Process-Aware Covert Channels Using Physical Instrumentation in Cyber-Physical Systems

We propose using the analog emissions of physical instrumentation (e.g., actuators, sensors, and mechanical structures) in a cyber-physical system (CPS) to send or leak information without impacting the CPS process characteristics. We show that one can use the analog emissions as covert channels to send information to a remote receiver without altering the functioning of the CPS by considering the dynamics of the controller and its closed-loop characteristics. We demonstrate the control-theoretic approach using the Tennessee Eastman (TE) controller benchmark implemented in a hardware-in-the-loop simulator. Two feedback loops (out of 18) in the TE process are implemented on a programmable logic controller (PLC) driving a geared motor. Assuming that a malware has compromised this PLC, we show that the malware can use the acoustic emissions of a motor controlling a valve in a feedback control loop as a covert channel. This secret transmission over the covert acoustic channel can be done without affecting the stability, performance, and signal characteristics of the closed-loop process. An attacker can exfiltrate sensitive information, such as the proprietary gains or the thresholds used in the controller and the system passwords using covert channels.