Resilient Safety-Critical Systems through Run-time Risk Assessment, Isolation, and Recovery (RESURREC)

对自动驾驶汽车等安全关键系统的攻击可能会造成严重后果，如经济损失，甚至危及生命和肢体。通过对资产(例如，软件应用程序、控制单元、加密密钥或消息)的成功攻击，攻击者可以直接或间接地造成损害(通过将攻击从一个资产扩展到另一个资产)。传统的安全措施，如故障检测、隔离和恢复(FDIR)，只能防止错误，而不能防止有针对性的攻击。例如，攻击者可以操作负责隔离故障组件并切换到冗余实例的组件。因此，必须将FDIR扩大到包括适当的安全措施。特别是，除了错误之外，还必须能够检测和响应攻击。为了实现复原力，隔离和恢复机制也必须受到保护，不受操纵。此外，一旦检测到攻击，就必须在系统运行时选择适当的响应；这一决策需要基于风险计算，并且需要考虑安全关键系统的具体情况。在这个提案中，我们提出了一个项目，以提高攻击检测、运行时风险评估、隔离和恢复，以增加安全关键系统的弹性。主要集中在后三个方面，因为在安全关键系统中入侵检测系统(IDS)已经有几种方法，而风险评估、隔离和恢复受到的关注要少得多。作为应用领域，我们考虑一辆自动驾驶汽车，因为它是一个分布式的复杂安全关键系统，由几个联网的部件组成，如控制单元、传感器和执行器，软件应用程序在这些部件上运行。对于风险评估，我们研究了基于资产之间的相关性来评估风险的新方法。从安全角度已知的隔离和恢复办法辅之以安全措施。我们研究了如何将零信任范例应用于安全关键系统。为此，我们研究了新的身份验证机制、访问和使用控制系统以及安全的面向服务的体系结构等。我们开发的解决方案将进行原型实施和评估。

Attacks on safety-critical systems such as autonomous vehicles can have serious consequences, such as financial damage or even danger to life and limb. Through successful attacks on assets (e.g., software applications, control units, cryptographic keys, or messages), an attacker can cause damage directly or indirectly (by extending the attack from one asset to another). Classical safety measures such as Fault Detection, Isolation, and Recovery (FDIR) only protect against errors and not against targeted attacks. For example, an attacker could manipulate a component that is responsible for the isolation of a faulty component and for switching to a redundant instance. FDIR must therefore be extended to include suitable security measures. In particular, in addition to errors, it must be possible to detect and respond to attacks. To achieve resilience, mechanisms for isolation and recovery must be protected against manipulation as well. Furthermore, once an attack has been detected, a suitable response has to be selected at run-time of the system; this decision needs to be based on a risk computation and needs to take the specifics of the safety-critical system into consideration. In this proposal, we propose a project to advance attack detection, run-time risk assessment, isolation, and recovery to increase the resilience of safety-critical systems. The main focus lies on the last three aspects, as there are already several approaches for Intrusion Detection Systems (IDS) in safety-critical systems, while risk assessment, isolation and recovery have received much less attention. As application domain, we consider an autonomous vehicle, as it is a distributed and complex safety-critical system, consisting of several networked components, such as control units, sensors and actuators, with software applications running on them. For risk assessment, we investigate new methods to assess risk based on the dependencies between assets. Approaches for isolation and recovery known from the safety context are supplemented by security measures. We investigate how the zero trust paradigm can be applied to safety-critical systems. For this, we investigate, among other things, novel authentication mechanisms, access and usage control systems, and secure service-oriented architectures. Our developed solutions will be prototypically implemented and evaluated.