Point-of-care diagnostics are a key technology for various safety-critical applications from providing diagnostics in developing countries lacking adequate medical infrastructure to fight infectious diseases to screening procedures for border protection. Digital microfluidics biochips are an emerging technology that are increasingly being evaluated as a viable platform for rapid diagnosis and point-of-care field deployment. In such a technology, processing errors are inherent. Cyber-physical digital biochips offer higher reliability through the inclusion of automated error recovery mechanisms that can reconfigure operations performed on the electrode array. Recent research has begun to explore security vulnerabilities of digital microfluidic systems. This paper expands previous work that exploits vulnerabilities due to implicit trust in the error recovery mechanism. In this work, a discriminative data mining approach is introduced to identify frequent bioassay operations that can be cyber-physically attested for runtime security protection.

Cyber-Physical Systems (CPS) are physical systems that are controlled or monitored by computer-based systems. CPS are a combination of computation, networking, and physical processes. As CPS are a combination of various diverse components, they are vulnerable to several security threats. Moreover, there are many different security domains (not just high/low, nor are they necessarily hierarchical). This paper utilizes previously-developed Multiple Security Domain Nondeducibility to uncover potential integrity vulnerabilities in an electric microgrid. These are then mitigated, to the extent possible, by adding executable invariants on system operation. Implementation on the Electric Power and Intelligent Control (EPIC) testbed at the Singapore University of Technology and Design are reported. Limitations of the design and successes/shortcomings of attack mitigation are reported.

An increase in the number of attacks on cyberphysical systems (CPS) has raised concerns over the vulnerability of critical infrastructure such as water treatment, oil, gas plants, against cyber attacks. Such systems are controlled by an Industrial Control System (ICS) that includes controllers communicating with each other, and with physical sensors and actuators, using a communications network. This paper focuses on a Multiple Security Domain Nondeducibility (MSDND) model to identify the vulnerable points of attack on the system that hide critical information rather than steal it, such as in the STUXNET virus. It is shown how MSDND analysis, conducted on a realistic multi-stage water treatment testbed, is useful in enhancing the security of a water treatment plant. Based on the MSDND analysis, this work offers a thorough documentation on the vulnerable points of attack, invariants used for removing the vulnerabilities, and suggested design decisions that help in developing invariants to mitigate attacks.

Blockchains are used to perform state agreement in a distributed system. However, there is no way to validate off-chain actions, such as physical actions, in the current architecture. This paper proposes a new blockchain architecture which features locally physically-verified transactions. From this new architecture, this paper presents a protocol for securing vehicular ad-hoc networks (VANETs) without the need to constantly communicate with roadside units (RSUs) or other infrastructure components. However, issues such as privacy in VANETs and Blockchains are left to future work. This paper shows the results from simulations of the current system in order to note its weaknesses. In particular, this paper can be used as a benchmark to show that ideas such as Proof-of-Work and full blockchain validation cannot work in a purely peer-to-peer VANET.

A malicious process in a distributed system can fabricate its internal state in its communications with its peers. These state fabrications can cause other processes in the distributed system to make incorrect control decisions. Smart grid systems have a unique advantage in the detection of falsified state attacks because process control decisions have an observable effect on a shared physical infrastructure. The physical infrastructure acts as a high-integrity message channel that broadcasts changes in individual process states. This work proposes a new distributed security mechanism called physical attestation that combines physical feedback with methods from computer security to detect state fabrications in the smart grid. The theory of physical attestation is proven using an information flow security property called nondeducibility, and supported with experimental results from a simulation test bed.

Digital microfluidics biochips are an emerging technology that are increasingly being evaluated as a viable platform for rapid diagnosis and point-of-care field deployment. In such a technology, processing errors are inherent. Cyber-physical digital biochips offer higher reliability through the inclusion of automated error recovery mechanisms that can reconfigure the electrode array. The potential exists for attack on these systems by confusing the reconfiguration activity. Recent research has begun to explore security vulnerabilities of digital microfluidic systems. In this work we use the Multiple Security Domain Nondeducibility (MSDND) framework to explore vulnerabilities that exist due to implicit trust. Specifically we examine Stuxnet-type threats that result in the disruption of information flow paths, and how creating beneficial paths will prevent threats from "hiding" behind Nondeducibility.

Fog computing is an attractive model for systems in which people live inside of the system with the goal of living smarter.This panel presentation discusses the security and privacy issues of people living within a Fog.

A malicious process in a distributed system can fabricate its internal state in its communications with its peers. These state fabrications can cause other processes in the distributed system to make incorrect control decisions. Smart grid systems have a unique advantage in the detection of falsified state attacks because process control decisions have an observable effect on a shared physical infrastructure. The physical infrastructure acts as a high-integrity message channel that broadcasts changes in individual process states. This work proposes a new distributed security mechanism called physical attestation that combines physical feedback with methods from computer security to detect state fabrications in the smart grid. The theory of physical attestation is proven using an information flow security property called nondeducibility, and supported with experimental results from a simulation test bed.

Cyber-physical systems augment traditional physical systems with cyber control. These cyber controls are intended to improve the efficiency and availability of the physical system. Smart-grid research focuses on improving the existing power grid with intelligent cyber control. Some smart-grid projects consider a future power grid where energy generation is largely decentralized because of widespread renewable generation and energy storage capabilities. However, if a distributed system is used to control this future power grid, faults in the cyber domain can lead to failures in the physical domain. This work treats communications congestion as a potential fault and makes use of congestion notification techniques to anticipate congestion and reconfigure the distributed system. Dynamic reconfiguration of the system maintains its proper operation in the presence of communications congestion such that proper smart grid operation is maintained. Our approach can be applied to other cyber-physical systems where communication is required for the correct operation of the physical network.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

In Cyber Physical Systems (CPSs), traditional security mechanisms such as cryptography and access control are not enough to ensure the security of the system. In a CPS, security is violated through complex interactions between the cyber and physical worlds, and, most insidiously, unintended information leakage through observable physical actions. Information flow analysis, which aims at controlling the way information flows among different entities, is better suited for CPSs. Information theory is widely used to quantify information leakage received by a program that produces a public output. Quantifying information leakage in CPSs can, however, be challenging due to implicit information flow between the cyber portion, the physical portion, and the outside world. This paper focuses on statistical methods to quantify information leakage in CPSs, especially, CPSs that allocate constrained resources. With aggregated physical observations, unintended information about the constrained resource might be leaked. The framework proposed is based on the advice tape concept of algorithmically quantifying information leakage and statistical analysis. An electric smart grid has been used as an example to develop confidence intervals of information leakage within a real CPS. The impact of this work is that it can be used as in algorithmic design to allocate electric power to nodes while maximizing the uncertainly of the information flow to an attacker.

Cyber-physical systems are physical infrastructures with deeply embedded computation, As these systems move beyond traditional control and response into more sophisticated planning and interaction, particularly with human elements, the need for intelligent cyber-physical systems emerges. This talk uses advanced electric smart grid technology as an example of distributed intelligence in a cyber-physical system from the point of view of energy management, human interfaces, and security and privacy.

Presents a listing of the Symposium organizing committee.

This paper presents a model-checking framework for the purpose of design and implementation of robust smart grid applications based on distributed intelligence. The paper first introduces distributed grid intelligence approach to smart grid automation and related challenges of their verification. We then introduce the case study example and how model-checking can be applied to the presented system implemented in IEC 61499 standard. In the end we present the initial results of our model-checking application to smart grid applications. The paper will conclude with some issues faced during the research and corrective steps to address these issues in future.

Cyber-Physical Systems (CPS) consist of computational components interconnected by computer networks that monitor and control switched physical entities interconnected by physical infrastructures. A fundamental challenge in the design and analysis of CPS is the lack of common semantics across the components. We address this challenge by employing a novel approach that composes the correctness of various components instead of their functionality using a conjunction of non-interfering logical invariants. We present a distributed algorithm that uses this approach to adaptively schedule power transfers between nodes in a smart power grid in such a way that the stability of both the computer network and the physical system are maintained. Simulation results demonstrate the necessity and usefulness of our approach in maintaining overall system stability in the presence of uncertainties in the computer network and with limited information about the global state of the system.

