The goal of the thesis was an analysis of IoT communication protocols, their vulnerabilities and the creation of a suitable anomaly detector. It must be possible to run the detector on routers with the OpenWRT system. To create the final solution, it was necessary to analyze the communication protocols BLE and Z-Wave with a focus on their security and vulnerabilities. Furthermore, it was necessary to analyze the possibilities of anomaly detection, design and implement the detection system. The result is a modular detection system based on the NEMEA framework. The detection system is able to detect re-pairing of BLE devices representing a potential pairing attack. The system allows interception of Z-Wave communication using SDR, detection of Z-Wave network scanning and several attacks on network routing. The system extends the existing detector over IoT statistical data with more detailed statistics with a broader view of the network. The original solution had only Z-Wave statistics with a limited view of the network obtained from the Z-Wave controller. The modular solution of the system provides deployment flexibility and easy system scalability. The functionality of the solution was verified by experiments and a set of automated tests. The system was also successfully tested on a router with OpenWRT and in the real world enviroment. The results of the thesis were used within the SIoT project.

In a world of the Internet of Things, smart home has shown a great potency and trend. A smart home is a convenient home setup where appliances and devices can be automatically controlled remotely from any internet-connected place in the world using a mobile or other networked device. Smart home has changed the way the residents interacted with their home and realised more convenience. Although this technology also has positive impact on saving energy and resources, privacy issues in it have shown to one of the biggest obstacles to the adaption of this technology. The purpose of this thesis is to study smart home users’ perceptions of smart homes and their privacy awareness and concerns. The research was conducted through interviews and followed an interpretive research paradigm and a qualitative research approach. In this study, 5 smart home owners were interviewed to investigate their reasons for purchasing IoT devices, their perceptions of smart home privacy risks, and actions to protect their privacy, as well as managing IoT devices and/or its data. The research results show that there are privacy risks existing in smart homes. Consumers’ privacy data is collected secretly, which needs to be controlled, and privacy issues have to be addressed in the near future for the smart home to be fully adopted by the society.

The Internet of Things (IoT) industry has been thriving for the past few years, especially in the household field. The proposal of smart homes has enabled a increasing number of IoT products to enter people’s daily lives. However, the access control in smart homes has gradually grown up to be a prominent problem. Traditional access control mechanisms consider one unique trusted user that controls all access to the devices. However, multiuser and multi-device smart home scenarios pose fundamentally different challenges to the traditional single-user systems. Multiple trusted users are expected to manage the whole smart home system. Furthermore, the access control system of smart homes needs to consider the complexity of user relationships, the convenience of user experience, and the flexibility of access control. So the basic question this project is intended to answer can be concluded as: how to design an access control system based on the user-desired access control mechanism in the context of multiple users and multiple devices? This project first investigates both technical background and user study researches, summarizing current issues. Then, to study user perceptions of current access control systems, this project carries out semi-structured interviews, identifying user needs in access control systems. Finally, a fine-grained prototype satisfying user needs is offered. It consists of three modules, namely the user interaction module, the backend module and the manager module. Permissions are assigned through the user interaction module, translated into access control policies at the backend module and enforced by the manager module. The proposed prototype is then implemented in a simulated smart home environment and evaluated on its feasibility to identified requirements. / Internet of Things (IoT) industrin har blomstrat de senaste åren, särskilt inom hushållsområdet. Förslaget om smarta hem har gjort det möjligt för ett ökande antal IoT produkter att komma in i människors vardag. Tillgångskontrollen i smarta hem har dock gradvis vuxit till att bli ett framstående problem. Traditionella åtkomstkontrollmekanismer överväger en unik betrodd användare som styr all åtkomst till enheterna. Men smarta hemscenarier för flera användare och flera enheter utgör emellertid fundamentalt olika utmaningar för de traditionella enanvändarsystemen. Flera betrodda användare förväntas hantera hela systemet för smarta hem. Dessutom måste system för åtkomstkontroll i smarta hänsyn beakta komplexiteten i användarrelationer, användarupplevelsens bekvämlighet och flexibiliteten i åtkomstkontroll. Så den grundläggande frågan som detta projekt är tänkt att besvara kan slutas som: hur man utformar ett åtkomstkontrollsystem baserat på den användarönskade åtkomstkontrollmekanismen i flera användare och flera enheter? Detta projekt undersöker först både teknisk bakgrund och användarstudier, som sammanfattar aktuella frågor. För att studera användaruppfattningar om nuvarande åtkomstkontrollsystem genomför detta projekt halvstrukturerade intervjuer som identifierar användarens behov i åtkomstkontrollsystem. Slutligen erbjuds en finkornig prototyp som uppfyller användarens behov. Den består av tre moduler, nämligen användarinteraktionsmodulen, backendmodulen och chefsmodulen. Behörigheter tilldelas via användarinteraktionsmodulen, översätts till åtkomstkontrollpolicyer på backend-modulen och tillämpas av chefsmodulen. Den föreslagna prototypen implementeras sedan i en simulerad smart hemmiljö och utvärderas om det är genomförbart för identifierade krav.

