1. IoTSafe: A Safe & Verified Security Controller for Internet-of-Things Tianlong Yu

2. IoT is an impending security disaster 2 IoT devices cause physical damage!!! overheatbreak-incrashfire

3. Current approaches fail to secure IoT 3 Attacker User Unfixable Flaws - Resource - Management - Longevity No physical context ✗✗ Embedded Controller

4. IoTSafe Security Controller 4 Attacker User Security Controller 2. Stop potential attacker 1. Reset device to safe state

5. Project Goals 5 Hybrid Program IoTSafe Controller KeYmaera X ✔ Verified Safety ✔ Implementation on OpenDayLight IoT APIsSecurity Appliances APIs Message Verifier with Snort ✔ Room Temperature Model

6. Hybrid Program 6 Security Controller TeTe T1T1 Desired Temperature T d Attacker User Safety 20<=T 1 <=24 Message Verifier By Newton’s cooling law:

7. Hybrid Program Design 7 /* Controller actions */ If can overheated/overcooled in tc time Block user/attacker Td change Reset Td to a safe value /* User/Attacker Actions */ If user/attacker can change Td Non-deterministic Td in (Td min, Td max ) /* Temperature change in tc time */ Differential equation to describe T change check every tc time P1 Event-triggered or time-triggered? P2 User/attacker actions? P3 Controller Actions?

8. Hybrid Program Design 8 How to predict overheat/overcool? How to set Td to safety value? Stop temperature change How to describe temperature change?

9. Verification with KeYmaera X 9

10. Implementation on SDN controller 10 Internet IoTSafe Controller IoT Gateway Home Network Security Server SDN IoT APIs NFV overheat/overcool normal FW: lock T; Reset Td; FW: allow T; FSM

11. Discussion & Future Works 11 Hybrid Program IoTSafe Controller KeYmaera X Synthesizer Automatic Translation? IoT Device Model Security Policy Automatic Verification?