Secured cyber-physical systems

• US 10,417,425 B2
• Filed: 06/08/2017
• Issued: 09/17/2019
• Est. Priority Date: 06/13/2016
• Status: Active Grant

• Current Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Original Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Inventors: Arroyo, Miguel A., Sethumadhavan, Lakshminarasimhan, Weisz, Jonathan
• Primary Examiner(s): Ehne, Charles
• Application Number:
  US15/618,019
• Publication Number:
  US 20170357808A1
• Time in Patent Office: 831 Days
• CPC Class Codes: G06F 1/24 Resetting means
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Disclosed are devices, systems, apparatus, methods, products, and other implementations, including a method that includes causing at least one reset for one or more components of a cyber-physical system, the cyber-physical system including a mechanical apparatus with at least one of a mechanical input or a mechanical output, and at least one controller to control operations of at least one of the mechanical apparatus and inhibit computing-based attacks on the cyber-physical system. The method further includes determining, upon resumption of operation of the cyber-physical system following the at least one reset, a post-reset state of the one or more components of the cyber-physical system based, at least in part, on mechanical attributes of the mechanical apparatus following the at least one reset resulting from inertia of the mechanical apparatus during the at least one reset.

Claims

1. A method comprising:

causing at least one reset for one or more components of a cyber-physical system, the cyber-physical system comprising a mechanical apparatus with at least one of a mechanical input or a mechanical output, and at least one controller to control operations of at least one of the mechanical apparatus and inhibit computing-based attacks on the cyber-physical system; and

upon resumption of operation of the cyber-physical system following the at least one reset, determining a post-reset state of the one or more components of the cyber-physical system based, at least in part, on mechanical attributes of the mechanical apparatus following the at least one reset resulting from inertia of the mechanical apparatus during the at least one reset.

2. The method of claim 1, wherein causing the at least one reset comprises:

causing recurring resets for the one or more components of the cyber-physical system.

3. The method of claim 1, wherein determining the post-reset state of the one or more components comprises:

determining the post-reset state of the one or more components based further on one or more previous inputs received by the cyber-physical system prior to a beginning of the at least one reset.

4. The method of claim 1, further comprising:

selecting one of multiple available process variants for at least one process implemented by the cyber-physical system.

5. The method of claim 4, wherein selecting the one of the multiple available process variants comprises:

providing the multiple available process variants according to one or more of;

leakage-resilient layout randomization techniques, Isomeron techniques, instruction set randomization techniques, or any combination thereof.

6. The method of claim 4, further comprising:

terminating use of the selected one of the multiple available process variants for the at least one process upon a next reset of the cyber-physical system;

wherein the method further comprises;

selecting another of the multiple available process variants for the at least one process for execution by the at least one controller upon the resumption of the operation of the cyber-physical system following the next reset.

7. The method of claim 1, further comprising:

obtaining measurements from one or more sensors of the cyber-physical system indicative of a state of the one or more components of the cyber-physical system;

determining respective estimates of the state corresponding to the one or more components of the cyber-physical system based on the measurements from the one or more sensors; and

resetting the at least one controller in response to a determination of a discrepancy between two or more estimates of the state corresponding to the one or more components determined from the respective measurements.

8. The method of claim 7, wherein obtaining the measurements from the one or more sensors comprises:

obtaining measurements from multiple engine position decoders indicative of an engine state of an engine.

9. The method of claim 1, further comprising:

periodically re-computing state data for the one or more components of the cyber-physical system.

10. The method of claim 9, wherein periodically re-computing data for the one or more components comprises:

periodically re-computing a task schedule for an engine, the task schedule comprising control signals to control one or more of;

an engine ignition task, or an engine injection task.

11. The method of claim 1, wherein causing the at least one reset for the one or more components of the cyber-physical system comprises one or more of:

re-booting, at least in part, the one or more components of the cyber-physical system;

or

restoring a previously saved state for the one or more components of the cyber-physical system.

