GEA-1 and GEA-2 are two standard stream ciphers used in GPRS (General Packet Radio Service) to protect against eavesdropping GPRS between the base station and the phone. Now, a range of current phones still support them. In this paper, a differential fault attack on the GEA-like stream ciphers under the random fault model is proposed for the first time. In this attack, an efficient dedicated algorithm for identifying the exact fault location is proposed. By using this dedicated algorithm, the attacker can succeed in determining the exact fault location. As applications, practical differential fault attacks on the GPRS standard ciphers (i.e., GEA-1 and GEA-2) are presented, which recover the 64-bit secret keys of GEA-1 and GEA-2 with time complexities of${2^{{\mathrm{{33}}}{\mathrm{{.807}}}}}$and${2^{{\mathrm{{33}}}{\mathrm{{.858}}}}}$, respectively. We validate the cryptanalytic results by simulating the whole attacks on the platform ChipWhisperer Lite. The experimental results show that both GEA-1 and GEA-2 can be broken within sixteen minutes on a common laptop. Finally, the possible countermeasures are presented to protect the processed data of massive GPRS devices.

ARX-based design is a major building block of modern cryptographic ciphers due to its efficiency in software. Forró is an ARX-based stream cipher proposed by Coutinho et al. at ASIACRYPT 2022, which was designed to provide higher security margin than the ChaCha stream cipher. In this paper, we propose a full automated MILP model calledMinForró, to derive linear approximations for the Forró stream cipher. For the differential part, a two-stage strategy to search for single-bit differential trails with high differential correlations is presented, which helps us to find the first-ever 3-round differential trails for Forró. By combining the linear approximations obtained byMinForróand 3-round differential trail for Forró, we propose improved differential-linear distinguishers for 4-, 5-, 5.25-, 5.5-, 5.75-, 6-, 6.25- and 6.5-round Forró with complexities 232.44, 246, 250, 264.32, 287.12, 2117.92, 2174.92and 2226.88, respectively. The proposed differential-linear distinguishers for 4-, 5-, 5.25- and 5.5- round Forró significantly improve the existing distinguishers by factors of 24.11, 283.68, 2127.64and 2178.20, respectively. To the best of our knowledge, this is the first differential-linear distinguisher for Forró that reaches 6.5 rounds, which is a significant advancement over the existing record of 5.5 rounds. We have implemented the differential-linear distinguishers for 4- and 5- round Forró on a common PC, and the experimental results confirm the correctness of these distinguishers. Furthermore, when combined with theProbabilistic Neutral Bits(PNB) technique, we obtain key recovery attacks on 5.5-, 6-, 6.5- and 6.75-round Forró with time complexities 2149.20, 2151.84, 2213.49and 2251.97, respectively. The proposed key recovery attack on 5.5-round Forró significantly improves the time complexity of the existing attack by a factor of 275.84. To the best of our knowledge, this is the first key recovery attack on Forró that reaches 6.75 rounds, which is a significant advancement over the existing record of 5.5 rounds.

Cyber-Physical Production Systems (CPPS) will usher a new era of smart manufacturing. However, CPPS will be vulnerable to cross-domain attacks due to the interactions between the cyber and physical domains. To address the challenges of modeling cross-domain security in CPPS, we are proposing GAN-Sec, a novel conditional Generative Adversarial Network based modeling approach to abstract and estimate the relations between the cyber and physical domains. Using GAN-Sec, we are able to determine if various security requirements such as confidentiality, availability, and integrity are met. We provide a security analysis of an additive manufacturing system to demonstrate the applicability of GAN-Sec.

Modern automotive Cyber-Physical Systems (CPS) are increasingly adopting wireless communications for Intra-Vehicular, Vehicle-to-Vehicle (V2V), and Vehicle-to-Infrastructure (V2I) protocols as a promising solution for challenges such as the wire harnessing problem, collision detection, and collision avoidance, traffic control, and environmental hazards. Regrettably, this new trend results in new security challenges that can put the safety and privacy of the automotive CPS and passengers at great risk. In addition, automotive wireless communication security is constrained by strict energy and performance limitations of electronic controller units and sensors. As a result, the key generation and management for secure automotive CPS wireless communication is an open research challenge. This article aims to help solve these security challenges by presenting a practical key generation technique based on the reciprocity and high spatial and temporal variation properties of the automotive wireless communication channel. Accompanying this technique is also a key length optimization algorithm to improve performance (in terms of time and energy) for safety-related applications constrained by small communication windows. To validate the practicality and effectiveness of our approach, we have conducted simulations alongside real-world experiments with vehicles and RC cars. Last, we demonstrate through simulations that we can generate keys with high security strength (keys with 67% min-entropy) with 20× reduction in code size overhead in comparison to the state-of-the-art security techniques.

