Security and Privacy in the Internet of Things

物联网中的安全和隐私

• 批准号: RGPIN-2018-04468
• 负责人: Barrera, David
• 金额: $ 0.05万
• 依托单位: École Polytechnique de Montréal
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2019
• 资助国家: 加拿大
• 起止时间: 2019-01-01 至 2020-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=670065
• 关键词: Security; Privacy; Internet; Things

The Internet of Things (IoT) era has brought forth incredible innovation. Adding Internet connectivity to small, task-specific devices ("things") has created new ways to integrate sensors and devices, and enabled new applications in the connected home. With IoT devices, users can configure their lights to automatically dim when a movie is playing, set home surveillance cameras to record when a motion sensor is triggered, call the fire department when smoke is detected, and many other applications. However, as these devices pervade users' lives, new concerns are raised about the security and privacy of data they collect, as well as the influence they may have on users' environments.***Despite having great access to data and users' lives, many current devices remain unsecured. Issues such as access control, authentication, secure data transmission, and software updates are poorly supported. These issues are compounded by the lack of transparency in hardware and software, as well as the tight constraints on form factor. The inability to monitor the underlying software on IoT devices makes it difficult to know what data is being recorded, stored, or sent to the cloud. For example, an ambient noise monitor that reports aggregate environmental acoustic measurements should not record full conversations, yet it is difficult to known with certainty if the monitor is indeed behaving as expected. ***This research program will design, develop, and evaluate software and methods to protect IoT devices from security and privacy threats. My research group will propose technical mechanisms to secure IoT devices and the networks in which they operate. We will create tools that give users transparency and control over the behaviour of IoT devices in their homes and enterprise networks. We will design new architectures, libraries, and design patterns that facilitate the development of new IoT devices that are secure by default. Our program will explore strategies for securely updating and maintaining devices that are no longer supported by vendors. In the long term, as IoT devices gain wide area network connectivity, we will extend and optimize our tools to support city-scale IoT networks. ***In parallel to these projects, we will seek collaboration with IoT software and hardware manufacturers across Canada. Our goal will be to work closely with these partners to gain a clear understanding of the challenges they face in designing and maintaining secure devices. We expect that partnering with IoT manufacturers will allow us to test our proposed solutions on real networks, and help tailor our research objectives to maximize real-world impact.

物联网（IoT）时代带来了令人难以置信的创新。将互联网连接添加到小型的特定任务设备（“事物”）中，创造了集成传感器和设备的新方法，并在互联家庭中启用了新的应用程序。使用物联网设备，用户可以将灯光配置为在播放电影时自动调暗，设置家庭监控摄像头以记录运动传感器被触发时的情况，在检测到烟雾时呼叫消防部门，以及许多其他应用。然而，随着这些设备渗透到用户的生活中，人们对它们收集的数据的安全性和隐私性以及它们可能对用户环境产生的影响提出了新的担忧。尽管可以很好地访问数据和用户的生活，但许多当前的设备仍然不安全。对访问控制、身份验证、安全数据传输和软件更新等问题的支持很差。这些问题由于硬件和软件缺乏透明度以及对形状因素的严格限制而变得更加复杂。由于无法监控物联网设备上的底层软件，因此很难知道哪些数据正在被记录、存储或发送到云端。例如，报告聚集环境声学测量结果的环境噪声监测器不应记录完整的对话，但是很难确定地知道监测器是否确实如预期那样工作。* 该研究计划将设计，开发和评估软件和方法，以保护物联网设备免受安全和隐私威胁。我的研究小组将提出技术机制来保护物联网设备及其运行的网络。我们将创建工具，使用户能够透明地控制其家庭和企业网络中物联网设备的行为。我们将设计新的架构、库和设计模式，以促进默认安全的新物联网设备的开发。我们的计划将探索安全更新和维护供应商不再支持的设备的策略。从长远来看，随着物联网设备获得广域网连接，我们将扩展和优化我们的工具，以支持城市规模的物联网网络。* 在开展这些项目的同时，我们将寻求与加拿大各地的物联网软件和硬件制造商合作。我们的目标是与这些合作伙伴密切合作，以清楚地了解他们在设计和维护安全设备时所面临的挑战。我们希望与物联网制造商合作将使我们能够在真实的网络上测试我们提出的解决方案，并帮助定制我们的研究目标，以最大限度地发挥现实世界的影响。