More Like this

1. Authorization Framework for Secure Cloud Assisted Connected Cars and Vehicular Internet of Things

   https://doi.org/10.1145/3205977.3205994  

   Gupta, Maanak ; Sandhu, Ravi ( June 2018 , Proceedings of 23rd ACM Symposium on Access Control Models and Technologies (SACMAT’18))

   Internet of Things has become a predominant phenomenon in every sphere of smart life. Connected Cars and Vehicular Internet of Things, which involves communication and data exchange between vehicles, traffic infrastructure or other entities are pivotal to realize the vision of smart city and intelligent transportation. Vehicular Cloud offers a promising architecture wherein storage and processing capabilities of smart objects are utilized to provide on-the-fly fog platform. Researchers have demonstrated vulnerabilities in this emerging vehicular IoT ecosystem, where data has been stolen from critical sensors and smart vehicles controlled remotely. Security and privacy is important in Internet of Vehicles (IoV) where access to electronic control units, applications and data in connected cars should only be authorized to legitimate users, sensors or vehicles. In this paper, we propose an authorization framework to secure this dynamic system where interactions among entities is not pre-defined. We provide an extended access control oriented (E-ACO) architecture relevant to IoV and discuss the need of vehicular clouds in this time and location sensitive environment. We outline approaches to different access control models which can be enforced at various layers of E-ACO architecture and in the authorization framework. Finally, we discuss use cases to illustrate access control requirements in our vision of cloud assisted connected cars and vehicular IoT, and discuss possible research directions. 

   more » « less
2. The SemIoTic Ecosystem: A Semantic Bridge between IoT Devices and Smart Spaces

   https://doi.org/10.1145/3527241  

   Yus, Roberto ; Bouloukakis, Georgios ; Mehrotra, Sharad ; Venkatasubramanian, Nalini ( August 2022 , ACM Transactions on Internet Technology)

   Smart space administration and application development is challenging in part due to the semantic gap that exists between the high-level requirements of users and the low-level capabilities of IoT devices. The stakeholders in a smart space are required to deal with communicating with specific IoT devices, capturing data, processing it, and abstracting it out to generate useful inferences. Additionally, this makes reusability of smart space applications difficult, since they are developed for specific sensor deployments. In this article, we present a holistic approach to IoT smart spaces, the SemIoTic ecosystem, to facilitate application development, space management, and service provision to its inhabitants. The ecosystem is based on a centralized repository, where developers can advertise their space-agnostic applications, and a SemIoTic system deployed in each smart space that interacts with those applications to provide them with the required information. SemIoTic applications are developed using a metamodel that defines high-level concepts abstracted from the smart space about the space itself and the people within it. Application requirements can be expressed then in terms of user-friendly high-level concepts, which are automatically translated by SemIoTic into sensor/actuator commands adapted to the underlying device deployment in each space. We present a reference implementation of the ecosystem that has been deployed at the University of California, Irvine and is abstracting data from hundreds of sensors in the space and providing applications to campus members. 

   more » « less
3. A Capstone Project: Designing an IoT Threat Modeling to Prevent Cyber-attacks

   Toutsop, O. ( November 2021 , 2021 Fall ASEE Middle Atlantic Section Meeting)

   The NTT (Nippon Telegraph and Telephone) Data Corporation report found that 80% of U.S. consumers are concerned about their smart home data security. The Internet of Things (IoT) technology brings many benefits to people's homes, and more people across the world are heavily dependent on the technology and its devices. However, many IoT devices are deployed without considering security, increasing the number of attack vectors available to attackers. Numerous Internet of Things devices lacking security features have been compromised by attackers, resulting in many security incidents. Attackers can infiltrate these smart home devices and control the home via turning off the lights, controlling the alarm systems, and unlocking the smart locks, to name a few. Attackers have also been able to access the smart home network, leading to data exfiltration. There are many threats that smart homes face, such as the Man-in-the-Middle (MIM) attacks, data and identity theft, and Denial of Service (DoS) attacks. The hardware vulnerabilities often targeted by attackers are SPI, UART, JTAG, USB, etc. Therefore, to enhance the security of the smart devices used in our daily lives, threat modeling should be implemented early on in developing any given system. This past Spring semester, Morgan State University launched a (senior) capstone project targeting undergraduate (electrical) engineering students who were thus allowed to research with the Cybersecurity Assurance and Policy (CAP) center for four months. The primary purpose of the capstone was to help students further develop both hardware and software skills while researching. For this project, the students mainly focused on the Arduino Mega Board. Some of the expected outcomes for this capstone project include: 1) understanding the physical board components, 2) learning how to attack the board through the STRIDE technique, 3) generating a Data Flow Diagram (DFD) of the system using the Microsoft threat modeling tool, 4) understanding the attack patterns, and 5) generating the threat based on the user's input. To prevent future threats and attacks from taking advantage of systems vulnerabilities, the practice of "threat modeling" is implemented. This method allows the analysis of potential attackers, including their goals and techniques, while also providing solutions and mitigation strategies. Although Threat modeling can be performed throughout the development of a system, implementing it during developmental stages will prevent further problems in the future. Threat Modeling is crucial because it will help identify any potential threat before it propagates in the system. Identifying threats and providing countermeasures will save both time and money while also keeping the consumers safe. As a result, students must grow to understand how essential detecting and preventing attacks are to protect consumer information systems and networks. At the end of this capstone project, students should take away hands-on skills in cyber defense. 

