DYPOSIT: Dynamic Policies for Shared Cyber-Physical Infrastructures under Attack

DYPOSIT项目解决了大型共享网络物理系统(CPS)基础设施受到攻击的问题。特别是，该项目满足了在面对对集成了各种利益相关者运行的多个应用程序的共享CPS交换矩阵的攻击时，快速和按需动态制定和调整安全策略的迫切需要。DYPOSIT通过一种新的动态策略方法解决这一基本研究问题，该方法植根于对共享CPS交换矩阵受到攻击的复杂性和动态的社会技术理解。DYPOSIT的方法是独一无二的，具有变革性，因为它采用了跨学科的观点来推理CPS的安全状态，并制定应对CPS受到攻击的措施。这与其他方法形成鲜明对比，其他方法仍然主要侧重于提供安全或解决方案的技术措施，以迎合CPS中采用的设备的资源受限性质。此外，DYPOSIT的动态策略方法为策略在大规模CPS环境中的角色提供了一个新的视角-将策略从简单的强制执行预定义安全属性的手段转变为作为活的、不断演变的对象的策略，这些对象在推理此类CPS的安全状态和应对正在展开的攻击方面发挥核心作用。在解决冲突的同时，管理在这种环境下动态制定和调整策略的复杂性，是迈向弹性共享CPS结构的根本进步。DYPOSIT的科学进步在现成的现实试验台上得到了验证，该试验台用于提供各种应用场景，描绘受到攻击的CP：高度管理的CP，如工业控制系统或未来工厂中的CP，到动态聚合的CP，如智能城市、大型制造工厂或智能交通系统中的CP。

The DYPOSIT project tackles the problem of large, shared cyber-physical system (CPS) infrastructures under attack. In particular, the project responds to the critical need for dynamically formulating and adapting security policies, rapidly and on-demand, in the face of unfolding attacks on a shared CPS fabric integrating multiple applications run by a variety of stakeholders. DYPOSIT tackles this fundamental research problem through a novel dynamic policies approach rooted in a socio-technical understanding of the complexity and dynamics of shared CPS fabrics under attack. DYPOSIT's approach is unique and transformative as it takes an inter-disciplinary view of reasoning about the security state of a CPS and formulating responses to CPS coming under attack. This is in sharp contrast to other approaches that remain largely focused on technical measures to provide security or solutions that cater for the resource-constrained nature of the devices employed in a CPS. Furthermore, DYPOSIT's approach to dynamic policies offers a new perspective on the role of policies in large-scale CPS settings - transforming policies from simply a means to enforce pre-defined security properties to policies as living, evolving objects that play a central role in reasoning about the security state of such a CPS and responding to unfolding attacks. Managing the complexity of formulating and adapting policies dynamically in such a setting, while resolving conflicts, is a fundamental advance towards resilient shared CPS fabrics. DYPOSIT's scientific advances are validated in an available realistic testbed, which is used to provide application scenarios depicting CPS under attack across a spectrum: highly-managed CPS such as those found in industrial control systems or future factories through to dynamically aggregated CPS, as in smart cities, large manufacturing plants or intelligent transportation systems.