Michael Krisper

Integration of Integrity Enforcing Technologies into Embedded Control Devices: Experiences and Evaluation

Security is a vital property of SCADA systems, especially in critical infrastructure. An important aspect is maintaining (sub-)system integrity in networks of embedded control devices. One technology that is used to achieve this is remote attestation. It is used to prove the integrity of one system (prover) to another (challenger). However, due to the complexity of the maintenance of reference measurement, it is seen as impractical in such constrained distributed systems. In this work, we show how recent advances such as privilege-based attestation enable an architecture that is more feasible to use. Based on real control systems used for hydro-electric power plants, we evaluate the impact of the proposed infrastructure on the device performance and discuss our experiences with the consequences of using such technologies for the production and development processes of such systems.

The Potential of Self-Adaptive Software Systems in Industrial Control Systems

New generations of industrial control systems offer higher performance, are networked and can be controlled remotely. Following this progress, the complexity of such systems increases through heterogeneous systems, hardware and more capable software. This may lead to an increase of unreliability and insecurity. Self-adaptive software systems offer a mean of dealing with complexity by monitoring a control system, detecting anomalies and adapting the control system to problems. Regarding such methods, industrial control systems have the advantage of being less dynamic. The network topology is fixed, devices rarely change, and the functionality of all the resources is known in principle. In this work, we examine this advantage and present the potential of self-adaptive software systems. The context of the presented work is control systems for hydropower units.

Describing binding time in software design patterns

Binding time is an important, yet underestimated viewpoint in software architecture and design. It defines the latest time during the software life cycle when something flexible becomes decided and fixed. This heavily impacts the flexibility of a software design and the resulting application. A terminology for describe binding time is established and an analysis is carried out in form of side-by-side comparisons for patterns and mechanisms from the creational, structural, and behavioral domains. These terminology and synoptic comparisons with the binding time considerations can aid software architects and developers in selecting patterns and taking correct architectural decisions for their binding time requirements.

Towards Executable Dependability Properties

Cyber-Physical Systems (CPSs) provide enormous potential for innovation. Examples are modern road vehicles (assisted and autonomous driving), CPS road networks (car2x), power plants, smart grids and healthcare devices. However, due to the dynamic interconnection and the largely unpredictable number of possible system configurations the dependable cooperation of CPS can not be fully assured at design time. The malfunction of a CPS could threaten human life, cause environmental damage and major financial loss. In order to address these challenges, this paper presents an early excerpt of an ongoing holistic approach and toolchain architecture that supports the design, development, implementation, operation and maintenance of dependable CPS. The proposed approach uses the dependability information accumulated during the system specification process as an input configuration for self-adaptive systems. These self-adaptive systems then test and assure the dependability properties of the CPS throughout the whole system life cycle.

Dynamic Adaption to Permanent Memory Faults in Industrial Control Systems

Abstract Industrial control systems are making increased use of commercial off-the-shelf hardware components. One such component is memory based on DRAM technology. As pointed out by others, DRAM memory can experience permanent hardware errors, e.g. a memory cell can be permanently stuck-at zero or one. In the worst case, such a fault may have serious safety-related consequences. In this work, we present the application of a self-adaptive software system named Scari that detects erroneous datapoints, analyzes them concerning permanent stuck-at faults, and adapts to them by masking defect memory areas. Crucial for this to work is a hot-standby device that takes over the control loop during the detection and adaption phases. The goal of the mechanism presented here is automatic self-repair of a faulty control device to increase its service life and to strengthen overall resilience. The industrial setting of the presented approach is that of control devices for hydropower plant units.

Use-Cases for Uncertainty Propagation in Distributed Control Systems

This paper describes how data quality can be used to gain trust between components in distributed control systems by adding information about quality to data values. Especially numeric uncertainty is a helpful tool for making highly informed decisions. To illustrate the benefits and challenges, several use-cases are discussed in the context of industrial and automotive settings. The target audience are architects and developers of cyber-physical systems in industrial and automotive domains, researchers in such domains and software developers who are writing software for embedded or distributed control systems which also use uncertain sensor measurements.

Supporting the integration of new security features in embedded control devices through the digitalization of production

Security is a vital property of Industrial Control Systems (ICS), especially in the context of critical infrastructure. In this work, we focus on distributed control devices for hydro-electric power plants. Much work has been done for specific lifecylce phases of distributed control devices such as development or operational phase. Our aim here is to consider the entire product lifecycle and the consequences of security feature implementations for a single lifecycle stage on other stages. At the same time, recent trends such as the digitization of production is an enabler of production process extensions that support the integration of such security features during the operational phase of a control devices. In particular, we propose a security concept that enables assurance of the integrity of software components and product configuration of other control devices in the same network. Moreover, we show how these concepts result in additional requirements for the production stages. We show how we meet these requirements and focus on a production process by extending previously proposed methods that enable the commissioning of secrets such as private keys during the manufacturing phase. We extend this process by extracting information about the configurations of the actually produced devices during production. Based on this information, the proposed security techniques can be integrated without considerable overhead for bootstrapping.

A Metric for Evaluating Residual Complexity in Software

A new metric for evaluating the complexity of software is proposed: The residual complexity. This is the combination of a complexity metric with a code coverage metric. It indicates how well the complexity of a software is handled by software tests, and how much complexity still remains untested. In this paper we give an overview over existing source code metrics and code coverage metrics. Afterwards the residual complexity is described and the consequences are discussed. In the end a use case is shown on a real life example of a software application implemented in .NET.

Patterns grasping the trade-off between distributing data and information

Today, we are at the dawn of the age of cyber-physical systems and internet of things. One of the commonalities these areas share is that such systems typically consist of networks of entities with means to gather data about the state of the surrounding environment. A fundamental design decision in such settings is whether to transfer data to more capable entities or to analyze data at the sensing entity and to share the resulting information. With this work, we discuss this trade-off by grasping it with three patterns, namely the LOCAL DATA PROCESSING, CENTRAL DATA PROCESSING, and MIXED DATA PROCESSING patterns.

Insertion Spaces

Insertion Spaces is the idea of purposefully leaving out empty space between objects to anticipate changes and insertions. These empty spaces can be used to insert further objects or rearrange existing objects. This idea is applicable in many contexts, but in this paper the context of software development and database development is addressed. Especially the calculation of order-values to change the sequence of objects is discussed. This paper primarily targets software engineers but Insertion Spaces can be useful for everyone having to deal with arrangements of objects and wanting to have flexibility in their solutions.