首页 > 最新文献

Proceedings of the 2017 Workshop on Internet of Things Security and Privacy最新文献

英文 中文
Smart Solution, Poor Protection: An Empirical Study of Security and Privacy Issues in Developing and Deploying Smart Home Devices 智能解决方案,缺乏保护:智能家居设备开发和部署中的安全和隐私问题的实证研究
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139948
Hui Liu, Changyu Li, Xuancheng Jin, Juanru Li, Yuanyuan Zhang, Dawu Gu
The concept of Smart Home drives the upgrade of home devices from traditional mode to an Internet-connected version. Instead of developing the smart devices from scratch, manufacturers often utilize existing smart home solutions released by large IT companies (e.g., Amazon, Google) to help build the smart home network. A smart home solution provides components such as software development kit (SDK) and relevant management system to boost the development and deployment of smart home devices. Nonetheless, the participating of third-party SDKs and management systems complicates the workflow of such devices. If not meticulously assessed, the complex workflow often leads to the violation of privacy and security to both the consumer and the manufacturer. In this paper, we illustrate how the security and privacy of smart home devices are affected by JoyLink, a widely used smart home solution. We demonstrate a concrete analysis combined with network traffic interception, source code audit, and binary code reverse engineering to evince that the design of smart home solution is error-prone. We argue that if the security and privacy issues are not considered, devices using the solution are inevitably vulnerable and thus the privacy and security of smart home are seriously threatened.
智能家居的概念推动着家居设备从传统模式向联网模式的升级。制造商通常利用大型IT公司(如亚马逊、谷歌)发布的现有智能家居解决方案来帮助构建智能家居网络,而不是从头开始开发智能设备。智能家居解决方案提供SDK (software development kit)和相关管理系统等组件,促进智能家居设备的开发和部署。尽管如此,第三方sdk和管理系统的参与使这些设备的工作流程变得复杂。如果不仔细评估,复杂的工作流程通常会导致侵犯消费者和制造商的隐私和安全。在本文中,我们说明了JoyLink,一个广泛使用的智能家居解决方案是如何影响智能家居设备的安全和隐私的。我们结合网络流量拦截、源代码审计和二进制代码逆向工程进行具体分析,以证明智能家居解决方案的设计容易出错。我们认为,如果不考虑安全和隐私问题,使用该解决方案的设备不可避免地会受到攻击,从而严重威胁智能家居的隐私和安全。
{"title":"Smart Solution, Poor Protection: An Empirical Study of Security and Privacy Issues in Developing and Deploying Smart Home Devices","authors":"Hui Liu, Changyu Li, Xuancheng Jin, Juanru Li, Yuanyuan Zhang, Dawu Gu","doi":"10.1145/3139937.3139948","DOIUrl":"https://doi.org/10.1145/3139937.3139948","url":null,"abstract":"The concept of Smart Home drives the upgrade of home devices from traditional mode to an Internet-connected version. Instead of developing the smart devices from scratch, manufacturers often utilize existing smart home solutions released by large IT companies (e.g., Amazon, Google) to help build the smart home network. A smart home solution provides components such as software development kit (SDK) and relevant management system to boost the development and deployment of smart home devices. Nonetheless, the participating of third-party SDKs and management systems complicates the workflow of such devices. If not meticulously assessed, the complex workflow often leads to the violation of privacy and security to both the consumer and the manufacturer. In this paper, we illustrate how the security and privacy of smart home devices are affected by JoyLink, a widely used smart home solution. We demonstrate a concrete analysis combined with network traffic interception, source code audit, and binary code reverse engineering to evince that the design of smart home solution is error-prone. We argue that if the security and privacy issues are not considered, devices using the solution are inevitably vulnerable and thus the privacy and security of smart home are seriously threatened.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130200744","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 25
Security & Privacy in Smart Toys 智能玩具的安全和隐私
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139947
J. Valente, A. Cárdenas
We analyze the security practices of three smart toys that communicate with children through voice commands. We show the general communication architecture, and some general security and privacy practices by each of the devices. Then we focus on the analysis of one particular toy, and show how attackers can decrypt communications to and from a target device, and perhaps more worryingly, the attackers can also inject audio into the toy so the children listens to any arbitrary audio file the attacker sends to the toy. This last attack raises new safety concerns that manufacturers of smart toys should prevent.
