A formal methods safe harbor
Name
1117710226-MIT.pdf
Size
4.57 MB
Format
Adobe PDF
Checksum (MD5)
056f94e96739c9898c57e30bb5bba42f
Author(s)
Wood, Clark,S. M.Massachusetts Institute of Technology.
Advisor(s)
Daniel Weitzner and Adam Chlipala.
Date Issued
2019
Publisher
Massachusetts Institute of Technology
Abstract
We discuss a problem: Internet of Things devices running software are vulnerable to accidents and exploitation, a technology solution: preventing exploitable bugs by developing machine-checked proofs of software correctness and security, and a policy lever to incentivize adoption of this solution: a safe harbor from FTC unfairness prosecution for manufacturers that use formal methods to guarantee safer, more secure devices. To motivate the potential of formal methods, we present a technical contribution: a formally verified connected lightbulb switch, proven immune to certain types of software exploits. We discuss a framework, the Common Weakness Enumeration, that the FTC and manufacturers could use as a shared language to explain what classes of software vulnerability a manufacturer will defend against. We outline the authority of the FTC in regards to poor data security practices as unfair practices and how our safe harbor would both provide immunity to participants and be updated over time to continue to incentivize ever stronger software protections.
Description
Thesis: S.M. in Technology and Policy, Massachusetts Institute of Technology, School of Engineering, Institute for Data, Systems, and Society, 2019
Cataloged from PDF version of thesis.
Includes bibliographical references (pages 77-84).
Subjects
Institute for Data, Systems, and Society.
Technology and Policy Program.
MIT Department
Massachusetts Institute of Technology. Institute for Data, Systems, and Society
Massachusetts Institute of Technology. Engineering Systems Division
Technology and Policy Program
Terms of Use
MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission.
Persistent DSpace Link
