Towards Provable Security in Industrial Control Systems Via Dynamic Protocol Attestation

Arthur Amorim,Trevor Kann,Max Taylor,Lance Joneckis

2024-12-19

Abstract:Industrial control systems (ICSs) increasingly rely on digital technologies vulnerable to cyber attacks. Cyber attackers can infiltrate ICSs and execute malicious actions. Individually, each action seems innocuous. But taken together, they cause the system to enter an unsafe state. These attacks have resulted in dramatic consequences such as physical damage, economic loss, and environmental catastrophes. This paper introduces a methodology that restricts actions using protocols. These protocols only allow safe actions to execute. Protocols are written in a domain specific language we have embedded in an interactive theorem prover (ITP). The ITP enables formal, machine-checked proofs to ensure protocols maintain safety properties. We use dynamic attestation to ensure ICSs conform to their protocol even if an adversary compromises a component. Since protocol conformance prevents unsafe actions, the previously mentioned cyber attacks become impossible. We demonstrate the effectiveness of our methodology using an example from the Fischertechnik Industry 4.0 platform. We measure dynamic attestation's impact on latency and throughput. Our approach is a starting point for studying how to combine formal methods and protocol design to thwart attacks intended to cripple ICSs.

Cryptography and Security,Formal Languages and Automata Theory,Logic in Computer Science,Programming Languages

What problem does this paper attempt to address?

This paper attempts to solve the cybersecurity problems faced by industrial control systems (ICS). Specifically, it aims to ensure the behavioral security of ICS through Dynamic Protocol Attestation and prevent malicious RPC (Remote Procedure Call) from causing the system to enter an unsafe state.

### Problem Background

With the development of "Industry 4.0", ICS increasingly rely on digital technologies that are vulnerable to cyber - attacks. Attackers can infiltrate into ICS and perform malicious operations that seem harmless but can cumulatively cause the system to enter an unsafe state. These attacks may lead to physical damage, economic losses and environmental disasters. For example, the Stuxnet worm used malicious commands to destroy centrifuges, and a similar attack in 2014 severely damaged the blast furnaces in a steel plant.

### The Method Proposed in the Paper

To solve the above problems, the paper introduces a method based on protocol - restricted behavior. The core ideas of this method are:

1. **Define Communication Protocols**: Write protocols using Domain - Specific Languages (DSL), which only allow the execution of safe operations.
2. **Formal Verification**: Utilize Interactive Theorem Provers (ITP), such as F*, to perform formal verification on the protocols to ensure that the protocols conform to security properties.
3. **Dynamic Protocol Verification**: Ensure that ICS follows its protocols through dynamic protocol verification at runtime, and prevent the occurrence of unsafe behaviors even if some components are controlled by attackers.

### Main Contributions

- Propose a new methodology for developing ICS software, which can use F* to construct new communication protocols and prove that these protocols maintain key security invariants.
- Provide automated tools to extract RPC framework inputs from F* and generate the code required to implement the protocols.
- Demonstrate how to use dynamic protocol verification to reduce the verification burden.
- Provide experimental results to show the potential of this method. Although dynamic verification checks will increase a moderate overhead, it is acceptable in many applications.

### Problems Solved

The paper mainly solves the following problems:
- How to prevent malicious RPC in ICS from causing the system to enter an unsafe state.
- How to combine formal methods and protocol design to prevent attacks aimed at destroying ICS.
- How to ensure the security and reliability of ICS without affecting system performance.

Through these methods, the paper provides an effective and reliable solution to the cybersecurity challenges faced by ICS.