Fear and Logging in the Internet of Things
Qi Wang, Wajih Ul Hasan, Adam Bates, Carl Gunter University of Illinois at Urbana-Champaign
Published at NDSS 2018
PresentedByMdMahbuburRahman
ComputerScience,WayneStateUniversity
September24,2018
Outline • InternetofThings• Background• ProvThings• Implementation• Evaluation• Conclusion
2
Internet of Things (IoT) • Anetworkofinterconnecteddevices/sensors
• Devicescanexchangedataviaacommoninterface• InterfaceisconnectedtotheInternet
• Asof2017,thenumberofIoTdevicesincreasedto8.4billion• By2020:30billiondevices• By2020:MarketvalueofIoTisprojectedtoreach$7.1trillion
• Example:SmartHome• Lock/unlockyourdoorwithasmartphoneapplication
3
A Smart Home
Source:
4
A Smart Home
Source:
450+othervendors!!!5
Common Architectures • AllthedevicesareconnectedtoaHub• ACloudsynchronizesdevicestatesandprovideinterfacesforremotemonitoring• AnAppisaprogramthatmanagesdevices
Hub-centric&Cloud-centricArchitectures
Cloud-centric,buthaveaHubaswell.
6
Security Concerns • Howtodiagnoseanincorrect/malicious/misconfigurationbehaviors
• Trigger-actionprogrammingcancreateachain(flow)ofdevicesandappstogethertothepointthatdeterminingtherootcauseofanunexpectedbehavior/eventisoftendifficult.
• MaliciousIoTappsmayexistsinachain.
• AmaliciousappmayforgeaCOdetectioneventandanalarmdetectionappmaysoundthealarmbecauseitcannotdetecttheillegitimatehistoryoftheevent.
• Howtoexplaintheoverallsystembehaviors?• Needtounderstandthelineageoftriggersandactionsthatoccurs.
7
Logging in IoT Platforms • CurrentloggingmechanisminIoTisdevice-centric
• Itisdifficulttocreateacausaldependenciesbetweendifferenteventsanddatastates
• AuthorsanalyzedthelogsofanIrisSystem• “MotionwasdetectedbyIrisindoorcameraat11:13AM”• “Frontdoorwasunlockedat11:13AM”• “Lightwasturnedonat11:14AM”
Whythelightwasturnedonat11:14AM?
8
Data Provenance • Describesthehistoryofactionstakenonadataobjectfromitscreationuptothepresent• “Inwhatenvironmentwasthisdatagenerated?”• “Wasthismessagederivedfromsensitivedata?”
ProvenanceofAppleHomeKit
Thelightwasturnedbecausemotionwas
detected
Tool:W3CPROV-DMItspervasiveandrepresentsprovenancegraphinaDAG 9
PROV-DM [1] • PROV-DMhasthreetypesofnodes
• Entity:isadataobject• Activity:isaprocess• Agent:issomethingthatisresponsibleforEntitiesandActivities
ProvenanceofAppleHomeKit1.https://www.w3.org/TR/prov-overview/
• Edges:encodedependencytypesbetweennodes
WhichEntityWasAttributedTowhichAgentWhichActivityWasAssociatedWithwhichAgentWhichEntityWasGeneratedBywhichActivity.......
