Search

Network-based attacks on control systems may alter sensor data delivered to the controller, effectively causing degradation in control performance. As a result, having access to accurate state estimates, even in the presence of attacks on sensor measurements, is of critical importance. In this work, we analyze performance of resilient state estimators (RSEs) when any subset of sensors may be compromised by a stealthy attacker. Specifically, we consider systems with the well-known l 0 -based RSE and two commonly used sound intrusion detectors (IDs). For linear time-invariant plants with bounded noise, we define the notion of perfect attackability (PA) when attacks may result in unbounded estimation errors while remaining undetected by the employed ID (i.e., stealthy). We derive necessary and sufficient PA conditions, showing that a system can be perfectly attackable even if the plant is stable. While PA can be prevented with the use the standard cryptographic mechanisms (e.g., message authentication) that ensure data integrity under network-based attacks, their continuous use imposes significant communication and computational overhead. Consequently, we also study the impact that even intermittent use of data authentication has on RSE performance guarantees in the presence of stealthy attacks. We show that if messages from some of the sensors are even intermittently authenticated, stealthy attacks could not result in unbounded state estimation errors. [ABSTRACT FROM AUTHOR]

The design and implementation of software for medical devices is challenging due to the closed-loop interaction with the patient, which is a stochastic physical environment. The safety-critical nature and the lack of existing industry standards for verification make this an ideal domain for exploring applications of formal modeling and closed-loop analysis. The biggest challenge is that the environment model(s) have to be both complex enough to express the physiological requirements and general enough to cover all possible inputs to the device. In this effort, we use a dual chamber implantable pacemaker as a case study to demonstrate verification of software specifications of medical devices as timed-automata models in UPPAAL. The pacemaker model is based on the specifications and algorithm descriptions from Boston Scientific. The heart is modeled using timed automata based on the physiology of heart. The model is gradually abstracted with timed simulation to preserve properties. A manual Counter-Example-Guided Abstraction and Refinement (CEGAR) framework has been adapted to refine the heart model when spurious counter-examples are found. To demonstrate the closed-loop nature of the problem and heart model refinement, we investigated two clinical cases of Pacemaker Mediated Tachycardia and verified their corresponding correction algorithms in the pacemaker. Along with our tools for code generation from UPPAAL models, this effort enables model-driven design and certification of software for medical devices. [ABSTRACT FROM AUTHOR]

Electromagnetic jamming results in a loss of link reliability, increased energy consumption and packet delays. In the context of energy-constrained wireless networks, nodes are scheduled to maximize the common sleep duration and coordinate communication to extend their battery life. This coordination results in statistical and predictable activity patterns that may be easily detected and jammed. To eliminate spatio-temporal patterns of communication in the link and network layers, we present WisperNet, an energy-efficient anti-jamming protocol.WisperNet employs hardware-based time synchronization and lightweight cryptographic hashing for coordinated temporal randomization of slot schedules at the link layer and adapts routes to avoid static jammers in the network layer.We demonstrate thatWisperNet reduces the efficiency of any statistical jammer to that of a random jammer, which has the lowest censorship-to-link utilization ratio. In the presence of a statistical jammer, WisperNet provides sub-2% packet drop ratios for link utilization up to 50%. In addition, the jammer's censorship efficiency is linear with link utilization as it is unable to extract any communication patterns. WisperNet is more efficient than low-power CSMA protocols in terms of energy, effective network throughput, reliability and delay. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) technologies enable development of reconfigurable manufacturing systems—a new generation of modularized industrial equipment suitable for highly customized manufacturing. Sequential control in these systems is largely based on discrete events, whereas their formal execution semantics is specified as control interpreted Petri nets (CIPN). Despite industry-wide use of programming languages based on the CIPN formalism, formal verification of such control applications in the presence of adversarial activity is not supported. Consequently, in this article, we introduce security-aware modeling and verification techniques for CIPN-based sequential control applications. Specifically, we show how CIPN models of networked industrial IoT controllers can be transformed into time Petri net (TPN)-based models and composed with plant and security-aware channel models in order to enable system-level verification of safety properties in the presence of network-based attacks. Additionally, we introduce realistic channel-specific attack models that capture adversarial behavior using nondeterminism. Moreover, we show how verification results can be utilized to introduce security patches and facilitate design of attack detectors that improve system resiliency and enable satisfaction of critical safety properties. Finally, we evaluate our framework on an industrial case study. Note to Practitioners—Our main goal is to provide formal security guarantees for distributed sequential controllers. Specifically, we target smart automation controllers geared toward Industrial IoT applications that are typically programed in C/C++ and are running applications originally designed in, for example, GRAFCET (IEC 60848)/SFC (IEC 61131-3) automation programming languages. Since existing tools for the design of distributed automation do not support system-level verification of relevant safety properties, we show how security-aware transceiver and communication models can be developed and composed with distributed controller models. Then, we show how existing tools for verification of time Petri nets can be used to verify relevant properties including safety and liveness of the distributed automation system in the presence of network-based attacks. To provide an end-to-end analysis as well as security patching, results of our analysis can be used to deploy suitable firmware updates during the stage when executable code for target controllers (e.g., in C/C++) is generated based on GRAFCET/SFC control models. We also show that security guarantees can be improved as the relevant safety/liveness properties can be verified after corresponding security patches are deployed. Finally, we show applicability of our framework on a realistic distributed pneumatic manipulator. [ABSTRACT FROM AUTHOR]

