SmartAuth: User-Centered Authorization for the Internet of Things
SmartAuth: User-Centered Authorization for the Internet of Things
复制标题
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Yuan Tian;N. Zhang;Yue-Hsun Lin;Xiaofeng Wang;Blase Ur;Xianzheng Guo;P. Tague
中科院分区：
文献类型：
--
作者：
Yuan Tian;N. Zhang;Yue-Hsun Lin;Xiaofeng Wang;Blase Ur;Xianzheng Guo;P. Tague
物联网（IoT）平台通常需要用户向第三方应用程序授予权限，例如控制锁的能力。不幸的是，由于很少有用户根据甚至理解权限屏幕进行操作，因此恶意或粗心的应用程序可能会通过请求不需要的权限而变得特权过高。为了满足物联网独特的安全需求，如跨设备，基于上下文和自动操作，我们提出了一种新的设计，支持以用户为中心，基于语义的“智能”授权。我们的技术称为SmartAuth，它可以自动从物联网应用程序的描述、代码和注释中收集安全相关信息，并生成授权用户界面，以弥合向用户解释的功能与应用程序实际执行的操作之间的差距。通过该接口，可以通过增强现有平台来生成和实施安全策略。为了解决物联网应用程序授权中的独特挑战，其中多个设备的状态用于确定可能在其他设备上发生的操作，我们设计了将设备的上下文（例如，浴室中的湿度传感器）到活动的语义（例如，洗澡）使用自然语言处理和程序分析。我们通过用户研究评估SmartAuth，发现使用SmartAuth的参与者更有可能避免使用特权过高的应用程序。
Internet of Things (IoT) platforms often require users to grant permissions to third-party apps, such as the ability to control a lock. Unfortunately, because few users act based upon, or even comprehend, permission screens, malicious or careless apps can become overprivileged by requesting unneeded permissions. To meet the IoT’s unique security demands, such as cross-device, context-based, and automatic operations, we present a new design that supports user-centric, semantic-based “smart” authorization. Our technique, called SmartAuth , automatically collects security-relevant information from an IoT app’s description, code and annotations, and generates an authorization user interface to bridge the gap between the functionalities explained to the user and the operations the app actually performs. Through the interface, security policies can be generated and enforced by enhancing existing platforms. To address the unique challenges in IoT app authorization, where states of multiple devices are used to determine the operations that can happen on other devices, we devise new technologies that link a device’s context (e.g., a humidity sensor in a bath room) to an activity’s semantics (e.g., taking a bath) using natural language processing and program analysis. We evaluate SmartAuth through user studies, finding participants who use SmartAuth are significantly more likely to avoid overprivileged apps.