Making connected home items interoperable will allow the players of the smart home market to offer products with more functions and new services. Therefore, it becomes even more important for companies to invest in privacy and security to guarantee transparency and security to end users.
Various players in the smart home market have underlined several times how the interoperability matter is strategic to concretize all business opportunities that Internet of Things can offer in the connected home ambit. The prospect of a common language that allows various smart home devices (also from different brands) to communicate and to exchange data one another opens new possibilities to make consumers’ user experience richer. The ever-rising number of connected objects for the smart home and the opportunities deriving from the integration of products and services need the implementation of a real interoperability inside the smart home world, so that platforms and devices can operate concretely. Concerning this, companies are already at work and recently the announcement of the initiative “Project Connected Home over IP” sees the alliance of Amazon, Apple and Google OTT to accelerate the smart home development. The three giants, together with ZigBee Alliance members, intend to develop an open-source framework that starts from the work already carried out by the enterprises taking part in the initiative. The evolution of the smart home, where objects are connected and interconnected, involves the promise of more advantages for end users but it also leads to ask some questions about the data treatment and cyber-security, themes about which consumers have already expressed their concern. We talk about that with Stefano Zanero, Associate Professor of the Department of Electronics, Information and Bioengineering of Milan Polytechnics, to highlight the benefits of interoperability and the possible criticalities it is worth considering. The professor, whose research interests include computer virology, mobile and system security, is member of various national and international organizations like IEEE (Institute of Electrical and Electronics Engineers), IEEE Computer Society, ACM (Association for Computing Machinery) and AIPSI (Information Systems Security Association).
Professor Zanero, is interoperability a successful key for the smart home? What advantages can it offer?
In general, in all ambits where the network connection is at stake, interoperability is one of the key advantages because it allows using different objects by integrating their functions. This is true for the smart home, too. The most evident benefit of making smart home items interoperable is the possibility of providing end-users with new increasingly advanced solutions and services, so enriching the user experience. Companies can adopt two types of approach to interoperability: the “proprietary” one and the “open” one. In the first case, a single vendor makes its products compatible just one another and not with their partner ecosystem: however, this approach does not work in a context (i.e. the usual one) where devices are bought at different times and from different brands. The second approach aims instead at creating open systems to make items, even from different brands, “dialogue” one another.
Are consumers’ current worries about the information security of connected appliances realistic?
People often have an “amplified” perception of the issues connected with security, because the violation of an information system generally causes a sensation. In my opinion, it is important to consider the menace model, because the same object in two different contexts might be secure in one case and unsecure in the other. Just to make an example, we all can easily understand the lock of a standard house would not be suitable for a bank vault. The same consideration is valid for electronic devices: in general, domotic appliances are not particularly safety-critical because it is unreasonable to suppose that someone might be interested in damaging the operation of my refrigerator or of my washing machine. In these cases, the risk of violations is low because the hacker would not be highly motivated. Nevertheless, in the smart home ambit there can be some exceptions, like for instance smart locks and anti-theft systems, which need to be protected against a higher menace level. Besides, another aspect worth considering is the case in which my refrigerator or my washing machine can make some orders automatically, enabling economic transactions: in that phase, the attempt of stealing credentials or payment data might occur. Furthermore, apart from the violation of devices from the outside, I think end users should attentively evaluate one element, that is to say the way in which the data collected by smart objects are treated, then the privacy protection rather than the cyber-security.
Can interoperability increase security-related risks?
If in the engineering world, standardization is a necessary pre-requisite to enable IoT to develop its entire potential, from the point of view of security operators, homogeneity can also mean more possibility for a hacker of affecting a big number of devices. Let us think of the case of ransomware, i.e. malware that damage the operation of electronic devices to ask owners for a ransom to restore their functions. If hackers were compelled to develop a ransomware for each specific system designed by each producer, probably an economic return able to justify the investment would not exist. However, when objects become interoperable and, for instance, start sharing a common framework or some common operating systems, then the menaced user base grows, making the development of malware that can act on several appliances more plausible. When we think of smart home, where there are various devices that “talk” one another, it is important to consider security measures regarding both the interoperability connection and the single item because the security of the whole depends, to some extent, on the security of the weakest link. To make an example, if the smart refrigerator (that, as above said, must be protected against a quite low menace level) is part of a data transmission chain that allows issuing purchase orders, interconnection will enable the household appliance connection with a device that can carry out economic transactions and then features a higher menace level. This means that also the refrigerator manufacturer, which is a link of the ecosystem, is called to play its part to protect it.
In concrete, what does this “playing its part” result in?
When I introduce a chip and some software into a mechanical item, I must take care of the maintenance of these elements along the entire service life of the product (precisely as it happens for the other parts composing the appliance), security updates included. If we consider the patches released on our mobile phones and computers, it is clear the frequency of security updates execution is quite high. In the case of software on board of a household appliance, too, updates must be performed constantly during the whole product life and the manufacturer must take this requirement into account, hand in hand with the impact this can exert on consumers. The user-friendliness of the process is essential. If we refer to the computer update in the late Nineties, the operation was so slow and cumbersome that many did not carry it out. Industry, anyway, understood updates were fundamental to maintain devices’ security and to avoid the malware diffusion in net, therefore, along the years, the various vendors have notably simplified the process, to the extent that nowadays the updates of our mobile phone or of our computer take place automatically, without taking care of them. Household appliances as well should be able to do the same, so that updates are performed almost “invisibly” to users. Also because we are speaking of daily use objects, which all must be able to use, including the less tech savvy.
Can companies avail themselves of certain professional figures to facilitate the security management and updates?
Yes, certainly, they can be figures who operate inside companies or external suppliers. However, in my opinion, it is important that, in items like household appliances, maintenance is prevailingly managed by the manufacturer, as the latter must be able to guarantee it along the entire product service life. On the contrary, activities like security assessment and penetration testing services can be profitably outsourced.
Considering the theme of the personal data collected by connected items and the exchange of information enabled by interoperability, do you think that more clarity in the communication concerning the data treatment would be useful?
Few people read the long information reports about the personal data treatment, also because they use a hardly understandable language. An instrument like the energy label, which is immediately intelligible, would be useful: even if consumers do not know in detail what A-class means, they would anyway understand easily it is better than the B-class. Therefore, it might be useful to create some icons that illustrate the main uses of personal data, so that consumers understand quickly for what purposes will be used the information collected by the device they are going to buy.
The connected home will collect a bigger and bigger quantity of data through interoperable objects and machine learning algorithms: what are the possible advantages and risks?
I think we will create a trade-off resembling the one already taking place with surfing systems that allow users to achieve traffic forecasts, supplied by aggregating different users’ data. It is clear that, as counterpart of this service that is useful because it allows identifying the less jammed roads and then saving time, consumers give access to the information that concern their displacements. Something similar can happen with the smart home, too: coming back home from work and finding it warm because the smart heating knows when I am back and starts operating at the right time certainly means enjoying comfort but also giving information about my travels. Consumers’ data have outstanding relevance for companies: however, people should perhaps be more aware of the trade-off generated when they authorize the access to personal information.
