-Today, robotic systems are becoming very popular. They are typically used to monitor critical objects. Human lives often depend on the correct operation of a robotic system. Therefore, risk analysis of a robotic information system is an important task. However, to date there is no standard that describes this process. We conducted a study of existing standards for industrial control system and typical information systems. We have identified one common problem. If the risk assessment process is still described in these documents, then the analysis of initial security is not considered at all. This assessment of the initial level of security, the analysis of structural and functional characteristics is a very important task. If we are not completely knowledgeable about our system, then we may not fully assess the risks. Therefore, an attacker can take advantage of this. This article also discusses security incidents related to robotic systems. We concluded that an attacker may not have special means to attack, and at the same time causes substantial damage to the robotic system. Indeed, the main problem in the analysis of robotic systems is the difference of this type of network from the typical computer networks, which in turn requires the creation of new methods and approaches to the analysis of the security of a network of mobile robots.
INTRODUCTION
As is well known, the industry associated with robotic
systems is actively developing. Automation in production,
military areas is becoming a mass phenomenon. Special
types of networks are being created; new ways of data
processing and decision-making methods are being
introduced, as well as artificial intelligence [
The novelty of this research lies in the fact that the authors proposed a technique for assessing initial security as well as risk assessment and information security threats. Thus, the main goal of our study is to develop a methodology for assessing information security risks for a robotic system by assessing the initial security. To achieve this goal, it is necessary to perform the following tasks:
• Researching for the features of robotic systems, and the architecture of robotic systems.
• Structuring and systematization information about robotic systems.
• Determination of indicators to assess the degree of protection of the robotic system.
• Development of the methodology of assessing the level of degrees of criticality, initial security, degree of difficulty of attack realization, negative consequences of the threat.
The remainder of the paper is structured as follows. Section 2 summarizes related work. Section 3 described analyses of the structural and functional characteristics of robotic systems, Section 4 view аassessment of the level of initial security, in Section 5 is described degree of difficulty of attack realization, in Section 6 represents negative consequences of the threat and Section 7 is conclusion and future work.
II.
RELATED WORK
The closest methodical document, which describes a
process of evaluating the initial security level, is a: Method
for determining threat to the security information in
information systems by FSTEK [
FSTEC Order No. 31 «Approval requirements for the
provision information security in the industrial control
systems (ICS) on critical infrastructure, potentially
dangerous objects, and objects posing an increased danger to
life and health and for the environment» was published in
2014 [
• Level of input (output) of data of executive devices (lower (field) level).
Despite the fact, that in the order to allocate separately autonomous management level, directly implying the protection of actuators and sensor system in the section, which deals with the protection subsystem, the specific features of the Autonomous level not taken into account. In addition, this document does not consider that executive mechanisms (which may include sensor nodes, robots) themselves autonomous controls may take decisions or act in a separate group. At the same time, intermediaries between the group of executing devices and the operator (devices at the automatic control level) can often be absent when it comes to a fully distributed system. Currently, group management systems, group intelligence are gaining more and more popularity [8]. These systems will provide greater economic efficiency and eliminate a single point of failure.
In 2008, a safety standard for industrial control systems
was issued. National Institute of Standards and Technology
represents SP 800-82 Guide to Industrial Control Systems.
For example, is the NIST, the ISO, but these standards are
mainly aimed at examining protection systems for the
Internet of things. NIST has developed a Framework for
Improving Critical Infrastructure Cybersecurity, where
represented the necessary security subsystems that should be
implemented in information systems [
• Control node. The control node consists of measurement sensors, a controller (includes equipment and actuators, such as PLC controllers, valves, switches, levers, motors) and variable systems.
• Human Machine Interface (HMI). Operators and engineers use the HMI to monitor, control and change set points, algorithms, control and set controller parameters.
• Remote diagnosis and support program. Remote diagnostic and support programs are used to prevent, recognize, and correct malfunctions.
This structure is fundamentally different from that
presented in the FSTEC. In May 2015, the standard was
released in the second version. The document describes the
structure of ICS as follows. A typical ICS contains numerous
control loops, human interfaces, and remote diagnostics and
maintenance tools built using an array of network protocols
on layered network architectures. Control loops utilize
sensors, actuators, and controllers (e.g., PLCs) to manipulate
some controlled process [
III.
CHARACTERISTICS OF ROBOTIC SYSTEMS
The nodes of the robotic system collect information and,
if necessary, control a remote object. Robots can be both
stationary and mobile. Robots can act as autonomous, or they
can be remotely controlled. Robots could be in active mode
or in sleep mode if necessary. Sensor nodes provide the
ability to track various physical processes. A group of nodes
can be networked according to the IEEE 802.11n, s standard,
which is part of the IEEE 802.11 standards and allows to
organize hierarchical wireless Ad-Hoc and mesh networks.