Traditional security models partition the security universe into two distinct and completely separate worlds: us and them. This partition is absolute and complete. More complex situations are most commonly treated as sets of increasingly more secure domains. This view is too simplistic for cyber-physical systems. Absolute divisions are conceptually clean, but they do not reflect the real world. Security partitions often overlap, frequently provide for the high level to have complete access to the low level, and are more complex than an impervious wall. We present a model that handles situations where the security domains are complex or the threat space is ill defined. To demonstrate our method, we examine a 'drive by wire' system from both the traditional view and in light of the modern reality. This paper examines the system from the viewpoint of the driver with special emphasis on the driver's inability to determine who, or what, is actually in control of the automobile during critical situations.

This paper presents implementation of one of the Distributed Grid Intelligence (DGI) applications: Load Balancing, using the IEC61499 architecture. This enables system level design of distributed load balancing application with a direct pathway to deployment to hardware. The use of IEC 61499 improves scalability, re-configurability and maintainability of automation software. The application was deployed to commercial programmable automation devices and embedded controller (ARM based TS-7800). The application was verified using co-simulation approach: control and power system simulated using Matlab on PC networked with the number of distributed hardware running load balance algorithm. The use of IEC 61499 facilitates deployment of hardware independent function block model to the variety of compliant hardware.

The work in this paper presents recent advances in developing a theory of information flow security specifically geared towards preserving the event confidentiality in Cyber-Physical Systems (CPSs). Preserving the confidentiality of sensitive internal actions is a unique challenge in CPSs due to the inherent external observability of such systems and the tight coupling between their cyber and physical domains. The far-reaching objective of this work is to develop a science of self-obfuscating systems based on the composition of simple building blocks. A model of Nondeducibility composes the building blocks under information flow security properties. To this end, this work presents fundamental theories on external observability for basic regular networks and the concept of "event compensation". Further, this work extends previous work by providing simulation based proof of these concepts for an experimental power transmission bus network as a model CPS.

Confidentiality is an often overlooked, yet crucial point in the security analysis of a system. infrastructures take for granted that confidentiality is maintained through obfuscation by dissemination of information. This dissemination does indeed maintain the confidentiality of the system when only a small portion of the information can be obtained by an outside observer. However, when multiple observers collaboratively make observations, the confidential information can be revealed or even just partially revealed. If a team of attackers on a system can deduce enough information to successfully perform a crippling attack, the system could not be considered secure. This paper will bring together facets of graph theory, electrical physics, and statistics to illustrate how a team of attackers could compromise a partially deducible system. The infrastructure considered in this paper is a power transmission systems, but these techniques could be applied to any system which could be modeled as a resistance network; including traffic systems, oil and gas pipelines, or even a large scale computer network.

Hardware-in-the-loop (HIL) real-time simulation is becoming a significant tool in prototyping complex, highly available systems. The HIL approach permits testing of hardware prototypes of components that would be extremely costly or difficult to test in the deployed environment. In power system simulation, key issues are the ability to wrap the systems of equations (such as Partial Differential Equations) describing the deployed environment into real-time software models, provide low synchronization overhead between the hardware and software, and reduce reliance on proprietary platforms. This paper introduces an open source HIL simulation framework that can be ported to any standard Unix-like system on any shared-memory multiprocessor computer, requires minimal operating system scheduler controls, enables an asynchronous user interface, and allows for an arbitrary number of secondary control components. The framework is implemented in a soft real-time HIL simulation of a power transmission network with physical Flexible AC Transmission System (FACTS) devices. Performance results are given that demonstrate a low synchronization overhead of the framework.