The interaction between the cyber domain and the physical domain components and processes can be leveraged to enhance the security of the cyber-physical system. In order to do so, we must first analyze various cyber domain and physical domain information flows, and characterize the relation between them using model functions. In this paper, we present a notion of cross-domain security of cyber-physical systems, whereby we present a security analysis framework that can be used for generating novel cross-domain attack models, attack detection methods, etc. We demonstrate how information flows such as discrete domain signal flows and continuous domain energy flows in the cyber and physical domain can be used to generate model functions using data-driven estimation, and use this model functions for performing various cross-domain security analysis. We also demonstrate the practical applicability of the cross-domain security analysis framework using the cyber-physical manufacturing system as a case study.

This paper presents a novel Model-Based Design (MBD) approach and associated tool-chain for the Time-Triggered Real-time Embedded (TTRE)1systems. Our tool-chain automatically synthesizes software for manufacturing TTRE systems. A Software-In-the-Loop Simulation (SILS) framework integrated into our tool-chain helps to reduce the design iterations. Using a manufacturing robot-arm use-case, we validate our tool-chain and demonstrate a 39× improvement in the Quality-of-Control (QoC) when compared to the state-of-the-art approach [3]. Our auto-generated scheduler meets all the hard real-time constraints (zero deadline misses) for a given TTRE system when compared to the scheduler (e.g., 145 deadline misses for a CPU utilization of 95%) presented in [1], [25]. Moreover, compared to the traditional MBD approach for the TTRE systems where many design iterations are required [4], our approach and tool-chain can generate high quality and accurate tasks with an associated scheduler in a single design iteration.

Security is one of the major challenges for Cyber-Physical Systems (CPS) design. Identifying flaws as early as possible in the CPS design saves time and money [6]; between 5× to 10× less expensive [7] than finding them during the detailed design stages. This paper makes a case for finding cybersecurity flaws as early as possible. Not only for the temporal and cost benefits, but more importantly, for the integrity of the system once in operation. We introduce a security-aware functional modeling methodology, supported by simulation to validate the robustness of the system in the presence of attacks and countermeasures. Our ideas are implemented in a design automation tool in Amesim and Matlab/Simulink. We use an automotive use-case as an example to validate the methodology and the tool.

This work presents a novel Model-Based Design (MBD) approach and associated tool-chain for the IEC 61131-3 specific Programmable Logical Controllers (PLC) [2]. Our tool-chain automatically synthesizes software for manufacturing Time-Triggered Real-time Embedded (TTRE) systems. A Software-In-the-Loop Simulation (SILS) framework integrated into our tool-chain helps to reduce the design iterations. Using a manufacturing robot-arm use-case, we validate our tool-chain and demonstrate a 39x improvement in the Quality-of-Control (QoC) when compared to the state-of-the-art approach [1]. Our auto-generated scheduler meets all the hard real-time constraints (zero deadline misses) for a given TTRE system when compared to the scheduler (e.g., 145 deadline misses for a CPU utilization of 95%) presented in [13].

Recently, Electric Vehicles (EVs) have been considered as new paradigm of transportation in order to solve environmental concerns, e.g. air pollution. However, EVs pose new challenges regarding their Battery LifeTime (BLT), energy consumption, and energy costs related to battery charging. The EV power consumption may be estimated by having the route information and the EV specifications. Also, by having the battery characteristics, the battery capacity consumption and the BLT may be estimated for each route. In this paper, we propose a driving management which uses the above-mentioned information in order to optimize the driving route by being aware of the EV energy consumption, energy cost, and BLT. Our proposed driving management extends the BLT by 16.8% and reduces the energy consumption by 11.9% and energy cost by 12.6% on average, by selecting the optimized route instead of the fastest route.

A novel design methodology, associated algorithms, and tools for the design of complex automotive cyber-physical systems are presented. Rather than supporting the critical path where most resources are spent, we preemptively target the concept design phase that determines 75% of a vehicle's cost. In our methodology, the marriage of systems engineering principles with high-level synthesis techniques results in a Functional Modeling Compiler capable of generating high-fidelity simulation models for the design space exploration and validation of multiple cyber-physical (ECUs+Physics) vehicle architectures. Using real-world automotive use-cases, we demonstrate how functional models capturing cyber-physical aspects are synthesized into high-fidelity simulation models.