A Case Study of the Security Vetting Process of Smart-home Assistant Applications

Hu, Hang; Yang, Limin; Lin, Shihan; Wang, Gang

doi:10.1109/spw50608.2020.00029

Cited by 14 publications

(10 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…3.1.1 Background. Smart voice assistants are one of the most commonly used IoT cloud applications [25,32,60,78,128,130]. Their main purpose is to help users call other services through voice commands, such as obtaining weather forecasts, making phone calls, and turning on the TV.…”

Section: Case Study: Smart Voice Assistantmentioning

confidence: 99%

“…The voice assistant was reported to have security issues on the cloud side [25,32,60,78,128,130]. Because voice assistants require advanced speech recognition technology and natural language processing technology, many voice assistants generally choose third-party cloud services as technical support for IoT clouds.…”

Section: Security Issuesmentioning

confidence: 99%

“…Establish sound authentication. This applies to case studies [18,26,60,74,78,85,86,99,105,108,128]. This is also the hardest part for constructing secure IoT cloud ecosystems.…”

Section: :26mentioning

confidence: 99%

“…Cryptographic authentication protocols can be used to enhance authentication [49,55,91,100]. We note that using HTTPS alone is not sufficient for sound authentication; examples can be found at [60,78,85,128]. Several methods can be used to enhance authentication.…”

Section: :26mentioning

confidence: 99%

See 3 more Smart Citations

IoT Cloud Security Review

et al. 2021

View full text Add to dashboard Cite

Recent years have seen the rapid development and integration of the Internet of Things (IoT) and cloud computing. The market is providing various consumer-oriented smart IoT devices; the mainstream cloud service providers are building their software stacks to support IoT services. With this emerging trend even growing, the security of such smart IoT cloud systems has drawn much research attention in recent years. To better understand the emerging consumer-oriented smart IoT cloud systems for practical engineers and new researchers, this article presents a review of the most recent research efforts on existing, real, already deployed consumer-oriented IoT cloud applications in the past five years using typical case studies. Specifically, we first present a general model for the IoT cloud ecosystem. Then, using the model, we review and summarize recent, representative research works on emerging smart IoT cloud system security using 10 detailed case studies, with the aim that the case studies together provide insights into the insecurity of current emerging IoT cloud systems. We further present a systematic approach to conduct a security analysis for IoT cloud systems. Based on the proposed security analysis approach, we review and suggest potential security risk mitigation methods to protect IoT cloud systems. We also discuss future research challenges for the IoT cloud security area.

show abstract

Section: Case Study: Smart Voice Assistantmentioning

confidence: 99%

Section: Security Issuesmentioning

confidence: 99%

“…Establish sound authentication. This applies to case studies [18,26,60,74,78,85,86,99,105,108,128]. This is also the hardest part for constructing secure IoT cloud ecosystems.…”

Section: :26mentioning

confidence: 99%

Section: :26mentioning

confidence: 99%

See 2 more Smart Citations

IoT Cloud Security Review

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Mare et al [11] exposed security flaws in commercially available consumer smart home hubs. Hu et al [12] examined mechanisms for testing the security of third-party applications for smart home assistants. Lounis and Zulkernine [13] discussed Bluetooth Low Energy (BLE) security and how the "Just Works" pairing option could be used to render a device inoperable.…”

Section: Introductionmentioning

confidence: 99%

Ranking Security of IoT-Based Smart Home Consumer Devices

AlLifah

Zualkernan

2022

IEEE Access

View full text Add to dashboard Cite

Smart home consumer devices like home theatres, music players, voice-based assistants, smart lighting, and security cameras have widely adopted the Internet of Things (IoT). These devices pose a significant security risk to consumers because the devices are exposed to mobile applications and cloud-based services with known security vulnerabilities. IoT technologies also introduce additional vulnerabilities specific to smart home architectures. Most current home consumer devices provide little or no information about the level of security they afford. Since most consumers are not tech-savvy, it is currently difficult for a consumer to make an informed decision about which consumer device model (e.g., which smart television model?) has the best security. Hence, consumers need an objective security ranking of each type (e.g., security cameras) of home consumer devices. This paper proposes a novel methodology to systematically build such security rankings for home consumer devices. The proposed methodology can be applied by utilizing data from any security assessment study. The paper discusses previous efforts in applying Analytic Hierarchy Process (AHP) to rank security risks in general. The paper also presents a systematic survey of security vulnerabilities of smart home consumer devices when viewed from an IoT lens. Using the proposed methodology, a case study where an AHP model for ranking commonly used home consumer devices including home theatres, security cameras, smart lighting, smart speakers, video surveillance, smart switches, home automation systems, home security systems, smart routers, wireless doorbell cameras, and home audio systems, was developed. Relative security rankings for each type of consumer device were derived from the AHP model. According to the AHP model, network security was the primary driver of smart home device security with a priority of 0.6893 while application security had the least priority of 0.0591. Critical Vulnerabilities were the most important for device security (priority=0.4397), Man-in-The-Middle attacks for network security (priority=0.2019), exploitable services for cloud security (priority=0.26), and sensitive data for application security (0.7626). The AHP model was internally consistent (Consistency Ratio < 0.1). Sensitivity analysis showed that the AHP model was robust against pairing assumptions.INDEX TERMS AHP, consumer applications, cloud computing, home consumer devices, Internet of Things, network security, smart home.

show abstract