# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### Access Control  
Access control systems help ensure that the right people have access to the right places at the right times. In CPS scenarios, the focuses are control apps, underlying sensors, cloud servers, and remote blinding. Apart from security policies, researchers also leverage technologies (such as hardware-based trustworthy computing, taint analysis, and flow tracking) to achieve effective access control. SmartAutth [38] is a user-centric, semantic-based authorization framework. First, it gathers security-sensitive information from the source code or annotations of IoT control apps and uses NLP and program analysis techniques to extract the security policy from these descriptions. Then, SmartAuth shows the required privileges to the user and requests authorization through a user-friendly interface, which can help to verify the current behavior with what the app claims to do. The authors evaluate SmartAuth on 180 available SmartApps and find that it can detect overprivileged apps with minimal performance overhead. [PERSON] et al. [43] introduced a situational access control method in an IoT system. They introduced \"environmental situation oracles\"(ESOs), which are independent middleware between underlying sensors and access-control policies. The ESO design obeys the principle of least privilege, as ESOs cannot access the implementation details but only the abstract predicate (e.g., \"at home or outsider\"). Moreover, different ESOs provide the same API for clients, so they can be substituted directly to suit different policies. SRM [16] is a secure remote monitoring framework that provides fine-grained control and privacy protection with hardware-based trustworthy computing technology (e.g., Intel SGX). To defend a packet-drop attack from an untrusted cloud server, SRM presents a lightweight \"heartbeat\" protocol. This protocol repeats previous entrusted key materials in the enclave if a valid heartbeat is missed in the defined time window. The authors implemented a prototype of SRM and tested it on an SGX enabled Intel platform, and the results show that it is feasible in practice and supports efficient access control over monitoring services. [PERSON] et al. [68] studied the security challenges in IoT remote blinding. They used a state-machine model to evaluate ten real-world remote binding cases. Then, they found many questionable designs, such as in usage of static device identifiers, weak device credentials, and weak cloud-side access control. These issues can lead to sensitive data leakage/injection, binding occupation, connection breaking, or even device hijacking. They also propose some mitigation solutions, such as the use dynamic device IDs, giving revoking permission to an individual who is already connected to the device and never delivering sensitive information during remote blinding. FlowFence [44] is an access control framework that controls the flow between sources and sinks. It splits application codes into two modules: sensitive and nonsensitive. This framework adds extra data flows in the app structure, which can help apps deny undeclared \begin{table}
\begin{tabular}{c c c c} \hline Access Control Section 3.1 & Authentication Section 3.2 & Attestation Section 3.3 & Trusted Computing Section 3.4 \\ \hline Security Strategy Section 3.5 & Fuzzing Section 3.6 & Botnet Section 3.7 & Firmware Analysis Section 3.8 \\ \hline Apps Analysis Section 3.9 & Audit Framework Section 3.10 & Reverse Engineering Section 3.11 & Fingerprinting Section 3.12 \\ \hline Anomaly Detection Section 3.13 & Intrusion Detection Section 3.14 & Overprivileged Permission Detection Section 3.15 & Lightweight Cryptography Section 3.16 \\ \hline Memory Protection Section 3.17 & Software Security Section 3.18 & Protocol Security Section 3.19 & Pairing Security Section 3.20 \\ \hline New Attacks Section 3.21 & Data Privacy Section 3.22 & Blockchain Section 3.23 & Novel Defense Section 3.24 \\ \hline \end{tabular}
\end{table} 
Table 2: List of 24 subcategories. flows, including implicit flows.