Architecting Cyber-Physical Systems; a Multi-Objective Approach with Security as a Key Quality

This report shares the learnings of TNO-ESI and Vanderlande on architecting cyber-physical systems. It is the final result of the SecureArch project. The purpose of architecting is to generate system architecture alternatives, and select the most effective one(s), for guiding the design process in defining a solution that can be realised. Due to the interconnectedness of cyber-physical systems, security has become a key quality that must be considered in the selection process. The effectiveness of alternatives depends on (multiple) business goals and operational capabilities. The SecureArch project focused on automated parcel handling solutions. After performing a problem analysis with Vanderlande for this application domain, the overall problem statement was identified as follows: "How to create & evaluate alternative concepts and manage architectural design decisions, risks, and measures effectively, balancing security and other quality attributes?" Applied research was done on a methodology for creating and selecting alternatives (architectural tradeoffs), and performing security risk assessments. The risk assessment approach was evaluated for two cases, involving multiple stakeholders in workshops. The absence of a clear use case for a trade-off study prevented the validation of the complete methodology. Nevertheless, the methodology described is considered to be promising when dealing with uncertainty and need for a balance between multiple competing objectives. Key to the approach would be to ensure that:
- The objectives under consideration as selection criteria for alternatives, should be the same as the ones used for risk assessments;
- The objectives should be measurable, so dependencies between them become clear and allow for reasoning about competing and enforcing objectives;
- To save time and resources, (security) risk assessments should be applied to selected alternatives only.
To save communication time, increase efficiency and manage consistency and complexity it is recommended to further research a model-based approach, which will save time, resources, and ensures the completeness, promptness and accurateness of the trade-off. However, this capability will require appropriate competencies of the people involved and support from the organisation (processes, tooling, training, etc).