Privacy Risk Assessment of Smart Home System Based on a STPA–FMEA Method

Abstract

Although the smart home industry is rapidly emerging, it faces the risk of privacy security that cannot be neglected. As this industry now has a complex combination system involving multiple subjects, it is difficult for the traditional risk assessment method to meet these new security requirements. In this study, a privacy risk assessment method based on the combination of system theoretic process analysis–failure mode and effect analysis (STPA–FMEA) is proposed for a smart home system, considering the interaction and control of ‘user-environment-smart home product’. A total of 35 privacy risk scenarios of ‘component-threat-failure-model-incident’ combinations are identified. The risk priority numbers (RPN) was used to quantitatively assess the level of risk for each risk scenario and the role of user and environmental factors in influencing the risk. According to the results, the privacy management ability of users and the security state of the environment have significant effects on the quantified values of the privacy risks of smart home systems. The STPA–FMEA method can identify the privacy risk scenarios of a smart home system and the insecurity constraints in the hierarchical control structure of the system in a relatively comprehensive manner. Additionally, the proposed risk control measures based on the STPA–FMEA analysis can effectively reduce the privacy risk of the smart home system. The risk assessment method proposed in this study can be widely applied to the field of risk research of complex systems, and this study can contribute to the improvement of privacy security of smart home systems.

Exploring the Impact of METO Factors with Data Privacy Changes at IoT Systems: A Comprehensive Review

“…This impact on risk communication between the public and private sectors requires attention. This paper investigates environmental characteristics related to environmental privacy risks [52], network environment [31], [52], and physical environment [31]. These findings provide insights into factors, subfactors, and issues from environmental perspectives, as outlined in Table 6.…”

Enhancing Safety in IoT Systems: A Model-Based Assessment of a Smart Irrigation System Using Fault Tree Analysis

“…Notably, FMEA is also used for failure analysis of smart agriculture [66]. Using FMEA, critical components and functions are identified, and failure modes are evaluated based on their severity, probability of occurrence, and detectability [67,68]. The Risk Priority Number (RPN) is calculated for each failure mode, and necessary mitigation strategies are adopted.…”

“…The Risk Priority Number (RPN) is calculated for each failure mode, and necessary mitigation strategies are adopted. High-RPN failure modes are prioritised through improved design, redundancy, maintenance, or additional safety measures [67].…”

An Enhancement Method in Few-Shot Scenarios for Intrusion Detection in Smart Home Environments

“…There is currently a limited amount of research focusing on smart home security, with most studies primarily concentrating on hardware design and passive defense measures. For instance, the authors of [3] propose a method for privacy risk assessment and risk control measures to address privacy security concerns. The authors of [4] describe a provable security authentication scheme to ensure the security of the smart home environment.…”