Maverick: An App-independent and Platform-agnostic Approach to Enforce Policies in IoT Systems at Runtime

Many solutions have been proposed to curb unexpected behavior of automation apps installed on programmable IoT platforms by enforcing safety policies at runtime. However, all prior work addresses a weaker version of the actual problem due to a simpler, unrealistic threat model. These solutions are not general enough as they are heavily dependent on the installed apps and catered to specific IoT platforms. Here, we address a stronger version of the problem via a realistic threat model, where (i) undesired cyber actions can come from not only automation platform backends (e.g., SmartThings) but also close-sourced third-party services (e.g., IFTTT), and (ii) physical actions (e.g., user interactions) on devices can move the IoT system to an undesirable state. We propose a runtime mechanism, dubbed Maverick, which employs an app-independent, platform-agnostic mediator to enforce policies against all undesired cyber actions and applies corrective-actions to bring the IoT system back to a safe state from an unsafe state transition. Maverick is equipped with a policy language capable of expressing rich temporal invariants and an automated toolchain that includes a policy synthesizer and a policy analyzer for user assistance. We implemented Maverick in a prototype and showed its efficacy in both physical and virtual testbeds, incurring minimal overhead.

为了在运行时通过执行安全策略来遏制安装在可编程物联网平台上的自动化应用程序的意外行为，人们已经提出了许多解决方案。然而，由于采用了更简单、不切实际的威胁模型，所有先前的工作都只是解决了实际问题的一个弱化版本。这些解决方案不够通用，因为它们在很大程度上依赖于所安装的应用程序，并且是针对特定的物联网平台定制的。在这里，我们通过一个更符合实际的威胁模型来解决一个更复杂的问题，其中（i）不良的网络行为不仅可能来自自动化平台后端（例如，SmartThings），还可能来自闭源的第三方服务（例如，IFTTT），以及（ii）设备上的物理操作（例如，用户交互）可能会使物联网系统进入不良状态。我们提出了一种运行时机制，称为Maverick，它采用一个与应用程序无关、与平台无关的中介来针对所有不良网络行为执行策略，并应用纠正措施使物联网系统从不安全的状态转换恢复到安全状态。Maverick配备了一种能够表达丰富的时间不变量的策略语言，以及一个自动化工具链，其中包括一个策略合成器和一个策略分析器，用于为用户提供帮助。我们在一个原型中实现了Maverick，并在物理和虚拟测试平台上展示了其有效性，且产生的开销极小。