CSR: Small: Surviving Cybersecurity and Privacy Threats in Wearable Mobile Cyber-Physical Systems

智能可穿戴设备，如智能手表，非常受欢迎，并迅速取代传统的非智能设备。通过各种高精度的车载传感器，这些设备可以捕获有关佩戴者及其环境的丰富上下文信息，从而实现几种新的有用应用。然而，这种多样化的机载传感器也提供了额外的攻击面。对这些传感器的访问，如果没有适当的控制，可以被热衷于获取属于佩戴者的私人和敏感信息的对手用作侧通道。此外，这些可穿戴设备传感器的主动误用检测和抵抗并不简单。目前，人们对可穿戴设备可能导致的各种侧信道安全漏洞缺乏了解，迫切需要研究持续防范这些漏洞的方法。本课题的研究正好解决了这个问题。本研究的目标是双重的：首先，证明可穿戴设备能够实现新的侧信道安全和隐私威胁，其次，设计连续身份验证技术和自适应访问控制机制来应对这些威胁。具体而言，本研究将评估使用未受保护的传感器作为侧信道的可穿戴设备中的私人数据推断和佩戴者跟踪威胁。这将通过设计适当的基于学习的分类和预测机制来实现，攻击者可以使用这些机制来推断敏感数据。在保护方面，该项目将开发一个多传感器活动和身份分类框架。该框架将利用丰富的上下文传感器数据（例如，细粒度运动，应用程序使用和关键身体参数）来实现合法佩戴者及其活动的持续识别和认证。通过研究不同用户群体的安全和隐私偏好，本研究将为这种新的可穿戴设备范式开发可用的基于活动的访问控制工具。该项目的一个重要研究重点是开发自适应数据共享机制，根据佩戴者的安全偏好、当前环境和感知到的威胁，动态调节对传感器数据的访问。这种机制将作为提供完全访问（没有安全性）和为每个访问（可用性差）做出手动决策之间的一个很好的中间地带。该项目涉及行业合作者，以促进将研究成果应用于可穿戴设备的未来设计和开发。研究结果，包括概念证明应用，将公开提供，以便传播、早期工业采用和与课程结合。

Smart wearable devices, such as smart watches, are very popular and fast replacing their traditional non-smart counterparts. By means of various high-precision on-board sensors, these devices capture rich contextual information about the wearer and his environment to enable several new and useful applications. However, this diverse set of on-board sensors also provides an additional attack surface. Access to these sensors, if not controlled appropriately, can be used as a side-channel by an adversary keen on obtaining private and sensitive information belonging to the wearer. Moreover, active misuse detection and resistance of these wearable device sensors is not straightforward. There is currently a lack of understanding of the various side-channel security vulnerabilities that are possible due to wearable devices and there is an urgent need to study the means for continuously protecting against them. The research in this project addresses this very timely topic.The goal of this research is twofold: first, to demonstrate that wearable devices enable novel side-channel security and privacy threats, and second, to design continuous authentication techniques and adaptive access control mechanisms to survive these threats. Specifically, this research will evaluate private data inference and wearer tracking threats in wearable devices that utilize unprotected sensors as side-channels. This will be accomplished by designing appropriate learning-based classification and prediction mechanisms that can be used by an adversary for inferring sensitive data. On the protection front, this project will develop a multi-sensor activity and identity classification framework. This framework will leverage rich contextual sensor data (e.g., fine-grained movements, application usage and critical body parameters) to enable continuous identification and authentication of legitimate wearers and their activities. By studying security and privacy preferences of a diverse population of users, this research will develop usable activity-based access control tools for this new wearable device paradigm. A significant research thrust of this project is to develop adaptive data-sharing mechanisms for dynamically regulating access to sensor data based on the wearers' security preferences, current context and perceived threats. Such mechanisms will serve as a good middle-ground between giving full access (no security) and making manual decisions for each access (poor usability). This project involves industry collaborators to facilitate adoption of research outcomes into the future design and development of wearable devices. Research results, including proof-of-concept applications, will be publicly available to allow dissemination, early industry adoption and integration with curricula.