Schneier on Security

Clive Robinson • June 27, 2010 4:15 AM

Although most of the things described (and many more besides) are possible you need to sanity check it.

The first question is “Why would you?”

There are two basic answers,

1.1, Because you can.
1.2, Because there is profit in it.

Because of the “Ego Food” asspect of 1.1 it is safe to assume that at some point it will be (like the defacing of harmless charity web sites etc).

The “profit” option gives rise to the obvious realisation of it’s opposit “loss”.

Thus the second and perhaps more important question “What is the loss potential?”

Potentialy it’s unlimited for any individual risk but in most cases any particular risk its actually not going to make it out of the noise floor of a risk analysis (but that class of risk may well do so).

Which gives rise to the the idea of mitigating specific high value risks directly and also some medium value risks. Likewise with some “Classes of Risk”. Traditionaly the rest you externalise by such things as insurance.

Now there is a specific problem with externalising risk onto a third party and that is the “assumptions of a physical universe” which gives rise to the notion of risk probability being spread against time.

Unfortunatly as we are seeing with the likes of botnets the information universe does not have the constraints of physical forces except where it interacts with the physical universe in things like storage and communications.

So information attacks are not subject to force multiplier or locality constraints just the cost of communications and storage which are effectivly zero for the attacker with the Internet etc.

Thus you need to find away of mitigating the risk arising from “zero cost”. If you do this correctly then the likes of “ego food” attacks goes down not just to the cost but due to the tracability the cost gives.

Also the cost metric and it’s attendent traceability means that the profit motivation equation tipping point moves significantly in the defenders favour.

The question thus arrises how do you raise the cost metric and get best advantage of the tracability metric that arises.

It is actually better to view it as two orthagonal domains with four limits,

(0,0) no cost, no tracability.
(0,1) no cost, full tracability.
(1,0) full cost, no tracability.
(1,1) full cost, full tracability.

Any proposed solution can then be viewed on this two dimensional matrix.

For instance AES encryption has a small direct cost to the defender but a very high cost to the attacker, but the attackers cost has low tracability.

Each mitigation can thus be assessed and a suitable choice made.

For instance even if you have full tracability does it actually stop an attack?

The simple answer is it depends on the jurisdictions the attacker and defender are in, and less obviously the time element involved.

Therefour you need to have a third dimension to your matrix and that is one of response time.

Thus it may be that your mitigation involves trivial cost increases and minimal or zero tracability but very very fast response times.

However an attacker on viewing such a system might go for a “delayed payload” attack.

What is clear however is that we cannot afford to deploy systems with a 25year or more life expectancy (which is the only way these proposed “smart grid” devices will pay back) unless we build in the appropriate mittigation directly…

And more importantly they need to be built in before the design process starts…

Clive Robinson • June 28, 2010 8:26 PM

@ Peter A,

“5. In near-emergency situations prices could be set much higher (but not to exceed some upper limit and for limited period), so the devices could react in near real time by temporarily going into powersave mode until the price drops again if it is OK for them, but can stay in normal mode for reasons of efficiency, safety, user preference or whatever other reason locally determined.”

Not sure if other folks have noticed but there is a “stability” issue with this and it will almost certanly exhibit oscillatory behaviour due to the different response time lengths (price setting and reaction to price by appliances).

If you imagine that demand has gone up due to some event after a delay the utility company starts to increase the price. Depending on the consumers their smart devices will after another delay adjust their ON/OFF/USAGE status. Demand drops and after a utility company decided delay the price drops. So after another consumer decided delay the devices will turn themselves on again.

What you would expect to see is oscillitory behaviour around a price point which in feedback control systems is known as “hunting”.

Now there are a couple of issues,

The first being the “startup surge” you identified would put in a significant over current on the network and as you have identified you get a fuse blowing/tripping.

As I identified further up the page this can give rise to a cascade failure and it will be “good night southern California”.

The second problem is more subtal and it is due to “phase delay” caused by the Utility company price change delay and the consumer appliance delay.

In a “servo loop” or “feedback delay” system it is known that if you have sufficient “response time” delays then it is possible for the “hunting oscillation frequency” to get sufficiently out of phase such that the negative feedback becomes positive feedback. Which means that the oscillation can fairly quickly build up to the point where it enters catastrophic self resonance and dies (anybody remember “the narrows” suspension bridge footage). Or worse the servo loop can “chase it’s tail” which builds up not to ocillation but a rapidly rising current demand which would quickly reach the “end stopps” and again cause fuses to trip giving the same effect as a cascade failure.

Engineers usually “tune” systems by controling the bandwidth and time delay of both the feedback loop and that of any “gain stages” in the loop. As a general rule of thumb the bandwidth of the overal control loop is kept well below that of any gain stage within the loop. And the total delays of gain stages kept very much less than the feedback loops “natural frequency”.

Now when you look at the feed back loop for the “smart grid” you have a real issue as there is not one feed back loop but as many as there are appliances out their. Irespective of how much control you have over the appliances you still need a very low bandwidth around the utility price setting to avoid loop instability.

Due to “economy” appliances (washing machines in particular) their inherant time delays are measured in hours not minutes or seconds. The result is that utility suppliers loop bandwidth would need to be five to ten times less than this or measured in 10 to 20 hours time steps…

When you then take into account how long it takes to “bring on line” extra capacity to adverse demand (think rapid onset adverse weather in places like Montreal in Canada), or respond to “solar flare” activity then you will realise,

1, The only utility grid of any use that will not damage it’s self is one using prediction not feedback.

2, There are major events that the a grid cannot predict.

That is a “smart grid” is not going to work any better than the current predictive grid, unless it has very fine control on each and every appliance.

Such fine control requires a lot of computing grunt which is only feasable to do in the appliance.

The appliance is beyond the “reliable” control of the grid operator, thus the smart grid is a “hostage of fortune” to those who can “zero day” even just one or two appliance instances such as just one leading brand of washing machine or air con…

Thus you can see that the smart grid offers no improvment to National Security in any way, in fact the exact opposite. Further it can be seen that it would be less environmentaly efficient than the current predictive grids.

Oh and as I said earlier some of the appliance equipment would have a life expectancy up in the 25year range.

Ask yourself a simple question,

Has any IT based technical security system without any change since first deployment lasted 25years, or even a reasonable fraction of that time?

The answer if you are honest is no, not even DES lasted that long, and think of all the cracks appearing in AES systems due to not considering “side channels” in the design requirment (even though they where known to be a significant attack vector even in the academic community let alone the “proffessional community” such as the NSA/GCHQ et al).

So take a leaf out of “Nancies” book,

“Just say no to” Smart Grids.