A threat-model for building and home automation

Abstract

Security and privacy are very important assets within building and home automation because the System Control Unit (SCU) stores and processes a huge amount of data about the inhabitants or employees of the building. This data is necessary for managing the building and increasing the convenience of persons within. But this data can also be used to create a movement profile, monitor working times, and draw conclusions about people's health situation. Modern smart home implementations also control many actuators within the building including doors, windows, locks, and fire extinguisher. These increase security and safety, but unauthorized control can reduce the security and can even be harmful to persons. Therefore, identifying the different security and privacy threats is very important and helps system engineers and system managers to develop and deploy secure systems. This work presents an abstract model of a building automation system and some attack trees which simplify threat identification. Attack trees are common in secure software development and secure system deployment. An example smart home deployment is evaluated using the proposed model and attack trees to show the feasibility.