Quantifying DDS-cerberus Network Control Overhead

Securing distributed device communication is critical because the private industry and the military depend on these resources. One area that adversaries target is the middleware, which is the medium that connects different systems. This paper evaluates a novel security layer, DDS-Cerberus (DDS-C), that protects in-transit data and improves communication efficiency on data-first distribution systems. This research contributes a distributed robotics operating system testbed and designs a multifactorial performance-based experiment to evaluate DDS-C efficiency and security by assessing total packet traffic generated in a robotics network. The performance experiment follows a 2:1 publisher to subscriber node ratio, varying the number of subscribers and publisher nodes from three to eighteen. By categorizing the network traffic from these nodes into either data message, security, or discovery+ with Quality of Service (QoS) best effort and reliable, the mean security traffic from DDS-C has minimal impact to Data Distribution Service (DDS) operations compared to other network traffic. The results reveal that applying DDS-C to a representative distributed network robotics operating system network does not impact performance

Distribution of DDS-cerberus Authenticated Facial Recognition Streams

Successful missions in the field often rely upon communication technologies for tactics and coordination. One middleware used in securing these communication channels is Data Distribution Service (DDS) which employs a publish-subscribe model. However, researchers have found several security vulnerabilities in DDS implementations. DDS-Cerberus (DDS-C) is a security layer implemented into DDS to mitigate impersonation attacks using Kerberos authentication and ticketing. Even with the addition of DDS-C, the real-time message sending of DDS also needs to be upheld. This paper extends our previous work to analyze DDS-C’s impact on performance in a use case implementation. The use case covers an artificial intelligence (AI) scenario that connects edge sensors across a commercial network. Specifically, it characterizes how DDS-C performs between unmanned aerial vehicles (UAV), the cloud, and video streams for facial recognition. The experiments send a set number of video frames over the network using DDS to be processed by AI and displayed on a screen. An evaluation of network traffic using DDS-C revealed that it was not statistically significant compared to DDS for the majority of the configuration runs. The results demonstrate that DDS-C provides security benefits without significantly hindering the overall performance

TrustZone based attestation in secure runtime verification for embedded systems

Dissertação de mestrado integrado em Engenharia InformáticaARM TrustZone é um “Ambiente de Execução Confiável” disponibilizado em processadores da ARM, que equipam grande parte dos sistemas embebidos. Este mecanismo permite assegurar que componentes críticos de uma aplicação executem num ambiente que garante a confidencialidade dos dados e integridade do código, mesmo que componentes maliciosos estejam instalados no mesmo dispositivo. Neste projecto pretende-se tirar partido do TrustZone no contexto de uma framework segura de monitorização em tempo real de sistemas embebidos. Especificamente, pretende-se recorrer a components como o ARM Trusted Firmware, responsável pelo processo de secure boot em sistemas ARM, para desenvolver um mecanismo de atestação que providencie garantias de computação segura a entidades remotas.ARM TrustZone is a security extension present on ARM processors that enables the development of hardware based Trusted Execution Environments (TEEs). This mechanism allows the critical components of an application to execute in an environment that guarantees data confidentiality and code integrity, even when a malicious agent is installed on the device. This projects aims to harness TrustZone in the context of a secure runtime verification framework for embedded devices. Specifically, it aims to harness existing components, namely ARM Trusted Firmware, responsible for the secure boot process of ARM devices, to implement an attestation mechanism that provides proof of secure computation to remote parties.This work has been partially supported by the Portuguese Foundation for Science and Technology (FCT), project REASSURE (PTDC/EEI-COM/28550/2017), co-financed by the European Regional Development Fund (FEDER), through the North Regional Operational Program (NORTE 2020)

Co-design of Security Aware Power System Distribution Architecture as Cyber Physical System

