Model Driven Engineering for the IoT

牛津词典将物联网（IoT）定义为：“互联网的拟议发展，其中日常物品具有网络连接性，允许它们发送和接收数据。虽然这项技术释放了巨大的机会来推进和积极影响我们的日常生活，但它增加了我们日常互动的设备的攻击面，因此当以恶意方式使用时，它可能会阻碍我们的生活。* 在这个项目中，我们的目标是通过两种方式解决物联网安全和信任挑战：首先，我们的目标是将模型驱动安全（MDS）与物联网应用程序的设计和开发相集成。安全元模型与物联网生态系统架构参考元模型在设计层面的这种集成将确保在开发的早期阶段考虑安全方面。所提出的集成模型也可以作为将现有物联网应用迁移到安全和隐私感知系统的基础。其次，从分析和测试的角度来看，与我们为Web应用程序安全分析开发的框架中的先前工作类似[10]，我们的目标是使用静态和动态分析技术从现有的物联网生态系统中恢复安全模型，并使用形式化验证技术来验证物联网应用程序是否存在安全漏洞。* 本研究计划将培养6名高素质人员（HQP）：2名博士生和4名硕士生。他们将获得MDE，安全分析研究技术和行业级物联网系统的广泛实践经验，为他们成功的学术生涯或大型软件系统的网络安全研究人员的苛刻角色做好准备。* 物联网蓬勃发展，带来了数万亿美元的经济影响，并提高了我们日常生活的服务质量。该计划旨在通过帮助标准化安全感知物联网生态系统的设计和开发来支持该技术的采用。该计划还将提供所需的方法和工具集，以测试和验证物联网解决方案是否符合安全标准，从而帮助行业验证和改进其产品，以满足市场预期。我们希望我们的计划将有助于提供更高质量的物联网产品，这将积极影响而不是阻碍我们的生活，并在无处不在的计算时代以多种方式为加拿大人做出贡献。

The Oxford dictionary defines the Internet of Things (IoT) as: “A proposed development of the Internet in which everyday objects have network connectivity, allowing them to send and receive data.” While this technology unleashed huge opportunities to advance and positively impact our daily life, it increases the attack surface on devices we interact with on a daily basis and consequently when used in malicious way, it could hinder our life. ***In this program, we aim to address the IoT security and trust challenge in two ways: First, we aim at integrating model driven security (MDS) with the design and development of IoT applications. Such integration of the security meta-model with the IoT ecosystem architectural reference meta-models at the design level will ensure that security aspects will be considered at an early stage of development. The proposed integrated model can also be used as a basis for migrating existing IoT applications into security and privacy aware systems. Second, and from an analysis and testing perspective, and similar to previous work in the framework we developed for web applications security analysis [10], we aim at using static and dynamic analysis techniques to recover security models from existing IoT ecosystems, and to use formal verification techniques to verify whether the IoT applications have security vulnerabilities. ***This research plan will train six Highly Qualified Personnel (HQP): 2 PhD and 4 Master's students. They will gain extensive hands-on experience with MDE, security analysis research techniques, and industry-grade IoT systems, preparing them for a successful academic career or for the demanding role of cybersecurity researchers of large software systems. ***The IoT sprang to life with a promise of trillion-dollar economic impact, and enhanced quality of service of our everyday life. This program is designed to support the adoption of this technology by helping standardize the efforts in the design and development of security aware IoT ecosystems. The program will also provide required methods and toolsets to test and verify the conformance of IoT solutions to security standards, thus helping industries to verify and improve their products to meet the market expectations. We hope that our program will contribute to provide higher quality IoT products which will positively impact rather than hinder our life and contribute in many ways to Canadians in the age of ubiquitous computing.