The growing complexity of modern Cyber–Physical Systems (CPS) and the frequent communication between their components make them vulnerable to malicious attacks. As a result, secure state estimation is a critical requirement for the control of these systems. Many existing secure state estimation methods suffer from combinatorial complexity which grows with the number of states and sensors in the system. This complexity can be mitigated using optimization-based methods that relax the original state estimation problem, although at the cost of optimality as these methods often identify attack-free sensors as attacked. In this paper, we propose a new optimal graph-search algorithm to correctly identify malicious attacks and to securely estimate the states even in large-scale CPS modeled as linear time-invariant systems The graph consists of layers, each one containing two nodes capturing a truth assignment of any given sensor, and directed edges connecting adjacent layers only. Then, our algorithm searches the layers of this graph incrementally, favoring directions at higher layers with more attack-free assignments, while actively managing a repository of nodes to be expanded at later iterations. The proposed search bias and the ability to revisit nodes in the repository and self-correct, allow our graph-search algorithm to reach the optimal assignment faster and tackle larger problems. We show that our algorithm is complete and optimal provided that process and measurement noises do not dominate the attack signal. Moreover, we provide numerical simulations that demonstrate the ability of our algorithm to correctly identify attacked sensors and securely reconstruct the state. Our simulations show that our method outperforms existing algorithms both in terms of optimality and execution time. [ABSTRACT FROM AUTHOR]

Continuous deep brain stimulation (cDBS) of the subthalamic nucleus (STN) or globus pallidus is an effective treatment for the motor symptoms of Parkinson's disease. The relative benefit of one region over the other is of great interest but cannot usually be compared in the same patient. Simultaneous DBS of both regions may synergistically increase the therapeutic benefit. Continuous DBS is limited by a lack of responsiveness to dynamic, fluctuating symptoms intrinsic to the disease. Adaptive DBS (aDBS) adjusts stimulation in response to biomarkers to improve efficacy, side effects, and efficiency. We combined bilateral DBS of both STN and globus pallidus (dual target DBS) in a prospective within-participant, clinical trial in six patients with Parkinson's disease (n = 6, 55–65 years, n = 2 females). Dual target cDBS was tested for Parkinson's disease symptom control annually over 2 years, measured by motor rating scales, on time without dyskinesia, and medication reduction. Random amplitude experiments probed system dynamics to estimate parameters for aDBS. We then implemented proportional-plus-integral aDBS using a novel distributed (off-implant) architecture. In the home setting, we collected tremor and dyskinesia scores as well as individualized β and DBS amplitudes. Dual target cDBS reduced motor symptoms as measured by Unified Parkinson's Disease Rating Scale (UPDRS) to a greater degree than either region alone (P < 0.05, linear mixed model) in the cohort. The amplitude of β-oscillations in the STN correlated to the speed of hand grasp movements for five of six participants (P < 0.05, Pearson correlation). Random amplitude experiments provided insight into temporal windowing to avoid stimulation artefacts and demonstrated a correlation between STN β amplitude and DBS amplitude. Proportional plus integral control of aDBS reduced average power, while preserving UPDRS III scores in the clinic (P = 0.28, Wilcoxon signed rank), and tremor and dyskinesia scores during blinded testing at home (n = 3 , P > 0.05, Wilcoxon ranked sum). In the home setting, DBS power reductions were slight but significant. Dual target cDBS may offer an improvement in treatment of motor symptoms of Parkinson's disease over DBS of either the STN or globus pallidus alone. When combined with proportional plus integral aDBS, stimulation power may be reduced, while preserving the increased benefit of dual target DBS. [ABSTRACT FROM AUTHOR]

