  Cyber-physical systems (CPS) are vulnerable to attacks targeting outgoing
actuation commands that modify their physical behaviors. The limited resources
in such systems, coupled with their stringent timing constraints, often
prevents the checking of every outgoing command. We present a "selective
checking" mechanism that uses game-theoretic modeling to identify the right
subset of commands to be checked in order to deter an adversary. This mechanism
is coupled with a "delay-aware" trusted execution environment (TEE) to ensure
that only verified actuation commands are ever sent to the physical system,
thus maintaining their safety and integrity. The selective checking and trusted
execution (SCATE) framework is implemented on an off-the-shelf ARM platform
running standard embedded Linux. We demonstrate the effectiveness of SCATE
using four realistic cyber-physical systems (a ground rover, a flight
controller, a robotic arm and an automated syringe pump) and study design
trade-offs. Not only does SCATE provide a high level of security and high
performance, it also suffers from significantly lower overheads (30.48%-47.32%
less) in the process. In fact, SCATE can work with more systems without
negatively affecting the safety of the system. Considering that most CPS do not
have any such checking mechanisms, and SCATE is guaranteed to meet all the
timing requirements (i.e., ensure the safety/integrity of the system), our
methods can significantly improve the security (and, hence, safety) of the
system.
