A hybrid threat model for smart systems
File(s)
Accepted version
Author(s)
Valenza, Fulvio
Karafili, Erisa
Steiner, Rodrigo Vieira
Lupu, Emil C
Type
Journal Article
Abstract
Cyber-physical systems and their smart components have a pervasive presence in all our daily activities. Unfortunately, identifying the potential threats and issues in these systems and selecting enough protection is challenging given that such environments combine human, physical and cyber aspects to the system design and implementation. Current threat models and analysis do not take into consideration all three aspects of the analyzed system, how they can introduce new vulnerabilities or protection measures to each other. In this work, we introduce a novel threat model for cyber-physical systems that combines the cyber, physical, and human aspects. Our model represents the system's components relations and security properties by taking into consideration these three aspects. Together with the threat model we also propose a threat analysis method that allows understanding the security state of the system's components. The threat model and the threat analysis have been implemented into an automatic tool, called TAMELESS, that automatically analyzes threats to the system, verifies its security properties, and generates a graphical representation, useful for security architects to identify the proper prevention/mitigation solutions. We show and prove the use of our threat model and analysis with three cases studies from different sectors.
Date Issued
2023-09-01
Date Acceptance
2022-10-01
Citation
IEEE Transactions on Dependable and Secure Computing, 2023, 20 (5), pp.4403-4417
ISSN
1545-5971
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Start Page
4403
End Page
4417
Journal / Book Title
IEEE Transactions on Dependable and Secure Computing
Volume
20
Issue
5
Copyright Statement
© 2022 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Identifier
https://ieeexplore.ieee.org/document/9916127
Publication Status
Published
Date Publish Online
2022-10-11