=Paper=
{{Paper
|id=Vol-3040/paper11>
|storemode=property
|title=The Integrated Regulation of a Cyber-Physical System
|pdfUrl=https://ceur-ws.org/Vol-3040/paper11.pdf
|volume=Vol-3040
|authors=Vlada M. Zhernova,Aleksey V. Minbaleev
}}
==The Integrated Regulation of a Cyber-Physical System==
https://ceur-ws.org/Vol-3040/paper11.pdf
The Integrated Regulation of a Cyber-Physical
System *
Vlada M. Zhernova (0000-0001-7320-6569)1(*), and Aleksey V. Minbaleev (0000-
0001-5995-1802)2
1 South Ural State University (National Research University), Chelyabinsk, Russia
zhernovavm@susu.ru
2 Kutafin Moscow State Law University, Moscow, Russia
alexmin@bk.ru
Abstract. The paper focuses on the integrated regulation of cyber-physical
systems, which is currently a relevant issue. The IT evolution calls for
regulating the process of creating and operating such systems. However, to
devise and implement such regulation, one needs to comprehensively
analyze its subject matter – the cyber-physical system with all its
constituents rather than only the commonly recognized entities. We present
a cyber-physical system that reflects the entire composition of its agents and
objects, as well as the relations between these entities. The study dwells on
the need to create and expand legal, technical, and ethical regulations of
these relations. We analyze the existing technical-legal standards governing
the creation and operation of cyber-physical systems. In such systems, one
needs to protect the information the system utilizes from malicious
manipulation. Moreover, we presented recommendations on how to
minimize the loss of data that is integral to a cyber-physical system.
Keywords: Cyber-physical system · Law · Technical and ethic regulation
1 Introduction
Today, Russia is facing a conundrum: its regulatory frameworks lack the
definition of a cyber-physical system, while the country has a committee dedicated
to regulating such systems. A cyber-physical system (CPS) is a complex object
comprising digital data (Blazheev & Egorova, 2020), including Big Data, Internet
of Things (IoT), smart cities, smart manufacturing, and artificial intelligence (AI)
technologies.
Undoubtedly, recent IT developments call for a new technical standard
applicable to CPS. The standard will serve as the foundation for legal and ethical
norms that regulate newly emerging, CPS-associated relations. A CPS is a
complex, organized, multi-level system that cannot be regulated only technically
or legally. Therefore, a CPS regulation system must also be complex, multi-level,
*
Copyright © 2021 for this paper by its authors. Use permitted under Creative
Commons License Attribution 4.0 International (CC BY 4.0).
and appropriate for its subject matter. The creation and use of a CPS involve
multifaceted human-machine interaction and a complex set of human-human,
human-technology, human-technology-human, and technology-technology
relations. The latter may not involve any human persons at all, which causes a
strong controversy. Analysis of CPS as the subject matter of relations arising from
its development and operation is a necessary step towards adequate and
proportionate regulatory standards.
2 Materials and Methods
CPS features a complex tri-layer structure: (1) physical layer, (2) software layer,
and (3) network layer (Rehman, Allgaier & Gruhn, 2018). This is what actually
dictates the model of the technical system itself, as well as the regulatory model
applicable to the creation and use of such systems. Physical, the system comprises
sensors. It would be logical to include the environment in the physical layer.
Although the environment is not a part of the subject matter of legal relations, it
can indeed affect the general operations within the system.
The physical form of a CPS can be included here, too, since CPS as a physical
object is a product of personal or corporate work, even if that work involves
automation. The next layer comprises a data communication network in the form
of various data transmission technologies using appropriate protocols. Currently,
the correct implementation and operation of this level determine how the CPS will
function in general. The third layer consists of software that utilizes the second
layer to collect and process information from the first layer.
A CPS itself, without associated entities, is of no interest for legal regulation.
Therefore, one needs to find and systematize the agents of relations arising from
the creation and use of a CPS. These include CPS owners, users, end customers,
engineers, software developers, and data service providers. All these individuals
and organizations interact with each other through CPS. This interaction is subject
to a triad of information security requirements, namely the (1) integrity, (2)
confidentiality, and (3) accessibility requirements. CPS regulation is undeniably
an interdisciplinary issue that must be studied by computer scientists, lawyers, and
other researchers. Personal data security is also an urgent issue. While a data leak
per se is not much of a concern, smart home, IoT, or data from the CPS of critical
infrastructures can provide a complete picture of a person’s life.
