Cyber security for industrial control systems : from the viewpoint of close-loop

316 Pages·2016·6.302 MB·English

by  Peng Cheng, Heng Zhang, Jiming Chen (eds.)

INFORMATION TECHNOLOGY CZC CYBER SECURITY FOR
hhh
eae
nnn
gg INDUSTRIAL
Cyber Security for Industrial Control Systems: From the Viewpoint of

Close-Loop provides a comprehensive technical guide on up-to-date new
secure defending theories and technologies, novel design, and systematic
CONTROL
understanding of secure architecture with practical applications. The book
consists of 10 chapters, which are divided into three sections.
SYSTEMS
The first three chapters extensively introduce secure state estimation IC
N
Y
technologies, providing a systematic presentation on the latest progress
DB
in security issues regarding state estimation. The next five chapters
E
U
focus on the design of secure feedback control technologies in industrial R from the viewpoint of close-loop
S
control systems, displaying an extraordinary difference from that of
S
traditional secure defending approaches from the viewpoint of network T
E
R
and communication. The last two chapters elaborate on the systematic C
secure control architecture and algorithms for various concrete application IU
A
scenarios. R
L
I
T
The book has the following salient features: CY

• Provides an extensive introduction to state-of-the-art cyber security OF
O
theories and technologies from the viewpoint of close-loop N
R
• Identifies the quantitative characteristics of typical cyber attacks and T

analyzes the attack decision mechanisms in closed-loop industrial R
systems in depth O
• Proposes novel intrusion detection mechanisms against cyber attacks
L
in industrial control systems

