreme scales

– Systems of systems •New spatial-temporal constraints •Complex at multiple temporal and spatial scales •Dynamically reorganizing/reconfiguring •Unconventional computational and physical substrates (Bio? Nano?)

Slide 6

Characteristics of Cyber-physical Systems (cont’d)

– Novel interactions between communications/computing/control •High degrees of automation, control loops must close at all scales •Large numbers of non-technical savvy users in the control loop

– Ubiquity drives unprecedented security and privacy needs – Operation must be dependable, certified in some cases

Slide 7

Characteristics of Cyber-physical Systems

• What they are not: – Not desktop computing – Not traditional, post-hoc embedded/real-time systems – Not today’s sensor nets

Slide 8

CPS adoption’s increasing…

• CPS offers immense benefit– Healthcare, home, vehicle

automation, industrial logistics etc.

Slide 9

The rise of CPS devices

Slide 10

Which gives rise to Internet of Things…

• Internet of Things and Moore’s Law– Based on Moore’s Law, the transistors in a dense integrated circuit doubles

every two years– This has given rise to affordable, more powerful, and highly computational

devices aka “Things”.

Slide 11

The rise of connected heterogeneous devices…

Source: CISCO

Slide 12

Heterogeneous device connectivity

• Today, we see “smart” non-traditional devices being connected to the internet.– Some home appliances such as toasters, washing machines, lightbulbs now are

internet connected• Heterogeneous devices communicate with each other as well.

– Alexa controls home appliances such as switching on a toaster, controlling the thermostat

Slide 13

What are Internet of Things?

• Heterogeneous device a.k.a “Things” with sensing and actuating capabilities connected via a shared network.– Network is not limited to the internet.

• Characteristics:– Interconnectivity– Heterogeneity– Dynamic Changes– Scalability

Slide 14

IoT Scenario

Motion sensorMotion sensor

Motion sensor

ECG sensor

Internet

Slide 15

IoT Architecture

Cloud Layer

Gateway Layer

Device Layer

Sensor-Actuator Layer

Incr

easi

ng r

esou

rce

cons

train

t

Slide 16

IoT Architecture

Cloud Layer

Gateway Layer

Device Layer

Sensor-Actuator Layer

Incr

easi

ng r

esou

rce

cons

train

t

Edge devices consists of a combination of the Device layer and Sensor- Actuator Layer

Fog devices consists of a Devices contained in the gateway layer.

Slide 17

IoT Architecture

• Cloud Layer:– Consists of Servers and Cloud-based infrastructures

• Gateway Layer:– Consists of devices which acts as an intermediary between the cloud and

Device layer (e.g network gateway devices, desktop servers). • Device Layer:

– Also known as “Things”.– Consists of devices with mostly constrained memory capabilities (e.g

smartphones)• Sensor and Actuator Layer:

– Performs actions such as sensing data from the environment.– Actuator acts on data sensed

Slide 18

Fog/Edge Devices

• Fog Devices:– Devices with closer proximity to end user devices– Larger storage/computational abilities than edge devices (e.g device gateways,

routers)

• Edge Devices– End user devices– Constrained memory (e.g smart watches, tvs, phones)

Slide 19

Overview: Hardware Platform

The Internet

Network

“Thing”

Sensors & Actuators

Communications

User/Environment

Servers

2 sensorsIEEE 802.15.4

2.4GHz RF System

XM1000

Device level

Network level

The Internet

Gateway

Slide 20

• Sensors:– They are mainly input components– They sense and collect surrounding information– Basically three types:

•Passive, omnidirectional (e.g. mic)•Passive, narrow-beam sensor (e.g. PIR)•Active sensors (e.g. sonar, radar, etc.)

• Actuators:– They are mainly output components– They alter the surrounding. Some examples:

•Adding lighting, heat, sound, etc.•Controlling motors to move objects•Displaying messages

Sensors & Actuators

20

Slide 21

• We can turn almost every object into a “thing”.• A “thing” still looks much like an embedded system currently.• A “thing” generally consists of four main parts:

– Sensors & actuators– Microcontroller– Communication unit– Power supply

• A “thing” has the following properties:– It’s usually powered by battery. This implies limited source of energy.– It’s generally small in size and low in cost. This limits their computing

capability.– It doesn’t usually perform complicated tasks.

• Power consumption is the main design issue.

Things

Slide 22

• A “thing” always feature communications for connecting to other devices.

• The Role of Communications– Providing a data link between two nodes

• Communication type:– Wired (e.g. copper wires, optical fibers) – Wireless (e.g. Radio Frequency , Infrared).

• Popular RF-based communication solutions:– IEEE 802.15.4 – IEEE 802.11 (or Wifi)– Bluetooth– Near Field Communication (NFC), e.g. RFID

Communications

Slide 23

• The Roles of Networks– Managing nodes (discovery, join, leave, etc).– Relaying data packets from the source to the destination node in the network.

• Networks are a distributed system. All nodes need to perform networking related tasks.

• RF-based Network in IoT is usually a Wireless Multi-hop Network. Some examples:– Wireless Sensor Networks (WSNs)– Mobile Wireless Ad hoc Networks (MANETs)– Wireless Mesh Networks (WMNs)– Vehicular Ad Hoc Networks (VANETs)– and others...

• Main concern: Reliability & Performance

Networks

Slide 24

• The Internet serves as a wide area networking for a local network.• The Internet uses TCP/IP. This implies that things must also support

TCP/IP.• Gateway (or sink)

– For a practical deployment, a gateway is often needed in a network.– It offers relaying packets between the network and the Internet.

The Internet

24

The Internet

GatewayData link

Network

Slide 25

Looming problem is insecurity

• Data Breaches– CPS: large-scale, long-term, distributed data– Attacker: Sell or hoard personal information

• Malware– CPS: Tight time horizons and UX focused– Attackers: Excess time and broad attack surfaces

Slide 26

Security flaw example: Jeep Remote Hijack

Source: https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

• Hacked via entertainment system.

Slide 27Source: www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project

Top Ten Device Vulnerabilities1 Insecure Web Interface2 Insufficient Authentication/Authorization3 Insecure Network Services4 Lack of Transport Encryption5 Privacy Concerns (Data Collection)6 Insecure Cloud Interface7 Insecure Mobile Interface8 Insufficient Security Configuration9 Insecure Software/Firmware Updates

10 Poor Physical Security

Looming problem is device insecurity

Trusting device end-

points is hard

Slide 28

References• Kang G Shin “Lecture Note #2 EECS 571 Cyber-Physical Systems”

[PowerPoint Slides]. Retrieved from https://www.eecs.umich.edu/courses/eecs571/lectures/lecture2-intro-of-CPS.pdf

• Tameer Nadeem “Cyber Physical Systems Seminar” [PowerPoint Slides]. Retrieved from https://www.cs.odu.edu/~nadeem/classes/cs795-CPS-S13/material/Lec-01_Course-Introduction.pdf

• NIST “Framework for Cyber-Physical Systems” https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1500-201.pdf