DYPOSIT: Dynamic Policies for Shared Cyber-Physical Infrastructures under Attack

DYPOSIT项目解决了大型共享网络物理系统（CPS）基础设施受到攻击的问题。特别是，该项目响应了动态制定和调整安全策略的关键需求，快速和按需，面对对集成由各种利益相关者运行的多个应用程序的共享CPS结构的不断发展的攻击。DYPOSIT通过一种新的动态策略方法来解决这个基本的研究问题，这种方法植根于对受攻击的共享CPS结构的复杂性和动态性的社会技术理解。DYPOSIT的方法是独特的和变革性的，因为它采用跨学科的观点来推理CPS的安全状态，并制定CPS受到攻击的响应。这与其他方法形成鲜明对比，这些方法主要集中在技术措施上，以提供安全性或解决方案，以满足CPS中使用的设备的资源限制性质。此外，DYPOSIT的动态策略方法为大规模CPS设置中的策略角色提供了一个新的视角——将策略从简单地强制执行预定义安全属性的手段转变为作为活的、不断发展的对象的策略，这些对象在推断此类CPS的安全状态和响应展开的攻击中发挥核心作用。在解决冲突的同时，在这种情况下动态管理制定和调整政策的复杂性，是向弹性共享CPS结构迈进的根本进步。DYPOSIT的科学进步在一个可用的现实试验台中得到验证，该试验台用于提供描述CPS在各种攻击下的应用场景：高度管理的CPS，如工业控制系统或未来工厂中的CPS，到动态聚合的CPS，如智能城市，大型制造工厂或智能交通系统。

The DYPOSIT project tackles the problem of large, shared cyber-physical system (CPS) infrastructures under attack. In particular, the project responds to the critical need for dynamically formulating and adapting security policies, rapidly and on-demand, in the face of unfolding attacks on a shared CPS fabric integrating multiple applications run by a variety of stakeholders. DYPOSIT tackles this fundamental research problem through a novel dynamic policies approach rooted in a socio-technical understanding of the complexity and dynamics of shared CPS fabrics under attack. DYPOSIT's approach is unique and transformative as it takes an inter-disciplinary view of reasoning about the security state of a CPS and formulating responses to CPS coming under attack. This is in sharp contrast to other approaches that remain largely focused on technical measures to provide security or solutions that cater for the resource-constrained nature of the devices employed in a CPS. Furthermore, DYPOSIT's approach to dynamic policies offers a new perspective on the role of policies in large-scale CPS settings - transforming policies from simply a means to enforce pre-defined security properties to policies as living, evolving objects that play a central role in reasoning about the security state of such a CPS and responding to unfolding attacks. Managing the complexity of formulating and adapting policies dynamically in such a setting, while resolving conflicts, is a fundamental advance towards resilient shared CPS fabrics. DYPOSIT's scientific advances are validated in an available realistic testbed, which is used to provide application scenarios depicting CPS under attack across a spectrum: highly-managed CPS such as those found in industrial control systems or future factories through to dynamically aggregated CPS, as in smart cities, large manufacturing plants or intelligent transportation systems.