我们分析了三种通过语音命令与儿童交流的智能玩具的安全实践。我们展示了每个设备的通用通信架构,以及一些通用的安全和隐私实践。然后我们集中分析一个特定的玩具,并展示攻击者如何解密与目标设备的通信,也许更令人担忧的是,攻击者还可以将音频注入玩具中,这样孩子们就可以收听攻击者发送给玩具的任意音频文件。最近的攻击引发了新的安全担忧,智能玩具制造商应该加以防范。
{"title":"Security & Privacy in Smart Toys","authors":"J. Valente, A. Cárdenas","doi":"10.1145/3139937.3139947","DOIUrl":"https://doi.org/10.1145/3139937.3139947","url":null,"abstract":"We analyze the security practices of three smart toys that communicate with children through voice commands. We show the general communication architecture, and some general security and privacy practices by each of the devices. Then we focus on the analysis of one particular toy, and show how attackers can decrypt communications to and from a target device, and perhaps more worryingly, the attackers can also inject audio into the toy so the children listens to any arbitrary audio file the attacker sends to the toy. This last attack raises new safety concerns that manufacturers of smart toys should prevent.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114540216","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 57
Computer Security and Privacy for the Physical World 物理世界的计算机安全和隐私
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139956
Earlence Fernandes
Many physical processes today are augmented with computerized control. Everything ranging from homes to cities are being digitally connected to each other, and to software. Although these connections have resulted in many useful benefits, malicious entities have exploited this new Internet of Things (IoT) to cause damage. In this talk, I'll briefly discuss recent results in securing these emerging IoT systems. I will also outline a few open questions in the field.
今天,计算机控制增强了许多物理过程。从家庭到城市的一切都在以数字方式相互连接,并与软件连接。尽管这些连接带来了许多有用的好处,但恶意实体已经利用这种新的物联网(IoT)造成损害。在这次演讲中,我将简要讨论在保护这些新兴物联网系统方面的最新成果。我还将概述该领域的一些悬而未决的问题。
{"title":"Computer Security and Privacy for the Physical World","authors":"Earlence Fernandes","doi":"10.1145/3139937.3139956","DOIUrl":"https://doi.org/10.1145/3139937.3139956","url":null,"abstract":"Many physical processes today are augmented with computerized control. Everything ranging from homes to cities are being digitally connected to each other, and to software. Although these connections have resulted in many useful benefits, malicious entities have exploited this new Internet of Things (IoT) to cause damage. In this talk, I'll briefly discuss recent results in securing these emerging IoT systems. I will also outline a few open questions in the field.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123468326","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A Secure Event Logging System for Smart Homes 智能家居的安全事件记录系统
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139945
S. Avizheh, Tam Thanh Doan, Xi Liu, R. Safavi-Naini
Smart homes include hundreds of devices that generate messages, and communicate with each other and the world outside the home, to provide a highly functional, optimized and personalized environment for residents. A secure and reliable event logging system is an essential component of smart homes with a wide range of applications such as fault detection, forensics and accounting. Existing smart home IoT frameworks are cloud-based and privacy of fine-grained log data is a real concern. In this paper we propose a host-based conceptual framework for storing and processing data in smart homes, analyze security requirements of such environments and design a forward secure event logging system that satisfies these environments. We give an overview of our implementation of a message (event) logging system for a typical home, and present efficiency evaluation of our cryptographic design.
