DuAtt: A Dual-Layer Attestation Scheme for PLC-Based Industrial Internet of Things

Industrial Internet of Things (IIoT) applications span a wide range of critical infrastructure sectors. Therefore, ensuring efficiency and security is critical in the IIoT given their widespread impact and vulnerability to multi-faceted attacks. System integrity can be compromised by malicious modifications in the program/software running on IIoT devices. Although programmable logic controllers (PLCs) are widely used in the IIoT, most of the existing attestation techniques exhibit computational complexity, leading to not only higher demand for resources but also a lack of versatility required to effectively detect and mitigate malicious modifications in PLCs. To resolve this issue, we propose a novel Dual-layer Attestation technique ‘DuAtt’, that aims to comprehensively validate the integrity of PLC-based IIoT devices at two levels of abstraction. The first layer leverages a physical process-based model to detect abnormal behavior by creating a physical model using linear dynamic state-space (LDS). The physical model then allows us to estimate the system state based on current sensor measurements and PLC output. After estimating the system states, a mismatch in the estimated values and the actual measurements signifies an anomaly. To complement, based on the feedback from the first layer, a second layer runs a software-based attestation check on the PLC’s program integrity. Thus, the first layer runs more frequently and requires fewer resources, which reduces the overall computational burden. Whereas, the more complex second layer is responsible for carrying out further investigation when an anomaly is detected. The effectiveness of DuAtt is evaluated using experiments on actual hardware, showing a lower verification delay by up to 37.31% in contrast to the current methods and provides a 100% detection rate against output as well as program modification attacks, with quick restoration to the original state in addition to the added benefits of scalability and adaptability.