Building Private-by-Design IoT Systems

Abstract

Internet of Things (IoT) devices have revolutionized the way we interact with our physical environment. With a single tap on a smartphone screen or a voice command one can control home lighting, thermostats and cameras, monitor physical activity, and keep track of personal belongings. However, while these devices become more and more embedded in our daily lives, there are growing concerns over the privacy and security of highly sensitive data they collect. Numerous cases of data abuse, unauthorized sharing and leakage have been reported. Unfortunately, existing IoT systems have not only failed to prevent such cases, but often contributed to those. To address this issue, we propose a clean-slate approach to building secure and private-by-design IoT systems, in which users retain full control and ownership of their IoT data. The approach builds upon key design concepts: (1) a dataflow programming model for building IoT apps and services, and (2) a mechanism to track sensitive sensor data flows inside these apps and automatically verify their compliance with user-defined privacy and security preferences.