Abstract:

Cyber-Physical Systems are converging towards a component-oriented and platform-based implementation. The community-driven Robotic Operating Systems and the proprietary Residential Operating System (of Prodea) are just two examples that indicate this trend. We envision that the software of the CPS is frequently updated and reconfigured, yet it cannot be guaranteed that security vulnerabilities are completely absent in the deployed systems. Clearly, there is a need to incorporate appropriate security features in these platforms so that they exhibit the necessary resilience properties and continue providing services even if parts of the larger system are compromised. In this project we develop a model-driven approach to system architecting for these component-based CPS that results in analysis techniques to determine the resilience of the systems, and in synthesis techniques that assist with the implementation. Prototypes and experimental studies will provide the vehicle for evaluation.

Hard Problems Addressed:

• Develop means to design and analyze system architectures that deliver required service in the face of compromised components
• Formal and informal domain-specific modeling languages to represent properties of CPS relevant for resilience
• Scalable and composable analysis approaches to determine the resilience metrics for the system of CPS against security attacks
• Requirements for trustworthy and dependable component-based software platforms that provide support for resilience

This research thrust focuses on the design and development of a highly accessible and scalable testbed environment for supporting the evaluation and experimentation efforts across the entire SURE research portfolio. This work is based on our existing technologies and previous results with the Command and Control Windtunnel (C2WT), a large-scale simulation integration platform and WebGME, a metaprogrammable web-based modeling environment with special emphasis
on on-line collaboration, model versioning and design-reuse. We are utilizing these core technologies and other third-party tools (e.g. Emulab) to provide a web-based interface for designing, executing and evaluating testbenches on a cloud-based simulation infrastructure. The metaprogramable environment enables us to develop and provide modeling languages, which specifically target each research thrust. Furthermore, by leveraging built-in prototypical inheritance we are building re-usable library components in the target domains.

First, the developed visual/modeling languages will be used to capture the physical, computational and communication infrastructure. Also, the simulation models will describe the deployment, configuration and/or the concrete strategies of security measures and algorithms. Third, the environment will provide entry points for injecting various attack or failure events from an existing library of components or by providing a model-based description of the algorithm.

For stimulating the experimentation and validation efforts in the SURE research thrusts and to motivate students and outside contributors to participate we are developing "Red Team" vs "Blue Team" simulation scenarios, where a using a given CPS infrastructure model each team is tasked to develop and/or configure security and fail-over measures while the other team develops an attack model. After the active design phase--when both teams are working in parallel and in isolation--the simulation is executed with no external user interaction, potentially several times. The winner is decided based on the scoring weights and rules which are captured by the infrastructure model. If successful, we may organize championships and maintain a leader board for each infrastructure model.

In security, our concern is typically with securing a particular network, or eliminating security holes in a particular piece of software.  These are important, but they miss the fact that being secure is fundamentally about security of all constituent parts, rather that any single part in isolation. In principle, if we can control all the pieces of a system, we can secure all possible channels of attack.  Typically, system and security design of various components are performed by different agents, having varying and often conflicting interests. Our goal is to develop this framework, and associated computational tools to address security holistically, accounting for incentives of all the parties.

In particular, the project aspires to investigate the many facets of decentralization in security. The overarching aim is to answer the following three questions in a variety of relevant settings: 1) what does decentralization of security decisions and associated incentive misalignment imply for overall system security; 2) in the world of decentralized security decisions, how should an organization optimally secure itself; and 3) how can one design incentives or constraints to improve the overall system security.  Much of the project focus will be on interdependence of security decisions, giving rise to competing decision externalities: positive externalities, where securing one’s system reduces exposure risk for others, and negative externalities, where security of one system incentivizes the attacker to attack another. The former will tend to lead to under-investment in security; the latter are expect to push organizations to invest too much.

Existing protocol analysis are typically confined to the electronic messages exchanged among computer systems running at the endpoints. In this project we take a broader view in which a protocol additionally encompasses both physical technologies as well as human participants. Our goal is to develop techniques for analyzing and proving security of protocols involving all these entities, with open-audit, remote voting systems such as Remotegrity as our starting point.

Our goal is to develop a transormational framework for a science of trust, and its impact on local policies for collaboration, in networked multi-agent systems. The framework will take human bahavior into account from the start by treating humans as integrated components of these networks, interacting dynamically with other elements. The new analytical framework will be integrated, and validated, with empirical methods of analyzing experimental data on trust, recommendation and reputation, from several datasets available to us, in order to capture fundamental trends and patterns of human behavior, including trust and mistrust propagation, confidence in trust, phase transitions in the dynamic graph models involved in the new framework, stability or instability of collaborations.

Trust as a concept, has been developed and used in several settings and in various forms. It has been devloped and applied in social and economic networks as well as information and communication networks. An important challenge is the diversity of descriptions and uses of trust that have appeared in prior work. Another challenge is the relative scarcity of quantitative and formal methods for modeling and evaluating trust. Methods for modeling trust have varied from simple empirical models based on statistical experiments, to simple scalar weights, to more sophisticated policy-based methods. Furthermore, there are very few works attempting to link empirical data on trust (in particular data on human behavior) to various formal and quantitative models.

Our new framework is based on our recently developed foundational model for networked multi-agent systems in which we consider three interacting dynamic graphs on the same underlying set of nodes: a social/agent network, which is relational; an information network, which is also relational; and a communication network that is physical. These graphs are directed and their links and nodes are annotated with dynamically changing "weights" representing trust metrics whose formal definition and mathematical representation can take one of several options, e.g. weights can be scalars, vectors, or even policies (i.e. rules). Such models, in much simpler mathematical form, have been used in social- and economic-network studies under the name of value directed graphs. The model we are developing is far more sophisticated, and thus much more expressive. We will incorporate within such models complex human behavior in various forms.

Within this new framework that we are developing, we are specifically focusing on investigating the following fundamental problems: (a) Theories and principles governing the spreading dynamics of trust and msitrust among memebers of a network; (b) Design and analysis of recommendation systems, their dynamics and integrity; (c) Development of a framework for understanding the composition of trust across various networks at the different layers of our basic model; (d) Analysis of the effects of trust on collaboration in networked multi-agent systems, using game-theoretic and economic principles.

Various practical applications are also pursued to demonstrate the results in various practical settings.

In these investigations we principally use the following analytical methods and appropriate extensions: (i) Multiple partially ordered semirings; (ii) Constrained-coalitional games on dynamic networks; (iii) Embeddings of complex annotated graphs in nonlinear parametric spaces for the development of scalable and fast algorithms (e.g. hyperbolic networks and hyperbolic embeddings); (iv) Sophisticated statistical analysis of experimental data on trust and associated human behavioral patterns.