Abstract:In recent years IoT platforms and smart-home systems have rapidly grown. Meanwhile, mobile apps have been widely accepted as user interfaces in these consumer IoTs, allowing users to retrieve processed data and issue specific commands. We notice that these companion apps are also used as gateways, providing Internet connectivity for resource-constrained devices, and its mobility advantage over static gateways further promotes applications of this kind. In this paper, we extracted this pattern into a new architecture called app-in-the-middle IoT. We provided a holistic view of what app-in-the-middle IoT is and introduced its attack surface by comparing it with two well-studied IoT architectures, which we refer to as cloud-in-the-middle IoT and trigger-action platform IoT. We detailed the similarities and differences between the three architectures, derived security goals of app-in-the-middle IoT, and drew the key to analyzing it from authentication, access control, and availability aspects. We adopted a method of building an abstract model and extracting the concept of token from the working process. To achieve security goals, the token needs to own these properties: mutual authentication, unforgeability, and resistance to replay attacks. We argue that the role the app plays is critical to the working process, which affects how the properties of the token are satisfied. During analysis, we find that the application scenarios significantly influence the role of the app. Therefore, we discussed the security of different situations separately. For each scenario, we indicated how the token should be generated and distributed to meet the security goals, and summarized several security rules. We analyzed several practical cases, which demonstrate that violating these rules can lead to severe consequences, such as unauthorized access, information leakage, irrevocable authorization, and device hijack.

Rethinking the Security of IoT from the Perspective of Developer Customized Device-Cloud Interaction.

Rethinking IoT Security: Understanding and Mitigating Out-of-Band Vulnerabilities

IoT Cloud Security Review

Discovering and Understanding the Security Hazards in the Interactions between IoT Devices, Mobile Apps, and Clouds on Smart Home Platforms

Security and Privacy for Cloud-Based IoT: Challenges.

Burglars' IoT Paradise: Understanding and Mitigating Security Risks of General Messaging Protocols on IoT Clouds.

Secure Data Collection, Storage and Access in Cloud-Assisted IoT

Shattered Chain of Trust: Understanding Security Risks in Cross-Cloud IoT Access Delegation.

P-Verifier: Understanding and Mitigating Security Risks in Cloud-based IoT Access Policies

Study to Improve Security for IoT Smart Device Controller: Drawbacks and Countermeasures.

Phantom Device Attack: Uncovering the Security Implications of the Interactions among Devices, IoT Cloud, and Mobile Apps.

IoT Platforms and Security: An Analysis of the Leading Industrial/Commercial Solutions

Understanding the Security of App-in-the-middle IoT

A Survey on IoT Vulnerability Discovery.

Understanding IoT Security Through the Data Crystal Ball: Where We Are Now and Where We Are Going to Be

A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices

Authentication Protocol for Distributed Cloud Computing: an Explanation of the Security Situations for Internet-of-Things-Enabled Devices.

Community-Based Security for the Internet of Things

A Survey on Internet of Things Security from Data Perspectives

IoT Security: An End-to-End View and Case Study

The Dichotomy of Cloud and IoT: Cloud-Assisted IoT From a Security Perspective