Visible to the public Enforcing Fine-Grained Security and Privacy Policies in an Ecosystem within an EcosystemConflict Detection Enabled

TitleEnforcing Fine-Grained Security and Privacy Policies in an Ecosystem within an Ecosystem
Publication TypeConference Proceedings
Year of Publication2015
AuthorsWaqar Ahmad, Joshua Sunshine, Christian Kästner, Adam Wynne
Conference NameSystems, Programming, Languages and Applications: Software for Humanity (SPLASH)
Series TitleProceedings of the 3rd International Workshop on Mobile Development Lifecycle (MobileDeLi)
Date Published10-26-2015
PublisherACM New York, NY, USA ©2015
Conference LocationPittsburgh, PA
ISBN Number978-1-4503-3906-3
Keywordsandroid, app, app store, CMU, Ecosystem, fine-grained policies, home automation, Internet of Things, Oct'15, privacy, security

Smart home automation and IoT promise to bring many advantages but they also expose their users to certain security and privacy vulnerabilities. For example, leaking the information about the absence of a person from home or the medicine somebody is taking may have serious security and privacy consequences for home users and potential legal implications for providers of home automation and IoT platforms. We envision that a new ecosystem within an existing smartphone ecosystem will be a suitable platform for distribution of apps for smart home and IoT devices. Android is increasingly becoming a popular platform for smart home and IoT devices and applications. Built-in security mechanisms in ecosystems such as Android have limitations that can be exploited by malicious apps to leak users' sensitive data to unintended recipients. For instance, Android enforces that an app requires the Internet permission in order to access a web server but it does not control which servers the app talks to or what data it shares with other apps. Therefore, sub-ecosystems that enforce additional fine-grained custom policies on top of existing policies of the smartphone ecosystems are necessary for smart home or IoT platforms. To this end, we have built a tool that enforces additional policies on inter-app interactions and permissions of Android apps. We have done preliminary testing of our tool on three proprietary apps developed by a future provider of a home automation platform. Our initial evaluation demonstrates that it is possible to develop mechanisms that allow definition and enforcement of custom security policies appropriate for ecosystems of the like smart home automation and IoT.

Citation Keynode-25009

Other available formats: