# SPD-Safe: Secure Administration of Railway Intelligent Transportation Systems
## 5 SPD-Safe Demonstration  
### Railway CPS Architecture  
This section details the demonstration and evaluation of the whole SPD-Safe framework in the context of protecting and managing a railway CPS. In the proof-of-concept setting, our proposal assesses and manages the system and ambient ecosystem with the goal of safeguarding the trains' carriages and railway's routes. The hardware platforms incorporate embedded devices that control smart equipment (e.g., cameras and electronic doors), inspect environmental conditions, and exchange information wirelessly. Furthermore, the PBAC framework is applied for the control of the physical access for personnel, determined by access rights that are specified in XACML policies. Every agent manages a smart subsystem, like a train or a station. Backend agents can also run at the cloud in order to gather  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Property** & **SecRoute** & **RFSN** & **Ariadne** & **CSRAN** & **SR3** \\ \hline Authentication & TESLA & TESLA & TESLA & Certificates & LWC \\ Routing method & DSR & DSR & DSR & ARAN & Random walk \\ Reputation & Bayesian & Bayesian & NO & Bayesian & FIFO * \\ Fading & & & & & \\ Load-balancing & YES & NO & NO & NO & Partially \\ Energy-aware & YES & NO & NO & NO & NO \\ Anti-jamming & YES & NO & NO & NO & NO \\ Authorization & YES & NO & NO & NO & NO \\ \hline \hline \end{tabular}  
* FIFO: First In First Out finite list.  
\end{table}
Table 4: Secure routing protocols.  
Figure 3: Simulation results for the evaluation of the network layer security solutions against four attack scenarios.  
high level information, perform big data analysis, and enable interaction with external systems and actuators. These agents run on virtual machines deployed on the research cloud platform GRNET Virtual MAchines (ViMA: [[http://vime.grnet.gr/about/info/en/](http://vime.grnet.gr/about/info/en/)]([http://vime.grnet.gr/about/info/en/](http://vime.grnet.gr/about/info/en/))). Figure 4 illustrates the railway system architecture. The whole setting is administered by a master agent (MA) at the C&C. At the edge, simple and more lightweight agents (SAs) protect the local subsystems (applying access control, lightweight data analysis, incident detection, etc.) and exchange information with the MA (i.e., security/safety events and response strategies). The MA can, optionally, forward data to a cloud SA for storing or in-depth analysis. The cloud SA also presents high-level knowledge to end-users as well as the current SPD status of the railway infrastructure.  
For this demonstration, the MA and the C&C services are deployed on a laptop. Both MA and cloud SA are installed on machines witha 2.1 GHz Intel Core i-7 processor, 8 GB of RAM, and the Ubuntu Linux Operating System (OS). The SAs are deployed on the BeagleBone devices at the edge systems.  
As a case study, two deployments are evaluated. In the first indoor setting, which emulates in-carriage or shelter equipment, we test the system under normal operation and the aforementioned attacks on routing. In the second outdoor scenario, which emulates the on-route equipment, we examine the system's response to safety-related incidents. Both networks run the SecRoute protocol [61] to enable communication, protect the network layer against cyber-attacks, and act as an intrusion detection and incident response system for the upper layers.