# CPTS 439

***

### Overview

This course explores the principles, techniques, and challenges of securing safety-critical cyber-physical systems. Students will gain a deep understanding of the vulnerabilities and threats in these systems and learn how to design and implement security measures. Example domains that we will study include the security of industrial control systems, automotive systems, smart grids, time-critical systems, and commodity Internet-of-things (IoT).

* **Instructor:** [Monowar Hasan](http://monowarhasan.info/)
* **Email:** <monowar.hasan@wsu.edu>
* **Class time:** Monday, Wednesday, Friday 1:10-2:00 PM
* **Class Location:** Pullman Campus, [Sloan 7](https://li.wsu.edu/buildings-and-spaces/general-university-classrooms/classroom-specs/sloan-7/)
* **Office Hours (EME B53):** Monday, Wednesday 2:30-3:30 PM or by appointment

> <mark style="color:orange;">**Important:**</mark> To better prepare yourself for office hours, read carefully the excellent guides from [Gabriel Parmer](https://www2.seas.gwu.edu/~gparmer/):
>
> * [Preparing and presenting yourself at office hours](https://www2.seas.gwu.edu/~gparmer/resources/2021-09-20-Office-Hours-HOWTO.html)
> * [Expected norms for online interactions](https://www2.seas.gwu.edu/~gparmer/resources/2020-08-01-Online-Conduct.html)

***

### Course Syllabus

The course syllabus is available [here](https://monowarhasan.info/courses/CPTS439_Syllabus_SP24.pdf).

***

### Textbook

The course uses materials from state-of-the-art cyber-physical and IoT security literature. In-class discussions and lecture slides will be sufficient to understand the basic concepts. *No textbook is required.*

***

### Schedule and Class Materials

**Note:** *The lectures and code files are hosted on the WSU OneDrive cloud. You need WSU credentials to access the materials. If you are from outside WSU and want to use these materials, please email Prof. Hasan at <monowar.hasan@wsu.edu>.*

