Security Analysis and Evaluation of Emerging Smart Systems

点击翻译按钮获取中文摘要

The rapid progress of smart technologies has led to a new era of automation, with numerous smart devices on the market. Smartphones, the most prominent example of smart devices, are being used by more than 3.3 billion users [1]. Other prominent smart devices include smart-home systems ranging from small sensors to large digital appliances, smart wearables, and auto-guidance systems. According to Statista [2], the smart home household penetration in Canada has reached 19.8% in 2019 and is expected to hit 38.7% by 2023. These systems combine sensing, intelligence, and control in order to analyze a situation and make a decision. At the core of smart systems often lies a lightweight, yet computationally powerful mobile system (e.g., Android, iOS, or a compact framework). Recent AI advances in intelligent apps (e.g., voice recognition and subject detection) along with other inherent features (e.g., abundant sensors and ubiquitous connectivity), make mobile operating systems an ideal platform for smart devices. With malicious attacks becoming more sophisticated, smart systems are on the next frontier of risk. Just like traditional systems carry security flaws, smart device contain access control flaws in various components. These flaws can lead to devastating cyber and physical consequences, such as sensitive-information leakage, financial loss (e.g., stealing banking credentials through misconfiguring smart modem routers [3]), and even safety issues (e.g., corrupt vital sign measurements in wearables). Our long-term vision is to create and develop innovative and original automatic tools for detecting vulnerabilities in smart devices and technologies, and to create systematic solutions for evaluating and synthesizing protection specifications for such systems. The smart ecosystem exhibits many features that inherently pose challenges for deploying existing security evaluation tools from the security community. Our research will address challenges in modeling, evaluating and strengthening access-control features used by smart device vendors to protect sensitive resources at different layers of the ecosystem. In addition to advancing the state of the art scientific knowledge, we plan to make our tools available to smart device vendors, who are at the forefront of suffering from increasing blame and even diminishing trust when a vulnerability is uncovered in the smart frameworks.