# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### Authentication  
Authentication is the process of verifying whether someone (or something) is who (or what) it is declared to be. In CPS, the types and behaviors of users are very diverse. To solve this problem, researchers mainly enhance the security of authentication in protocols and mark users accurately through their behaviors.  
[PERSON] et al. [39] built a system, called Icelus, to locate users and model users' movements as an extra factor of authentication. Utilizing the many devices carried by users, this method overall considers a devices' location. It builds a model to identify the probability that a user is located in a particular location and is safer than models based on a user's credentials only. Experiments with several smart devices (smartphones and wearables) show that this method has a lower false-rejection rate than smartphone-based location-based authentication (LBA) and rejects illegal access with few errors.  
Current discovery protocols (e.g., Multicast DNS, Apple AirDrop, and Bluetooth Low Energy) do not consider much privacy control and often leak sensitive information. Hence, [PERSON] et al. [35] proposed two private service discovery and mutual authentication protocols. The protocols design key primitives to encrypt the communication between the sender and receiver for verifying identity, and they can protect clients from connecting to an impostor service. Deployed in the vanadium distributed application framework, the authors measured the protocol on multiple platforms (Intel Edison, Raspberry Pi, smartphones, laptops, and desktops), and the results show that the end-to-end latency overhead is acceptable compared to that of SIGMA-I.  
Virtual U [40] uses public photos of a target user to mislead 3D facial models and passes state-of-the-art face authentication. It uses VR devices to display a user's synthetic face and adds animations (e.g., blinking or smiling) to trick liveness detectors. The authors tested the proposed framework with 20 participants and on five face authentication systems. Only in two cases did all the systems withstand the attack.  
VulCAN [21] is a novel vehicle authentication protocol that uses lightweight trusted computing to authenticate the message and attest the software component. This guarantees that only a chain of processing events can trigger the critical actuator event. The authors also provided an extended application scenario that shows the security guarantees against attackers with arbitrary code execution abilities on participating ECUs.  
Physically unclonable functions (PUFs) are likely to be critical hardware primitive, as they can guarantee unique identities. [PERSON] et al. [130] adapt the idea combining double arbiter PUF, identity-based encryption (IBE), and keyed hash function to present a lightweight authentication and key exchange protocol. This identification protocol does not need to store the PUF response at the verifier clearly, so the main attack point in vulnerable verifiers cannot work. Utilizing the proposed protocol, the authors implement a secured video camera, which successfully resists the man-in-the-middle attack via IP spoofing.  
[PERSON] et al. [123] proposed Proof of Aliveness (PoA) to detect the survival of IoT devices. Assuming that attackers can forge aliveness proofs, they used one central authentication server with several clients and a hash chain (one-way function chains)-based authentication method to prevent replay attacks. Due to the limited length of one-way function (OWF) chains, the authors combined several OWF chains generated by a pseudorandom generator to build an efficient PoA. Moreover, they evaluated the PoA constructions on Raspberry Pis, and the proof generation time was approximately microseconds.