<table><thead><tr><th width="79" data-type="number">WK</th><th width="81">Date</th><th width="215">Topic</th><th width="139">Slides</th><th>Remarks</th></tr></thead><tbody><tr><td>1</td><td>01/08<br>(Mon)</td><td>Course overview</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EpdtccsNbcRGtEcaeKcLAqcBpsCU3bYweEFow3dmQ2uZAg?e=FHIeY5">Lecture 01</a></td><td></td></tr><tr><td>1</td><td>01/10<br>(Wed)</td><td>CPS/ICS background</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/ElU96GzRLwRLieXfQPWMAoEBMKq8vRRcFb0OLayhZBlLxw?e=qCwX33">Lecture 02</a></td><td></td></tr><tr><td>1</td><td>01/12<br>(Fri)</td><td>CPS security overview</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/ElsUn_x-nvRMh9_UNOFdRDABxJv2isUPUHTUeCUAIt2yTQ?e=VWf4q1">Lecture 03</a></td><td></td></tr><tr><td>2</td><td>01/15<br>(Mon)</td><td><mark style="color:green;"><strong>No Class</strong></mark></td><td></td><td><mark style="color:green;">Martin Luther King Jr Day</mark></td></tr><tr><td>2</td><td>01/17<br>(Wed)</td><td><del>Safety and security</del><br><mark style="color:green;"><strong>No Class</strong></mark></td><td></td><td><mark style="color:blue;"><strong>Reading assignment 1 released</strong></mark><br><strong>MH is traveling</strong></td></tr><tr><td>2</td><td>01/19<br>(Fri)</td><td>Access control </td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/Ejzfj84qaM5AujN6kVqbX1UB-xK7qRhSkpdimRabdSMKFg?e=PrlHhV">Lecture 04</a></td><td></td></tr><tr><td>3</td><td>01/22<br>(Mon)</td><td>Access control mechanisms</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EqBaSBa0CvpDoVzPJ0sr5mQB97DyNNQKD6LeWMB_7hOevQ?e=ewRVqB">Lecture 05</a></td><td></td></tr><tr><td>3</td><td>01/24<br>(Wed)</td><td>Access control mechanisms</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EuqLGaB87ShNrMBADBnT90MBiPiV0JM8Uyj3M47UfHTuDg?e=5ti77d">Lecture 06</a></td><td><mark style="background-color:blue;">Reading assignment 1 due</mark></td></tr><tr><td>3</td><td>01/26<br>(Fri)</td><td><mark style="color:green;"><strong>No Class</strong></mark></td><td></td><td><mark style="background-color:orange;">Class cancelled</mark></td></tr><tr><td>4</td><td>01/29<br>(Mon)</td><td>Isolation techniques</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EsvJSJwyAT5ItnBmEDqTCu8Bj_NoeWnMhSC0nKXdEHt9VA?e=kflYcB">Lecture 07</a></td><td><mark style="background-color:red;"><strong>Project proposal due</strong></mark></td></tr><tr><td>4</td><td>01/31<br>(Wed)</td><td>Virtualization</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EqrW2PYDMZhEhr1vcHr15gcB_b2_252_Hr_Cf0mPUO_YMw?e=bh0jFD">Lecture 08</a></td><td></td></tr><tr><td>4</td><td>02/02<br>(Fri)</td><td>Trusted execution environments</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/Erf16wmp861AleNAFODamGMByiSZOPl4gnoodLrxjrpWSA?e=GkAL03">Lecture 09</a></td><td></td></tr><tr><td>5</td><td>02/05<br>(Mon)</td><td>Program-level isolation</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EotKS0e70X9Aj9A_MeaABycBn9ztHE6U8HJHanqxGi3dTw?e=Bhn9a1">Lecture 10</a></td><td><mark style="color:purple;">Prog. assignment 1 released</mark></td></tr><tr><td>5</td><td>02/07<br>(Wed)</td><td>Security models</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EgL6bxogu6pBqTd2ieIioLcBfAvNZ2fGzjzu-hJFeMFoug?e=2wTl3E">Lecture 11</a></td><td></td></tr><tr><td>5</td><td>02/09<br>(Fri)</td><td>Information flow</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/El9Jq_gXXpVGlpNZ93O2rtQBwfAedrsY8Yri6xfaY_KJRA?e=KtDKPD">Lecture 12</a></td><td></td></tr><tr><td>6</td><td>02/12<br>(Mon)</td><td>Covert channels</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EmutepgiorRBpFB8WvTNK8QBD2yQbxRgZ7zalT6c26v8iA?e=n7pPVX">Lecture 13</a></td><td></td></tr><tr><td>6</td><td>02/14</td><td>Covert channel (contd.)