Signal Jamming Attacks Against Communication-Based Train Control: Attack Impact and Countermeasure∗

Signal Jamming Attacks Against Communication-Based Train Control: Attack Impact and Countermeasure∗ Subhash Lakshminarayana Jabir Shabbir Karachiwala Sang-Yoon Chang Advanced Digital Sciences Center, Advanced Digital Sciences Center, University of Colorado Colorado Illinois at Singapore, Singapore Illinois at Singapore, Singapore Springs [email protected] [email protected] [email protected] Girish Revadigar Sristi Lakshmi Sravana Kumar David K.Y. Yau Singapore University of Technology Advanced Digital Sciences Center, Singapore University of Technology and Design, Singapore Illinois at Singapore, Singapore and Design, Singapore [email protected] [email protected] [email protected] Yih-Chun Hu University of Illinois at Urbana-Champaign [email protected] ABSTRACT data to provide insights into the jamming attack’s impact and the We study the impact of signal jamming attacks against the com- effectiveness of the proposed countermeasure. munication based train control (CBTC) systems and develop the countermeasures to limit the attacks’ impact. CBTC supports the CCS CONCEPTS train operation automation and moving-block signaling, which im- • Security and privacy → Network security; Mobile and wireless proves the transport efficiency. We consider an attacker jamming security; • Networks → Network protocols; the wireless communication between the trains or the train to way- side access point, which can disable CBTC and the corresponding KEYWORDS benefits. In contrast to prior work studying jamming only atthe Communication-based train control, signal jamming attack, fre- physical or link layer, we study the real impact of such attacks on quency hopping spread spectrum, attack impact end users, namely train journey time and passenger congestion. Our analysis employs a detailed model of leaky medium-based ACM Reference Format: communication system (leaky waveguide or leaky feeder/coaxial Subhash Lakshminarayana, Jabir Shabbir Karachiwala, Sang-Yoon Chang, cable) popularly used in CBTC systems. To counteract the jamming Girish Revadigar, Sristi Lakshmi Sravana Kumar, David K.Y. Yau, and Yih- attacks, we develop a mitigation approach based on frequency hop- Chun Hu. 2018. Signal Jamming Attacks Against Communication-Based ping spread spectrum taking into account domain-specific struc- Train Control: Attack Impact and Countermeasure. In Proceedings of Pro- ture of the leaky-medium CBTC systems. Specifically, compared ceedings of the 11th ACM Conference on Security & Privacy in Wireless with existing implementations of FHSS, we apply FHSS not only and Mobile Networks (WiSec ’18). ACM, New York, NY, USA, 12 pages. https://doi.org/10.1145/3212480.3212500 between the transmitter-receiver pair but also at the track-side repeaters. To demonstrate the feasibility of implementing this technology in CBTC systems, we develop a FHSS repeater prototype 1 INTRODUCTION using software-defined radios on both leaky-medium and open-air With rapid explosion in urban populations, metro systems around arXiv:1808.01723v1 [cs.CR] 6 Aug 2018 (free-wave) channels. We perform extensive simulations driven the world are getting increasingly congested. Information and com- by realistic running profiles of trains and real-world passenger munication technologies (ICTs) can play a key role in relieving the ∗This work was supported by the National Research Foundation (NRF), Prime Min- congestion by improving the railway infrastructure utilization, and ister’s Office, Singapore, under its National Cybersecurity R&D Programme (Award are being increasingly adopted by railway operators. However, their No. NRF2014NCR-NCR001-31) and administered by the National Cybersecurity R&D Directorate. adoption also makes railways vulnerable to cyber attacks. Exist- ing cybersecurity of modern railways typically appeals to air gaps Permission to make digital or hard copies of all or part of this work for personal or that isolate the ICT systems from public networks. However, there classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation are growing instances of successful air-gap breaches in railways on the first page. Copyrights for components of this work owned by others than ACM [1, 6] and other critical infrastructures (e.g., Black Energy and the must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a Stuxnet attacks [24], [3]). Such security breaches can have severe fee. Request permissions from [email protected]. consequences on end users. This is particularly true of railways, WiSec ’18, June 18–20, 2018, Stockholm, Sweden due to deep involvement of humans who use them everyday in © 2018 Association for Computing Machinery. large numbers, where physical isolation is highly questionable in ACM ISBN 978-1-4503-5731-9/18/06...