Secure RTOS Architecture for Building Automation Xiaolong Wang Masaaki Mizuno Mitch Neilsen Kansas State University Kansas State University Kansas State University Manhattan, Kansas, USA Manhattan, Kansas, USA Manhattan, Kansas, USA [email protected] [email protected] [email protected] Xinming Ou S. Raj Rajagopalan Kansas State University Honeywell ACS Labs Manhattan, Kansas, USA [email protected] [email protected] Will G. Baldwin Bryan Phillips Biosecurity Research Institute Biosecurity Research Institute Manhattan, Kansas, USA Manhattan, Kansas, USA [email protected] [email protected] ABSTRACT 1. INTRODUCTION Building Automation System (BAS) is a computer-based control Building Automation System (BAS) is a complex network-based system that is widely installed in office buildings and laboratories for distributed control system responsible for the communication and monitoring and controlling mechanical/electrical equipment. With cooperation of different electrical/mechanical subsystems. A typical the advancements in Cyber-Physical System (CPS) and Internet building automation is designed to automatically control a build- of Things (IoTs), BAS is in the process of becoming more intelli- ing’s heating, ventilation, and air conditioning (HVAC). Along with gent by merging computing resources and network communication advances in control systems, BAS has evolved into a gigantic sys- with physical control. Along with potential benefits, it also brings tem. It not only handles HVAC, lighting, air humidity, but also tremendous risks of security breaches and safety violations, espe- manages building security and safety subsystems by controlling and cially when it comes to Programmable Logic Controllers (PLCs). monitoring fire and flood safety, CCTV, elevator, power supply, and In this paper, we systematically analyze biocontainment laboratory part of the process for room access authentication. Often, BAS pro- control models based on real case scenarios from Biosecurity Re- vides a communication backbone which serves as an infrastructure search Institute (BRI) at Kansas State University. We present a that provides rules, policies, and integration medium for different vision for a new secure Real-Time Operating System (RTOS) archi- subsystems. tecture, which leverages various technologies, including microkernel Buildings, including commercial, government, and private, are structure, Trusted Platform Module (TPM), proxy-based policy en- a ubiquitous critical infrastructure [37] and yet the last to be con- forcement, and formal verification. The secure RTOS architecture is sidered as such. The Boston Marathon bombing revealed that the designed specifically to work with embedded controllers which are financial losses from the shutting down of large commercial build- widely used in BAS and other CPS to achieve a highly secure and ings in the area were in the hundreds of thousands of dollars per day. trustworthy control system. Recent cyber attacks have targeted critical infrastructure control system [1, 31] raising safety and security concerns. The safety and security of BAS is at high risk. Unfortunately, there have been few Categories and Subject Descriptors systematic studies of cybersecurity for building controls, in part be- D.4.6 [Operating Systems]: Security and Protection cause the sector is completely dominated by vendors who mostly do not have much interest in academic research. A significant number General Terms of off-the-shelf BAS products in the market are currently based on outdated technologies, which have limited security features, and un- Design; Security; Reliability predictable vulnerabilities due to their backward-compatible designs and focus on ease of maintenance. Moreover, the building industry Keywords is highly fragmented and no single vendor has a controlling share of the market to force change, which makes the situation even more Cyber-Physical System; Building Automation; RTOS; Microkernel; challenging. TPM; Trusted Computing In this paper, we conduct a systematic case study of biocon- Permission to make digital or hard copies of all or part of this work for tainment facility building automation system based on real case personal or classroom use is granted without fee provided that copies are not scenarios from Biosecurity Research Institute (BRI) at Kansas State made or distributed for profit or commercial advantage and that copies bear University, and analyze specification of the requirements for each this notice and the full citation on the first page. Copyrights for components control task. We provide a new possible research direction to se- of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to cure CPS infrastructure from an operating system’s point of view redistribute to lists, requires prior specific permission and/or a fee. Request and present a roadmap of our proposed secure operating system permissions from [email protected]. architecture. Our contributions are: CPS-SPC’15, October 16 2015, Denver, Colorado USA ©2015 ACM. ISBN 978-1-4503-3827-1/15/10 ...$15.00 DOI: http://dx.doi.org/10.1145/2808705.2808709. 79 • We systematically study realistic bio-containment facility 2.1 PLC Basics building scenarios and identify safety requirements therein. PLCs play a critical rule in control systems. A PLC is a digi- • We provide a detailed analysis of potential security vulner- tal embedded device used for automation of industrial processes. abilities in the BAS and how that may impact the safety re- They perform real-time control of electromechanical processes. A quirements of biocontainment facilities. PLC works by continually scanning a program, which is called the scan cycle. This involves reading sensor measurements repeatedly, • We propose an architecture and roadmap for ensuring secu- executing control logic program to calculate output, and actuating rity/safety properties of building environments by adopting output with electromechanical processes. PLCs are responsible for a microkernel-based architecture, where the real-time oper- constantly adjusting physical machinery based on the sensor mea- ating systems (RTOS) on embedded controllers become the surement as well as functions as a gateway between the machinery security anchors for such cyber physical systems. We point to and human operators. PLCs translate continuous analog signals directions where this architecture could be used to strengthen into digital values. Processing is performed using a cycle of input, the security/safety properties of BAS. processing and output. The control logic for processing is typically represented using relay ladder logic written in a graphical language. 2. BACKGROUND The most widely used PLC control structure is a Proportional Inte- Buildings worldwide account for 30% to 40% of global energy gral Derivative (PID) controller. This controller algorithm has three consumption [45]. There are increasing concerns of energy effi- separate constant parameters: the proportional, the integral, and the ciency and high demand for more intelligent buildings. A number derivative values. PID controllers are used to dynamically adjust of advanced technologies are designed to incorporate into BAS to output by comparing setpoint (desired value) and actual value of the make it smarter. The concept of Smart Building has existed since process variable from the process under control. the 1980’s, and a definition given by the Intelligent Building Insti- 2.2 PLC Security Issues tution in Washington is “one which integrates various systems to effectively manage resources in a coordinated mode to maximize: BAS security and safety has gradually raised concerns of both technical performances; investment and operating cost savings; flex- industry and academia. While many researchers are working to ibility.” [13]. The idea is to use computers and networks to au- secure BAS protocols, and designing new detection algorithms [6, tomatically perform operations based on predefined rules. Today 8] we believe that the security of Programmable Logic Controller leveraging the advance of Internet and various digital technologies, is overlooked. PLC is the controller that directly interacts with researchers are proposing Cyber-Physical System (CPS) and Inter- sensors and actuators, as a central anchor. The stability of PLCs is net of Things (IoTs), which conjoin computational and physical the weak link in a chain that directly influences the robustness of the resources through digital networks to achieve a more intelligent, BAS. Current PLCs, however, are relatively fragile. A majority of automatic, and energy-efficient control system. PLCs are limited electrical devices that run a control loop directly The benefits new technologies bring to BAS have also opened the on bare hardware. They lack functionality for simple emergency gate for various safety and security risks. Those trends in the build- situations such as power outage or network failures. Some PLCs ing industry such as convergence of control and IT networks, use of run a simple real-time operating system (RTOS); e.g., FreeRTOS. mobile devices to access building controls, and the increasing use All applications are compiled together with a real-time scheduler of COTS is raising the risk of cybersecurity breaches dramatically. in a single binary file. Systems lack the capability for handling Even though the number of reported attacks on Industrial Control complex situations and the absence of protection