In addition, ZigBee, 6LoWPAN, Thread, RPL, BLE, and
other protocols support for communication [
The main differences are that we separately distinguish
such subsystems as: smart management and security system.
This is very important when assessing threats and
vulnerabilities since these subsystems are significantly
different from others. In addition, in the hardware system, we
single out separately computing mechanisms, a sensory
system and actuators, and auxiliary hardware [
High - The implementation of an attack on a particular security attribute will lead to serious consequences such as denial of service, system damage, system destruction, system malfunction, control interception, system destruction, landing system for further research and data collection, as well as entail for itself damage in the field of state security, in the field of defense, political field, economic, man-made consequences.
Medium - The implementation of an attack on a particular security attribute will lead to minor consequences such as a short-term system shutdown, partial destabilization of the network due to the failure of one or more mobile devices. The introduction of an attacker can lead to disruption of the system’s functioning, as well as to disrupt the process of achieving goals. The application of a destructive effect on the network, and a partial failure of the system, as well as the implementation of the attack, are detrimental in the field of economy, reputation, and political.
Low - The implementation of an attack on a particular security attribute leads to minimal consequences such as a partial destabilization of the network, short-term interference with data transmission, as well as the implementation of the attack is harmful in the social, reputational and economic fields.
When identifying information security threats at the stage of creating an information system (IS) in the case when information protection measures are not implemented or their sufficiency and effectiveness are not assessed, the assessment of the possibility of realizing a threat, which is characterized by how likely it is. Robotic IS with given structural and functional characteristics and features of functioning, is carried out relative to the level of initial security of IS. The level of initial security is understood to be the security of the IS, due to the structural and functional characteristics set in the design and the conditions of its operation. The level of initial security is determined based on the analysis of design structural and functional characteristics. During the creation of a robotic IS, the level of its initial security is determined as follows, as described in table 1. It is necessary to determine how to assess the impact of certain factors on the structural and functional characteristics of the information system and its operating conditions, such as physical influence or the effect on the communication channels of a robot. To assets this it is necessary to determine the reason for assigning a characteristic to each level. This can be done in an expert way, but in this study, it was proposed to use the evaluation of factors. These factors were chosen based on what effect an attacker could have on a particular structural-functional characteristic. In determining the level of initial security for each of the characteristics, it was assessed whether the attacker could disrupt the functioning of a particular characteristic according to these factors: Violation of the hardware performance; Violation of the software; Violation of communication channels; Violation of the navigation system; Negative impact on the robotic IS operator; Impact on data transmission process. The results of the assessment of the impact of factors on the structural and functional characteristics are presented in table 1.
The result of the analysis of the structural and functional characteristics of the robotic IS, the conditions of its operation, as well as the effects of various factors on each of the security levels of the robotic complexes, is table 2. During the creation of a robotic IS, the level of its initial security is determined as follows, as described below. Robotic IS has a high level of initial security, if at least 80% of IS characteristics correspond to the “high” level, and the rest - to the average level.IS has an average level of initial security, if the conditions under at least 90% of the characteristics of the IS correspond to a level no lower than “medium”, and the rest - to a low level of security.IS has a low level of project security, if the conditions in “high” level and “medium” level are not met.down to the next line. This is the author sequence that will be used in future citations and by indexing services. software, which can be purchased online for as little as $ 25.95.
In 2011, Iran planted on its territory the American secret UAV RQ-170 Sentinel, using such vulnerability as GPSspoofing. As a result of these actions, the UAV automatically, guided by the global navigation system, began returning home. Since the true signal of the satellites was drowned out by a false one, the RQ-170 took the Iranian airfield, taking it as its “home” one.
In 2013, Sami Kamkar used the Aircrack-ng utility to hack the AR.Drone UAV wireless network, on the base of the Raspberry Pi, a Wi-Fi transmitter and receiver. The attacker explained that the quadcopters on the network could be detected thanks to the peculiarities of their MAC address. Special software monitors the MAC addresses of Wi-Fi networks in the signal coverage area, and then blocks them using its UAV and disconnects from the IOS or Android device from which it was controlled. After that, the hacker can control the direction, speed, and altitude of the flight of the UAV, as well as receive an image from the cameras.
In 2014, in the sky over the Crimea, the Russian military managed to seize control of the American MQ-5B Hunter UAV. Specialists from the University of Washington managed to carry out a successful attack on the medical robot Raven II, which is analogous to the robot Da Vinci. At the first stage of the experiment, data packets addressed to the Raven II robot were intercepted, which made it possible to change their sequence during transmission. The robot manipulator began to produce chaotic movements and ceased to obey the doctor’s management. As a result, the specialists managed to get full control over the actions of the Raven II, and the impact on the robot turned out to be so serious that the robot surgeon did not even react to the command to reboot the system and continued to perform the actions imposed on it.
