Transparent and Decentralized Security Framework for the Internet of Things

透明且去中心化的物联网安全框架

• 批准号: RGPIN-2020-07063
• 负责人: AlTawy, Riham
• 金额: $ 2.04万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2021
• 资助国家: 加拿大
• 起止时间: 2021-01-01 至 2022-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=741578
• 关键词: Transparent; Decentralized; Security; Framework; Internet

This research program aims to empower IoT users by providing a decentralized and transparent (minimal dependency on trusted third parties) security infrastructure for the majority of their IoT devices. Such devices have already outnumbered the world's population and a compounded growth of 20% is expected each year. IoT devices vary drastically in their physical and cyber resources, communication protocols and application domains which render the adoption of the common "one fits all" security solution unfeasible. This fact has been confirmed by the 600% increase in the number of attacks on IoT in the last two years [2]. Our program will build a generalized blockchain-like network for IoT devices. In doing so, we will leverage the blockchain's decentralization, pseudonymity, trust, autonomy, and strong cryptographic guarantees to provide security solutions for IoT. However, current blockchain models are not adequate to provide the required security for IoT. Particularly, they lack efficient consensus protocols which translates into slow response time to IoT devices requests. Blockchains also require public key infrastructure for authentication which is computationally expensive and will be eventually insecure in the presence of large-scale quantum computers. Furthermore, blockchains provide no communication privacy/confidentiality which is counterintuitive to the privacy goals of IoT. Accordingly, the following two streams of inquiry will tackle two of the challenges that hinder the direct adoption of current blockchain models in a computationally and communicationally diversified IoT. 1. Developing efficient and quantum resilient digital signature schemes with strong security assumptions. Specifically, we will explore the literature on hash functions, Merkle trees, and error correcting codes to build stateless hash-based signatures with small signature size. 2. Exploiting the literature on Lattice cryptographic constructions, we will build one shot zero-knowledge proofs and utilize them in developing smart contract-oriented privacy preserving protocols for IoT applications. The novelty of this program lies in the redesigning of an extensively analysed infrastructure (blockchains) to develop solutions to one of the top global challenges in cybersecurity, i.e., security and privacy of IoT. The work under this DG will be extended by partnerships for applications deployment in several market sectors including but not limited to supply chain management and smart homes. It also has a positive impact on the Canadian economy which according to the Canadian Chamber of Commerce 2017 cybersecurity report, has suffered over $12 millions in losses as a result of IoT cyber attacks [24]. Overall, this program will provide a unique, interdisciplinary environment for budding researchers in the Canadian system, training technical leaders equipped to tackle the complex engineering and security challenges of the 21st century.

该研究计划旨在通过为大多数物联网设备提供分散和透明（对可信第三方的依赖最小）的安全基础设施来增强物联网用户的能力。这些设备的数量已经超过了世界人口，预计每年将以20%的复合增长率增长。物联网设备在其物理和网络资源、通信协议和应用领域方面存在巨大差异，这使得采用通用的“一刀切”安全解决方案变得不可行。这一事实已经被过去两年中物联网攻击数量增加600%所证实[2]。 我们的计划将为物联网设备构建一个通用的区块链网络。在这样做的过程中，我们将利用区块链的去中心化、匿名性、信任、自治性和强大的加密保证，为物联网提供安全解决方案。然而，目前的区块链模型不足以为物联网提供所需的安全性。特别是，它们缺乏有效的共识协议，这导致物联网设备请求的响应时间缓慢。区块链还需要公钥基础设施来进行身份验证，这在计算上是昂贵的，并且在大规模量子计算机的存在下最终将是不安全的。此外，区块链不提供通信隐私/保密性，这与物联网的隐私目标是背道而驰的。因此，以下两个调查流将解决阻碍在计算和通信多样化的物联网中直接采用当前区块链模型的两个挑战。 1.在强安全性假设下开发高效的量子弹性数字签名方案。具体来说，我们将探讨散列函数，Merkle树和纠错码的文献，以构建具有小签名大小的无状态基于散列的签名。2.利用Lattice加密构造的文献，我们将构建一次性零知识证明，并将其用于开发面向智能合约的物联网应用隐私保护协议。该计划的新奇在于重新设计了一个经过广泛分析的基础设施（区块链），以开发解决方案，以应对网络安全领域的全球最大挑战之一，即：物联网的安全和隐私。该DG下的工作将通过在多个市场领域部署应用程序的合作伙伴关系来扩展，包括但不限于供应链管理和智能家居。它还对加拿大经济产生了积极影响，根据加拿大商会2017年网络安全报告，物联网网络攻击已造成超过1200万美元的损失[24]。总体而言，该计划将为加拿大系统中的新兴研究人员提供一个独特的跨学科环境，培训技术领导者，以应对21世纪世纪复杂的工程和安全挑战。