Security Analysis and Evaluation of Emerging Smart Systems

智能技术的快速进步导致了自动化的新时代，市场上有无数智能设备。智能手机是智能设备中最突出的例子，目前有超过33亿用户在使用[1]。其他著名的智能设备包括智能家居系统，从小型传感器到大型数字家电，智能可穿戴设备和自动导航系统。根据Statista[2]的数据，2019年加拿大智能家居普及率已达到19.8%，预计到2023年将达到38.7%。这些系统将感知、智能和控制结合在一起，以分析情况并做出决定。智能系统的核心通常是轻量级但计算能力强大的移动系统(例如，Android、iOS或紧凑的框架)。最近人工智能在智能应用程序(如语音识别和主题检测)方面的进步，以及其他固有功能(如丰富的传感器和无处不在的连接)，使移动操作系统成为智能设备的理想平台。随着恶意攻击变得越来越复杂，智能系统正处于风险的下一个前沿。就像传统系统存在安全漏洞一样，智能设备在各种组件中也存在访问控制漏洞。这些漏洞可能导致毁灭性的网络和物理后果，例如敏感信息泄露、经济损失(例如，由于错误配置智能调制解调器路由器[3]而窃取银行凭证)，甚至安全问题(例如，可穿戴设备中的生命体征测量损坏)。我们的长期愿景是创建和开发用于检测智能设备和技术中的漏洞的创新和原创的自动化工具，并创建用于评估和综合此类系统的保护规范的系统解决方案。智能生态系统展示了许多功能，这些功能固有地对部署安全社区的现有安全评估工具构成了挑战。我们的研究将解决在建模、评估和加强智能设备供应商用来保护生态系统不同层的敏感资源的访问控制功能方面的挑战。除了推进最先进的科学知识，我们还计划将我们的工具提供给智能设备供应商，当智能框架中发现漏洞时，这些供应商正处于越来越多的指责甚至信任减少的前沿。

The rapid progress of smart technologies has led to a new era of automation, with numerous smart devices on the market. Smartphones, the most prominent example of smart devices, are being used by more than 3.3 billion users [1]. Other prominent smart devices include smart-home systems ranging from small sensors to large digital appliances, smart wearables, and auto-guidance systems. According to Statista [2], the smart home household penetration in Canada has reached 19.8% in 2019 and is expected to hit 38.7% by 2023. These systems combine sensing, intelligence, and control in order to analyze a situation and make a decision. At the core of smart systems often lies a lightweight, yet computationally powerful mobile system (e.g., Android, iOS, or a compact framework). Recent AI advances in intelligent apps (e.g., voice recognition and subject detection) along with other inherent features (e.g., abundant sensors and ubiquitous connectivity), make mobile operating systems an ideal platform for smart devices. With malicious attacks becoming more sophisticated, smart systems are on the next frontier of risk. Just like traditional systems carry security flaws, smart device contain access control flaws in various components. These flaws can lead to devastating cyber and physical consequences, such as sensitive-information leakage, financial loss (e.g., stealing banking credentials through misconfiguring smart modem routers [3]), and even safety issues (e.g., corrupt vital sign measurements in wearables). Our long-term vision is to create and develop innovative and original automatic tools for detecting vulnerabilities in smart devices and technologies, and to create systematic solutions for evaluating and synthesizing protection specifications for such systems. The smart ecosystem exhibits many features that inherently pose challenges for deploying existing security evaluation tools from the security community. Our research will address challenges in modeling, evaluating and strengthening access-control features used by smart device vendors to protect sensitive resources at different layers of the ecosystem. In addition to advancing the state of the art scientific knowledge, we plan to make our tools available to smart device vendors, who are at the forefront of suffering from increasing blame and even diminishing trust when a vulnerability is uncovered in the smart frameworks.