智能家居包括数百个设备,这些设备可以生成信息,并与彼此和家庭外的世界进行通信,为居民提供一个功能强大、优化和个性化的环境。安全可靠的事件日志系统是智能家居的重要组成部分,具有广泛的应用,如故障检测,取证和会计。现有的智能家居物联网框架是基于云的,细粒度日志数据的隐私是一个真正的问题。本文提出了一种基于主机的智能家居数据存储和处理的概念框架,分析了智能家居环境的安全需求,并设计了一种满足这些环境的前向安全事件日志系统。我们概述了一个典型家庭的消息(事件)日志系统的实现,并对我们的加密设计进行了效率评估。
{"title":"A Secure Event Logging System for Smart Homes","authors":"S. Avizheh, Tam Thanh Doan, Xi Liu, R. Safavi-Naini","doi":"10.1145/3139937.3139945","DOIUrl":"https://doi.org/10.1145/3139937.3139945","url":null,"abstract":"Smart homes include hundreds of devices that generate messages, and communicate with each other and the world outside the home, to provide a highly functional, optimized and personalized environment for residents. A secure and reliable event logging system is an essential component of smart homes with a wide range of applications such as fault detection, forensics and accounting. Existing smart home IoT frameworks are cloud-based and privacy of fine-grained log data is a real concern. In this paper we propose a host-based conceptual framework for storing and processing data in smart homes, analyze security requirements of such environments and design a forward secure event logging system that satisfies these environments. We give an overview of our implementation of a message (event) logging system for a typical home, and present efficiency evaluation of our cryptographic design.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117333186","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 11
Enabling Multi-user Controls in Smart Home Devices 在智能家居设备中启用多用户控制
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139941
William Jang, Adil Chhabra, Aarathi Prasad
The Internet of Things (IoT) devices have expanded into many aspects of everyday life. As these smart home devices grow more popular, security concerns increase. Researchers have modeled the privacy and security threats for smart home devices, but have yet to fully address the problem of unintended user access within the home. Often, smart home devices are purchased by one of the family members and associated with the same family member's account, yet are shared by the entire home. Currently most devices implement a course-grained access control model where someone in the home either has complete access or no access. We provide scenarios that highlight the need for exible authorization control and seamless authentication in IoT devices, especially in multi-user environments. We present design recommendations for IoT device manufacturers to provide fine-grained access control and authentication and describe the challenges to meeting the expectations of all users within a home.
物联网(IoT)设备已经扩展到日常生活的许多方面。随着这些智能家居设备越来越受欢迎,安全问题也越来越多。研究人员已经对智能家居设备的隐私和安全威胁进行了建模,但尚未完全解决用户在家中无意访问的问题。通常,智能家居设备是由家庭成员之一购买的,并与同一家庭成员的账户相关联,但却由整个家庭共享。目前,大多数设备都实现了细粒度访问控制模型,其中家中的人要么完全访问,要么没有访问。我们提供的场景强调了物联网设备中灵活的授权控制和无缝认证的需求,特别是在多用户环境中。我们为物联网设备制造商提供了设计建议,以提供细粒度的访问控制和身份验证,并描述了满足家庭中所有用户期望的挑战。
{"title":"Enabling Multi-user Controls in Smart Home Devices","authors":"William Jang, Adil Chhabra, Aarathi Prasad","doi":"10.1145/3139937.3139941","DOIUrl":"https://doi.org/10.1145/3139937.3139941","url":null,"abstract":"The Internet of Things (IoT) devices have expanded into many aspects of everyday life. As these smart home devices grow more popular, security concerns increase. Researchers have modeled the privacy and security threats for smart home devices, but have yet to fully address the problem of unintended user access within the home. Often, smart home devices are purchased by one of the family members and associated with the same family member's account, yet are shared by the entire home. Currently most devices implement a course-grained access control model where someone in the home either has complete access or no access. We provide scenarios that highlight the need for exible authorization control and seamless authentication in IoT devices, especially in multi-user environments. We present design recommendations for IoT device manufacturers to provide fine-grained access control and authentication and describe the challenges to meeting the expectations of all users within a home.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"87 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121017841","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 36
Low-Cost Standard Public Key Cryptography Services for Wireless IoT Systems 无线物联网系统的低成本标准公钥加密服务
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139940
Muslum Ozgur Ozmen, A. Yavuz
