Proceedings of the 7th ACM on Cyber-Physical System Security Workshop最新文献

Session details: Session 1: CPS Formalization and Protocols 会话详细信息:会话1:CPS形式化和协议

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3468024

N. Tippenhauer

引用次数: 0

You talkin' to me? Exploring Practical Attacks on Controller Pilot Data Link Communications 你在跟我说话?探索对控制器导频数据链路通信的实际攻击

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3457339.3457985

Joshua Smailes, Daniel Moser, Matthew Smith, Martin Strohmeier, Vincent Lenders, I. Martinovic

{"title":"You talkin' to me? Exploring Practical Attacks on Controller Pilot Data Link Communications","authors":"Joshua Smailes, Daniel Moser, Matthew Smith, Martin Strohmeier, Vincent Lenders, I. Martinovic","doi":"10.1145/3457339.3457985","DOIUrl":"https://doi.org/10.1145/3457339.3457985","url":null,"abstract":"Worldwide, voice-based Air Traffic Control (ATC) communications are gradually being replaced with data link-based equivalents, namely the Controller Pilot Data Link Communications (CPDLC) system. This helps to manage the high levels of congestion on voice-based ATC---under modern traffic levels these analog voice channels are extremely busy, especially at times of peak traffic. CPDLC offers the ability to conduct most ATC actions in the form of digital text-based messages. As with voice-based ATC, CPDLC has no built-in security mechanisms. Furthermore, the links which carry CPDLC do not have security mechanisms either. In this paper, we analyze the susceptibility of CPDLC to attacks by a software-defined radio (SDR)-equipped attacker. Crucially, this is different to attacks on aviation surveillance systems, as it requires the attacker to comply with a larger authentication protocol. We identify attacks on CPDLC, including a man-in-the-middle attack on the protocol. This attack enables a take-over of an aircraft's communication on an attacker-specified frequency, after which arbitrary CPDLC commands can be transmitted to the target without alerting the legitimate controller. We empirically assess the likely effectiveness of this attack through a data collection and analysis exercise. In order to counteract this type of attack, we propose three countermeasures of different complexities, including logical checks and a public key infrastructure approach. We also estimate to what extent these countermeasures can be implemented without altering the underlying protocol.","PeriodicalId":239758,"journal":{"name":"Proceedings of the 7th ACM on Cyber-Physical System Security Workshop","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-05-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124421845","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Session details: Session 2: Side-Channels in CPS 会话详细信息:会话2:CPS中的侧通道

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3468025

引用次数: 0

High we Fly: Wireless Witnessing and Crowdsourcing for Air-Traffic Communication Security 高空飞行:空中交通通信安全的无线见证和众包

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3457339.3457979

C. Pöpper

引用次数: 0

A Semantic Framework for Direct Information Flows in Hybrid-Dynamic Systems 混合动态系统中直接信息流的语义框架

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3457339.3457981

Sepehr Amir-Mohammadian

{"title":"A Semantic Framework for Direct Information Flows in Hybrid-Dynamic Systems","authors":"Sepehr Amir-Mohammadian","doi":"10.1145/3457339.3457981","DOIUrl":"https://doi.org/10.1145/3457339.3457981","url":null,"abstract":"Hybrid-dynamic models provide an underlying framework to study the evergrowing cyber-physical systems with an emphasis on the integration of their discrete computational steps and the associated continuous physical dynamics. Ubiquity of cyber-physical systems necessitates some level of assurance about the secure flow of information through different discrete and continuous components. In recent years, different logical frameworks have been proposed to analyze indirect information flows in cyber-physical systems. While these frameworks are used to verify secure flow of information in a metalevel, they naturally fall short in support of implementing information flow analyzers that could effectively enforce policies at runtime. This practical limitation has triggered the implementation of direct information flow analyzers in different language settings. In this paper, we focus on direct flows of information confidentiality in hybrid-dynamic environments and propose a semantic framework through which we can judge about such flows. This semantic framework can be used to study the correctness of enforced policies by these analyzers, and in particular taint tracking tools. In this regard, we specify a dynamic taint tracking policy for hybrid dynamic systems and prove its soundness based on the proposed semantic framework. As a case study, we consider the flow of information in a public transportation control system, and the effectiveness of our enforced policy on this system.","PeriodicalId":239758,"journal":{"name":"Proceedings of the 7th ACM on Cyber-Physical System Security Workshop","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-05-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122721992","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Towards Secure and Robust Autonomy Software in Autonomous Driving and Smart Transportation 在自动驾驶和智能交通中实现安全、稳健的自主软件

