Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper analyzes IoT access control policies to uncover security vulnerabilities arising from unintended information flow between devices in cloud-based environments. By formally modeling AWS IoT Core's components and constructing an information flow graph, the authors utilize an SMT solver to verify communication permissions among devices. The implementation of their approach in the tool IOT:POKER demonstrates its effectiveness on realistic scenarios and real-world policies, revealing critical insights into potential security flaws in IoT systems.
Unintended information flow in IoT access control can expose critical security vulnerabilities, and our tool IOT:POKER reveals these risks in real-world scenarios.
Many cloud providers for IoT technologies offer access control mechanisms whose proper configuration is critical for security. However, verifying permissions in isolation is insufficient in a setting where devices have different levels of trust or are compartmentalised in various subsystems. This work analyses IoT access control policies to identify potential security vulnerabilities from unwanted information flow between devices. To this end, we formally model AWS IoT Core's components and define an information flow graph to capture the communication among devices permitted by the access control policies. We build a finite representation of the graph by leveraging an SMT solver, thus enabling the verification of information flow between devices. We implement our approach in a tool called IOT:POKER, and assess it on a realistic scenario and several real-world policies.