Internet of Things (IoT) is an integral part of application domains such as smart-home and digital healthcare. Various standard public key cryptography techniques (e.g., key exchange, public key encryption, signature) are available to provide fundamental security services for IoTs. However, despite their pervasiveness and well-proven security, they also have been shown to be highly energy costly for embedded devices. Hence, it is a critical task to improve the energy efficiency of standard cryptographic services, while preserving their desirable properties simultaneously. In this paper, we exploit synergies among various cryptographic primitives with algorithmic optimizations to substantially reduce the energy consumption of standard cryptographic techniques on embedded devices. Our contributions are: (i) We harness special precomputation techniques, which have not been considered for some important cryptographic standards to boost the performance of key exchange, integrated encryption, and hybrid constructions. (ii) We provide self-certification for these techniques to push their performance to the edge. (iii) We implemented our techniques and their counterparts on 8-bit AVR ATmega 2560 and evaluated their performance. We used microECC library and made the implementations on NIST-recommended secp192 curve, due to its standardization. Our experiments confirmed significant improvements on the battery life (up to 7x) while preserving the desirable properties of standard techniques. Moreover, to the best of our knowledge, we provide the first open-source framework including such set of optimizations on low-end devices.
物联网(IoT)是智能家居和数字医疗等应用领域不可或缺的一部分。各种标准的公钥加密技术(如密钥交换、公钥加密、签名)可以为物联网提供基础安全服务。然而,尽管它们的普及和良好的安全性,它们也被证明对嵌入式设备来说是非常昂贵的能源。因此,提高标准加密服务的能源效率,同时保持其理想的特性是一项关键任务。在本文中,我们利用各种加密原语与算法优化之间的协同作用,以大大降低嵌入式设备上标准加密技术的能耗。我们的贡献是:(i)我们利用特殊的预计算技术来提高密钥交换、集成加密和混合结构的性能,这些技术尚未被一些重要的加密标准所考虑。(ii)我们为这些技术提供自我认证,将其性能推向极致。(iii)我们在8位AVR ATmega 2560上实现了我们的技术和相应的技术,并评估了它们的性能。由于其标准化,我们使用microECC库并在nist推荐的secp192曲线上实现。我们的实验证实了电池寿命的显著改善(高达7倍),同时保留了标准技术的理想特性。此外,据我们所知,我们提供了第一个在低端设备上包含这样一组优化的开源框架。
{"title":"Low-Cost Standard Public Key Cryptography Services for Wireless IoT Systems","authors":"Muslum Ozgur Ozmen, A. Yavuz","doi":"10.1145/3139937.3139940","DOIUrl":"https://doi.org/10.1145/3139937.3139940","url":null,"abstract":"Internet of Things (IoT) is an integral part of application domains such as smart-home and digital healthcare. Various standard public key cryptography techniques (e.g., key exchange, public key encryption, signature) are available to provide fundamental security services for IoTs. However, despite their pervasiveness and well-proven security, they also have been shown to be highly energy costly for embedded devices. Hence, it is a critical task to improve the energy efficiency of standard cryptographic services, while preserving their desirable properties simultaneously. In this paper, we exploit synergies among various cryptographic primitives with algorithmic optimizations to substantially reduce the energy consumption of standard cryptographic techniques on embedded devices. Our contributions are: (i) We harness special precomputation techniques, which have not been considered for some important cryptographic standards to boost the performance of key exchange, integrated encryption, and hybrid constructions. (ii) We provide self-certification for these techniques to push their performance to the edge. (iii) We implemented our techniques and their counterparts on 8-bit AVR ATmega 2560 and evaluated their performance. We used microECC library and made the implementations on NIST-recommended secp192 curve, due to its standardization. Our experiments confirmed significant improvements on the battery life (up to 7x) while preserving the desirable properties of standard techniques. Moreover, to the best of our knowledge, we provide the first open-source framework including such set of optimizations on low-end devices.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"98 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128709300","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
Understanding Security Threats in Consumer Drones Through the Lens of the Discovery Quadcopter Family 通过发现四轴飞行器家族的镜头了解消费无人机的安全威胁
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139943
J. Valente, A. Cárdenas
In this paper we identify new threats to drones in an effort to have a better public discussion of realistic attacks that vendors need to take into consideration when designing their products. In particular we study in detail the security of a new drone family (U818A) released in 2016, which is quickly becoming a best-selling brand, and is re-purposed and sold by a variety of drone vendors. We implemented and tested several attacks and considered privacy issues (e.g., remotely accessing someone else's drone to take video or images of a private setting), security issues (e.g., stealing a drone mid-flight), and safety issues (e.g., taking down a drone operated by someone else). We finish the paper by recommending basic steps to improve the security of drones.
