SBIR Phase II: Cyber Security Monitoring for Critical Embedded and Wireless Systems Using Power Fingerprinting

这项小型企业创新研究（SBIR）二期项目将为基于功率指纹（PFP）技术的工业控制系统（ICS）提供一种新的网络安全解决方案。PFP通过使用外部设备监控侧信道信息和应用信号处理技术来确定处理器的执行状态，为嵌入式和资源受限平台提供完整性评估和入侵检测。由于PFP监测是由外部设备执行的，因此它可以应用于计算资源受限的平台，例如工业控制系统，而基于传统网络安全方法的解决方案实际上是不存在的。目前还没有商业上可用的解决方案能够直接监控核心ICS元件（如可编程逻辑控制器（plc））的执行和检测入侵。第二阶段工作的目标包括：1)通过集成商用组件开发用于ICS的PFP监视器原型，2)开发必要的软件工具来支持ICS监视，以及3)使用关键基础设施中使用的代表性ICS平台验证原型。在第二阶段结束时，原型PFP监视器将在盲测中检测恶意入侵，作为将该技术推向商业化的垫脚石。该项目的更广泛/商业影响是为关键基础设施中的ICS开发创新的网络安全解决方案。PFP可以防止资金充足的对手在不被发现的情况下破坏关键系统。PFP监测器可以评估没有商业解决方案的国际集成系统核心元件的完整性。PFP可以应用于嵌入式平台，并可以与传统的网络安全解决方案共存，在纵深防御方法中增加额外的保护层。这些特征使PFP成为检测复杂的隐蔽攻击ICS的强大工具，例如最近的Stuxnet蠕虫。传统的网络安全方法，如反病毒和防火墙，正在被用于ICS，但收效甚微。因此，PFP解决了在关键基础设施中保护ics并直接监控其执行的日益增长的需求。PFP在商业和政府市场有双重应用，特别是对于资源受限和嵌入式平台。PFP有潜力通过保护国家而成为网络安全的基本参与者吗？促进经济基础和就业的进一步发展。

This Small Business Innovation Research (SBIR) Phase II project should provide a novel cyber security solution for Industrial Control Systems (ICS) based on Power Fingerprinting (PFP) technology. PFP provides integrity assessment and intrusion detection for embedded and resource-constrained platforms by using an external device to monitor side-channel information and applying signal processing techniques to determine the execution status of a processor. Because PFP monitoring is performed by an external device, it can be applied to platforms with constrained computational resources, such as Industrial Control Systems, for which solutions based on traditional cyber security approaches are practically inexistent. There are no commercially available solutions capable of monitoring the execution and detecting intrusions directly in core ICS elements, such as Programmable Logic Controllers (PLCs). The objectives of this Phase II effort include: 1) Develop a PFP monitor prototype for ICS by integrating commercially available components, 2) Develop the necessary software tools to support ICS monitoring, and 3) Validate the prototype using representative ICS platforms used in critical infrastructure. At the end of Phase II, the prototype PFP monitor will be demonstrated detecting malicious intrusions in blind tests, serving as stepping stone to bring this technology into commercialization.The broader/commercial impact of this project is the development of an innovative cyber security solution for ICS in critical infrastructure. PFP can prevent well-funded adversaries from compromising critical systems without being discovered. The PFP monitor can assess the integrity of core elements in ICSs for which there are no commercial solutions available. PFP can be applied to embedded platforms and can coexist with traditional cyber security solutions adding an extra layer of protection in a defense-in-depth approach. These characteristics make PFP a powerful tool for detecting sophisticated covert attacks to ICS, such as the recent Stuxnet worm. Traditional cyber security approaches, such as anti-virus and firewalls, are being adapted for ICS with very limited success. Thus, PFP addresses a growing need to secure ICSs in critical infrastructure and directly monitor their execution. PFP has dual application in the commercial and government markets, particularly for resource-constrained and embedded platforms. PFP has the potential to become a fundamental player in cyber-security by protecting the nation?s infrastructure and promoting further development of the economic base and employment.