Security Analysis and Evaluation of Emerging Smart Systems

智能技术的快速发展导致了一个自动化的新时代，市场上有许多智能设备。智能手机是智能设备中最突出的例子，目前有超过33亿用户在使用。其他突出的智能设备包括智能家居系统，从小型传感器到大型数字设备，智能可穿戴设备和自动导航系统。根据Statista[2]的数据，加拿大的智能家居渗透率在2019年达到19.8%，预计到2023年将达到38.7%。这些系统结合了感知、智能和控制，以分析情况并做出决定。智能系统的核心通常是轻量级但计算能力强大的移动系统（例如，Android、iOS或紧凑的框架）。最近人工智能在智能应用（如语音识别和主体检测）以及其他固有功能（如丰富的传感器和无处不在的连接）方面的进展，使移动操作系统成为智能设备的理想平台。随着恶意攻击变得越来越复杂，智能系统处于下一个风险前沿。与传统系统存在安全漏洞一样，智能设备的各个部件也存在访问控制漏洞。这些漏洞可能导致毁灭性的网络和物理后果，例如敏感信息泄露，财务损失（例如，通过错误配置智能调制解调器路由器b[3]窃取银行凭证），甚至安全问题（例如，可穿戴设备的生命体征测量损坏）。我们的长期愿景是创造和开发创新和原创的自动工具，用于检测智能设备和技术中的漏洞，并为评估和综合此类系统的保护规范创建系统解决方案。智能生态系统展示了许多特性，这些特性本质上给安全社区部署现有的安全评估工具带来了挑战。我们的研究将解决建模、评估和加强智能设备供应商使用的访问控制功能的挑战，以保护生态系统不同层的敏感资源。除了推进最先进的科学知识之外，我们还计划将我们的工具提供给智能设备供应商，当智能框架中发现漏洞时，他们会受到越来越多的指责，甚至失去信任。

The rapid progress of smart technologies has led to a new era of automation, with numerous smart devices on the market. Smartphones, the most prominent example of smart devices, are being used by more than 3.3 billion users [1]. Other prominent smart devices include smart-home systems ranging from small sensors to large digital appliances, smart wearables, and auto-guidance systems. According to Statista [2], the smart home household penetration in Canada has reached 19.8% in 2019 and is expected to hit 38.7% by 2023. These systems combine sensing, intelligence, and control in order to analyze a situation and make a decision. At the core of smart systems often lies a lightweight, yet computationally powerful mobile system (e.g., Android, iOS, or a compact framework). Recent AI advances in intelligent apps (e.g., voice recognition and subject detection) along with other inherent features (e.g., abundant sensors and ubiquitous connectivity), make mobile operating systems an ideal platform for smart devices. With malicious attacks becoming more sophisticated, smart systems are on the next frontier of risk. Just like traditional systems carry security flaws, smart device contain access control flaws in various components. These flaws can lead to devastating cyber and physical consequences, such as sensitive-information leakage, financial loss (e.g., stealing banking credentials through misconfiguring smart modem routers [3]), and even safety issues (e.g., corrupt vital sign measurements in wearables). Our long-term vision is to create and develop innovative and original automatic tools for detecting vulnerabilities in smart devices and technologies, and to create systematic solutions for evaluating and synthesizing protection specifications for such systems. The smart ecosystem exhibits many features that inherently pose challenges for deploying existing security evaluation tools from the security community. Our research will address challenges in modeling, evaluating and strengthening access-control features used by smart device vendors to protect sensitive resources at different layers of the ecosystem. In addition to advancing the state of the art scientific knowledge, we plan to make our tools available to smart device vendors, who are at the forefront of suffering from increasing blame and even diminishing trust when a vulnerability is uncovered in the smart frameworks.