Semantics-Aware Understanding and Handling of Security and Privacy Problems in Smart Environments

Abstract

Internet of Things (IoT) platforms enable users to connect heterogeneous resource-constrained wireless devices and deploy semantics-rich home automation applications in smart homes. With the proliferation and fragmentation of IoT products, it even becomes a status quo that many smart IoT devices in a smart home are bounded or delegated to multiple IoT platforms, demonstrating the following characteristics. First, an IoT device may interact with more than one IoT platform. Second, a device can be accessed via multiple communication channels (e.g., Zigbee and Bluetooth). Third, automation applications or rules in a smart home may scatter on different platforms, mainly because each platform has its own strengths and restrictions on the supported IoT devices (e.g., many Google Nest devices are not compatible to work with the Amazon platform) and programming features. Despite the convenience brought by the modern platform-backed systems, a variety of attacks targeting the devices, applications and their interactions arise, which can put the smart home devices to insecure, unsafe, or unexpected states, or can breach users' private information in the daily life. In this dissertation, several semantics-aware security and privacy issues are discussed, analyzed and handled. In one way, we systematically categorized a family of cross-app interference threats and designed a Satisfiability modulo theories (SMT)-based solution to detect them. In another work, we revealed a family of delay-based automation interference attacks that cause cross-rule interference problems in multi-platform multi-path systems. We also studied privacy protection of IoT systems and proposed a semantics-aware customizable data flow control system to protect IoT data from being exploited by third parties and attackers. We also established a command sanitizer solution for detecting cross-app interference problems in multi-platform systems and enforce security and safety policies against various IoT threats. All the works were evaluated in real-world smart home testbeds.