Legal, technical, ethical, and other regulations of CPS should guarantee the
physical safety of persons. Information security, cybersecurity, internal
compatibility, and the compatibility of external components are no less critical
requirements.
Since a CPS is an interdisciplinary product, it needs comprehensive regulation
on the part of public authorities and individual associations, unions, self-
regulatory organizations, and standardization organizations. Russian regulating
authorities should include the Ministry of Digital Development, Communications
and Mass Media of the Russian Federation, the Ministry of Economic
Development of the Russian Federation, the Federal Agency for Technical
Regulation and Metrology, the Ministry of Industry and Trade of the Russian
Federation, Federal Service for Supervision of Communications, Information
Technology and Mass Media, Technical Committee 194, and several other
associations and alliances in the field of digital development. Internationally,
regulations are provided by the relevant authorities and standardization
organizations, such as International Organization for Standardization (ISO),
European Telecommunications Standards Institute (ETSI), etc.
To date, Russia has ad-hoc regulation of CPS components and technologies,
mainly by virtue of national programs such as the Digital Economy of the Russian
Federation (Government of the Russian Federation, 2019), federal laws On
Personal Data; On Information, Information Technology and Information
Protection (Russian Federation, 2006b), National Technical Initiative
(Government of the Russian Federation, 2016), Information Society Development
Strategy (President of the Russian Federation, 2017) and other strategic
documents regulating the creation and implementation of CPS. Unfortunately,
regions are currently only copying the federal laws or are in the initial stages of
drafting their own regulations.
3 Results
Technical standards are fundamental to regulating the creation and use of CPS. As
of late March 2020, the Technical Committee 194 has drafted a set of preliminary
national standards and submitted them for review. These preliminary standards
“seek to optimize the industrial adoption of digital technology in Russia, to help
develop high-quality independent solutions, and to ensure the inter-compatibility
of such solutions.” The number of national standards governing the creation and
operation of CPS components on an ad-hoc basis is quite substantial as it already
is: Information Technology (Standartinform Rossiiskoi Federatsii, 2019),
Information Security Standards Family (Standartinform Rossiiskoi Federatsii,
2013), Robots and robotic devices (Standartinform Rossiiskoi Federatsii, 2012).
Emphasis should also be made on the standards dedicated to the software layer of
CPS (Standartinform Rossiiskoi Federatsii, 2015). Technical standards of CPS
regulation will be focused on further in the paper. Emphasis will also be made on
the standards dedicated to the software layer. Besides, humanity has so far realized
that CPS and AI need to be governed by codes of ethics, too. This has been
showcased by a study carried out by the European Parliamentary Research
Service Scientific Foresight Unit (STOA) titled Ethical Aspects of Cyber-Physical
System (Ethical Aspects of Cyber-Physical Systems, 2016). In addition, the US
Department of Defense formalized the ethical principles of using artificial
intelligence in the military.
Robo-ethics is concerned with the ethical consequences of adopting and using
CPS and robots in human and public life; it also searched for solutions to the
emerging problems. South Korea was one of the first countries to adopt ethics
officially with its Robot Ethics Charter of 2017. However, the project came to a
halt after a series of discussions. Private ethical initiatives are not uncommon; they
are a product of multi-company cooperation to advance the use of AI and
consolidate the basic principles of such use. For instance, the Asilomar AI
Principles seek to create useful intelligence, maintain human values, and protect
the privacy of personal data (Asilomar ai principles, 2017).
In recent years, Canada, China, Denmark, the EU Commission, Finland,
France, India, Italy, Japan, Mexico, the Scandinavian-Baltic region, Singapore,
South Korea, Sweden, Taiwan, and the UAE have issued national strategies
pertaining to AI and the promotion of AI technologies. Each of those documents
focuses on the individual aspects of AI policies: (1) research, (2) talent support,
(3) development of skills and education, (4) public-private cooperation, (5) ethics,
(6) coexistence, (7) regulations, (8) data, and (9) digital infrastructure (Dutton,
2018). The documents emphasize the AI-associated issues of ethics.
