MDSSED: A safety and security enhanced model-driven development approach for smart home apps

Context: With the popularization of smart home devices, people rely more on automation functions provided by smart home apps. This increases the attack surface for safety and security threats. Many of these threats are at the interaction level, caused by unintended or malicious interactions between apps.Objective: Most of the current studies focus on identifying unsafe interactions between smart home apps by code analysis. To the best of our knowledge, none of the existing studies focuses on enhancing the safety and security of smart home apps under interaction threats in the design phase. To fill this gap, this paper presents MDSSED, a safety and security enhanced model-driven development approach for smart home apps.Method: First, this paper identifies eleven types of interaction threats faced by smart home apps. Second, the MDSSED profile is proposed to support modeling smart home apps using UML. Third, the MDSSED prototype tool is developed to generate threat models and corresponding safety and security properties automatically. Then, the safety and security properties are automatically verified by model checking. Finally, the MDSSED tool automatically converts the UML models to the Samsung SmartThings apps.Results: To evaluate the accuracy and effectiveness of MDSSED, this paper uses the benchmarks in existing state-of-the-art studies. The results show that MDSSED not only identified the safety and security problems in the existing benchmarks but also pointed out vulnerabilities of apps under other interaction threats identified in this paper.Conclusion: To the best of our knowledge, MDSSED is the first model-driven development approach that supports the automatic verification of the safety and security properties of smart home apps under interaction threats. The accuracy, practicality, and efficiency of MDSSED are corroborated by experiments. The source code of the MDSSED tool and the experimental data are available online.1