In order to grant/withdraw the access right over the control system, we will leverage the Group Key Scheme [11] , based on which the new CPS controller can join and the malicious CPS controller can be forced to leave. In this paper, each controller’s activities will be viewed/audited by other peer controllers in real time.

The group key scheme we utilized includes two components: 1) efficient and reliable group key agreement; 2) virtual synchrony view. The former ensures that only the present group members contain the current group key. Malicious controllers will be expelled based on their misbehavior. The group key is a symmetric key shared among all current group members in such a way that the control commands or measured statuses will be encrypted by the group key during their transmission over control systems. A group key scheme should satisfy two privacies: 1) Forward secrecy: previous group members who know contiguous subsets of old group keys must not be able to discover subsequent group keys after they leave the group. 2) Backward secrecy: current group members who know a contiguous subset of current group keys must not be able to discover preceding group keys. The virtual synchrony view means that, if processes $p$ and $q$ install the same new view $V$ in the same previous view $V^{\prime }$, then any message received by $p$ in $V^{\prime }$ is also received by $q$ in $V^{\prime }$. So,

$install{s}_{in\left(p,V,V^{\prime }\right)}\wedge instal{l}_{in\left(q,V,V^{\prime }\right)}\wedge receiv{e}_{in\left(p,m,V^{\prime }\right)}\to receive{s}_{in\left(q,m,V^{\prime }\right)}.$ (1)

Authentication and integrity will be provided for group keys to prevent attacks, e.g., Man-In-The-Middle attacks, etc. But we will not explain the details here.

Our research tries to isolate the malicious CPS controllers from the control system by employing the supervisory control theory in which discrete state spaces and event-driven dynamics are widely used. From the viewpoint of discrete event systems, the control system under protection can be modelled as a plant to which the supervisory controllers send control actions. The control system is treated as the feedback control of dynamic systems, the specification of which is represented as finite-state automata over the set of discrete events. Any actions from the controllers will force the control system to make discrete changes and, consequently, generate a sequence of discrete events that can formulate transition-based, event-driven models. Research focusing on the models can analyze the security, safety, reliability, etc. [12] . Due to its capability to quickly detect and isolate malfunctions, the fault detection and diagnosis methodology synthesizing to discrete state event-driven dynamics is further studied to model the control system’s activities and to further deduce controllers’ misbehavior [13] . However, it is still a concern that they are sensitive to noises, which may easily lead to false alarms during normal operations.

The reputation of a host [10] has been treated as a vital metric which measures the security condition of a host. Based on the reputation value, some systems construct a list of rejections. The purpose is to block/filter the inbound or outbound traffic sent from/forwarded to hosts in the list.

A control system, for example, a driverless vehicle, could be driven by a few controllers. At each time point $t_i$, the vehicle received a few control commands, one of which was issued by the controller in charge. Our decision is based on the current status of the vehicle (e.g. speed, engine brake, gas, light, etc.), context around the vehicle (e.g. other vehicles at the same lane or different lanes, road condition, etc.), and the mission of this trip. Then, we need to figure out how to evaluate which control command is safe. If the control command in charge is malicious, how can we find the right from others? To be more generic, let us assume the controller may be physical, cyber or human operators, namely, $O=\left\{O_x\right\}$, where $x=1,\cdots n$. Let $P$ denote the control system, say, driverless vehicle which is fed with a number of control commands from different controllers at every time point. Therefore, at a sequence of time points, $\left\{t_1,t_2,\cdots ,t_m,\cdots \right\}$, there are a series of control commands $\left\{{\left\{c_{O_1},c_{O_2},\cdots \right\}}_{t_1},{\left\{c_{O_1},c_{O_2},\cdots \right\}}_{t_2},\cdots \left\{c_{O_1},c_{O_2},\cdots \right\}{t}_m\cdots \right\}$. At each time point, the mobile control system could be at a status, $S_k$ where $S_k\in S$ and $S_k={\left[M\right]}_{i\times j}$ and $i,j,m$ are integers. Note that ${\left[M\right]}_{i\times j}$ represents a block of key parameters which are measured from object, $P$. The problem we would like to address is that, at time point $t_i$, we need to select a control command $c_x\in {\left\{c_{O_1},c_{O_2},\cdots \right\}}_{t_i}$ in a sense that $c_x$ will lead driverless vehicle from status $S_{t_i}$ to $S_{t_{i+1}}$ in which the condition $S_{t_{i+1}}$ is safe. The challenge is (1) how to validate $c_x$ in case of the context set $\phi \left(t_i\right)=\left\{{\phi }_1,{\phi }_2,\cdots {\phi }_n\cdots \right\}$ and the mission $M$ where ${\phi }_i$ is one element of context, (2) how to drop the malicious commands and (3) how to punish the corresponding unsafe controller.

As depicted in Figure 1 , our paper proposes a new physical, human and cyber triad system, which is comprised of three components (sketched as circles), each denoting one type of controller.

The system under protection is represented by the “control system” blocks (sketched as rectangles), which abstract a general model with such instances as modern vehicles, unmanned robots, etc. The solid, directional links connecting controller elements and the control system blocks denote the capability of the control privilege, and the dashed links represent functions of collecting statuses from control systems.

A controller operates control systems through three channels: the human operators drive the handle, e.g., function lever, the automation control systems execute embedded operational instructions in firmware, and the remote access cyber systems forward control commands that are encapsulated in packets through cyber communication channels.

