Software Engineering Institute

Grace A. Lewis

Principal Researcher

Grace A. Lewis is the principal investigator for two research projects related to IoT Security:

High-Assurance Software-Defined IoT Security

is creating an IoT framework that operates, with high assurance, in a resilient and trustworthy manner even in the presence of a powerful and realistic attacker who can compromise IoT devices, control nodes, and other intermediaries. The software-defined IoT infrastructure is composed of (i) a high-assurance control node that monitors security-relevant events and alters the "security postures" of IoT devices to enforce specific policies; (ii) trusted data nodes that execute these security postures for each IoT device using "micro-middleboxes"; and (iii) firmware-hardened IoT device nodes, which can be untrusted (e.g., commodity), or trusted (e.g., custom-built by a trusted contractor) but have verifiably secure communication with the control node and data nodes.

Authentication and Authorization of IoT Devices in Tactical Environments

is evaluating, adapting, and implementing an IETF proposal for authentication and authorization in constrained environments (ACE) such that it is resilient to high-priority threats of tactical environments (e.g., node impersonation and capture) that are currently not addressed in ACE. The SEI-ACE implementation is available on GitHub.

She also led the work in Tactical Computing and Communications (TCC) that developed tactical cloudlets. The tactical cloudlet software is available as KD-Cloudlet on GitHub.

Areas of expertise: edge computing, cloud computing, software architecture, service-oriented architecture, technology evaluation, IoT security