Internet of things or threats?: on building trust in IoT (keynote)

The Internet of things (IoT) is rapidly emerging with the goal to connect the unconnected. Many new device manufacturers are entering the market of internet-connected appliances for smart homes and offices, ranging from motion sensors to virtual voice assistants. However, due to lack of security by design and flawed implementations we are facing significant security and privacy challenges specific to IoT, such as perilous IoT botnet attacks, and novel privacy threats caused by widespread installation of wireless sensors, actuators and smart home appliances even in the private setting of our homes. Unfortunately, basic security measures like properly encrypted communications does not protect against these threats. The massive scale of the IoT device population and enormous diversity of device hardware, operating systems, software frameworks and manufacturers makes it very difficult to establish standard IoT security and privacy-protecting solutions by simply applying known solutions, neither for per-device security architectures nor for network security measures. In particular, existing intrusion detection techniques to detect compromised IoT devices seem ineffective. In this talk, we will present our recent work on addressing various security and privacy challenges in the growing IoT landscape including industry collaborations. In particular, we focus on approaches for flexible management of security associations (pairing) among devices introduced into the user's trust domain as well as effectively and efficiently identifying these devices based on their inherent communication behavior and using these behavior patterns to automatically and reliably detect compromised IoT devices.