Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Hi, I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We're looking at the paper: "Skip to Secure".

Elias: Here's the gist of the paper. The gist: The proposed framework introduces intentional skipping of control loop executions as a control-theoretic countermeasure against stealthy attacks that violate message integrity and authenticity in cyber-physical systems.

Nadia: The proliferation of network connectivity has increased the application domain for cyber-physical systems (CPS) in today’s connected world, which manifests security vulnerability in terms of increased number of possible attack surfaces for such systems Increased connectivity manifests security vulnerability in terms of increased number of possible attack surfaces for such systems.

Elias: Recent results have established that network based Man-in-the-Middle type attacks, like false data injection on cyberphysical control systems are quite capable of disturbing closed loop stability as well as degrading the control performance of such systems.

Nadia: In such an attack, an adversary injects false data in the communication medium between the plant and the controller with the intention of driving the system to an unsafe state by changing the set point of the system.

Paper summary: Nadia: So we're looking at this paper called "Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions". It’s about trying to secure a control loop when there are attacks on the data exchange between the plant and the controller. The big idea is that instead of just using monitoring systems or heavy cryptography which use up a lot of network and computer power, they propose skipping parts of the control loop executions intentionally.

Elias: Exactly. The authors claim this intentional skipping acts as a control theoretic countermeasure against stealthy attacks that mess with message integrity and authenticity. They suggest it can actually lower the overhead from those cryptographic security measures without hurting the performance or safety of things in systems like CAN-based automotive CPS, which is what matters for resource constraints.

Priya: It sounds like they're trying to find a way to make security lighter by manipulating when the control action actually happens, rather than just encrypting everything. So, what’s the main problem they’re tackling here?

Nadia: The core problem is that computing a control law based on false sensor measurements can actually drive a cyber-physical system toward an unsafe state. They want to minimize the effect of false data injection in those sensor measurements by skipping some control law computations at certain sampling instants, while making sure those skips don't mess up the desired control performance.

Elias: And they frame this as finding a control skipping pattern that maximizes attack resilience while keeping the actual system performance as good as possible. They set up a two-step optimization framework for this.

Priya: So, first they synthesize patterns ranked by how well they keep the system stable, and then in the second step, they use SMT based techniques to analyze how much attack resilience those specific patterns offer against stealthy false data injection attacks.

Nadia: That sounds like a pretty complex process because you're trying to balance two competing goals: making it as resilient as possible and keeping the control performance high. They call this "intentional execution skips" a control theoretic countermeasure, which is what's really interesting here because it’s based on the system dynamics itself.

Elias: The paper introduces a physical plant model as a linear discrete-time invariant system, an LTI system with dynamical equations like X

k + one: = A1 Xk, where A1 has a specific matrix structure that helps them analyze how those execution skips affect the closed loop <ref:2007.08121#pg1>.

Priya: When they skip an execution inside a sampling interval, it means no new control update is sent to the plant or the state estimation unit during that sampling instance, but they still get a sensor update. So what exactly is this pattern?

Paper summary: Nadia: A Control Skipping Pattern is defined as an l-length control skipping pattern for a given control loop P and K, which can be used to define an infinite length control schedule pi = rho r, repeating with period l. They're looking at patterns like rho = one hundred ten thousand ten to see how the system evolves through those skips <ref:2007.08121#pg1>.

Elias: Their design metric for performance is settling time, which is the time needed for the system output to settle around the reference value within a two percent error band. Then they measure control performance using Quality of Control, or QoC, which is based on an LQR cost function J defined by J = infinity k=zero (x T

k: Qx

k: + u T

k: Ru

k: ) <ref:2007.08121#pg1>.

Priya: That LQR cost function uses weighting matrices Q and R to capture how much the designer cares about state deviation versus control effort, with Q being greater than or equal to zero and R being positive definite. So a lower LQR cost means better performance, right?

Nadia: Right. And they state that for a pattern rho to maintain the settling time requirement Ts, it must have at least ceiling l times rmin number of ones in it. The distribution of those zeros over the pattern is what they are trying to optimize for resilience.

Elias: The attacker's goal is to change the system's operating point by injecting false data in the least amount of time possible while staying stealthy, and an attack vector Ad is defined as a sequence of inputs △u1 · · · △ud launched on a protected control system, which is considered stealthy if its magnitude ri is less than or equal to Th for all i from k + one up to k + d + nup <ref:2007.08121#pg1>.