12. The method of claim 1, wherein causing the at least one reset for the one or more components of the cyber-physical system comprises:

adaptively regulating recurring reset intervals based, at least in part, on one or more of;

environmental conditions affecting the cyber-physical system, changes to the environmental condition, location of the cyber-physical system, or a previous state of a previous reset.

13. A cyber-physical system comprising:

a mechanical apparatus configured for at least one of;

receive one or more mechanical inputs, or provide one or more mechanical outputs; and

at least one controller to control operation of the mechanical apparatus and to inhibit computing-based attacks on the cyber-physical system, wherein the at least one controller is configured to;

cause at least one reset for one or more components of the cyber-physical system; and

upon resumption of operation of the cyber-physical system following the at least one reset, determine a post-reset state of the one or more components of the cyber-physical system based, at least in part, on mechanical attributes of the mechanical apparatus following the at least one reset resulting from inertia of the mechanical apparatus during the at least one reset.

14. The cyber-physical system of claim 13, wherein the at least one controller configured to cause the at least one reset is configured to:

cause recurring resets for the one or more components of the cyber-physical system.

15. The cyber-physical system of claim 13, wherein the at least one controller configured determine the post-reset state of the one or more components is configured to:

determine the post-reset state of the one or more components based further on one or more previous inputs received by the cyber-physical system prior to a beginning of the at least one reset.

16. The cyber-physical system of claim 13, wherein the at least one controller is further configured to:

select one of multiple available process variants for at least one process implemented by the cyber-physical system.

17. The cyber-physical system of claim 16, wherein the at least one controller configured to select the one of the multiple available process variants is configured to:

provide the multiple available process variants according to one or more of;

leakage-resilient layout randomization techniques, isomeron techniques, instruction set randomization techniques, or any combination thereof.

18. The cyber-physical system of claim 16, wherein the at least one controller is further configured to:

terminate use of the selected one of the multiple available process variants for the at least one process upon a next reset of the cyber-physical system;

select another of the multiple available process variants for the at least one process is for execution by the at least one controller upon a next resumption of the operation of the cyber-physical system following the next reset.

19. The cyber-physical system of claim 13, further comprising:

one or more sensors of the cyber-physical system to obtain measurements indicative of a state of one or more components of the cyber-physical system;

wherein the at least one controller is further configured to;

determine respective estimates of the state corresponding to one or more components of the cyber-physical system based on the measurements from the one or more sensors; and

wherein the at least one controller configured to cause the at least one reset is configured to reset the at least one controller in response to a determination of a discrepancy between two or more estimates of the state corresponding to the one or more components determined from the respective measurements.

20. The cyber-physical system of claim 19, wherein the one or more sensors configured to obtain the measurements are configured to:

obtain measurements from multiple engine position decoders indicative of an engine state of an engine.

21. The cyber-physical system of claim 13, wherein the at least one controller is further configured to:

periodically re-compute state data for the one or more components of the cyber-physical system.

22. The cyber-physical system of claim 21, wherein the at least one controller configured to periodically re-compute the data for the one or more components is configured to:

periodically re-compute a task schedule for an engine, the task schedule comprising control signals to control one or more of;

an engine ignition task, or an engine injection task.

23. The cyber-physical system of claim 13, wherein the at least one controller configured to cause the at least one reset for the one or more components of the cyber-physical system is configured to perform one or more of:

re-boot, at least in part, the one or more components of the cyber-physical system;

or

restore a previously saved state for the one or more components of the cyber-physical system.

24. A non-transitory computer readable media programmed with instructions, executable on a processor, to:

cause at least one reset for one or more components of a cyber-physical system, the cyber-physical system comprising a mechanical apparatus with at least one of a mechanical input or a mechanical output, and at least one controller to control operations of at least one of the mechanical apparatus and inhibit computing-based attacks on the cyber-physical system; and

determine, upon resumption of operation of the cyber-physical system following the at least one reset, a post-reset state of the one or more components of the cyber-physical system based, at least in part, on mechanical attributes of the mechanical apparatus following the at least one reset resulting from inertia of the mechanical apparatus during the at least one reset.