Ph.D. Thesis - Alexandre M. Bayen - University of California, Berkeley

199 Pages·2011·3.44 MB·English

On Cyber Security for Networked Control Systems
by
Saurabh Amin
A dissertation submitted in partial satisfaction of the
requirements for the degree of
Doctor of Philosophy
in
Civil and Environmental Engineering
and the Designated Emphasis
in
Communication, Computation, and Statistics
in the
Graduate Division
of the
University of California, Berkeley
Committee in charge:
Professor Alexandre M. Bayen, Co-Chair
Professor S. Shankar Sastry, Co-Chair
Professor Mark Stacey
Professor Pravin P. Varaiya
Spring 2011
The dissertation of Saurabh Amin, titled On Cyber Security for Networked Control Sys-
tems, is approved:
Co-Chair Date
Co-Chair Date
Date
Date
University of California, Berkeley
On Cyber Security for Networked Control Systems
Copyright 2011
by
Saurabh Amin
1
Abstract
On Cyber Security for Networked Control Systems
by
Saurabh Amin
Doctor of Philosophy in Civil and Environmental Engineering
and the Designated Emphasis in Communication, Computation, and Statistics
University of California, Berkeley
Professor Alexandre M. Bayen, Co-Chair
Professor S. Shankar Sastry, Co-Chair
The instrumentation of infrastructure systems by embedded sensors, computation, and
communication networks has enabled significant advances in their management. Exam-
ples include monitoring of structural health, traffic congestion, environmental hazards, and
energy usage. The use of homogeneous (especially, commercially available off-the-shelf)
information technology (IT) solutions makes infrastructure systems subject to correlated
hardware malfunctions and software bugs. Over the past decade, many concerns have been
raised about the vulnerabilities of infrastructure systems to both random failures and secu-
rity attacks. Cyber-security of Supervisory Control and Data Acquisition (SCADA) systems
is especially important, because these systems are employed for sensing and control of large
physical infrastructures. So far, the existing research in robust and fault-tolerant control
does not account for cyber attacks on networked control system (NCS) components. Also,
the existing research in computer security neither considers the attacks targeting NCS com-
ponents nor accounts for their interactions with the physical system. The goal of this thesis
is to bridge this gap by focusing on (1) security threat assessment, (2) model-based attack
diagnosis, and (3) resilient control design.
First, cyber-security assessment for SCADA systems is performed based on well-defined
attacker and defender objectives. The mathematical model of SCADA systems considered
inthisworkhastwocontrollevels: regulatorycontrolusingdistributedproportional-integral
(PI) controllers, and supervisory fault diagnosis based on approximate dynamical system
models. The performance of a PI control based regulatory scheme and a model-based
supervisory diagnostic scheme is studied under a class of deception attacks. In order to
test the system resilience, a class of stealthy attacks which can evade detection by SCADA
systems is presented.
Second, design of attack diagnosis schemes that incorporate the knowledge of physical
dynamics of the system is presented. For SCADA systems used to manage water canal
networks, an observer-based attack diagnostic scheme, in which each observer estimates the
state of a reduced-order flow model, is presented. The observer parameters are computed
2
using a convex optimization method, and the performance of this scheme is tested on a
number of attack scenarios. An application of the theoretical results is illustrated by a
field operational test performed on the SCADA system of the Gignac water canal system,
located in Montpellier, France. A successful experimental cyber-attack on the sensors and
actuators of this canal network revealed new vulnerabilities of the current SCADA system
implementation.
Anotherillustrationincludessecurityanalysisoftwobenchmarkscenarios: theTennessee
Eastman process control system (TE-PCS) and a power system state estimator (PSSE).
In both these cases, model-based statistical detection schemes are used to study stealthy
deception attacks. For the case of TE-PCS, design of practically implementable attack-
detection and response mechanisms to maintain operational safety is presented. For the
case of PSSE, it is assumed that the attacker only has a partial knowledge of the actual
system model. For a set of attacker objectives, the trade-off between the attacker knowledge
andpossibleimpactofasuccessfulattackontheperformanceoffalsedatadetectionschemes
is studied.
Third, the stability of linear hyperbolic systems of PDEs when the boundary control
actions and the system parameters switch discontinuously between a finite set of modes is
studied. Switched PDE models can describe a class of fault and attack scenarios resulting
fromintermittentwithdrawalsthroughofftakenodesandcompromiseofsensor-controldata.
Motivated by such scenarios, a new condition for stability of linear hyperbolic systems
of PDEs under arbitrary switching of boundary control actions and system parameters is
derived. A class of switching attack strategies is presented, which violate the stability
condition and result in unstable flow dynamics.
Fourth,theproblemofcontrollingstochasticlinearsystemsfornetworkedcontrolsettings
is considered when the sensor-control data is prone to packet loss and jamming. For a
class of packet drop models, feedback control policies which minimize a given objective
function subject to safety constraints are synthesized. For marginally stable systems, under
mild hypotheses on the noise introduced by the control channel and large enough control
authority, the synthesis of a control policy that render the state of the closed-loop system
mean-square bounded is presented.
Finally, a class of games involving discrete interdependent risks is considered when each
player is a NCS, and their security is interdependent due to the exposure to network induced
risks. The problem of security decisions of individual players is formulated as a two-stage
non-cooperative game defined as follows: in the first stage, the players decide whether to
invest in security or not; and in the second stage, they apply control inputs to minimize the
average operational costs. The characterization of the equilibria of the game is presented,
which includes the determination of the individually optimal security levels. The presence
of interdependent security causes a negative externality, and the individual players tend
to under invest in security relative to the social optimum. From these results, for a wide
parameter range, public policy incentivising higher security investments is desirable.
i

