SmartAuth: User-Centered Authorization for the Internet of Things
summary
System automatically extracts device context and code behaviors with program analysis and app text with natural language processing, then matches them to flag mismatches (e.g., a coffee workflow that also unlocks the door). Evaluation covers 180 apps, one-time preprocessing ~10s per app, runtime enforcement causes 3.3% loss of remote functionality, and a 100-participant user study shows substantially better avoidance of overprivileged apps versus manifest-only interfaces. Implementation includes a policy enforcer integrated with Samsung smart home cloud.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 0:40Smart Home
- 1:17ThirdParty Apps
- 1:41Smart Home Keys
- 4:59Challenges
- 7:34Popup Permission
- 8:32Smart Apps
- 8:47Design Goals
- 9:39Overview
- 10:22Content Inspector
- 11:09Security Policy
- 11:40SmartAuth Example
- 11:55Context Generation
- 12:53Natural Language Processing
- 13:16Description Analysis
- 14:13Conditions
- 15:19Interface
- 17:00Evaluation
- 18:46User Study
- 20:14Recap
- 21:32Performance
- 22:03Crash
- 23:25Thank you
- 24:00Questions
related talks
05mExploring Authentication for Security-Sensitive Tasks on Smart Home Voice Assistants
19mProtecting Your Users in an Agentic World
19mDeus EM Machina: On-Touch Contextual Functionality for Smart IoT Appliances
20mThe End of User Authentication & the Coming Auto Authentication by the Server
52mPhilosophizing Security In A "Mobile-First" World
47mPatterns of Authentication and Self-Announcement in IoT
28mNew Apps, Good Snacks: Effective Threat Modeling for New Territory
46mA More Secure World for Android Apps