A Risk-Aware Access Control Framework for Cyber-Physical Systems

Abstract

Cyber-physical systems (CPS) integrate cyber components into physical processes. This integration enhances the capabilities of physical systems by incorporating intelligence into objects and services. On the other hand, integration of cyber and physical components and interaction between them introduce new security threats. Since CPSs are mostly safety-critical systems, data stored and communicated in them are highly critical. Hence, there is an inevitable need for protecting the data and resources against unauthorized accesses. In this paper, we propose an access control (AC) framework to address CPS related security issues. The proposed framework consists of two parts: a cyber-physical access control model (CPAC) and a generalized action generation model (GAGM). CPAC utilizes an attribute based approach and extends it with cyber-physical components and cyber-physical interactions. GAGM is used to augment enforcement of authorization policies. We present formal representations of CPAC and GAGM, and provide a sample scenario for a medical CPS. We propose an algorithm for enforcing authorization policies.