SCOPE: Secure Compiling of PLCs in Cyber-Physical Systems
This work tackles the critical problem of memory-safety attacks in Cyber-Physical Systems, which are vital for critical infrastructure, by providing a solution that prioritizes both security and system availability, an incremental improvement for the CPS security domain.
This paper addresses memory-safety attacks in Cyber-Physical Systems (CPS) by proposing a full-stack memory-safety enforcement based on secure compiling of PLCs. It detects attacks and mitigates them by bypassing illegal memory access instructions at runtime, demonstrating effectiveness and efficiency on real CPS experimental settings.
Cyber-Physical Systems (CPS) are being widely adopted in critical infrastructures, such as smart grids, nuclear plants, water systems, transportation systems, manufacturing and healthcare services, among others. However, the increasing prevalence of cyberattacks targeting them raises a growing security concern in the domain. In particular, memory-safety attacks, that exploit memory-safety vulnerabilities, constitute a major attack vector against real-time control devices in CPS. Traditional IT countermeasures against such attacks have limitations when applied to the CPS context: they typically incur in high runtime overheads; which conflicts with real-time constraints in CPS and they often abort the program when an attack is detected, thus harming availability of the system, which in turn can potentially result in damage to the physical world. In this work, we propose to enforce a full-stack memory-safety (covering user-space and kernel-space attack surfaces) based on secure compiling of PLCs to detect memory-safety attacks in CPS. Furthermore, to ensure availability, we enforce a resilient mitigation technique that bypasses illegal memory access instructions at runtime by dynamically instrumenting low-level code. We empirically measure the computational overhead caused by our approach on two experimental settings based on real CPS. The experimental results show that our approach effectively and efficiently detects and mitigates memory-safety attacks in realistic CPS.