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3457339.3457978

Qi Alfred Chen

{"title":"Towards Secure and Robust Autonomy Software in Autonomous Driving and Smart Transportation","authors":"Qi Alfred Chen","doi":"10.1145/3457339.3457978","DOIUrl":"https://doi.org/10.1145/3457339.3457978","url":null,"abstract":"Autonomous Driving (AD) technology has always been an international pursuit due to its significant benefit in driving safety, efficiency, and mobility. Over 15 years after the first DARPA Grand Challenge, its development and deployment are becoming increasingly mature and practical, with some AD vehicles already providing services on public roads (e.g., Google Waymo One in Phoenix and Baidu Apollo Go in China). In AD technology, the autonomy software stack, or the AD software, is highly security critical: it is in charge of safety-critical driving decisions such as collision avoidance and lane keeping, and thus any security problems in it can directly impact road safety. In this talk, I will describe my recent research that initiates the first systematic effort towards understanding and addressing the security problems in production AD software. I will be focusing on two critical modules: perception and localization, and talk about how we are able to discover novel and practical sensor/physical-world attacks that can cause end-to-end safety impacts such as crashing into obstacles or driving off road. Besides AD software, I will also briefly talk about my recent research on autonomy software security in smart transportation in general, especially those enabled by Connected Vehicle (CV) technology. I will conclude with a discussion on defense and future research directions.","PeriodicalId":239758,"journal":{"name":"Proceedings of the 7th ACM on Cyber-Physical System Security Workshop","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-05-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128849655","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Session details: Session 3: Communication Security in CPS 会话详细信息:会话3:CPS中的通信安全

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3468026

引用次数: 0

Session details: Keynote Talks 会议详情:主题演讲

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3468023

引用次数: 0

Lightweight Delegated Authentication with Identity Fraud Detection for Cyber-physical Systems 基于信息物理系统身份欺诈检测的轻量级委托认证

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3457339.3457984

Zheng Yang, Chao Yin, Chenglu Jin, Jianting Ning, Jianying Zhou

引用次数: 0

MoveAR: Continuous Biometric Authentication for Augmented Reality Headsets MoveAR:用于增强现实耳机的连续生物识别认证

Proceedings of the 7th ACM on Cyber-Physical System Security Workshop Pub Date : 2021-05-24 DOI: 10.1145/3457339.3457983

Arman Bhalla, Ivo Sluganovic, Klaudia Krawiecka, I. Martinovic

{"title":"MoveAR: Continuous Biometric Authentication for Augmented Reality Headsets","authors":"Arman Bhalla, Ivo Sluganovic, Klaudia Krawiecka, I. Martinovic","doi":"10.1145/3457339.3457983","DOIUrl":"https://doi.org/10.1145/3457339.3457983","url":null,"abstract":"Augmented Reality (AR) headsets are rapidly coming to consumer and professional markets. The lack of traditional input interfaces for these devices motivates the need to research novel methods of achieving security primitives such as user authentication. Given the various inertial sensors that the headsets use to position users in their environment, we propose, investigate, and evaluate the potential for a continuous biometric authentication system based on the distinct ways in which people move their heads and interact with their virtual environments. We collect samples of the spatial and behavioural patterns from a group of users wearing an AR headset. Using this data, we propose a multitude of novel models and machine learning pipelines that learn the unique signature of AR users as they interact with the virtual environment and AR objects. We evaluate multiple supervised machine learning algorithms, including k-Nearest Neighbours, Random Forest, Support Vector Machine (SVM), and Bag of Symbolic-Fourier-Approximation Symbols (BOSS) for two different sets of input data and parameters. We achieve a balanced accuracy score of 92.675% and an EER of 11% using an Adaptive Boost Random Forest classifier together with our proposed series of novel, AR-specific preprocessing methods used on our current dataset. This demonstrates that it is indeed possible to profile and authenticate AR head-mounted display users based on their head movements and gestures.","PeriodicalId":239758,"journal":{"name":"Proceedings of the 7th ACM on Cyber-Physical System Security Workshop","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-05-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133523068","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8