[论文解读] SafeChain: Securing Trigger-Action Programming From Attack Chains

Kai-Hsiang Hsu, Yu-Hsi Chiang+1 more|arXiv (Cornell University)|Oct 1, 2019

Security and Verification in Computing参考文献 26被引用 7

一句话总结

该论文提出SafeChain，一种基于模型检测的系统，通过将生态系统建模为有限状态机，检测物联网触发-动作编程中的隐藏攻击链。它通过规则感知优化，高效识别权限提升和隐私泄露漏洞，在不到一秒内验证100条规则，且无任何误报。

ABSTRACT

The proliferation of Internet of Things (IoT) is reshaping our lifestyle. With IoT sensors and devices communicating with each other via the Internet, people can customize automation rules to meet their needs. Unless carefully defined, however, such rules can easily become points of security failure as the number of devices and complexity of rules increase. Device owners may end up unintentionally providing access or revealing private information to unauthorized entities due to complex chain reactions among devices. Prior work on trigger-action programming either focuses on conflict resolution or usability issues, or fails to accurately and efficiently detect such attack chains. This paper explores security vulnerabilities when users have the freedom to customize automation rules using trigger-action programming. We define two broad classes of attack--privilege escalation and privacy leakage--and present a practical model-checking-based system called SAFECHAIN that detects hidden attack chains exploiting the combination of rules. Built upon existing model-checking techniques, SAFECHAIN identifies attack chains by modeling the IoT ecosystem as a Finite State Machine. To improve practicability, SAFECHAIN avoids the need to accurately model an environment by frequently re-checking the automation rules given the current states, and employs rule-aware optimizations to further reduce overhead. Our comparative analysis shows that SAFECHAIN can efficiently and accurately identify attack chains, and our prototype implementation of SAFECHAIN can verify 100 rules in less than one second with no false positives.

研究动机与目标

• 解决随着设备复杂性和规则相互依赖性增加，物联网触发-动作编程日益增长的安全风险。
• 识别先前未被发现的攻击链，这些攻击链利用用户定义的自动化规则组合进行攻击。
• 开发一种实用且可扩展的解决方案，检测权限提升和隐私泄露漏洞。
• 通过避免完整环境建模并采用规则感知优化，降低验证开销。
• 确保在检测恶意规则组合时具有高准确率和低延迟，且无任何误报。

提出的方法

• 将物联网生态系统建模为有限状态机（FSM），以表示设备状态及由规则触发的转换。
• 应用模型检测技术，系统性地验证是否存在任何规则执行序列导致未经授权的状态转换。
• 根据当前设备状态动态重新检查规则，避免对精确环境建模的需求。
• 引入规则感知优化，通过分析规则依赖关系和传播路径，减少冗余检查。
• 利用现有的模型检测框架，将安全验证集成到规则编写过程中。
• 将安全属性表述为时序逻辑断言，以形式化验证攻击链的不存在性。

实验结果

研究问题

• RQ1 尽管设备交互复杂，如何系统性地检测触发-动作编程中的隐藏攻击链？
• RQ2 哪些技术可在动态物联网环境中保持高准确率的同时降低验证开销？
• RQ3 规则感知优化在多大程度上能提升攻击链检测的可扩展性？
• RQ4 所提出的系统能否以零误报检测权限提升和隐私泄露漏洞？
• RQ5 SafeChain的性能如何随规则和设备数量的增加而扩展？

主要发现

• SafeChain 成功检测出通过组合多条规则实现未经授权结果的隐藏攻击链。
• 该系统在检测权限提升和隐私泄露漏洞方面实现零误报。
• SafeChain 在不到一秒内验证100条触发-动作规则，展现出高性能和可扩展性。
• 规则感知优化通过最小化冗余状态探索，显著降低验证开销。
• 基于当前设备状态的动态重新检查机制，消除了对精确环境建模的需求。
• 原型实现证实，SafeChain 在真实物联网规则复杂度下兼具高效性和准确性。