CPS: Synergy: Collaborative Research: Support for Security and Safety of Programmable IoT Systems

这项工作研究如何在物联网(IoT)系统中获得安全和保障，在物联网系统中，多个设备(物)被集中在一起，通过一个或多个软件应用程序(APP)控制，每个设备(物)都是独立设计的。物联网环境中的“东西”可以包括简单的设备，如开关、灯泡、智能锁、恒温器和安全警报，以及复杂的系统，如家电、智能手机和汽车。软件物联网应用程序可以监控家庭、汽车、城市和企业中的多个设备，提供节能、安全、安全和用户便利等显著好处。不幸的是，可编程物联网系统也带来了新的风险，包括允许黑客通过有漏洞的物联网应用程序远程控制智能家居、汽车和城市中的设备。测试物联网应用程序以消除漏洞目前具有挑战性，因为此类应用程序可能与各种物理设备交互，包括甚至在应用程序开发期间不可用的设备。这项拟议的工作将有助于开发有效测试物联网应用程序并对其运行时行为实施安全和安全约束的技术。更具体地说，拟议的工作围绕三个技术主题：1)创建虚拟设备模型，以帮助高效地系统地测试物联网应用程序，而无需知道应用程序将预先控制的物理设备的准确细节；2)自动化物联网应用程序的测试开发，以针对灵活的设备集检查安全和安全规范；以及3)支持在运行时强制执行安全和安全断言规范。这项工作包括使用不同的设备进行广泛的实验和评估，并将在加固这些重要空间方面取得重大进展

This work examines how to get safety and security in Internet of Things (IoT) systems where multiple devices (things), each designed in isolation from others, are brought together to form a networked system, controlled via one or more software applications ("apps"). "Things" in an IoT environment can include simple devices such as switches, lightbulbs, smart locks, thermostats, and safety alarms as well as complex systems such as appliances, smartphones, and cars. Software IoT "apps" can monitor and control multiple devices in homes, cars, cities, and businesses, providing significant benefits such as energy efficiency, security, safety, and user convenience. Unfortunately, programmable IoT systems also introduce new risks, including enabling remote control by hackers of devices in smart homes, cars, and cities, via buggy IoT apps. Testing IoT apps to remove bugs is currently challenging due to a variety of physical devices with which such apps may interact, including devices that were not even available during app development. The proposed work will help develop techniques for testing IoT apps efficiently and for enforcing safety and security constraints on their run-time behavior.More specifically, the proposed work is centered around three technical thrusts: 1) creating virtual device models to help efficiently test IoT apps systematically without knowing the precise details of physical devices that the apps will control in advance; 2) automating test development for an IoT app to check safety and security specifications against a flexible set of devices; and 3) providing support for enforcement of specifications at run-time for security and safety assertions. The work includes extensive experimentation and evaluation using diverse devices and will represent a significant advance in hardening this important spaces