Cyber-Physical Systems Security—A Survey <s> 1) ICS: <s> This work presents a study of current and future bus systems with respect to their security against various malicious attacks. After a brief description of the most well-known and established vehicular communication systems, we present feasible attacks and potential exposures for these automotive networks. We also provide an approach for secured automotive communication based on modern cryptographic mechanisms that provide secrecy, manipulation prevention and authentication to solve most of the vehicular bus security issues. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> 1) ICS: <s> Our study analyzes the security and privacy properties of an implantable cardioverter defibrillator (ICD). Introduced to the U.S. market in 2003, this model of ICD includes pacemaker technology and is designed to communicate wirelessly with a nearby external programmer in the 175 kHz frequency range. After partially reverse-engineering the ICD's communications protocol with an oscilloscope and a software radio, we implemented several software radio-based attacks that could compromise patient safety and patient privacy. Motivated by our desire to improve patient safety, and mindful of conventional trade-offs between security and power consumption for resource-constrained devices, we introduce three new zero-power defenses based on RF power harvesting. Two of these defenses are human-centric, bringing patients into the loop with respect to the security and privacy of their implantable medical devices (IMDs). Our contributions provide a scientific baseline for understanding the potential security and privacy risks of current and future IMDs, and introduce human-perceptible and zero-power mitigation techniques that address those risks. To the best of our knowledge, this paper is the first in our community to use general-purpose software radios to analyze and attack previously unknown radio communications protocols. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> 1) ICS: <s> Advances in wireless communication technologies, such as wearable and implantable biosensors, along with recent developments in the embedded computing area are enabling the design, development, and implementation of body area networks. This class of networks is paving the way for the deployment of innovative healthcare monitoring applications. In the past few years, much of the research in the area of body area networks has focused on issues related to wireless sensor designs, sensor miniaturization, low-power sensor circuitry, signal processing, and communications protocols. In this paper, we present an overview of body area networks, and a discussion of BAN communications types and their related issues. We provide a detailed investigation of sensor devices, physical layer, data link layer, and radio technology aspects of BAN research. We also present a taxonomy of BAN projects that have been introduced/proposed to date. Finally, we highlight some of the design challenges and open issues that still need to be addressed to make BANs truly ubiquitous for a wide range of applications. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> 1) ICS: <s> This article investigates the vulnerabilities of Supervisory Control and Data Acquisition (SCADA) systems which monitor and control the modern day irrigation canal systems. This type of monitoring and control infrastructure is also common for many other water distribution systems. We present a linearized shallow water partial differential equation (PDE) system that can model water flow in a network of canal pools which are equipped with lateral offtakes for water withdrawal and are connected by automated gates. The knowledge of the system dynamics enables us to develop a deception attack scheme based on switching the PDE parameters and proportional (P) boundary control actions, to withdraw water from the pools through offtakes. We briefly discuss the limits on detectability of such attacks. We use a known formulation based on low frequency approximation of the PDE model and an associated proportional integral (PI) controller, to create a stealthy deception scheme capable of compromising the performance of the closed-loop system. We test the proposed attack scheme in simulation, using a shallow water solver; and show that the attack is indeed realizable in practice by implementing it on a physical canal in Southern France: the Gignac canal. A successful field experiment shows that the attack scheme enables us to steal water stealthily from the canal until the end of the attack. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> 1) ICS: <s> Modern automobiles are pervasively computerized, and hence potentially vulnerable to attack. However, while previous research has shown that the internal networks within some modern cars are insecure, the associated threat model--requiring prior physical access--has justifiably been viewed as unrealistic. Thus, it remains an open question if automobiles can also be susceptible to remote compromise. Our work seeks to put this question to rest by systematically analyzing the external attack surface of a modern automobile. We discover that remote exploitation is feasible via a broad range of attack vectors (including mechanics tools, CD players, Bluetooth and cellular radio), and further, that wireless communications channels allow long distance vehicle control, location tracking, in-cabin audio exfiltration and theft. Finally, we discuss the structural characteristics of the automotive ecosystem that give rise to such problems and highlight the practical challenges in mitigating them. <s> BIB005 </s> Cyber-Physical Systems Security—A Survey <s> 