CCDS-SH02-2021
CCDS-SH03-2021

Security Guidelines for Product Categories- Smarthomes Ver. 1.0

CCDS Security Guidelines WG
Smarthome WGⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Revision History
EditionDate

Description

Ver.0.1

2018/11/26

Newly released as a draft version.

Ver.1.0

2019/10/29

Draft version revised into a new release.

■Trademarks
・All company names, product names and the like in this document are either
trademarks or registered trademarks of their respective companies.
■Notice・Information in this document is that available at the time of publication of thisdocument and is subject to change without notice.
・Duplication or reproduction of the contents of this document without priorpermission from the CCDS is strictly prohibited.

© 2018-2019 Connected Consumer Device Security Council Proprietaryⓒ2020 Connected Consumer Device Security Council Proprietary

Contents
1

Introduction .......................................................................................... 1
Present Status and Issues of Smarthome Security .................................................. 2
Audiences ............................................................................................................... 4
Intended audiences are: .......................................................................................... 4
Glossary ................................................................................................................. 5

2

Definition of Smarthome Services and System Configuration ........... 8
Definition of Smarthome Services ........................................................................... 8
Definitions of Security Levels of Smarthome Products and Services ....................... 9
Definitions of Security Levels of Smarthome Products and Services ......................13
Defining a System Model ..................... エラー! ブックマークが定義されていません。
Definitions of Use Cases ........................................................................................172.4.1 Use Case in ★★ Services ........................................................................................ 17
2.4.2 Use Case in ★★★ Services ...................................................................................... 19

3

Risk Analyses of Smarthome Products and Services ........................ 22
Risk Analyses and assessment Procedures .............................................................22
Identification of the Assets to be Protected ............................................................24
Analysis of Potential Threats ................................................................................27
3.3.1 Potential Threats to Smarthome Products and Systems ........................................ 27
3.3.2 Potential Threats Other Than Cyber Security ....................................................... 32
Detailed Analysis of Potential Threats ..................................................................32
Calculation of Risk Metrics ...................................................................................53
3.5.1 Calculation of Risk Metrics Based on CVSS v3 and Issues .................................... 53
3.5.2 Definitions of Risk Metrics Calculations Based on the Smarthome Unique Methodi......................................................................................................................................... 55
3.5.3 Results of Risk Metrics Calculations Based on the Smarthome Unique Method ... 71
Risk Analysis and Assessment Summary ...............................................................82
Exploring Security Actions ....................................................................................82

4

Potential Security Threats and Action Guidelines ............................. 93
Diversity of Relevant Factors ................................................................................93
Responding to Product Safety ................................................................................93
Device Collaboration ..............................................................................................94
Installation and Removal of IoT Devices by Users .................................................96
Keeping Security Action Guidelines for Smarthome Services Organized ................965

Life Cycle of a Smarthome Service and Security Efforts .................. 98
Definitions of the Successive Phases of the Life Cycle of a Smarthome Service .....98
Security Efforts to be Made in the Life Cycle of a Service ......................................99
5.2.1 Service Planning Phase........................................................................................... 99
5.2.2 Design and Manufacturing Phase ......................................................................... 101
5.2.3 Scoring Phase ........................................................................................................ 102
5.2.4 Operation and Maintenance Phase ....................................................................... 102
5.2.5 Service Termination Phase ................................................................................... 107
Definitions of the Successive Phases of the Life Cycle of a Smarthome ................ 108
Security Efforts to be Made in the Life Cycle of a Smarthome ............................. 109
5.4.1 Design Phase ......................................................................................................... 109
5.4.2 Production and Construction Phase...................................................................... 109
5.4.3 Post-Construction Phase ....................................................................................... 111
5.4.4 Remodeling Phase ................................................................................................. 113
5.4.5 Resale Phase ......................................................................................................... 114
5.4.6 Unbuilding Phase .................................................................................................. 115ii

6

Security Requirements for Smarthome Services ............................. 116
Security Requirements for Smarthome Services .................................................. 116
Security Secondary Requirements for System Service-Compatible Devices .......... 125
6.2.1 Security Secondary Requirements for Smarthome Service Information Platforms....................................................................................................................................... 126
6.2.2 Security Secondary Requirements for Service Provider Information Platforms .. 133
6.2.3 Security Secondary Requirements for Home Gateways........................................ 134
6.2.4 Security Secondary Requirements for Smarthome-Compatible Devices .............. 140
6.2.5 Security Secondary Requirements for Smartphone Applications ......................... 144

7

Conclusion ........................................................................................ 145

Citation / References ................................................................................. 146
Figure 2-1: Hierarchical Models of Smarthome Products and Services ...................... 10
Figure 2-2: Responding to Security Requirements/Security Secondary Requirements for
Smarthome Services ..................................................................................................... 13
Figure 2-3: Smarthome System Model Schematic ........................................................ 14
Figure 2-4:Smarthome Use Case (Automatic Shutter Opening/Closing Service) ........ 18
Figure 2-5: Smarthome Use Case (On-Call Security Service) ..................................... 20
Figure 3-1: Threat Analysis Cases on the Smartphone System Model ........................ 29
Figure 3-2: Base Score (Smarthome Unique Method) Formula ................................... 58
Figure 3-3: Environmental Score (Smarthome Unique Method) Formula................... 64
Figure 5-1: Phases of the Life Cycle of a Smarthome Service ..................................... 98
Figure 5-2: Phases of the Life Cycle of a Smarthome ................................................ 108

Table 1-1: Glossary ......................................................................................................... 5
Table 1-2: Abbreviations ................................................................................................. 7
Table 2-1: Definitions of a Service and a System ........................................................... 9
Table 2-2: Certification Levels of Smarthome Products and Services .......................... 11
Table 2-3: System model components ........................................................................... 15
Table 2-4:Smarthome Use Case (Automatic Shutter Opening/Closing Service) .......... 18
Table 2-5 Smarthome Use Case (On-Call Security Service) ........................................ 21
Table 3-1:Risk Analyses and Assessment Procedures .................................................. 23iii

Table 3-2: Examples of Assets to be Protected among Smarthome Systems and Products....................................................................................................................................... 24
Table 3-3 List of Threat Categories Based on the STRIDE+CCDS Model ................... 28
Table 3-4: Examples of Threat Categories Based on the STRIDE+CCDS Model ........ 30
Table 3-5: List of Detailed Analysis Items of Potential Threats .................................. 33
Table 3-6: Connection I/F Items ................................................................................... 33
Table 3-7: Who (who connected) Items ......................................................................... 35
Table 3-8: Whom (what has been harmed) ................................................................... 35
Table 3-9: Where (where the threat has occurred) ....................................................... 36
Table 3-10: Examples of Detailed Threat Analyses of a Smarthome Service and aService Provider Information Platform ........................................................................ 37
Table 3-11: Detailed Threat Analysis Cases for Home Gateways, SmarthomeCompatible Devices and Smarthome Applications ....................................................... 43
Table 3-12 Service Risk Metrics Based on CVSS v3(Common to ★★ and ★★★) ※Excerpt .......................................................................................................................... 54
Table 3-13: Issues of Risk Metrics Calculation Based on CVSS v3 ............................. 55
Table 3-14: Vulnerability Scoring Criteria Based on the Smarthome Unique Method 56
Table 3-15: Base Score Calculation Parameters .......................................................... 59
Table 3-16 Life and Property (LP) Impact .................................................................... 59
Table 3-17: Information Importance (II) ...................................................................... 60
Table 3-18: Confidentiality (C), Integrity (I) and Availability (A) Impacts ................. 60
Table 3-19: Attack Vector (AV) ...................................................................................... 61
Table 3-20: Attack Confidentiality (AC) ....................................................................... 62
Table 3-21: Privileges Required (PR) ............................................................................ 62
Table 3-22: User Interaction (UI) ................................................................................. 63
Table 3-23: Scope (S) ..................................................................................................... 63
Table 3-24: Environmental Score Calculation Parameters .......................................... 65
Table 3-25: Modified Life and Property Impact (MLP) ................................................ 66
Table 3-26: Modified Information Importance (MII) .................................................... 66
Table 3-27: Security requirements for the target system （CR/IR/AR） .................... 67
Table 3-28: Modified Confidentiality Impact (MC) ...................................................... 68
Table 3-29: Modified Integrity Impact (MI) ................................................................. 68
Table 3-30: Modified Availability Impact (MA) ............................................................ 68
Table 3-31: Modified Attack Vector (MAV) ................................................................... 68
Table 3-32: Modified Attack Confidentiality (MAC) ..................................................... 69iv

Table 3-33: Modified Privileges Required (MPR) ......................................................... 69
Table 3-34: Modified User Interaction (MUI) ............................................................... 69
Table 3-35: Modified Scope (MS) .................................................................................. 69
Table 3-36: Severity Rating Scale ................................................................................. 70
Table 3-37: Risk Metrics of Services Based on the Smarthome Unique Method ......... 70
Table 3-38 Automatic Shutter Opening/Closing Service (★★) Risk Metrics (before
Security Action) ............................................................................................................. 72
Table 3-39: On-Call Security Service (★★★) Risk Metrics (before Security Action) ... 77
Table 3-40 Automatic Shutter Opening/Closing Service (★★) Risk Metrics (after
Security Action) ............................................................................................................. 83
Table 3-41 On-Call Security Service (★★★) Risk Metrics (after Security Action) ...... 88
Table 5-1: Definitions of the Phases of a Smarthome Service ..................................... 99
Table 5-2: Security Efforts to be Made in the Service Planning Phase ..................... 100
Table 5-3: Security Efforts to be Made in the Design and Manufacturing Phase ..... 101
Table 5-4: Security Efforts to be Made in the Scoring Phase .................................... 102
Table 5-5 Security Efforts to be Made in the Operation and Maintenance Phase .... 102
Table 5-6: Security Efforts to be Made in the Service Termination Phase ................ 107
Table 5-7: Definitions of the Phases of a Smarthome ................................................ 108
Table 5-8 Security Efforts to be Made in the Design Phase ....................................... 109
Table 5-9 Security Efforts to be Made in the Production and Construction Phase ... 109
Table 5-10: Security Efforts to be Made in the Post-Construction Phase .................. 111
Table 5-11: Security Efforts to be Made in the Remodeling Phase ............................. 113
Table 5-12: Security Efforts to be Made in the Resale Phase. .................................... 114
Table 5-13: Security Efforts to be Made in the Unbuilding Phase ............................. 115
Table 6-1 Rules of Notation of Security Requirements and Secondary Requirements...................................................................................................................................... 117
Table 6-2 Numbering Rules for Security Requirements and Secondary Requirements...................................................................................................................................... 117
Table 6-3 Security Requirements for Smarthome Services ......................................... 118
Table 6-4 Security Secondary Requirements for Smarthome Service Information ... 126
Table 6-5 Security Secondary Requirements for Service Provider Information Platform..................................................................................................................................... 133
Table 6-6 Security Secondary Requirements for Home Gateways ............................. 134
Table 6-7 Security Secondary Requirements for Smarthome-Compatible Devices ... 140
Table 6-8 Security Secondary Requirements for Smartphone Applications .............. 144v

CCDS-SH02-2021
CCDS-SH03-2021

1 Introduction
Safety standards have been formulated separately from each product industry toanother to date. As cyber security standards, a standard relating to organizational
operations (ISO27001) and a standard relating to security assessment andcertification (ISO15408) have been set forth. And recently, even standards targeting
control systems for key infrastructures (plants and facilities essential to social
infrastructures) (ISO62443) have come into existence.
With the growing popularity of the Internet of Things (IoT) initiative, familiar
consumer devices in our lives have come to boast a variety of networking capabilities,
threatening more security concerns than ever. In the circumstances, security
standards essential to IoT products and services are yet to be fully developed to suitconsumer devices. In the meantime, moves are underway in various parts of the U.S.
and European nations to explore security standards from industry-specific safety
standards (U.K. Code of Practice for Consumer IoT Security [21] and U.S. California
State’s Regulating Internet of Things (IoT) (Senate Bill No.327, Chapter 886) [1] andothers). In Japan as well, concerns over security have loomed to reflect growing urges
for deliberation, but specific discussions have launched in very few categories ofindustry.
It was under the circumstances that the Connected Consumer Device Security
Council (CCDS) was inaugurated as a general incorporated association. The activityof the Council has been committed to the goal of crafting an environment in whichusers can safely use IoT products, by formulating security standards for consumer
devices while administering a CCDS certification program designed to verify andvalidate product compliance with these standards.
While the IoT Security Guidelines [2] compiled on July 5, 2016 by the IoT
Acceleration Consortium, the Ministry of Economy and Trade and Industry and theMinistry of Internal Affairs and Communications offers a basic insight into thecommon issues encompassing comprehensive product fields, the CCDS has worked out
this Guidelines to drive design and development efforts directed at security assurance
in the individual product categories.

1ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Status and Issues of Smarthome Security
A smarthome is a dwelling that is connected to the Internet or the like and that is
furnished with IoT-compatible housing equipment and home appliances to deliversafe, secure and comfortable living to the homeowner by leveraging information
technologies, such as IoT and AI.

IoT devices have an expanding scope of applications as they get closer to our day-today lives than ever. For example, if there is a way to control consumer devices
installed within one’s home from a remote location, then locking of the home, opening
and/closing of the shutters and water supply/drainage facilities would be controllable.
IoT devices have come into rapid popularity and the pace is expected to hasten evenfaster in the future. Annual Report 2016: Information and Communications in Japan[3] cited projections by IHI Technology to forecast leaps in the number of consumer
devices from about 5.4 billion units worldwide in 2015 to 12.5 billion units, a morethan twofold increase, in 2020.
These IoT devices can be connected to the Internet to offer a variety of services, butalso threaten potential risks to information security. Since the presence of malware
targeting IoT devices has been confirmed, it is feared to risk our lives and properties.
The causes of attacks launched at IoT devices can be viewed in two aspects: users andproviders. Attacks attributable to users might include, for example, the use of IoT
devices without their default settings being changed, use of passwords that can beeasily guessed and a lack of knowledge about security. Those attributable to providers
might include a product design that grants access to anybody with the default
settings and a lack of their assumption of users' concept of security.

In March 2016, Smart-society Development Guidelines [4] was publicized by the
Information-technology Promotion Agency, Japan (IPA), an independentadministrative agency, to define a general concept of the risks and actions to be taken
into consideration by those who develop IoT devices. In July 2016, IoT Security
Guidelines compiled by the Ministry of Economy, Trade and Industry, the Ministry ofInternal Affairs and Communications and other were publicized to provide providers
and users a conceptual approach to exploring security actions for IoT devices, systems
and services. Such approach includes, for example, implementing important security
updates to IoT devices properly after their initial delivery.
2ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
The CCDS is now working to forge a CCDS certification program, which is a security
certification plan that encompasses a complete classification of products, includingATMs, IoT gateways, on-board devices and open POS terminals. The programcontemplates to assign Certification Mark ★ to those products and services for which
Certification Level 1 is defined to specify a minimum set of security requirements to
be fulfilled by IoT devices; Certification Mark ★★ or ★★★ to those for which
Certification Level 2 or 3 is defined by trade organizations according to specificproduct categorizations and that have been verified to meet these security
requirements through voluntary assessment or third-party certification.

Despite the growing popularity of IoT devices, smarthomes still remain in theirbudding period and housing companies have only begun to pursue them seriously.
While guidelines on smarthome security are yet to be formulated, discussions havebeen initiated through demonstration testing so far.
In Fiscal 2016, for example, a connected IoT device security verification testbed forsmarthomes was built as part of an IoT service creation project driven by the
Ministry of Internal Affairs and Communications. In this project, a smarthome
testbed environment was fabricated to verify the security of IoT devices used in our
day-to-day lives. Findings of this verification work were compiled into IoT security
verification guidelines for smarthomes. In Fiscal 2017, the FY2016 Social System
Maintenance Project Leveraging Modified IoT (Smarthome Data Utilization
Environment Maintenance Promotion Project) was implemented. The project came up
with a formulation of Smarthome Field Security and Product Safety Action Guidelines(Checklists).
To work out security guidelines for smarthomes, it would be necessary to presume inwhat context IoT devices are used. For example, the IoT devices used to protect auser’s life and property and those used to improve the user's comfort or convenienceshould differ in the security requirements for the system that runs the devices. Whilea growing number of IoT devices continue to penetrate homes as explained above,some seem to be installed without a full prior review of their security characteristics.
For this reason, security standards should be formulated to meet the importance ofthe objects to be protected with regard to Certification Levels 2 and 3 under the
Certification Program defined by the CCDS with a view to authenticating smarthome
security, so Certification Marks ★★ and ★★★ will be assigned to services compliant
3ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
with these standards.
Users would then be able to check the Certification Mark label appearing on asmarthome service to make certain that the service is a safe and secure service.

This document presents specific action guidelines that reflect components and life
cycles specific to the smarthome field based on IoT Security Guidelines [2] compiledby the IoT Acceleration Consortium, and also defines relevant security requirements
for the smarthome field in accordance with the Cyber Physical Security Framework(CPSF) [20] developed by Japan’s Ministry of Economy, Trade and Industry, U.K.
Code of Practice for Consumer IoT Security [21] and U.S. California State’s
Regulating Internet Of Things (IoT) (Senate Bill No.327, Chapter 886) [1].
Discussions launched in this document focus on topics characteristic of the security
actions for the smarthome field. Issues, such as organizational information security
management, network security and safety actions and the like are beyond the scope of
this Guideline. For information about these topics, the reader is directed toassociated guidelines established by other associations.

Scope of Application
Written mainly for corporate developers who plan, design, construct and operate
smarthomes, and services and housing equipment, this Guidelines presents security
action policies that should deserve consideration as they go through their life cycles.

Intended audiences are:
1)Designers, developers, producers and distributors of consumer devices2)Operations representatives responsible for operating and maintaining housing
equipment3)Smarthome designers, producers and constructors, administrators and site
supervisors
4)Operations representatives responsible for operating and maintaining smarthomes

4ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Glossary
This section gives definitions of the terms used in this document.

Table 1-1: Glossary
TermDefinitionHouse

A dwelling house, residence or living home. In this document,
the term refers to a detached house for general households,
rental house, multiple-dwelling house or the like, excluding
offices, facilities and shops.

Housing company

A company that planning, sells, designs and constructs
houses, such as a housing maker, contractor, builder or design
firm. In this document, the term refers to any company thatplans, sells, designs or constructs smarthomes.

Smarthome

A house furnished with IoT-compatible housing equipment
and home appliances utilizing a communications architecture,such as the Internet.

Housing equipment

Equipment that makes up or that is incidental to a house. In
this document, the term refers to housing equipment andhome appliances connected with the Internet or the like.

Home gateway

Communications equipment installed in the premises of asmarthome. Home gateways also serve to connect premises
housing equipment and home appliances to an external cloudin a secure manner.

Device manufacturer

A cloud provided by a housing equipment or home appliancecloud

manufacturer to manage and control products of its own.
Device manufacturer clouds often support an API via which
the external society (such as third parties) can gain access tothe functions of target devices or information stored in them.

Constraction manager

A person who supervises and overseas the construction of ahouse on site.

Site supervisor

A person who guides and supervises the construction so thatthe building be able to build according to the planning.

HEMS

Short for Home Energy Management System.

5ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
A management system that takes advantage of information
technology to help visualize and streamline the process ofenergy utilization by home appliances and the like in generalhouseholds.
Entry point

A point in a smarthome service, IoT device or path ofcommunication that could pose a security threat because of its
accessibility from outside.

User interface

A scheme of exchanging information between a user and asmarthome. This scheme can be implemented in a variety ofmethods, such as on-screen display and manual entry, as witha smartphone, and voice speech and recognition, as with asmart speaker.

DeviceAn IoT device, such as housing equipment, a home applianceor sensor, installed in the premises of a smarthome.

Risk analysis and

The process in which the assets to be protected and theassessment

potential threats and damages are analyzed, and security
actions are defined from their risk metrics (severity of thedamages).

6ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Definitions of the abbreviations used in this document are listed below.

Table 1-2: Abbreviations
Abbreviation

Name

API

Application Program Interface

CCDS

Connected Consumer Device Security council

CPU

Central Processing Unit

CSIRT

Computer Security Incident Response Team

CVSS

Common Vulnerability Scoring System

DoS

Denial of Service

ETSI

European Telecommunications Standards Institute

GW

Gateway

HEMS

Home Energy Management System

IEC

International Electrotechnical Commission

I/F

Interface

IoT

Internet of Things

IoT-GW

Internet of Things-Gateway

IP

Internet Protocol

IPA

Information-technology Promotion Agency

ISO

International Organization for Standardization

JPCERT/CC

Japan Computer Emergency Response Team Coordination Center

LAN

Local Area Network

OTA

Online Trust AllianceOWASPThe Open Web Application Security Project

VPN

Virtual Private Network

WG

Working Group

Wi-Fi

Wireless Fidelity

Information Security

Information Security that maintains confidentiality, integrity, andavailability affects both cybers and physical area.
※This guideline uses “Information Security” that extends to cyberand physical area.

Cyber Security

Security in the scope of cyber7ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

2 Definition of Smarthome Services and System
Configuration
Preparatory to exploring security actions required in the smarthome field, thischapter defines services and identifies their relationships with certification. It
proceeds to define the systems that make up a smarthome and introduces typical use
cases of smarthome services.

Definition of Smarthome Services
Operations of an IoT device installed in the premises of a smarthome could cause
damage to life and property under certain circumstances. For example, if a third
party tampers the setting of a hot water server by exploiting its vulnerability, a fireor accident might result. And, If an electronically managed electronic lock is unlocked
illegally a theft might ensue. Because different services offer different functions, usecases and compatible devices, the kinds of asses to be protected vary accordingly.
Assuming that the assets that impact life and property should require foremost
protection, smarthome services have been classified into the following two categories
according to the importance of assets to be protected:

1) Services relevant to user comfort or convenience
Services in which premises housing equipment, intelligent home appliances, sensors
and so on are controlled either automatically or as preprogrammed, as theycollaborate with a system on a cloud, offering augmented user comfort or convenience.
Service examples:
・Products and services that remote-control or manage the schedules of airconditioners, lighting fixtures, electric shutters and the like and that automate orotherwise manipulate their operations in sync with sensors.
・Products and services that help visualize the progress of power metering or energysaving.
・Products and services linked to day-to-day health care, and more.

2)Services relevant to life and property
Services in which an information platform, such as a crime-prevention system or life8ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
saving system, collaborates with security cameras, electronic locks, sensors and thirdparty service providers, to ensure users’ day-to-day safety, security and life-saving intimes of emergencies.

Examples:・Products and services relevant to crime prevention or life-saving in times of
emergencies
・Products and services requiring rigid control because they could lead to accidents,
such as fires and physical injury, and more

Definitions of the terms “service” and “system” used this document are given below ontable2-1.

Table 2-1: Definitions of a Service and a System
Term

Definition

Service

The process of a service provider delivering devices or systems, and avalue, such as usefulness or satisfaction, through operation of suchdevices or systems, is defined as a “service.” In the smarthome field,
service providers might be house makers utilizing the devices orsystems they installed, device or systems makers utilizing productsof their own or third parties utilizing services, devices or systems
made by other companies.

SystemAn aggregate of devices configured to realize a value to a user isdefined as a “system.” In the smarthome field, the term covers an IoT
device environment, a cloud system used to integrate and manage
service data and controls and so on. A system is defined not toinclude human operations.

Definitions of Security Levels of Smarthome Products an
d Services
The CCDS released IoT Field Common Security Requirements Guidelines FY2018(draft) [5] in November 2018. This Guidelines defines certification levels in a threelayer model, with each level designating a specific security level with a given number
9ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021of star marks (★, ★★, ★★★) to promote better understanding by consumers. Further,
11 items of security requirements have been publicized to specify a "minimum set ofcommon requirements to be fulfilled by connected devices."
This hierarchical model is adopted in the smarthome field as well, in which
compliance with a minimum set of common requirements (Level ★) is assumed and inwhich Level ★★ represents products and services relevant to user comfort orconvenience and Level ★★★ represents products and services relevant to life andproperty. In this document, security action policies and security requirements are
discussed individually for Level ★★ and Level ★★★ products and services.

A hierarchical model of certification in the smarthome field is shown in Figure 2-1.

Figure 2-1: Hierarchical Models of Smarthome Products and Services

10ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 2-2 summarizes definitions of the respective levels.

Table 2-2: Certification Levels of Smarthome Products and Services
Level

★★★

Corresponding Service

Explanation

A product or service relevant

Enforce security actions needed to protect

to life and property (hereafter

assets that impact life and property, ina “Level ★ ★★ service”)

addition to being compliant with therequirements of Level ★★.

★★

★

A product or service relevant

Enforce security actions needed to realize

to user comfort or convenienceuser comfort or convenience, in addition to(hereafter a “Level ★★

being compliant with the requirements ofservice”).

Level ★.

An Internet connectivity

Compliant with the 11 items of Common

product or service.

Requirements defined in “IoT Field Common
Security Requirements Guidelines.”

Certification at Level ★★ or ★★★ aims at smarthome services and is intended toverify compliance with Section 5.5¸"Security Requirements for Smarthome Services."
Because this Guidelines adheres to the concept of smarthome services endorsing acertain level of security actions as a whole, it does not go as far as guaranteeing
security actions taken for a Service Information Platform over a cloud or forindividual devices in the premises of a smarthome. Hence, the specification ofindividual certification requirements for a Service Information Platform or devices isbeyond the scope of this Guidelines.
To help clarify the line of demarcation for responsibility for a service, however, theService Information Platform or individual devices installed in the premises of asmarthome must be chosen to comply with the secondary requirements for ★★ or★★★ services defined in Section 5.6.
For example, if an electronic lock can be unlocked by running a smartphone
application in one use case, it is classified as a service relevant to user comfort orconvenience (★★) and should require compliance with security secondary
requirements for ★★ services. If the same electronic lock can be unlocked by a field
representative stationed closest rushing to the source of fault notification to unlock
the electronic lock remotely in another use case, then it is classified as a service
11ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
relevant to life and property (★★★), requiring compliance with the security
secondary requirements for ★★★ services.

Service providers act in the following procedural flow to determine whether theservices they provide are classified as ★★ or as ★★★:
1) Service providers review use cases in the service planning stage and postulate
applicable services tentatively to reflect the component devices and systems.
2)Service providers conduct risk analyses based on the use cases and check to see
whether sensitive data, such as personal information, is handled and whether there
will be any life and property impact and then determine compatible services.

12ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Figure 2-2 Responding to Security Requirements/Security Secondary Requirements
for Smarthome Services

To find out more about the 11 items of Common Requirements, refer to IoT Field
Common Security Requirements Guidelines FY2018 (draft) [5].

Defining a System Model
A schematic view of a basic system model of smarthomes is given in Figure 2-3. In
reviewing this model, Figure 5-3, "Threats to Smart Houses and Typical Discussionsof Security Actions," on P59, "A Guide to Security Design in IoT Development"
compiled by the IPA has been consulted.
A Smarthome Service Information Platform is built to underlie the delivery ofservices intended to enhance the quality of life of users built on the equipment
installed in their smarthomes. Smarthome Service Information Platforms control user
premises devices according to collected and stored smarthome and user information.
Device operations may be carried out by the users from inside or outside of theirpremises or remotely by third parties, such as service providers, depending on the13ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
kind of services provided.
Device operations from a Smarthome Service Information Platform can be carried out
in two different ways: using the API available from a device manufacturer cloud anddirectly from the Smarthome Service Information Platform. Direct device operations
require the Smarthome Service Information Platform to connect to a premises
network beforehand, because they go through a HEMS controller or edge serverconnected to the premises network. Particularly, to be able to make the process ofrunning devices relevant to life and property in a safer, more secure manner, a home
gateway should be installed in the premises to make for secure communication with
the Smarthome Service Information Platform. Because the home gateway positionedon the boundary between an external Internet and a premises smarthomeenvironment serves as a secure gateway, a scheme of identifying between servicecompatible devices with a certain level of security endorsed and devices individually
set by users is desired.

Figure 2-3: Smarthome System Model Schematic
14ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 2-3 gives a summary description of the components of the system model.

Table 2-3: System model components
Name

Description■Smarthome Service Information Platform

A system designed to manage the devices that make up the smarthome and provide
essential services.
Security server

Authentication server

Supervises the security of a Smarthome Service Information
Platform.
Authenticates users, operators and the home gateway in using a
Smarthome Service Information Platform.

Service device status

Manages the status of individual devices based on information

management server

sent from user premises smarthome service-compatible devices.

Personal information

Manages user information about the users of the Smarthome

management server

Service Information Platform.

Remote maintenanceManages and releases software updates for the home gateway

serverand smarthome service-compatible devices.

■Smarthome

Installed between the Internet and a smarthome, a home
Home gateway

gateway connects information platforms to housing equipment
and service-compatible devices while assuring their security.

Housing equipment,

Facilities and equipment installed in the premises of a home,such as air-such as air-conditioner and lighting fixtures.

conditioners andlighting fixtures
An electrical appliance installed in the premises of a general
Home appliancehome, such as TV, personal computers, refrigerators andwashing machines.

SensorA sensor that detects a house temperature, humidity, humansensation and so on.

Other ★★ service-

All other devices compatible with★★ services, such as HEMS

compatible device

controllers and intelligent home appliances.

■Service Provider Information Platform

A collaborating information system, such as a call center, that helps deliver optional

15ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Name

Description

services, such as security and life-saving services.
Server (such as a

A server needed to provide services, set up above a cloud or

cloud)

elsewhere.

16ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Definitions of Use Cases
IoT devices (housing equipment, home appliances and sensors) used to deliver
smarthome services vary in their level of significance to cyber security, depending on
their intended uses. For example, a human sensor might be used to enhance theconvenience of our lives (e.g., for automatically opening and closing room doors) or toenhance our life and property (e.g., for identifying between an individual's life anddeath). More exacting cyber security actions would be required in the latter case.
Because the risk factors and characteristics and issues of cyber security vary fromone use case to another as outlined in Product Field-Specific Security Guidelines IoTGW _Ver2.0 [10], typical use cases of the ★★ and ★★★ services will be defined to aid
in subsequent discussions of security actions.

2.4.1 Use Case in ★★ Services
To illustrate a use case in which the asset to be protected is important information, aservice that allows an electric shutter to open and close automatically (“Automatic
Shutter Opening/Closing Service) according to a user-preset schedule is considered(Figure 2-4, Table 2-4).
This service remote-controls an electric shutter installed in the premises of asmarthome from a Smarthome Service Information Platform according to a schedule
set from a user-run application. Because remote operations of the electric shutter are
linked to personal information, allowing access, for example, to the user’s life patternor residence/absence information, this use case can be classified as a ★★ service.

17ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Figure 2-4:Smarthome Use Case (Automatic Shutter Opening/Closing Service)

Table 2-4:Smarthome Use Case (Automatic Shutter Opening/Closing Service)
Figure#ActionDescription
Once an electric shutter opening/closing schedule is set

1

Set an opening/closing

from a user-run application, it is recorded with theschedule

user being linked to the automatic shutter
opening/closing service system.
When a preset time comes around, the automatic

Order opening and/or
2

closing of the electric
shutter3

shutter opening/closing service system orders the
Smarthome Service Information Platform to open
and/or close the electric shutter.

Execute opening and/or

On receiving the order to open and/or close the electricclosing of the electric

shutter, the Smarthome Service Information Platform

shutter from the Smarthomein turn orders the home gateway relevant to the home18
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Figure#ActionDescription

Service Information

to open and/or close the electric shutter.

Platform

4

Open and/or close the

The home gateway opens and/or closes the electric

electric shutter

shutter.

2.4.2 Use Case in ★★★ Services
To illustrate an instance of life and property as an asset to be protected, a use case ofa security service ("On-Call Security Service"), in which personnel rush to the site
upon detection of any abnormal conditions in the target home, is used (Figure 2-5,
Table 2-5).

According to this service, the staff member stationed nearest to a home rushes to thathome upon notification from a premises burglar sensor detecting any abnormal
condition, such as trespassing, and enters the house through an entrance as it isunlocked from the call center in a remote operation, checks the internal conditions of
the home and takes any action as appropriate in the circumstances.

19ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Figure 2-5: Smarthome Use Case (On-Call Security Service)20ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 2-5 Smarthome Use Case (On-Call Security Service)
Figure#ActionDescription
A burglar sensor or security camera installed in the1

Detection of any

premises of a smarthome detects any abnormal conditions,abnormal conditions bysuch as trespassing. The status of the burglar sensors andburglar sensors andsecurity cameras is being monitored by the home gateway,

security cameras

so any abnormal conditions will be detected uponoccurrence.
As soon as any abnormal conditions in the smarthome are

Notification to the2

Smarthome Service
Information Platform

Notification to the3

security service

5

Smarthome Service Information Platform through a secure
path of communication.
The Smarthome Service Information Platform displays thedetected abnormal conditions on a security service system
screen monitored at the security service provider’s callprovider4

detected, they are reported from the home gateway to thecenter.

Callout to a field

The field representative stationed nearest to the reported

representative

home is called out to rush to that home.

Field representative

The arrival of the field representative at the reported homearrival checkand the identity of the field representative are verified.
On confirming the arrival of the field representative, the6

Order to unlock theelectronic lockcall center worker gains authorization according to apredetermined chain of command before unlocking theelectronic lock at the entrance through a call-out security
service screen.

78

Unlocking of the

When ordered to unlock the electronic lock, the Smarthomeelectrical lock from theService Information Platform orders the home gateway for

Smarthome Service

the home to unlock the electronic lock through a secure path

Informationof communication.

Unlocking of the

The home gateway unlocks the electronic lock at theelectrical lockentrance.

21ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

3 Risk Analyses of Smarthome Products andServices
Risk analyses and assessment are carried out to define the cyber security risks
existing in the services provided to a smarthome and the security requirements toprovide against them. In the risk analysis and assessment process, the information
assets to be protected in providing such services are identified, along with potential
threats to the information assets and their risk characteristics, and the impacts fromthe threats occurring are measured. Then, the actions against the risks and theirpriority levels are established from the risk characteristics and impacts thus
analyzed.

This chapter presents a summary insight into the procedural flow of the cybersecurity risk analysis and assessment process for smarthome services.

Risk Analyses and assessment Procedures
Risk analyses of smarthome services are carried out in the procedural flow described
below. Detailed descriptions of the procedural steps follow.

22ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-1:Risk Analyses and Assessment Procedures
No.

Step

Description

Define the components of a system to be analyzed and1

Define a use caseassessed and its users and the way the users and thesystem interact with each other.
Among all information assets handled by the system

2

3

4

5

Identify the assets toappearing in the use case, identify those that needbe protected

protection.

Analyze potential

Specify entry points based on the system model andthreats

analyze potential threats.

Analyze the potential

Review potential threat cases and analyze them inthreats in detaildetail.

Calculate risk metrics

Calculate the risk metrics that represent the impact ofpotential threats when they occur.
Define the security actions to be taken in providing
services, from the results of risk metric analyses andassessment. In defining security actions, it is6

Define security actions

necessary to take into consideration the frequencies
with which incidents could occur, impacts (riskmetrics) of their occurrence and the cost of the actions
taken.

23ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Identification of the Assets to be Protected
Regarding the use case defined in the foregoing section, identify the assets to beprotected. The availability of a smarthome service, particularly ★★★ service, or theability to provide one without interruption, is considered an important protectedasset, because the user’s life or property could be impacted if the availability of afunction relating to life saving in times of emergencies or to day-to-day crime
prevention is impeded by attacks. Moreover, if a smarthome product or service isassumed, the target assets need to be identified exhaustively from the information
they handle, from the functionalities they provide and so on for each of the elements(such as an IoT device or cloud) that make up the service.
The assets to be protected are exemplified in Table 3-2 below.

Table 3-2: Examples of Assets to be Protected among Smarthome Systems andProducts
Entry Point

Device Name

Security server

Asset TypePrimary asset

Asset to be Protected
Hardware, software (security function
itself)（※1)
Setup information, log information
Authentication
serverPrimary asset

Hardware, software (function itself)

Secondary

Authentication information

asset(※2)

Encryption key

Service device
Smarthome Service

statusInformation

management

Platform

server

Hardware, software (function itself)
Primary asset

Personal
information
management

Device status management information

Hardware, software (function itself)
Primary asset

Personal information (user’s name,serveraddress, phone number and the like)

RemoteHardware, software (function itself)

maintenanceserverPrimary asset
Update software

24ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Path of

Data on a communication pathcommunication

Primary asset

between the
Smarthome Service/―

Secondary

Information

asset

Platform and theInternet

Hardware, software (function itself)
Device status management information
Service Provider
Information
Platform

Primary asset

Personal information (user’s name,Third-party

address, phone number and the like)

service server

Setup information, log information
Secondary
asset

Authentication information（Authentication key）
Encryption key

Path ofcommunication
between theService Provider

Primary asset―

Information/Secondary

Data on a communication pathasset

Platform and theInternet
Hardware, software (function itself)
Setup information, log information
Primary asset
Home gateway

Home gateway

Personal information (dependent on thefunctional implementation of the target
device)between the home

Authentication information

asset

Encryption key

Primary asset

Path ofcommunication

Secondary―/
Secondary

Data on a communication path

asset

25
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
gateway and theInternet
Airconditioners,

Primary asset

Hardware, software (function itself)
Control signal

lighting
fixtures andthe like

Secondaryasset

Primary asset
SensorAuthentication information
Hardware, software (function itself)
Sensing data

Secondary
asset

Authentication information
Hardware, software (function itself)
Control signal

Other ★★
service-Primary asset

Sensing data
Personal information (dependent on thecompatible

functional implementation of the target

devicedevice)Smarthome-

Secondarycompatible devices

asset

Authentication information
Hardware, software (function itself)
Control signal

Security
service-Primary asset

Sensing data
Personal information (dependent on thecompatible

functional implementation of the target

devicedevice)Secondary
asset

Authentication information
Hardware, software (function itself)
Control signal

Life-saving
servicecompatible
devicePrimary asset

Sensing data
Personal information (dependent on thefunctional implementation of the target
device)26ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Secondaryasset

Data on a communication path

Path ofcommunication
between the home

Authentication information―

gateway andcompatible devices

Primary asset

・Control signal 、Sensing data/

・Personal information (dependent on

Secondary

the functional implementation of theasset

target device)・Authentication information
Software (function itself)

Smartphone
application

Primary asset―

Control signal
Personal information or confidential
information stored in the smartphone

Secondary
asset
Path ofPrimary asset

communication
between a―smartphone andthe home gateway

Authentication information
Data on a communication path/
Secondary
asset

Note to *1 and *2:“Primary asset” and “Secondary asset” used in the table are defined as follows:・Primary asset:Any asset to be protected itself are defined as a “primary asset.”
・Secondary asset:An encryption measure needed to protect a primary asset and a subsidiary
assets relevant to authentication are defined as a “secondary asset.”

Analysis of Potential Threats
Cyber security threats to the assets to be protected as identified in the preceding
section are analyzed here.

3.3.1 Potential Threats to Smarthome Products and Systems
Using the smarthome system model, entry points (exploitable points) are extracted
and potential threats are analyzed regarding each of these entry points. In this27
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
document, use is made of the STRIDE+CCDS model [12], which is an enhancement
made by the CCDS to a Microsoft-advocated threat analysis technique called "STRIDE model" [11]. The STRIDE model has six kinds of threats (Spoofing,
Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation ofPrivilege) defined, which are used to analyze potential threats to systems. The
STRIDE+CCDS model has an additional five kinds of threats added to respond to IoT
devices and systems.