In the context of CPS and AI, these issues are numerous. The government and
the public need to address them. The issues include:
• Unemployment and social stratification caused by CPS and robotics.
“Robotization, according to some experts, could render at least half of the
existing professions obsolete. Other experts point out that robotization creates
rather than destroys jobs, since the disappearing professions are compensated
by the emergence of new ones.” (Analytical review of the global robotics
market. 2018).
• Replacement of human personality by artificial intelligence. This issue is in the
spotlight today because once humans stop seeking, processing, and
transmitting information (even if not entirely), they become completely
dependent on robots, willing to sacrifice some human freedoms and legitimate
interests, as robots take over some human process.
• AI capabilities. Artificial intelligence can surpass human one, which threatens
human safety. This is why ethical and various regulatory bodies must impose
restrictions on the use and development of artificial intelligence.
The National Strategy for the Development of Artificial Intelligence until 2030
states, “To incentivize the development and use of AI, legal regulations that
govern human-AI interaction need to be adjusted, and appropriate ethical
standards shall be in place. However, overregulation of AI may hinder its
development and adoption.” Thus, the President of the Russian Federation has
effectively tasked the responsible agencies to devise legal and ethical regulations
for the use of AI. The President, however, noted that overregulation should not
take place.
The Government of the Russian Federation drafted Model Rules for the use of
CPS and AI by government agencies and local governments. The Rules could
enshrine ethical standards based on the acts of international organizations and the
recommendations made by the professional expert community. Besides, the Rules
could provide recommendations on their use by non-governmental legal entities,
individual entrepreneurs, and natural persons using AI. We believe that such an
approach will prevent the coexistence of multiple redundant codes of ethics in
public and private sectors (Neznamov & Naumov, 2018; Sinyukov & Egorova,
2019).
The CPS components, as outlined above, can be illustrated by the chart in
Figure 1:
Fig.1. CPS ecosystem chart. Source: Compiled by the authors
Thus, the key finding so far is that the CPS ecosystem goes far beyond the
generally accepted model.
4 Discussion
Once the CPS components have been identified, one needs to determine the public
relations associated with the creation and use of CPS and how to regulate them.
First, we noted that the Russian legislature was amended with the definition of
digital rights (Russian Federation, 2006b), a step necessitated by the recent years
of digitalization. This concept refers to liability rights and other rights recognized
by law as digital rights, the scope and conditions of which are established within
an information system compliant with the law. The change is also evident in the
form of transactions, which are now taking more diverse forms, including by
electronic or other technical means capable of reproducing the transaction volume
on an exact paper medium, with any method that reliably identifies the signer.
These innovations lead to the generation of various information in large
volumes, which is facilitated by new sensors that collect and process information.
This requires the regulation of massive amounts of information, an issue already
reflected in legislative efforts for enacting appropriate regulations in their bills.
ISO has already introduced technical regulations, releasing a series of standards
for big data reference architecture starting in 2018 (International Organization for
Standardization, 2019). In particular, the preliminary national standard (PNST),
entitled Information Technology. Big data. Reference architecture (Preliminary
national standards of the Russian Federation, 2020) is based on ISO / IEC 20547-
3 Information technology. Big data reference architecture. Part 3. Reference
architecture.
Big Data is generated using sensors and transmitted through the
communication channels to another part of the CPS for processing. Data
transmission is protocol-driven. Notably, IoT or data communication between
independent objects is integral to CPS. Unfortunately, while the technology has
long been used, it still lacks unambiguous legal and technical regulation.
Technical Committee 194 drafted the regulations titled Information technology.
Internet of Things. General provisions (Preliminary national standards of the
Russian Federation, 2020), which defines IoT as an infrastructure comprising
interconnected entities, systems, and information resources plus services that
enable processing physical and virtual world data and responding to it. More
PNSTs are being discussed.
Intra-CPS data transmission requires the identification of facilities. This is
facilitated by GOST R ISO / IEC 29161-2019 Information technology. Data
structure. Unique identification for the IoT. Besides, technical requirements for
electronic identification are laid out in NIST Special Publication 800-63B Digital
Identity Guidelines Authentication and Lifecycle Management.
