Collaborative Research: SaTC: CORE: Medium: Toward safe, private, and secure home automation: from formal modeling to user evaluation

协作研究：SaTC：核心：中：迈向安全、私密和可靠的家庭自动化：从形式建模到用户评估

• 批准号: 2320903
• 负责人: Yuan Tian
• 金额: $ 34.16万
• 依托单位: University of California-Los Angeles
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-10-01 至 2024-10-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2320903&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Medium

IoT devices such as smart door locks and platforms and applications that connect these devices and other online services (e.g., IFTTT, Zapier) make life more convenient but have also raised security and privacy concerns. These concerns arise because smart home devices can collect potentially sensitive data about their users and the data and devices can be accessed (e.g., to unlock doors or disable home security systems) in the absence of physical human actions. Further, the risks posed by smart-home devices can impact people other than the device owners, such as home service workers and children. There is a need for a systematic understanding of the security and privacy impact of such platforms. However, existing work is often too coarse-grained to capture the context in which these devices are used (e.g., camera in public area vs. in the bedroom) and mostly focuses on risks and harms to device owners rather than more broadly. This project aims to gain a deeper understanding of smart homes' security and privacy impact, with a focus on end-user programming platforms like IFTTT and Zapier, and to mitigate potential harms via formal modeling and automated analysis tools. One of the identifying characteristics of this project is that user studies are used to both identify user needs and to evaluate potential solutions, including models and formal analysis tools.This project follows an iterative process, where tools and models are first built (based on results of preliminary user studies); next, user studies are conducted to evaluate the tools and learn about users' needs; then, results from user studies are used to refine the tools and models. This project builds detailed, context-rich models and characterizations of risks and harms from home automation platforms, customized to individual users' perspective, and thus fills the gap between what existing models and tools can do and users' perceptions and needs. This project also builds usable, context-aware, configurable analysis tools that extend traditional information-flow analysis to calculate attackers’ precise knowledge of and influence over the system. These analysis tools take into consideration different threat models, which account for attackers’ different capabilities to observe relevant events and interact with the system. Finally, the project designs warnings and nudges to help users understand their smart home systems better and avoid potential harm.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

物联网设备（例如连接这些设备和其他在线服务（例如IFTTT，Zapier））的智能门锁，平台和应用程序使生活更加方便，但也提出了安全和隐私问题。这些担忧是因为智能家庭设备可以收集有关用户的潜在敏感数据，并且可以在没有物理人类行动的情况下访问数据和设备（例如，解锁门或禁用家庭安全系统）。此外，智能家庭设备带来的风险可能会影响设备所有者以外的其他人，例如家庭服务人员和儿童。需要系统地了解此类平台的安全性和隐私影响。但是，现有的工作通常太粗糙了，无法捕获使用这些设备的上下文（例如，在公共区域中与卧室中的相机相机），并且主要集中在对设备所有者的风险和危害上，而不是更广泛地危害。项目旨在更深入地了解智能房屋的安全性和隐私影响，重点关注IFTTT和Zapier等最终用户编程平台，并通过正式的建模和自动化分析工具来减轻潜在的危害。该项目的识别特征之一是用户研究既可以识别用户需求并评估潜在的解决方案，包括模型和正式分析工具。该项目遵循迭代过程，首先构建了工具和模型（基于初步用户研究的结果）；接下来，进行用户研究以评估工具并了解用户的需求；然后，用户研究的结果用于完善工具和模型。该项目构建了家庭自动化平台的详细，上下文丰富的模型以及风险和危害的特征，并根据用户的角度自定义，从而填补了现有模型和工具可以做的事情以及用户的看法和需求之间的空白。该项目还构建了可用的，上下文感知的可配置分析工具，可扩展传统的信息流分析，以计算攻击者对系统的精确知识和影响。这些分析工具考虑了不同的威胁模型，这说明了攻击者观察相关事件并与系统互动的不同功能。最后，该项目设计了警告和轻推，以帮助用户更好地了解其智能家庭系统并避免潜在的伤害。该奖项反映了NSF的法定任务，并通过使用基金会的知识分子优点和更广泛的影响来审查标准，通过评估来诚实地获得支持。

项目成果

Exploring Smart Commercial Building Occupants’ Perceptions and Notification Preferences of Internet of Things Data Collection in the United States

探索美国智能商业建筑住户对物联网数据收集的认知和通知偏好

• DOI: 10.1109/eurosp57164.2023.00064
• 发表时间: 2023
• 期刊: 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P
• 作者: Le, Tu;Wang, Alan;Yao, Yaxing;Feng, Yuanyuan;Heydarian, Arsalan;Sadeh, Norman;Tian, Yuan
• 通讯作者: Tian, Yuan

SkillBot: Identifying Risky Content for Children in Alexa Skills

• DOI: 10.1145/3539609
• 发表时间: 2021-02
• 期刊: ACM Transactions on Internet Technology (TOIT)
• 作者: Tu Le;D. Huang;Noah J. Apthorpe;Yuan Tian