A formal adversary capability model for SCADA environments

Authors:
Thomas Richard McEvoy;Stephen D. Wolthusen
Affiliations:
Information Security Group, Department of Mathematics, Royal Holloway, University of London, UK;Norwegian Information Security Laboratory, Department of Computer Science, Gjøvik University College, Norway
Venue:
CRITIS'10 Proceedings of the 5th international conference on Critical Information Infrastructures Security
Year:
2010

Citing 5
Cited 2

PI-Calculus: A Theory of Mobile Processes

PI-Calculus: A Theory of Mobile Processes
Process algebra for hybrid systems

Theoretical Computer Science - Process algebra
SKMA: a key management architecture for SCADA systems

ACSW Frontiers '06 Proceedings of the 2006 Australasian workshops on Grid computing and e-research - Volume 54
On the security of public key protocols

SFCS '81 Proceedings of the 22nd Annual Symposium on Foundations of Computer Science
Rethinking security properties, threat models, and the design space in sensor networks: A case study in SCADA systems

Ad Hoc Networks

Modelling approaches

Critical Infrastructure Protection
Modeling and verification of security properties for critical infrastructure protection

Proceedings of the Eighth Annual Cyber Security and Information Intelligence Research Workshop

Quantified Score

Hi-index	0.00

Visualization

Abstract

Conventional adversary models used in the analysis of cryptographic protocols such as the Dolev-Yao model and variants rely on a simple communication model in which an adversary fully participates in network communication. In the case of control (supervisory control and data acquisition, SCADA) systems, this set of assumptions can lead to undesirable results as constraints on communication affect both defender and adversary capabilities. These include a restricted topology for message passing and real-time processing constraints resulting in message prioritisation. We therefore propose an alternative adversary model explicitly capturing these constraints. We use a π-calculus variant to reason about priorities and constraints on messages (names) and explicitly model multiple adversarial agents rather than a single omnipotent adversary so as to capture synchronisation and communication effects. As an example of the model's capabilities, we derive targets for intrusion detection based on constraints on adversary action resulting from adversary-agent communication capabilities.