时间关键型工业控制系统中基于缓存的多播消息认证
Caching-based Multicast Message Authentication in Time-critical Industrial Control Systems
AI总结：
本文提出轻量级消息认证方案CMA及其多播变体CMMA，通过预计算与缓存消除时间关键型工业控制系统中的密码学操作延迟，并利用消息紧急程度加速关键消息验证，在智能电网变电站自动化场景中验证了可行性。
摘要：
针对工业控制系统（ICS）的攻击往往利用认证机制的不足。验证接收到的消息是否完整且由合法来源发出，可以防止非法或受侵害设备注入恶意数据/命令。然而，关键挑战在于为各种ICS通信模型（包括多播或广播）引入消息认证，其消息速率可高达每秒数千条，且延迟约束极为严格。例如，智能电网中某些用于保护的命令必须在2毫秒内送达，这排除了公钥密码学的使用。本文提出了两种轻量级消息认证方案，分别命名为CMA及其多播变体CMMA，它们通过预计算和缓存来认证未来消息。在最小的预计算和通信开销下，C(M)MA在消息给出后消除了源端的所有密码学操作，并在消息接收后消除了目的端的所有昂贵密码学操作。C(M)MA考虑了一组未来消息的紧急程度（或可能性），以便对最时间关键（或最可能）的消息进行更快的验证。我们基于智能电网中的变电站自动化系统，在ICS环境中证明了C(M)MA的可行性。
英文摘要：
Attacks against industrial control systems (ICSs) often exploit the insufficiency of authentication mechanisms. Verifying whether the received messages are intact and issued by legitimate sources can prevent malicious data/command injection by illegitimate or compromised devices. However, the key challenge is to introduce message authentication for various ICS communication models, including multicast or broadcast, with a messaging rate that can be as high as thousands of messages per second, within very stringent latency constraints. For example, certain commands for protection in smart grids must be delivered within 2 milliseconds, ruling out public-key cryptography. This paper proposes two lightweight message authentication schemes, named CMA and its multicast variant CMMA, that perform precomputation and caching to authenticate future messages. With minimal precomputation and communication overhead, C(M)MA eliminates all cryptographic operations for the source after the message is given, and all expensive cryptographic operations for the destinations after the message is received. C(M)MA considers the urgency profile (or likelihood) of a set of future messages for even faster verification of the most time-critical (or likely) messages. We demonstrate the feasibility of C(M)MA in an ICS setting based on a substation automation system in smart grids.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
