PRASH: A Framework for Privacy Risk Analysis of Smart Homes

Abstract

Smart homes promise to improve the quality of life of residents. However, they collect vasts amounts of personal and sensitive data, making privacy protection critically important. We propose a framework, called PRASH, for modeling and analyzing the privacy risks of smart homes. It is composed of three modules: a system model, a threat model, and a set of privacy metrics, which together are used for calculating the privacy risk exposure of a smart home system. By representing a smart home through a formal specification, PRASH allows for early identification of threats, better planning for risk management scenarios, and mitigation of potential impacts caused by attacks before they compromise the lives of residents. To demonstrate the capabilities of PRASH, an executable version of the smart home system configuration was generated using the proposed formal specification, which was then analyzed to find potential attack paths while also mitigating the impacts of those attacks. Thereby, we add important contributions to the body of knowledge on the mitigations of threat agents violating the privacy of users in their homes. Overall, the use of PRASH will help residents to preserve their right to privacy in the face of the emerging challenges affecting smart homes.

Keywords: IoT; attack taxonomy; privacy; privacy metrics; risk analysis; smart home; system model; threat model.

Figure 1

The components of a smart home. At the center are the users, particularly the smart home residents. Users interact with their home via the hardware layer, typically through mobile devices. The network layer is responsible for implementing the communication and providing connectivity between the users and their homes. Data and software represent crosscutting components as data are generated, collected, processed, and exchanged at different layers, and software, which can include machine learning models, is integrated in the different conceptual layers.

Figure 2

Taxonomy of privacy attacks on the smart home structured, according to the entities they target. Hardware layer attacks target the physical components; network layer attacks target the communication and connectivity; and user layer attacks target the smart home users. Attacks also compromise the software and data that are present across the different conceptual layers of the smart home.

Figure 3

A schematic illustration of the smart home model’s components, including the logical relationships between them. Items indicated in bold represent the main attributes of the system model. Dotted boxes indicate abstract concepts.

Figure 4

A smart home configuration generated using Alloy. The smart home setup consists of 4 nodes (ConnectedToy, VideoDoorbell, MobileDevice, Cloud), 3 users (Child, Parent, ServiceProvider), and 4 links (Link0-Link3) that interconnect users to nodes, and vice versa. All the relations between the different model components is displayed in the form of labelled arrows.

Figure 5

Attack tree with the attacker’s goal being that of profiling the house occupants.

Figure 6

Radar chart indicating the risk level associated with each smart home component, including the risk score adjusted for the hacker and nation state actor. This figure shows that the highest risk (risk score > 7) is that of an attack targeting the $$ConnectedToy$$. Therefore, the most priority should be put on securing the $$ConnectedToy$$.