Security Analysis of Smart Home Based on Life Cycle
Yuhang Mao, Xuejun Li, Yan Jia, Shangru Zhao, Yuqing Zhang · 2019
With the rapid development of the Internet of Things (IoT) technology, security and privacy issues in the smart home have become the focus of extensive research. However, due to the differences in smart home solutions, especially the complex communication protocols and the wide variety of IoT devices, it is difficult for security researchers to systematically and comprehensively study the security of smart home. In this paper, we propose a novel security analysis method based on the life cycle of smart home, including the complete process of the user using IoT devices in smart home scenario, and take user, samrt device and IoT cloud as the research object. Moreover, in order to figure out the life cycle of smart home from different manufacturers, we propose a tool, called IoTCap (IoT Capture), to study the security and privacy issues of the smart home. The fundamental approach used in this tool is to capture IP-layer data packets sent and received by smart appliance on the user's mobile phone, and to analyze the contents of the data packets. Using this tool to recover the workflow and interaction process of the smart home, we further analyze security risks at all stages of the life cycle, including identity authentication, access control, protocol security, and privacy protection. The experimental results have shown that the method is feasible. We believe that this tool will be the basis of a general automation framework for analyzing the security and privacy of smart home.