How should safety-critical systems such as autonomous road or rail vehicles react if they come under attack? In the DFG project "Resilient Safety-Critical Systems through Run-time Risk Assessment, Isolation, and Recovery (RESURREC)", researchers at Darmstadt University of Applied Sciences are developing solutions in cooperation with the University of Passau.

Attacks on safety-critical systems such as autonomous vehicles can have serious consequences, e.g. financial damage or even endanger life and limb. Through successful attacks on assets (e.g. software applications, control units, cryptographic keys or messages), an attacker can cause damage directly or indirectly (by extending the attack to other assets). Traditional security measures such as fault detection, isolation and recovery (FDIR) only protect against errors and not against targeted attacks. For example, an attacker could manipulate a component that is responsible for isolating a faulty component and switching to a redundant instance. FDIR must therefore be expanded to include suitable security measures. In particular, it must be possible to recognise and react to attacks as well as errors. In order to achieve resilience, mechanisms for isolation and recovery must also be protected against manipulation. In addition, once an attack has been detected, a suitable response must be selected at system runtime; this decision must be based on a risk calculation and take into account the special features of safety-critical systems.

The aim of RESURREC is to improve the resilience of safety-critical systems through new methods for attack detection, runtime risk assessment, isolation and recovery. The main focus is on the last three aspects, as there are already several approaches for intrusion detection systems (IDS) in safety-critical systems, while risk assessment, isolation and recovery have received much less attention. As an application domain, we consider an autonomous vehicle as it is a distributed and complex safety-critical system consisting of multiple networked components such as control units, sensors and actuators running software applications. For risk assessment, we are investigating new methods for risk assessment based on the dependencies between the assets. The isolation and recovery approaches familiar from the safety context are supplemented by security measures. We are investigating how the zero-trust paradigm can be applied to safety-critical systems. Among other things, we are investigating novel authentication mechanisms, entry and usage control systems and secure service-oriented architectures. The solutions we develop are implemented and evaluated as prototypes.

The project is a collaboration with Prof Dr Stefan Katzenbeisser from the University of Passau. It is funded by the German Research Foundation as part of the priority programme "Resilience in Networked Worlds - Mastering Errors, Overload, Attacks and the Unknown" over a period of three years.