Cyber-physical systems are characterized by an IT infrastructure controlling effects in the physical world. Attacks are intentional actions trying to cause undesired physical effects. When process data originating in the physical world is manipulated before being handed to the IT infrastructure, the data security property called "veracity" or trustworthiness will be violated. There is no canonical IT security solution guaranteeing that the inputs from a sensor faithfully represent reality. However, the laws of physics may help the defender to detect impossible or implausible sensor readings.

Increasing awareness of ICS security issues has brought about a growing body of work in this area, including pioneering contributions based on realistic control system logs and network traces. This paper surveys the state of the art in ICS security research, including efforts of industrial researchers, highlighting the most interesting works. Research efforts are grouped into divergent areas, where we add “secure control” as a new category to capture security goals specific to control systems that differ from security goals in traditional IT systems.

Increasing awareness of ICS security issues has brought about a growing body of work in this area, including pioneering contributions based on realistic control system logs and network traces. This paper surveys the state of the art in ICS security research, including efforts of industrial researchers, highlighting the most interesting works. Research efforts are grouped into divergent areas, where we add “secure control” as a new category to capture security goals specific to control systems that differ from security goals in traditional IT systems.

This paper discusses the protocol used for electing the Doge of Venice between 1268 and the end of the Republic in 1797. We show that it has some useful properties that in addition to being interesting in themselves, also suggest that its fundamental design principle is worth investigating for application to leader election protocols in computer science. For example, it gives some opportunities to minorities while ensuring that more popular candidates are more likely to win, and offers some resistance to corruption of voters. The most obvious feature of this protocol is that it is complicated and would have taken a long time to carry out. We also advance a hypothesis as to why it is so complicated, and describe a simplified protocol with very similar properties.

Correspondence properties capture authentication only indirectly. We trace the origin of correspondence in the analysis of authentication protocols and investigate to what extent correspondence actually corresponds to the various flavors of authentication.

A proposed multiplier for finite fields given by equally spaced polynomials is based on the transformation from the polynomial basis to its dual basis, combined with multiplication by a constant. We classify the constants that are optimal regarding the cost of this operation and investigate the cost of the inverse transformation.

This paper discusses the difficulties of describing an appropriate notion of the security attributes "caller" and "target" in object-oriented middleware systems such as CORBA. Middleware security needs such security attributes in order to be able to express middleware layer security policies. Our analysis points out that, whilst there is no information available on the ORB layer to describe the caller and target, it is possible in practice to use descriptors from other layers. In CORBA security, the mechanism-specific identifiers on the caller side and the information from the object reference on the target side turn out to be most appropriate and trustworthy for describing caller and target application objects at the right granularity. As a proof of concept we mention our MICOSec CORBA security implementation which demonstrates the feasibility of our approach. Our paper shows that it is unrealistic to expect a security service layer to be able to abstract fully from the underlying security mechanisms without implications on granularity and semantic mismatches.

Fairness may be a desirable property of a non-repudiation service. Protocols can achieve fairness through the involvement of a trusted third party but the extent of the trusted third party's involvement can vary between protocols. Hence, one of the goals of designing an efficient non-repudiation protocol is to reduce the workload of the trusted third party. In this paper, we present a variant of our fair non-repudiation protocol (1996), where the trusted third party is involved only in the case that one party cannot obtain the expected non-repudiation evidence from the other party. This variant is efficient in an environment where the two parties are likely to resolve communications problems between themselves.

The design of authentication protocols has proven to be surprisingly error-prone. We suggest that this is partly due to a language problem. The objectives of entity authentication are usually given in terms of human encounters while we actually implement message passing protocols. We propose various translations of the high-level objectives into a language appropriate for communication protocols. In addition, protocols are often specified at too low a level of abstraction. We argue that encryption should not be used as a general primitive as it does not capture the specific purpose for using a cryptographic function in a particular protocol.

A fair non-repudiation protocol should not give the sender of a message an advantage over the receiver, or vice versa. We present a fair non-repudiation protocol that requires a trusted third party but attempts to minimize its involvement in the execution of the protocol. We draw particular attention to the nonstandard use of encryption in our protocol and discuss some aspects of its formal verification.

Some recent research on key distribution systems has focussed on analysing trust in authentication servers, and constructing key distribution protocols which operate using a number of authentication servers, which have the property that a minority of them may be untrustworthy. This paper proposes two key distribution protocols with multiple authentication servers using a cross checksum scheme. Both protocol are based on the use of symmetric encryption for verifying the origin and integrity of messages. In these protocols it is not necessary for clients to trust an individual authentication server. A minority of malicious and colluding servers cannot compromise security and can be detected. The first 'parallel' protocol can prevent a minority of servers disrupting the service. The second 'cascade' protocol has to work with other security mechanisms in order to prevent a server breaking the procedure by refusing to cooperate. As compared with other proposed protocols with similar properties these two protocols require less exchanged messages.

Some recent research on key distribution systems has focussed on analysing trust in authentication servers, and constructing key distribution protocols which operate using a number of authentication servers, a minority of them may be untrusted. This

Ideally, a measure of the security of a system should capture quantitatively the intuitive notion of ‘the ability of the system to resist attack’. That is, it should be operational, reflecting the degree to which the system can be expected to remain

Methods of implementing public key algorithms based on modular integer arithmetic (RSA) and finite-field arithmetic (Diffie-Hellman, El Gamal) are examined. Architectures for VLSI implementations are emphasized.>

Key-stream generators are discussed in which shift registers are clocked in a quasi-random manner under the control of other shift registers. They are a promising practical alternative to those using nonlinear combining functions on the outputs from regularly stepped shift registers and are now almost as well understood. Some World War II ciphers using stuttered rotors are briefly described as natural predecessors, including one cryptanalyzed on the Colossus machines. The algebraic theory is discussed, from which it is shown how large periods and linear equivalences can readily be obtained. The work of a number of authors on cascades is reviewed; these are linear hierarchies in which each register except the first is clock controlled by its predecessor. Other schemes are considered. Results on statistical properties and autocorrelation functions are quoted.>