GhostBox

GhostBox: Placing Physical Boundaries on Mobile Information Access Problem: How can you create physical boundaries where information can be accessed on mobile devices? Context:  Cyber-attacks are no longer focused on stealing credit card and bank information from individuals. A study by McAfee, presented at the World Economic Form, found that over 50% of computer systems maintaining electrical grids and oil and gas pipelines have been hacked to silently steal information. The study also found that 40% of IT managers expect a major cyber-security incident in the next year. Given that the same study also found the average incident costs $6.4 million per day, the economic importance of effective cyber-security is clear. Cyber-security is not new. Research in this area has been conducted almost as long as computers have been available. However, the complexity of computing devices makes it difficult to quantify security and ensure that exploits do not exist. Existing approaches to security cannot be weighed, measured, or quantified like physical objects can and thus are difficult to ensure are effective. Moreover, despite the sophistication of cyber-security approaches that have been researched, end-users, executives, IT administrators, and other people are the links that determine whether or not the techniques are applied correctly for the context in which they are used.

Unless the people applying the techniques can comprehend their application, measure the context in which they will be applied, and ensure appropriate coverage, they are not effective. A single gap in the security surface can have devastating consequences. As long as security techniques are difficult to understand and hard to measure, it will be nearly impossible to ensure their consistent and correct usage.

The goal of this research is to create algorithms and information access architectures that depend upon specific physical contexts. People understand how to assess, quantify, and secure physical environments. By making information access reliant on specific physical characteristics surrounding a mobile device, this research will make security techniques more accessible and quantifiable.

This research has three key areas 1) formal modeling to understand how an algorithm’s attack surface projects into the physical world and limits the exposure in the cyber-world; 2) creation of information access algorithms that have provable reliance on external physical characteristics; 3) and security middleware approaches for mobile devices that can deal with noise in commodity mobile sensors when executing cyber-physical security algorithms.

The advances in these three areas will provide a pathway that allows researchers to make algorithms that are more accessible to end-users by having physical components that can be secured with traditional mechanisms. Moreover, formal models for assessing cyber-physical security techniques and ensuring that they have provable cyber-physical properties will ensure that algorithms are assessed properly.

Solution Approach:

Our solution approach is based on creating cyber-physical security techniques, developing formal models to analyze these algorithms, and developing prototype mobile policy middleware for empirically evaluating these approaches in real-world settings. The key research objectives that stem from this methodology are as follows: 

1. Researching Algorithms that Rely on the Observation of Physical Phenomena at Close Range for Authentication and Access to Data – Cyber-physical security algorithms rely on both the observation of physical phenomena, such as a visual signal, and cyber-mechanisms, such as encryption, to control the access to data. An important research concern is devising information access control algorithms that rely on a mobile device’s sensors to observe physical phenomena for access, provide sufficient security while overcoming noise in commodity mobile device sensors, and provably require physical observation of the physical phenomena to attack.
2. Architecting & Developing Secure Mobile Policy Middleware that can Configurably Control Information Access and Storage Based on Physical Context – When and where information should be accessed is highly domain-dependent. Existing information access control access specification and middleware approaches, such as the use of users and groups, are not designed to include physical context attributes in access control specifications. A further core aspect of my research is developing secure context-aware mobile information access middleware. A critical aspect of this middlware is that it uses domain-specific policy languages that include physical context attributes to allow domain-experts, such as medical administrators, to assign cyber-physical information access policies. These domain-specific languages allow the incorporation of physical characteristics important to a specific domain, such as the concept of a patient’s room, that are critical to enabling context-aware information security.
3. Creating Formal Models for Quantifying Mobile Cyber-physical Security Techniques’ Physical vs. Cyber Attack Surface – Physical security is well understood by businesses, governments, hospitals and other keepers of sensitive information. However, most approaches for mobile cyber-security rely purely on cyber-mechanisms, such as identifying unusual network traffic patterns that are not well understood by these entities. One aspect of my research is on developing formal models for quantifying how much of a mobile cyber-physical security technique’s attack surface lies in the physical rather than the cyber-world and the tradeoff in quality of service (QoS) of the computing provided by the device.