Security Requirements and Tests for Smart Toys

Carvalho, Luciano Gonçalves de; Eler, Marcelo Medeiros

doi:10.1007/978-3-319-93375-7_14

Cited by 7 publications

(7 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Besides, the RPT must support LPS and non-PID collection by combining both long and short-range wireless communication protocols (e.g., NFC/RFID, Bluetooth). Note that by limiting PD collection does not minimize the need for adequate privacy policies and data security approaches [13,14]. In that way, all communication between the interface components must comply with data security models and universal standards.…”

Section: Page 1492mentioning

confidence: 99%

“…Finally, to improve reliability and circumvent the identified vulnerabilities, we select the following data Security Requirement (SR) items for smart toys, which were proposed by de Carvalho and Eler [14].…”

Section: Technical Assessmentmentioning

confidence: 99%

“…Thus, we adapted the SR5 to cover NFC communication. It may suggest that taxonomy of vulnerabilities [13] and SR items [14] must be expanded to cover a broader range of smart toys solutions [2]. In Table 5, we relate the SR items with potential threats.…”

Section: Technical Assessmentmentioning

confidence: 99%

“…We also carry a vulnerability analysis for data security and privacy threats [13], which include simulating attacks to access and configure the communication modules and mobile applications (when applicable). Then, we select security strategies to solve the identified vulnerabilities [14]. Finally, in Section 7, we summarize needed improvements that cover topics on miniaturization, robustness, and reliability.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

IoT4Fun Rapid Prototyping Toolkit for Smart Toys

Albuquerque

Kelner

Nogueira

et al. 2020

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Rapid prototyping tools turn the design of smart toys faster and easier for creative teams. Appropriate tools for smart toys should meet a list of requirements, which include distributed data collection and adaptability for assorted toy shapes and size. The IoT4Fun toolkit innovates by mixing the embedded, modular, and plugand-play approaches. It supports motion tracking data, wireless communication, and contactless identification. IoT4Fun demonstrates its effectiveness to design a variety of smart toy solutions by fitting into a hula-hoop toy until spherical, cubic, and wearable shapes. Solutions connect with either mobile applications or other toys and play rules range from open-ended to closed behaviors. End-users exhaustively tested developed solutions, and technical assessment evaluates their integrity after playtesting sessions. Results show comparative data on battery consumption and vulnerabilities threats for data security and privacy of each design. Future versions of IoT4Fun can benefit from miniaturization, robustness, and reliability improvements. As a means to demonstrate adequacy with elicited requirements, in Section 3, we first compare IoT4Fun features with other RPTs from literature and industry [1,4,5,6,7,8,9,10,11,12]. In Section 4, we introduce IoT4Fun, a toolkit that combines embedded, modular, and plug-and-play approaches. The first approach aims to embed the same RPT into different physical toys. Modularity permits better distribution of the hardware components and allows creators to decide which modules are essential to their solutions. The plug-andplay approach offers a rapid and easy-to-use experience for the creators to manage the modules. IoT4Fun uses Printed-Circuit Board (PCB) manufacture to favor miniaturization and robustness. It collects real-time motion tracking information, supports wireless communication with devices, and contactless identification of objects or users. Besides, it offers visual, auditory, and tactile feedback and permits programming all play behaviors using Arduino IDE. In Section 5, we detail how a group of 27 graduate students embedded IoT4Fun into five smart toy prototypes. Students selected RPT modules that were suitable for their designs. Prototypes present a variety of shapes and sizes (e.g., a hula-hoop toy, a plush toy, a hand-sized cube, a large box, and a glove). Solutions either connect with mobile applications or with tagged objects, and programmed behaviors range from openended play to closed-rules. A total of 40 end-users (23 males/17 females) exhaustively tested the prototypes in playtesting sessions. In Section 6, we check for the

show abstract

Section: Page 1492mentioning

confidence: 99%

Section: Technical Assessmentmentioning

confidence: 99%

Section: Technical Assessmentmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

IoT4Fun Rapid Prototyping Toolkit for Smart Toys

Albuquerque

Kelner

Nogueira

et al. 2020

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

show abstract

“…This section surveys and analyzes Data Flow Diagram (DFD), Privacy-Aware Data Flow Diagram (PA-DFD), and Privacy by Design (PbD) widely adopted preferred models use in the SCT design. For example, de Cavalho, and Eler [18] used high-level DFD to model data flow in order to identify privacy and security threats within the smart toy environment. To ascertain detail requirements of system development, DFDs are used to produce the process model [8].…”

Section: Data Flow Model and Petri-netsmentioning

confidence: 99%

Modeling Privacy Preservation in Smart Connected Toys by Petri-Nets

Yankson¹,

Iqbal²,

Lu³

et al. 2019

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Children data privacy must be considered as integral and factored into the system design of Smart Connected Toy (SCT). The challenge is that SCTs are capable to gather significant amount volunteered and nonvolunteered data, which lacks privacy considerations. It is imperative to adopt a modeling technique that autonomously preserves privacy and secure children's data in SCT transactions. This paper surveys the current data flow modeling techniques, which most of them do not have elements to address the privacy of Personal Identifiable Information (PII). This paper shows a Petri-Net simulation which provides privacy assurance in order to minimize the risk of privacy violation of a child's PII and related data.

show abstract