Grant: Discovery Grants Program - Individual

The Internet of Things (IoT) era has brought forth incredible innovation. Adding Internet connectivity to small, task-specific devices ("things") has created new ways to integrate sensors and devices, and enabled new applications in the connected home. With IoT devices, users can configure their lights to automatically dim when a movie is playing, set home surveillance cameras to record when a motion sensor is triggered, call the fire department when smoke is detected, and many other applications. However, as these devices pervade users' lives, new concerns are raised about the security and privacy of data they collect, as well as the influence they may have on users' environments. Despite having great access to data and users' lives, many current devices remain unsecured. Issues such as access control, authentication, secure data transmission, and software updates are poorly supported. These issues are compounded by the lack of transparency in hardware and software, as well as the tight constraints on form factor. The inability to monitor the underlying software on IoT devices makes it difficult to know what data is being recorded, stored, or sent to the cloud. For example, an ambient noise monitor that reports aggregate environmental acoustic measurements should not record full conversations, yet it is difficult to known with certainty if the monitor is indeed behaving as expected. This research program will design, develop, and evaluate software and methods to protect IoT devices from security and privacy threats. My research group will propose technical mechanisms to secure IoT devices and the networks in which they operate. We will create tools that give users transparency and control over the behaviour of IoT devices in their homes and enterprise networks. We will design new architectures, libraries, and design patterns that facilitate the development of new IoT devices that are secure by default. Our program will explore strategies for securely updating and maintaining devices that are no longer supported by vendors. In the long term, as IoT devices gain wide area network connectivity, we will extend and optimize our tools to support city-scale IoT networks. In parallel to these projects, we will seek collaboration with IoT software and hardware manufacturers across Canada. Our goal will be to work closely with these partners to gain a clear understanding of the challenges they face in designing and maintaining secure devices. We expect that partnering with IoT manufacturers will allow us to test our proposed solutions on real networks, and help tailor our research objectives to maximize real-world impact.