Security Analysis and Evaluation of Emerging Smart Systems

智能技术的快速发展导致了一个自动化的新时代，市场上有许多智能设备。智能手机是智能设备中最突出的例子，目前有超过33亿用户在使用。其他突出的智能设备包括智能家居系统，从小型传感器到大型数字设备，智能可穿戴设备和自动导航系统。根据Statista[2]的数据，加拿大的智能家居渗透率在2019年达到19.8%，预计到2023年将达到38.7%。这些系统结合了感知、智能和控制，以分析情况并做出决定。智能系统的核心通常是轻量级但计算能力强大的移动系统（例如，Android、iOS或紧凑的框架）。最近人工智能在智能应用（如语音识别和主体检测）以及其他固有功能（如丰富的传感器和无处不在的连接）方面的进展，使移动操作系统成为智能设备的理想平台。

The rapid progress of smart technologies has led to a new era of automation, with numerous smart devices on the market. Smartphones, the most prominent example of smart devices, are being used by more than 3.3 billion users [1]. Other prominent smart devices include smart-home systems ranging from small sensors to large digital appliances, smart wearables, and auto-guidance systems. According to Statista [2], the smart home household penetration in Canada has reached 19.8% in 2019 and is expected to hit 38.7% by 2023. These systems combine sensing, intelligence, and control in order to analyze a situation and make a decision. At the core of smart systems often lies a lightweight, yet computationally powerful mobile system (e.g., Android, iOS, or a compact framework). Recent AI advances in intelligent apps (e.g., voice recognition and subject detection) along with other inherent features (e.g., abundant sensors and ubiquitous connectivity), make mobile operating systems an ideal platform for smart devices. With malicious attacks becoming more sophisticated, smart systems are on the next frontier of risk. Just like traditional systems carry security flaws, smart device contain access control flaws in various components. These flaws can lead to devastating cyber and physical consequences, such as sensitive-information leakage, financial loss (e.g., stealing banking credentials through misconfiguring smart modem routers [3]), and even safety issues (e.g., corrupt vital sign measurements in wearables). Our long-term vision is to create and develop innovative and original automatic tools for detecting vulnerabilities in smart devices and technologies, and to create systematic solutions for evaluating and synthesizing protection specifications for such systems. The smart ecosystem exhibits many features that inherently pose challenges for deploying existing security evaluation tools from the security community. Our research will address challenges in modeling, evaluating and strengthening access-control features used by smart device vendors to protect sensitive resources at different layers of the ecosystem. In addition to advancing the state of the art scientific knowledge, we plan to make our tools available to smart device vendors, who are at the forefront of suffering from increasing blame and even diminishing trust when a vulnerability is uncovered in the smart frameworks.