Analysing the Safety Implications of Security Risks in Cyber-Physical Systems

Cyber-physical systems (CPS) often use open communications to expedite interactions and hence introduce security risks which can be exploited by attackers to cause unsafe failure conditions. Interfaces within the system require security properties (e.g. confidentiality, authentication and reliability) in order to ensure that potential risks are eliminated. However, different applications may differ in their sensitivity to particular security properties. Avionics standards such as ED202A require developers to analyse potential security risks to ensure that their impact on the safe operation of an aircraft is acceptable. We show how Event-B modelling can be used to evaluate which security properties affect safety, and other properties such as liveness, in a particular CPS application.