Topic 1: System Security for Infrastructure Control System

Background

Recently, industrial control systems (ICS) for critical infrastructure, such as power plants and water distribution control and management systems, have been digitalized. While the digitalization achieves sophistication of data driven O&M and optimization of the control algorithm, there are emerging cyber threats against industrial control system as well as vulnerability exploitation and sensitive data exfiltration. Many sophisticated attacks exploit zero-day vulnerabilities. Since exploitation of a vulnerability in such systems may cause severe consequences in the physical world, it is a heavy responsibility of system/device vendor including Toshiba to mitigate vulnerabilities and attack surface. While the mitigation can be done through vulnerability testing and exploit synthesis using binary program analysis[1][2], there are remaining challenges specific to ICS such as timing constraint consideration, non-standard instruction set and byte code interpreters. Furthermore, data utilization of the infrastructure control field also follows increasingly by progress of AI technology etc., and we expect growing needs for the data protection technology and security protocols to leak with a disclosure risk of sensitive information.[3][4]

Suggested Research Proposals

• Security Verification for Software Implementation in industrial control systems and devices, in detail, finding vulnerabilities, composing attacks and/or synthesizing patches technology for binary programs and systems. There have already been many studies in this field, so it is important to extend existing techniques with new idea to apply them to industrial control system and devices.
• Data protection technology and data protection protocols suitable for industrial control system, such as, on the premise of multiple systems, a secure search of various O&M data and a secure fault prediction/detection technique of the system, furthermore industrial data analysis without exposing sensitive information, such as searchable encryption.

Related Papers

[1] T. Avgerinos, et al. AEG: Automatic Exploit Generation. In Proc. of NDSS, 2011.

[2] P. Godefroid, et al. Automated Whitebox Fuzz Testing. In Proc. of NDSS, 2008.

[3] Komano, et al., Toward Highly Secure Metering Data Management in the Smart Grid, https://www.imi.kyushu-u.ac.jp/files/imipublishattachment/file/math_58d8ad2f89418.pdf

[4] Start of Project to Verify Open Platform Aggregation Business, https://www.toshiba-energy.com/en/info/info2020_0608.htm