10
ProvThings: A Framework • ThreatModel&Assumptions
• API-level attacks: attacker is able to access ormanipulate the state of thesmart home through creation and transition of well-formed API controlmessages.• AccidentalAppconfiguration
• PlausiblescenariosthroughwhichAPI-levelattacksmayhappen• MaliciousApps• DeviceVulnerabilities• Proximity
11
ProvThings: A Framework • Assumptions
• Attackercannotgettherootaccessofthedevices• Attacksthroughcommunicationprotocolsareoutofscope• EntityresponsibleforIoTcentralmanagementisnotcompromised
• SmartThingsCloud
12
ProvThings: Overview • ProvThings isageneral frameworkforcollection,management,andanalysisofdataprovenanceinIoTplatform
13
ArchitectureofProvThingsprovenancemanagementsystem Courtesy:theAuthors
Provenance Collection • ProvThingscollectprovenancemetadatafromdifferentcomponentsofanIoTplatform• IoTApps• DeviceHandlers
• Usesautomatedprograminstrumentationtocollectmetadata• Minimallyinvasivesinceitdoesnotdoanyhardwareinstrumentation
14
Program Instrumentation • ProvThingsinstrumentsIoTAppsstatically
• Helpsbuildthecontrolflowanddataflow
• InstrumentedApp/codecollectsprovenancemetadataatruntime
15
Courtesy:theAuthors
Selective Program Instrumentation • Helpstoavoidcollectingunnecessaryprovenancemetadata• DefineprovenanceintermsofSourcesandSinks
• Source:asecuritysensitivedataobject(e.g.,stateofalock)• Sink:asecuritysensitivemethod(e.g.,commandtounlockadoor)
16
Courtesy:theAuthors
Provenance Management • Aggregatesandmergesprovenancerecordsfromdifferentcollectors,filtersthem,andconvertsthemintoaunifiedIoTprovenancemodel
• Buildsandstorestheprovenancegraphinadatabase• Addsmodularsupportfordifferentbackends:SQL,Neo4j.
17
Provenance Analysis • QueryAPIs:cananalyzeforwardandbackwarddependencyanalysis
• PolicyEngine:allowsuserstocreateconfiguration,policiesintheformofgraph
• PolicyMonitor:Cross-checkswithprovenancegraphifit’savalidpolicyornot
18
Implementation • ImplementedontopofSamsungSmartThings
19
Implementation: Comparison
20
Evaluation • Evaluateonfivemetrics
1. Effectivenessofattackreconstruction2. Instrumentationoverhead3. Runtimeoverhead4. Storageoverhead5. Queryperformance
• Evaluationof1and3isdoneatSmartThingsIDEcloud• 2, 4, and 5 is evaluated at a localmachinewith Intel Core i7-2600Quad-Core3.4GHzprocessorwith16GBRAMrunningUbuntu
21
Evaluation • Overheadmeasurements
• Unmodified(vanilla)SmartApps• ProvFull(instrumentsallinstructionstocollectprovenancedata)• ProvSave(Applyselectivecodeinstrumentation)
• Dataset• SmartAppsof26possibleIoTattacks[2]• 236commoditySmartApps
222.ContexIoT,Jiaetal.NDSS’17
Evaluation • ProvThingswereabletoeffectivelyreconstructall26attacks
• 34ms for SmartApps and 27ms for device handlers as theinstrumentationoverhead
• 260KBofdailystorageoverhead
232.ContexIoT,Jiaetal.NDSS’17
Evaluation • End-to-endlatencyoneventhandlingduetoprovenancecollection
• An event handler sends a textmessage if motion is detected by amotionsensor, the end-to-end event handling latency is the time between themotioneventisreceivedandthetimemessageisdeliveredtotheuser.
242.ContexIoT,Jiaetal.NDSS’17
Testedonbothvirtualandphysicaldevices
InsimulationProvSave:20.6%overheadProvFull:40.4%overhead
RealDevicesProvSave:5.3%and4.5%overheadProvFull:13.8%and8.7%overhead
Evaluation • Provenancestoragegrowth&Queryperformance
252.ContexIoT,Jiaetal.NDSS’17
ProvSaveincurslessstoragecosts
PerformancetestonNeo4j
ProvThingscanrespondquicklytoreal-timemonitoringsystem
Conclusion • ProvThings isa framework forcollection,management,andanalysisofdataprovenanceinIoT
• Limitations• StaticSourceCodeInstrumentation
• Unabletohandledynamicfeaturesofalanguage• DeviceIntegrity
• ProvThingsassumesthatthedevicesarenotcompromised• Compromiseddevicesmaycausewrongprovenancegraphs
262.ContexIoT,Jiaetal.NDSS’17
Questions?
27
Top Related