CRII: SaTC: Analyzing Information Leak in Smart Homes

随着物联网(IoT)的快速采用，我们面临着一个新的世界，在这个世界里，我们永远不会孤单。在任何时候，从智能手机到家庭助理再到运动探测器，大量的连接设备都在不断地感知和监控我们的活动。虽然这些设备为我们提供了便利，但它们通常有强大的分析支持，可以筛选大量的个人数据，有时是在我们不知情或未经我们同意的情况下收集的。这样的个人数据可以揭示我们自己的很多信息，比如我们的习惯和生活方式，这些信息不仅对广告商提供有针对性的广告具有巨大的商业价值，而且还可能被保险公司、专制政府和网络犯罪分子滥用。该项目的目标是为了解日常物联网设备泄露有关我们生活方式的敏感信息的不同方式奠定基础。这项拟议的工作将使整个社会受益，因为人们将更多地意识到与家用物联网设备相关的安全和隐私风险。该提案还可以帮助识别易受攻击的通信协议，并由此导致新的隐私增强协议的设计。此外，该项目将使本科生和研究生接触到尖端分析工具，并帮助开发一支具有全球竞争力的科学、技术、工程和数学工作队伍。该项目建议建立一个试验台，以分析家用物联网设备可以在多大程度上泄露关于我们自己的敏感信息。拟议的试验床将有助于沿着以下方向进行研究：i)帮助确定执行旁路攻击的可行性，以不仅推断家庭内部驻留有哪些设备，而且还推断用户可能正在执行哪些更高级别的活动，例如，推断用户是否正在使用Amazon Alexa打电话、打盹或在跑步机上锻炼；ii)帮助确定收集了哪些数据以及与谁共享这些数据；iii)帮助构建信息仪表板，以通知用户潜在的隐私风险。构建一个可以与各种设备交互的可扩展试验台将需要解决一系列与系统相关的挑战。数据分析将利用各种先进的统计、信号处理和机器学习技术。该项目将为新兴物联网设备带来的安全和隐私威胁提供亟需的洞察。这项拟议的工作不仅可以识别泄露敏感信息的设备，同时还可以促进新的隐私增强技术的设计。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

With the rapid adoption of the Internet of Things (IoT), we face a new world, where we are never alone. At all times, a plethora of connected devices, from smartphones to home assistants to motion detectors continuously sense and monitor our activities. While these devices provide us convenience, they are often backed by powerful analytics to sift through large volume of personal data, at times collected without our awareness or consent. Such personal data can reveal a lot about ourselves like our habits and lifestyles, which not only has great commercial value to advertisers to serve targeted ads, but can also be misused by insurance companies, repressive governments and cybercriminals. The goal of this project is to build a foundation for understanding the different ways in which every day Internet of Things devices can leak sensitive information about our lifestyles. The proposed work will benefit the society as a whole as people will become more aware of the security and privacy risks associated with household Internet of Things devices. The proposal can also help identify vulnerable communication protocols and consequentially lead to the design of new privacy-enhancing protocols. Furthermore, this project will expose both undergraduate and graduate students to cutting-edge analytic tools and help develop a globally competitive science, technology, engineering and mathematics workforce.This project proposes to build a testbed to analyze the extent to which household Internet of Things devices can leak sensitive information about ourselves. The proposed testbed will facilitate research along the following directions: i) help determine the feasibility of performing side-channel attacks to infer not only what devices reside inside a household, but also what higher order activities users may be performing, for example, inferring whether a user is making a call using Amazon Alexa or taking a nap, or working out on a treadmill; ii) help determine what data is collected and with whom it is shared; iii) help build an information dashboard to notify users about the potential privacy risks. Building a scalable testbed that can interact with a wide variety of devices will require addressing a host of systems related challenges. The data analysis will utilize a variety of advanced statistical, signal processing and machine learning techniques. This project will provide a much-needed insight into the security and privacy threats imposed by emerging Internet of Things devices. The proposed work can lead to not only identifying devices that leak sensitive information, but at the same time foster the design of new privacy-enhancing technologies.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.