Table 3-3 List of Threat Categories Based on the STRIDE+CCDS ModelType
STRIDE

ThreatSpoofing

To pretend to be another user or device to thecomputer.

MODEL
STRIDE

Tampering

MODEL
STRIDE

Description

Unauthorized alteration of data to disrupt its
integrity.

Repudiation

To repudiate any action taken by a user, without theuser having no way to verify that action.

MODEL
STRIDE

Information

The Information Disclosure to an individual without

MODEL

Disclosureaccess privileges.

STRIDE

Denial of Service

To impede a regular user from accessing a server or

MODEL

（DoS）

service.

STRIDE

Elevation of

The acquisition of access privileges by an

MODEL

Privilegeunauthorized user.

THREAT

Unauthorized

Access made by an individual without access

ADDED BY

accessprivileges.

Malware Infection

A source of contamination to other devices, causing

THE CCDSTHREAT
ADDED BY

an interference with one's business with ransomware

THE CCDSTHREATor the like.

Springboard

ADDED BY

Used as a relay point in attempting unauthorizedaccess or the like to any other device.

THE CCDSTHREAT

Unauthorized

The theft of internal data or installation of a

ADDED BY

modification

vulnerability trap by making unauthorized (illegal)

THE CCDS

modifications to hardware or software.

28ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
THREAT

Unknown

A vulnerability yet to be publicly known or one

ADDED BY

vulnerability

produced by a new attach technique.

THE CCDS

Considering the system model outlined above, what kinds of threat will reach theassets to be protected are examined exhaustively regarding to entry points(exploitable points). In the analysis case illustrated in Figure 3-1 below, those devices
and paths of communication that could form an entry point are each designated by ared mark and assigned a number (EP number) from (1) to (10) in association with
Table 3-4.

Figure 3-1: Threat Analysis Cases on the Smartphone System Model29ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-4: Examples of Threat Categories Based on the STRIDE+CCDS Model
Entry Point Number(EP Number) on the

Entry Point

System Model

Threat Category on the
STRIDE+CCDS Model
Unauthorized accessInformation Disclosure

Smarthome Service

EP①

Information Platform

Tampering

Spoofing
Malware Infection
Denial of Service

Path of communication
between the Smarthome
Service Information

EP②

Information Disclosure

Platform and the Internet
Unauthorized accessInformation Disclosure
Service Provider Information
Platform

EP③

Tampering
Spoofing
Malware Infection
Denial of Service

Path of communication between
the Smarthome Service
Information Platform and the

EP④

Information Disclosure

Internet
Unauthorized accessInformation Disclosure
TamperingHome gateway

EP⑤

Spoofing
Malware Infection
Denial of Service
Springboard

30ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Path of communication between
EP⑥

the home gateway and theInformation Disclosure

Internet
Unauthorized accessInformation Disclosure
Smarthome-compatible devices

EP⑦

Tampering
Spoofing
Malware Infection
Springboard

Path of communication

Spoofing

between smarthomecompatible devices and the

EP⑧Information Disclosure

home gateway
EP⑨

Smartphone application
Path of communication between
a smartphone and the home
gateway

Information Disclosure
Spoofing
Spoofing

EP⑩

Information Disclosure

31ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

3.3.2 Potential Threats Other Than Cyber Security
If Availability is positioned as an asset of importance to a smarthome service, threatsother than cyber security should require consideration as well. Typical potential
threats are enumerated below.
・Accidents, such as natural disasters and fires
・Hardware failures
・Software faults
・Operation errors committed by operations representatives, acts of negligence,
internal fraud
・Maintenance work (software and hardware update)・Service providers’ service shutdown or withdrawable from business・Damage to hardware and software by physical invasion

Chapter 5 of this document discusses actions to be taken against threats other thanthose to cyber security listed above, as well as finds of the cyber security threat
analyses presented in this section.

Detailed Analysis of Potential Threats
This section launches a more detailed analysis of potential threats based on theanalysis findings presented in the foregoing sections, with their case studies, risk
characteristics and other factors taken into consideration.
It is assumed that the risk characteristics are assigned the items (see Table 3-5)
outlined below.

32ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-5: List of Detailed Analysis Items of Potential Threats
No.

Item

Description

Description of potential threats
1

Entry point

The entry point assumed by a potential threat (IoT
device, cloud).

2

An asset that is exposed to the potential threat (seeAsset to be protected

Table 3-2).
3

Threat category based

A classification of the potential threat (see Table 3-3).

on the STRIDE+CCDS
model

4

Example of the

An example of the potential threat.

potential threat
Risk characteristics
5

Connection I/F

The route of threat invasion (see Table 3-6).

6

Who (who connected)

The entity that is connected to the entry point (seeTable 3-7).

7

Whom (what has been

What has been harmed by the threat (see Table 3-8).

harmed)8Where (where theWhere the threat has occurred (see Table 3-9).

threat has occurred)

The items listed on the connection I/F are listed below.

Table 3-6: Connection I/F Items
A) Connection I/F on a wired connection
No.

Item

Description

A standard under which data is transmitted at rates from1

Ethernet

10Mbps to 1Gps over CAT cables as communication media.
Standardized as IEEE802.3.
High Definition Power Line Communication, or a standard

2

HD-PLC

that uses the frequency band of 2 to 30 MHz to achievecommunication of multiple streams of HDTV video.

3

Wired

Wired communication by means other than 1 and 2 above.

communication33ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
other than above.
B) Connection I/F on a wireless connection
No.

Item

Description

Wi-Fi (wireless fidelity) is a brand name that designates
the certification (Wi-Fi Certified) by the Wi-Fi Alliance of
4

Wi-Fi

the interconnectivity between wireless LAN devices
adhering to IEEE802.11 Series(IEEE802.11a/IEEE802.11b).
A wireless technology standard used for exchanging

5

Bluetooth

simple data between information devices over shortdistances, ranging several meters to several tens ofmeters.
ZigBee is one of the short-distance wirelesscommunication standards designed mainly for sensor
networks. Electrical specifications of its basic part are

6

ZigBeestandardized as IEEE802.15.4. For device-to-device
communications protocols higher than the logical layer,
specifications have been formulated by the ZigBee
Alliance.
Short for Wireless Smart Utility Network, Wi-SUN is an

7

Wi-SUN

interconnect specification for wireless communications
based on IEEE802.15.4g, standardized by the tradeorganization, Wi-SUN Alliance.
Since diversified life styles or business scenes have comeSpecified low8

to dictate means of simple communication over shortranges, the demand for radio communication in relatively

power radio

narrow service areas is growing. In this background, acommunication

system aiming at specified low-power radio stations has
been created, allowing anybody to use low-power radio
communication without being required to comply with theradio operator standard or acquire a radio station license,

9

10

LTE/LTE-Advanced

A communication standard for digital cellular telephonyWireless

Wireless communication other than 4 to 10 above.

communication
other than theabove.

34ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Note:Prepared by the CCDS by consulting TR-1043 and TR-1064 worked out by the
Telecommunication Technology Committee (TTC), a general incorporated association.

The descriptions of Who, Whom and Where are listed below. These descriptions havebeen defined to suit the needs for smarthome services by consulting “Patterns ofConnectivity,” “What Needs to be Protected” and “Locations of Risks” described in the
IPA’s Smart-society Development Guidelines, Second Edition.

Table 3-7: Who (who connected) Items
No.
1

Item

Description

DeviceFor a connection that was envisioned by the IoT device

manufacturer

manufacturer at design time.
For a device or system connected to implement a service.

2

Service provider

This case includes a connection that was not envisioned by
the device manufacturer at design time.

3
4

User (intentional)

For an intentional connection made by a user.

User(wrong

For a wrong connection made by a user.

connection)

5

Attacker

For a malicious connection that targets a vulnerability.

6

Accidental

For a connection made by accident.

Table 3-8: Whom (what has been harmed)
No.

Item

Description

1

IoT function

2

Original function

3

Service

4

Information

5

Life and property

A user’s own life and property

6

OthersAll other objects.

Any function (such as communication or security action)required by an IoT device to connect to a system.
Original functions provided by IoT deices and systems.
A service provided through collaboration between an IoT
device and a system.
Personal information about users, device informationcollected, IoT devices andsystem setup information.

35ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-9: Where (where the threat has occurred)
No.

Item

1

Ordinary-use I/F

Description

A user operation panel, wired/wireless service I/F, USB
terminal and so on.
Examples include an administrator control panel, remote

2

Maintenance I/F

control communication I/F or software update USB
terminal.

3

Nonordinary-use

An unnecessary port left uncovered, USB terminal used

I/F

only during manufacture or the like.
A defect or bug that could result in failure, a vulnerability

4

Included risk

possibly open to attacks, a function that might cause harm
as a result of a failure, abuse or the like.

5

Physical contact

To come into direct contact with a body (as for unauthorized
replacement or alteration of parts).

Table 3-10 and Table 3-11 below present examples of detailed threat analyses of thesystems and devices that make up a smarthome according to the items listed above.

36ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-10: Examples of Detailed Threat Analyses of a Smarthome Service and a Service Provider Information Platform
ThreatEntry PointEP#

Asset to beProtected

Category
Based on the
STRIDE+CCDS

Example of Potential

Connection I/F

Who

Whom

Threats

Table 3-6

Table 3-7

Table 3-8

Where

Table 3-9

Model
【Primary
asset 】
・Hardware,

UnauthorizedaccessEP

Information①

Platform

Service Information

Service

Platform (attacks
exploiting known(securityvulnerabilities)

・SetupService★★

softwarefunction itself)

Smarthome

Unauthorized access to theinformation,
log

★★★

Ordinary-use
I/F

property

Theft of information from★★

data stored in the Service

Information

Information Platform

Disclosure(access control or

Ethernet

Attackerauthentication

・Device status

Ordinary-use
★★★

I/F

Information

overridden).

management★★

Tampering of data or

information

information

Attacker

Life andInformation

information

・Personal

Ethernet

Tamperingsettings in the Smarthome
Service Information
Platform.

Ethernet

Attacker

Service★★★

Ordinary-use
I/F37ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021(user’s name,Life andaddress, phone

property

number and

The Service Provider

the like)

Information Platform or・Updatesoftware★★
Servicethe home gateway is
Spoofing【Secondary

attacked by spoofing or

Ethernet

Attacker

tampered messaging

asset】

I/F

propertyan API.

information★★

Malware infection of the・Encryption
key★★★
Life andduring communication via

・Authentication

Ordinary-use

MalwareService Information

Infection

Platform (attacks launched

Service
Ethernet

Attacker★★★
Life andvia an external network).

Ordinary-use
I/F

property★★

Denial ofService

Service
DDoS (DoS) attack.

Ethernet

Attacker★★★
Life andOrdinary-use
I/F

property
Information

Information Disclosure via

Wired

Service★★

Nonordinary-

Disclosure

a carried-in storage device.

communication

ProviderInformation

use I/F38ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
other than

★★★

above

Information
★★

Wired
MalwareMalware infection via acommunication

Service

Infection

carried-in storage device.

other than

Providerabove

Service★★★
Life andNonordinaryuse I/F

property★★

Information

Theft of update software

Disclosure

information.

Ethernet

Attacker

Information

Maintenance

★★★

I/F

Information★★

TamperingTampering of update
softwareService
Ethernet

Attacker★★★
Life and

Maintenance
I/F

property

Path ofcommunication
between the
Smarthome
Information【Primary asset
EP/Secondary

Information

Internet path by launching②

asset】

Disclosurea man-in-the-middle

Data on a★★

Theft of information on an

attackInformation
Ethernet

Attacker★★★

Ordinary-use
I/F

Information

39ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Platform andcommunication

the Internet

path【Primary
asset 】
・Hardware,

Unauthorizedaccesssoftware(functionitself)・SetupService Provider
InformationEP

information,★★

Service Information

Service

Platform (attacks

Ethernet

vulnerabilities)

property

Theft of information from★★

data stored in the Service

Information

Disclosure(access control or

Ethernet

Attackerauthentication

information★★★
Life andInformation Platform

log

Attacker

exploiting known

Information③
Platform

Unauthorized access to theOrdinary-use
I/F

Ordinary-use
★★★

I/F

Information

overridden).

・Device statusmanagement

Tampering of data or

information

settings in the Smarthome

Tampering・Personal

Service Information★★
Service
Ethernet

Attacker

Life andPlatform.

information★★★

Ordinary-use
I/F

property(user’s name,address, phone

Spoofing

Smarthome Service
Information Platforms

Ethernet

Attacker★★

Ordinary-use

ServiceI/F40ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
number andare attacked by

the like)spoofing or tampered★★★

messaging during

Life andcommunication via an

property【Secondary
asset】

API.

・Authentication
information
・Encryption
key★★

Malware infection of the
MalwareService Information

Infection

Platform (attacks launched

Service
Ethernet

Attacker★★★
Life andvia an external network).

Ordinary-use
I/F

property★★

Denial ofService

Service
DDoS (DoS) attack.

Ethernet

Attacker★★★
Life andOrdinary-use
I/F

property

Information
Disclosure

Information Disclosure
via a carried-in storage
device.

★★

Wiredcommunication

User

Information

Nonordinary-

other than(intentional)★★★

use I/F

above

Information

MalwareMalware infection via a

Wired

User

★★

Nonordinary-

Infection

carried-in storage device.

communication(intentional)

Serviceuse I/F41ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
other than

★★★

above

Life andproperty★★

Information

Theft of update software

Disclosure

information.

Ethernet

Attacker

Information

Maintenance

★★★

I/F

Information★★

TamperingTampering of update
softwareService
Ethernet

Attacker★★★
Life and

Maintenance
I/F

property★★

Path ofcommunication【Primary asset

between the/Secondary

Information
Theft of information on an

SmarthomeEPasset】

Information

Internet path by launching

Service④

Data on a

Disclosurea man-in-the-middle

Information

communication

Platform and thepathattackEthernet

Attacker

Ordinary-use
★★★

I/F

Information

Internet

42ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-11: Detailed Threat Analysis Cases for Home Gateways, Smarthome-Compatible Devices and Smarthome Applications
ThreatEntry PointEP#

Asset to beProtected

Category
Based on the
STRIDE+CCDS

Example of Potential
Threats

Connection I/F

Who

Whom

Where

Model
★★
【Primary

Original

asset 】
Ethernet

・Hardware,
Unauthorized access to asoftware(function itself)
・SetupHome gateway

EP

information, log⑤

information

Attacker

Unauthorized

home gateway（attacks

accessexploiting known

★★★

I/F

function★★

vulnerabilities）

Service
Ethernet

Attacker★★★
Life andinformation

Ordinary-use
I/F

property(user’s name,★★

Theft of information

address, phone

like)

Ordinary-use

Original

・Personal

number and thefunction

Informationfrom data or settings

Disclosure

stored in a home
gateway (access control

Ethernet

Attacker

Information

Ordinary-use

★★★

I/F

Information43ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
or authentication【Secondary

overridden).

asset】★★

・Authentication
information

Original

・Encryption key
Ethernet

Tampering

Attackerfunction

Ordinary-use

★★★

I/F

Tampering of data or

Original

settings stored in a homefunctiongateway★★
Service
Ethernet

Attacker★★★
Life andOrdinary-use
I/F

property
The home gateway is★★

attacked by spoofing of aService

Service Provider
Spoofing

Information Platform andEthernet

Attacker★★★

tampered messaging

Life andduring communication via

property

Ordinary-use
I/F

an API.

44ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021★★
MalwareHome gateway malware

Infection

infection (attacks launched

Service
Ethernet

Attacker

via an external network)★★★
Life andOrdinary-use
I/F

property★★
Service
Denial of Service

DDoS (DoS) attack.

Ethernet

Attacker★★★
Life andOrdinary-use
I/F

property★★
Information

Information Disclosure via

Wired communication

Disclosurea connected storage device.

other than above

User(intentional)

Information

Ordinary-use

★★★

I/F

Information★★
Original
Wired communication
MalwareMalware infection via a

Infectionconnected storage device.

other than above

User(intentional)

function

Ordinary-use

★★★

I/F

OriginalfunctionUser(intentional)★★

45ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Service
Wired communication★★★

other than above

Life andOrdinary-use
I/F

property★★
Original

Ethernetfunction・

Wi-Fi
Wireless

Attacker

communication other
MalwareInfection

Malware Infection from

Ordinary-use

★★★

I/F

Original

than the above.

internal LAN-attached

function・

devices

Information
Ethernet

★★

Wi-Fi

ServiceWireless

Attackerfor launching attacks, e.g.,
as a bot.

★★★

communication otherLife andthan the above.

property

Ordinary-use
I/F★★

Abused as a springboard
Springboard

Information

Ethernet

Attacker

IoT function

Ordinary-use

★★★

I/F

IoT function46ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Path of【Primary asset

communication/Secondary★★
Theft of information on an

between theEPasset】

Information

Internet path by launching

Home gateway⑥

Data on a

Disclosurea man-in-the-middle

and thecommunication

Internet

path

Information
Ethernet

Attacker

attack【Primary

Wi-Fi

asset 】

Wired

・Hardware,communication/wireless

software
SmarthomeServiceEP

Compatible⑦

Devices・Control signal

Unauthorizedaccess・Sensing data

Unauthorized access to a
device (attacks exploiting
known vulnerabilities).

・Personal

I/F

IoT function

★★★

I/F

IoT function

Ethernet

★★

Wi-Fi

Service
Attackernumber and
Theft of information from

Ethernet

Disclosure

data or settings stored in a

Wi-Fi

★★★

I/F

property

than above.
Information

Ordinary-use

Life andcommunication otheraddress, phone

Ordinary-use

Attackerthan above.

communication/wireless(user’s name,★★

communication other

Wiredinformation

the like)★★★
Information

Ethernet(function itself)

Ordinary-use

Attacker★★

Ordinary-use

Information

I/F

47ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021【Secondary
asset】
・Authentication

device (access control orWiredauthentication

communication/wireless★★★

overridden).

communication other

Information

information

than above.

・Encryption key

Ethernet

★★

Wi-Fi

Original

Wiredcommunication/wirelessTampering

Attacker

Ordinary-use

★★★

I/F

communication other

Original

Tampering of data or

than above.

functionsettings stored in a device.

Ethernet

★★

Wi-Fi
Wired
communication/wirelessService
Attacker

Ordinary-use
★★★

I/F

Life andcommunication otherproperty

than above.

Spoofing

function

The device is attacked by

Ethernet Wi-Fi★★

spoofing of the Home

Wired

Servicegateway and tampered

communication/wirelessmessaging duringcommunication othercommunication.

than above.

Attacker★★★

Ordinary-use
I/FLife andproperty48ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021★★

Information Disclosure via
Informationa connected storage device

Wired communication

Disclosure(any compatible device,other than above

User (intentional)

such as a USB interface).

Information

Ordinary-use

★★★

I/F

Information★★
Originalfunction・Malware infection via a
MalwareInfection

Wired communication

User

Information

Ordinary-use

other than above(intentional)

★★★

I/F

connected storage

Original

device (any compatible

function・

device, such as a USB

Informationinterface).

★★
Wired communication

User

other than above(intentional)

Service★★★
Life andOrdinary-use
I/F

property
Ethernet

Springboard

Wi-Fi

Attacker★★

Ordinary-use

OthersI/F49ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Abused as a springboard
for launching attacks, e.g.,
as a bot.

Wiredcommunication/wireless★★★

communication other

Othersthan above.
★★

【Primary asset/Secondary

Wi-Fi

asset】

Wireless

Data on a

Path ofcommunication other
Spoofing of a device

communication

communication

path

betweenSpoofing

・Control
SmarthomeServiceEP⑧

Compatible

than the above.

Wireless
communication otherthe Home
gateway

implementationof the target
device)I/F

Service
Attacker

Theft of information on an

Wi-Fi

Information

Internet path by launching

Wireless

Disclosurea man-in-the-middle

communication otherattackthan the above.

