The Internet-of-Things (IoT) has quickly moved from the realm of hype to reality with estimates of over 25 billion devices deployed by 2020. While IoT has huge potential for societal impact, it comes with several key security challenges–IoT devices can become the entry points into critical infrastructures and can be exploited to leak sensitive information. Traditional host-centric security solutions in today's IT ecosystems (e.g., antivirus, software patches) are fundamentally at odds with the realities of IoT (e.g., poor vendor security practices and constrained hardware). We argue that the network will have to play a critical role in securing IoT deployments. However, the scale, diversity, cyber-physical coupling, and cross-device use cases inherent to IoT require us to rethink network security along three key dimensions. First, current enforcement architecture cannoten force context-based and agile security postures needed to protect IoT devices. Second, current detection mechanisms cannot learn the network-side behaviors for a single IoT device. Third,there is no mechanism to learnthe complex environment-device or cross-device interactions for IoT devices.

To tackle these problems, we build a fine-grained network detection and prevention system for IoT devices. The workflow of the system is as follows. In the first step, the system can learn single-device behaviors as well as cross-device interactions from historical records. Then, the system can convert the single-device behavioral models and interactions models into regulating security policies, and enforce such security policies in a context-based and agile manner to protect the IoT devices. However, there are several key challenges. To learn single-device behaviors, the main challenges are the lack of single-device behavioral models and how to address the data pollution issue in a realistic setting. For learning complex interactions, it is hard to define a model to capture the environment-device interactions and crossdevice interactions. Besides, learning such an interaction model for IoT devices faces the challenge of insufficient data and privacy issues. For the enforcement part, it is hard to design an expressive context-based and agile policy abstraction that can capture security postures needed for IoT devices. Also, it is hard to design a scalable and responsive controller to orchestrate the enforcement architecture.

Next, we briefly describe our solutions to address these challenges. To model the network behaviors of an IoT device, we design a robust behavioral model inference mechanism called RADIO to build benign behavioral models from potentially polluted network traces. To learn the complex IoT interactions, we build a distributed learning mechanism called LoFTI to learn the IoT interaction model across multiple smart homes. To provide context-based and agile enforcement, we build a new enforcement architecture called PSI (Precise Security Instrumentation). Leveraging recent advances in SDN (Software-Defined Networking)and NFV (Network Function Virtualization), PSI protects each IoT device with dedicated software middleboxes enforcing context-based and agile policies.

103 pages

Thesis Committee:
Vyas Sekar (Co-Chair)
Srinivasan Seshan (Co-Chair)
Yuvraj Agarwal
Virginia Smith
Susanta Nanda (Symantec Research Labs)

Srinivasan Seshan, Head, Computer Science Department
Martial Hebert, Dean, School of Computer Science

Return to: SCS Technical Report Collection
School of Computer Science

This page maintained by reports@cs.cmu.edu