Detection of replay attacks in cyber-physical systems using a frequency-based signature

This paper proposes a frequency-based approach for the detection of replay attacks affecting cyber-physical systems (CPS). In particular, the method employs a sinusoidal signal with a time-varying frequency (authentication signal) into the closed-loop system and checks whether the time profile of the frequency components in the output signal are compatible with the authentication signal or not. In order to carry out this target, the couplings between inputs and outputs are eliminated using a dynamic decoupling technique based on vector fitting. In this way, a signature introduced on a specific input channel will affect only the output that is selected to be associated with that input, which is a property that can be exploited to determine which channels are being affected. A bank of band-pass filters is used to generate signals whose energies can be compared to reconstruct an estimation of the time-varying frequency profile. By matching the known frequency profile with its estimation, the detector can provide the information about whether a replay attack is being carried out or not. The design of the signal generator and the detector are thoroughly discussed, and an example based on a quadruple-tank process is used to show the application and effectiveness of the proposed method.Peer ReviewedPostprint (author's final draft

Attack Resilience and Recovery using Physical Challenge Response Authentication for Active Sensors Under Integrity Attacks

Embedded sensing systems are pervasively used in life- and security-critical systems such as those found in airplanes, automobiles, and healthcare. Traditional security mechanisms for these sensors focus on data encryption and other post-processing techniques, but the sensors themselves often remain vulnerable to attacks in the physical/analog domain. If an adversary manipulates a physical/analog signal prior to digitization, no amount of digital security mechanisms after the fact can help. Fortunately, nature imposes fundamental constraints on how these analog signals can behave. This work presents PyCRA, a physical challenge-response authentication scheme designed to protect active sensing systems against physical attacks occurring in the analog domain. PyCRA provides security for active sensors by continually challenging the surrounding environment via random but deliberate physical probes. By analyzing the responses to these probes, and by using the fact that the adversary cannot change the underlying laws of physics, we provide an authentication mechanism that not only detects malicious attacks but provides resilience against them. We demonstrate the effectiveness of PyCRA through several case studies using two sensing systems: (1) magnetic sensors like those found wheel speed sensors in robotics and automotive, and (2) commercial RFID tags used in many security-critical applications. Finally, we outline methods and theoretical proofs for further enhancing the resilience of PyCRA to active attacks by means of a confusion phase---a period of low signal to noise ratio that makes it more difficult for an attacker to correctly identify and respond to PyCRA's physical challenges. In doing so, we evaluate both the robustness and the limitations of PyCRA, concluding by outlining practical considerations as well as further applications for the proposed authentication mechanism.Comment: Shorter version appeared in ACM ACM Conference on Computer and Communications (CCS) 201

Detecting Current Noise with a Josephson Junction in the Macroscopic Quantum Tunneling Regime

We discuss the use of a hysteretic Josephson junction to detect current fluctuations with frequencies below the plasma frequency of the junction. These adiabatic fluctuations are probed by switching measurements observing the noise-affected average rate of macroscopic quantum tunneling of the detector junction out of its zero-voltage state. In a proposed experimental scheme, frequencies of the noise are limited by an on-chip filtering circuit. The third cumulant of current fluctuations at the detector is related to an asymmetry of the switching rates.Comment: 26 pages, 10 figures. To appear in Journal of Low Temperature Physics in the proceedings of the ULTI conference organized in Lammi, Finland (2006

Towards energy-autonomous wake-up receiver using visible light communication

The use of Visible Light Communication (VLC) in wake-up communication systems is a potential energy-efficient and low-cost solution for wireless communication of consumer electronics. In this paper, we go one step further and propose the use of visible light both for wake-up communication and energy harvesting purposes, with the final objective of an energy-autonomous wake-up receiver module. We first present the details and the design criteria of this novel system. We then present the results of evaluation of design criteria such as solar panel and capacitor type choices. To evaluate the performance of the developed wake-up system with energy-autonomous receiver system, we perform realistic indoor scenario tests, analyzing the effect of varying distances, angles, and light intensities as well as the effect of presence of interfering lights.Peer ReviewedPostprint (author's final draft

Micromechanical resonator driven by radiation pressure force

Radiation pressure exerted by light on any surface is the pressure generated by the momentum of impinging photons. The associated force - fundamentally, a quantum mechanical aspect of light - is usually too small to be useful, except in large-scale problems in astronomy and astrodynamics. In atomic and molecular optics, radiation pressure can be used to trap or cool atoms and ions. Use of radiation pressure on larger objects such as micromechanical resonators has been so far limited to its coupling to an acoustic mode, sideband cooling, or levitation of microscopic objects. In this Letter, we demonstrate direct actuation of a radio-frequency micromechanical plate-type resonator by the radiation pressure force generated by a standard laser diode at room temperature. Using two independent methods, the magnitude of the resonator's response to forcing by radiation pressure is found to be proportional to the intensity of the incident light.https://www.nature.com/articles/s41598-017-16063-4.epdfPublished versio