★★★
Life andOrdinary-use
I/F

property(dependent on
the functional

★★★

★★

than the above.

information

Ordinary-use

function
Wi-Fi

Sensing data

function

Original

a man-in-the-middle

・Personal
Devices andAttacker

control signal by launchingattack.

signal 、

Original★★
Information
Attacker★★★

Ordinary-use
I/F

Information50ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
・Authentication
information★★

Information Disclosure on【Primary
asset 】

Information

stored in a device due to a

Wi-Fi

User

Information

Ordinary-use

Disclosure

vulnerability in a

LTE/LTE-Advanced(intentional)

★★★

I/F

・Software

smartphone application.

Information(function itself)★★

・Control signal

Original

Information Disclosure

・Personal
SmartphoneEPapplication⑨

information orconfidential

Information

due to an unauthorized

Wi-Fi

Disclosure

login to a smartphone

LTE/LTE-Advanced

Attacker

application.

information

operation of a device
Spoofing

・Authentication⑩
between a

asset】

Original
Wi-Fi
LTE/LTE-Advanced

Attacker

Spoofing

function

Ordinary-use

★★★

I/F

Original

application.

【Primary asset/Secondary

caused by illegally logging
in to a smartphone

information

communication

I/F

★★

Any unauthorized【Secondary

EP

★★★

function

smartphone

Path of

Ordinary-use

Original

stored in theasset】

functionfunction★★

Spoofing of a device
control signal by launching

Wi-Fi

Attacker

Originalfunction

Ordinary-use
I/F51ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
smartphone

Data on aa man-in-the-middle★★★

and the homecommunication

attack.

Original

gatewaypath

function★★

Theft of information on an
Information

Internet path by launching

Disclosurea man-in-the-middle
attackWi-Fi

Attacker

Information

Ordinary-use

★★★

I/F

Information52ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Calculation of Risk Metrics
Once potential threats and their risk characteristics are analyzed, the next step is tocalculate their risk metrics. Various methods of calculating risk metrics have been
proposed [15], including the CVSS and the OWASP Risk Rating Methodology, ETSITS102 165-1. Risk metrics assume different values depending on how they arecalculated, so that only a comparison of the risk metrics determined in the same
method will be meaningful.
For this reason, once a given method of calculating the risk metrics of smarthome
products and services is defined, it must be put into continued use thereafter.
The work of calculating the risk metrics of smarthome products and services should
also take their uses, particularly, their Life and Property impact, into consideration.

3.5.1 Calculation of Risk Metrics Based on CVSS v3 and Issues
No analytical techniques are currently available for risk analyses and assessment ofsmarthome products and services, since this endeavor has not yet been carried out todate. Preparatory to compilation of this Guidelines, risk analyses and assessment
techniques were surveyed and reviewed and the calculation of risk metrics based on
CVSS v3 [16][17], a commonly used framework of assessing information security
vulnerabilities, was tried.

CVSS Base Scores are to be used in the calculation of threat risk metrics thatprecedes the implementation of security actions. Risk metrics of the threats assumed
for ★★ and ★★★ services based on CVSS v3 are summarized.

53ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-12 Service Risk Metrics Based on CVSS v3(Common to ★★ and ★★★) ※Excerpt

Threat Example
Entry Point

Smarthome Service
Information Platform

Smarthome Service
Information Platform

EP number

EP①

EP②

ThreatCategory

Threat examples

AttackVectorBase Metrics
Privileg
Informati
AttackUser
Confide Integrit Availabil Life and
es
on
Risk
Complexi
Interact Scope ntialityyity
Property
RequireImportan Scorety
ion
Impact Impact Impact Impact
d
ce

Risk
Score
Rank

Unauthorized
AccessUnauthorized access to the Service
Information Platform (attacks exploiting
known vulnerabilities)

Network

High

None

None

Unchanged

High

High

High

None

None

8.1

High

Information
Disclosure

Theft of information from data stored in theService Information Platform (access control
or authentication overridden).

Network

Low

Low

None

Unchanged

High

None

None

None

None

6.5

MediumTamperingTampering of data or settings in the
Smarthome Service Information Platform.

Network

High

None

None

Unchanged

High

High

High

None

None

8.1

High

Malware infection of the Service Information
Malware Infection Platform (attacks launched via an external
network).

Network

High

None

None

Unchanged

High

High

High

None

None

8.1

High

Denial of Service DDoS (DoS) attack

Network

Low

None

None

Unchanged

None

None

High

None

None

7.5

High

Information
Disclosure

Information Disclosure via a carried-instorage device.

Physical

Low

Low

Required Unchanged

High

None

None

None

None

4.1

Medium

Malware Infection

Malware infection via a carried-in storage
device.

Physical

Low

Low

Required Unchanged

High

High

High

None

None

6.4

MediumInformation
Disclosure

Theft of update software.

Network

High

None

None

Unchanged

High

High

High

None

None

8.1

High

TamperingTampering of update software.

Network

High

None

None

Unchanged

High

High

High

None

None

8.1

High

Information
Disclosure

Theft of information on an Internet path bylaunching a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

None

4.8

Medium54ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Issues involved in the application of CVSS v3 to the calculation of risk metrics in thesmarthome field are listed below.

Table 3-13: Issues of Risk Metrics Calculation Based on CVSS v3
Issue

Description① The importance of assets to

Because the CVSS does not allow for the importance ofbeprotected

cannotbereflected in the calculationof risk metrics.

assets to be protected as a risk factor, even threats
exerting a major impact on an asset in a ★★ service,
such as the disclosure of personal information, is notreflected in the calculation of risk metrics.

② The

Life

and

Property

impact cannot be reflectedin the calculation of risk
metrics.

Because the CVSS calculates the extent of impact
incidents may have upon confidentiality, integrity andavailability as a key risk factor, any Life and Property
impact, such as that feared in a ★★★ service, is notreflected in the calculation of risk metrics.

While the application of the CVSS in the smarthome field has yielded issues in (1)and (2) above, actual calculation results made no differences in the risk metrics
between the ★★ and ★★★ services. For this reason, a new, unique method of
calculating risk metrics ("Smarthome Unique Method"), with security characteristics
of smarthome products and services taken into consideration, is defined based on
CVSS v3 in this document.

3.5.2 Definitions of Risk Metrics Calculations Based on the Smarthome Unique
MethodA scheme of calculating smarthome product and service risk metrics (Smarthome
Unique Method) is defined based on CVSS v3. The Smarthome Unique Method uses
the following two values to rate service vulnerabilities.

55ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-14: Vulnerability Scoring Criteria Based on the Smarthome Unique Method
No.

Item

Description

The Base Score represents the severity of a vulnerability itself
and is used for scoring, ahead of the implementation of security
actions.
・Base Scores are calculated by rating the accessconfidentiality, attack impacts on the system security
characteristics of Confidentiality, Integrity and Availability
1Base Score

and on the service security characteristics of Life and Property
and the Importance of Information handled, such as personal
information, and so on.
・The Base Score reflects a vulnerability-specific severity anddoes not depend on time changes surrounding the vulnerability
and the status of security actions taken in the working
environment.
The Environmental Score is a value that represents theseverity of a vulnerability in a system that provides an actual

Environmental
2

Score

service and is used to evaluate the implementation of security
actions.
・The Environmental Score is calculated by reassessing theaccess confidentiality in the service delivery environment,
impact of attacks, the status of security action implementationand so on.

These Base and Environmental Scores are calculated by solving the formulas given
below, with the results being expressed from 0.0 (lowest Severity) to 10.0 (highest
Severity) (in increments of 0.1).

In these Base and Environmental Score formulas, parameters for rating security
characteristics (Life and Property Impact and the Importance of Information
Handled) have been added to CVSS v3 for use as factors (Figure 3-2, Figure 3-3)
relevant to the impacts for calculating CVSS v3 Risk Metrics. More specifically, whena product or service is exposed to a threat, if Life and Property are impacted, theImpact is raised by 1.5 times; if the product or service handles any personal
56ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
information as defined by the Personal Information Protection Law, the Impact israised by 1.2 times (see Table 3-16, Table 3-17, Table 3-25, Table 3-26). To find out
more, see the Base Score and Environment Score formulas appearing later.

57ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021(1) Base Score formula
The Base Score formula is given below.

(1)Impact
Unadjusted Impact=1 - (1-C) x (1-I) x (1-A)
Impact (if Scope is Unchanged) = 6.42×Unadjusted Impact×LP×II
Impact (if Scope is changed) = (7.52 x (Unadjusted Impact -0.029) - 3.25 (Unadjusted Impact -0.02) 15)
×LP×II(2)Exploitability
Exploitability = 8.22×AV×AC×PR×UI(3)Base Score
If Impact ≦ 0, Base Score = 0
If Impact > 0,
・If Scope is Unchanged
Base Score = Impact + Exploitability (*)
・If Scope is changed
Base Score = 1.08 x (Impact+ Exploitability) (*)(*)Rounded at the second decimal place. If the result exceeds 10.0, also 10.0.

Figure 3-2: Base Score (Smarthome Unique Method) Formula

LP/II, C/I/A and AV/AC/PR/UI appearing in the formula are defined in Table 3-15. LP
and II are parameters specific to smarthome products and services and represent theLife and Property Impact and the Importance of Information handled, such as
personal information, respectively. Other parameters are identical to those defined by
CVSS v3.

58ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-15: Base Score Calculation Parameters
No.
1

2

3

4

5

6

7

8

Item

Description

Life and Property

Assesses the possibility of a vulnerability attack(LP) Impact

impacting Life and Property.

Information

Assesses the importance of information (such as personal

Importance (II)information) that is impacted by a vulnerability attack.

Confidentiality(C)Assesses the possibility of information leaking from the

Impactpossible scope of impact from a vulnerability attack.
Assesses the possibility of information in the possible

Integrity(I) Impact

scope of impact being tampered on a vulnerability attack.
Assesses the possibility of operations in the possible scope

Availability(A)of impact being delayed or shut down on a vulnerability

Impactattack.
Assesses from where an attacker can successfully attack

Attack Vector (AV)the vulnerable component.
Assesses the confidentiality of the conditions an attacker

Attackmust meet before successfully attacking a vulnerable

Confidentiality (AC)component.

Privileges Required

Assesses the level of privileges an attacker must possess(PR)

before successfully attacking a vulnerable component.
Assesses the level of user interaction an attacker must

9

User Interaction (UI)

possess before successfully attacking a vulnerable
component.

10

Assesses the scope of impact from attacks at a vulnerable

Scope (S)component.

The values that can be assumed by the individual items are listed below.

Table 3-16 Life and Property (LP) Impact
Item

Yes （Y）
None （N）

Description

If a threat occurs, it would have impact on Life andProperty.
If a threat occurs, it would no impact on Life and Property.

Value
1.5
1.0

59
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-17: Information Importance (II)Item

Description

Value

Any sensitive information as defined below is contained.
Personal information specified in the Personal Information
Protection Law (Article 2) is the kind of information that
relates to an existing individual and that falls under any of
the following categories:
・Information that contains the name of an individual, that
individual's date of birth and so on allowing that individualHigh (H)to be identified. Such information includes what can beeasily checked against other information to help identify an

1.2

individual.
・Information that contains a personal identification code
(which allows a particular individual to be identified byitself).
A code that represents properties of a part of a body,
converted for computer use.
A code that is assigned to each individual concerned inservice usage or in a document.
None (N)1.0

No sensitive information is contained.

Table 3-18: Confidentiality (C), Integrity (I) and Availability (A) Impacts
Item

High (H)Low (L)No (N)

When a threat occurs,

When a threat occurs,

When a threat occurs,

user information anduser information anduser information andsensitive systemsensitive systemsensitive system

Confidentiality

information is

information is

information is not(C)compromised in its

compromised in part,compromised, with noentirety, with the

but with the impact

impact arising.

impact extending tobeing limited.

the whole.
Value: 0.56

Value: 0.22

Value: 0.060ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
When a threat occurs,

When a threat occurs,

When a threat occurs,

user information anduser information anduser information andsensitive systemsensitive systemsensitive system

information becomes

information becomes

information is notaccessible foraccessible foraccessible fortampering, with thetampering, but with

tampering, with no

impact extending to

the impact being

impact arising.

the whole.

limited.

Value: 0.56

Value: 0.22

Value: 0.0

When a threat occurs,

When a threat occurs,

When a threat occurs,

the service may be

the service may be

the service is neither

Availability

shut down

temporarily shut

shut down nor（A）completely.

down or delayed.

delayed, with noIntegrity （I）

impact arising.
Value: 0.56

Value: 0.22

Value: 0.0

Table 3-19: Attack Vector (AV)Item

Description

Value

The vulnerable component can be remotely attacked via a
Network

network.

(N)・The Smarthome Service Information Platform is attacked

0.85

from the Internet (N).
・The gateway is attacked from the Internet.
The vulnerable component needs to be attacked from anadjacent network.
Adjacent(A)・The attack is launched by making connections to a
Smarthome Service Information Platform network.
・The attack is launched by making connections to the wireless

0.62

LAN of a wireless router to which the gateway is connected.
・The attack is launched by making connections to the gateway
LAN terminal or wireless LAN.
Local

The vulnerable component needs to be attacked from a local(L)

environment.

0.55

61
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
・The attack is launched by logging in to a Smarthome Service
Information Platform server.
・The attack is launched by making connections to the gateway
serial console.
The vulnerable component needs to be attacked from a physicalPhysicalaccess environment.

(P)・The attack is launched by making connections to a physical

0.20

terminal of the gateway, such as a JEM-A terminal (HAterminal) or USB terminal.

Table 3-20: Attack Confidentiality (AC)Item

Low (L)

Description

Value

An attacker can always attack the vulnerable component,
without needing special attack conditions.

0.77

Attack conditions that depend on other than the attacker exist.
These conditions might include, for example:
・An attacker needs to collect information about the vulnerable
High
(H)

component beforehand, such as setup information, sequencenumbers and common keys.
・An attacker needs to define the environmental conditions for a

0.44

successful attack, such as the conditions under which contention
occurs and those under which heap spraying succeeds.
・An attacker requires an environment to launch a man-in-themiddle attack.

Table 3-21: Privileges Required (PR)
Value
Item

None
(N)

Description

An attacker does not require any special privileges.

Low

An attacker only requires basic privileges on the(L)vulnerable component.

High

An attacker requires an equivalent of administrator

if Scope is

if Scope is

Unchangedchanged

0.85

0.62

0.68

0.27

0.50

62
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021(H)

privileges on the vulnerable component.

Table 3-22: User Interaction (UI)
Item

None (N)

Description

Vulnerabilities can be exploited without interaction from any
user.

RequiredUser interaction, such as clicking a link, browsing a file or(R)changing settings, is required for a successful exploit.

Value
0.85

0.62

Further, “if Scope is changed” and “if Scope is Unchanged” are defined in Table 3-23.

Table 3-23: Scope (S)Item

Unchanged(U)

Description

The scope of impact falls in the same extent of authentication as thetarget.
For example, Unauthorized Access to a system that shares an accesstoken is an Unchanged Scope.

Changed (C)The scope of impact differs from the vulnerable component in its extent
of authentication.

63ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021(2) Environmental Score formula
The Environmental Score formula is given below.

(1)Modified Impact
Modified Unadjusted Impact =min [ (1 - (1 - MC CR)× (1 - MI IR)× (1 - MA AR)),0.915]◎if Scope is Unchanged
Modified Impact = 6.42×Modified Unadjusted Impact×MLP×MII◎if Scope is changed
Modified Impact = (7.52× (Modified Unadjusted Impact -0.029)-3.25× (Modified Unadjusted Impact -0.02) 15) ×MLP×MII(2)Modified Exploitability
Modified Exploitability = 8.22× MAV× MAC× MPR× MUI(3)Environmental Score
If Modified Impact ≦ 0, Environmental Score = 0
If Modified Impact > 0◎if Scope is Unchanged
Modified Base Score =Modified Impact+Modified Exploitability (※ 1)
Environmental Score =Modified Base Score ×E×RL×RC（ ※2)◎if Scope is changed
Modified Base Score = 1.08× (Modified Impact+Modified Exploitability) (*1)
Environmental Score =Modified Base Score×E×RL×RC （ ※2)(※ 1)Rounded at the second decimal place. If the result exceeds 10.0, also 10.0.
(※ 2)Rounded at the second decimal place.
E: Exploitability, RL: Remediation Level, RC: Since the value of Report Confidence is unchanged
from the current method of metrics calculation, refer to CVSS v3 [16][17].

Figure 3-3: Environmental Score (Smarthome Unique Method) Formula

MLP/MI, CR/IR/AR, MC/MI/MA and MAV/MAC/MPR/MUI appearing in the formula
are defined in Table 3-24. Here, MLP/MII represent Life and Property Impact andInformation Importance of personal information, etc., respectively, and correspond to
LP and II in the Base Score metrics. Other parameters are identical to those definedby CVSS v3.
64ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-24: Environmental Score Calculation Parameters
No.

Item

Description

Life and Property impact and Information Importance.
1

Modified Life andReassesses the possibility of a vulnerability attack

Property Impact

impacting Life and Property.

(MLP)
2

Modified Information

Reassesses the importance of information (e.g., personal

Importance (MII)

information) when it is impacted by a vulnerability attack.

Security requirements for the target system3

4

5

Confidentiality

Scores the level of importance of confidentiality in theRequirement (CR)target system.

Integrity

Scores the level of importance of integrity in the target

Requirement (IR)system.

Availability

Scores the level of importance of availability in the target

Requirement (AR)system.

Reassessment of Base metrics with environmental conditions taken into consideration.
6

Modified

Reassess the possibility of information leaking from theConfidentiality

possible scope of impact from a vulnerability attack.

Impact (MC)7

8Modified Integrity

Reassess the possibility of information in the possible scope

Impact (MI)of impact being tampered on a vulnerability attack.

Modified Availability

Reassesses the possibility of operations in the possible

Impact (MA)scope of impact being delayed or shut down on avulnerability attack.

910

Modified Attack

Reassesses from where an attacker can successfully attack

Vector (MAV)the vulnerable component.

Modified Attack

Reassesses the confidentiality of the conditions an attacker

Confidentiality (MAC)

must meet before successfully attacking a vulnerable
component.

11

12Modified Privileges

Reassesses the level of privileges an attacker must possess

Required (MPR)

before successfully attacking a vulnerable component.

Modified User

Reassesses the level of user interaction an attacker must

Interaction (MUI)

possess before successfully attacking a vulnerable

65ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
component.
Modified Scope (MS)13

Reassesses the scope of impact from attacks at a vulnerable
component.

The values that can be assumed by the individual items are listed below.

Table 3-25: Modified Life and Property Impact (MLP)
Item
Not Defined

Description

Value

Not assessed (the same items as for calculating the Base Score are used).

（X）
Yes（Y）

Same as the definition used for calculating the Base Score （See

1.5

No (N)

Table 3-16 ）1.0

Table 3-26: Modified Information Importance (MII)
Item
Not Defined

Description

Value

Not assessed (the same items as for calculating the Base Score are used).

（X）
High (H)Same as the definition used for calculating the Base Score （See

1.2

No (N)

Table 3-17 ）1.0

66ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-27: Security requirements for the target system （CR/IR/AR）
Item

Not Defined（X）

High (H)This item is not

Loss ofassessed.

Confidentiality

Confidentiality

is likely to haveRequirementa catastrophic(CR)

Medium (M)Loss ofConfidentiality
is likely to havea serious
adverse effect.

adverse effect.

Low (L)
Loss ofConfidentiality
is likely to havea limitedadverse effect.

Value: 1.0

Value: 1.5

Value: 1.0

Value: 0.5

This item is not

Loss of Integrity

Loss of Integrity

Loss of Integrity

assessed.

is likely to haveis likely to haveis likely to havea serious

a limitedadverse effect.

adverse effect.

Integritya catastrophic

Requirement

adverse effect.

(IR)

Value: 1.0

Value: 1.5

Value: 1.0

Value: 0.5

This item is not

Loss of

Loss of

Loss ofassessed.

Availability is

Availability is

Availability islikely to have alikely to have alikely to have acatastrophic

serious adverse

limited adverse

adverse effect.

effect.

effect.

