11.1 The need for authenticity and integrity
Imagine Alice being a control computer in a train control system and Bob being a board computer installed within a train. For a more realistic scenario, let’s assume the train control system is a positive train control. This means that the train is only allowed to move if it receives an explicit move message from the train control. Otherwise, the train does not move.
Further, assume that there are two different move messages that onboard computer Bob can receive from control computer Alice:
Message ms instructing the train to move slowly, for example, before entering a train station
Message mf instructing the train to move fast
In addition, to secure the train control against cyberattacks, the communication channel between Alice and Bob is protected using a cryptographic mechanism that provides confidentiality only. That is, Alice and Bob share a secret key k and can compute an encryption function ek to make their communication unintelligible...
