CPS: Small: Collaborative Research: A Secure Communication Framework with Verifiable Authenticity for Immutable Services in Industrial IoT Systems

工业物联网(IIoT)系统广泛应用于任务关键型和安全关键型应用，因此对底层通信基础设施的安全性提出了严格的要求。IIoT网络由多个通信方组成，遵循双向通信模型，包括在上行链路上传输感测数据和在下行链路上传输控制消息。外部攻击者篡改传感数据或控制消息将导致错误的决策，可能会造成重大危害。工业自动化最近的趋势是将相互依赖的工业设备连接在一起，以提供分散、可验证和不可更改的服务，这进一步加剧了这一问题。该项目的目标是设计1)高效的签名方案，以支持工厂内双向通信的可验证真实性、完整性和一致性，以及2)分层和可扩展的区块链协议，以支持工厂间不可改变的服务。研究团队的密切合作将导致一个公开可用的支持IIoT的先进制造试验台，研究成果在从业者中的有效传播，以及启动技术转移。为了解决现有的局限性，所提出的安全通信框架旨在：(I)通过设计对签名者和验证者都快速有效的新型签名方案，确保IIoT网络中传感数据的真实性、完整性和一致性；(Ii)通过将IIoT网络的控制边界扩展到云/互联网并解决新的安全挑战，实现基于公钥密码(PKC)的快速控制消息认证；以及(Iii)通过开发分层的区块链结构和可扩展的轻量级共识协议来提供工厂间不变的服务。建议的解决方案将在独特的支持IIoT的先进制造系统试验台上实施和部署，以进行彻底的设计验证和性能评估。建议安全解决方案的成功设计、实施和演示将推动IIoT网络基础设施的采用，加快传统安全体系结构向基于PKC的安全体系结构的转变，并将工业通信基础设施的安全保护提升到新的水平。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Industrial Internet of Things (IIoT) systems are used in a wide range of mission- and safety-critical applications, thus imposing stringent requirements on the security of the underlying communication infrastructure. An IIoT network consists of multiple communication parties and follows a two-way communication model, including delivering sensing data on the uplink and transmitting control messages on the downlink. Tampered sensing data or control messages by outside attackers will result in wrong decisions, potentially causing significant harm. The recent trend in industrial automation to connect interdependent industrial plants together to provide decentralized, verifiable and immutable services further exacerbates the problem. This project aims to design 1) efficient signature schemes to support verifiable authenticity, integrity, and uniformity for intra-plant two-way communications, and 2) hierarchical and scalable blockchain protocols to support inter-plant immutable services. The close collaboration of the research teams will lead to a publicly available IIoT-enabled advanced manufacturing testbed, effective dissemination of research results among practitioners, and initiation of technology transfer.To address existing limitations, the proposed secure communication framework aims to (i) ensure authenticity, integrity, and uniformity of sensing data in IIoT networks by designing novel signature schemes that are fast and efficient for both the signer and the verifier; (ii) enable public-key cryptography (PKC)-based fast control message authentication by extending the control border of IIoT networks to the cloud/Internet and solving the new security challenges; and (iii) provide inter-plant immutable services by developing a hierarchical blockchain structure and scalable lightweight consensus protocols. The proposed solutions will be implemented and deployed on a unique IIoT-enabled advanced manufacturing system testbed for thorough design validation and performance evaluation. Successful design, implementation and demonstration of the proposed security solutions should advance the adoption of IIoT network infrastructure, accelerate the transformation of legacy security architectures to PKC-based security architectures and lift the security protection of the industrial communication infrastructure to the next level.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.