Value: 1.5

Value: 1.0

Value: 0.5

Availability
Requirement(AR)

Value: 1.067ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-28: Modified Confidentiality Impact (MC)Item
Not Defined

Description

Value

Not assessed (the same items as for calculating the Base Score are used).

（X）
High (H)
Low（L）

0.56
Same as the definition used for calculating the Base Score（ See "Confidentiality" in Table 3-18)

No (N)

0.22
0.0

Table 3-29: Modified Integrity Impact (MI)Item
Not Defined

Description

Value

Not assessed (the same items as for calculating the Base Score are used).

（X）
High (H)
Low（L）

0.56
Same as the definition used for calculating the Base Score （ see"Integrity" in Table 3-18)

No (N)

0.22
0.0

Table 3-30: Modified Availability Impact (MA)Item
Not Defined

Description

Value

Not assessed (the same items as for calculating the Base Score are used).

（X）
High (H)
Low（L）

0.56
Same as the definition used for calculating the Base Score （ see"Availability" in Table 3-18)

No (N)

0.22
0.0

Table 3-31: Modified Attack Vector (MAV)
Item
Not Defined（X）

Description

Value

Not assessed (the same items as for calculating the Base Score are used).

Network（N）

0.85

Adjacent (A)Same as the definition used for calculating the Base Score

0.62

Local (L)（See Table 3-19 ）0.55

Physical (P)

0.20

68
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-32: Modified Attack Confidentiality (MAC)
Item
Not Defined（X）

Description

Value

Not assessed (the same items as for calculating the Base Score are used).

Low（L）

Same as the definition used for calculating the Base Score

0.77

High (H)（See Table 3-20 ）.

0.44

Table 3-33: Modified Privileges Required (MPR)
Value
Item

Not Defined

Description

if Scope is

if Scope is

UnchangedchangedNot assessed (the same items as for calculating the Base Score are used).

（X）
None (N)
Low（L）

0.85
Same as the definition used for calculating theBase Score（See Table 3-21 ）.

High (H)

0.62

0.68

0.27

0.50

Table 3-34: Modified User Interaction (MUI)
ItemNot Defined（X）

Description

Value

Not assessed (the same items as for calculating the Base Score are used).

None (N)Same as the definition used for calculating the Base Score

0.85

Required（R）（See Table 3-22 ）.

0.62

Table 3-35: Modified Scope (MS)Item
Not Defined（X）

Description
Not assessed (the same items as for calculating the Base Score are used).

Unchanged (U)Same as the definition used for calculating the Base Score（See Table

Changed（C）

3-23 ）.

69ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021(3) Severity rating scale
According to the Smarthome Unique Method, severity ratings are set the same way as
under CVSS v3, as follows:

Table 3-36: Severity Rating Scale
Severity

CriticalHigh

Medium

Low

None

Score

9.0～10.0

7.0～8.9

4.0～6.9

0.1～3.9

0(4) Calculation of risk metrics based on the Smarthome Unique Method
Table 3-37 summarizes the calculations of risk metrics based on the Smarthome
Unique Method.

Table 3-37: Risk Metrics of Services Based on the Smarthome Unique Method① CVSS v3 calculation example:Smarthome Unique Method not appliedThreat Example
Entry Point

EP number

Smarthome Service
EP①
Information Platform

ThreatCategory

Threat examples

AttackVectorUnauthorized access to theUnauthorized Service Information Platform
Access(attacks exploiting known
vulnerabilities)

Network

Base Metrics
Privileg
Informati
AttackUser
Confide Integrit Availabil Life and
es
on
Risk
Complexi
Interact Scope ntialityyity
Property
RequireImportan Scorety
ion
Impact Impact Impact Impact
d
ce
High

None

None

Unchanged

High

High

High

None

None

8.1

Risk
Score
Rank

High

② CVSS v3 calculation example:Smarthome Unique Method applied (with impacts on Information Importance)
Threat Example
Entry Point

EP number

Smarthome Service
EP①
Information Platform

ThreatCategory

Threat examples

AttackVectorUnauthorized access to theUnauthorized Service Information Platform
Access(attacks exploiting known
vulnerabilities)

Network

Base Metrics
Privileg
Informati
AttackUser
Confide Integrit Availabil Life and
es
on
Risk
Complexi
Interact Scope ntialityyity
Property
RequireImportan Scorety
ion
Impact Impact Impact Impact
d
ce
High

None

None

Unchanged

High

High

High

None

High

9.1

Risk
Score
Rank

Critical③ CVSS v3 calculation example:Smarthome Unique Method applied(with impacts on Information Importance and Life/Property)
Threat Example
Entry Point

EP number

Smarthome Service
EP①
Information Platform

ThreatCategory

Threat examples

AttackVectorUnauthorized access to theUnauthorized Service Information Platform
Access(attacks exploiting known
vulnerabilities)

Network

Base Metrics
Privileg
Informati
AttackUser
Confide Integrit Availabil Life and
es
on
Risk
Complexi
Interact Scope ntialityyity
Property
RequireImportan Scorety
ion
Impact Impact Impact Impact
d
ce
High

None

None

Unchanged

High

High

High

Yes

High

10

Risk
Score
Rank

CriticalFirst, (1) gives an example of risk metrics calculated under the current CVSS v370ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
without the Smarthome Unique Method applied, where a risk metric value of 8.1(High) is determined. In (2), a risk metric value of 9.3 (Critical) is determined for thesame potential threats when a use case in which personal information is handled in a★★ service is assumed. Further, in (3) above, a risk metric value of 10 (Critical) is
worked out for the same potential threats involving the use of personal information or
possible the Life and Property impact.
Thus, the Smarthome Unique Method has been found to identify differences in theassessment results even in the threat cases in which personal information is among
the assets to be protected or in which a Life and Property impact is involved, whencompared with the current CVSS v3.

3.5.3 Results of Risk Metrics Calculations Based on the Smarthome Unique
MethodRisk metrics are calculated for each individual incident using the Smarthome Unique
Method defined in the foregoing section. Table 3-38 and Table 3-39 summarize theresults of calculation of the Automatic Shutter Opening/Closing Service (★★) and the
On-Call Security Service (★★★), respectively.

71ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-38 Automatic Shutter Opening/Closing Service ( ★★) Risk Metrics (before Security Action)
Base Metrics

Threat Example
Entry Point

Smarthome Service
Information Platform

Path ofCommunication
between the
Smarthome Service
Information Platform
and the Internet

EP Number

EP①

EP②

User
PrivilegesInteractio
RequirednConfidenti
Integrity Availability
ality
ImpactImpactImpactLife and
Property
ImpactInformation
Importance

Risk value

Risk value
rank

High

None

High

9.3

Critical

None

None

None

High

7.2

High

High

High

High

None

High

9.3

Critical

Unchanged

Low

High

High

None

High

8.8

High

None

Unchanged

High

High

High

None

High

9.3

Critical

None

Unchanged

None

None

High

None

None

7.5

High

Low

Required Unchanged

High

None

None

None

High

4.9

MediumLow

Low

Required Unchanged

High

High

High

None

High

7.6

High

Network

High

None

None

Unchanged

High

High

High

None

High

9.3

CriticalTampering of update software.

Network

High

None

None

Unchanged

High

High

High

None

High

9.3

Critical

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

High

5.5

MediumThreat Example

AttackVector

AttackComplexity

Unauthorized Access

Unauthorized access to the Service
Information Platform (attacks
exploiting known vulnerabilities).

Network

High

None

None

Unchanged

High

High

Information Disclosure

Theft of information from datastored in the Service Information
Platform (access control orinadequate authentication).

Network

Low

Low

None

Unchanged

High

TamperingTampering of data or settings in theService Information Platform.

Network

High

None

None

Unchanged

Spoofing

Attack by tampered message by
disguising oneself as the Service
Provider Information Platform or thehome gateway during communication
via an API.

Network

High

None

None

Malware Infection

Malware infection of the Service
Information Platform (attacks
launched via an external network).

Network

High

None

Denial of Service

DDoS (DoS) attack.

Network

Low

None

Information Disclosure

Information Disclosure via a carriedin storage device.

Physical

Low

Malware Infection

Malware infection via a carried-instorage device.

PhysicalInformation Disclosure

Theft of update software.

Tampering

Information Disclosure

Threat Category

Scope

72
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Base Metrics

Threat Example
Entry Point

Service Provider
Information Platform

Path ofCommunication
between the Service
Provider Information
Platform and theInternet

EP Number

Confidenti
Integrity Availability
ality
ImpactImpactImpactLife and
Property
ImpactInformation
Importance

Risk value

Risk value
rank

High

None

None

8.1

High

None

None

None

None

6.5

Medium

High

High

High

None

None

8.1

High

Unchanged

Low

High

High

None

None

7.7

High

None

Unchanged

High

High

High

None

None

8.1

High

None

Unchanged

None

None

High

None

None

7.5

High

Low

Required Unchanged

High

None

None

None

None

4.1

MediumLow

Low

Required Unchanged

High

High

High

None

None

6.4

MediumNetwork

High

None

None

Unchanged

High

High

High

None

None

8.1

High

Tampering of update software.

Network

High

None

None

Unchanged

High

High

High

None

None

8.1

High

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

None

4.8

MediumAttackVector

AttackComplexity

Unauthorized Access

Unauthorized access to the Service
Information Platform (attacks
exploiting known vulnerabilities)

Network

High

None

None

Unchanged

High

High

Information Disclosure

Theft of information from datastored in the Service Information
Platform (access control orinadequate authentication).

Network

Low

Low

None

Unchanged

High

TamperingTampering of data or settings in theService Information Platform.

Network

High

None

None

Unchanged

Spoofing

Attack by tampered message by
disguising oneself as the Smarthome
Service Information Platform duringcommunication via an API.

Network

High

None

None

Malware Infection

Malware infection of the Service
Information Platform (attacks
launched via an external network).

Network

High

None

Denial of Service

DDoS (DoS) attack.

Network

Low

None

Information Disclosure

Information Disclosure via a carriedin storage device.

Physical

Low

Malware Infection

Malware infection via a carried-instorage device.

PhysicalInformation Disclosure

Theft of update software.

Tampering

Information Disclosure

EP③

EP④

User
PrivilegesInteractio
RequirednThreat Example

Threat Category

Scope

73
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Base Metrics

Threat Example
Entry Point

EP NumberThreat Category

Unauthorized AccessInformation Disclosure

Tampering

Spoofing

Malware Infection
Home Gateway

Path ofCommunication
between the Home
Gateway and theInternet

EP⑤

EP⑥

Threat Example

Unauthorized access to the home
gateway (attacks exploiting known
vulnerabilities).
Theft of information from data or
settings stored in the home gateway(access control or inadequate
authentication).
Tampering of data or settings stored
in the home gateway.
Attack by tampered message by
disguising oneself as the Service
Provider Information Platform duringcommunication via an API.
Malware infection of the home
gateway (attacks launched via an
external Internet)

User
PrivilegesInteractio
RequirednConfidenti
Integrity Availability
ality
ImpactImpactImpactLife and
Property
ImpactInformation
Importance

Risk value

Risk value
rank

High

None

None

8.1

High

None

None

None

None

6.5

Medium

High

High

High

None

None

8.1

High

Unchanged

Low

High

High

None

None

7.7

High

None

Unchanged

High

High

High

None

None

8.1

High

None

Unchanged

None

None

High

None

None

7.5

High

AttackVector

AttackComplexity

Network

High

None

None

Unchanged

High

High

Network

Low

Low

None

Unchanged

High

Network

High

None

None

Unchanged

Network

High

None

None

Network

High

None

Scope

Denial of Service

DDoS (DoS) attack.

Network

Low

None

Information Disclosure

Information Disclosure via aconnected storage device.

Physical

Low

Low

Required Unchanged

High

None

None

None

None

4.1

Medium

Malware Infection

Malware infection via a connectedstorage device.

Physical

Low

Low

Required Unchanged

High

High

High

None

None

6.4

Medium

Malware Infection

Malware Infection from internal
equipment on the LAN

Adjacent

Low

None

None

Unchanged

High

High

High

None

None

8.8

High

Springboard

Abused as a springboard forlaunching attacks, e.g., as a bot.

Network

Low

Low

None

Change

None

None

None

None

None

3.2

Low

Information Disclosure

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

None

4.8

Medium74ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Base Metrics

Threat Example
Entry Point

EP NumberThreat Category

Unauthorized AccessInformation Disclosure

Smarthomecompatible Devices

Path ofCommunication
between Smarthomecompatible Devices
and the Home
Gateway

EP⑦

Threat Example

Unauthorized access to a device(attacks exploiting known
vulnerabilities).
Theft of information from data or
settings stored in a device (access
control or inadequate
authentication).

User
PrivilegesInteractio
RequirednConfidenti
Integrity Availability
ality
ImpactImpactImpactLife and
Property
ImpactInformation
Importance

Risk value

Risk value
rank

High

None

None

8.1

High

None

None

None

None

6.5

MediumAttackVector

AttackComplexity

Network

High

None

None

Unchanged

High

High

Network

Low

Low

None

Unchanged

High

Scope

TamperingTampering of data or settings stored
in a device.

Network

High

None

None

Unchanged

High

High

High

None

None

8.1

High

Spoofing

Attack by tampered message by
disguising oneself as the home
gateway during communication.

Network

High

None

None

Unchanged

Low

High

High

None

None

7.7

High

Information Disclosure

Information Disclosure via aconnected storage device (anycompatible device, such as a USB
interface).

Physical

Low

Low

Required Unchanged

High

None

None

None

None

4.1

Medium

Malware Infection

Malware infection via a connectedstorage device (any compatible
device, such as a USB interface).

Physical

Low

Low

Required Unchanged

High

High

High

None

None

6.4

MediumSpringboard

Abused as a springboard forlaunching attacks, e.g., as a bot.

Network

Low

Low

None

Change

Low

None

None

None

None

5

MediumSpoofing

Spoofing of a device control signal
by a man-in-the-middle attack.

Adjacent

High

Low

None

Change

Low

High

High

None

None

7.9

High

Information Disclosure

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

None

4.8

MediumEP⑧75ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Base Metrics

Threat Example
Entry Point

Smartphone
Application

Path ofCommunication
between a
Smartphone and theHome Gateway

EP Number

EP⑨

User
PrivilegesInteractio
RequirednConfidenti
Integrity Availability
ality
ImpactImpactImpactLife and
Property
ImpactInformation
Importance

Risk value

Risk value
rank

None

None

High

7.6

High

None

None

None

High

7.2

High

None

None

High

None

None

7.7

High

Change

Low

High

High

None

None

7.9

High

Unchanged

High

None

None

None

High

5.5

MediumThreat Example

AttackVector

AttackComplexity

Information Disclosure

Information Disclosure stored in a
device due to a vulnerability in asmartphone application.

Network

High

None

None

ChangeHigh

NoneInformation Disclosure

Information Disclosure due to an
unauthorized login to a smartphone
application.

Network

Low

Low

None

UnchangedHigh

Spoofing

Any unauthorized operation of adevice caused by illegal login to asmartphone application. (spoofing)

Network

Low

Low

None

ChangeSpoofing

Spoofing of a device control signal
by a man-in-the-middle attack.

Adjacent

High

Low

None

Information Disclosure

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Threat Category

Scope

EP⑩

※Assumptions of Risk Metrics Calculation
・According to the use case of the automatic shutter opening/closing service, no personal information will be stored on or transmitted
to and from Smarthome-compatible devices.

76ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-39: On-Call Security Service (★★★) Risk Metrics (before Security Action)
Base Metrics

Threat Example
Entry Point

EP numberThreat Category

Unauthorized
AccessInformation
Disclosure

Smarthome Service
Information Platform

Path ofCommunication
between the
Smarthome Service
Information Platform

Unauthorized access to the Service
Information Platform (attacks
exploiting known vulnerabilities)
Theft of information from datastored in the Service Information
Platform (access control orinadequate authentication).

AttackVector

AttackUser
Privileges
ConfidentiInteractio
Required
ality
n

Scope

Confidenti
Integrity Availability
ality
ImpactImpactImpactLife and
Property
ImpactInformationImportanc
e

Risk
Score

Risk
Score
Rank

Network

High

None

None

Unchanged

High

High

High

Yes

High

10

CriticalNetwork

Low

Low

None

Unchanged

High

None

None

None

High

7.2

High

TamperingTampering of data or settings in theService Information Platform.

Network

High

None

None

Unchanged

High

High

High

Yes

High

10

CriticalSpoofing

Attack by tampered message by
disguising oneself as the Service
Provider Information Platform or thehome gateway during communication
via an API.

Network

High

None

None

Unchanged

Low

High

High

Yes

High

10

CriticalMalware Infection

Malware infection of the Service
Information Platform (attacks
launched via an external network).

Network

High

None

None

Unchanged

High

High

High

Yes

High

10

CriticalDenial of Service

DDoS (DoS) attack.

Network

Low

None

None

Unchanged

None

None

High

Yes

None

9.3

CriticalInformation
Disclosure

Information Disclosure via a carriedin storage device.

Physical

Low

Low

Required Unchanged

High

None

None

None

High

4.9

Medium

Malware Infection

Malware infection via a carried-instorage device.

Physical

Low

Low

Required Unchanged

High

High

High

Yes

High

10

CriticalInformation
Disclosure

Theft of update software.

Network

High

None

None

Unchanged

High

High

High

None

High

9.3

CriticalTamperingTampering of update software.

Network

High

None

None

Unchanged

High

High

High

Yes

High

10

CriticalInformation
Disclosure

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

High

5.5

MediumEP①

EP②

Threat examples

77ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Base Metrics

Threat Example
Entry Point

Service Provider
Information Platform

Path ofcommunication
between the Service
Provider Information
Platform and theInternet

EP number

EP③

EP④

Life and
Property
ImpactInformationImportanc
e

Risk
Score

Risk
Score
Rank

High

Yes

High

10

Critical

None

None

None

High

7.2

High

High

High

High

Yes

High

10

Critical

Unchanged

Low

High

High

Yes

High

10

Critical

None

Unchanged

High

High

High

Yes

High

10

Critical

None

Unchanged

None

None

High

Yes

None

9.3

Critical

Low

Required Unchanged

High

None

None

None

High

4.9

MediumLow

Low

Required Unchanged

High

High

High

Yes

High

10

CriticalNetwork

High

None

None

Unchanged

High

High

High

None

High

9.3

CriticalTampering of update software.

Network

High

None

None

Unchanged

High

High

High

Yes

High

10

Critical

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

High

5.5

MediumAttackUser
Privileges
ConfidentiInteractio
RequiredalitynConfidenti
Integrity Availability
ality
ImpactImpactImpactThreat examples

AttackVectorUnauthorized
AccessUnauthorized access to the Service
Information Platform (attacks
exploiting known vulnerabilities)

Network

High

None

None

Unchanged

High

High

Information
Disclosure

Theft of information from datastored in the Service Information
Platform (access control orinadequate authentication).

Network

Low

Low

None

Unchanged

High

TamperingTampering of data or settings in theService Information Platform.

Network

High

None

None

Unchanged

Spoofing

Attack by tampered message by
disguising oneself as the Smarthome
Service Information Platform duringcommunication via an API.

Network

High

None

None

Malware Infection

Malware infection of the Service
Information Platform (attacks
launched via an external network).

Network

High

None

Denial of Service

DDoS (DoS) attack.

Network

Low

None

Information
Disclosure

Information Disclosure via a carriedin storage device.

Physical

Low

Malware Infection

Malware infection via a carried-instorage device.

PhysicalInformation
Disclosure

Theft of update software.