在本文中,我们确定了无人机面临的新威胁,以便更好地公开讨论供应商在设计产品时需要考虑的现实攻击。特别是我们详细研究了2016年发布的新无人机家族(U818A)的安全性,该家族正迅速成为最畅销的品牌,并由各种无人机供应商重新利用和销售。我们实施并测试了几种攻击,并考虑了隐私问题(例如,远程访问其他人的无人机拍摄私人设置的视频或图像),安全问题(例如,在飞行中窃取无人机)和安全问题(例如,取下由其他人操作的无人机)。最后,我们提出了提高无人机安全性的基本步骤。
{"title":"Understanding Security Threats in Consumer Drones Through the Lens of the Discovery Quadcopter Family","authors":"J. Valente, A. Cárdenas","doi":"10.1145/3139937.3139943","DOIUrl":"https://doi.org/10.1145/3139937.3139943","url":null,"abstract":"In this paper we identify new threats to drones in an effort to have a better public discussion of realistic attacks that vendors need to take into consideration when designing their products. In particular we study in detail the security of a new drone family (U818A) released in 2016, which is quickly becoming a best-selling brand, and is re-purposed and sold by a variety of drone vendors. We implemented and tested several attacks and considered privacy issues (e.g., remotely accessing someone else's drone to take video or images of a private setting), security issues (e.g., stealing a drone mid-flight), and safety issues (e.g., taking down a drone operated by someone else). We finish the paper by recommending basic steps to improve the security of drones.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130126282","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 37
Proceedings of the 2017 Workshop on Internet of Things Security and Privacy 2017物联网安全与隐私研讨会论文集
Peng Liu, Yuqing Zhang, Theophilus A. Benson, S. Sundaresan
It is our great pleasure to welcome you to the First Workshop on Internet of Things Security & Privacy - IoT S&P'17. This year's workshop begins a tradition of bringing together networking and security researchers to analyze and tackle security and privacy challenges introduced by the growing number of Internet of Things devices and deployments. The mission of the workshop is to share novel measurements, techniques and insights that identify new directions for future research and development. IoT S&P gives researchers and practitioners a unique opportunity to share their perspectives with others interested in the various aspects of IoT security and privacy We also encourage attendees to attend the keynote and poster presentations. These valuable and insightful talks can and will guide us to a better understanding of the future: Computer Security and Privacy for the Physical World, Earlence Fernandes (who is currently at University of Washington
我们非常高兴地欢迎您参加第一届物联网安全与隐私研讨会- IoT标准普尔17。今年的研讨会延续了以往的传统,将网络和安全研究人员聚集在一起,分析和解决越来越多的物联网设备和部署带来的安全和隐私挑战。研讨会的使命是分享新的测量方法、技术和见解,为未来的研究和发展确定新的方向。物联网标准普尔为研究人员和从业人员提供了一个独特的机会,与对物联网安全和隐私各个方面感兴趣的其他人分享他们的观点。我们还鼓励与会者参加主题演讲和海报演讲。这些有价值和有见地的谈话可以并且将引导我们更好地理解未来:物理世界的计算机安全和隐私,Earlence Fernandes(目前在华盛顿大学)
{"title":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","authors":"Peng Liu, Yuqing Zhang, Theophilus A. Benson, S. Sundaresan","doi":"10.1145/3139937","DOIUrl":"https://doi.org/10.1145/3139937","url":null,"abstract":"It is our great pleasure to welcome you to the First Workshop on Internet of Things Security & Privacy - IoT S&P'17. This year's workshop begins a tradition of bringing together networking and security researchers to analyze and tackle security and privacy challenges introduced by the growing number of Internet of Things devices and deployments. The mission of the workshop is to share novel measurements, techniques and insights that identify new directions for future research and development. IoT S&P gives researchers and