!"#$%&(' + ! #%) $%&(' + *

,%-/. %0&(+ ! /%#1%#2 **

3&&4 1.-4 56-' + 75 8 9&: *

;5<% 6 (+ =5' 6 >6% (+ **

;5<% ??%8- ;5 &(+ ;5 &%<%8- @%A-%(+ *

@%A95% 6 (%B C8- 6 %96((' + --D =FE (+ **
For Richa
ii
Contents
List of Figures vi
1 Introduction 1
1.1 The Vulnerability of Control Systems and Stuxnet . . . . . . . . . . . . . . . 2
1.2 New Security Problems for Control Systems . . . . . . . . . . . . . . . . . . 4
1.2.1 Efforts for Securing Control Systems . . . . . . . . . . . . . . . . . . 4
1.2.2 Control System Security vs. IT Security . . . . . . . . . . . . . . . . 5
1.2.3 What is new and fundamentally different? . . . . . . . . . . . . . . . 6
2 Attacks on Hierarchically Structured Water SCADA Systems 8
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2 Cyber-Attacks Against Water SCADA Systems . . . . . . . . . . . . . . . . 9
2.2.1 Attack Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.3 Flow Models & Hierarchical System Architecture . . . . . . . . . . . . . . . 14
2.3.1 Model of Canal Cascade . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.3.2 Regulatory Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.3.3 Supervisory Control (FDI) . . . . . . . . . . . . . . . . . . . . . . . . 17
2.3.4 Simulation of a Stealthy Attack . . . . . . . . . . . . . . . . . . . . . 20
2.4 Field Operational Test Attacks . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.4.1 Gignac canal network and SCADA system . . . . . . . . . . . . . . . 22
2.4.2 Field Operational Test Setup . . . . . . . . . . . . . . . . . . . . . . 23
2.4.3 Effect of cyber-attack on regulatory control . . . . . . . . . . . . . . . 25
2.4.4 Effect of cyber-attack on supervisory FDI scheme . . . . . . . . . . . 27
2.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Appendix 2.A Regulatory Control Design . . . . . . . . . . . . . . . . . . . . . . 29
2.A.1 Regulatory control of single canal pool . . . . . . . . . . . . . . . . . 29
2.A.2 Regulatory control of multiple canal pools . . . . . . . . . . . . . . . 30
Appendix 2.B Computation of Observer Parameters . . . . . . . . . . . . . . . . 33
3 Detection of Deception Attacks on Water SCADA Systems 36
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.1.1 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.1.2 Contributions for Fault and Attack Diagnosis . . . . . . . . . . . . . 38
3.2 Models of Canal Pool Cascade . . . . . . . . . . . . . . . . . . . . . . . . . . 39
iii
3.2.1 Model of Flow Dynamics . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.2.2 Model of Hydraulic Structures . . . . . . . . . . . . . . . . . . . . . . 40
3.2.3 Linearized Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
3.3 Characteristic form and IDZ model . . . . . . . . . . . . . . . . . . . . . . . 43
3.3.1 Characteristic Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
3.3.2 Integrator-Delay Model . . . . . . . . . . . . . . . . . . . . . . . . . . 44
3.4 UIO Based Fault Detection and Isolation . . . . . . . . . . . . . . . . . . . . 50
3.4.1 Unknown Input Observer Design . . . . . . . . . . . . . . . . . . . . 51
3.4.2 Residual Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
3.5 Attack Detection and Isolation . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.5.1 Generalized Fault/Attack Model for Two Pool System . . . . . . . . 57
3.5.2 Implications for Water Security . . . . . . . . . . . . . . . . . . . . . 60
3.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Appendix 3.A Conditions for observer design . . . . . . . . . . . . . . . . . . . . 63
4 Stability of Flow Networks under Switching Attacks 69
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
4.1.1 Switching Infinite-Dimensional Systems . . . . . . . . . . . . . . . . . 69
4.1.2 Stability under Switching Attacks . . . . . . . . . . . . . . . . . . . . 71
4.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
4.3 Diagonal Switching System . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
4.4 Non-diagonal Switching System . . . . . . . . . . . . . . . . . . . . . . . . . 87
4.5 Application to Stability of Canal Cascade under DoS attacks . . . . . . . . . 90
4.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
5 Detection of Deception Attacks on Process Control Systems 93
5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
5.1.1 Attack models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
5.1.2 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
5.2 Detection of Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
5.2.1 Linear Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
5.2.2 Detection Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
