CSC5930/9010: Security and Privacy in Cyber-physical Systems
Lecture 1: Introduction to CPS/IoT
Slide 2
What are “Cyber- Physical Systems”?
• Cyber – computation, communication, and control that are discrete, logical, and switched
• Physical – natural and human-made systems governed by the laws of physics and operating in continuous time
• Cyber-Physical Systems – systems in which the cyber and physical systems are tightly integrated at all scales and levels.
Slide 3
What are “Cyber- Physical Systems”?• Cyber-physical systems (CPSs) are physical and engineered systems
whose operations are monitored, coordinated, controlled and integrated by a computing and communication core.
• By merging computing and communication with physical processes, CPS brings many benefits: – Safer and more efficient systems – Reduce the cost of building and operating systems– Build complex systems that provide new capabilities
Slide 4
What are “Cyber- Physical Systems”?
• Technological and Economic Drivers – The decreasing cost of computation, networking, and sensing – Computers and communication are ubiquitous, enables national or global scale
CPSs – Social and economic forces require more efficient use of national
infrastructure.
Slide 5
Characteristics of Cyber-physical Systems• Some defining characteristics:
– Cyber – physical coupling driven by new demands and applications •Cyber capability in every physical component •Large scale wired and wireless networking •Networked at multiple and extreme scales
– Systems of systems •New spatial-temporal constraints •Complex at multiple temporal and spatial scales •Dynamically reorganizing/reconfiguring •Unconventional computational and physical substrates (Bio? Nano?)
Slide 6
Characteristics of Cyber-physical Systems (cont’d)
– Novel interactions between communications/computing/control •High degrees of automation, control loops must close at all scales •Large numbers of non-technical savvy users in the control loop
– Ubiquity drives unprecedented security and privacy needs – Operation must be dependable, certified in some cases
Slide 7
Characteristics of Cyber-physical Systems
• What they are not: – Not desktop computing – Not traditional, post-hoc embedded/real-time systems – Not today’s sensor nets
Slide 8
CPS adoption’s increasing…
• CPS offers immense benefit– Healthcare, home, vehicle
automation, industrial logistics etc.
Slide 9
The rise of CPS devices
Slide 10
Which gives rise to Internet of Things…
• Internet of Things and Moore’s Law– Based on Moore’s Law, the transistors in a dense integrated circuit doubles
every two years– This has given rise to affordable, more powerful, and highly computational
devices aka “Things”.
Slide 11
The rise of connected heterogeneous devices…
Source: CISCO
Slide 12
Heterogeneous device connectivity
• Today, we see “smart” non-traditional devices being connected to the internet.– Some home appliances such as toasters, washing machines, lightbulbs now are
internet connected• Heterogeneous devices communicate with each other as well.
– Alexa controls home appliances such as switching on a toaster, controlling the thermostat
Slide 13
What are Internet of Things?
• Heterogeneous device a.k.a “Things” with sensing and actuating capabilities connected via a shared network.– Network is not limited to the internet.
• Characteristics:– Interconnectivity– Heterogeneity– Dynamic Changes– Scalability
Slide 14
IoT Scenario
Motion sensorMotion sensor
Motion sensor
ECG sensor
Internet
Slide 15
IoT Architecture
Cloud Layer
Gateway Layer
Device Layer
Sensor-Actuator Layer
Incr
easi
ng r
esou
rce
cons
train
t
Slide 16
IoT Architecture
Cloud Layer
Gateway Layer
Device Layer
Sensor-Actuator Layer
Incr
easi
ng r
esou
rce
cons
train
t
Edge devices consists of a combination of the Device layer and Sensor- Actuator Layer
Fog devices consists of a Devices contained in the gateway layer.
