A taxonomy of cyber-physical threats and impact in the smart home

Abstract

In the past, home automation was a small market for technology enthusiasts. Interconnectivity between devices was down to the owner's technical skills and creativity, while security was non-existent or primitive, because cyber threats were also largely non-existent or primitive. This is not the case any more. The adoption of Internet of Things technologies, cloud computing, artificial intelligence and an increasingly wide range of sensing and actuation capabilities has led to smart homes that are more practical, but also genuinely attractive targets for cyber attacks. Here, we classify applicable cyber threats according to a novel taxonomy, focusing not only on the attack vectors that can be used, but also the potential impact on the systems and ultimately on the occupants and their domestic life. Utilising the taxonomy, we classify twenty five different smart home attacks, providing further examples of legitimate, yet vulnerable smart home configurations which can lead to second-order attack vectors. We then review existing smart home defence mechanisms and discuss open research problems. Reference Key security properties Vulnerabilities/challenges Security recommended Open problems identified Komninos et al. [1] Confidentiality Connected to Internet Auto-immunity to threats Resilience Physical tampering Reliability, availability Lin et al. [2] Confidentiality Phys./netw. accessibility Gateway architecture Auto-configuration Authentication Constrained resources Updates Access control Heterogeneity Nawir et al. [6] Smart meter integrity Remote connectivity Techn. countermeasures Standardisation Privacy Physical tampering Regulatory initiatives Impact evaluation, metrics Non-repudiation Malicious actuation Intrusion detection Authorisation Logging for audit/forensics Ziegeldorf et al.[5]

A State-of-the-Art Review on the Security of Mainstream IoT Wireless PAN Protocol Stacks

“…They referred to several types of attacks against these two protocols and detail on the ways such attacks can be addressed. After introducing a taxonomy of cyber-physical threats, the work in [92] examines a plethora of potential attacks in the smart home environment based on the presented taxonomy. The authors concentrated on both the attack vectors and the potential consequences on the systems and the occupants of such a house.…”

Building Taxonomies based on Human-Machine Teaming

“…There are also studies that focused on building taxonomies for cyber-physical threats and attacks. In [12], Heartfield et al built a taxonomy for the cyber security threats that affect smart homes. In their taxonomy, they considered the impact on both the system and users.…”

Security Analysis of Smart Speaker: Security Attacks and Mitigation

“…Therefore, a smart speaker can be a new target for an attacker to infiltrate into the smart home system. Heartfield et al [Heartfield, Loukas, Budimir et al (2018)] investigated and showed security threat taxonomy in a smart home. They enumerate possible attack vectors in the smart home system from a physical layer such as an infrared sensor and a voice to the application layer.…”