Whilst human-human or people-to-people (P2P) interaction is regulated by the
Civil Code of the Russian Federation, including intellectual property relations,
contractual law, etc. Business interactions are also partly covered by it.
Regulations on the interaction between physical and virtual entities are still being
drafted, even though the process of such interaction and its outcomes do already
affect human persons. Therefore, intra-CPS data transmission needs particular
emphasis.
Data transmission is provided by appropriate service providers. In this regard,
information law has long identified the problem of information provider liability;
however, the information intermediary as a concept was first defined in Russia in
Article 1253.1 of the Civil Code, rather than in information-related laws.
Data transmission is controlled by protocols. Earlier data communication
between computers was mediated by the OSI networking model that enabled
different devices to communicate. This is a seven-level model, and each level has
its own functions that ultimately enable error-free data communication from the
query received by the database to the response delivery via fiber optical fiber.
The data transmission model for CPS can and has to change. The network
level of the OSI model features certain protocols – IP/IPv4/IPv6 (Internet
Protocol), IPX (Internetwork Packet Exchange), X.25, CLNP, and IPsec (Internet
Protocol Security). More protocols are employed to organize data communication:
DDS (Data Distribution Service), UDP, CoAP (Constrained Application
Protocol), XMPP (Extensible Messaging and Presence Protocol), MQTT
(Message Queue Telemetry Transport), and TCP. MQTT has served as a
foundation for MQTT-SN, a specialized protocol for sensor networks.
IoT protocols are strikingly diverse. As the technology advanced, the OSI
model had to be reviewed; it now comprises eight layers. The desire to optimize
and improve the quality of data transmission has led to the emergence of novel
types of data communication networks (e.g., mesh networks). A characteristic
feature of CPS networks is that they communicate in small data packages – a
phenomenon covered in the recently adopted NB-IoT standard (GSM Association,
2019), that describes an LTE-based cellular technology for low-power, low-data
stationary devices.
CPSs carry out a multitude of transactions, which has unavoidably drawn the
attention of malicious users. Thus, the UK Department for Digital, Culture, Media
& Sport published its Code of Practice for Consumer IoT Security to improve the
cybersecurity of CPS users and lists several security guidelines: (1) not using
default passwords, (2) regular software updates, (3) making systems more robust,
etc. The document also introduces the concept of security-sensitive data, which
differs from other types of sensitive data. Security-sensitive data could include, for
example, cryptographic initialization vectors. This Code of Practice is based on
ETSI’s Cyber Security for Consumer IoT.
5 Conclusion
Despite the recommended security measures in place, CPS networks are not safe
from integrity, confidentiality, and accessibility breaches that lead to:
• Decrease in personal privacy with the growth of the Internet;
• Excessive regulation of the flow of private information can lead to a delay in
the use of CPS;
• The difficulty of receiving user privacy notices on connected devices;
• IoT giving non-governmental organizations access to bulk personal data
(Rither & Hoxie, 2017).
Even where there are data protection regulations and documents in place
(European Parliament and Council of the European Union, 2016), there is no
guarantee of complete and uncompromised data protection. For this reason,
scholars advise analyzing the security requirements and tailoring the security
measures for each CPS individually (Rehman et al., 2018).
CPS is a complex system made by humans for humans, but wrong use could
be problematic. Therefore, it calls for appropriate regulations, including technical,
legal, and ethical standards.
Acknowledgement
This study was funded by RFBR, project number 18-29-16014, project number
“Role and Functions of Legal Regulation in the Advancement of Digital Tech:
Legal Regulation and Self-Regulation in the Context of Law Branches and Their
Specifics”.
References
Asilomar ai principles. (2017). Future of life institute. Retrieved from:
http://robopravo.ru/matierialy_dlia_skachivaniia#ul-id-2-3
Blazheev, V., & Egorova, M. Digital Law: Study. Moscow, Russia: Prospect.
Dutton, T. (2020). An overview of national ai strategies. Retrieved from:
https://medium.com/politics-ai/an-overview-of-national-ai-strategies-2a70ec6edfd.
Government of the Russian Federation. (2016). Decree of “On the Implementation of the
National Technological Initiative” (April 18, 2016 No. 317). Moscow, Russia.
