Security Solutions for Constrained Devices in Cyber-Physical Systems

Industrial Control Systems (ICS) are becoming more and more connected. Whileconnecting systems increases flexibility productivity in ICS, it also introduces risks and security vulnerabilities. Media have reported several cyberattacks against ICS, and security is a top priority in the next generation of ICS. High availability requirements and severe consequences of cyber-attacks make securing ICS a challenging problem.In the next generation of industrial control systems, often called Industry 4.0,most parts are assumed to be connected. These connected things are classified as Industrial Internet of Things (IIoT). The scale of deployment of these IIoT devices requires special considerations and solutions.This thesis will present work on security for industrial control systems andcyber-physical systems. The contributions include protocols for secure communications in small, connected IIOT devices and schemes for security life cycle management of industrial control systems.On the topic of protocols, this contribution consists of two papers. The firstis an evaluation of the recently standardized protocol OSCORE, in terms of effi-ciency, to investigate its suitability for constrained devices. We also, in the second paper, propose a novel way of encrypting sensor data in transit to a remote server for analytics so that the sender’s identity remains hidden.The long lifetimes of ICS require the management of devices over an extendedtime. On this topic, we also include two papers. In the first, we have utilized thenew concept Digital Twin, for a security architecture where physical components are synchronized to a Digital Twin, to keep track of their security status. In the final paper, we observed that long lifetimes of devices in ICS also introduces the problem of how to deal with the ownership change. We have designed a protocol that transfers the ownership of IoT devices from one entity to another