Safe and secure model-driven design for embedded systems Letitia Li To cite this version: Letitia Li. Safe and secure model-driven design for embedded systems. Embedded Systems. Université Paris-Saclay, 2018. English. NNT : 2018SACLT002. tel-01894734 HAL Id: tel-01894734 https://pastel.archives-ouvertes.fr/tel-01894734 Submitted on 12 Oct 2018 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Approche Orientee´ Modeles` pour la Suretˆ e´ et la Securit´ e´ des Systemes` Embarques´ These` de doctorat de l’Universite´ Paris-Saclay prepar´ ee´ a` Telecom ParisTech Ecole doctorale n◦580 Denomination´ (STIC) NNT : 2018SACLT002 Specialit´ e´ de doctorat: Informatique These` present´ ee´ et soutenue a` Biot, le 3 septembre` 2018, par LETITIA W. LI Composition du Jury : Prof. Philippe Collet Professeur, Universite´ Coteˆ d’Azur President´ Prof. Guy Gogniat Professeur, Universite´ de Bretagne Sud Rapporteur Prof. Maritta Heisel Professeur, University Duisburg-Essen Rapporteur Prof. Jean-Luc Danger Professeur, Telecom ParisTech Examinateur Dr. Patricia Guitton Ingenieur,´ Renault Software Labs Examinateur Dr. Ludovic Apvrille Maˆıtre de Conferences,´ Telecom ParisTech Directeur de these` Dr. Annie Bracquemond Directeur de Recherche, Institut Vedecom Co-directeur de these` Titre:Approche Orientee´ Modeles` pour la Suretˆ e´ et la Securit´ e´ des Systemes` Embarques´ Mots cles:´ systemes` embarques, vehicules´ autonomes, suretˆ e´ de fonctionnement, securit´ e,´ exploration d’architecture Resum´ e:´ La presence´ de systemes` et d’objets em- le memeˆ temps, alors que les vehicules´ sont de plus barques´ communicants dans notre vie quotidienne a en plus connectes´ (et dans un avenir proche, au- apporte´ une myriade d’avantages, allant de l’ajout de tonomes), les chercheurs ont demontr´ e´ la possibilite´ commodites´ et de divertissements a` l’amelioration´ de de piratage de leurs capteurs ou de leurs systemes` de la suretˆ e´ des deplacements´ et des soins de sante.´ controleˆ interne. Cette these` s’interesse´ a` la securit´ e´ Cependant, les defauts´ et les vulnerabilit´ es´ de ces et la suretˆ e´ des systemes` embarques,´ dans le con- systemes` exposent leurs utilisateurs a` des risques de texte du vehicule´ autonome de l’Institut Vedecom. dommages materiels,´ de pertes monetaires,´ et memeˆ Notre approche repose sur une nouvelle methode´ de dommages corporels. Par exemple, certains de modelisation´ pour concevoir des systemes` em- vehicules´ commercialises,´ qu’ils soient connectes´ ou barques´ sursˆ et securis´ es,´ basee´ sur la methodologie´ conventionnels, ont dej´ a` souffert d’une variet´ e´ de SysML-Sec, et impliquant de nouvelles strategies´ de defauts´ de conception entraˆınant des victimes. Dans modelisation´ et de verification´ formelle. Title: Safe and Secure Model-Driven Design for Embedded Systems Keywords: embedded systems, autonomous vehicles, safe comportment, security, design space exploration Abstract: The presence of communicating embed- cases, death. At the same time, as vehicles become ded systems/IoTs in our daily lives have brought a increasingly connected (and in the near future, au- myriad of benefits, from adding conveniences and en- tonomous), researchers have demonstrated possible tertainment, to improving the safety of our commutes hacks on their sensors or internal control systems. and health care. However, the flaws and vulnera- This thesis discusses how to ensure the safety and bilities in these devices expose their users to risks security of embedded systems, in the context of Insti- of property damage, monetary losses, and personal tut Vedecom’s autonomous vehicle. Our approach in- injury. For example, consumer vehicles, both con- volves a new model-based methodology for safe and nected and conventional, have succumbed to a va- secure design, which involve new modeling and veri- riety of design flaws resulting in injuries, and in some fication methods. Universite´ Paris-Saclay Espace Technologique / Immeuble Discovery Route de l’Orme aux Merisiers RD 128 / 91190 Saint-Aubin, France Acknowledgments The research presented in this thesis was sponsored by Institut Vedecom of Versailles, France and took place at Lab System-on-Chip of Telecom ParisTech in Sophia Antipolis, France. With the conclusion of my PhD, I would like to recognize everyone who made the completion of this thesis possible: through technical support, encouragement, assisting with my post-thesis career plans, and helping me find a life in France. I would like to thank my advisors, Professor