Cyber-physical systems (CPSs) are implemented in many industrial and embedded control applications. Where these systems are safety-critical, correct and safe behavior is of paramount importance. Malicious attacks on such CPSs can have far-reaching repercussions. For instance, if elements of a power grid behave erratically, physical damage and loss of life could occur. Currently, there is a trend toward increased complexity and connectivity of CPS. However, as this occurs, the potential attack vectors for these systems grow in number, increasing the risk that a given controller might become compromised. In this article, we examine how the dangers of compromised controllers can be mitigated. We propose a novel application of runtime enforcement that can secure the safety of real-world physical systems. Here, we synthesize enforcers to a new hardware architecture within programmable logic controller I/O modules to act as an effective line of defence between the cyber and the physical domains. Our enforcers prevent the physical damage that a compromised control system might be able to perform. To demonstrate the efficacy of our approach, we present several benchmarks, and show that the overhead for each system is extremely minimal.

中文翻译：

---

用于减轻工业控制系统网络物理攻击的智能 I/O 模块


网络物理系统 (CPS) 在许多工业和嵌入式控制应用中实施。当这些系统对安全至关重要时，正确和安全的行为至关重要。对此类 CPS 的恶意攻击可能会产生深远的影响。例如，如果电网元件运行异常，可能会发生物理损坏和人员伤亡。目前，CPS 的复杂性和连接性有增加的趋势。然而，当这种情况发生时，这些系统的潜在攻击媒介数量就会增加，从而增加了给定控制器可能受到损害的风险。在本文中，我们将研究如何减轻控制器受损的危险。我们提出了一种运行时强制执行的新颖应用，可以确保现实世界物理系统的安全。在这里，我们将执行器综合到可编程逻辑控制器 I/O 模块内的新硬件架构中，作为网络域和物理域之间的有效防线。我们的执法者可以防止受感染的控制系统可能造​​成的物理损害。为了证明我们方法的有效性，我们提出了几个基准，并表明每个系统的开销非常小。