Threats, Risk Assessment, and Policy Management in UbiComp Workshop on Security in UbiComp UBICOMP 2002, 29th Sept. Göteborg, Sweden Philip Robinson, SAP Corporate Research & Telecooperation Office

Management & Access Scope of UbiComp Environments and Applications Closed/ Embedded Personal Static Groups Public Ad Hoc Groups

Point of Alert Static Threat = Unsolicited interactive access to system by non-group member Ad Hoc Threat = Unsolicited use of special services – access beyond role and rights Public Threat = “unsolicited modification/ misuse of system Personal Threat = Unsolicited possession of system (tangible access) Closed Threat = Unsolicited access to system location “Access to a system or its resources/ information is the first line of attack”

Risk – all about Context Information and Resources have no value without a particular Context. Context information changes the awareness and evaluation of risks Awareness of risks changes the utility of and contribution to the Context information Credit Card #:

When is the risk pending? Data Sensor/ Low-level Context Information (cues) temperatureaccelerationlocation Computed/ Partial Context Information Movement Office Occupied Elicited/ Meta-level Context Information Meeting and Discussion in Session, and topic is…

Attack Profile RESOURCESCONTEXT Communicational (Reception & Transmission (Reception & Transmission) Interactive (Stimuli & Response (Stimuli & Response) Perceptive (Sensors & Actuators) Computational (Memory, Power & Processing (Memory, Power & Processing) ATTACK ATTACK ATTACK ATTACK Attacker listens in on communications channel. Attacks on confidentiality & privacy! Attack by abusing lack or excess of computational capacity – denial of service or malicious code attacks Attack by embedding false sensor and actuator devices into environment – attack on context derivation integrity Attack by falsifying the physical environment’s signals – attack on context reading integrity

Policy Management Administrative Distribution data Definition -Document encoded -Application encoded -Entity encoded Enforcement -Security Mechanism selection -Physical vs. Logical Modification & Dissolution -Static vs. Dynamic -Consistency & notification Auditing -Centralized vs. Distributed Behavioral policy, relational policy Analog signal A/D transmission Computation Digital signal Interpretation emission Physical environment Signal integrity policy Context-based policiesComputational policies Communication policies Authorization policies

Summary Identify access scope of UbiComp application Determine point-of-alert based on access scope Determine when the context creates a manageable risk Perform a Threat Analysis Define policy model to circumvent threats Implement mechanisms to enforce policy Establish methodology for managing policy information

Policy Enforcement

Policy Dissolution

Policy Modification