Authors:
Argiro Anagnostopoulou
1
;
Ioannis Mavridis
2
and
Dimitris Gritzalis
1
Affiliations:
1
Dept. of Informatics, Athens University of Economics and Business, Patision 76 Ave, Athens, Greece
;
2
Dept. of Applied Informatics, University of Macedonia, 156 Egnatia St, Thessaloniki, Greece
Keyword(s):
Access Control, Information Flow Control, Illegal Information Flow Detection, Critical Infrastructure Protection, Industrial Internet of Things (IIoT), Industry 4.0.
Abstract:
Industrial IoT (IIoT) consists of a great number of low-cost interconnected devices, including sensors, actuators, and PLCs. Such environments deal with vast amounts of data originating from a wide range of devices, applications, and services. These data should be adequately protected from unauthorized users and services. As IIoT environments are scalable and decentralized, the conventional security schemes have difficulties in protecting systems. Information flow control, along with delegation of accurate access control rules is crucial. In this work, we propose an approach to assess the existing information flows and detect the illegal ones in IIoT environments, which utilizes a risk-based method for critical infrastructure dependency modeling. We define formulas to indicate the nodes with a high-risk level. We create a graph based on business processes, operations, and current access control rules of an infrastructure. In the graph, the edges represent the information flows. For e
ach information flow we calculate the risk level. This aids to reconstruct current access control rules on the high-risk nodes of the infrastructure.
(More)