Government of the Russian Federation. (2019). Decree of “On the system for managing the
implementation of the national program ‘Digital Economy of the Russian Federation’”
(March 2, 2019 No. 234). Moscow, Russia.
GSM Association. (2019). NB-IoT deployment guide to basic feature set requirements.
Retrived from: https://www.gsma.com/iot/wp-content/uploads/2019/07/201906-GSMA-
NB-IoT-Deployment-Guide-v3.pdf
European Parliamentary Research Service Scientific Foresight Unit (STOA). (2016).
Ethical Aspects of Cyber-Physical Systems. Retrieved from:
https://www.europarl.europa.eu/RegData/etudes/STUD/2016/563501/EPRS_STU%282
016%29563501_EN.pdf
Information technology. Big data. Overview and vocabulary. (2019). ISO/IEC 20546:2019
from February, 2019. Geneva, Switzerland: International Organization for
Standardization.
Information technology. Data structure. Unique identification for the Internet of Things.
(2019). HOST R ISO / IEC 29161-2019 from March 01, 2020. Moscow, Russia:
Standartinform Rossiiskoi Federatsii.
Information Technology (IT). Security methods and tools. Information Security
Management Systems. General overview and terminology. (2012). HOST R ISO / IEC
27000-2012 from December 01, 2013. Moscow, Russia: Standartinform Rossiiskoi
Federatsii.
Neznamov A. V., & Naumov V. B. (2018). Strategy for the regulation of robotics and
cyberphysical systems. Retrieved from: https://zakon.ru/magazine/zakon/496
Sinyukov V. N., & Egorova M. A. (2019). Legal regulation of the digital economy in
modern conditions of high-tech business development in the national and global
context. Moscow, Russia: Prospect.
Technical committee 194 of “Cyber physical systems”. (2019). Preliminary national
standards of the Russian Federation by technical committee. Retrieved from
http://tc194.ru/publichnoe_obsuzhdenie_proektov
President of the Russian Federation. (2017). Decree of “On the Strategy for the
Development of the Information Society in the Russian Federation for 2017 – 2030”
(May 09, 2017 No. 203). Moscow, Russia.
Rehman S., Allgaier C., & Gruhn V. (2018). Security requirements engineering: A
framework for cyber-physical systems. International Conference on Frontiers of
Information Technology (FIT).
Rither, A., & Hoxie, C. (2017). Legal Considerations of Cyber-Physical Systems and the
Internet of Things: Foundations, Principles and Applications. Security and Privacy in
Cyber-Physical Systems: Fundamentals, Principles and Applications, 2, 93-115. DOI:
10.1002/9781119226079.ch5
Robots and robotic devices. Terms and Definitions. (2012). HOST R 60.0.0.4-2019/ISO
8373:2012 from September 01, 2019. Moscow, Russia: Standartinform Rossiiskoi
Federatsii.
Sberbank. (2019). Analytical review of the global robotics market. Retrieved from:
https://www.sberbank.ru/common/img/uploaded/pdf/sberbank_robotics_review_2019_
17.07.2019_m.pdf
System and software engineering. The content of information products of the life cycle of
systems and software (documentation). (2015). HOST R 56713-2015 from August 01,
2016. Moscow, Russia: Standartinform Rossiiskoi Federatsii.
System and software engineering. Software testing. Part 1. Concepts and definitions.
(2016). HOST R 56920-2016/ISO/IEC/IEEE 29119-1:2013 from June 01, 2016.
Moscow, Russia: Standartinform Rossiiskoi Federatsii.
European Parliament and Council of the European Union. (2016). General Data Protection
Regulation (April 27, 2016 No. 2016/679). Brussels, Belgium.
Russian Federation. (2006a). Federal Law of “On Personal Data” (July 27, 2006 No. 152-
FZ, edited by December 08, 2020 No. 429-FZ). Moscow, Russia.
Russian Federation. (2006b). Federal Law of “On Information, Information Technologies
and Information Protection” (July 27, 2006 No. 149-FZ, edited by June 08, 2020 No.
177-FZ). Moscow, Russia.
Russian Federation. (2006c). Civil Code of the Russian Federation (part four) (December
18, 2006 No. 230-FZ; edited by July 31, 2020 No. 262-FZ). Moscow, Russia.