Background. Smart home assistants are becoming more common in our homes. Often taking the form of a speaker, these devices enable communication via voice commands. Through this communication channel, users can for example order a pizza, check the weather, or call a taxi. When a voice command is given to the assistant, the command is sent to cloud services over the Internet, enabling a multitude of functions associated with risks regarding security and privacy. Furthermore, with an always active Internet connection, smart home assistants are a part of the Internet of Things, a type of historically not secure devices. Therefore, it is crucial to understand the security situation and the risks that a smart home assistant brings with it. Objectives. This thesis aims to investigate and compile threats towards smart home assistants in a home environment. Such a compilation could be used as a foundation during the creation of a formal model for securing smart home assistants and other devices with similar properties. Methods. Through literature studies and threat modelling, current vulnerabilities towards smart home assistants and systems with similar properties were found and compiled. A few  vulnerabilities were tested against two smart home assistants through experiments to verify which vulnerabilities are present in a home environment. Finally, methods for the prevention and protection of the vulnerabilities were found and compiled. Results. Overall, 27 vulnerabilities towards smart home assistants and 12 towards similar systems were found and identified. The majority of the found vulnerabilities focus on exploiting the voice interface. In total, 27 methods to prevent vulnerabilities in smart home assistants or similar systems were found and compiled. Eleven of the found vulnerabilities did not have any reported protection methods. Finally, we performed one experiment consisting of four attacks against two smart home assistants with mixed results; one attack was not successful, while the others were either completely or partially successful in exploiting the target vulnerabilities. Conclusions. We conclude that vulnerabilities exist for smart home assistants and similar systems. The vulnerabilities differ in execution difficulty and impact. However, we consider smart home assistants safe enough to usage with the accompanying protection methods activated. / Bakgrund. Smarta hemassistenter blir allt vanligare i våra hem. De tar ofta formen av en högtalare och möjliggör kommunikation via röstkommandon. Genom denna kommunikationskanal kan användare bland annat beställa pizza, kolla väderleken eller beställa en taxi. Röstkommandon som ges åt enheten skickas till molntjänster över internet och möjliggör då flertalet funktioner med associerade risker kring säkerhet och integritet. Vidare, med en konstant uppkoppling mot internet är de smarta hemassistenterna en del av sakernas internet; en typ av enhet som historiskt sett är osäker. Således är det viktigt att förstå säkerhetssituationen och riskerna som medföljer användningen av smarta hemassistenter i en hemmiljö. Syfte. Syftet med rapporten är att göra en bred kartläggning av hotbilden mot smarta hemassistenter i en hemmiljö. Dessutom kan kartläggningen fungera som en grund i skapandet av en modell för att säkra både smarta hemassistenter och andra enheter med liknande egenskaper. Metod. Genom literaturstudier och hotmodellering hittades och sammanställdes nuvarande hot mot smarta hemassistenter och system med liknande egenskaper. Några av hoten testades mot två olika smarta hemassistenter genom experiment för att säkerställa vilka hot som är aktuella i en hemmiljö. Slutligen hittades och sammanställdes även metoder för att förhindra och skydda sig mot sårbarheterna. Resultat. Totalt hittades och sammanställdes 27 stycken hot mot smarta hemassistenter och 12 mot liknande system. Av de funna sårbarheterna fokuserar majoriteten på manipulation av röstgränssnittet genom olika metoder. Totalt hittades och sammanställdes även 27 stycken metoder för att förhindra sårbarheter i smarta hemassistenter eller liknande system, varav elva sårbarheter inte förhindras av någon av dessa metoder. Slutligen utfördes ett experiment där fyra olika attacker testades mot två smarta hemassistenter med varierande resultat. En attack lyckades inte, medan resterande antingen helt eller delvis lyckades utnyttja sårbarheterna. Slutsatser. Vi konstaterar att sårbarheter finns för smarta hemassistenter och för liknande system. Sårbarheterna varierar i svårighet att uföra samt konsekvens. Dock anser vi att smarta hemassistenter är säkra nog att använda med medföljande skyddsmetoder aktiverade.