A digital microfluidic biochip (DMFB) enables miniaturization of immunoassays, point-of-care clinical diagnostics, and DNA sequencing. A recent generation of DMFBs uses a micro-electrode-dot-array (MEDA) architecture, which provides fine-grained control of droplets and real-time droplet sensing using the CMOS technology. However, microelectrodes in a MEDA biochip degrade when they are charged and discharged frequently during bioassay execution. In this article, we first make the key observation that the droplet-sensing operations contribute up to 94% of all microelectrode actuation in MEDA. Consequently, to reduce the number of droplet-sensing operations, we present a new microelectrode cell (MC) design as well as a selective-sensing method such that only a small fraction of microelectrodes perform droplet sensing during bioassay execution. The selection of microelectrodes that need to perform the droplet sensing is based on an analysis of experimental data. A comprehensive set of simulation results show that the total number of droplet-sensing operations is reduced to only 0.7%, which prolongs the lifespan of a MEDA biochip by $11\times $ without any impact on bioassay time-to-response. [ABSTRACT FROM AUTHOR]

In this paper, we establish a zero-sum, hybrid state stochastic game model for designing defense policies for cyber-physical systems against different types of attacks. With the increasingly integrated properties of cyber-physical systems (CPS) today, security is a challenge for critical infrastructures. Though resilient control and detecting techniques for a specific model of attack have been proposed, to analyze and design detection and defense mechanisms against multiple types of attacks for CPSs requires new system frameworks. Besides security, other requirements such as optimal control cost also need to be considered. The hybrid game model we propose contains physical states that are described by the system dynamics, and a cyber state that represents the detection mode of the system composed by a set of subsystems. A strategy means selecting a subsystem by combining one controller, one estimator and one detector among a finite set of candidate components at each state. Based on the game model, we propose a suboptimal value iteration algorithm for a finite horizon game, and prove that the algorithm results an upper bound for the value of the finite horizon game. A moving-horizon approach is also developed in order to provide a scalable and real-time computation of the switching strategies. Both algorithms aim at obtaining a saddle-point equilibrium policy for balancing the system’s security overhead and control cost. The paper illustrates these concepts using numerical examples, and we compare the results with previously system designs that only equipped with one type of controller. [ABSTRACT FROM AUTHOR]

A digital microfluidic biochip (DMFB) enables the miniaturization of immunoassays, point-of-care clinical diagnostics, and DNA sequencing. A recent generation of DMFBs uses a microelectrode-dot-array (MEDA) architecture, which provides fine-grained control of droplets and real-time droplet sensing using CMOS technology. However, microelectrodes in a MEDA biochip can degrade due to charge trapping when they are repeatedly charged and discharged during bioassay execution; such degradation leads to the failure of microelectrodes and erroneous bioassay outcomes. To address this problem, we first introduce a new microelectrode-cell design such that we can obtain the health status of all the microelectrodes in a MEDA biochip by employing the inherent sensing mechanism. Next, we present a stochastic game-based model for droplet manipulation, and a formal synthesis method for droplet routing that can dynamically change droplet transportation routes. This adaptation is based on the real-time health information obtained from microelectrodes. Comprehensive simulation results for four real-life bioassays show that our method increases the likelihood of successful bioassay completion with negligible impact on time-to-results. [ABSTRACT FROM AUTHOR]

A digital microfluidic biochip (DMFB) is an attractive technology platform for automating laboratory procedures in biochemistry. In recent years, DMFBs based on a micro-electrode-dot-array (MEDA) architecture have been proposed. MEDA biochips can provide advantages of better capability of droplet manipulation and real-time sensing ability. However, errors are likely to occur due to defects, chip degradation, and the lack of precision inherent in biochemical experiments. Therefore, an efficient error-recovery strategy is essential to ensure the correctness of assays executed on MEDA biochips. By exploiting MEDA-specific advances in droplet sensing, we present a novel error-recovery technique to dynamically reconfigure the biochip using real-time data provided by on-chip sensors. Local recovery strategies based on probabilistic-timed-automata are presented for various types of errors. An online synthesis technique and a control flow are also proposed to connect local-recovery procedures with global error recovery for the complete bioassay. Moreover, an integer linear programming-based method is also proposed to select the optimal local-recovery time for each operation. Laboratory experiments using a fabricated MEDA chip are used to characterize the outcomes of key droplet operations. The PRISM model checker and three benchmarks are used for an extensive set of simulations. Our results highlight the effectiveness of the proposed error-recovery strategy. [ABSTRACT FROM PUBLISHER]