The primary goal of this paper is to develop a structured object-oriented security requirements analysis methodology for the elicitation and analysis of security requirements in embedded systems. There are several approaches to elicit, analyze and specify security requirements in embedded systems ranging from formal mathematical models for proof of certain security properties to informal methods that are easily understood. Applicability of formal security models is limited because they are complex and it is time consuming to develop. On the other hand, informal security requirements analysis methods are not integrated with conceptual models in requirements analysis, and although both external and internal threats have been dealt using use cases and misuse cases, they provide no process for analyzing both internal and external threats in a structured manner. This paper discusses a structured object-oriented security requirements analysis methodology for the elicitation and analysis of security requirements in embedded systems. It is capable of identifying hierarchically both external and internal threats posed by both external and internal actors of a system level by level. It is illustrated and validated by security requirements analysis for an advanced embedded power grid control system.

The future of computing is to be a core discipline. Nearly everything in computing is cross-cutting, not only over computing applications, but over society. Systems with significant Cyber and Physical components, such as advanced transportation, electric power transmission management, advanced sensing in agriculture, and social services. To realize this future, the discipline must not only embrace all aspects of computing applications and tools, from requirements to quality over the system life cycle but also the semantics of applications [1], including socio-economic aspects of design and decision making.

The current object-oriented class-based approaches to hardware/software co-analysis/co-design of embedded systems are limited in their abilities to properly capture the structure of individual instances of hardware and software components and their interactions. This paper discusses a methodology to extend a structured object-oriented hardware/software co-design methodology based on the high order object-oriented modeling technique (HOOMT) to incorporate instance-based object and behavioral models. The instance-based structured object-oriented methodology will enable description of a system's structure based on individual instances of hardware and software components and specification of the interactions among them. In addition, lattices are introduced to specify the concurrent behavior of hardware/software components in a concurrent embedded system. These additions further enhance the method's capability of providing a precise set of specifications that can be understood easily by both hardware and software designers in co-analysis/co-design. The methodology has been applied to the specification of hardware and software of a simulated advanced power grid control system

The hardware/software co-design of a high-quality real-time system relies heavily on the modeling of both the hardware and software components from three aspects: structures, functionalities, and constraints, especially the temporal constraints. However, there is not a systematic process for the elicitation and analysis of temporal constraints in hardware/software co-design. Furthermore, existing object-oriented methods provide no means for the explicit specification of system/component constraints in object models. This paper presents a systematic methodology for structured object-oriented analysis and specification of temporal constraints in hardware/software co-analysis and co-design using an extended high-order object-oriented modeling technique (HOOMT). This methodology hierarchically elicits and analyzes the temporal constraints in hardware/software co-design based on the integration of the high-order object model (HOOM) and hierarchical timed automata (HTA). It helps to identify temporal constraints of hardware and software components as well as their interactions level by level. In addition, it helps trace the relationships among these constraints at multiple levels during the co-design of real-time systems. A case study from the hardware/software co-design of the simulated FACTS power transmission system is used to illustrate the feasibility and merits of this methodology

Existing maximum flow algorithms use one processor for all calculations or one processor per vertex in a graph to calculate the maximum possible flow through a graph's vertices. This is not suitable for practical implementation. We extend the max-flow work of Goldberg and Tarjan to a distributed algorithm to calculate maximum flow where the number of processors is less than the number of vertices in a graph. Our algorithm is applied to maximizing electrical flow within a power network where the power grid is modeled as a graph. Error detection measures are included to detect problems in a simulated power network. We show that our algorithm is successful in executing quickly enough to prevent catastrophic power outages.

The bound on component failures and their spatial distribution govern the fault tolerance of any candidate error-detecting algorithm. For distributed memory multiprocessors, the specific algorithm and the topology of the processor interconnection network define these bounds. This paper introduces the maximal fault index, derived from the system topology and local communication patterns, to demonstrate how a maximal number of simultaneous component failures can be tolerated for a particular interconnection network and error-detecting algorithm. The index is used to design a mapping of processes to processor groups such that the error-detecting ability of the algorithm is preserved for certain multiple simultaneous processor failures.