IoT is an abbreviation of the term Internet of Things. The term describes everydayitems such as light bulbs that are connected to the Internet. IoT is a field that isgrowing very quickly with some researchers and industry leaders predicting thatthere will be up to 200 billion connected IoT devices in the world by 2020. Many IoTdevices are developed by smaller companies looking to capitalize on a specific needin the market. Because of this, the companies may favor launching a product as fastas possible which could mean that the devices may have not been adequately testedfor different vulnerabilities.The IoT and Smart Home market is currently experiencing rapid growth and all signspoint towards that continuing in the future. This thesis focuses on testing forvulnerabilities to Denial of Service attacks in common-off-the-shelf IoT devices thatcan be found in a smart home environment. The purpose of this thesis is to createmore knowledge about the vulnerabilities that can be found in Internet connecteddevices that are used daily.This thesis includes experiments using OpenVAS, which is a vulnerability scannerdeveloped by Greenbone Security used to test for vulnerabilities to Denial of Serviceattacks in IoT devices. The devices that are tested are Sony PlayStation 4, IKEATrådfri Smart Lighting, Google Chromecast (First Generation), Apple TV (ThirdGeneration) and D-Link DCS-930LB Wi-Fi IP-Camera. The firmware/software of allthe devices are updated as of April of 2019.The results of the conducted experiments show that all the tested devices besidesChromecast and IKEA Trådfri had vulnerabilities to Denial of Service attacks.PlayStation 4 was the device with the highest amount of vulnerabilities (9) and thevulnerability with highest possible severity (10.0). The effects of a Denial of Serviceattack range from an annoyance, when a gaming console is unavailable, to a securityrisk when an IP camera can be temporarily disabled.

Artificial Intelligence, being recently one of the most popular topics in technology, has been in a spotlight of Interaction Design for a long time. Despite its success in software and business-oriented cases, the adoption of Artificial Intelligence solutions in home environments still remains relatively low. This study reflects on the key reasons for the low penetration of AI-based solutions in private households and formulates design considerations for possible further developments in this area with a focus on artificial light sources. The design considerations are based on literature review and studies of multiple home environments gathered through qualitative interviews and context mapping exercises. Health influence of lighting, multi-user interactions, and privacy-related and ethical concerns are taken into account as the key factors. The considerations have been validated with participants of the study through user testing sessions of a digital prototype that virtualises a home environment and explores some of the common light usage scenarios. The study argues that despite multiple efforts in this direction during the past three decades, the future of Artificial Intelligence in connected, intelligent homes does not lie in smart, autonomous systems. Instead, Artificial Intelligence can be arguably used to simplify and contextualise interactions between humans and their home environments as well as foster the development of parametric solutions for private households.

