A Semantic Threat Model to Evaluate Security Threats in Cyber-Physical Systems

Cyber-Physical Systems (CPS) implement critical infrastructures, in which physical objects interact with services of the cyber domain consequently building a heterogeneous System-of-Systems (SoS). Although this marriage extends the functionality of traditionally closed systems, it also introduces a variety of challenges—especially for engineers. One critical aspect relates to establishing and sustaining a sufficient level of security, as exploited vulnerabilities may cause severe effects, either toward involved humans or sensitive information. Consequently, engineers must be aware of potential security-related threats and vulnerabilities. To this end, threat models are usually used to identify such weaknesses within a specification. However, existing solutions may not be able to comprehensively identify all threats in a CPS-like environment, as they often do not consider all relevant dependencies between interacting systems on an SoS level. To address this gap, we have elaborated a methodology—called Semantic Threat Model (STM), which can identify and evaluate potential threats toward a given CPS specification. In detail, the framework focuses on the semantic relationships and side effects between security objects, e.g., attacks, and the actual specification of the CPS. In contrast to existing solutions, STM takes an SoS point of view, while analyzing semantic data to gain a comprehensive view on security. The quantitative output of the method can then be used to identify the most severe attacks or to point out necessary security enhancements. We highlight the usage and benefits of the STM in the form of a case study in the domain of intelligent transportation systems.