NIST Special Publication 1500-202 Framework for Cyber-Physical Systems: Volume 2, Working Group Reports Version 1.0 Cyber-Physical Systems Public Working Group Smart Grid and Cyber-Physical Systems Program Office Engineering Laboratory This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-202 NIST Special Publication 1500-202 Framework for Cyber-Physical Systems: Volume 2, Working Group Reports Version 1.0 Cyber-Physical Systems Public Working Group Smart Grid and Cyber-Physical Systems Program Office Engineering Laboratory This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-202 June 2017 U.S. Department of Commerce Wilbur L. Ross Jr., Secretary National Institute of Standards and Technology Kent Rochford, Acting NIST Director and Under Secretary of Commerce for Standards and Technology National Institute of Standards and Technology (NIST) Special Publication 1500-202 163 pages (June 2017) NIST Special Publication series 1500 is intended to capture external perspectives related to NIST standards, measurement, and testing-related efforts. These external perspectives can come from industry, academia, government, and others. These reports are intended to document external perspectives and do not represent official NIST positions. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. National Institute of Standards and Technology Special Publication 1500-202 Natl. Inst. Stand. Technol. Spec. Publ. 1500-202, 163 pages (June 2017) CODEN: NSPUE2 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-202 Framework for Cyber-Physical Systems: Volume 2, Working Group Reports Revision Tracking Version Date Editor Changes 1.0 20170320 ERG First Release Version This publication is available free of charge from: http s ://doi.org/10.6028/NIST.SP. 1500 - 202 Framework for Cyber-Physical Systems: Volume 2: Working Group Reports Table of Contents Table of Contents .............................................................................................................. i Table of Figures ................................................................................................................ ii Table of Tables ................................................................................................................ iii Disclaimer ....................................................................................................................... iv Acknowledgement ........................................................................................................... v Executive Summary ......................................................................................................... vi This publication is available free of charge from: http 1 Introduction .............................................................................................................. 1 1.1 Overview ...................................................................................................................... 1 1.2 Purpose and Scope ...................................................................................................... 1 1.3 Organization of This Document ................................................................................... 2 2 Report of the Cybersecurity and Privacy Sub-Group: Trustworthiness ........................ 2 2.1 Overview ...................................................................................................................... 3 2.2 CPS Cybersecurity and Privacy Risk ............................................................................. 4 2.3 Moving from Classic Cybersecurity Properties to Cross-Property Risk Management15 3 Report of the Data Interoperability Sub-group ......................................................... 29 3.1 Overview .................................................................................................................... 29 3.2 Data Interoperability Topics from the CPS Viewpoint .............................................. 33 4 Report of the Timing Sub-group ............................................................................... 78 4.1 Introduction ............................................................................................................... 79 s ://doi.org/10.6028/NIST.SP. 4.2 Time Awareness in CPS ............................................................................................. 85 4.3 Managing Timing and Latency in CPS ........................................................................ 92 4.4 Secure and Resilient Time ....................................................................................... 100 5 Report of the Use Case Sub-group .......................................................................... 108 5.1 Background .............................................................................................................. 108 5.2 Analysis Method ...................................................................................................... 113 1500 5.3 Supporting CPS Use Case Examples with Evaluation .............................................. 118 - 202 Appendix A. References ................................................................................................ 125 Appendix B. Definitions and Acronyms ......................................................................... 136 B.1 Definitions ............................................................................................................... 136 B.2 Acronyms ................................................................................................................. 149 i Framework for Cyber-Physical Systems: Volume 2, Working Group Reports Table of Figures Figure 1: Evolution of Systems Design Property Silos ............................................................ 17 Figure 2: Recommended Interdisciplinary Design Approach to CPS Engineering .................. 18 Figure 3: Physical, Analog, and Cyber Components of CPS .................................................... 21 This publication is available free of charge from: http Figure 4: CPS Risk Properties .................................................................................................. 24 Figure 5: Applying Risk Analysis to CPS ................................................................................... 25 Figure 6: Merger of Different Sources of Data ....................................................................... 38 Figure 7: Data Fusion Today.................................................................................................... 38 Figure 8: Simplified Topology of Networks for a Chemical Plant ........................................... 42 Figure 9: Continuous Refinement of Privacy Risk Management ............................................ 54 Figure 10: Double-Blind Authentication Scheme ................................................................... 55 Figure 11: Common Data Services .......................................................................................... 69 Figure 12: Taxonomy of Data .................................................................................................. 72 s Figure 13: On-Time Marker ..................................................................................................... 80 ://doi.org/10.6028/NIST.SP. Figure 14: Architecture of a CPS Node and Environment ....................................................... 88 Figure 15: Domains and Multiple Timescales in Time-Aware CPSs ........................................ 94 Figure 16: CPS Network Manager Configuring a CPS ............................................................. 95 Figure 17: Time-Aware CPS Device Model .............................................................................. 97 Figure 18: Requirements Decomposition into Primitives ..................................................... 114 1500 - Figure 19: Example of Reference Architecture Model of "Manufacturing" System-of-Interest 202 ............................................................................................................................................... 119 ii Framework for Cyber-Physical Systems: Volume 2, Working Group Reports Table of Tables Table 1: Elements of Secure Timing ...................................................................................... 101 Table 2: Survey of Time Distribution Methods ..................................................................... 102 Table 3: Principal Threat Vectors in an Unsecured Time Network ....................................... 106 This publication is available free of charge from: http Table 4: List of Stakeholders ................................................................................................. 112 Table 5: CPS Application Domain Examples.......................................................................... 112 Table 6: CPS Example Template ............................................................................................ 115 Table 7: Requirements Categories .......................................................................................