Risk-Based Illegal Information Flow Detection in the IIoT

Argiro Anagnostopoulou, Ioannis Mavridis, Dimitris Gritzalis

2023

Abstract

Industrial IoT (IIoT) consists of a great number of low-cost interconnected devices, including sensors, actuators, and PLCs. Such environments deal with vast amounts of data originating from a wide range of devices, applications, and services. These data should be adequately protected from unauthorized users and services. As IIoT environments are scalable and decentralized, the conventional security schemes have difficulties in protecting systems. Information flow control, along with delegation of accurate access control rules is crucial. In this work, we propose an approach to assess the existing information flows and detect the illegal ones in IIoT environments, which utilizes a risk-based method for critical infrastructure dependency modeling. We define formulas to indicate the nodes with a high-risk level. We create a graph based on business processes, operations, and current access control rules of an infrastructure. In the graph, the edges represent the information flows. For each information flow we calculate the risk level. This aids to reconstruct current access control rules on the high-risk nodes of the infrastructure.

Paper Citation

in Harvard Style

Anagnostopoulou A., Mavridis I. and Gritzalis D. (2023). Risk-Based Illegal Information Flow Detection in the IIoT. In Proceedings of the 20th International Conference on Security and Cryptography - Volume 1: SECRYPT; ISBN 978-989-758-666-8, SciTePress, pages 377-384. DOI: 10.5220/0012079800003555

in Bibtex Style

@conference{secrypt23,
author={Argiro Anagnostopoulou and Ioannis Mavridis and Dimitris Gritzalis},
title={Risk-Based Illegal Information Flow Detection in the IIoT},
booktitle={Proceedings of the 20th International Conference on Security and Cryptography - Volume 1: SECRYPT},
year={2023},
pages={377-384},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012079800003555},
isbn={978-989-758-666-8},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 20th International Conference on Security and Cryptography - Volume 1: SECRYPT
TI - Risk-Based Illegal Information Flow Detection in the IIoT
SN - 978-989-758-666-8
AU - Anagnostopoulou A.
AU - Mavridis I.
AU - Gritzalis D.
PY - 2023
SP - 377
EP - 384
DO - 10.5220/0012079800003555
PB - SciTePress