Abstract In recent years IoT platforms and smart-home systems have rapidly grown. Meanwhile, mobile apps have been widely accepted as user interfaces in these consumer IoTs, allowing users to retrieve processed data and issue specific commands. We notice that these companion apps are also used as gateways, providing Internet connectivity for resource-constrained devices, and its mobility advantage over static gateways further promotes applications of this kind. In this paper, we extracted this pattern into a new architecture called app-in-the-middle IoT. We provided a holistic view of what app-in-the-middle IoT is and introduced its attack surface by comparing it with two well-studied IoT architectures, which we refer to as cloud-in-the-middle IoT and trigger-action platform IoT. We detailed the similarities and differences between the three architectures, derived security goals of app-in-the-middle IoT, and drew the key to analyzing it from authentication, access control, and availability aspects. We adopted a method of building an abstract model and extracting the concept of token from the working process. To achieve security goals, the token needs to own these properties: mutual authentication, unforgeability, and resistance to replay attacks. We argue that the role the app plays is critical to the working process, which affects how the properties of the token are satisfied. During analysis, we find that the application scenarios significantly influence the role of the app. Therefore, we discussed the security of different situations separately. For each scenario, we indicated how the token should be generated and distributed to meet the security goals, and summarized several security rules. We analyzed several practical cases, which demonstrate that violating these rules can lead to severe consequences, such as unauthorized access, information leakage, irrevocable authorization, and device hijack.

中文翻译：

---

了解中间应用物联网的安全性

摘要 近年来，物联网平台和智能家居系统发展迅速。同时，移动应用程序已被广泛接受为这些消费者物联网中的用户界面，允许用户检索处理过的数据并发出特定命令。我们注意到这些配套应用程序也被用作网关，为资源受限的设备提供互联网连接，其相对于静态网关的移动优势进一步促进了此类应用程序的发展。在本文中，我们将这种模式提取到一个名为 app-in-the-middle IoT 的新架构中。我们提供了一个关于什么是中间应用物联网的整体视图，并通过将其与两个经过充分研究的物联网架构（我们称之为中间云物联网和触发操作平台）进行比较来介绍其攻击面物联网。我们详细介绍了三种架构之间的异同，推导出了中间应用物联网的安全目标，并从身份验证、访问控制和可用性方面得出了分析它的关键。我们采用了建立抽象模型的方法，从工作过程中提取token的概念。为了实现安全目标，令牌需要拥有以下属性：相互认证、不可伪造和抵抗重放攻击。我们认为应用程序扮演的角色对工作过程至关重要，这会影响令牌属性的满足方式。在分析过程中，我们发现应用场景对应用的作用有显着影响。因此，我们分别讨论了不同情况下的安全性。对于每个场景，我们指出了应如何生成和分发令牌以满足安全目标，并总结了几个安全规则。我们分析了几个实际案例，证明违反这些规则会导致严重的后果，例如未经授权的访问、信息泄露、不可撤销的授权和设备劫持。