Privacy Leakage Analysis for Colluding Smart Apps
Privacy Leakage Analysis for Colluding Smart Apps
复制标题
DOI：
10.1109/dsn-w54100.2022.00025
复制
发表时间：
2022-06
期刊：
影响因子：
--
通讯作者：
Junzhe Wang;Lannan Luo
中科院分区：
文献类型：
--
作者：
Junzhe Wang;Lannan Luo
物联网（IoT）的快速普及推动了智能环境的发展。通过在物联网平台上安装智能应用程序，用户可以集成物联网设备以实现便捷的自动化。由于智能应用程序会接触到来自设备的大量敏感数据，因此一个严重的问题是这些数字增强空间的隐私。最近的工作 SAINT [1] 被提议使用污点分析来检测各个智能应用程序中的敏感数据流。但由于对污点种子和污点汇的考虑不当，其误报和漏报率很高。现有工作忽略的一个重要安全问题是物联网平台支持亲子智能应用程序。然而，他们的通信能力会对安全产生负面影响。我们把亲子智能应用称为合谋智能应用。不幸的是，没有工具可以检测智能应用程序的串通行为。我们提出PDColA，它解决了SAINT的局限性，更重要的是，可以通过串通智能应用程序来检测隐私泄露。评估结果表明，PDColA在检测单个智能应用的隐私泄露方面比SAINT具有更高的准确率，并且能够有效地检测智能应用串通造成的隐私泄露。
The rapid proliferation of Internet-of-Things (IoT) has advanced the development of smart environments. By installing smart apps on IoT platforms, users can integrate IoT devices for convenient automation. As smart apps are exposed to a myriad of sensitive data from devices, one severe concern is about the privacy of these digitally augmented spaces. The recent work SAINT [1] has been proposed to detect sensitive data flows in individual smart apps using taint analysis. But it has high false positives and false negatives due to inappropriate consideration of taint seeds and taint sinks.One important security issue ignored by existing work is that the IoT platform supports parent-child smart apps. Their ability to communicate, however, has a negative effect on security. We call the parent-child smart apps colluding smart apps. Unfortunately, no tool exists to detect smart app collusion. We propose PDColA, which addresses the limitations of SAINT, and more importantly, can detect privacy leakages by colluding smart apps. The evaluation results show that PDColA achieves higher accuracies than SAINT in detecting privacy leakages by individual smart apps, and is effective to detect privacy leakages by colluding smart apps.