5.2.3 Stealthy Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
5.2.4 Surge Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
5.2.5 Bias Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
5.2.6 Geometric Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
5.2.7 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
5.3 Response to Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
5.3.1 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
5.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
iv
6 Deception Attacks on Power System State Estimators 112
6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
6.2 Stealthy Deception Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
6.2.1 Power System State Estimation (PSSE) . . . . . . . . . . . . . . . . 114
6.2.2 Attacker Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
6.3 PSSE Iterates as Linear WLS Problems . . . . . . . . . . . . . . . . . . . . . 117
6.3.1 Normal Equations as Linear Least Squares . . . . . . . . . . . . . . . 117
6.3.2 Decoupled State Estimation . . . . . . . . . . . . . . . . . . . . . . . 118
6.4 Bad Data Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
6.5 Deception Attacks on Linear State Estimator . . . . . . . . . . . . . . . . . 120
6.5.1 Attack Synthesis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
6.5.2 Relaxing the Assumptions on Adversarial Knowledge . . . . . . . . . 122
6.5.3 Stealthy Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
6.6 Case study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
6.6.1 Worst-Case Model Uncertainty . . . . . . . . . . . . . . . . . . . . . 126
6.7 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
7 Security Constrained Networked Control 129
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
7.1.1 Attacks on control systems . . . . . . . . . . . . . . . . . . . . . . . . 130
7.2 Problem Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
7.2.1 System Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
7.2.2 Goals and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 131
7.3 Optimal control with constraints and random attacks . . . . . . . . . . . . . 132
7.3.1 A random DoS attack model . . . . . . . . . . . . . . . . . . . . . . . 132
7.3.2 Controller parameterization . . . . . . . . . . . . . . . . . . . . . . . 133
7.3.3 Convex characterization . . . . . . . . . . . . . . . . . . . . . . . . . 134
7.3.4 Safety-constrained optimal control for Bernoulli attacks . . . . . . . . 136
7.4 Modeling general DoS attacks . . . . . . . . . . . . . . . . . . . . . . . . . . 139
7.4.1 DoS attacks against the safety constraint . . . . . . . . . . . . . . . . 140
7.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
8 Stabilization of Networked Control Systems using Bounded Inputs 143
8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
8.2 Problem Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
8.3 Admissible Policy of Bounded Control Authority . . . . . . . . . . . . . . . . 147
8.4 Proofs for the Existence of Admissible Policies . . . . . . . . . . . . . . . . . 149
8.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
9 Security Interdependencies for Networked Control Systems 156
9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
9.2 Problem Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
9.2.1 The Game . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
9.2.2 Security Interdependence . . . . . . . . . . . . . . . . . . . . . . . . . 160
v
9.2.3 Second Stage LQG Problem . . . . . . . . . . . . . . . . . . . . . . . 161
9.3 Equilibria for two player game . . . . . . . . . . . . . . . . . . . . . . . . . . 162
9.3.1 Increasing incentives . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
9.3.2 Decreasing incentives . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
9.3.3 Penalties for insecure players . . . . . . . . . . . . . . . . . . . . . . . 164
9.4 Equilibria for M player game . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
9.4.1 Increasing incentives . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
9.4.2 Decreasing incentives . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
9.5 Discussion and Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . 168
10 Conclusion and Future Plans 169
10.1 Proposed future technical approach . . . . . . . . . . . . . . . . . . . . . . . 169
10.1.1 Attack Models and Threat Assessment . . . . . . . . . . . . . . . . . 170
10.1.2 Diagnostic Methods for Stealthy Attacks . . . . . . . . . . . . . . . . 170
10.1.3 Scalable Attack Resilient Control Algorithms . . . . . . . . . . . . . 171
10.1.4 Management of Interdependent Network Risks . . . . . . . . . . . . . 172