The modern smart grid would involve deep integration between measurement nodes, communication systems, artificial intelligence, power electronics and distributed resources. On one hand, this type of integration can dramatically improve the grid performance and efficiency, but on the other, it can also introduce new types of vulnerabilities to the grid. To obtain the best performance, while minimizing the risk of vulnerabilities, the physical power system must be designed as a security aware system. In this dissertation, an interoperability and communication framework for microgrid control and Cyber Physical system enhancements is designed and implemented taking into account cyber and physical security aspects. The proposed data-centric interoperability layer provides a common data bus and a resilient control network for seamless integration of distributed energy resources. In addition, a synchronized measurement network and advanced metering infrastructure were developed to provide real-time monitoring for active distribution networks. A hybrid hardware/software testbed environment was developed to represent the smart grid as a cyber-physical system through hardware and software in the loop simulation methods. In addition it provides a flexible interface for remote integration and experimentation of attack scenarios. The work in this dissertation utilizes communication technologies to enhance the performance of the DC microgrids and distribution networks by extending the application of the GPS synchronization to the DC Networks. GPS synchronization allows the operation of distributed DC-DC converters as an interleaved converters system. Along with the GPS synchronization, carrier extraction synchronization technique was developed to improve the system’s security and reliability in the case of GPS signal spoofing or jamming. To improve the integration of the microgrid with the utility system, new synchronization and islanding detection algorithms were developed. The developed algorithms overcome the problem of SCADA and PMU based islanding detection methods such as communication failure and frequency stability. In addition, a real-time energy management system with online optimization was developed to manage the energy resources within the microgrid. The security and privacy were also addressed in both the cyber and physical levels. For the physical design, two techniques were developed to address the physical privacy issues by changing the current and electromagnetic signature. For the cyber level, a security mechanism for IEC 61850 GOOSE messages was developed to address the security shortcomings in the standard

Современные методы обеспечения целостности данных в протоколах управления киберфизических систем

At present, the problem of creating methodological security of cyberphysical systems, in particular, the design and implementation of information security subsystems is acute. At the same time, the landscape of threats and vulnerabilities typical for a wide range of hardware and software technologies used in cyberphysical systems is extremely wide and complex. In this context, the security of application layer protocols is of paramount importance, as these protocols are the basis for interaction between applications and services running on different devices, as well as in cloud infrastructures. With the constant interaction of the systems under study with the real physical infrastructure, the challenge is to determine effective measures to ensure the integrity of the transferred control commands, as disruption of the performed critical processes can affect human life and health. The paper provides an analytical review of the main methods of data integrity assurance in management protocol of cyberphysical systems, as well as an overview of application layer protocols vulnerabilities widely used in cyberphysical systems of different types. Classical methods of data integrity assurance, new methods, in particular, blockchain, as well as the main directions of increasing the efficiency of data integrity protocols in cyberphysical systems are considered. Analysis of application layer vulnerabilities is carried out on the example of the most popular MQTT, CoAP, AMQP, DDS, XMPP specifications and their implementations. It is established that despite the presence of basic security mechanisms in all these protocols, researchers continue to regularly identify vulnerabilities in popular implementations, that often endangers critical infrastructure services. In the course of preparing the review of the existing methods of data integrity assurance for the examined class of systems, the key problems of these methods integration and ways of their solution were defined.В настоящее время остро стоит проблема создания методологического обеспечения безопасности киберфизических систем, в частности проектирования и реализации подсистем информационной безопасности. При этом ландшафт угроз и уязвимостей, характерных для применяемого в киберфизических системах широкого спектра аппаратных и программных технологий, чрезвычайно широк и сложен. В этом контексте безопасность протоколов прикладного уровня имеет первостепенное значение, поскольку эти протоколы лежат в основе взаимодействия между приложениями и службами, работающими на различных устройствах, а также в облачных инфраструктурах. В условиях постоянного взаимодействия исследуемых систем с реальной физической инфраструктурой актуальна проблема определения эффективных мер по обеспечению целостности передаваемых команд управления, поскольку нарушение выполняемых критически важных процессов может затрагивать жизнь и здоровье людей. Представлен обзор основных методов обеспечения целостности данных в протоколах управления киберфизических систем, а также обзор уязвимостей протоколов прикладного уровня, широко используемых в различных киберфизических системах. Рассмотрены классические методы обеспечения целостности и новые методы, в частности блокчейн, а также основные направления повышения эффективности протоколов обеспечения целостности данных в киберфизических системах. Анализ уязвимостей прикладного уровня проведен на примере наиболее популярных спецификаций MQTT, CoAP, AMQP, DDS, XMPP, а также их реализаций. Установлено, что несмотря на наличие во всех перечисленных протоколах базовых механизмов обеспечения безопасности, исследователи продолжают регулярно выявлять уязвимости в популярных реализациях, что зачастую ставит под угрозу сервисы критической инфраструктуры. В ходе подготовки обзора существующих методов обеспечения целостности данных для исследуемого класса систем были определены ключевые проблемы интеграции этих методов и способы их решения

