Context-Aware IoT Device Functionality Extraction from Specifications for Ensuring Consumer Security
Context-Aware IoT Device Functionality Extraction from Specifications for Ensuring Consumer Security
复制标题
DOI：
10.1109/cns53000.2021.9705050
复制
发表时间：
2021-10
期刊：
影响因子：
--
通讯作者：
Upakar Paudel;Andy Dolan;Suryadipta Majumdar;I. Ray
中科院分区：
文献类型：
--
作者：
Upakar Paudel;Andy Dolan;Suryadipta Majumdar;I. Ray
物联网（IoT）设备正在智能家居和组织中广泛使用。物联网设备具有一些预期用途，但也可能具有隐藏的功能。通常，设备安装在家庭或组织中，并且捕获和分析与设备相关联的网络流量以尽可能地推断高级功能。然而，这种分析本质上是动态的，并且需要安装设备和访问网络数据，而由于隐私和保密原因，这通常很难获得。我们提出了一种替代的静态方法，可以推断出一个设备的功能，从供应商的材料，使用自然语言处理（NLP）技术。有关物联网设备功能的信息可以用于各种应用，其中之一是确保智能家居的安全性。我们演示了如何与智能家居中的设备功能相关的安全策略可以使用NIST下一代访问控制（NGAC）模型进行正式表示，并使用Alloy（一种正式的验证工具）进行自动分析。这将向消费者保证，这些设备甚至在购买之前就符合家庭或组织政策。
Internet of Thing (IoT) devices are being widely used in smart homes and organizations. An IoT device has some intended purposes, but may also have hidden functionalities. Typically, the device is installed in a home or an organization and the network traffic associated with the device is captured and analyzed to infer high-level functionality to the extent possible. However, such analysis is dynamic in nature, and requires the installation of the device and access to network data which is often hard to get for privacy and confidentiality reasons. We propose an alternative static approach which can infer the functionality of a device from vendor materials using Natural Language Processing (NLP) techniques. Information about IoT device functionality can be used in various applications, one of which is ensuring security in a smart home. We demonstrate how security policies associated with device functionality in a smart home can be formally represented using the NIST Next Generation Access Control (NGAC) model and automatically analyzed using Alloy, which is a formal verification tool. This will provide assurance to the consumer that these devices will be compliant to the home or organizational policy even before they have been purchased.