Secure Robotic Process Automation

Abstract

The use of industrial control systems (ICS) allows for greater flexibility and customization in the control and monitoring of industrial processes, which are at the core of every robotic process automation (RPA). However, RPA systems are vulnerable to digital security threats, particularly finite-state machines (FSMs) used in decision-making, command, and control operations. The Stuxnet attack on the Iranian nuclear uranium enrichment plant is an example of a control logic injection attack on RPA systems. Various physical and cyber security solutions are developed to counter security threats, including locking the cabinets, securing the network, and applying firmware updates. After reviewing the literature on ICS, it is evident that there is a critical importance of securing programmable logic controllers (PLCs). Despite existing protections at management, planning, supervisory, control, and field levels, there is a research gap in the logic-level security of PLCs. State-Permutation Logic Locking (SPeLL) is a novel approach to logic locking FSMs, encrypting them based on transition obfuscation to protect the states from tampering and reverse-engineering. Therefore, the SPeLL algorithm is used to execute the logic-level security in the PLCs. Consequently, the conventional static, next-state lookup table of the FSM is transformed into a dynamic, key-dependent lookup table. Security researchers, reverse engineers, and analysts frequently use attack or deobfuscation approaches to comprehend the functioning of an algorithm, detect weaknesses, and obtain knowledge about the behaviour of encryption techniques. As a result, the security analysis of the SPeLL algorithm is conducted by utilizing the state-of-the-art tools, Netlist Encryption and Obfuscation Suite (NEOS) and the Reversal Assessment of Netlist Encryption (RANE). This analysis revealed that these tools are unable to parse or interpret the behavioural netlists encrypted by SPeLL. This outcome not only validates the robustness of the encryption method but also positions it as a formidable tool in safeguarding against reverse engineering and cyber threats.

Date of Award	10 May 2024
Original language	American English
Supervisor	IBRAHIM Elfadel (Supervisor)