Tampering

Information
Disclosure

Threat Category

Scope

78
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Base Metrics

Threat Example
Entry Point

Home Gateway

Path ofCommunication
between the Home
Gateway and theInternet

EP number

EP⑤

EP⑥

Life and
Property
ImpactInformationImportanc
e

Risk
Score

Risk
Score
Rank

High

Yes

High

10

Critical

None

None

None

High

7.2

High

High

High

High

Yes

High

10

Critical

Unchanged

Low

High

High

Yes

High

10

Critical

None

Unchanged

High

High

High

Yes

High

10

Critical

None

Unchanged

None

None

High

Yes

None

9.3

Critical

Low

Required Unchanged

High

None

None

None

High

4.9

MediumLow

Low

Required Unchanged

High

High

High

Yes

High

10

Critical

Adjacent

Low

None

None

Unchanged

High

High

High

Yes

High

10

CriticalAbused as a springboard forlaunching attacks, e.g., as a bot.

Network

Low

Low

None

Change

None

None

None

None

None

3.2

Low

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

High

5.5

MediumAttackUser
Privileges
ConfidentiInteractio
RequiredalitynConfidenti
Integrity Availability
ality
ImpactImpactImpactThreat examples

AttackVectorUnauthorized
AccessUnauthorized access to the home
gateway (attacks exploiting known
vulnerabilities).

Network

High

None

None

Unchanged

High

High

Information
Disclosure

Theft of information from data or
settings stored in the home gateway(access control or inadequate
authentication).

Network

Low

Low

None

Unchanged

High

TamperingTampering of data or settings stored
in the home gateway.

Network

High

None

None

Unchanged

Spoofing

Attack by tampered message by
disguising oneself as the Service
Information Platform duringcommunication via an API.

Network

High

None

None

Malware Infection

Malware infection of the home gateway(attacks launched via an externalInternet)

Network

High

None

Denial of Service

DDoS (DoS) attack.

Network

Low

None

Information
Disclosure

Information Disclosure via a connectedstorage device.

Physical

Low

Malware Infection

Malware infection via a connectedstorage device.

PhysicalMalware Infection

Malware Infection from internal
equipment on the LAN

Springboard

Information
Disclosure

Threat Category

Scope

79
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Base Metrics

Threat Example
Entry Point

Smarthomecompatible Devices

Path ofCommunication
between Smarthomecompatible Devices
and the Home
Gateway

EP number

EP⑦

Threat Category

Threat examples

AttackVector

AttackUser
Privileges
ConfidentiInteractio
Required
ality
n

Scope

Confidenti
Integrity Availability
ality
ImpactImpactImpactLife and
Property
ImpactInformationImportanc
e

Risk
Score

Risk
Score
Rank

Unauthorized
AccessUnauthorized access to a device(attacks exploiting known
vulnerabilities).

Network

High

None

None

Unchanged

High

High

High

Yes

High

10

CriticalInformation
Disclosure

Theft of information from data or
settings stored in a device (access
control or inadequate authentication).

Network

Low

Low

None

Unchanged

High

None

None

None

High

7.2

High

TamperingTampering of data or settings stored in a
device.

Network

High

None

None

Unchanged

High

High

High

Yes

None

10

CriticalSpoofing

Attack by tampered message by
disguising oneself as the home
gateway during communication.

Network

High

None

None

Unchanged

Low

High

High

Yes

None

10

CriticalInformation
Disclosure

Information Disclosure via a connectedstorage device (any compatible device,
such as a USB interface).

Physical

Low

Low

Required Unchanged

High

None

None

None

High

4.9

Medium

Malware Infection

Malware infection via a connectedstorage device (any compatible
device, such as a USB interface).

Physical

Low

Low

Required Unchanged

High

High

High

Yes

High

10

CriticalSpringboard

Abused as a springboard forlaunching attacks, e.g., as a bot.

Network

Low

Low

None

Change

Low

None

None

None

None

5

MediumSpoofing

Spoofing of a device control signal
by a man-in-the-middle attack.

Adjacent

High

Low

None

Change

Low

High

High

Yes

None

10

CriticalInformation
Disclosure

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Unchanged

High

None

None

None

High

5.5

MediumEP⑧80ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Base Metrics

Threat Example
Entry Point

Smartphone
Application

Path ofCommunication
between a
Smartphone and theHome Gateway

EP number

EP⑨

AttackUser
Privileges
ConfidentiInteractio
RequiredalitynLife and
Property
ImpactInformationImportanc
e

Risk
Score

Risk
Score
Rank

None

None

High

7.6

High

None

None

None

High

7.2

High

None

None

High

None

None

7.7

High

Change

Low

High

High

None

None

7.9

High

Unchanged

High

None

None

None

High

5.5

MediumConfidenti
Integrity Availability
ality
ImpactImpactImpactThreat examples

AttackVectorInformation
Disclosure

Information Disclosure stored in a
device due to a vulnerability in asmartphone application.

Network

High

None

None

ChangeHigh

NoneInformation
Disclosure

Information Disclosure due to an
unauthorized login to a smartphone
application.

Network

Low

Low

None

UnchangedHigh

Spoofing

Any unauthorized operation of adevice caused by illegal login to asmartphone application.

Network

Low

Low

None

ChangeSpoofing

Spoofing of a device control signal
by a man-in-the-middle attack.

Adjacent

High

Low

None

Information
Disclosure

Theft of information on an Internet
path by a man-in-the-middle attack.

Adjacent

High

Low

None

Threat Category

Scope

EP⑩

81
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Risk Analysis and Assessment Summary
The preceding sections have presented the summary and the procedural flow of risk
analyses and assessments of smarthome products and services. In the process, a new
and unique method of calculation has been defined to allow the Life and Property
impact and Importance of Information handled, such as personal information, to bereflected in the calculation of risk metrics.
The application of the Smarthome Unique Method to the use case described in
Sections 2.4.1 and 2.4.2 has verified that the Life and Property impact andImportance of Information handled are reflected in the risk metrics of the threats
influencing Life and Property and of handling personal information.

Exploring Security Actions
Possible security actions are explored starting with threats having the highest levelof severity based on risk metrics calculations. Security action can be set by consulting“Table 3-6 and Table 3-7 Action Candidate Lists" in “A Guide to Security Design in
IoT Development”[6], "Annex2 Action Item List for Physical and Technical Action" in“Guidelines on Information Security Actions in Providing Cloud Services(Second
Edition)” [9], and frameworks, such as those detailed in OTA [18] and OWASP [19]. In
exploring possible actions, allowance should also be made for the occurrence
frequency of each incidence, the impact when it occurs, the cost of actions to deal withand so on. Security actions considered in this document will be detailed in Chapter 4
and after.

Once security actions are thus formulated, the validity and cost effectiveness can beverified by assessing the CVSS environmental metrics.
Table 3-40 and Table 3-41 show the metric calculations of the Automatic Shutter
Opening/Closing Service (★★) and the On-Call Security Service (★★★), respectively.

82ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-40 Automatic Shutter Opening/Closing Service (★★) Risk Metrics (after Security Action)
Environmental Metrics

Threat Example
Entry point

Smarthome Service
Information Platform

Path ofCommunication
between the
Smarthome Service
Information Platform
and the Internet

EP Number

EP①

EP②

Threat Category

Threat Example

Requireme
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified
Modified Modified
nt for
AttackConfidentiLife andnt fornt for
AttackPrivileges
User
Modified Scope
Integrity Availability
Confidenti
Complexit
ality
Property
Integrity Availability Vector
Required Interaction
ImpactImpactality
yImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

Unauthorized
AccessUnauthorized access to the Service
Information Platform (attacks exploiting
known vulnerabilities)

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Information
Disclosure

Theft of information from data stored in
the Service Information Platform (access
control or inadequate authentication).

High

High

Low

Network

High

High

None

Unchanged

Low

Low

None

None

High

5

MediumTamperingTampering of data or settings in theService Information Platform.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Spoofing

Attack by tampered message by disguisingoneself as the Service Provider
Information Platform or the home gateway
during communication via an API.

Low

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

6.9

Medium

Malware Infection

Malware infection of the Service
Information Platform (attacks launched via
an external network).

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Denial of Service

DDoS (DoS) attack.

Low

Low

High

Network

Low

None

None

Unchanged

None

None

Low

None

None

6.1

MediumInformation
Disclosure

Information Disclosure via a carried-instorage device.

High

Low

Low

Physical

Low

High

Required

Unchanged

Low

None

None

None

High

2.8

Low

Malware Infection

Malware infection via a carried-in storage
device.

High

High

High

Physical

Low

High

Required

Unchanged

Low

Low

Low

None

High

5.6

MediumInformation
Disclosure

Theft of update software.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

TamperingTampering of update software.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Information
Disclosure

Theft of information on an Internet pathby a man-in-the-middle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

High

3.1

Low

83
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Environmental Metrics

Threat Example
Entry point

Service Provider
Information Platform

Path ofCommunication
between the Service
Provider Information
Platform and theInternet

EP Number

EP③

EP④

Threat Category

Threat Example

Requireme
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified
Modified Modified
nt for
AttackConfidentiLife andnt fornt for
AttackPrivileges
User
Modified Scope
Integrity Availability
Confidenti
Complexit
ality
Property
Integrity Availability Vector
Required Interaction
ImpactImpactality
yImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

Unauthorized
AccessUnauthorized access to the Service
Information Platform (attacks exploiting
known vulnerabilities)

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumInformation
Disclosure

Theft of information from data stored in
the Service Information Platform (access
control or inadequate authentication).

High

High

Low

Network

High

High

None

Unchanged

Low

Low

None

None

None

4.3

MediumTamperingTampering of data or settings in theService Information Platform.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumSpoofing

Attack by tampered message by disguisingoneself as the Smarthome Service
Information Platform during communication
via an API.

Low

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.1

Medium

Malware Infection

Malware infection of the Service
Information Platform (attacks launched via
an external network).

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumDenial of Service

DDoS (DoS) attack.

Low

Low

High

Network

Low

None

None

Unchanged

None

None

Low

None

None

6.1

MediumInformation
Disclosure

Information Disclosure via a carried-instorage device.

High

Low

Low

Physical

Low

High

Required

Unchanged

Low

None

None

None

None

2.4

Low

Malware Infection

Malware infection via a carried-in storage
device.

High

High

High

Physical

Low

High

Required

Unchanged

Low

Low

Low

None

None

4.8

MediumInformation
Disclosure

Theft of update software.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumTamperingTampering of update software.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumInformation
Disclosure

Theft of information on an Internet pathby a man-in-the-middle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

None

2.7

Low

84
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Environmental Metrics

Threat Example
Entry point

Home Gateway

Path ofCommunication
between the Home
Gateway and theInternet

EP NumberThreat Category

Threat Example

Requireme
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified
Modified Modified
nt for
AttackConfidentiLife andnt fornt for
AttackPrivileges
User
Modified Scope
Integrity Availability
Confidenti
Complexit
ality
Property
Integrity Availability Vector
Required Interaction
ImpactImpactality
yImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

Unauthorized
AccessUnauthorized access to the home gateway(attacks exploiting known vulnerabilities).

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumInformation
Disclosure

Theft of information from data or settings
stored in the home gateway (access
control or inadequate authentication)

High

High

Low

Network

High

High

None

Unchanged

Low

Low

None

None

None

4.3

MediumTamperingTampering of data or settings stored in thehome gateway.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumSpoofing

Attack by tampered message by disguisingoneself as the Service Information
Platform during communication via an API.

Low

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.1

Medium

Malware Infection

Malware infection of the home gateway(attacks launched via an external Internet)

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumDenial of Service

DDoS (DoS) attack.

Low

Low

High

Network

Low

None

None

Unchanged

None

None

Low

None

None

6.1

MediumInformation
Disclosure

Information Disclosure via a connectedstorage device.

High

Low

Low

Physical

Low

High

Required

Unchanged

Low

None

None

None

None

2.4

Low

Malware Infection

Malware infection via a connected storage
device.

High

High

High

Physical

Low

High

Required

Unchanged

Low

Low

Low

None

None

4.8

Medium

Malware Infection

Malware Infection from internal equipmenton the LAN

High

High

High

Adjacent

Low

None

None

Unchanged

Low

Low

Low

None

None

7.4

High

Springboard

Abused as a springboard for launchingattacks, e.g., as a bot.

Low

Low

Low

Network

Low

High

None

Change

None

None

None

None

None

2.3

Low

Information
Disclosure

Theft of information on an Internet pathby a man-in-the-middle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

None

2.7

Low

EP⑤

EP⑥

85
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Environmental Metrics

Threat Example
Entry point

Smarthomecompatible Devices

Path ofCommunication
between Smarthomecompatible Devices
and the Home
Gateway

EP Number

EP⑦

Threat Category

Threat Example

Requireme
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified
Modified Modified
nt for
AttackConfidentiLife andnt fornt for
AttackPrivileges
User
Modified Scope
Integrity Availability
Confidenti
Complexit
ality
Property
Integrity Availability Vector
Required Interaction
ImpactImpactality
yImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

Unauthorized
AccessUnauthorized access to a device (attacks
exploiting known vulnerabilities).

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumInformation
Disclosure

Theft of information from data or settings
stored in a device (access control orinadequate authentication).

High

High

Low

Network

High

High

None

Unchanged

Low

None

None

None

None

2.9

Low

TamperingTampering of data or settings stored in a
device.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumSpoofing

Attack by tampered message by disguisingoneself as the home gateway duringcommunication.

Low

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.1

MediumInformation
Disclosure

Information Disclosure via a connectedstorage device (any compatible device,
such as a USB interface).

High

Low

Low

Physical

Low

High

Required

Unchanged

Low

None

None

None

None

2.4

Low

Malware Infection

Malware infection via a connected storage
device (any compatible device, such as a
USB interface).

High

High

High

Physical

Low

High

Required

Unchanged

Low

Low

Low

None

None

4.8

MediumSpringboard

Abused as a springboard for launchingattacks, e.g., as a bot.

Low

Low

Low

Network

Low

High

None

Change

None

None

None

None

None

2.3

Low

Spoofing

Spoofing of a device control signal by a
man-in-the-middle attack.

High

High

High

Physical

High

High

None

Change

Low

Low

Low

None

None

5.8

MediumInformation
Disclosure

Theft of information on an Internet pathby a man-in-the-middle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

None

2.7

Low

EP⑧

86
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Environmental Metrics

Threat Example
Entry point

Smartphone
Application

Path ofcommunication
between asmartphone and thehome gateway

EP NumberEP⑨Threat Category

Threat Example

Requireme
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified
Modified Modified
nt for
AttackConfidentiLife andnt fornt for
AttackPrivileges
User
Modified Scope
Integrity Availability
Confidenti
Complexit
ality
Property
Integrity Availability Vector
Required Interaction
ImpactImpactality
yImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

Information
Disclosure

Information Disclosure stored in a device
due to a vulnerability in a smartphone
application.

High

High

High

Local

High

None

None

Change

Low

None

None

None

High

4.5

MediumInformation
Disclosure

Information Disclosure due to an
unauthorized login to a smartphone
application.

High

High

High

Network

Low

High

None

Unchanged

None

None

Low

None

High

3.8

Low

Spoofing

Any unauthorized operation of a device
caused by illegally logging in to asmartphone application.

High

High

High

Network

Low

High

None

Change

None

None

Low

None

None

5

MediumSpoofing

Spoofing of a device control signal bylaunching a man-in-the-middle attack.

High

High

High

Physical

High

High

None

Change

Low

Low

Low

None

None

5.8

MediumInformation
Disclosure

Theft of information on an Internet pathby launching a man-in-the-middle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

High

3.1

Low

EP⑩

87
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 3-41 On-Call Security Service (★★★) Risk Metrics (after Security Action)

Environmental Metrics

Threat Example
Entry point

Smarthome service
information Platform

Path ofcommunication
between the
Smarthome Service
Information Platform
and the Internet

EP Number

EP①

EP②

Threat Category

Threat Example

Requireme
Modified
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified Modified
nt for
AttackUser
ConfidentiLife andnt fornt for
AttackPrivileges
Modified Scope
Integrity Availability
Confidenti
Complexit
Interactio
ality
Property
Integrity Availability Vector
Required
ImpactImpactality
yn
ImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

Unauthorized
AccessUnauthorized access to the Service
Information Platform (attacks
exploiting known vulnerabilities)

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Information
Disclosure

Theft of information from datastored in the Service Information
Platform (access control orauthentication overridden).

High

High

Low

Network

High

High

None

Unchanged

Low

Low

None

None

High

5

MediumTamperingTampering of data or settings in theService Information Platform.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Spoofing

The Service Provider Information
Platform or the home gateway is
attacked by spoofing or tampered
messaging during communication via
an API.

Low

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

6.9

Medium

Malware Infection

Malware infection of the Service
Information Platform (attacks
launched via an external network).

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Denial of Service

DDoS (DoS) attack.

Low

Low

High

Network

Low

None

None

Unchanged

None

None

Low

None

None

6.1

MediumInformation
Disclosure

Information Disclosure via a carriedin storage device.

High

Low

Low

Physical

Low

High

Required

Unchanged

Low

None

None

None

High

2.8

Low

Malware Infection

Malware infection via a carried-instorage device.

High

High

High

Physical

Low

High

Required

Unchanged

Low

Low

Low

None

High

5.6

MediumInformation
Disclosure

Theft of update software.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

TamperingTampering of update software.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Information
Disclosure

Theft of information on an Internet
path by launching a man-in-themiddle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

High

3.1

Low

88
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Environmental Metrics

Threat Example
Entry point

Service Provider
Information Platform

Path ofcommunication
between the Service
Provider Information
Platform and theInternet

EP Number

EP③

EP④

Threat Category

Threat Example

Requireme
Modified
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified Modified
nt for
AttackUser
ConfidentiLife andnt fornt for
AttackPrivileges
Modified Scope
Integrity Availability
Confidenti
Complexit
Interactio
ality
Property
Integrity Availability Vector
Required
ImpactImpactality
yn
ImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

Unauthorized
AccessUnauthorized access to the Service
Information Platform (attacks
exploiting known vulnerabilities)

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Information
Disclosure

Theft of information from datastored in the Service Information
Platform (access control orauthentication overridden).

High

High

Low

Network

High

High

None

Unchanged

Low

Low

None

None

High

5

MediumTamperingTampering of data or settings in theService Information Platform.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Spoofing

Smarthome Service Information
Plathome is attacked by spoofing or
tampered messaging duringcommunication via an API.

Low

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

6.9

Medium

Malware Infection

Malware infection of the Service
Information Platform (attacks
launched via an external network).

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Denial of Service

DDoS (DoS) attack.

Low

Low

High

Network

Low

None

None

Unchanged

None

None

Low

None

High

6.1

MediumInformation
Disclosure

Information Disclosure via a carriedin storage device.

High

Low

Low

Physical

Low

High

Required

Unchanged

Low

None

None

None

High

2.8

Low

Malware Infection

Malware infection via a carried-instorage device.

High

High

High

Physical

Low

High

Required

Unchanged

Low

Low

Low

None

High

5.6

MediumInformation
Disclosure

Theft of update software.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

TamperingTampering of update software.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Information
Disclosure

Theft of information on an Internet
path by launching a man-in-themiddle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

High

3.1

Low

89
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Environmental Metrics

Threat Example
Entry point

EP NumberThreat Category

Threat Example

Unauthorized access to the home
Unauthorized Accessgateway (attacks exploiting known
vulnerabilities).

Risk
Score
Rank

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

High

High

Low

Network

High

High

None

Unchanged

Low

Low

None

None

High

5

MediumTamperingTampering of data or settings stored
in the home gateway.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Low

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

6.9

Medium

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

EP⑤

EP⑥

Risk
Score

Theft of information from data or
settings stored in the home gateway(access control or authentication
overridden).）Malware Infection

Path ofcommunication
between the home
gateway and theInternet

Modified
Information
Importance

Information
Disclosure

Spoofing

Home gateway

Requireme
Modified
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified Modified
nt for
AttackUser
ConfidentiLife andnt fornt for
AttackPrivileges
Modified Scope
Integrity Availability
Confidenti
Complexit
Interactio
ality
Property
Integrity Availability Vector
Required
ImpactImpactality
yn
ImpactImpactThe Service Information Platform is
attacked by spoofing or tampered
messaging during communication via
an API.
Malware infection of the home
gateway (attacks launched via an
external Internet)

Denial of Service

DDoS (DoS) attack.

