Automated Security Analysis of IoT Software Updates - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2020

Automated Security Analysis of IoT Software Updates


IoT devices often operate unsupervised in ever-changing environments for several years. Therefore, they need to be updated on a regular basis. Current approaches for software updates on IoT, like the recent SUIT proposal, focus on granting integrity and confidentiality but do not analyze the content of the software update, especially the IoT application which is deployed to IoT devices. To this aim, in this paper, we present IoTAV, an automated software analysis framework for systematically verifying the security of the applications contained in software updates w.r.t. a given security policy. Our proposal can be adopted transparently by current IoT software updates workflows. We prove the viability of IoTAV by testing our methodology on a set of actual RIOT OS applications. Experimental results indicate that the approach is viable in terms of both reliability and performance, leading to the identification of 26 security policy violations in 31 real-world RIOT applications.
Fichier principal
Vignette du fichier
492809_1_En_14_Chapter.pdf (930.97 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03173903 , version 1 (18-03-2021)





Nicolas Dejon, Davide Caputo, Luca Verderame, Alessandro Armando, Alessio Merlo. Automated Security Analysis of IoT Software Updates. 13th IFIP International Conference on Information Security Theory and Practice (WISTP), Dec 2019, Paris, France. pp.223-239, ⟨10.1007/978-3-030-41702-4_14⟩. ⟨hal-03173903⟩
74 View
13 Download



Gmail Facebook Twitter LinkedIn More