<br>ICS</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EuQjOlxLgqFAq4OTWMXAOL0BtcwIaBEmkCHhgeGFc5pk5Q?e=0ZO2gz">Lecture 14</a></td><td></td></tr><tr><td>6</td><td>02/16</td><td>ICS network</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EtjAB3yu59RDnfhvWCpg6asBitzMmI35I4AuwXw-1e_Ruw?e=TDqjDq">Lecture 15</a></td><td><mark style="background-color:purple;"><strong>Prog. assignment 1 due</strong></mark></td></tr><tr><td>7</td><td>02/19<br>(Mon)</td><td><mark style="color:green;"><strong>No Class</strong></mark></td><td></td><td><mark style="color:green;">President's Day</mark></td></tr><tr><td>7</td><td>02/21</td><td>Exam-1 review</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EgOlKlVEPsFMkjImG255RrUBT7xY49eZi1BrS7gweo9jbA?e=Cltzh7">Lecture 16</a></td><td>Informal feedback (<a href="http://tinyurl.com/439-fb-sp24">link</a>)</td></tr><tr><td>7</td><td>02/23</td><td><mark style="color:red;"><strong>Mid-Term Exam</strong></mark></td><td></td><td><mark style="color:orange;">In-class, closed-book exam</mark><br><mark style="color:orange;">Time limit: <strong>45 minutes</strong></mark></td></tr><tr><td>8</td><td>02/26<br>(Mon)</td><td>ICS network protocols</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EhdiT_Fw-69FhHJiykGTvWAB8GWiSJl6ZCWx7Khya7u1gA?e=eobLU5">Lecture 17</a></td><td><mark style="color:purple;">Prog. assignment 2 released</mark></td></tr><tr><td>8</td><td>02/28</td><td>ICS network protocols</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/Ei2H3UqYHzlCnrmwBrrcVpEBNguLuOwFHZLEvKUmkaB1RQ?e=5otgB6">Lecture 18</a></td><td></td></tr><tr><td>8</td><td>03/01</td><td>ICS network protocols</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/Er8J_iQie7NOhZKp5cCmcsIB3c2zQIacKuw-KkqTKHyoPA?e=nc2QPT">Lecture 19</a></td><td></td></tr><tr><td>9</td><td>03/04<br>(Mon)</td><td>ICS network security</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EuB4wDI3eldLsfJSSRfmzJEB-eQ-PcMsaFFrC7ZDMtPXtQ?e=Qtegrc">Lecture 20</a></td><td></td></tr><tr><td>9</td><td>03/06<br>(Wed)</td><td>Ccontroller area network</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/Eo4C77RWwnZImUBZxPqAro8B_jHmOb6cD2pD05ikKuuo5w?e=FTI1JG">Lecture 21</a></td><td></td></tr><tr><td>9</td><td>03/08<br>(Fri)</td><td>CAN security</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/ElnO5UFORzhHg3XcxZTLaUYBL0g1OfHD1AR8BRE-qcNZBQ?e=x7J38n">Lecture 22</a></td><td><mark style="background-color:purple;"><strong>Prog. assignment 2 due</strong></mark></td></tr><tr><td>10</td><td>03/11<br>(Mon)</td><td><mark style="color:green;"><strong>No Class</strong></mark></td><td></td><td><mark style="color:green;">Spring vacation</mark><br><mark style="color:purple;">Prog. assignment 3 released</mark><br><mark style="color:blue;"><strong>Reading assignment 2 released</strong></mark></td></tr><tr><td>10</td><td>03/13<br>(Wed)</td><td><mark style="color:green;"><strong>No Class</strong></mark></td><td></td><td><mark style="color:green;">Spring vacation</mark><br></td></tr><tr><td>10</td><td>03/15<br>(Fri)</td><td><mark style="color:green;"><strong>No Class</strong></mark></td><td></td><td><mark style="color:green;">Spring vacation</mark></td></tr><tr><td>11</td><td>03/18<br>(Mon)</td><td>Real-time systems</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/Er0IzgznWkNAlU2JRruthG8BEwdi_GdlgffVpt2To39Iyg?e=DTqIIl">Lecture 23</a></td><td></td></tr><tr><td>11</td><td>03/20<br>(Wed)</td><td>Real-time security</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EiKM6qsOeuNPmGgdtAUOCCwBnVOqE_ykzaNO0hK1-Ph8ng?e=q8Fw1K">Lecture 24</a></td><td></td></tr><tr><td>11</td><td>03/22<br>(Fri)</td><td>Real-time security</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EjGZUil6f9ZGjwPo5PFK_UYBH7YwdIW-tKLM4jo3_Y-AQA?e=0QcOkf">Lecture 25</a></td><td><mark style="background-color:red;"><strong>Project update due</strong></mark></td></tr><tr><td>12</td><td>03/25<br>(Mon)</td><td>Real-time security</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EmCZv_xVw1lBvC9eHnnasG4BOg1V2sYqRNLkYZ47KCQ92A?e=rSefx8">Lecture 26</a></td><td></td></tr><tr><td>12</td><td>03/27<br>(Wed)</td><td>Real-time security</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EoJQSHrJZv9Pll-Tv6LA9WMB1CFGgLqq0ajvs9s8pew_YQ?e=emNoz0">Lecture 27</a></td><td><mark style="background-color:blue;"><strong>Reading assginment 2 due</strong></mark></td></tr><tr><td>12</td><td>03/29<br>(Fri)</td><td>Real-time security</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EtchggvdFa9Kid-pJ52hmvQBAuvTlVEWVIZUxwMLFujzdA?e=eg8Agc">Lecture 28</a></td><td><mark style="background-color:purple;"><strong>Prog. assignment 3 due</strong></mark></td></tr><tr><td>13</td><td>04/01<br>(Mon)</td><td>Hardware security</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/Et1Ddrp0_69Aqe7El6SQfaEBrMtdofH6f_rRe-fL-j3sHw?e=h0BPj2">Lecture 29</a></td><td><mark style="color:purple;">Prog. assignment 4 released</mark></td></tr><tr><td>13</td><td>04/03<br>(Wed)</td><td>Hardware trojans</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/ElB17J8qyGdMq2UERYFgAAcBwFWNwKxf5Z-KReniJqfZDQ?e=wsGPhd">Lecture 30</a></td><td><mark style="color:blue;"><strong>Reading assignment 3 released</strong></mark></td></tr><tr><td>13</td><td>04/05<br>(Fri)</td><td>Hardware security and trust</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EsvRAxcl5VFIlZ9X79iDja4B3zXZhxgnghNtkQJ9HZy0kg?e=Y1huyu">Lecture 31</a></td><td></td></tr><tr><td>14</td><td>04/08<br>(Mon)</td><td>System auditing</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EuI2HREsQeJAkCRdV83TCf8BpMUmJfq-Kngp5vGUyP2gLA?e=0yIRSi">Lecture 32</a></td><td></td></tr><tr><td>14</td><td>04/10<br>(Wed)</td><td>System auditing</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EsexI_cp_VNNkd7pY0IGYHMB-nOfja-wzis8_T8Q35t1Dw?e=kQIPsp">Lecture 33</a></td><td><mark style="background-color:blue;"><strong>Reading assignment 3 due</strong></mark></td></tr><tr><td>14</td><td>04/12<br>(Fri)</td><td>Secure CPS design</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/ErzBp1Wx84VDtHkAVi7bv5cBDMN4vHG7y4Ll-iu2ZoxnpA?e=45BR28">Lecture 34</a></td><td><mark style="background-color:purple;"><strong>Prog. assignment 4 due</strong></mark></td></tr><tr><td>15</td><td>04/15<br>(Mon)</td><td>Exam review and closing</td><td><a href="https://emailwsu-my.sharepoint.com/:f:/g/personal/monowar_hasan_wsu_edu/EjJZ1vzK7PVKtLCLSlFBggQBNOgWu07Eh0Xo80A1hWR9pw?e=W7bYc1">Lecture 35</a></td><td></td></tr><tr><td>15</td><td>04/17<br>(Wed)</td><td>No class — presentation preparation</td><td></td><td>Buffer day before project presentation</td></tr><tr><td>15</td><td>04/19<br>(Fri)</td><td>Project presentation<br><strong>Matthew Gerola</strong> <br><strong>Griffin Gerry &#x26; Freeman Trader</strong><br><strong>Alexander Hagood</strong></td><td></td><td><mark style="background-color:red;"><strong>Project due</strong></mark></td></tr><tr><td>16</td><td>04/22<br>(Mon)</td><td><mark style="color:green;"><strong>No Class</strong></mark><br></td><td></td><td><strong>MH  is traveling for a workshop</strong></td></tr><tr><td>16</td><td>04/24<br>(Wed)</td><td>Project presentation<br><strong>Dathan Le</strong> <br><strong>Kyle Parker</strong><br><strong>Howie Potter</strong><br><strong>Ganesh Krishnamoorthy</strong></td><td></td><td><mark style="background-color:green;">End of class!</mark></td></tr><tr><td>16</td><td>04/26<br>(Fri)</td><td>No class — exam preparation</td><td></td><td></td></tr><tr><td>17</td><td>04/29<br>(Mon)</td><td><mark style="color:red;"><strong>Final Exam</strong></mark><br><mark style="color:red;"><strong>04/29, 1:30-3:00 PM</strong></mark><br><mark style="color:red;"><strong>@ Classroom</strong></mark></td><td></td><td><mark style="color:orange;">In-class closed-book exam</mark><br><mark style="color:orange;">Time limit: <strong>90 minutes</strong></mark></td></tr></tbody></table>