1) ICS: <s> Many people think of the Smart Grid as a power distribution group built on advanced smart metering-but that's just one aspect of a much larger and more complex system. The "Smart Grid" requires new technologies throughout energy generation, transmission and distribution, and even the homes and businesses being served by the grid. This also represents new information paths between these new systems and services, all of which represents risk, requiring a more thorough approach to where and how cyber security controls are implemented. ::: ::: This insight provides a detailed architecture of the entire Smart Grid, with recommended cyber security measures for everything from the supply chain to the consumer. ::: ::: ::: ::: Discover the potential of the Smart Grid ::: Learn in depth about its systems ::: See its vulnerabilities and how best to protect it ::: ::: Table of Contents ::: ::: ::: Introduction ::: ::: Chapter 1: What is the Smart Grid? ::: ::: Chapter 2:?Smart Grid Network Architecture ::: ::: Chapter 3: Hacking the Smart Grid ::: ::: Chapter 4: Privacy Concerns with the Smart Grid ::: ::: Chapter 5: Security Models for SCADA, ICS and Smart Grid ::: ::: Chapter 6: Securing the Smart Grid ::: ::: Chapter 7: Securing the Supply Chain ::: ::: Chapter 8: The Future of the Grid ::: ::: Appendix A: Reference Models and Architectures ::: ::: Appendix B: Continued Reading ::: ::: Glossary <s> BIB006
Two categories of communication protocols are deployed in ICS, one is used for the automation and control such as Modbus, Distributed Network Protocol (DNP3), and the other is for interconnecting ICS control centers, such as Inter-Control Center Protocol (ICCP)  . Those protocols are used in addition to general-purpose protocols such as TCP/IP. 2) Smart Grid: The networks are of two types: field device communications within substations using Modbus and DNP3, and recently the more advanced protocol, developed by the International Electrotechnical Commission (IEC), IEC 61850. The other type is control center communications, which also rely on ICCP, similar to ICS. In addition, smart meters and field devices use wireless communications to send measurements and receive commands from control centers. Smart meters, for example, use short-range frequency signals, e.g., ZigBee, for diagnostics operations by technicians or readings by digital smart readers. 3) Medical Devices: It is a necessary requirement that IMDs be configured and updated wirelessly, so that no surgical extraction for the device is needed. Therefore, wireless communication is the most common method of communication in medical devices. IMDs and wearable devices rely on different communication protocols and technologies. For example, IMDs use low frequency (LF) signals specified by the Federal Communications Commission, called Medical Implant Communication Service, that make it possible for IMDs and their programmers to communicate. On the other hand, wearable devices rely on another type of wireless communications, i.e., body area network (BAN). BAN utilizes several wireless communication technologies such as Bluetooth and ZigBee BIB003 . 4) Smart Cars: Smart cars can have different types of communication capacities, including vehicle to vehicle (V2V), vehicle to infrastructure (V2I), and in-vehicle communications. In this paper, we focus on the latter. As we mentioned, cars have around 70 connected ECUs, all of which communicate through a bus network. The network is usually divided into multiple subnetworks, each of which also has a bus topology. Subnetworks can exchange messages through a gateway that separates their traffics. A common conception is that this separation is due to security concerns. However, Checkoway et al. BIB005 suggested that this is also for bandwidth concerns. The most common protocols are as follows. 1) The local interconnect network (LIN), used for relatively low speed applications such as opening/closing windows. 2) Controller area network (CAN), used for soft real-time applications such as the anti-lock braking system (ABS). 3) Flexray, needed for hard real-time applications where the speed of transmission is critical such as braking or responding to an obstacle in front of the car. 4) Media oriented systems transport, used for in-car entertainment applications BIB001 . In addition, some cars are equipped with wireless connections such as Bluetooth and cellular interfaces. Fig. 2 shows a high-level abstraction of any CPS, which mainly consists of three categories of components: 1) communication; 2) computation and control; and 3) monitoring and manipulation. The communication could be wireless or wired, and it could connect CPS with higher-level systems, such as control centers, or with lower-level components in the physical world. The computation and control part is where the intelligence is embedded, control commands are sent, and sensed measures are received. The monitoring and manipulation components connect CPS to the physical world through sensors to monitor physical components, and actuators to manipulate them. In this figure, the cyber aspects (1) are the cyber interactions with the PLC such that there is no direct interaction with physical components, such as cooling fans or the tank. This involves laptops that can directly connect PLCs, communications with higher-level environments such as the control center and other remote entities, and the PLC's wireless interface that could be based on long-or short-range frequencies. In addition, cyber-physical aspects (2) are those that connect cyber and physical aspects. The PLC, the actuator, and the sensor, are all cyber-physical aspects due to their direct interactions with the physical world. The wireless capabilities of the actuator and the sensor are also considered cyber-physical. Finally, the physical aspects are the physical objects that need monitoring and control, i.e., the cooling fans and the tank's temperature. 