.png){kind=icon}
返回
SAFECHAIN: Securing Trigger-Action Programming From Attack Chains
.png){kind=icon}
OA
AI
DOI：10.1109/TIFS.2019.2899758.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
The proliferation of the Internet of Things (IoT) is reshaping our lifestyle. With IoT sensors and devices communicating with each other via the Internet, people can customize automation rules to meet their needs. Unless carefully defined, however, such rules can easily become points of security failure as the number of devices and complexity of rules increase. Device owners may end up unintentionally providing access or revealing private information to unauthorized entities due to complex chain reactions among devices. Prior work on trigger-action programming either focuses on conflict resolution or usability issues or fails to accurately and efficiently detect such attack chains. This paper explores the security vulnerabilities when users have the freedom to customize automation rules using trigger-action programming. We define two broad classes of attack-privilege escalation and privacy leakage-and present a practical model-checking-based system called SAFECHAIN that detects hidden attack chains exploiting the combination of rules. Built upon existing model-checking techniques, SAFECHAIN identifies attack chains by modeling the IoT ecosystem as a finitestate machine. To improve practicability, SAFECHAIN avoids the need to accurately model an environment by frequently rechecking the automation rules given the current states and employs rule-aware optimizations to further reduce overhead. Our comparative analysis shows that SAFECHAIN can efficiently and accurately identify attack chains, and our prototype implementation of SAFECHAIN can verify 100 rules in less than 1 s with no false positives.
Keyword:
Trigger-action attack chains
privilege escalation
information leakage
model checking
Internet of Things
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
.png){kind=icon}
分享收藏分享收藏
查看更多内容