Optimal and Secure Electricity Market Framework for Market Operation of Multi-Microgrid Systems

Traditional power systems were typically based on bulk energy services by large utility companies. However, microgrids and distributed generations have changed the structure of modern power systems as well as electricity markets. Therefore, restructured electricity markets are needed to address energy transactions in modern power systems. In this dissertation, we developed a hierarchical and decentralized electricity market framework for multi-microgrid systems, which clears energy transactions through three market levels; Day-Ahead-Market (DAM), Hour-Ahead-Market (HAM) and Real-Time-Market (RTM). In this market, energy trades are possible between all participants within the microgrids as well as inter-microgrids transactions. In this approach, we developed a game-theoretic-based double auction mechanism for energy transactions in the DAM, while HAM and RTM are cleared by an optimization algorithm and reverse action mechanism, respectively. For data exchange among market players, we developed a secure data-centric communication approach using the Data Distribution Service. Results demonstrated that this electricity market could significantly reduce the energy price and dependency of the multi-microgrid area on the external grid. Furthermore, we developed and verified a hierarchical blockchain-based energy transaction framework for a multi-microgrid system. This framework has a unique structure, which makes it possible to check the feasibility of energy transactions from the power system point of view by evaluating transmission system constraints. The blockchain ledger summarization, microgrid equivalent model development, and market players’ security and privacy enhancement are new approaches to this framework. The research in this dissertation also addresses some ancillary services in power markets such as an optimal power routing in unbalanced microgrids, where we developed a multi-objective optimization model and verified its ability to minimize the power imbalance factor, active power losses and voltage deviation in an unbalanced microgrid. Moreover, we developed an adaptive real-time congestion management algorithm to mitigate congestions in transmission systems using dynamic thermal ratings of transmission lines. Results indicated that the developed algorithm is cost-effective, fast, and reliable for real-time congestion management cases. Finally, we completed research about the communication framework and security algorithm for IEC 61850 Routable GOOSE messages and developed an advanced protection scheme as its application in modern power systems

Demystifying Internet of Things Security

Break down the misconceptions of the Internet of Things by examining the different security building blocks available in Intel Architecture (IA) based IoT platforms. This open access book reviews the threat pyramid, secure boot, chain of trust, and the SW stack leading up to defense-in-depth. The IoT presents unique challenges in implementing security and Intel has both CPU and Isolated Security Engine capabilities to simplify it. This book explores the challenges to secure these devices to make them immune to different threats originating from within and outside the network. The requirements and robustness rules to protect the assets vary greatly and there is no single blanket solution approach to implement security. Demystifying Internet of Things Security provides clarity to industry professionals and provides and overview of different security solutions What You'll Learn Secure devices, immunizing them against different threats originating from inside and outside the network Gather an overview of the different security building blocks available in Intel Architecture (IA) based IoT platforms Understand the threat pyramid, secure boot, chain of trust, and the software stack leading up to defense-in-depth Who This Book Is For Strategists, developers, architects, and managers in the embedded and Internet of Things (IoT) space trying to understand and implement the security in the IoT devices/platforms

The Complete Reference (Volume 4)

This is the fourth volume of the successful series Robot Operating Systems: The Complete Reference, providing a comprehensive overview of robot operating systems (ROS), which is currently the main development framework for robotics applications, as well as the latest trends and contributed systems. The book is divided into four parts: Part 1 features two papers on navigation, discussing SLAM and path planning. Part 2 focuses on the integration of ROS into quadcopters and their control. Part 3 then discusses two emerging applications for robotics: cloud robotics, and video stabilization. Part 4 presents tools developed for ROS; the first is a practical alternative to the roslaunch system, and the second is related to penetration testing. This book is a valuable resource for ROS users and wanting to learn more about ROS capabilities and features.info:eu-repo/semantics/publishedVersio