Collaborative Research: CNS Core: Small: Retrofitting IoT Ecosystems with a Software-defined Overlay to Enforce Safety, Security, and Privacy Policies

物联网（IoT）领域的最新进展通过引入可编程物联网平台来满足其不同的业务需求，极大地改变了许多重要行业（例如制造业、医疗保健、智能家居）。这种可编程平台使用户可以通过安装各种本地和第三方自动化应用程序，将低功耗物联网设备集合在一起，自动执行手头的定制任务。不幸的是，许多现有的可编程物联网平台没有提供足够的内置安全措施（例如，细粒度的访问控制）来阻止不当行为（流氓/故障）应用程序的风险。因此，行为不当的应用程序可以不受限制地访问设备，从而将物联网系统过渡到不受欢迎和/或不安全的状态。这可能导致经济损失、致命后果或环境灾难。该项目侧重于通过防止本地和第三方应用程序管理物联网设备上的意外操作来保护物联网系统免受此类威胁。该项目开发了一个平台无关的解决方案，它有可能大大提高现有可编程物联网系统的整体安全性、隐私性和安全性。本项目开发的基础技术也适用于各种网络系统（例如，任务/安全关键系统）。为了开发有效的解决方案，该合作研究项目依赖于这样一种见解，即物联网系统的不良状态转换可以被视为违反系统所需的状态不变量或策略。系统应遵守这些政策，以确保其安全性、安全性和隐私保障。本研究的核心目标是创建一个策略导向的防御机制，通过在运行时动态执行用户定义的策略，防止物联网系统进入不希望的状态，即使在存在行为不当的应用程序的情况下。这个项目通过三个研究重点来实现项目的目标。第一个重点是设计一种统一的、富有表现力的策略语言，以捕获用户定义的富状态策略，这些策略将规定系统的预期行为。第二个重点是开发一个软件定义的覆盖层，它不仅可以推广通过多种网络技术连接的异构物联网设备，还可以实现与平台无关的策略执行方法。第三个推力设计了必要的技术，以实现现实世界物联网生态系统（例如，智能家居，工业控制系统）的前两个推力的高级基础开发。为了培养有竞争力的网络安全劳动力，本项目中开发的理论和原型用于教育本科生和研究生在构建实用、安全和有弹性的系统时的内在设计权衡。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The recent advancement in the Internet-of-Things (IoT) domain has substantially transformed many important sectors (e.g., manufacturing, healthcare, smart-home) by introducing programmable IoT platforms to fulfill their varying business needs. Such programmable platforms facilitate a user to bring together a collection of low-powered IoT devices to automatically carry out customized tasks at hand by installing various native and third-party automation apps. Unfortunately, many of these existing programmable IoT platforms do not provide adequate in-built security measures (e.g., fine-grained access control) to thwart risks from misbehaving (rogue/faulty) apps. As a result, a misbehaving app can exercise unrestricted access to the devices and thus, transition the IoT system to an undesirable and/or unsafe state. This can lead to financial loss, fatal consequences, or environmental disasters. This project focuses on defending IoT systems against such threats by preventing native and third-party apps from administering unexpected operations on IoT devices. The project develops a platform-agnostic solution, which has the potential to substantially improve the overall security, privacy and safety of existing programmable IoT systems. The foundational techniques developed in this project are also applicable to a variety of networked systems (e.g., mission-/safety-critical systems). To develop an effective solution, this collaborative research project relies on the insight that undesirable state transitions of the IoT system can be viewed as violations of the system's desired stateful invariants or policies. The system is expected to comply with these policies to ensure its safety, security, and privacy guarantees. The core objective of this research is to create a policy-guided defense mechanism which prevents an IoT system from entering into an undesired state, even at the presence of misbehaving apps, by dynamically enforcing user-defined policies at runtime. This project realizes the project's objective through three research thrusts. The first thrust designs a unified, expressive policy language to capture user-defined rich stateful policies, which would dictate the expected behavior of a system. The second thrust develops a software-defined overlay which not only generalizes heterogeneous IoT devices connected through several network technologies but also enables a platform-agnostic policy enforcement approach. The third thrust devises the necessary techniques to realize the high-level foundational developments from the preceding thrusts for real-world IoT ecosystems (e.g., smart-home, industrial control systems). With the goal of developing a competitive cybersecurity workforce, the theories and prototypes developed in this project are used to educate undergraduate and graduate students on the inherent design trade-offs in building practical, secure and resilient systems.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.