A non-intrusive runtime enforcement on behaviors of open supervisory control and data acquisition systems

被引:2
作者
Mao, Yan-Fang [1 ,2 ]
Zhang, Yang [1 ]
Chen, Jun-Liang [1 ]
机构
[1] Beijing Univ Posts & Telecommun, State Key Lab Networking & Switching Technol, Beijing 100876, Peoples R China
[2] Zhengzhou Univ Light Ind, Software Engn Coll, Zhengzhou, Peoples R China
基金
中国国家自然科学基金; 中国博士后科学基金;
关键词
Supervisory control and data acquisition; Internet of things service; runtime monitoring; runtime enforcement; semantic reconstruction;
D O I
10.1177/1550147716664231
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
With the development of Web-based services and related technologies, today's supervisory control and data acquisition is regarded as an Internet of things service system for industrial infrastructures and ensuring open supervisory control and data acquisition systems in a secure and safe state at runtime becomes a critical and mandatory requirement. Existing host-based monitoring automata are vulnerable because "inside" malware may compromise and subvert the monitoring mechanism itself, and the virtual machine-based monitoring cannot provide observable running traces of the protected services because of the isolation between these services and the runtime monitor. In this article, we propose a non-intrusive solution to guarantee runtime state of open supervisory control and data acquisition systems. In this solution, the running traces of protected services are obtained in an "out-of-box" framework, which is built on abstract execution of network events on Internet of things service models and virtual machine semantic reconstruction of the protected services. In addition, a property checking procedure is employed to check the states of physical devices in advance to guarantee the runtime behavior in compliance with the security policies of open supervisory control and data acquisition systems. In such a way, the solution provides a fine-grained protection for open supervisory control and data acquisition systems and physical devices running in safety.
引用
收藏
页数:15
相关论文
共 24 条
[1]  
[Anonymous], 2003, P NETW DISTR SYST SE
[2]   Smart Generation and Transmission With Coherent, Real-Time Data [J].
Bakken, David E. ;
Bose, Anjan ;
Hauser, Carl H. ;
Whitehead, David E. ;
Zweigle, Gregary C. .
PROCEEDINGS OF THE IEEE, 2011, 99 (06) :928-951
[3]  
Barringer H, 2004, LECT NOTES COMPUT SC, V2937, P44
[4]   Rule Systems for Run-time Monitoring: from EAGLE to RULER [J].
Barringer, Howard ;
Rydeheard, David ;
Havelund, Klaus .
JOURNAL OF LOGIC AND COMPUTATION, 2010, 20 (03) :675-706
[5]  
Blech J.O., 2012, Proceedings of the 10th International Conference on Formal Engineering Methods: Formal Methods and Software Engineering (SEFM), P494, DOI DOI 10.1007/978-3-642-34281-3_34
[6]   Extending the enforcement power of truncation monitors using static analysis [J].
Chabot, Hugues ;
Khoury, Raphael ;
Tawbi, Nadia .
COMPUTERS & SECURITY, 2011, 30 (04) :194-207
[7]   Modeling runtime enforcement with mandatory results automata [J].
Dolzhenko, Egor ;
Ligatti, Jay ;
Reddy, Srikar .
INTERNATIONAL JOURNAL OF INFORMATION SECURITY, 2015, 14 (01) :47-60
[8]   Runtime enforcement monitors: composition, synthesis, and enforcement abilities [J].
Falcone, Ylies ;
Mounier, Laurent ;
Fernandez, Jean-Claude ;
Richier, Jean-Luc .
FORMAL METHODS IN SYSTEM DESIGN, 2011, 38 (03) :223-262
[9]  
Fong PWL, 2004, P IEEE S SECUR PRIV, P43
[10]   Role Mining with Probabilistic Models [J].
Frank, Mario ;
Buhman, Joachim M. ;
Basin, David .
ACM TRANSACTIONS ON INFORMATION AND SYSTEM SECURITY, 2013, 15 (04)