CAREER: Securing Critical Infrastructure with Autonomously Secure Storage

嵌入式系统目前依赖于本地且通常不安全的状态保留来进行过程控制和后续取证分析。随着关键嵌入式控制系统（例如智能电网、SCADA）生成越来越多的数据并与其他系统的连接越来越紧密，需要安全地保留和管理这些数据。 Stuxnet 等攻击表明，SCADA 和其他构成关键基础设施的系统很容易受到控制器和传感设备的损害，以及伪造数据以规避异常检测机制。该项目开发用于安全存储和监控关键基础设施中的嵌入式系统状态的技术和架构。我们正在检查与关键嵌入式系统中生成和存储数据相关的漏洞，这些系统通常是资源受限的环境。我们建议设计和部署“自主安全存储设备”，作为嵌入式设备的弹性存储。 我们正在设计日志记录、审计和管理架构，以便在面对恶意和受损设备时弹性存储系统数据和来源。此外，我们探索如何将这些数据传播到其他系统和云等环境，旨在通过隐私保护通信和查询接口来保护数据，并尝试对系统操作进行数据驱动的推断以检测异常行为。通过对生成的数据和元数据进行这些主动保护，我们的目标是为生成和存储关键基础设施中生成的数据提供新的基准。

Embedded systems currently rely on local and often insecure state retention for process control and subsequent forensic analysis. As critical embedded control systems (e.g., smart grids, SCADA) generate increasing amounts of data and become ever more connected to other systems, secure retention and management of that data is required. Attacks such as Stuxnet show that SCADA and other systems comprising critical infrastructure are vulnerable to the compromise of controllers and sensing devices, as well as falsification of data to circumvent anomaly detection mechanisms. This project develops techniques and architectures for securely storing and monitoring embedded system state in critical infrastructure. We are examining vulnerabilities relating to generating and storing data in critical embedded systems, which are often resource-constrained environments. We propose the design and deployment of 'autonomously secure storage devices' that act as resilient storage for embedded devices. We are designing logging, audit, and management architectures for resiliently storing system data and provenance in the face of malicious and compromised devices. Additionally, we explore how this data may be disseminated to other systems and to environments such as the cloud and aim to protect data through privacy-preserving communication and querying interfaces, and attempt to make data-driven inferences about system operation to detect anomalous behavior. Through these active protections to generated data and metadata, we aim to provide a new baseline for producing and storing data generated within critical infrastructures.