Our colleagues Carlos Blanco, David G. Rosado and Eduardo Fernández-Medina of the GSYA group along with Ángel Jesús Varela-Vaca and María Teresa Gómez Lopez of the IDEAS group of the University of Seville have published the article “Onto-CARMEN: Ontology-driven approach for Cyber–Physical System Security Requirements meta-modelling and reasoning”, in the journal Internet of Things (IF 5.9, Q1). DOI: https://doi.org/10.1016/j.iot.2023.100989. The article is accessible under an Open Access license.

Abstract

In recent years, Cyber–physical systems (CPS) have attracted substantial mainstream, especially in the industrial sector, since they have become the focus of cyber-attacks. CPS are complex systems that encompass a great variety of hardware and software components with a countless number of configurations and features. For this reason, the construction, validation, and diagnosis of security in CPS become a major challenge. An invalid security requirement for the CPS can produce partial or incomplete configuration, even misconfigurations, and hence catastrophic consequences. Therefore, it is crucial to ensure the validation of the security requirements specification from the earlier design stages. To this end, Onto-CARMEN is proposed, a semantic approach that enables the automatic verification and diagnosis of security requirements according to the ENISA and OWASP recommendations. Our approach provides a mechanism for the specification of security requirements on top of ontologies, and automatic diagnosis through semantic axioms and SPARQL rules. The approach has been validated using security requirements from a real case study.