Low

Low

High

Network

Low

None

None

Unchanged

None

None

Low

None

High

6.1

MediumInformation
Disclosure

Information Disclosure via aconnected storage device.

High

Low

Low

Physical

Low

High

Required

Unchanged

Low

None

None

None

High

2.8

Low

Malware Infection

Malware infection via a connectedstorage device.

High

High

High

Physical

Low

High

Required

Unchanged

Low

Low

Low

None

High

5.6

Medium

Malware Infection

Malware Infection from LANattached devices

High

High

High

Adjacent

Low

None

None

Unchanged

Low

Low

Low

None

High

8.3

High

Springboard

Abused as a springboard forlaunching attacks, e.g., as a bot.

Low

Low

Low

Network

Low

High

None

Change

None

None

None

None

High

2.3

Low

Information
Disclosure

Theft of information on an Internet
path by launching a man-in-themiddle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

High

3.1

Low

90
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Environmental Metrics

Threat Example
Entry point

EP NumberThreat Category

Threat Example

Unauthorized access to a device
Unauthorized Access(attacks exploiting known
vulnerabilities).

Smarthomecompatible devices

Path ofcommunication
between smarthomecompatible devices
and the home
gateway

EP⑦

Requireme
Modified
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified Modified
nt for
AttackUser
ConfidentiLife andnt fornt for
AttackPrivileges
Modified Scope
Integrity Availability
Confidenti
Complexit
Interactio
ality
Property
Integrity Availability Vector
Required
ImpactImpactality
yn
ImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

High

7.7

High

Information
Disclosure

Theft of information from data or
settings stored in a device (access
control or authentication overridden).

High

High

Low

Network

High

High

None

Unchanged

Low

None

None

None

High

3.3

Low

TamperingTampering of data or settings stored
in a device.

High

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.8

MediumSpoofing

The home gateway is attacked byspoofing or tampered messaging
during communication.

Low

High

High

Network

High

None

None

Unchanged

Low

Low

Low

None

None

6.1

MediumInformation
Disclosure

Information Disclosure via aconnected storage device (anycompatible device, such as a USB
interface).

High

Low

Low

Physical

Low

High

Required

Unchanged

Low

None

None

None

High

2.8

Low

Malware Infection

Malware infection via a connectedstorage device (any compatible
device, such as a USB interface).

High

High

High

Physical

Low

High

Required

Unchanged

Low

Low

Low

Yes

High

8.3

High

Springboard

Abused as a springboard forlaunching attacks, e.g., as a bot.

Low

Low

Low

Network

Low

High

None

Change

None

None

None

None

None

2.3

Low

Spoofing

Spoofing of a device control signal
by launching a man-in-the-middle
attack.

High

High

High

Physical

High

High

None

Change

Low

Low

Low

Yes

None

8.5

High

Information
Disclosure

Theft of information on an Internet
path by launching a man-in-themiddle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

High

3.1

Low

EP⑧

91
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Environmental Metrics

Threat Example
Entry point

Smartphone
Application

Path ofcommunication
between asmartphone and thehome gateway

EP NumberEP⑨Threat Category

Threat Example

Requireme
Modified
Modified
Modified
Modified
Requireme Requireme Modified
Modified
Modified Modified
nt for
AttackUser
ConfidentiLife andnt fornt for
AttackPrivileges
Modified Scope
Integrity Availability
Confidenti
Complexit
Interactio
ality
Property
Integrity Availability Vector
Required
ImpactImpactality
yn
ImpactImpactModified
Information
Importance

Risk
Score

Risk
Score
Rank

Information
Disclosure

Information Disclosure stored in a
device due to a vulnerability in asmartphone application.

High

High

High

Local

High

None

None

Change

Low

None

None

None

High

4.5

MediumInformation
Disclosure

Information Disclosure due to an
unauthorized login to a smartphone
application.

High

High

High

Network

Low

High

None

Unchanged

None

None

Low

None

High

3.8

Low

Spoofing

Any unauthorized operation of adevice caused by illegally logging in
to a smartphone application.

High

High

High

Network

Low

High

None

Change

None

None

Low

None

None

5

MediumSpoofing

Spoofing of a device control signal
by launching a man-in-the-middle
attack.

High

High

High

Physical

High

High

None

Change

Low

Low

Low

None

None

5.8

MediumInformation
Disclosure

Theft of information on an Internet
path by launching a man-in-themiddle attack.

High

High

Low

Adjacent

High

High

None

Unchanged

Low

None

None

None

High

3.1

Low

EP⑩

92
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

4 Potential Security Threats and Action Guidelines
This chapter identifies characteristic issues that affect smarthome security to help
pursue security action guidelines.

Diversity of Relevant Factors
As can be seen from the system model depicted in Chapter 2, the components of asmarthome are many and diverse, obscuring the transparency of the discussions of
security threats and actions.
This issue can be approached by considering that the component elements of asmarthome can be divided into two broad categories from a user value perspective:
individual IoT devices and services leveraging these devices. In this Guidelines,
security threats to and actions taken for the services provided by a smarthome are
explored and assessed on the system model. Likewise, threats and actions are
explored and assessed for individual IoT devices by creating relevant guidelines.

Responding to Product Safety
The structural requirements for remote operations of electrical appliances, including
IoT devices, as prescribed in 1 (2) b [7], Technical Standard Appended Table 8,
Electrical Appliances and Materials Safety Act dictate "top priority being placed on
hand operations" and "abilities to verify action results from feedbacks to ensure
successful remote operations." In March 2018, a proposal for an international
standard that prescribes the functional safety of multiple devices and systems thatrun concurrently in a smarthome pursuant to the principles of IEC61508(electrical/electronic/programmable electronic safety-related systems), a basic
standard relating to functional safety, was submitted to the International
Electrotechnical Commission (IEC) by the National Institute of Advanced Industrial
Science and Technology (AIST), a national research and development agency, and by
the Misawa Homes Institute of Research and Development Co., Ltd. and approved [8].
With IoT devices governed by the Product Liability Act and the Consumer Product
Safety Act, it is necessary to check to see if their remote operations comply with therequirements of these laws and regulations.
93ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Fail-safe software or other product safety assurance measures must be in place tominimize the possible impact of interruptions in the availability of services caused
under the influence of some failures in the Smarthome Service Information Platform
or associated cloud.

Device Collaboration
While smarthomes are populated with numerous IoT devices, these devices may not
only work independently but may collaborate with one another. Collaboration among
different kinds of devices, however, could give rise to these issues:(1)Because the appropriateness of the nature and levels of security actions enforcedin the connected devices are unknown, whether appropriate security actions aretaken as a whole or not cannot be determined.

(2)Where multiple devices varying in their security level collaborate, the one having
the lowest level of safety in terms of systems and security implemented among them
could make a breakthrough for an attacker, so the security actions to be taken should
allow for all component devices connected.

(3)As discussed in the use cases in this document, in the case of providing smarthome
services, where multiple enterprises participate as multivendors in the work ofsystems and equipment development and collaboration with a third-party service, thelines of demarcation for security responsibility among them could be made obscure.
This could, in turn, make it difficult for one enterprise as a service provider topresent a security standard to other enterprises.

To approach these issues, it would be necessary to implement risk analyses andassessment, at the stage of planning a new service, on the system models that makeup the service. Based on risk analysis findings, secondary requirements for a Service
Information Platform, a home gateway and housing equipment may be presented as
individualized security standards to help encourage better security across the94ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
component systems. Then, the lines of demarcation for responsibility between theparticipating enterprises would also be specified expressly.

95ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Installation and Removal of IoT Devices by Users
Products compliant with procurement standards set by housing companies (forexample, JIS, F☆☆☆☆ for interior building products and CP marks for security
building components) are used as building products and housing equipment installedin homes. With smarthomes that are furnished with products having security actions
implemented, it would be necessary to verify that these products comply with therelevant standards.

Yet, it may happen that the owner of a home sets up devices of the owner's choice inthe home after its delivery from the housing company. The nature and levels of
security actions implemented in these owner-installed devices are likely unknown.
The security level of a smarthome might be downgraded through the installation ofthese devices in it. It is imperative, therefore, to consider endorsing the security of asmarthome as a whole, including the devices installed by the homeowner themselves.

This issue can also be approached with the Certification Mark Plan consistent with
the CCDS Certification Program. Users may check the Certification Mark label
appearing on an IoT device and then purchase and install that device at their choice.
Because these devices fulfill the security requirements defined by the CCDS
Certification Program, the security standard of the smarthomes furnished by thesedevices is maintained.

Keeping Security Action Guidelines for Smarthome Servi
ces Organized
Both a Smarthome Service Information Platform and a Service Provider Information
Platform relate to the delivery of smarthome services. Security actions applicable tothe cloud system for the Service Information Platform should be reviewed fromperspectives of both the system itself and the operational background (people,
operating environments and operating procedures, etc.). Smarthome Service
Information Platforms could handle information that may impact Life and Property
or even control actual devices, and sometimes might entrust controls to third parties
while the users are absent. Hence, smarthome services should allow for threats, suchas Spoofing, Disclosure of Information and Unauthorized Access. Factors for96ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
consideration include:

・Enough security actions must be enforced in the Service Information Platform as asystem on the cloud.
・Physical security actions must be enforced for service operating facilities, plus
people, operating environments and operating procedures.
・Systems and devices that make up a smarthome service must meet Common
Requirements ★ in the IoT Field Common Security Requirements Guidelines; thesystems and devices that make up ★★ and ★★★ services must meet the security
standards (Chapter 6) respectively.
・The authentication of the home gateway by Service Provider Information Platforms(including both the Smarthome Service Information Platform and the Service
Provider Information Platform) and that of smarthome-compatible devices by thehome gateway must be carried out.
・Secure means of communication or protocols must be used in the paths ofcommunication between each Service Provider Information Platform and the home
gateway and between the Service Provider Information Platforms.
・Device operation logs must be recorded to track down the sources of any illegal
device operations attempted and their details.

97ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

5 Life Cycle of a Smarthome Service and Security
Efforts
The implementation of security actions for smarthomes should also take into
consideration the fact that not only the IoT devices installed in the premises couldchange with their life cycles (purchase, failure, resale, scrapping) but their users
themselves might change as well.

Definitions of the Successive Phases of the Life Cycle ofa Smarthome Service
This section defines the security actions to be taken through the life cycle ofsmarthome development work by service providers. The life cycle of Smarthome
Services development work can be broadly divided into five successive phases: Service
Planning, Design and Manufacturing, Assessment, Operation and Maintenance, andTermination of Services. To maintain adequate security in providing Smarthome
Services, enough actions need to be taken in the successive phase of the life cycle ofthe services from a broad spectrum of considerations,including the formulation of
corporate policies and plans,compliance with the relevant laws and regulations,and
people,operating enviroments and procedures.

Service Planning

Design and
Manufacturing

Service Planning

Service Planning

Assessment

Design and
Manufacturing

Design and
Manufacturing

Operation and
Maintenance

Assessment

Assessment

Termination ofService

Operation and
MaintenanceOperation and
MaintenanceTermination ofService

Termination ofService

Figure5-1: Phases of the Life Cycle of a Smarthome Service

98ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 5-1: Definitions of the Phases of a Smarthome Service
Phase
Service
Planning

Description

Carry out risk analyses and assessment, etc. based on service
concepts, requirements definitions, use case definitions and assumed
system models.

Design and
Manufacturing

Design, implement and manufacture the systems and devices thatmake up a service (or outsource these tasks) based on decisions madein the Service Planning phase.
Have the construction representative verify installation status andAssessment

manage and supervise equipment used to preclude failures andincidents while providing the service.

Operation and

Run and maintain the service being offered to the user, and take

Maintenanceresponses to incidents as they occur in the meantime.

Termination ofService

When the service terminates, notify the user beforehand, complete
procedures for migrating to an alternate service, destroy personal
information collected and so on.

Security Efforts to be Made in the Life Cycle of a Servi
ce
This section reviews the security efforts to be made in the successive phases of thelife cycle as outlined in the foregoing section.

5.2.1 Service Planning Phase
This section summarizes security efforts to be made in the Service Planning phase.

99ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 5-2: Security Efforts to be Made in the Service Planning Phase
No.

1

Item

Description

Formulation of response・Formulate a system of risk management activity to cope with cyberpolicies to be pursued by asecurity, along with rules, in the corporate organization.

corporate organization

2

Formulation of personal

・Define personal information to be collected and formulate relevant

information management

management policies from a viewpoint of personal information

policies to be pursued by aprotection.

corporate organization

3

Definition of service

Define system models and use cases based on the service

requirements, and system

requirements. With a system model, clarify the lines of demarcation

models and use cases

for responsibility between the service provider and its partnering
enterprises such as contractors.
・Conduct risk analyses and assessment to assess assets to be

4

Risk analyses andprotected, potential threat, and risk metrics.

assessment, and definition

・Review in the course of risk analyses and assessment whetherof service levels

sensitive data,such as personal information,is handled and whether
there is any Life and Property impact, and define a Certification
Level (★★, ★★★) for the services accordingly.

5

6

Review of responses toExtract items that require responses to the laws and regulations

relevant laws andrelevant to the Smarthome Services and explore possible actions on

regulations

the part of the devices and systems.

Formulation of security

・Formulate the policies of security actions required to reflect theaction policies

risk analysis and assessment results. Further, launch discussions toallow for availability, etc. from a viewpoint of safety hazards.

7

Definition of a disclaimer

・Define a disclaimer to provide against possible failures impacting

for services

the services (such as the loss of power caused by accidents, including
natural disasters or fires).

100ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

5.2.2 Design and Manufacturing Phase
Security efforts to be made in the Production and Construction phase are summarized
below.

Table 5-3: Security Efforts to be Made in the Design and Manufacturing Phase
No.

Item

Description
・If the work of device or systems development is outsourced,
make certain that the vendor's development organization

Verification of thedevelopment vendor's
1

enforces quality control by adhering to the "Security by
Design" concept.

organization

Example:・Static assessment:Secure design, coding review
・Dynamic assessment:Security testing, etc.
・If a need arises to develop new devices or to implement
solutions in the course of providing a service, it will bemandatory to specify security secondary requirements

Outsourcing ofdevelopment work and2solutionsaccording to the level of authentication of that service to thedevelopment or solutions vendors and dictate their compliancewith such requirements.
・For a description of specific security actions to take, see:
Section 6.2 Security Secondary Requirements for System
Service-Compatible Devices

101ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

5.2.3 Scoring Phase
Security efforts to be made in the Scoring phase are summarized below.

Table 5-4: Security Efforts to be Made in the Scoring Phase
No.

1

Item

Description

Authentication

・Preparatory to constructing a smarthome, make certain that

information andthe authentication information and security settings havesecurity setting checks

been integrated properly.

during construction
・Check each Service Information Platform and each of the

Vulnerability check2

home gateway and smarthome-compatible devices for known
vulnerabilities.
※For additional information about the actions to take in the
Scoring phase, see the description of the Production andResponses while

Construction phase in the following life cycle of a smarthome:

producing and3

5.4.2Production and Construction Phase

constructing a

No.2Ordering devices used, etc.

smarthome

No.3Managing and supervising devices used, etc.
No.4Confirming construction

5.2.4 Operation and Maintenance Phase
Security efforts to be made in the Operation and Maintenance phase aresummarized below.

Table 5-5 Security Efforts to be Made in the Operation and Maintenance Phase
No.

Item

Description
・Service-providing systems (Service Information Platforms,

1

Personal authenticationof the service subscriber

smarthome environment) must support an authentication
function to allow only the subscriber to a service contract (orany individual authorized by that subscriber) to use theservice under contract.

2

Logging and data

・Service-providing systems must support a logging function
to provide against potential incidents occurring, such as102ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
analysis

Unauthorized Access, and must also be ready to analyze log
data collected.
・A function for deleting data on the system on which the

Implementation of a3data deletion function

service runs must be implemented from a standpoint of
personal information protection.

Authentication of the
4

field representative

As for ★★★ services, a scheme or function must be
implemented to validate the qualifications of the field
representatives rushing to the smarthomes in times of fault
notification.
・For a Smarthome Service Information Platform, thefollowing actions must be enforced to ruggedize its operations:

5

Ruggedization of

1)Definition of data access procedures and rules

operations of a2)Minimization of the scope of data access

Smarthome Service

3)Data access log auditing

Information Platform

4)Security education for operations representatives(1) (Data access)※In every case, certification must have been acquired under
the following standard or an operation scheme conforming tosuch certification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification
・For a smarthome Service Information Platform, thefollowing actions must be enforced to ruggedize its operations:

6

Ruggedization of

1)Definition of login information management procedures andoperations of a

rules

smarthome Service2)Minimization of the scope of login information release

Information Platform

3)Security education for operations representatives(2) (Server login)※In every case, certification must have been acquired under
the following standard or an operation scheme conforming tosuch certification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification

7

Ruggedization of the・Enforce access control to server rooms and operation rooms,

workrooms for ausing IDs or the like, to prevent unauthorized personnel fromsmarthome Service

entering them.

Information Platform※Certification must have been acquired under the following

103ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021(1) (Access control)

standard or an operation scheme conforming to suchcertification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification

8

Ruggedization of・Enforce critical control over those accessing server rooms

operations of aand operation rooms by restricting the carrying-in of storage

smarthome Service

devices, smartphones, PCs and the like

Information Platform※Certification must have been acquired under the following(2) (Restriction on

standard or an operation scheme conforming to suchcarrying-in of devices)

certification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification

9

Ruggedization of・Access to and from server rooms and operation rooms must

operations of abe recorded using security cameras or ID card logging.

Smarthome Service※Certification must have been acquired under the following

Information Platformstandard or an operation scheme conforming to such(3) (Access history

certification standard must be implemented:

control)(Access history control)-ISO/IEC27017:ISMS Cloud Security Certification
For a Service Provider Information Platform (※),the following
actions must be enforced to ruggedize its operations:
1)Definition of data access procedures and rules.

10

Ruggedization of2)Minimization of the scope of data access.

operations of a Service

3)Data access log auditing.

Provider Information4)Security education for operations representatives.

Platform (1) (Data※An example of a Service Provider Information Platform

access)might be a call center system or the like.
※In every case, certification must have been acquired under
the following standard or an operation scheme conforming tosuch certification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification

11

Ruggedization of・For a Service Provider Information Platform, the following

operations of aactions must be enforced to ruggedize its operations:

Service Provider1)Definition of login information management procedures andInformation

rules.

104ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Platform (2) (Server2)Minimization of the scope of login information release.

login)

3)Security education for operations representatives.
※An example of a Service Provider Information Platformmight be a call center system or the like.
※In every case, certification must have been acquired under
the following standard or an operation scheme conforming tosuch certification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification
・If a Service Provider Information Platform is to carry out
device operations relevant to crime prevention and life-saving,
the following actions must be enforced:1)Definition of operational routines for device operations
relevant to crime prevention and life-saving.

12

Ruggedization of2)Auditing of device operation logs for device operations

operations of a Service

relevant to crime prevention and life-saving.

Provider Information3)Security education for operators relevant to crime

Platform (3) (Remoteprevention and life-saving.

unlocking operation)※An example of a Service Providers Information Platformmight be a call center system or the like.
※In every case, certification must have been acquired under
the following standard or an operation scheme conforming tosuch certification standard must implemented:-ISO/IEC27017:ISMS Cloud Security Certification
・Enforce access control to server rooms and operation rooms,
using IDs or the like, to prevent unauthorized personnel from

Ruggedization of theworkrooms for a Service※An example of a Service Provider Information Platform

Provider Information
13

entering them.

might be a call center system or the like. (1)Platform (1) (Access※Certification must have been acquired under the following

control)

standard or an operation scheme conforming to suchcertification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification
14

Ruggedization of the・Enforce exacting control over those accessing server rooms

workrooms for a Service

and operation rooms by restricting the carrying-in of storage

105ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Provider Information

devices, smartphones, PCs and the like

Platform (2) (Restriction
on carrying-in of※An example of a Service Provider Information Platform

devices)might be a call center system or the like.
※ Certification must have been acquired under the following
standard or an operation scheme conforming to suchcertification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification
・Access to and from server rooms and operation rooms must15

Ruggedization of thebe recorded using security cameras or ID card logging.

workrooms for a Service※An example of a Service Provider Information Platform

Provider Information

might be a call center system or the like.