Priya: And the attack is successful if there exists some point j within that window where the system state xj drops below a threshold C2, meaning it becomes unsafe. They use an SMT solver called Z3 to validate if any attack of length d that stays stealthy over d plus nup samples violates those safety requirements.

Nadia: The methodology involves two steps: first, they synthesize a set of control skipping patterns P ranked by their control performance using a lightweight equivalent index, and then in step two, they find the most attack resilient pattern set PR that's a subset of P by checking for successful yet stealthy attack vectors against those schedules.

Paper summary: Elias: To rank the patterns with the same number of skips, they use a measure called LQR-Distance to compare their control performance. Algorithm three then computes up and down time for any pattern using functions like FindOnTime and MinAttLen to figure out how long an IDS can stay on or off for that schedule <ref:2007.08121#pg1>.

Priya: The results show that case studies on the Vehicle Dynamic Controller, VDC, and Trajectory Tracking Controller, TTC, demonstrate this approach works. For TTC with l = ten the most attack resilient pattern they found was rho = one billion ten million eleven thousand one hundred eleven with an IDS rate of zero point one six six seven compared to a periodic IDS rate of zero point two three zero seven, which is a twenty-seven point seven eight percent improvement over that existing scheme.

Nadia: And for the VDC, when they tried different values for l, the most resilient solutions showed about a thirty-seven point five percent reduction in the IDS rate compared to previous methods. The plot they show illustrates that even with this pattern based execution, the safety of the system is maintained even when increasing the down-time of those IDS schemes from two to five samples.

Elias: So, what does this mean for us? It means we can design sporadic IDS schemes based on intentional control loop skips which promises better resource utilization in terms of communication bandwidth for automotive CPS. The paper shows that integrating their SMT based technique with safe but approximate analysis can help scale this approach for more complex industrial test cases.

Priya: So, to sum up what we saw here, this work on "Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions" is about using control skipping patterns as a control theoretic way to add resilience against stealthy attacks that violate message integrity and authenticity. It shows how you can lower the resource consumption of IDS schemes in automotive systems by making them sporadic based on intentional skips, while keeping performance high enough.

Nadia: That’s what it is. It’s about using the system's own control logic to build security into the execution schedule rather than just bolting on heavy cryptographic layers that drain resources.

Elias: And it points toward a way to achieve provably secure IDS schemes by maximizing down-time, which is always desirable in resource-constrained CPS environments when you’re dealing with stealthy attacks.

Priya: It's interesting how they manage to keep the safety requirement met even when they increase the down-time of those IDS schemes from two to five samples. That suggests a pretty robust method for sporadic deployment.

Nadia: Yeah, so if you’re working on securing these systems, this paper is showing that skipping control loop executions intentionally can be a way to reduce the overhead of security measures without compromising performance in these critical areas.

Conclusion: Nadia: So we’re wrapping up this look at "Skip to Secure: Securing Cyber-physical Control Loops with Intentionally Skipped Executions" by those authors, and what this actually means for us in practice.

Elias: The core idea is using intentional control loop skips as a way to add resilience against attacks that mess with the data exchange between the plant and the controller.

Priya: It seems like they’re trying to find a middle ground, not just relying on heavy encryption or constant monitoring systems that drain resources.

Nadia: Exactly. They show how this method can lower the overhead of those security measures without messing up how well the system actually performs its job in things like automotive control systems.

Elias: The authors use a two-step optimization framework, synthesizing patterns based on performance and then testing them against stealthy attack vectors using SMT techniques to check for safety violations.

Priya: So, what this really tells me is that we can design sporadic intrusion detection schemes using these skips instead of having them run constantly, which should mean better communication bandwidth usage.

Nadia: That’s the practical implication here, Priya; making things sporadic based on the system's own control schedule seems like a smart way to manage those resource constraints in real-world cyber-physical systems.

Elias: The authors demonstrate that these safe and resilient patterns help reduce the computation and communication overhead of intrusion detection schemes used in automotive CPS.

Priya: They also showed that even when you increase the down-time for those intrusion detection schemes, from two to five samples, the safety of the system is still maintained with their pattern based execution.

Nadia: That robustness across different down-times is a key finding; it suggests this approach has good potential for scalable applications in more complex industrial test cases.

Elias: They also point out that integrating their SMT based technique with safe but approximate analysis can help make this approach more applicable to those harder, real-world scenarios.

Priya: So, what we’re seeing here is a way to build security directly into the execution schedule of a system rather than just layering on external security primitives.

Nadia: That’s the big picture—using the control loop itself as part of the defense mechanism for securing these systems.