Model Driven Engineering for the IoT

牛津词典对物联网(IoT)的定义是：“一种拟议中的互联网发展，其中日常物品具有网络连接，允许它们发送和接收数据。”虽然这项技术释放了巨大的机会来推动和积极影响我们的日常生活，但它增加了我们日常交互设备的攻击面，因此当被恶意使用时，它可能会阻碍我们的生活。*在本计划中，我们的目标是通过两种方式应对物联网安全和信任挑战：第一，我们的目标是将模型驱动的安全(MDS)与物联网应用的设计和开发相结合。安全元模型与物联网生态系统架构参考元模型在设计层面的这种集成将确保在开发的早期阶段考虑安全方面。建议的集成模型还可以用作将现有物联网应用迁移到安全和隐私感知系统的基础。其次，从分析和测试的角度，与我们开发的Web应用安全分析框架[10]中的工作类似，我们的目标是使用静态和动态分析技术从现有的物联网生态系统中恢复安全模型，并使用正式的验证技术来验证物联网应用是否存在安全漏洞。*本研究计划将培养6名高素质人才：2名博士生和4名硕士研究生。他们将在MDE、安全分析研究技术和工业级物联网系统方面获得丰富的实践经验，为成功的学术生涯或担任大型软件系统网络安全研究人员的苛刻角色做好准备。*物联网的诞生带来了数万亿美元的经济影响，并提高了我们日常生活的服务质量。该计划旨在通过帮助标准化具有安全意识的物联网生态系统的设计和开发来支持该技术的采用。该计划还将提供必要的方法和工具集来测试和验证物联网解决方案是否符合安全标准，从而帮助行业验证和改进其产品，以满足市场期望。我们希望我们的计划将有助于提供更高质量的物联网产品，这些产品将积极影响而不是阻碍我们的生活，并在许多方面为无处不在计算时代的加拿大人做出贡献。

The Oxford dictionary defines the Internet of Things (IoT) as: “A proposed development of the Internet in which everyday objects have network connectivity, allowing them to send and receive data.” While this technology unleashed huge opportunities to advance and positively impact our daily life, it increases the attack surface on devices we interact with on a daily basis and consequently when used in malicious way, it could hinder our life. ***In this program, we aim to address the IoT security and trust challenge in two ways: First, we aim at integrating model driven security (MDS) with the design and development of IoT applications. Such integration of the security meta-model with the IoT ecosystem architectural reference meta-models at the design level will ensure that security aspects will be considered at an early stage of development. The proposed integrated model can also be used as a basis for migrating existing IoT applications into security and privacy aware systems. Second, and from an analysis and testing perspective, and similar to previous work in the framework we developed for web applications security analysis [10], we aim at using static and dynamic analysis techniques to recover security models from existing IoT ecosystems, and to use formal verification techniques to verify whether the IoT applications have security vulnerabilities. ***This research plan will train six Highly Qualified Personnel (HQP): 2 PhD and 4 Master's students. They will gain extensive hands-on experience with MDE, security analysis research techniques, and industry-grade IoT systems, preparing them for a successful academic career or for the demanding role of cybersecurity researchers of large software systems. ***The IoT sprang to life with a promise of trillion-dollar economic impact, and enhanced quality of service of our everyday life. This program is designed to support the adoption of this technology by helping standardize the efforts in the design and development of security aware IoT ecosystems. The program will also provide required methods and toolsets to test and verify the conformance of IoT solutions to security standards, thus helping industries to verify and improve their products to meet the market expectations. We hope that our program will contribute to provide higher quality IoT products which will positively impact rather than hinder our life and contribute in many ways to Canadians in the age of ubiquitous computing.