Denna undersökning har granskat det problem som uppstår i samband med den snabba utvecklingen utav Internet of Things där de lågenergienheter saknar kraft för att utföra avancerade säkerhetslösningar. På grund av den låga säkerheten och växande användningsområdet så har Internet of Things enheterna blivit ett lockande mål för eventuella attacker. Den systematiska litteraturanalysen har genomförts genom att granska tidigare mer detaljerade analyser av protokollen och dess säkerhet samt utvecklarnas specifikationer. Detta för att bland annat skapa en sammanfattning utav protokollens säkerhet men också för att sedan jämföra protokollen för att kunna ta fram det säkrare protokollet för hemanvändning. Alla protokoll som tas upp har någon form av säkerhet implementerad för att förse med autentisering i form av MAC (i vissa fall HMAC), nyckelhantering, integritet i form av MIC och kommunikationssäkerhet med kryptering. Alla protokoll har stöd för AES-128 kryptering samt användning av IEEE 802.15.4 säkerhetsserie som ytterligare skydd utöver protokollens egna lösningar. Flertalen av protokollen använder sig också av Elleptic Curve för att säkert transportera nycklar. Analysens slutsats visar att Thread och Z-Wave anses som de två säkraste protokollen för hemmaanvändning. Det baserat på hur protokollen hanterar de olika aspekterna med sin märkbara prioritering av säkerhet tillsammans med det få antalet brister som kan skada det smarta hemmet. Bluetooth Low Energy och EnOcean är de två mindre säkra gällande en IoT miljö. Undersökningen tar också med en diskussion kring olika områden som dykt upp under undersökningens gång. Slutligen tas några punkter som dök upp under granskningen som kan vara bra att tänka på vid utveckling av dessa protokoll men säkerhet i tanken. / This study has examined the problems that arise in connection with the rapid development of the Internet of Things, where the low-energy units lack the power to implement advanced security solutions. Due to the low security and growing area of use, the Internet of Things units have become an attractive target for any attacks. The systematic literature analysis has been carried out by reviewing previously more detailed analyzes of the protocols and their security as well as the developers' specifications. This is to create a wide summary of the security of the protocols and then to compare the protocols to select one or more as the safer protocol for home use. All protocols that are included have some form of security implemented to provide authentication in the form of MAC, key management, integrity in the form of MIC and communication security with encryption. All protocols support AES-128 encryption and the use of IEEE 802.15.4 security suit as additional protection in addition to the protocol's own solutions. The majority of protocols also use Elleptic Curve to safely transport keys. The analysis concludes that Thread and Z-Wave are considered the two most secure home use protocols. It is based on how the protocols handle the various aspects with their noticeable prioritization of security along with the few deficiencies that can damage the smart home. Bluetooth Low Energy and EnOcean are thetwo less secure regarding an IoT environment. The survey also includes a discussion of various areas that emerged during the course of the investigation. Finally, some points that emerged during the review that may be good to consider when developing these protocols with security as focus.

No description available.

No description available.

Technology is developing at a rapid pace. With this, Internet of Things (IoT) and smart homes are being used by more and more people every day. The amount of network protocols that is being used in relation to smart homes are many and they come with different features and challenges. With one of the main challenges being the issue of interoperability between the protocols. This has led to the introduction of Matter, a new protocol that uses Thread, Wi-Fi and Ethernet as networking technologies underneath. The goal is to enable smart devices from different companies to seamlessly talk to each other. There is a gap in how the different protocols are perceived by users as well as how a standardized protocol like Matter could impact the experience of a smart home. The aim of the study is to better understand the need of consumers for their smart home protocols. This by using a mixed method approach to get the insight of consumers located in Sweden. The data in the study was collected by conducting a survey and two focus group sessions. The survey was answered by 34 respondents and was structured to answer research question 1. The focus group had 4 participants in the first session and 3 participants in the second session and was structured to answer research question 2. Thematic analysis was used to analyze the collected data which concluded into 7 themes from the survey and 5 themes from the focus groups.  The findings were then discussed subsequently with each theme. Using UTAUT2 as the theoretical framework the similarities and general findings were connected to the constructs of the UTAUT2 model. The themes showed that the perception of protocol is closely tied to its influence on factors like performance, reliability, and functionality of smart home devices. Additionally, it was concluded that adopting a standardized protocol such as Matter could potentially enhance interoperability, make it less complex, and address security and privacy concerns. As a result, this could significantly impact the user experience of individuals in their smart homes.