practitioners a unique opportunity to share their perspectives with others interested in the various aspects of IoT security and privacy \u0000 \u0000We also encourage attendees to attend the keynote and poster presentations. These valuable and insightful talks can and will guide us to a better understanding of the future: \u0000Computer Security and Privacy for the Physical World, Earlence Fernandes (who is currently at University of Washington","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"22 3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116320890","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A Lightweight Vulnerability Mitigation Framework for IoT Devices 物联网设备的轻量级漏洞缓解框架
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139944
Noy Hadar, Shachar Siboni, Y. Elovici
Many of today's Internet of Things (IoT) devices are vulnerable due to the large amount of overhead incurred when their operating systems are patched against emerging vulnerabilities. In addition, legacy IoT devices are no longer supported by their manufacturers, leaving customers with unpatched devices that can be easily exploited by attackers. Thus, there is an urgent need for a solution that provides a lightweight and low-cost mechanism for preventing exploitation of vulnerable IoT devices. In this paper, we propose an innovative cloud-based framework for protecting IoT devices. The proposed framework consists of a cloud service and a designated IoT security appliance. The security appliance controls the network traffic flowing to and from the vulnerable device and verifies that it does not violate a set of rules, represented by a vulnerability mitigation policy, that have been derived and synthesized by the cloud service from public corpora of Common Vulnerabilities and Exposures (CVE). We demonstrate how the proposed solution can be applied as a cost-effective solution capable of preventing exploitation of vulnerable IP cameras as part of a prominent botnet attack called Mirai.
当今的许多物联网(IoT)设备都很容易受到攻击,因为它们的操作系统在针对新出现的漏洞进行修补时产生了大量开销。此外,传统的物联网设备不再得到制造商的支持,这给客户留下了未打补丁的设备,很容易被攻击者利用。因此,迫切需要一种解决方案,提供一种轻量级和低成本的机制,以防止利用易受攻击的物联网设备。在本文中,我们提出了一个创新的基于云的框架来保护物联网设备。提议的框架由云服务和指定的物联网安全设备组成。安全设备控制进出易受攻击设备的网络流量,并验证它不违反由漏洞缓解策略表示的一组规则,这些规则是由云服务从公共漏洞和暴露(CVE)的公共语料库中派生和合成的。我们展示了如何提出的解决方案可以作为一个具有成本效益的解决方案,能够防止利用脆弱的IP摄像机作为一个突出的僵尸网络攻击称为Mirai的一部分。
{"title":"A Lightweight Vulnerability Mitigation Framework for IoT Devices","authors":"Noy Hadar, Shachar Siboni, Y. Elovici","doi":"10.1145/3139937.3139944","DOIUrl":"https://doi.org/10.1145/3139937.3139944","url":null,"abstract":"Many of today's Internet of Things (IoT) devices are vulnerable due to the large amount of overhead incurred when their operating systems are patched against emerging vulnerabilities. In addition, legacy IoT devices are no longer supported by their manufacturers, leaving customers with unpatched devices that can be easily exploited by attackers. Thus, there is an urgent need for a solution that provides a lightweight and low-cost mechanism for preventing exploitation of vulnerable IoT devices. In this paper, we propose an innovative cloud-based framework for protecting IoT devices. The proposed framework consists of a cloud service and a designated IoT security appliance. The security appliance controls the network traffic flowing to and from the vulnerable device and verifies that it does not violate a set of rules, represented by a vulnerability mitigation policy, that have been derived and synthesized by the cloud service from public corpora of Common Vulnerabilities and Exposures (CVE). We demonstrate how the proposed solution can be applied as a cost-effective solution capable of preventing exploitation of vulnerable IP cameras as part of a prominent botnet attack called Mirai.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"89 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122207404","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 27
