Ubiquitous Systems Security Boris Dragovic Systems Research Group Computer Laboratory University of Cambridge, UK

Ubiquitous Systems Security What is Ubiquitous Computing? What is Ubiquitous Computing? What are the Security & Privacy issues? What are the Security & Privacy issues? The CASPEr project The CASPEr project EU initiative EU initiative Concluding remarks Concluding remarks

What is Ubiquitous Computing? (1) “Each person is continually interacting with hundreds of … interconnected computers” which ideally “weave themselves into the fabric of everyday life until they are indistiguinshable from it” -- “Some computer science issues in Ubiquitous computing.”, CACM, Mark Weiser, “The computer of the 21 st century.”, Scientific American, 1991.

What is Ubiquitous Computing? (2) “Wirelessly networked processors embedded in everyday objects” “Wirelessly networked processors embedded in everyday objects” Smart environments characterized by: Smart environments characterized by: Transparent interaction Transparent interaction Automated capture Automated capture Context awareness Context awareness Proactive and reactive Proactive and reactive Example projects Example projects AT&T Active bat/badge, HP Cooltown, Microsoft Aura, Intel Place Lab and PersonalServer, EQUATOR AT&T Active bat/badge, HP Cooltown, Microsoft Aura, Intel Place Lab and PersonalServer, EQUATOR

What is Ubiquitous Computing? (3) Where do we currently stand? Where do we currently stand? Ubiquitous devices (always “at hand”): Ubiquitous devices (always “at hand”): Mobile phones, Personal Digital Assistants, Laptops, etc. Mobile phones, Personal Digital Assistants, Laptops, etc. Ubiquitous networks (always available): Ubiquitous networks (always available): (W)LAN/MAN (Ethernet & IEEE ) (W)LAN/MAN (Ethernet & IEEE ) GSM/GPRS/3G GSM/GPRS/3G PANs (Bluetooth, IrDA, AudioNet etc.) PANs (Bluetooth, IrDA, AudioNet etc.) Ubiquitous services Ubiquitous services Currently mostly “location-based” Currently mostly “location-based”

What is Ubiquitous Computing? (4) Reference: Alan Daniel, Georgia Institute of Technology.

What is Ubiquitous Computing? (5) Effects (always-on, always-available) Effects (always-on, always-available) economy & businesses economy & businesses productivity productivity competitiveness competitiveness growth growth etc. etc. private lives private lives

Security & Privacy Issues (1) The “Old Model” – a Castle The “Old Model” – a Castle Security perimeter, inside and outside Security perimeter, inside and outside Firewalls for access control Firewalls for access control Static security policy Static security policy Static trust model Static trust model Tendency to focus on network layer Tendency to focus on network layer Pre-evaluated, non- or slowly-evolving threat model. Pre-evaluated, non- or slowly-evolving threat model.

Security and Privacy Issues (2) Relevant UbiComp characteristics: Relevant UbiComp characteristics: a) wireless media supporting from personal- area to wide-area networks b) ad-hoc device association at different layers c) location and context considerations in policy management d) heterogeneity of content encoding e) variability in processing and storage capabilities of devices f) heterogeneity of security & privacy policies

Security and Privacy Issues (3) The “New Model” The “New Model” Authentication Authentication secure transient associations secure transient associations proximity proximity Recognition vs. Authentication Recognition vs. Authentication activities/behaviour activities/behaviour situation interpretation situation interpretation Identity Management Identity Management

Security and Privacy Issues (4) The “New Model” The “New Model” Confidentiality Confidentiality eavesdropping on wireless links not a major issue eavesdropping on wireless links not a major issue device capabilities (processor, battery etc.) device capabilities (processor, battery etc.) confidentiality of data and meta data on devices real problem confidentiality of data and meta data on devices real problem Integrity Integrity again, not messages in transit but devices again, not messages in transit but devices tamper resistance/evidence tamper resistance/evidence

Security and Privacy Issues (5) The “New Model” The “New Model” Availability Availability jamming communications channels jamming communications channels sleep deprivation sleep deprivation Dynamic Trust Model Dynamic Trust Model localised decisions localised decisions context aware context aware Context-awareness Context-awareness Generalised RBAC Generalised RBAC Location-based access control Location-based access control

Security and Privacy Issues (6) The “New Model” The “New Model” Security policies Security policies prevent formation of “evidence”: forming a link between contexts, objects, users and objectives. prevent formation of “evidence”: forming a link between contexts, objects, users and objectives. e.g. number, “credit card”, “foo bar”, credit limit e.g. number, “credit card”, “foo bar”, credit limit Location information privacy Location information privacy One of the burning issues One of the burning issues

The CASPEr project Containment Aware Security for Pervasive Environments Goal: Data Protection in the UbiComp enhanced World Goal: Data Protection in the UbiComp enhanced World A new paradigm A new paradigm protection of individual data objects protection of individual data objects as they switch contexts as they switch contexts by being contained on mobile devices and communication channels in dynamic environments by being contained on mobile devices and communication channels in dynamic environments and thus threat models and thus threat models through proactive data format management through proactive data format management

The CASPEr project Containment Aware Security for Pervasive Environments Strong analogy to human behaviour Strong analogy to human behaviour Real-world examples, applications: Real-world examples, applications: persistant storage on mobile devices persistant storage on mobile devices environmental displays (PersonalServer) environmental displays (PersonalServer) communications channels trust communications channels trust attachments attachments etc. etc. Humans unable to cope with complexity Humans unable to cope with complexity an automatic, proactive mechanism needed an automatic, proactive mechanism needed

The CASPEr project Containment Aware Security for Pervasive Environments Overview: Overview: security policy (external): security policy (external): containment attributes and values containment attributes and values respective data format transformations respective data format transformations containment manager: containment manager: determines current containment attribute values determines current containment attribute values data object tracking system: data object tracking system: system-wide data-object location system-wide data-object location policy enforcement: policy enforcement: format transformation format transformation

The CASPEr project Containment Aware Security for Pervasive Environments Variable level of application awareness Variable level of application awareness granularity of format transformations granularity of format transformations Orthogonal to traditional access control Orthogonal to traditional access control traditional AC: ID x Obj x Action -> Perm traditional AC: ID x Obj x Action -> Perm CASPEr: ObjType x Containment -> Format CASPEr: ObjType x Containment -> Format Current activities: Current activities: OS Level implementation OS Level implementation GPRS/WLAN/LAN testbed implementation GPRS/WLAN/LAN testbed implementation Audio containment and location analysis Audio containment and location analysis

EU Cybersecurity Efforts European Commission European Commission Joint Research Council (JRC) Joint Research Council (JRC) Institute for Prospective Technological Studies – Information and Communications Technologies. Institute for Prospective Technological Studies – Information and Communications Technologies. Series of proposals and directives Series of proposals and directives OECD OECD Guidelines for data protection, information systems security and networks, crypto etc. Guidelines for data protection, information systems security and networks, crypto etc. Council of Europe Council of Europe Conventions on cybercrime, automatic data processing etc. Conventions on cybercrime, automatic data processing etc.

Conclusion In the Ubiquitous World enterprise borders disappear. In the Ubiquitous World enterprise borders disappear. Traditional, “Old Model”, approaches to protecting Security & Privacy are too rigid. Traditional, “Old Model”, approaches to protecting Security & Privacy are too rigid. Need for a “New Model” which is flexible, adaptable, robust, effective and un- obtrusive. Need for a “New Model” which is flexible, adaptable, robust, effective and un- obtrusive. Data-centric protection mechanism, CASPEr, promising. Data-centric protection mechanism, CASPEr, promising.