Article Run-time security evaluation: can we afford it? Share on Authors: Cristina Serban Bell Laboratories, Lucent Technologies, Murray Hill, NJ Bell Laboratories, Lucent Technologies, Murray Hill, NJView Profile , Bruce McMillin Dept. of Computer Science, University of Missouri-Rolla, Rolla, MO Dept. of Computer Science, University of Missouri-Rolla, Rolla, MOView Profile Authors Info & Claims NSPW '96: Proceedings of the 1996 workshop on New security paradigmsSeptember 1996 Pages 68–72https://doi.org/10.1145/304851.304868Published:17 September 1996 0citation244DownloadsMetricsTotal Citations0Total Downloads244Last 12 Months0Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

Formal security specifications for a distributed application can be checked for compliance at run-time using executable security assertions. We propose the run-time security evaluation (RTSE) method which makes use of histories/traces of events, assertions and operational evaluation in the distributed environment to ensure the security specifications for the application are fulfilled at run-time. A model problem is used to aid in developing the security requirements formally.

To generate reliable software, it must be shown that a program meets its specifications. This can be done using program verification techniques. Assertions are made about the expected behavior of a program, and intermediate program states are examined to ensure that the program specifications are never violated. However,proving that the intermediate program steps lead to the conclusion and, therefore, proving that the program is correct is difficult. In this paper we introduce a novel technique, temporal subsumption, and its application as a proof checker. This technique removes "redundant" assertions from an argument of program correctness, based on a precondition and the predicate transformations performed by the program statements.

A responsive computing system is a hybrid of real-time, distributed and fault-tolerant systems. In such a system, severe consequences can occur if the run-time behavior does not conform to the expected behavior or specifications. In this paper, we present a formal approach to ensure satisfaction of the specifications in the operational environment as follows. First we specify behavior of the systems using Interval Temporal Logic (ITL). Next we give algorithms for trace checking of programs in such systems. Finally, we present a fully distributed run-time evaluation system which causally orders the events of the system during its execution and checks this run-time behavior against its ITL specification. The approach is illustrated using a train-set example.

This paper presents a cost error measurement scheme and relaxed synchronization method, for simulated annealing on a distributed memory multicomputer, which predicts the amount of cost error that an algorithm will tolerate. An adaptive error control method is developed and implemented on an Intel iPSC/2.>

An embedding is 1-step recoverable if any single fault occurs, the embedding can be reconfigured in one reconfiguration step to maintain the structure of the embedded graph. In this paper we present an efficient scheme to construct this type of 1-step recoverable ring embeddings in the hypercube. Our scheme will guarantee finding a 1-step recoverable embedding of a length-k (even) ring in a d-cube where 6/spl les/k/spl les/(3/4)2/sup d/ and d/spl ges/3, provided such an embedding exists. Unlike previously proposed schemes, we solve the general problem of embedding rings of different lengths and the resulting embeddings are of smaller expansion than in previous proposals. A sufficient condition for the non-existence of 1-step recoverable embeddings of rings of length >(3/4)2/sup d/ in d-cubes is also given.

In an unreliable distributed system, faulty processors may prevent a deadlock detection algorithm from properly detecting deadlocks. However, few of the algorithms proposed in the literature address the issue of handling process failures in a distributed system. This paper proposes a fault-tolerant distributed deadlock detection algorithm which integrates a priority-based probe algorithm with a PMC-based diagnosis model. This algorithm detects deadlock cycles as well as identifies process failures under a bounded number of failures in a deadlock cycle by using extended probe messages that contain additional information about faulty processors.>

One approach for providing fault tolerance is through examining the behavior and properties of the application and deriving executable assertions that detect faults. This paper focuses on transforming the assertions of a verification proof of a program to executable assertions. These executable assertions may be embedded in the program to create a fault-tolerant program. It is also shown how the natural redundancy of the program variables can be used to reduce the number of executable assertions needed. While this approach has been applied to the sequential programming environment, the distributed programming environment presents special challenges. The authors discuss the application of concurrent programming axiomatic proof systems to generate executable assertions in a distributed environment using distributed branch and bound as a model problem.>