Slide 17
IoT Architecture
• Cloud Layer:– Consists of Servers and Cloud-based infrastructures
• Gateway Layer:– Consists of devices which acts as an intermediary between the cloud and
Device layer (e.g network gateway devices, desktop servers). • Device Layer:
– Also known as “Things”.– Consists of devices with mostly constrained memory capabilities (e.g
smartphones)• Sensor and Actuator Layer:
– Performs actions such as sensing data from the environment.– Actuator acts on data sensed
Slide 18
Fog/Edge Devices
• Fog Devices:– Devices with closer proximity to end user devices– Larger storage/computational abilities than edge devices (e.g device gateways,
routers)
• Edge Devices– End user devices– Constrained memory (e.g smart watches, tvs, phones)
Slide 19
Overview: Hardware Platform
The Internet
Network
“Thing”
Sensors & Actuators
Communications
User/Environment
Servers
2 sensorsIEEE 802.15.4
2.4GHz RF System
XM1000
Device level
Network level
The Internet
Gateway
Slide 20
• Sensors:– They are mainly input components– They sense and collect surrounding information– Basically three types:
•Passive, omnidirectional (e.g. mic)•Passive, narrow-beam sensor (e.g. PIR)•Active sensors (e.g. sonar, radar, etc.)
• Actuators:– They are mainly output components– They alter the surrounding. Some examples:
•Adding lighting, heat, sound, etc.•Controlling motors to move objects•Displaying messages
Sensors & Actuators
20
Slide 21
• We can turn almost every object into a “thing”.• A “thing” still looks much like an embedded system currently.• A “thing” generally consists of four main parts:
– Sensors & actuators– Microcontroller– Communication unit– Power supply
• A “thing” has the following properties:– It’s usually powered by battery. This implies limited source of energy.– It’s generally small in size and low in cost. This limits their computing
capability.– It doesn’t usually perform complicated tasks.
• Power consumption is the main design issue.
Things
Slide 22
• A “thing” always feature communications for connecting to other devices.
• The Role of Communications– Providing a data link between two nodes
• Communication type:– Wired (e.g. copper wires, optical fibers) – Wireless (e.g. Radio Frequency , Infrared).
• Popular RF-based communication solutions:– IEEE 802.15.4 – IEEE 802.11 (or Wifi)– Bluetooth– Near Field Communication (NFC), e.g. RFID
Communications
Slide 23
• The Roles of Networks– Managing nodes (discovery, join, leave, etc).– Relaying data packets from the source to the destination node in the network.
• Networks are a distributed system. All nodes need to perform networking related tasks.
• RF-based Network in IoT is usually a Wireless Multi-hop Network. Some examples:– Wireless Sensor Networks (WSNs)– Mobile Wireless Ad hoc Networks (MANETs)– Wireless Mesh Networks (WMNs)– Vehicular Ad Hoc Networks (VANETs)– and others...
• Main concern: Reliability & Performance
Networks
Slide 24
• The Internet serves as a wide area networking for a local network.• The Internet uses TCP/IP. This implies that things must also support
TCP/IP.• Gateway (or sink)
– For a practical deployment, a gateway is often needed in a network.– It offers relaying packets between the network and the Internet.
The Internet
24
The Internet
GatewayData link
Network
Slide 25
Looming problem is insecurity
• Data Breaches– CPS: large-scale, long-term, distributed data– Attacker: Sell or hoard personal information
• Malware– CPS: Tight time horizons and UX focused– Attackers: Excess time and broad attack surfaces
Slide 26
Security flaw example: Jeep Remote Hijack
Source: https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
• Hacked via entertainment system.
Slide 27Source: www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project
Top Ten Device Vulnerabilities1 Insecure Web Interface2 Insufficient Authentication/Authorization3 Insecure Network Services4 Lack of Transport Encryption5 Privacy Concerns (Data Collection)6 Insecure Cloud Interface7 Insecure Mobile Interface8 Insufficient Security Configuration9 Insecure Software/Firmware Updates
10 Poor Physical Security
Looming problem is device insecurity
Trusting device end-
points is hard
Slide 28
References• Kang G Shin “Lecture Note #2 EECS 571 Cyber-Physical Systems”
[PowerPoint Slides]. Retrieved from https://www.eecs.umich.edu/courses/eecs571/lectures/lecture2-intro-of-CPS.pdf
• Tameer Nadeem “Cyber Physical Systems Seminar” [PowerPoint Slides]. Retrieved from https://www.cs.odu.edu/~nadeem/classes/cs795-CPS-S13/material/Lec-01_Course-Introduction.pdf
• NIST “Framework for Cyber-Physical Systems” https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1500-201.pdf