Detecting and Estimating Signals in Noisy Cable Structures, II: Information Theoretical Analysis

This is the second in a series of articles that seek to recast classical single-neuron biophysics in information-theoretical terms. Classical cable theory focuses on analyzing the voltage or current attenuation of a synaptic signal as it propagates from its dendritic input location to the spike initiation zone. On the other hand, we are interested in analyzing the amount of information lost about the signal in this process due to the presence of various noise sources distributed throughout the neuronal membrane. We use a stochastic version of the linear one-dimensional cable equation to derive closed-form expressions for the second-order moments of the fluctuations of the membrane potential associated with different membrane current noise sources: thermal noise, noise due to the random opening and closing of sodium and potassium channels, and noise due to the presence of “spontaneous” synaptic input. We consider two different scenarios. In the signal estimation paradigm, the time course of the membrane potential at a location on the cable is used to reconstruct the detailed time course of a random, band-limited current injected some distance away. Estimation performance is characterized in terms of the coding fraction and the mutual information. In the signal detection paradigm, the membrane potential is used to determine whether a distant synaptic event occurred within a given observation interval. In the light of our analytical results, we speculate that the length of weakly active apical dendrites might be limited by the information loss due to the accumulated noise between distal synaptic input sites and the soma and that the presence of dendritic nonlinearities probably serves to increase dendritic information transfer

A `bright zone' in male hoverfly (Eristalis tenax) eyes and associated faster motion detection and increased contrast sensitivity

Eyes of the hoverfly Eristalis tenax are sexually dimorphic such that males have a fronto-dorsal region of large facets. In contrast to other large flies in which large facets are associated with a decreased interommatidial angle to form a dorsal `acute zone' of increased spatial resolution, we show that a dorsal region of large facets in males appears to form a `bright zone' of increased light capture without substantially increased spatial resolution. Theoretically, more light allows for increased performance in tasks such as motion detection. To determine the effect of the bright zone on motion detection, local properties of wide field motion detecting neurons were investigated using localized sinusoidal gratings. The pattern of local preferred directions of one class of these cells, the HS cells, in Eristalis is similar to that reported for the blowfly Calliphora. The bright zone seems to contribute to local contrast sensitivity; high contrast sensitivity exists in portions of the receptive field served by large diameter facet lenses of males and is not observed in females. Finally, temporal frequency tuning is also significantly faster in this frontal portion of the world, particularly in males, where it overcompensates for the higher spatial-frequency tuning and shifts the predicted local velocity optimum to higher speeds. These results indicate that increased retinal illuminance due to the bright zone of males is used to enhance contrast sensitivity and speed motion detector responses. Additionally, local neural properties vary across the visual world in a way not expected if HS cells serve purely as matched filters to measure yaw-induced visual motion

Integrated 2-D Optical Flow Sensor

I present a new focal-plane analog VLSI sensor that estimates optical flow in two visual dimensions. The chip significantly improves previous approaches both with respect to the applied model of optical flow estimation as well as the actual hardware implementation. Its distributed computational architecture consists of an array of locally connected motion units that collectively solve for the unique optimal optical flow estimate. The novel gradient-based motion model assumes visual motion to be translational, smooth and biased. The model guarantees that the estimation problem is computationally well-posed regardless of the visual input. Model parameters can be globally adjusted, leading to a rich output behavior. Varying the smoothness strength, for example, can provide a continuous spectrum of motion estimates, ranging from normal to global optical flow. Unlike approaches that rely on the explicit matching of brightness edges in space or time, the applied gradient-based model assures spatiotemporal continuity on visual information. The non-linear coupling of the individual motion units improves the resulting optical flow estimate because it reduces spatial smoothing across large velocity differences. Extended measurements of a 30x30 array prototype sensor under real-world conditions demonstrate the validity of the model and the robustness and functionality of the implementation

Bridge damage detection based on vibration data: past and new developments

Overtime, bridge condition declines due to a number of degradation processes such as creep, corrosion, and cyclic loading, among others. Traditionally, vibration-based damage detection techniques in bridges have focused on monitoring changes to modal parameters. These techniques can often suffer to their sensitivity to changes in environmental and operational conditions, mistaking them as structural damage. Recent research has seen the emergence of more advanced computational techniques that not only allow the assessment of noisier and more complex data but also allow research to veer away from monitoring changes in modal parameters alone. This paper presents a review of the current state-of-the-art developments in vibration-based damage detection in small to medium span bridges with particular focus on the utilization of advanced computational methods that avoid traditional damage detection pitfalls. A case study based on the S101 bridge is also presented to test the damage sensitivity to a chosen methodology.Peer ReviewedPostprint (published version