   more » « less
4. CardioCam: Leveraging Camera on Mobile Devices to Verify Users While Their Heart is Pumping

   https://doi.org/10.1145/3307334.3326093  

   Liu, Jian ; Shi, Cong ; Chen, Yingying ; Liu, Hongbo ; Gruteser, Marco ( January 2019 , Proceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services (MobiSys '19))

   With the increasing prevalence of mobile and IoT devices (e.g., smartphones, tablets, smart-home appliances), massive private and sensitive information are stored on these devices. To prevent unauthorized access on these devices, existing user verification solutions either rely on the complexity of user-defined secrets (e.g., password) or resort to specialized biometric sensors (e.g., fingerprint reader), but the users may still suffer from various attacks, such as password theft, shoulder surfing, smudge, and forged biometrics attacks. In this paper, we propose, CardioCam, a low-cost, general, hard-to-forge user verification system leveraging the unique cardiac biometrics extracted from the readily available built-in cameras in mobile and IoT devices. We demonstrate that the unique cardiac features can be extracted from the cardiac motion patterns in fingertips, by pressing on the built-in camera. To mitigate the impacts of various ambient lighting conditions and human movements under practical scenarios, CardioCam develops a gradient-based technique to optimize the camera configuration, and dynamically selects the most sensitive pixels in a camera frame to extract reliable cardiac motion patterns. Furthermore, the morphological characteristic analysis is deployed to derive user-specific cardiac features, and a feature transformation scheme grounded on Principle Component Analysis (PCA) is developed to enhance the robustness of cardiac biometrics for effective user verification. With the prototyped system, extensive experiments involving 25 subjects are conducted to demonstrate that CardioCam can achieve effective and reliable user verification with over $99%$ average true positive rate (TPR) while maintaining the false positive rate (FPR) as low as 4%. 

   more » « less
5. iTex Gloves: Design and In-Home Evaluation of an E-Textile Glove System for Tele-Assessment of Parkinson’s Disease

   https://doi.org/10.3390/s23062877  

   Ravichandran, Vignesh ; Sadhu, Shehjar ; Convey, Daniel ; Guerrier, Sebastien ; Chomal, Shubham ; Dupre, Anne-Marie ; Akbar, Umer ; Solanki, Dhaval ; Mankodiya, Kunal ( March 2023 , Sensors)

   Parkinson’s disease (PD) is a neurological progressive movement disorder, affecting more than 10 million people globally. PD demands a longitudinal assessment of symptoms to monitor the disease progression and manage the treatments. Existing assessment methods require patients with PD (PwPD) to visit a clinic every 3–6 months to perform movement assessments conducted by trained clinicians. However, periodic visits pose barriers as PwPDs have limited mobility, and healthcare cost increases. Hence, there is a strong demand for using telemedicine technologies for assessing PwPDs in remote settings. In this work, we present an in-home telemedicine kit, named iTex (intelligent Textile), which is a patient-centered design to carry out accessible tele-assessments of movement symptoms in people with PD. iTex is composed of a pair of smart textile gloves connected to a customized embedded tablet. iTex gloves are integrated with flex sensors on the fingers and inertial measurement unit (IMU) and have an onboard microcontroller unit with IoT (Internet of Things) capabilities including data storage and wireless communication. The gloves acquire the sensor data wirelessly to monitor various hand movements such as finger tapping, hand opening and closing, and other movement tasks. The gloves are connected to a customized tablet computer acting as an IoT device, configured to host a wireless access point, and host an MQTT broker and a time-series database server. The tablet also employs a patient-centered interface to guide PwPDs through the movement exam protocol. The system was deployed in four PwPDs who used iTex at home independently for a week. They performed the test independently before and after medication intake. Later, we performed data analysis of the in-home study and created a feature set. The study findings reported that the iTex gloves were capable to collect movement-related data and distinguish between pre-medication and post-medication cases in a majority of the participants. The IoT infrastructure demonstrated robust performance in home settings and offered minimum barriers for the assessment exams and the data communication with a remote server. In the post-study survey, all four participants expressed that the system was easy to use and poses a minimum barrier to performing the test independently. The present findings indicate that the iTex glove system has the potential for periodic and objective assessment of PD motor symptoms in remote settings. 

   more » « less