This paper assumes that any controller in a physical, human and cyber triad could act maliciously since, even if not hostile at the beginning, it may potentially be compromised by attackers in future. The paper will use this conceptual architecture to offer a quantitative, abstract model to assess the compromised controller based on their misbehavior activities and to further provide a mechanism which can withdraw the control privileges after the detection of corresponding attacks.

This paper seeks to mitigate the threat introduced by the following problems for each physical, human and cyber controller: 1) Define a variety of metrics to model the misbehaviors over the control systems; 2) Construct the quantitative framework to evaluate the security conditions of the control system based on the captured operational commands and the corresponding results; and 3) Define reputation index thresholds in the quantitative framework and withdraw adversary controller’s control privilege when its reputation index is beyond the threshold.

Note that this paper only proposes the framework rather than studying the details due to the limited space.

So, the following work will not be considered in this paper. But they can be accomplished in our future work:

1) Fulfill numerous data collection, data separation, and data analyses over not only control commands instructed by all physical, human and cyber controllers but also the status result data measured over the control system for both before and after the control commands are executed;

2) Construct a generic model to measure a set of essential metrics which can not only evaluate the security condition of control systems but also assess other critical parameters such as reliability, safety and so on;

3) Design the quantitative framework indicating the security level for each controller, namely, the autonomic controller, human operators, and remote access cyber controllers. Security conditions will be assessed by discrete-state event-driven fault-diagnosis theories [14] [15] , by human operation manuals [1] [5] [6] , by finite-state machines, and by reputation systems [10] , and;

4) Withdraw the malicious controllers’ control privileges via group key schemes [11] after attacks are detected.

Capture Control Commands and Statuses:

We collect the control commands that are issued by physical, human, and cyber controllers, as well as a finite sequence of statuses of control systems. Those raw data will be de-noised, stored, classified, filtered and evaluated through a set of pre-processing operations or algorithms.

Autonomic control system (P): we first map a sequence of observable events $E=\left\{e_1,e_2\cdots ,e_n\right\}$ to a set of control actions $C=\left\{c_1,c_2\cdots ,c_n\right\}$. Function $F:E\times C=\left\{e_i\right\}\times \left\{c_j\right\}$. Our intrusion detection system is defined as $I$ (a fault-diagnosis function). The control loop $A\to F$ (where A: finite-state automation) is named as a potential attack if the action $c_j$ is misbehavior and if the $e_i$ is one of the fault states of the control system. Combining the active fault-diagnosis theory and the finite-state automation method, the intrusion detection $I$ could abstract the control system as discrete-state event-driven dynamic and identify the misbehavior or attacks as an active fault event. If a fault even occurs, the corresponding action $c_j$ will be traced back to its controller, whose reputation index, in turn, will be impacted.

Human Operator (H): wrong human operations can negatively impact the control systems, which are shown as different kinds of symptoms. We can collect a number of symptoms led by the misbehavior which will be treated as complementary to some well-known guides or user manuals [1] [5] [6] . They altogether can correct the mis-operation and stop adversaries.

Cyber remote control (C): we will analyze the malicious activities launched from remote access cyber controller through the method for data collection and measurement. Its result reflects the reputation index of each specific remote host, based on which the list of rejection can be constructed.

Misbehavior Abstraction, Profiling and Modeling:

While analyzing control commands, we aim to identify, profile, model and filter attacks based on a formal method via utilizing finite-state machine, namely $\Phi$, which is listed below:

$S\times C\stackrel{\Phi }{\to }S\times O$ (2)

$\Phi \left(S,C\right)=\Phi \left(S,\left\{c_1,c_2,\cdots c_n\right\}\right)$ (3)

$=\Phi \left(\Phi \left(S,c_1\right),\left\{c_2,\cdots c_n\right\}\right)$ (4)

where

S is the state,

C is the control command sequence,

O is the output,

c_n is each control command.

Record Misbehavior:

Regarding each control command c_i on the list of rejection, the controller which sends out c_i, will be impacted for its reputation index.

Access Control (group key scheme):

The group key will be rekeyed, which can guarantee both forward privacy and backward privacy. Thus, the expelled controller cannot get the subsequent group keys. The control system is assumed to always hold the current group key and therefore can decrypt the ciphertext. The other advantage is that peer and legal controllers can audit others’ activities in order to prevent the misbehavior via group key.

Let us take a driverless car as an example: at a time point $t_i$, a few controllers, $O_h$, $O_p,$ and $O_c$ represent the human driver, the physical automation control device in the vehicle and the remote access cyber control program, respectively. They issue control command ${\left\{c_{O_h},c_{O_p},c_{O_c}\right\}}_{t_i}$. In our paper, since each of $O_h$, $O_p,$ and $O_c$ could be malicious, we will choose the right control command $O_r$ for driverless vehicle $P$ based on the current context set $\phi \left(t_i\right)$ and the vehicle statuses, $S_k={\left[M\right]}_{i\times j}$. The context set $\phi \left(t_i\right)$ could include the road traffic, the speed of other vehicles in front/behind the vehicle or at neighbor lanes, the pedestrian on the road, the condition of the road, parking space, gas level, map service, and so on. In a word, the context, together with the current status of the vehicle as well as the mission of the trip, can decide whether the vehicle is safe or not. Our future work includes both simulation and real-world experiments.