Transparent and Decentralized Security Framework for the Internet of Things

透明且去中心化的物联网安全框架

• 批准号: RGPIN-2020-07063
• 负责人: AlTawy, Riham
• 金额: $ 2.04万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2020
• 资助国家: 加拿大
• 起止时间: 2020-01-01 至 2021-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=718669
• 关键词: Transparent; Decentralized; Security; Framework; Internet

This research program aims to empower IoT users by providing a decentralized and transparent (minimal dependency on trusted third parties) security infrastructure for the majority of their IoT devices. Such devices have already outnumbered the world's population and a compounded growth of 20% is expected each year. IoT devices vary drastically in their physical and cyber resources, communication protocols and application domains which render the adoption of the common “one fits all” security solution unfeasible. This fact has been confirmed by the 600% increase in the number of attacks on IoT in the last two years [2]. Our program will build a generalized blockchain-like network for IoT devices. In doing so, we will leverage the blockchain's decentralization, pseudonymity, trust, autonomy, and strong cryptographic guarantees to provide security solutions for IoT. However, current blockchain models are not adequate to provide the required security for IoT. Particularly, they lack efficient consensus protocols which translates into slow response time to IoT devices requests. Blockchains also require public key infrastructure for authentication which is computationally expensive and will be eventually insecure in the presence of large-scale quantum computers. Furthermore, blockchains provide no communication privacy/confidentiality which is counterintuitive to the privacy goals of IoT. Accordingly, the following two streams of inquiry will tackle two of the challenges that hinder the direct adoption of current blockchain models in a computationally and communicationally diversified IoT. 1. Developing efficient and quantum resilient digital signature schemes with strong security assumptions. Specifically, we will explore the literature on hash functions, Merkle trees, and error correcting codes to build stateless hash-based signatures with small signature size. 2. Exploiting the literature on Lattice cryptographic constructions, we will build one shot zero-knowledge proofs and utilize them in developing smart contract-oriented privacy preserving protocols for IoT applications. The novelty of this program lies in the redesigning of an extensively analysed infrastructure (blockchains) to develop solutions to one of the top global challenges in cybersecurity, i.e., security and privacy of IoT. The work under this DG will be extended by partnerships for applications deployment in several market sectors including but not limited to supply chain management and smart homes. It also has a positive impact on the Canadian economy which according to the Canadian Chamber of Commerce 2017 cybersecurity report, has suffered over $12 millions in losses as a result of IoT cyber attacks [24]. Overall, this program will provide a unique, interdisciplinary environment for budding researchers in the Canadian system, training technical leaders equipped to tackle the complex engineering and security challenges of the 21st century.

该研究计划旨在通过为大多数物联网设备提供分散且透明(对可信第三方的依赖最小)的安全基础设施来增强物联网用户的能力。这类设备的数量已经超过了世界人口，预计每年将以20%的复合增长率增长。物联网设备在其物理和网络资源、通信协议和应用领域方面存在巨大差异，这使得采用常见的“一刀切”的安全解决方案是不可行的。过去两年对物联网的攻击数量增加了600%，这证实了这一事实[2]。 我们的计划将为物联网设备构建一个泛化的区块链式网络。在这样做的过程中，我们将利用区块链的去中心化、假名、信任、自治性和强大的加密保证，为物联网提供安全解决方案。然而，目前的区块链模型不足以为物联网提供所需的安全。特别是，它们缺乏有效的共识协议，这意味着对物联网设备请求的响应时间较慢。区块链还需要公钥基础设施来进行身份验证，这在计算上很昂贵，而且在大规模量子计算机存在的情况下最终将是不安全的。此外，区块链不提供通信隐私/机密性，这与物联网的隐私目标背道而驰。因此，以下两个调查流将解决阻碍当前区块链模型在计算和通信多样化的物联网中直接采用的两个挑战。 1.提出了一种具有强安全性假设的高效量子弹性数字签名方案。具体地说，我们将探索有关哈希函数、Merkle树和纠错码的文献，以构建签名大小较小的基于无状态哈希的签名。 2.利用有关格子密码构造的文献，我们将构建一次零知识证明，并将其用于开发面向物联网应用的面向合同的智能隐私保护协议。 该计划的新颖性在于重新设计了经过广泛分析的基础设施(区块链)，以开发解决方案来应对网络安全中的顶级全球挑战之一，即物联网的安全和隐私。这一副秘书长的工作将通过在几个市场部门部署应用程序的伙伴关系来扩展，包括但不限于供应链管理和智能家居。它还对加拿大经济产生了积极影响，根据加拿大商会2017年网络安全报告，物联网网络攻击已造成超过1200万美元的损失[24]。 总体而言，该项目将为加拿大系统的初出茅庐的研究人员提供一个独特的跨学科环境，培训有能力应对21世纪复杂工程和安全挑战的技术领导者。