IoTGuard: Dynamic Enforcement of Security and Safety Policy in Commodity IoT

Abstract

Broadly defined as the Internet of Things (IoT), the growth of commodity devices that integrate physical processes with digital connectivity has changed the way we live, play, and work. To date, the traditional approach to securing IoT has treated devices individually. However, in practice, it has been recently shown that the interactions among devices are often the real cause of safety and security violations. In this paper, we present IOTGUARD, a dynamic, policy-based enforcement system for IoT, which protects users from unsafe and insecure device states by monitoring the behavior of IoT and triggeraction platform apps. IOTGUARD operates in three phases: (a) implementation of a code instrumentor that adds extra logic to an app's source code to collect app's information at runtime, (b) storing the apps' information in a dynamic model that represents the runtime execution behavior of apps, and (c) identifying IoT safety and security policies, and enforcing relevant policies on the dynamic model of individual apps or sets of interacting apps. We demonstrate IOTGUARD on 20 flawed apps and find that IOTGUARD correctly enforces 12 of the 12 policy violations. In addition, we evaluate IOTGUARD on 35 SmartThings IoT and 30 IFTTT trigger-action platform market apps executed in a simulated smart home. IOTGUARD enforces 11 unique policies and blocks 16 states in six (17.1%) SmartThings and five (16.6%) IFTTT apps. IOTGUARD imposes only 17.3% runtime overhead on an app and 19.8% for five interacting apps. Through this effort, we introduce a rigorously grounded system for enforcing correct operation of IoT devices through systematically identified IoT policies, demonstrating the effectiveness and value of monitoring IoT apps with tools such as IOTGUARD.

Securing Cross-App Interactions in IoT Platforms

“…Our key observation is that for a system of apps to reach an unsafe configuration, a cross-app interaction should either lead to an inconsistent state that violates the intended specification for some apps, or engage in an interaction where the action of one app triggers the execution of another app. This is supported by the intuition, as well as existing real-world vulnerabilities [12], [14], [15], [17], [36], that an end user may consider a system of IoT apps as safe if the runtime behavior of an app in isolation is bisimilar to running that app in parallel with other apps in the system. Drawing on Focardi and Martinelli's Generalized Non Deducibility on Composition [21], we formalize this intuition to provide a bisimulationbased characterization of safe cross-app interaction.…”

“…Surbatovich et al [36] study a dataset of 20K IFTTT applets and provide an empirical evaluation of potential secrecy and integrity violations, including violations due to crossapp interactions. Celik et al [12], [14] propose static and dynamic enforcement mechanisms for unveiling cross-app interference vulnerabilities. Ding et al [17] propose a framework that combines device physical channel analysis and static analysis to generate all potential interaction chains among applications in an IoT environment.…”

“…A more subtle vulnerability concerns the unintended or malicious interaction between different apps running on behalf on the same user [12], [14], [15], [17], [36]. The distinctive feature of IoT apps to affect a shared physical environment such as the room temperature, may enable unintended crossapp interactions between IoT apps that are installed by the same user.…”

“…Recent research identifies numerous use cases of crossapp interactions that violate specific policies, and suggests tracking dependencies across IoT apps to identify policy violations [12], [14], [15], [17], [36]. These mechanisms perform inter-application program analysis to track depen-dencies, and (manual or automatic) language processing to identify semantically-related language constructs, e.g., the fact that temperature and thermostat refer to related semantic constructs, despite their syntax being different.…”

Clockwork: Tracking Remote Timing Attacks

“…Recent research [10], [16], [17], [25], [26], [34], [58] identifies ways to leak private information by malicious IoT apps and suggests information flow tracking as countermeasure. The suggested mechanisms perform data-flow (explicit [30]) and control-flow (implicit [30]) tracking.…”