• Presents a systematic understanding of the secure architectural design S
for industrial control systems Y
• Addresses secure control approaches against cyber attacks for the S
representative applications in industrial control systems T
E
The authors provide detailed descriptions on attack model and strategy
M
analysis, intrusion detection, secure state estimation and control, game
S
theory in closed-loop systems, and various cyber security applications.
The book is useful to anyone interested in secure theories and
technologies for industrial control systems.
Edited by
K26386
Peng Cheng • Heng Zhang • Jiming Chen
6000 Broken Sound Parkway, NW
ISBN: 978-1-4987-3473-8
Suite 300, Boca Raton, FL 33487
90000
711 Third Avenue
New York, NY 10017
2 Park Square, Milton Park
Abingdon, Oxon OX14 4RN, UK 9 781498 734738
www.crcpress.com
CYBER SECURITY FOR
INDUSTRIAL
CONTROL
SYSTEMS
from the viewpoint of close-loop
TThhiiss ppaaggee iinntteennttiioonnaallllyy lleefftt bbllaannkk
CYBER SECURITY FOR
INDUSTRIAL
CONTROL
SYSTEMS
from the viewpoint of close-loop
Edited by
Peng Cheng
Heng Zhang
Jiming Chen
Boca Raton London New York
CRC Press is an imprint of the
Taylor & Francis Group, an informa business
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2016 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Version Date: 20160301
International Standard Book Number-13: 978-1-4987-3474-5 (eBook - PDF)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts
have been made to publish reliable data and information, but the author and publisher cannot assume
responsibility for the validity of all materials or the consequences of their use. The authors and publishers
have attempted to trace the copyright holders of all material reproduced in this publication and apologize to
copyright holders if permission to publish in this form has not been obtained. If any copyright material has
not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmit-
ted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented,
including photocopying, microfilming, and recording, or in any information storage or retrieval system,
without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.
com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood
Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and
registration for a variety of users. For organizations that have been granted a photocopy license by the CCC,
a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used
only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
SECTION I: SECURE STATE ESTIMATION 1
1 AGame-TheoreticApproachtoJammingAttacksonRemoteState
EstimationinCyber-PhysicalSystems . . . . . . . . . . . . . . . . 3
YuzheLi,LingShi,PengCheng,JimingChen,andDanielE.Quevedo
2 SecureStateEstimationagainstStealthyAttack . . . . . . . . . . 31
YilinMo
3 SecureStateEstimationinIndustrialControlSystems . . . . . . . 57
ArashMohammadiandKonstantinosN.Plataniotis
SECTION II:RESILIENT CONTROLTHEORY 95
4 OptimalDenial-of-ServiceAttackPolicyagainstWirelessIndustrial
ControlSystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
HengZhang,PengCheng,LingShi,andJimingChen
5 Behavior Rule Specification-Based False Data Injection Detection
TechniqueforSmartGrid . . . . . . . . . . . . . . . . . . . . . . . 119
BeibeiLi,RongxingLu,andHaiyongBao
vi (cid:4) Contents
6 HierarchicalArchitectures ofResilientControl Systems:Concepts,
Metrics,andDesignPrinciples . . . . . . . . . . . . . . . . . . . . 151
QuanyanZhu,DongWei,andKunJi
7 TopologyControlinSecureWirelessSensorsNetworks . . . . . . 183
JunZhao
8 ResilientDistributedControlinCyber-PhysicalEnergy
Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
WenteZengandMo-YuenChow
SECTION III: SECURITY ISSUES INAPPLICATION
FIELDS 251
9 Distributed Resilient Control of Operator-Vehicle Networks under
CyberAttacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
MinghuiZhuandSoniaMart´ınez
10 Privacy-PreservingDataAccessControlintheSmartGrid . . . . 285
KanYang,XiaohuaJia,andXuemin(Sherman)Shen
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Preface
By exploiting sensing, networking, and computation capabilities, the new-
generationindustrialcontrolsystemsare abletobetterconnectcyberspaceand
the physicalprocessin close-loopthaneverbefore.However,suchconnections
havealso providedrich opportunitiesforadversariesto perform potentialmali-
ciousattacks.
There has been extensive research on security issues from the viewpoint of
networksandcommunication,andthesecuredefendingapproachesmainlycon-
sider how to guarantee network performance. Considerable efforts have been
devotedto the designof securedefendingapproachesagainstmalicious attacks
with communication technologies.For example, channelhopping is often used
tomaintainnetworkperformance,forexample,throughput,inajammingattack
environment.
Such network performancerarely considersthe operationofphysicalplants
withoutthe features ofautomaticcontrolorfeedback.However,industrialcon-
trolsystemsare characterizedbyfeedbackcontrolandaim to optimizethesys-
tem control performances, such as reducing state estimation errors, improving
the stability ofunstableplants, andenhancingthe robustnessagainstuncertain-
tiesandnoise.Thus,itisequivalentorevenmoreimportanttoprotectthesystem
control performance while studying the cyber-security issues in industrial con-
trolsystems. Forexample,whenthe communicationofsystem entities is under
a jamming attack, different from the existing design, such as the channel hop-
pingalgorithm,thesecurestateestimationandcontrolalgorithmsmaybebetter
configured by exploiting the feedback information as well as the dynamics of
the physicalplants. As a result, it is of great research interest to develop novel
theoriesandtechnologiesfromtheviewpointofclose-loopinordertoprotectthe
industrialcontrolsystemperformanceundervariouscyberandphysicalattacks.
CyberSecurityforIndustrialControlSystems:FromtheViewpointofClose-
Loop is the first comprehensive and updated book on cyber security from the
vii
viii (cid:4) Preface
viewpointofclose-loop.Thisbookprovidesacomprehensivetechnicalguideon
up-to-date secure defending theories and technologies, novel design, and sys-
tematic understanding of secure architecture and some practical applications.
Specifically, it consists of 10 chapters, which are divided into three parts. The
first part, consisting of Chapters 1 through 3, extensively introduces secure
state estimation technologies, providing a systematic presentation on the latest
progressinsecurityissuesregardingstateestimation.Thesecondpart,composed
of five chapters, focuses on the design of secure feedback control technologies
in industrial control systems, showing its extraordinary difference from that of
traditionalsecuredefendingapproachesfromtheviewpointofnetworkandcom-
munication.Thethirdpart,withtwochapters,elaboratesonthesystematicsecure
controlarchitectureandalgorithmsforvariousconcreteapplicationscenarios.
Thisbookhasthefollowingsalientfeatures:
1. Providesanextensiveintroductionto state-of-the-artcybersecuritytheo-
riesandtechnologiesfromtheviewpointofclose-loop
2. Identifiesthequantitativecharacteristicsoftypicalcyberattacksandana-
lyzestheattackdecisionmechanismsinclosed-loopindustrialsystemsin
depth
3. Proposes novel intrusion detection mechanisms against cyber attacks in
industrialcontrolsystems
4. Presentsasystematicunderstandingofthesecurearchitecturaldesignfor
industrialcontrolsystems
5. Addresses secure control approaches against cyber attacks for the repre-
sentativeapplicationsinindustrialcontrolsystems
This bookprovidesdetailed descriptionson attackmodelandstrategyanal-
ysis, intrusion detection, secure state estimation and control, game theory in
closed-loop systems, and various cyber-security applications. We expect the
book to be favorable to those who are interested in secure theories and tech-
nologiesforindustrialcontrolsystems.
Wewouldliketothankallthecontributorsofeachchapterfortheirexpertise
andcooperation,andeffortsinvested,withoutwhichwewouldnothavesuchan
excellent book. Specially, we highly appreciate the support, patience, and pro-
fessionalism of Ruijun He and Kathryn Everett from the very beginning to the
finalpublicationofthebook.Lastbutnotleast,wearegratefulforourfamilies
andfriendsfortheirconstantencouragementandunderstandingthroughoutthis
project.
PengCheng
HengZhang
JimingChen
Contributors
HaiyongBao XiaohuaJia
School of Electrical and Electronic DepartmentofComputerScience
Engineering CityUniversityofHongKong
NanyangTechnologicalUniversity KowloonTong,HongKong,China
Singapore
BeibeiLi
JimingChen School of Electrical and Electronic
Engineering
CollegeofControlScienceand
Technology NanyangTechnologicalUniversity
ZhejiangUniversity Singapore
Zhejiang,China
YuzheLi
DepartmentofElectronicand
PengCheng
ComputerEngineering
CollegeofControlScienceand Hong Kong University of Science
Technology andTechnology
ZhejiangUniversity Kowloon,HongKong,China
Hangzhou,China
RongxingLu
Mo-YuenChow
School of Electrical and Electronic
DepartmentofElectricaland Engineering
ComputerEngineering
NanyangTechnologicalUniversity
NorthCarolinaStateUniversity
Singapore
Raleigh,NorthCarolina,USA
SoniaMart´ınez
KunJi Department of Mechanical and
CorporateTechnology AerospaceEngineering
SiemensCorporation UniversityofCalifornia
Princeton,NewJersey,USA SanDiego,California,USA
ix