2) Smart Grid: Fig. 5 shows a typical scenario in smart grids. A smart meter is attached to every house to provide utility companies with more accurate electricity consumption data and customers with convenient way to track their usage information. A smart meter interfaces a house's appliances and home energy management systems on the one hand, and interfaces with data collectors on the other. Wireless communications are the most common means to communicate with collectors, although wired communications, such as power line communications, are also available. A meter is equipped with a diagnostics port that relies on short-range wireless interface for convenient access by digital meter readers and diagnostics tools BIB006 . The smart meter sends the measurements to a collector that aggregates all meters' data in a designated neighborhood. The collector sends the aggregated data to a distribution control center managed by the utility company. In particular, the data is sent to the AMI headend server that stores the meters' data and shares it with the meter data management system that manages the data with other systems such as demand response systems, historians, and billing systems. The headend can connect/disconnect services by remotely sending commands to the meters. This feature is a double-edged sword such that it is very efficient way to control services, yet it could be exploited to launch large-scale blackouts by remotely controlling a large number of smart meters. In Fig. 5 , we highlight the CPS aspects in the involved components that have some interactions with the smart meters. Cyber aspects (1) appear in the control center where smart meters' data is stored, shared, and analyzed and based on that some decisions can be made based on the analysis. The control center can also have a cyber-physical aspect (2) when connect/disconnect commands are sent by the AMI headend to smart meters. In addition, the cyber-physical aspect (2) is also apparent in the smart meter itself due to its ability to perform cyber operations, such as sending measurements to utility, and physical operations, such as connecting/disconnecting electricity services. Other field devices in the generation, transmission automation, and distribution plants have a high presence of the cyber-physical aspect due to their close interactions with physical aspects of smart grids. Home appliances that are connected with smart meters are considered cyber-physical because of their direct interaction with smart meters. A utility company can use smart meters to control the amount of energy consumed by home appliances when needed  , which is a cyber-physical (2) action. 3) Medical Devices: Fig. 6 is an overview of two of the most popular IMDs, the insulin pump and the implantable cardioverter defibrillator (ICD). The insulin pump is used to automatically or manually inject insulin injections for diabetes patients when needed, whereas the ICS is used to detect rapid heartbeat and response by delivering an electric shock to maintain a normal heartbeat rate BIB002 . The insulin pump usually needs another device, called the continuous glucose monitor (CGM), to receive blood sugar measurements. Both devices, the insulin pump and the CGM, require small syringes to be injected into a patient's body. The insulin pump receives measurements of glucose levels from the CGM. Based on the measurements, the pump decides whether the patient needs an insulin dose or not. The CGM sends the measurements through wireless signals to the insulin pump or other devices, such as a remote controller or computer. In addition, some insulin pumps can be commanded by a remote controller held by a patient or physician. In this figure, the cyber aspects (1) are embodied in the monitoring computers in the hospital and the communications to the Internet. The cyber-physical aspects (2), on the other hand, are present in those devices that directly interact with patients' implanted devices. A patient represents the physical aspect BIB004 in the context of medical devices. An IMD connects to the hospital by sending measurements through an in-home router. To reconfigure an ICD, a physical proximity is required to be able to do so using a device called the programmer. 4) Smart Cars: Fig. 7 shows the typical architecture of an in-car network. Depending on the nature of the tasks expected from each ECU, an ECU is attached to the appropriate subnetwork. ECUs from different subnetworks can intercommunicate through gateways. In this paper, we mainly focus on CAN bus for two reasons: 1) most security issues result from CAN-based networks and 2) it has been required to be deployed in all cars in the U.S. since 2008  , thus it is in almost every car around us. In Fig. 7 , we annotated ECUs that do not have any interactions with physical components of the cars as cyber  . Examples of which include the telematics control unit (TCU) and the media player. The TCU has more than a wireless interface that allows advanced capabilities such as remote software updates by car manufacturers, phone pairing, handsfree usage of phones. The cyber-physical (2) annotations are for ECUs that can legitimately interact with physical components and manipulate them, such as the parking assist and the remote keyless entry (RKE) systems. The RKE, for example, receives signals to make a physical impact on the car by locking/unlocking doors. Finally, physical components such as the engine or tires are physical (3).