Source-End DDoS Defense in IoT Environments 物联网环境下的源端DDoS防御
Pub Date : 2017-11-03 DOI: 10.1145/3139937.3139954
Samuel Mergendahl, Devkishen Sisodia, Jun Li, H. Çam
While the Internet of Things (IoT) becomes increasingly popular and pervasive in everyday objects, IoT devices often remain unprotected and can be exploited to launch large-scale distributed denial-of-service (DDoS) attacks. One could attempt to employ traditional DDoS defense solutions, but these solutions are hardly suitable in IoT environments since they seldom consider the resource constraints of IoT devices. This paper presents FR-WARD which defends against DDoS attacks launched from an IoT network. FR-WARD is an adaptation of the classic DDoS defense system D-WARD. While both solutions are situated near the attack sources and drop packets to throttle DDoS traffic, FR-WARD utilizes the fast retransmit mechanism in TCP congestion control to minimize resource penalties on benign IoT devices. Based on our analysis and simulation results, FR-WARD not only effectively throttles DDoS traffic but also minimizes retransmission overhead for benign IoT devices.
虽然物联网(IoT)在日常物品中变得越来越流行和普遍,但物联网设备通常仍然不受保护,并且可以被利用来发起大规模的分布式拒绝服务(DDoS)攻击。人们可以尝试采用传统的DDoS防御解决方案,但这些解决方案几乎不适合物联网环境,因为它们很少考虑物联网设备的资源限制。本文介绍了防御物联网网络发起的DDoS攻击的FR-WARD。FR-WARD是对经典DDoS防御系统D-WARD的改进。虽然这两种解决方案都位于攻击源附近并丢弃数据包以限制DDoS流量,但FR-WARD利用TCP拥塞控制中的快速重传机制来最大限度地减少良性物联网设备的资源损失。根据我们的分析和仿真结果,FR-WARD不仅有效地抑制了DDoS流量,而且还最大限度地减少了良性物联网设备的重传开销。
{"title":"Source-End DDoS Defense in IoT Environments","authors":"Samuel Mergendahl, Devkishen Sisodia, Jun Li, H. Çam","doi":"10.1145/3139937.3139954","DOIUrl":"https://doi.org/10.1145/3139937.3139954","url":null,"abstract":"While the Internet of Things (IoT) becomes increasingly popular and pervasive in everyday objects, IoT devices often remain unprotected and can be exploited to launch large-scale distributed denial-of-service (DDoS) attacks. One could attempt to employ traditional DDoS defense solutions, but these solutions are hardly suitable in IoT environments since they seldom consider the resource constraints of IoT devices. This paper presents FR-WARD which defends against DDoS attacks launched from an IoT network. FR-WARD is an adaptation of the classic DDoS defense system D-WARD. While both solutions are situated near the attack sources and drop packets to throttle DDoS traffic, FR-WARD utilizes the fast retransmit mechanism in TCP congestion control to minimize resource penalties on benign IoT devices. Based on our analysis and simulation results, FR-WARD not only effectively throttles DDoS traffic but also minimizes retransmission overhead for benign IoT devices.","PeriodicalId":129651,"journal":{"name":"Proceedings of the 2017 Workshop on Internet of Things Security and Privacy","volume":"13 4","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-11-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120913343","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
期刊
Proceedings of the 2017 Workshop on Internet of Things Security and Privacy
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1