Grant: Discovery Grants Program - Individual

Internet-of-Things, where everyday objects are all connected and autonomously communicate with one another, is revolutionizing our lives. The data handled by the IoT devices can be privacy-sensitive, e.g., in the case of smart healthcare, and safety-critical, e.g., in the case of smart manufacturing, giving rise to serious information security concerns. The overarching goal of this research program is to design, analyze and implement end-to-end IoT security and privacy solutions, with an emphasis on (a) longevity of data protection in the IoT systems and (b) varying sensitivity levels of the IoT data among different IoT devices. As a result of this research program, we will produce robust and practical implementations of provably secure systems and, in turn, enhance the contextual privacy and security of users of IoT systems. We will achieve this goal by identifying the challenges with respect to integrity and confidentiality of data in IoT scenarios and addressing them by designing new schemes. Then, we complement our findings with a proof-of-concept implementation and further develop it to an end-to-end package which is ready for standardization and deployment in the industry. IoT devices are getting smarter and contain more safety-critical and privacy-sensitive information about us while becoming smaller - making them a very appealing target for attackers. While providing a great opportunity for ubiquitous computing, the miniaturization of smart devices brings many security and privacy concerns as the traditional mechanisms for safeguarding digital information are no longer adequate. As a result, IoT cannot afford complex algorithms and demands for lightweight alternatives. We will investigate new techniques and approaches for developing security protocols that are lightweight enough to be used in a small sensor in IoT while at the same time provide adequate and contextual security and privacy guarantees. Another challenge is longevity of the confidentiality requirement. Many IoT devices are deployed with life expectancy of more than a decade or are storing information that are meant to remain confidential for decades. This brings them in the scope of the quantum computing threat where currently standardized public-key schemes are no longer secure. While quantum-resistant solutions currently exist, they are not yet standardized and definitely not lightweight enough for many IoT scenarios. We will investigate new approaches in designing scalable quantum-resistant solutions for IoT devices and design and implement them in a flexible manner providing crypto-agility.  One other IoT pain point is efficient and scalable message and device authentication which are typically achieved by secure management of cryptographic keys and credentials. These techniques are highly relying on public-key cryptography which are expensive and not scalable for many IoT settings. We will propose alternative techniques to address message and device authentication.