A fault-tolerant parallel sorting algorithm developed using the application-oriented fault tolerance paradigm is presented. The algorithm is tolerant of one processor/link failure in an n-cube. The addition of reliability to the sorting algorithm results in a performance penalty. Asymptotically, the fault-tolerant algorithm is less costly than host sorting. Experimentally it is shown that fault-tolerant sorting quickly becomes more efficient that host sorting when the bitonic sort/merge is considered. The main contribution is the demonstration that the application-oriented fault tolerance paradigm is applicable to problems of a noniterative-convergent nature.>

A new algorithm, the ID algorithm, is presented which minimizes the fault-detection latency. In the ID algorithm, a fault is detected as soon as the fault occurs instead of at problem termination. For n/sup 2/ processors, the fault-latency time of the ID algorithm is 1/n of that of the checksum algorithm with a run-time penalty of O(n log/sub 2/ n) in an n*n matrix operation. This algorithm has better performance in terms of error coverage and expected run time in large-scale matrix multiplications such as signal and image processing, weather prediction, and finite-element analysis.>

An algorithm based on the Marquardt-Levenberg least-square optimization method has been shown by S. Kollias and D. Anastassiou (IEEE Trans. on Circuits Syst. vol.36, no.8, p.1092-101, Aug. 1989) to be a much more efficient training method than gradient descent, when applied to some small feedforward neural networks. Yet, for many applications, the increase in computational complexity of the method outweighs any gain in learning rate obtained over current training methods. However, the least-squares method can be more efficiently implemented on parallel architectures than standard methods. This is demonstrated by comparing computation times and learning rates for the least-squares method implemented on 1, 2, 4, 8, and 16 processors on an Intel iPSC/2 multicomputer. Two applications which demonstrate the faster real-time learning rate of the last-squares method over than of gradient descent are given

An essential element of automated deduction systems is unification algorithms which identify general substitutions and when applied to two expressions, make them identical. However, functions which are associative and commutative, such as the usual addition and multiplication functions, often arise in term rewriting systems, program verification, the theory of abstract data types and logic programming. The introduction to the associative and commutative equality axioms together with standard unification brings with it problems of termination and unreasonably large search spaces. One way around these problems is to remove the troublesome axioms from the system and to employ a unification algorithm which unifies modulo the axioms of associativity and commutativity. Unlike standard unification, the associative-commutative (AC) unification of two expressions can lead to the formation of many most general unifiers. A report is presented on a hybrid AC unification algorithm which has been implemented to run in parallel on an Intel iPSC/2.>

The design and implementation of a reliable version of the distributed bitonic sorting algorithm using the application-oriented fault tolerance paradigm on a commercial multicomputer is described. Sorting assertions in general are discussed and the bitonic sort algorithm is introduced. Faulty behavior is discussed and a fault-tolerant parallel bitonic sort developed using this paradigm is presented. The error coverage and the response of the fault-tolerant algorithm to faulty behavior are presented. Both asymptotic complexity and the results of run-time experimental measurements on an Ncube multicomputer are given. The authors demonstrate that the application-oriented fault tolerance paradigm is applicable to problems of a noniterative nature.>

The use of executable assertions is a powerful tool with which to perform program verification, provide software fault-tolerance, and provide hardware fault-tolerance via the application-oriented paradigm. The authors show that assertions commonly used in the sequential programming environment are inadequate for the distributed parallel environment. In particular, it is shown that even design-based assertions are myopic and provide inadequate error coverage. In their place, a triad of basic metrics is proposed for certain classes of problems that, when applied beginning with the specification phase of the life cycle, produce assertions that are better suited to the parallel environment. This method is applied to a well-known parallel computing problem in order to demonstrate the effectiveness of the method. Error coverage is modeled probabilistically so that the dominance of assertions may be quantified.>