IMHOTEP-SMT: A Satisfiability Modulo Theory Solver For Secure State Estimation Yasser Shoukry 1 Pierluigi Nuzzo 2 , Alberto Puggelli 2 , Alberto Sangiovani-Vincentelli 2 , Sanjit A. Seshia 2 , Mani Srivastava 1 , and Paulo Tabuada 1 1 EE Department University of California Los Angeles 2 EECS Department, University of California Berkeley Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 1 / 30
Motivation: Sensor Attacks Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 2 / 30
Motivation: Noninvasive Spoofing Sensor Attacks Y. Shoukry, P . D. Martin, P . Tabuada, and M. B. Srivastava, “Noninvasive Spoofing Attacks for Anti-Lock Braking Systems,” in Workshop on Cryptographic Hardware and Embedded Systems 2013. Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 3 / 30
Motivation: Noninvasive Spoofing Sensor Attacks Y. Shoukry, P . D. Martin, P . Tabuada, and M. B. Srivastava, “Noninvasive Spoofing Attacks for Anti-Lock Braking Systems,” in Workshop on Cryptographic Hardware and Embedded Systems 2013. Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 3 / 30
Motivation: Noninvasive Spoofing Sensor Attacks Y. Shoukry, P . D. Martin, P . Tabuada, and M. B. Srivastava, “Noninvasive Spoofing Attacks for Anti-Lock Braking Systems,” in Workshop on Cryptographic Hardware and Embedded Systems 2013. Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 3 / 30
Motivation: Noninvasive Spoofing Sensor Attacks Y. Shoukry, P . D. Martin, P . Tabuada, and M. B. Srivastava, “Noninvasive Spoofing Attacks for Anti-Lock Braking Systems,” in Workshop on Cryptographic Hardware and Embedded Systems 2013. Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 4 / 30
Secure State Estimation Problem Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 5 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) ���� noise Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 6 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Some sensors are attacked: a i ( t ) � = 0 − → sensor i is attacked at time t ∈ N ; Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 6 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Some sensors are attacked: a i ( t ) � = 0 − → sensor i is attacked at time t ∈ N ; If sensor i is attacked, a i ( t ) can be arbitrary (no boundedness assumption, no stochastic model, etc.). Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 6 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Some sensors are attacked: a i ( t ) � = 0 − → sensor i is attacked at time t ∈ N ; If sensor i is attacked, a i ( t ) can be arbitrary (no boundedness assumption, no stochastic model, etc.). Set of attacked sensors is unknown and has cardinality s . Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 6 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Some sensors are attacked: a i ( t ) � = 0 − → sensor i is attacked at time t ∈ N ; If sensor i is attacked, a i ( t ) can be arbitrary (no boundedness assumption, no stochastic model, etc.). Set of attacked sensors is unknown and has cardinality s . The value of s is also unknown although we assume the knowledge of an upper bound s . Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 6 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Some sensors are attacked: a i ( t ) � = 0 − → sensor i is attacked at time t ∈ N ; If sensor i is attacked, a i ( t ) can be arbitrary (no boundedness assumption, no stochastic model, etc.). Set of attacked sensors is unknown and has cardinality s . The value of s is also unknown although we assume the knowledge of an upper bound s . Objective: estimate the state of the physical system x ( t ) ∈ R n . Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 6 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Example: a car with two states position , velocity and three sensors: Some sensors are attacked: a i ( t ) � = 0 − → sensor i is attacked at time t ∈ N ; y GPS ( t ) 1 0 ψ GPS ( t ) 0 � p ( t ) � If sensor i is attacked, a i ( t ) can be arbitrary (no boundedness assumption, = + y odometer ( t ) 0 1 + ψ odometer ( t ) a odometer ( t ) s = 1 v ( t ) no stochastic model, etc.). y IMU ( t ) 0 1 ψ IMU ( t ) 0 Set of attacked sensors is unknown and has cardinality s . The value of s is also unknown although we assume the knowledge of an upper bound s . Objective: estimate the state of the physical system x ( t ) ∈ R n . Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 6 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) ���� noise Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 7 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Although sensors are heterogeneous, the physical quantities they measure are correlated. Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 7 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack Example: a car with two states position , velocity and three sensors: vector Although sensors are heterogeneous, the physical quantities they measure are y GPS ( t ) 1 0 ψ GPS ( t ) 0 correlated. � p ( t ) � = + y odometer ( t ) 0 1 + ψ odometer ( t ) a odometer ( t ) s = 1 v ( t ) y IMU ( t ) ψ IMU ( t ) 0 1 0 v ( t ) ≃ ( p ( t ) − p ( t − 1 )) / ( T s ) Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 7 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Although sensors are heterogeneous, the physical quantities they measure are correlated. Physical system modeled as a discrete-time linear dynamical system: x ( t + 1 ) = Ax ( t ) + Bu ( t ) + µ ( t ) . Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 7 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Although sensors are heterogeneous, the physical quantities they measure are correlated. Physical system modeled as a discrete-time linear dynamical system: x ( t + 1 ) = Ax ( t ) + Bu ( t ) + µ ( t ) . This model: Captures adversarial attacks, non-adversarial faults, cooperative and non-cooperative attacks, ... Does not depend on how the sensor measurements are corrupted (e.g. sensor-level spoofing, spoofing communication channel, ...). Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 7 / 30
Secure State Estimation Problem A total of p sensors monitor the state of the physical system ( y ( t ) ∈ R p ): y ( t ) = Cx ( t ) + ψ ( t ) + a ( t ) . ���� ���� noise attack vector Although sensors are heterogeneous, the physical quantities they measure are correlated. Physical system modeled as a discrete-time linear dynamical system: x ( t + 1 ) = Ax ( t ) + Bu ( t ) + µ ( t ) . This model: Captures adversarial attacks, non-adversarial faults, cooperative and non-cooperative attacks, ... Does not depend on how the sensor measurements are corrupted (e.g. sensor-level spoofing, spoofing communication channel, ...). For sake of simplicity, in this talk, I will consider the noise-free case ( ψ ( t ) = µ ( t ) = 0 ). Yasser Shoukry I MHOTEP -SMT - SMT Workshop’15 July 19, 2015 7 / 30
Recommend
More recommend
