Io TSafe A Safe Verified Security Controller for

Io. TSafe: A Safe & Verified Security Controller for Internet-of-Things Tianlong Yu

Io. T is an impending security disaster overheat break-in crash fire Io. T devices cause physical damage!!! 2

Current approaches fail to secure Io. T Embedded Controller ✗ ✗ Attacker User Unfixable Flaws - Resource - Management - Longevity No physical context 3

Io. TSafe Security Controller Attacker User 1. Reset device to safe state 2. Stop potential attacker 4

Project Goals ✔Room Temperature ✔ Verified Safety Model Hybrid Program Io. TSafe Controller Io. T APIs Ke. Ymaera X ✔ Implementation on Open. Day. Light Security Appliances APIs Message Verifier with Snort 5

Hybrid Program Security Controller Desired Temperature Td Te T 1 Attacker Message Verifier User Safety 20<=T 1<=24 By Newton’s cooling law: 6

Hybrid Program Design /* Controller actions */ If can overheated/overcooled in tc time Block user/attacker Td change Reset Td to a safe value /* User/Attacker Actions */ If user/attacker can change Td Non-deterministic Td in (Tdmin, Tdmax) P 1 Event-triggered or time-triggered? P 2 User/attacker actions? P 3 Controller Actions? /* Temperature change in tc time */ Differential equation to describe T change check every tc time 7

Hybrid Program Design How to predict overheat/overcool? How to set Td to safety value? Stop temperature change How to describe temperature change? 8

Verification with Ke. Ymaera X 9

Implementation on SDN controller FSM overheat/overcool FW: lock T; Reset Td; FW: allow T; normal Io. TSafe Controller SDN NFV Io. T APIs Security Server Internet Io. T Gateway Home Network 10

Discussion & Future Works Io. T Device Security Model Policy Synthesizer Automatic Translation? Hybrid Program Io. TSafe Controller Ke. Ymaera X Automatic Verification? 11