Ludovic Apvrille and Dr. Annie Bracquemond, who have guided me through this thesis. They have taught me all about modeling, verification, safety, security, and embedded systems, and it is their suggestions and corrections who have shaped this thesis into a coherent scientific work. I have been exceptionally fortunate for their availability to aid me in more than just my research, for I could not have navigated the administrative procedures or language difficulties without them, and I am also grateful for their willingness to show me the cultural heritage of the country, such as raclette. Next, I would like to thank all of my jury members for their time in participating in my defense, and all of the insights and the expertise they brought forth. I thank my reviewers: Professor Guy Gogniat and Professor Maritta Heisel for taking time this summer to read my thesis and offer feedback vital to its improvement, and the examiners of my jury: Professor Jean-Luc Danger, Professor Philippe Collet, and Dr. Patricia Guitton, for their interest in my research. I would also like to thank all of the developers of TTool, fellow members of LabSoc, and co-authors, for the working environment conducive to research, and all of our shared triumphs and disasters, especially: Professor Renaud Pacalet, who originally welcomed me to LabSoc for an internship and inspired me to start a career in research, and taught me the meaning of research and the search for knowledge and understanding, Professor Tullio Tanzi, who provided our case studies on his research on drones and rovers for disaster relief, and has taught me so much about radar and to find the courage to face the rest of the world so different than what I have experienced, Professor Rabea Ameur-Boulifa, who has been an excellent source of knowledge on formalization and verification, Dr. Florian Lugou, who developed so much of TTool’s security verification capabilities upon which my research is based, Matteo Bertolino, my officemate and fellow PhD student, who I am sure will forge his own career in academia, Dr. Dominique Blouin, whose work has greatly facilitated TTool development, Professor Daniela Genius of LIP6, our co-author who inspired most of our work on performance and relating between levels of abstraction, and Dr. Andrea Enrici of Nokia, the first of my fellow PhD students to graduate, who has been a great source of information regarding post-thesis life. I also thank the other researchers at Institut Vedecom, Laurent Bonic, Professor Féthi ben Ouezdou, and many others for helping with the modeling and testing on the company side. I thank my dearest and longtime friends Dr. Sharon Chou, Adam Fagan, Clement Pit-Claudel, Andrea Wang, and Stephie Wu, for their encouragement to see this thesis through, and staying a part of my life from afar. I am grateful for these friendships who have endured time and distance, and that they have ensured that we can meet again in those brief, precious times that we are on the same side of the ocean. And lastly, I thank my parents, who have always supported me no matter where my education and career take me. They have set an example to strive for education, knowledge, integrity, and scientific achievement, which, in my own way, I have attempted to live up to. 1 Abstract The presence of communicating embedded systems/IoTs in our daily lives have brought a myriad of ben- efits, from adding conveniences and entertainment, to improving the safety of our commutes and health care. However, the flaws and vulnerabilities in these devices expose their users to risks of property damage, monetary losses, and personal injury. For example, consumer vehicles, both connected and conventional, have succumbed to a variety of design flaws resulting in injuries, and in some cases, death. At the same time, as vehicles become increasingly connected (and in the near future, autonomous), researchers have demonstrated possible hacks on their sensors or internal control systems, including direct injection of messages on the CAN bus. Ensuring the safety of users or bystanders involves considering multiple factors. Conventional safety suggests that a system should not contain software and hardware flaws which can prevent it from correct function. ‘Safety of the Intended Function’ involves avoiding the situations which the system or its compo- nents cannot handle, such as adverse extreme environmental conditions. Timing can be critical for certain real-time systems, as the system will need to respond to certain events, such as obstacle