Hardware-level Vulnerabilities and Support for Secure and Safe Cyber-Physical Systems
Cyber-physical systems (CPS) interact with both the physical and cyber worlds, rendering them more vulnerable to security and safety issues compared to traditional computer systems. CPS rely on hardware computers to facilitate their execution. Similar to numerous hardware-level vulnerabilities in traditional computer systems that impact system security, hardware-level vulnerabilities can also compromise the security and safety of CPS. In this dissertation, we delve into hardware-level vulnerabilities and the provision of support for secure and safe CPS.In terms of a security vulnerability in CPS, we showcase how an unprivileged user-space program, lacking access to sensor inputs or the protected state of control software, can predict the route or location of an autonomous vehicle. This prediction is achieved using a prime-and-probe cache timing channel attack on the control software. Addressing CPS security support, we introduce AutoCAT, the first framework utilizing reinforcement learning to autonomously explore cache timing attacks. These attacks have been demonstrated to affect CPS confidentiality. AutoCAT can discover cache timing attack sequences across multiple cache configurations, replacement policies, prefetchers, and can bypass defense and detection mechanisms, while also identifying new cache timing attack vectors. For safety vulnerabilities in CPS, we demonstrate that CPS safety can be compromised by an interrupt attack. We derive an analytical equation connecting timestamp errors and physical-world localization errors. Additionally, we design and implement a Trusted Execution Environment (TEE)-based sensor timestamp module using off-the-shelf hardware. We illustrate the impact of the interrupt attack on timestamp integrity and provide a demonstration of this attack on the ROS platform. Furthermore, we present quantitative studies studying its influence on localization errors. To support CPS safety, we propose hardware assistance to expedite path planning execution, thus enhancing safety. Specifically, we introduce the use of a space-filling curve to efficiently index, memorize, and prune time-consuming nearest neighbor search and collision detection tasks in path planning. We present a high-performance hardware implementation and a programming interface for the memorization of space-filling curve-indexed tree nodes, catering to nearest neighbor search and collision detection. This hardware-oriented approach reduces path planning execution time, especially in scenarios involving dynamic obstacles, thereby enhancing safety. In summary, this dissertation delves into hardware-level vulnerabilities and introduces measures to support the security and safety of CPS. We envision a future where meticulously designed hardware could furnish security and safety assurances for CPS.