Model Driven Engineering for the IoT

牛津词典对物联网（IoT）的定义是：“一种建议发展的互联网，日常物品在其中具有网络连接，允许它们发送和接收数据。”虽然这项技术释放了巨大的机会来推进和积极影响我们的日常生活，但它增加了我们每天与之互动的设备的攻击面，因此，当以恶意方式使用时，它可能会阻碍我们的生活。在该计划中，我们的目标是通过两种方式解决物联网安全和信任挑战：首先，我们的目标是将模型驱动安全（MDS）与物联网应用的设计和开发相结合。安全元模型与物联网生态系统架构参考元模型在设计层面的集成将确保在开发的早期阶段就考虑到安全方面。提出的集成模型还可以作为将现有物联网应用程序迁移到安全和隐私感知系统的基础。其次，从分析和测试的角度来看，与我们之前为web应用安全分析开发的框架[10]类似，我们的目标是使用静态和动态分析技术从现有的物联网生态系统中恢复安全模型，并使用形式化验证技术来验证物联网应用是否存在安全漏洞。本研究计划将培养6名高素质人才（HQP）： 2名博士研究生和4名硕士研究生。他们将获得MDE，安全分析研究技术和工业级物联网系统的丰富实践经验，为他们成功的学术生涯或大型软件系统的网络安全研究人员的苛刻角色做好准备。物联网的出现带来了万亿美元的经济影响，并提高了我们日常生活的服务质量。该计划旨在通过帮助标准化具有安全意识的物联网生态系统的设计和开发工作，支持该技术的采用。该计划还将提供所需的方法和工具集来测试和验证物联网解决方案是否符合安全标准，从而帮助行业验证和改进其产品以满足市场期望。我们希望我们的项目将有助于提供更高质量的物联网产品，这些产品将对我们的生活产生积极影响，而不是阻碍我们的生活，并在许多方面为无处不在的计算时代的加拿大人做出贡献。

The Oxford dictionary defines the Internet of Things (IoT) as: “A proposed development of the Internet in which everyday objects have network connectivity, allowing them to send and receive data.” While this technology unleashed huge opportunities to advance and positively impact our daily life, it increases the attack surface on devices we interact with on a daily basis and consequently when used in malicious way, it could hinder our life. In this program, we aim to address the IoT security and trust challenge in two ways: First, we aim at integrating model driven security (MDS) with the design and development of IoT applications. Such integration of the security meta-model with the IoT ecosystem architectural reference meta-models at the design level will ensure that security aspects will be considered at an early stage of development. The proposed integrated model can also be used as a basis for migrating existing IoT applications into security and privacy aware systems. Second, and from an analysis and testing perspective, and similar to previous work in the framework we developed for web applications security analysis [10], we aim at using static and dynamic analysis techniques to recover security models from existing IoT ecosystems, and to use formal verification techniques to verify whether the IoT applications have security vulnerabilities. This research plan will train six Highly Qualified Personnel (HQP): 2 PhD and 4 Master's students. They will gain extensive hands-on experience with MDE, security analysis research techniques, and industry-grade IoT systems, preparing them for a successful academic career or for the demanding role of cybersecurity researchers of large software systems. The IoT sprang to life with a promise of trillion-dollar economic impact, and enhanced quality of service of our everyday life. This program is designed to support the adoption of this technology by helping standardize the efforts in the design and development of security aware IoT ecosystems. The program will also provide required methods and toolsets to test and verify the conformance of IoT solutions to security standards, thus helping industries to verify and improve their products to meet the market expectations. We hope that our program will contribute to provide higher quality IoT products which will positively impact rather than hinder our life and contribute in many ways to Canadians in the age of ubiquitous computing.