Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, 2016, p.461-472
2016
Volltextzugriff (PDF)
Details
- Autor(en) / Beteiligte
- Titel
- Smart Locks: Lessons for Securing Commodity Internet of Things Devices
- Ist Teil von
- Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, 2016, p.461-472
- Ort / Verlag
- New York, NY, USA: ACM
- Erscheinungsjahr
- 2016
- Quelle
- ACM Digital Library
- Beschreibungen/Notizen
- We examine the security of home smart locks: cyber-physical devices that replace traditional door locks with deadbolts that can be electronically controlled by mobile devices or the lock manufacturer's remote servers. We present two categories of attacks against smart locks and analyze the security of five commercially-available locks with respect to these attacks. Our security analysis reveals that flaws in the design, implementation, and interaction models of existing locks can be exploited by several classes of adversaries, allowing them to learn private information about users and gain unauthorized home access. To guide future development of smart locks and similar Internet of Things devices, we propose several defenses that mitigate the attacks we present. One of these defenses is a novel approach to securely and usably communicate a user's intended actions to smart locks, which we prototype and evaluate. Ultimately, our work takes a first step towards illuminating security challenges in the system design and novel functionality introduced by emerging IoT systems.
- Sprache
- Englisch
- Identifikatoren
- ISBN: 9781450342339, 1450342337DOI: 10.1145/2897845.2897886Titel-ID: cdi_acm_books_10_1145_2897845_2897886
- Format
- –
- Schlagworte
- Security and privacy, Security and privacy -- Cryptography -- Key management, Security and privacy -- Formal methods and theory of security -- Security requirements, Security and privacy -- Human and societal aspects of security and privacy -- Usability in security and privacy, Security and privacy -- Security services -- Access control, Security and privacy -- Security services -- Authentication, Security and privacy -- Security services -- Authentication -- Biometrics, Security and privacy -- Security services -- Authorization, Security and privacy -- Security services -- Privacy-preserving protocols, Security and privacy -- Software and application security -- Software security engineering, Security and privacy -- Systems security -- Distributed systems security, Security and privacy -- Systems security -- Operating systems security -- Mobile platform security