CAREER: A Holistic Context-based Approach for Security and Privacy in the Era of Ubiquitous Sensing and Computing

智能手机、可穿戴设备和物联网（IoT）等无处不在的传感和计算设备的惊人增长，催生了令人兴奋的新应用，显著改善了我们公民的健康、健康、安全和生活质量。然而，这些设备上的传感器和执行器也可能被利用来推断用户的敏感信息，或危及用户的安全和网络安全。传感器硬件、云和软件（包括机器学习）技术的持续进步导致了当前访问控制模型和保护机制无法解决的新威胁的出现。现有保护机制的一个关键缺点是它们不能跨不同类型的传感器、应用程序和容纳这些传感器和应用程序的自主设备工作。由于这些设备上的应用程序以孤立的方式运行，它们通常不知道有关用户的整体上下文信息，这通常会导致严重的隐私威胁。该项目开发了一种新方法，可以在多个操作级别上暴露和利用用户上下文，以防止移动和物联网应用中不协调和不规范的传感和驱动。该项目的教育议程是在移动和物联网安全方面开发一个整合良好的实践课程，并通过以社区为中心的教育夏令营、课程和培训计划，将课程展示给具有不同技能水平和背景的各种学生和从业者，包括德克萨斯州圣安东尼奥地区的高中生、教师、该项目计划在现代无处不在的传感和计算环境中发现新的安全和隐私风险，包括功能异构和隔离的传感器和应用程序，并评估其在实际环境中的可行性。为了实现应用程序对传感器的安全和隐私保护访问，该项目将设计一个新的框架，在设备和网络级别上公开和利用用户的上下文信息，以实现细粒度和用户批准的访问控制。第一种设计称为ConWare，它将通过在这些上下文之间定义用户批准的访问绑定，以及在这些上下文中该设备上允许的感知操作集，在设备级利用暴露的用户上下文。第二种设计称为ConWareNet，它将利用通信网络级别上暴露的用户上下文，使用类似的用户批准绑定或策略，在一组自主设备上管理应用程序。该项目还将解决防止滥用暴露环境的问题，并将设计适应机制，使这些框架在动态传感和驱动环境中自我调整。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The phenomenal growth of ubiquitous sensing and computing devices such as smartphones, wearables and Internet-of-Things (IoT) enable exciting new applications that significantly improve the health, wellness, security and quality of life of our citizens. Sensors and actuators on-board these devices, however, can also be exploited to infer sensitive information about users or to compromise their safety and cyber security. Continued progress in sensor hardware, cloud and software (including, machine learning) technologies have caused new threats to emerge which current access control models and protection mechanisms are unable to address. One critical shortcoming of existing protection mechanisms is that they do not work across different types of sensors, applications and autonomous devices housing these sensors and applications. As applications on these devices operate in an isolated fashion, they are generally unaware of the holistic contextual information about users, often resulting in grave privacy threats. This project develops a new approach to expose and harness user context at multiple operational levels to protect against uncoordinated and unregulated sensing and actuation in mobile and IoT applications. The project's educational agenda is to develop a well-integrated and hands-on curriculum in mobile and IoT security and through community-focused educational summer camps, courses and training initiatives expose the curriculum to a diverse set of students and practitioners with varying skill-levels and backgrounds including San Antonio, TX area high school students, teachers, soldiers and veteransThe project plans to uncover new security and privacy risks in modern ubiquitous sensing and computing environments comprising of functionally heterogeneous and isolated sensors and applications and evaluate their feasibility in practical settings. To enable secure and privacy-preserving sensor access by applications, the project will design a novel framework that exposes and harnesses contextual information about users both at the device and network levels for achieving fine-grained and user-approved access control. The first design, called ConWare, will harness the exposed user context at the device level by defining user-approved access bindings between these contexts and the set of allowable sensing actions on that device within those contexts. The second design, called ConWareNet, will harness the exposed user context at the communication network level to regulate applications across an autonomous set of devices using similar user-approved bindings or policies. The project will also address the issue of preventing misuse of the exposed context and will design adaptation mechanisms for these frameworks to self-adjust in a dynamic sensing and actuation environment.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.