$15.00 https://doi.org/10.1145/3212480.3212500 the first place. WiSec ’18, June 18–20, 2018, Stockholm, Sweden S. Lakshminarayana et.al. In this paper, we study the cybersecurity of communication- who truly matter in everyday applications. The investigation must based train control (CBTC) [18], an automatic train control sys- capture these interdependencies and expose the truly important tem that enables trains to run with shorter headways, thereby end performance of the CBTC. improving track utilization. In CBTC, the trains can continuously (2) How to design effective countermeasure against the jamming exchange their states of motion (i.e., location, velocity, and acceler- attack in today’s train systems? The CBTC environment provides ation/deceleration capabilities) among each other over high-speed not only unique challenges but also opportunities for security. We wireless communication links, and optimize their headway accord- take advantage of the CBTC communication architecture to achieve ingly. However, CBTC has stringent requirements for communica- increased jamming resistance compared with prior work. tion availability, and the loss of communication can lead to severe In addressing the above two research questions, we make the disruptions. A recent real-world incident occurred for the Singa- following main contributions. pore metro [4], in which a train with faulty signaling hardware We analyze jamming in leaky medium-based communication, which affected the communication of other trains traveling in its vicinity. extends prior such results for the free-wave medium (see also the This resulted in the trains activating their emergency brakes un- discussions in Sec. 2) and is critical for the CBTC application do- necessarily, leading to multiple delays and widespread disruptions. main. The leaky medium has channel characteristics quite distinct Another incident involving CBTC signaling fault resulted in more from the case of free wave. Whereas recent work [16] has pointed serious train collision [9]. These incidents highlight the importance out specific issues of leaky medium-based communications under of understanding cyber attacks that can cause the loss of signaling jamming attacks, their evaluations are limited to the physical com- in CBTC and developing countermeasures. munication layer only. Importantly, we evaluate the impacts of the We consider signal jamming attacks against the CBTC, in which affected train operations from the end user’s perspective, namely the attacker injects an interference signal into the wireless trans- wait times and congestion. Clearly, train operators are primarily mission in order to disrupt the communications (specifically, train- concerned about the service they provide ultimately to their cus- to-train or train-to-trackside-infrastructure communications). The tomers, instead of any low level details of the communications per jamming can disable the CBTC and negate its benefits such as se. It is because the service quality affects directly their reputation transport efficiency. The threat is acute in urban train systems as and profitability. Moreover, operators usually face significant fi- they are accessed by and share the same physical space with the nancial penalties imposed by governments for service disruptions public, as opposed to other critical infrastructures that might be or delays. Their licence may even be revoked in extreme cases. physically isolated. This co-location heightens the risk as say rogue For instance, the U.K. has a penalty scheme that holds rail opera- attackers close to their targets may readily impart strong interfer- tors directly responsible for significant service problems [2]. The ences. They can readily do so as outsiders; there is no need for prior challenge for understanding the end impacts of CBTC jamming compromise of any credential systems. Moreover, the availability attacks is the lack of an evaluation platform that can integrate the of software-defined radio (SDR) has lowered the bar significantly diverse interacting components operating at different layers of the for would-be attackers. They can now launch jamming attacks by overall system. To meet the challenge, in this work we developed a simply commanding a software API, without much expertise in co-simulation platform that admits holistically (i) a model of train low-level radios and signal processing. As a result, jamming has motion under different signaling modes, (ii) a model of the leaky emerged as a major focal point of cybersecurity

Load more