Threat Model: Diagnostic and Sensor Spoofing

Falsified diagnostics could deceive the control loop or the digital twin; integrity checks, sensor fusion, and independent safety sensing bound the damage.

Lie to the controller, not the plasma

A subtle attack does not command an actuator directly; it feeds the controller false measurements so the controller itself drives the machine wrong, or so a real fault is hidden from operators. Kronos treats diagnostics as an attack surface. The breeder's magnetics, interferometry, Thomson scattering, and neutron diagnostics, and the burner's field and end-loss diagnostics, all feed control and the twin, so their integrity is a safety concern.

Layered defenses

• Authenticated acquisition: diagnostic nodes hold identities and sign their data streams - see zero-trust identity.
• Physical-consistency checks: measurements must satisfy conservation laws and cross-diagnostic agreement, so a single spoofed channel is detectable.
• Sensor fusion / redundancy: independent diagnostics of the same quantity must agree within tolerance.
• Independent safety sensing: the SIS reads its own sensors, so spoofing the control diagnostics does not blind safety.
• Anomaly detection on the data itself - see OT anomaly detection.

Consistency as a detector

# Reject a channel that violates cross-diagnostic physics consistency
def diagnostic_ok(fused):
    # e.g. line-integrated density vs Thomson profile vs stored energy
    resid = physics_residual(fused)             # should be ~0 for real data
    if resid > policy.tolerance:
        flag_spoof_suspect(fused.channels)
        return False
    if disagreement(fused.redundant) > policy.redundant_tol:
        return False
    return True

Honest residual risk

A sophisticated attacker who compromises multiple independent diagnostics simultaneously and crafts physically consistent false data could still deceive control - but that requires defeating redundancy, physics consistency, and authenticated acquisition at once, and safety still reads separate sensors. Design status: consistency and fusion checks run against twin-generated and archival diagnostic data; live-plasma validation waits on FOAK.