# A Survey on Recent Advanced Research of CPS Security
## 4 Discussion
### Architecture Layers
#### 4.1.3 Application Layer  
The application layer is the most comprehensive and interactive layer. It receives data from the network layer and utilizes them to support the required applications. In this process, the most important thing is to ensure the data's credibility, which requires effective authentication methods. As the participants and privileges in the IoT are more complex than ever, we also require access control schemes to protect systems. Vulnerabilities in applications must be found and repaired in time. Moreover, trusted computing in CPS is also an essential research field.  
(1) Authentication: The main task of authentication is to verify the identity of users or devices. In CPS, more complicated factors are needed to verify an object. In the latest studies, users' movements [39], proofs of nonabsence [23], and modular attestation [24] are all considered attestation factors. More authentication methods can be used in CPS, but they also provide a broader attack surface for attackers. With the wide use of biometric identification, an attacker can leverage a target user's pictures to create 3D facial models and trick camera-based authentication systems [40].  
(2) Access Control: Access control is widely used in security management to stop unauthorized users and formulate policies for granting privileges. The two most prominent scenes on access control are cloud services and mobile apps. More devices can handle computing and data storage missions to cloud services. To check their security issues, researchers have studies access control models in remote binding [68], IFTTT (if this then that) services [65], and resource sharing [67]. As more vendors develop mobile apps to control their devices, the access control issues in these apps are also worthy of attention. The design of apps should follow the principle of least privilege [43], and applicationcodes should be divided into sensitive and nonsensitive modules [44] to block undeclared flows. To support fine-grained context identification, researchers can track an app's data flows [45], even across multiple devices and apps [46].  
(3) Vulnerability Analysis: To find vulnerabilities in CPS devices, we can learn technology from traditional software analysis, but the approach faces new challenges. Traditional analysis techniques, such as fuzzing [50; 137; 138], similarity detection [142], and control flow analysis [141; 142], are still efficient in discovering unknown firmware bugs. Nevertheless, the various instruction sets and CPU architectures present new challenges. To solve this problem, researchers have developed effective reverse tools for mobile apps [58], PLC binary tools [93], and firmware binary tools [26; 112] to identify processing logic. Additionally, a simulation environment [92; 164] was also implemented for real-time networks and instruction simulations.  
(4) Trusted Computing: In a real CPS environment, it is impossible to repair every device and block all attacks. In fact, some devices are no longer supported by vendors, as they have exceeded the service life. Therefore, we need trust computation to minimize the impact of a partially damaged system. Through security and isolation architecture, we can protect the data even when the host OS is compromised [27; 149]. For each node in CPS, managers can judge their credibility through the experience-reputation model [60], game theory [72], or the trust assessment module [146]. Moreover, trusted computing could also recover faulty IoT devices in an untrusted environment [73] or even when attackers have control of all devices [147].