Cross-Device Security: Threats and Opportunities

跨设备安全是指同一用户拥有的两台设备之间存在安全关系，且其中一台设备的安全状态可以受到另一台设备的影响。例如，最近的笔记本电脑可以配置为，如果笔记本电脑检测到笔记本电脑所有者的智能手机（因此也可能是笔记本电脑所有者）在附近，就不再要求输入密码。在另一个例子中，许多物联网（IoT）设备都是用智能手机控制的。因此，成功攻击用户的智能手机也可能导致成功攻击用户的物联网设备。最后，在隐式认证中，设备通过收集有关所有者的行为数据，建立其所有者典型行为的分类模型。然后，设备使用此分类模型对用户进行持续身份验证。在跨设备安全性方面，一台设备可能会与用户的其他一些设备共享其分类模型，以便它们也可以使用隐式身份验证。拟议的研究将展示跨设备安全提供和提出的机会和威胁。这将通过结合移动传感、机器学习、移动系统开发和用户研究的解决方案来实现，为参与的学生提供跨学科的合作机会。该研究将沿着三个主要方向进行：1)跨设备传输身份验证决策。研究结果是能够将用户在一台设备上的身份验证状态安全地传输到同一用户的另一台设备上，从而避免用户必须手动向第二台设备进行身份验证。2)跨设备的隐式认证。研究成果是将一台设备根据其所有者的行为数据建立的分类模型转移到同一用户拥有的其他设备上，避免其他设备需要收集自己的行为数据并建立自己的分类模型。3)跨设备的安全依赖。如果攻击者获得设备（或设备收集的数据）的所有权，可以使用该设备（或数据）成功攻击同一用户的其他设备，则存在安全依赖关系。研究结果是告知用户这些依赖关系并建议补救措施。这项研究非常重要，因为期望用户单独管理每个设备的安全性是不现实的。此外，这项研究将使人们更容易安全地使用网络设备，使相关的生态系统受益，如设备制造商、应用程序开发商和通信网络提供商，从而使加拿大经济受益。学生将获得网络安全、物联网和应用机器学习方面的技能，因此他们将在多个行业中受到高度需求。

Cross-device security denotes the existence of a security relationship between two devices owned by the same user with the property that the security state of one device can be affected by the other device. For example, recent laptops can be configured to no longer ask for a password if the laptop detects that the smartphone of the laptop owner and thereby likely also the laptop owner are nearby. In another example, many Internet of Things (IoT) devices are controlled with a smartphone. Therefore, a successful attack on a user's smartphone may also lead to successful attacks on the user's IoT devices. Finally, in implicit authentication, a device establishes a classification model of its owner's typical behaviour by collecting behavioural data about the owner. The device then uses this classification model for continuously authenticating the user. In terms of cross-device security, a device may share its classification model with some of the user's other devices so that they can also use implicit authentication. The proposed research will demonstrate the opportunities and threats offered and raised by cross-device security. This will be achieved through a combination of solutions from mobile sensing, machine learning, mobile systems development, and user studies, providing interdisciplinary collaboration opportunities to the involved students. The research will proceed along three main thrusts: 1) Transfer of authentication decisions across devices. The research outcome is to enable the secure transfer of a user's authentication status on a device to another device of the same user to prevent the user from having to manually authenticate to the second device. 2) Implicit authentication across devices. The research outcome is to enable the transfer of the classification model built by a device based on its owner's behavioural data to other devices owned by the same user to prevent the other devices from having to collect their own behavioural data and build their own classification model. 3) Security dependencies across devices. A security dependency exists if an attacker taking ownership of a device (or of data gathered by the device) can use this device (or data) to successfully attack other devices of the same user. The research outcome is to inform users of these dependencies and to suggest remedies. The proposed research is important and significant because expecting users to manage security individually for each of their devices is unrealistic. Moreover, the research will make it easier for people to use networked devices securely, benefiting the associated ecosystem, such as device manufacturers, app developers, and communication network providers, and therefore the Canadian economy. Students will acquire skills in cybersecurity, IoT, and applied machine learning, so they will be in high demand across multiple industries.