***

### Reading Assignments <a href="#resources" id="resources"></a>

There will be **three** reading assignments: Week 2, Week 10, and Week 13. Grading for reading assignments will be based on ***submission*** or ***non-submission***: total points for attempted assignments with reasonable answers will be awarded, while unattempted tasks will receive no points.

***

### Term Project

Students will engage in a semester-long project related to critical infrastructure security. A team of a maximum of **two students** is acceptable.  The students will submit an end-of-semester report and a recorded presentation (time limit: 10 minutes).\
\
The term project could be one of the following types:

1. **Survey:** Students will survey the related research fields. The survey should include a summary of at least 8 papers from top journals/conferences.
2. **Exploration:** Students will explore a new research problem related to CPS/IoT security.&#x20;

Some problems of interest are as follows (NOTE: this is NOT the list you are required to choose from):

* Integrating security monitoring/cryptographic primitives in CPS
* Using trusted computing time-critical CPS
* Lightweight and privacy-preserving machine learning models for autonomous systems
* Review of TEE-related (TrustZone/SGX) security vulnerabilities for the CPS applications
* Investigating covert/side-channels in real-time/CPS/SCADA applications

**Project Deliverables:**

* **Project proposal:** The term project proposal with a timeline (max two pages) must be submitted and approved by the instructor by the end of **Week 4**.
* **Mid-semester update:** A progress report (max three pages) of the project is due by **Week 10**.
* **Final submission:** The final project, all related code/data, and a recorded talk (maximum 10 minutes) are due by the exam week. Use the [IEEE conference format](https://www.ieee.org/conferences/publishing/templates.html) template for your report. Reports can be up to 6 pages, excluding references (and appendices, if any). The final project is due by **Week 15**.

***

### Exams

There will be **two** exams on **Week 7** and **Week 17** (Finals Week). Details will be announced on Canvas/Class.

***

### Programming Assignments <a href="#resources" id="resources"></a>

We will have **four** programming assignments in this course. The assignments must be completed individually.&#x20;

* Assignment 1: CPS Security Warm-Up -- Analyzing a Firmware Image
* Assignment 2: Attacking a Cyber-Physical Plant
* Assignment 3: Hacking an Automotive System (Controller Area Network)
* Assignment 4: UAV Autopilot Controller Security

**Notes:**&#x20;

* You will need access to a Linux machine (or VM) to complete the labs.&#x20;
* For Windows systems, [WSL](https://learn.microsoft.com/en-us/windows/wsl/install) is **not recommended**. You must install a standalone VM image.&#x20;
* Due to the incompatibility of newer M-series (ARM) Mac computers, it is recommended to use X86-based Windows/Linux machines (or older Intel-based Macs) to create the VM images.&#x20;
* For those with M-series Macs (or if you can't use your laptop), we will provide compatible systems (located in EME labs). However, no remote access is available -- you must be physically present in the lab to use those machines.

### Programming Assignment Submission <a href="#pa" id="pa"></a>

We will use [GitHub Classroom](https://classroom.github.com) to deliver programming assignments. To learn more about the GitHub workflow, see [GitHub Quickstart](https://docs.github.com/en/get-started/quickstart).

**Are You Using GitHub for the first time on your machine?**\
If you are using GitHub for the first time on your development machine, you need to authenticate your account — one way to do this is by using [GitHub CLI](https://github.com/cli/cli). Install GitHub CLI using the instructions given [here](https://github.com/cli/cli#installation). Then run the following command and follow the prompts to authenticate your system: `gh auth login`.

#### Submission Workflow <a href="#resources" id="resources"></a>

1. For each lab, you will find a GitHub Classroom link on Canvas. Once you click the link and log into your GitHub account, find your name in the student list and click it to accept the assignment. Please double-check your name and email address before accepting the assignment. *If you accidentally choose another student's name, please contact the instructor.*
2. A repo named `wsu-cpts439-term/paX-name` will be automatically created for you and hosted on GitHub with the starter code.
3. You can then "clone" your repository onto your development machine. You will complete assignments on your development computer and then "push" your work to the GitHub-hosted remote repository for us to grade.
4. **Final submission:**&#x20;
   * Copy the URL of your GitHub repository on the corresponding assignment section on Canvas.&#x20;

For any questions on setting up GitHub, please reach out to the instructor.

***

#### <mark style="color:blue;">Got stuck? Questions about anything? Feel free to contact the instructor on Teams (preferred) or via email: <monowar.hasan@wsu.edu>!</mark>