Following on from the CTI project (Cybersecurity of Intelligent Transport), this new project brings together a consortium of 11 industrial companies and research organisations to address the issue of resilience – at a controlled cost – of control systems vis-à-vis cyber threats. It will focus on the design of methods and devices in charge of anomaly detection and active reaction / defence strategies.
This project is carried out in collaboration with the French National Agency for the Security of Information Systems (ANSSI) and the Central Observatory for Intelligent Transport Systems (OCSTI) of the Gendarmerie Nationale.
The RTI (Resilience of Intelligent Transport) project has gathered 10 industrial companies (APSYS, EGERIE SOFTWARE, ETAS, Expleo, FAAR, ProvenRun, Renault, Sherpa Engineering, Trialog and Valeo) and one research organisations (the IBISC laboratory at the University of Evry) around the issue of resilience of intelligent transport control systems. The R&D efforts will focus on the design and validation tools for these systems, but also on the development of defence and active reaction devices in the face of intrusion attempts. These technological assets will be validated on a set of critical situations through two use cases: autonomous cars and fleets of autonomous drones (for parcel delivery, for example).
“Resilience is the ability of a system to operate safely, even when part of its components are compromised or have failed. In the event of imminent danger, such a system is expected to change its configuration, to adapt to contain the danger and at least to stop to limit the risks. Depending on the severity of the situation, different degraded modes can be triggered. It is also necessary to propose an approach to return to normal operation, partly driven by humans. This work carried out within the framework of the RTI project will enrich the security solutions as well as the validation methods developed in the CTI project”, commented Witold Klaudel, project manager of RTI, IRT SystemX.
During these three years, the project partners will focus on producing the following technological assets::
- A digital isk analysis tool, enriched by the behavioural models resulting from the modelling and validation of the robustness of control and defence algorithms.
The enrichment of system behaviour models through the modelling of control and resilience algorithms is a fairly new research topic. This method of analysing the dynamic behaviour of the system using formal methods and simulation is a new approach to addressing the issue of resilience. The CTI project created the methodological basis for the modelling, but it is the RTI project that takes into account the adaptive reaction of the system – which makes the analysis complex because the architecture can evolve -, the activation of degraded modes and the return to normal operation.
The tool will also have to take into account the new vulnerabilities brought about by the adaptation mechanism, and should make it possible to reconcile the approaches of cybersecurity and operational safety specialists. - Methods, processes and tools for penetration testing will be developed in order to verify the conformity of implementations with assumptions made during the design phase. As with risk analysis, the novelty lies in taking into account the adaptability of the systems tested. The test reports will be used to enrich and complete the risk analyses.
- A monitoring and reaction system will be developed to enable the detection of anomalies caused by cyber attacks, the implementation of an active defence strategy and the return to normal operation. In this context, a monitoring system deployed in cyber-physical objects from a Security Operation Centre will be designed. It will integrate a simulator and a model-checker provided by two project partners.
All of this work will be integrated into an engineering process aligned with the normative approaches and regulatory requirements for which the RTI project will maintain the state of the art. Due to the presence of software editors and service providers in this project, these results will be industrialised in the form of offers and services oriented towards the resilience of control systems. From a scientific point of view, a thesis will be conducted in collaboration with the IBISC laboratory of the University of Evry.
Read more:
