Towards Practical Integrity in the Smart Home with HomeEndorser
This addresses security vulnerabilities in smart home automation for users, though it is incremental as it builds on existing platform-based approaches.
The paper tackles the integrity problem in smart home platforms where untrusted third-parties can modify abstract home objects (AHOs) to attack high-integrity devices, proposing the HomeEndorser framework that uses home abstraction endorsement to correlate AHO changes with environmental changes. It evaluates HomeEndorser on HomeAssistant, deriving over 1000 policy rules for 6 key AHOs with less than 10% overhead and no false alarms.
Home automation in modern smart home platforms is often facilitated using trigger-action routines. While such routines enable flexible automation, they also lead to an instance of the integrity problem in these systems: untrusted third-parties may use platform APIs to modify the abstract home objects (AHOs) that privileged, high-integrity devices such as security cameras rely on (i.e., as triggers), thereby transitively attacking them. As most accesses to AHOs are legitimate, removing the permissions or applying naive information flow controls would not only fail to prevent these problems, but also break useful functionality. Therefore, this paper proposes the alternate approach of home abstraction endorsement, which endorses a proposed change to an AHO by correlating it with certain specific, preceding, environmental changes. We present the HomeEndorser framework, which provides a policy model for specifying endorsement policies for AHOs as changes in device states, relative to their location, and a platform-based reference monitor for mediating all API requests to change AHOs against those device states. We evaluate HomeEndorser on the HomeAssistant platform, finding that we can derive over 1000 policy rules for HomeEndorser to endorse changes to 6 key AHOs, preventing malice and accidents for less than 10% overhead for endorsement check microbenchmarks, and with no false alarms under realistic usage scenarios. In doing so, HomeEndorser lays the first steps towards providing a practical foundation for ensuring that API-induced changes to abstract home objects correlate with the physical realities of the user's environment.