As from the incidents presented above, it is clear that to cause damage for the robotic system is easy, even using publicly available software. Thus, Figure 2 (a) shows the result of determining which goals an attacker most often pursues. pursues. From this diagram, many incidents in the area of the violation of the security of robotic systems are connected with the conduct of terrorist acts. Such statistics say that first the interests of the state and civilians may be affected.
It is necessary to pay more attention to the security of robotic systems, since so much depends on it. According to the analysis, the attacker does not always need to develop a means to attack himself or use special technical means. Figure 2 (b) presents a diagram showing the results of the analysis of indentations associated with robotic systems to determine the capabilities of the intruder. From the diagram, most of the incidents were carried out using software that is freely available. To assess the complexity of the attack, we introduce two evaluation criteria. Tools for conducting an attack (T):
• The attack is implemented by standard software tools available on the Internet, which do not require additional refinement, and use skills.
• The attack is implemented by standard software available on the Internet, requiring additional refinement, and special skills of use.
V. DEGREE OF DIFFICULTY OF ATTACK REALIZATION In order to determine the degree of difficulty in implementing an attack, it is necessary to understand what goals and opportunities an attacker has. For this, a number of incidents related to the violation of the safety of robotic tools were considered. For example, in 2009 in Iran, the rebels, using a data channel from the UAV to the ground control center, managed to intercept the video data stream from the UAV. At the same time, they used cheap SkyGrabber
• The attack is implemented by software and hardware available in the consumer market for purchase, not requiring additional refinement, and skills of use.
• The attack is implemented by software and hardware available in the consumer market for purchase, while requiring additional refinement, and special skills of use.
• The attack is carried out using specially developed software tools.
• The attack is carried out using specially developed software and hardware.
a)
b)
The attack is implemented through direct physical • The attack is implemented by directly affecting the structural and functional characteristics.
• The attack is implemented by indirectly affecting the structural and functional characteristics (impact on environmental parameters, etc.)
• The attack is carried out by acting on one structural - functional characteristic through another structural and functional characteristic (multi-stage attack).
VI.
Next, you need to determine what consequences may occur as a result of a particular attack. The following types of damage are usually highlighted as one of the manifestations of damage. We define the following types of damage and the degree of their influence on the consequences that occur because of the implementation of the attack:
At the same time, for each type of damper, three degrees are determined: low, medium, high. This characterization should be evaluated by the system owner.
In addition, the damage can be estimated considering the value of the assets that the system owner has. We propose to add to the standard set of resources an entity controlled by an information system, or a product that is the result of work. Adding this entity is important, because an attacker can, for example, act on environmental parameters and introduce a system that measures. And vice versa, the results of an attack can affect the system that measures the environment, an attacker can spoof data or block a network. In this case, the management entity will be violated:
information; software and hardware (including automated workstations, servers, including industrial, machine storage media, telecommunications equipment and communication lines, information display tools, programmable logic controllers, production, technological equipment (executive devices); software; information security tools; supporting systems; the entity that is controlled by the information system, or the product that is the result of the information system (temperature, production results, gas supply, etc.).
For each asset, three levels of value are also determined: high, medium, low.
VII.
As a result, having determined the values of the previous evaluation criteria, we can determine the degree of danger of the realization of the threat for each potentially dangerous threat (PDT):
PDT = (dd*va*dc + T*S)/ds where dd - degree of damage, va- value of assets, dc degrees of criticality, ds- design security
In conclusion, it should be noted that robotic systems differ significantly in their design and functionality from the process control system, the Internet of things, etc. They are usually equipped with an intelligent control system and decision-making, which imposes additional security requirements. Often robotic systems are mobile and can be located outside the controlled area. In addition, many threats arise in connection with the use of wireless communication channels. This article attempted to structure information about robotic systems, collected the maximum amount of information from open sources, and carried out its classification. An analysis of potential offenders, their goals and capabilities revealed several important points. Due to the peculiarities of the operation and the conditions for the creation of robotic systems, they are very vulnerable to attacks by the intruder. Robots have limited computing and energy resources, and the use of software and hardware protection tools is not at all possible. Thus, research and development in this area is very relevant and necessary.
In future work, we plan to supplement the risk assessment process with a set of threats that are specific to the robotic system. In previous works, we gave examples and bases of such threats. In future work, we plan to supplement the risk assessment process with a set of threats that are specific to the robotic system. In previous works, we gave examples and bases of such threats. And we also plan to automate the process of determining current threats for given conditions. To solve this problem, we plan to use machine learning methods. Today, many industrial enterprises and critical facilities are automated. In addition, the economic effect of using automated systems has already been proven in practice.
This work was supported by the RFBR grant 18-0700212 "Development of a method and decision protocol for detecting anomalous node behavior in group control systems for autonomous mobile robots".