Platform (3) (Access※Certification must have been acquired under the following

history control)

standard or an operation scheme conforming to suchcertification standard must be implemented:-ISO/IEC27017:ISMS Cloud Security Certification
・Organize a CSIRT (Cyber Security Incident Response Team)

Responding to incidents
occurring while
16

providing a service

to respond to unexpected risks occurring while providing aservice and take action to prevent their recurrence.
・Take appropriate responses in reporting vulnerabilities byworking in conjunction with relevant organizations, such as
Japan Computer Emergency Response Team/Coordination
Center (JPCERT/CC).

17

Responding to※For additional information about the actions to take in thesmarthome services

Operation and Maintenance Phase, see the description of theoperation andRemodeling in the following life cycle of a smarthome:

maintenance5.4.3Post-Construction Phase
5.4.4Remodeling Phase106ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

5.2.5 Service Termination Phase
Security efforts to be made in the Service Termination phase are summarized below.

Table 5-6: Security Efforts to be Made in the Service Termination Phase
No.

Item

Description
・Before a service terminates, its user must be given an about

1

End-of-service

one-year prior notice from a viewpoint of user protection. The

notification

user must also be given appropriate explanations, including
an introduction to alternate services.
・When a service terminates, personal information collected

Destruction of personal
2

information collectedmust be destroyed. If migration to an alternate service takes
place, however, the personal information may be appropriatedfor the implementation of the alternate service, subject toconsent from the user.
*For information about publicizing the method of device

3

Publicizing of thescrapping, see the description of the Unbuilding Phase in themethod of device

following flow of smarthome development:

scrapping

5.4.6Unbuilding PhaseNo. 1Publicizing the method of device scrapping

107ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Definitions of the Successive Phases of the Life Cycle ofa SmarthomeThis section defines the security actions to be taken by service providers and system
operation vendors through the life cycle of a smarthome (dwelling). The life cycle of asmarthome can be broadly divided into six phases: Design, Production andConstruction, Post-Construction, Remodeling, Resale and Unbuilding.
To maintain enough security in providing smarthome services, adequate actions
should be taken in these successive phases to bolter the security of the products.

Production
andConstruction

DesignProduction
andConstruction

DesignDesignProduction
andConstruction

PostConstruction

Remodeling

ResaleUnbuilding

PostConstruction

Remodeling

ResaleUnbuilding

PostConstruction

Remodeling

ResaleUnbuilding

Figure5-2: Phases of the Life Cycle of a Smarthome

Table 5-7: Definitions of the Phases of a Smarthome
Phase

Description

Phase

Designs smarthomes, including IoT housing equipment.

Production and

Produces and constructs smarthomes, including IoT housing equipment.

Construction
Following the completion of a smarthome, the homeowner starts living in
Post-Construction

it, utilizing information about the smarthome and running andmaintaining it.

Remodeling

Remodels smarthomes.

ResaleChanges smarthome owners.

Unbuilding

Terminates the use of a smarthome and unbuilds it.

108ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Security Efforts to be Made in the Life Cycle of a Smar
thome
This section describes security efforts to be made in the successive phases of the life cycle
summarized in the foregoing section.

5.4.1 Design Phase
Security efforts to be made in the Design phase are summarized below.

Table 5-8 Security Efforts to be Made in the Design Phase
Item

No.

Description
・Explain the content of the service to its user andService selection

1

gain consent to that service from the user.
・Select devices to meet the relevant security
standards according to the certification level of theSelection of devices to be
2

service provided.
・For a description of specific security actions to

installedtake, see the following section of this document:
6.2Security Secondary Requirements for System
and Service-Compatible Devices

3

Notation and marking in・List all devices used in the system

the design

documentation (including system schematics)

documentation

without omission.

5.4.2 Production and Construction Phase
Security efforts to be made in the Production and Construction phase are summarized below.

Table 5-9 Security Efforts to be Made in the Production and Construction Phase
No.

Item

Description
・Explain about the handling of personal information, etc.
to the service users and gain their consent.

1

Acquisition of user consent

・Specify and explain about the line of demarcation forresponsibility.
・Explain about disclaimers in using the services to the109ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
users and gain their consent.
2

Ordering of devices used,

・Verify consistency with the design documentation (foretc.

home gateways, sensors, connections and more).
・Check to see if unauthorized devices have not been

3Management andinstalled and if the devices used are not in trouble.

supervision of devices used,・Check the models (descriptions and types) of the devicesetc.

to be installed in the premises of the smarthome to verify
their compliance with the Security Secondary
Requirements for services.
・Check the subscriber, devices used and the conditions ofoptions.
・Verify and supervise consistency with the design
documentation and purchase specifications during andConstruction checks
4

after construction. (Recording by photographs, etc. isallowed.)・Check the devices used, etc. for successful operations
after construction.
・Verify the validity of the system as a whole.

5・Check the quantities of keys, cards and the like issued

Issues managementwith the quantities of those actually handed over.

Descriptions of devices used6

and how to use services

・ Descriptions of devices used and how to use services
・ Explain to the users about the devices used and how to
use services.
・Include a disclaimer notice, how to respond to failures

7

Terms of use

when they occur, service provider contact information andso on.

110ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

5.4.3 Post-Construction Phase
Security efforts to be made in the Post-Construction phase are summarized below.

Table 5-10: Security Efforts to be Made in the Post-Construction Phase
No.

Item

Description
・Define a disclaimer in providing the services expressly in

1

Provision of the terms or

the terms of use or instruction manual for the users to see.

use or instruction manuals

・Present the security action policies of the services to theusers.

・Specify expressly the extent beyond which users have noauthority to alter the device configuration or settings in

2

Definition of operational

the smarthomes. Alert the users not to act beyond suchusagesextent to make unauthorized alterations.
・Familiarize the user with the objectives andfunctionalities of the service so they will not use thedevices for purposes other than the intended use.
・Include in the instruction manuals to direct users tocontact the service provider when suspicious devices are

3

User reminderconnected or devices are found to behave abnormally.
・Alert users to the cases, in the instruction manuals, inwhich the use of defaults, or setup errors could produce
vulnerabilities.
・Watch vulnerability information constantly to check forpresence or absence of any vulnerabilities in the OS, bootResponding to latest
4

vulnerabilities

program and applications used and, whenever associatedvulnerabilities are reported, release program updates.
・Notify service users of the availability of the latest
versions of programs, alert them to the impact ofvulnerabilities and familiarize them with the program
update procedures.

Issues management
5・Check the quantities of keys, cards and the like issued
with those handed over.
・Update information about issues in times of their loss.

111ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
・Algorithms and key lengths currently consideredadequate could become inadequate in the future. Consider
advising users to terminate their use of devices at a given
Restriction on device usage
6

point of time.
・For gateways that are possibly used over a long period oftime, have their maintenance period defined with theservice provider and publicize it in manuals or at a website
for the users to see.

112
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

5.4.4 Remodeling Phase
Security efforts to be made in the Remodeling phase are summarized below.

For the Design Phase and the Production and Construction Phase of remodeling work, see Table 58 and Table 5-9.

Table 5-11: Security Efforts to be Made in the Remodeling Phase
No.

1

Item

Description

Verification of・Before attempting to add to or exchange devices or add

compatibility with devices

or update relevant information, verify that there will be no

already in position

impact upon devices already in position.
*The following are the actions to be taken when the devices
installed in the premises of a smarthome are scrapped as
the user (homeowner) changes:
・Specify the potential threats and risks associated withthe disposal of devices with data left inside in instruction
manuals or the like to alert the users.

Publicizing the method of2

device scrapping

・Recommend to users in the instruction manuals or the
like to initialize device settings and data stored in memory
when scrapping devices.
・If scrapping of devices by destruction is to berecommended to users, specify, in the instruction manuals
or the like, that their disposal must comply with therelevant local regulations.
・In disposing of security devices (such as electronic locks
and door locks), service providers must direct the disposal
contractors to initialize the data stored on these devices.

113ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

5.4.5 Resale Phase
This section summarizes security efforts to be made in the Resale Phase.

Table 5-12: Security Efforts to be Made in the Resale Phase.
No.

Item

Description

・Check the quantities of keys, cards and the like
1

Issues management

issued with the quantities of those actually handed
over.
※ The following are the actions to be taken when thedevices installed in the premises of a smarthome arescrapped as the user (homeowner) changes:
・Specify the potential threats and risks associatedwith the disposal of devices with data left inside in
instruction manuals or the like to alert the users.
・Recommend to users in the instruction manuals or

2

Publicizing the method

the like to initialize device settings and data stored inof device scrapping

memory when scrapping devices.
・If scrapping of devices by destruction is to berecommended to users, specify, in the instruction
manuals or the like, that their disposal must comply
with the relevant local regulations.
・In disposing of security devices (such as electronic
locks and door locks), service providers must direct
the disposal contractors to initialize the data stored
on these devices.
・ Disseminate disclaimers and security precautions to thenext user.
・ For security precautions, refer to the following items in

3

Management after resale

Table 4-4 After Phase.
-Provision of instruction manuals-User reminder-Responding to latest vulnerabilities-Restriction on device usage114ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

5.4.6 Unbuilding Phase
Security Efforts to be Made in the Unbuilding Phase are summarized below.

Table 5-13: Security Efforts to be Made in the Unbuilding Phase
No.

Item

Description
・Specify the potential threats and risks associated withthe disposal of devices with data left inside in instruction
manuals or the like to alert the users.
・Recommend to users in the instruction manuals or the1

Publicizing the method oflike to initialize device settings and data stored in memory

device scrapping

when scrapping devices.
・If scrapping of devices by destruction is to berecommended to users, specify, in the instruction manuals
or the like, that their disposal must comply with therelevant local regulations.

115ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

6 Security Requirements for Smarthome Services
This chapter defines security requirements for the services relevant to thecertification programs in the smarthome field and security secondary requirements
for the components of the services, to reflect the risk analysis and assessment results
and security action efforts discussed so far.

Security Requirements for Smarthome Services
This section defines security requirements for those services that need be addressedby a Certification Program.

Requirements for ★★ and ★★★ services have been selected, respectively, from thefollowing standpoints:

1)Requirements for ★★ services
・Requirements essential for delivering all smarthome services in a safe, secure andconsistent manner.
*Actions that are cost-effective against highly serious threats have been mainly
selected to reflect the risk metrics calculations.
2)Requirements for ★★★ services
・Requirements sought by services requiring more exacting action to protect lives,properties and personal information.
*Implementable items have been selected, with their cost and cost effectiveness taken
into consideration, by checking against the Cyber Physical Security Framework(CPSF) [20], based on the risk metrics calculations.
The security requirements discussed in this section and in Section 6.2 comply with
the U.K. Code of Practice for Consumer IoT Security [21] and U.S. California State’s
Information privacy: connected devices (Senate Bill No.327, Chapter 886) [1] as well.

116ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 6-1 Rules of Notation of Security Requirements and Secondary Requirements
Status of Response

Symbol◎Not discussed in the associated guidelines but defined in this Guidelines.

○

Detailed in further depth in this Guidelines than in the associated guidelines.

＝

Requirements and secondary requirements essentially correspond to the associatedguidelines.

Security requirements and secondary requirements in this document are numbered in accordancewith the following rules:[Requirement/Secondary requirement] [Level]-[Type]-[No.]Table 6-2 Numbering Rules for Security Requirements and Secondary Requirements
Category

Japanese Name
要件

Requirement/secondary
requirement

Level

English Notation
Requirements

Numbering Rule
R

Secondary
要求事項
Requirements

SR

レベル 2

Level22

レベル 3

Level3

3

Smarthome Service
スマートホームサービス情Information

SP

報基盤
Platform
Service Provider
第三者サービス情報基盤

Information

PP

PlatformType
ホームゲートウェイ

Home Gateway
Smart home

スマートホーム 対応機器群
compatible devices

H
D

Smartphone
スマートフォンアプリ
application

A

117ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Table 6-3 S ecurity Requirements for Smarthome Services
No.

Level

Scope

Item

Description

UK

SB327

CPSF

・Conduct risk analyses and assessment on theservices to assess the assets to be protected,
potential threats and risk metrics.

R2-1

★★

Service○・Review whether sensitive data, such as

CPS.DS-1

Risk analyses andpersonal information, is handled in the course of

CPS.AE-1

assessment, formulation ofrisk analyses and assessment or not and whether

security action policies

there is any Life and Property impact or not, and

CPS.AE-4

define a Certification Level (★★) for the services

CPS.AE-5

accordingly.

CPS.DP-1◎◎

CPS.AE-3

・Formulate required security action policies toreflect risk analysis and assessment results.
・Service-providing systems (Service Information＝
Platforms, devices installed in the premises of a
Use of devices and systems
R2-2

★★

Servicecompliant with Security
Secondary Requirements

CPS.SC-3

smarthome and smartphone applications) must be

CPS.SC-4

comprised of devices and systems that meetrequirements for ★★ services.
・In building a smarthome, check the models(descriptions and types) of the devices to beinstalled in the premises of the smarthome to◎◎

CPS.SC-5
CPS.PT-3
CPS.DP-1
CPS.RP-2

118ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
verify their compliance with the Security
Requirements for ★★services.

R2-3

★★

Appropriate initial settings

・Make certain, at the start of service usage, thatfor the IoT device

authentication information and access control(Authentication information

between IoT devices has been initialized properly.

＝Serviceand access control for

＝
◎

UK6

CPS.IP-1

between IoT devices)
When a Smarthome Service is used, the
＝
R2-4

★★

Service

Personal authentication ofsubscriber to the service contract must be

the service subscriber

authenticated. User authentication information

＝
◎
UK12

CPS.AC-9

must be updated when the smarthome is resold.
Deletion of personal
R2-5

★★

Service

information used in thepremises of a smarthome

CPS.AC-6

・Users of any devices used in the premises of asmarthome must be able to delete personal＝

information loaded into these devices by

UK8

◎

◎

◎

◎

themselves to allow for their resale or disposal.
・Specify expressly the extent beyond which users
have no authority to alter the device configuration

R2-6

★★

Service

Guidance on the secure useor settings in the smarthomes. Alert the users not＝of a smarthometo act beyond such extent to make unauthorized

UK12

alterations.
・Familiarize the user with the objectives and119ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
functionalities of the service so they will not use
the devices for purposes other than the intendeduse.
・Software installed in service-providing systems(Service Information Platforms, devices installed
○
R2-7

★★

Service

Periodic updating to thein the premises of a smarthome) must be updated＝

latest software

periodically.

UK3◎

CPS.DS-7
CPS.MA-1

・If vulnerabilities are reported in the above,
release software updates promptly.
・Define operating procedures installing updates
to the individual Service Information Platforms
and the software installed in the devices in the

R2-8

★★

Service

Update software operating

smarthome and keep the software under version＝

procedures and version

management.

UK3

management1)Management and operating procedures for

UK7

CPS.MA-1○○◎

CPS.DS-7

releasing software updates.
2)Management of the histories of software
updates and the associated versions.

R2-9

★★

Service

Initializing and updating

・When reselling a smarthome, take the following＝

components devices of aactions on its components devices before

UK3

smarthome when reselling it

transferring it to the new owner:

UK8◎

CPS.DS-7
CPS.MA-1

120ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
1)Initialize information that has been configured,
collected and stored.
2)When the construction work is completed,
update to the latest software for the service before
the new owner starts using it.
R3-1

★★★

Service

Responding to ★★ service

・Security Requirements for★★ services must be

requirements

met.

※See ★★.

・Conduct risk analyses and assessment on theservices to assess the assets to be protected,
possible threats and risk metrics.
○

・Review whether sensitive data, such as
Risk analyses and
R3-2

★★★

Service

assessment, formulation of
security action policies

CPS.DS-1

personal information, is handled in the course of

CPS.AE-1

risk analyses and assessment or not and whether◎
there is any Life and Property impact or not, anddefine a Certification Level (★★★) for the services
accordingly.
・Formulate the policies of security actions◎

CPS.AE-3
CPS.AE-4
CPS.AE-5
CPS.DP-1

required based on the results of risk analyses andassessment.

121ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
・Service-providing systems (Service Information

R3-3

★★★

Service

Platforms and devices installed in the premises of＝a smarthome) must be comprised of devices and

CPS.SC-3

Use of devices and systems

systems that meet the Secondary Requirements

CPS.SC-4

compliant with Security

for ★★★ services.

Secondary Requirements

・In building a smarthome, make certain that the

CPS.PT-3

devices to be installed in the premises meet the

CPS.DP-1

Secondary Requirements for ★★★ services

CPS.RP-2◎◎

CPS.SC-5(descriptions, types).
・A scheme of information security management
activity must be implemented in a service
provider ’s cloud service operation
・In case of collaborating with a third-party
Information security
R3-4

★★★

Servicemanagement in a cloudservice operation

service, make certain that the service provider○

maintains a reliable scheme of security

CPS.AT-1◎◎

management.

CPS.AC-2

・Certification must have been acquired under

CPS.IP-9

the following standard or an operation scheme
conforming to such certification standard be
implemented:*ISO/IEC27017:ISMS Cloud Security Certification

122ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

R3-5

★★★

Service

Logging and data analysis

・Service-proving systems must support a logging＝

function to provide against incidents and also a

CPS.MA-2

scheme of operation that allows collected log data

CPS.PT-1＝◎

to be analyzed.

UK10

CPS.CM-2
CPS.CM-5
CPS.AN-2

・Check each Service Information Platform, thehome gateway each smarthome-compatible device
R3-6

★★★

○
ServiceVulnerability checkfor known vulnerabilities. The method and timing◎◎
CPS.CM-7

of such check should be set individually to suit
the services provided.
As for each servicer accesses the smart home

R3-7

★★★

Service

Authentication of each＝system, perform appropriate access management.

CPS.AC-2◎

servicer◎

CPS.AC-3
CPS.AC-5
CPS.AC-9

123ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Organize a CSIRT (Cyber Security Incident

Responding to incidents
R3-8

★★★

Service＝

Response Team) to respond to unexpected risks

CPS.IP-7

occurring while providing a service, and thenCPS.IP-10

respond to incident and take action to prevent

CPS.AE-2

their recurrence.

occurring while providing a・Work in conjunction with relevant

serviceorganizations, such as Japan Computer

CPS.RP-4＝◎
UK2

CPS.CO-1
CPS.AN-2

Emergency Response Team/Coordination Center

CPS.AN-3(JPCERT/CC), take appropriate responses in

CPS.MI-1

reporting vulnerabilities.

CPS.IM-1
CPS.IM-2

124ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Security Secondary Requirements for System Service-Co
mpatible Devices
This section defines security secondary requirements for individual Smarthome Service
Information Platforms, home gateways, smarthome-compatible devices and smartphone
application devices and systems vendors. While security secondary requirements are defined
separately for each device or system to help draw a line of demarcation for responsibility, they are
not necessarily mandatory. Their aim is to attain a certain level of security quality across allservices by responding to a given need with an alternative component based on threat analyses
when the fulfillment of such need is beyond ready reach of an individual device or system.

Security Secondary Requirements for ★★ and ★★★ services have been selected from the following
standpoints:

1)Secondary Requirements for ★★ services
・Secondary requirements that are essential to deliver all smarthome services in a safe, secureand consistent way.

*Actions are cost-effective against highly serious threats have been mainly selected based on risk
metrics calculations.

2)Secondary Requirements for ★★★ services
・Secondary requirements to be met by services that require more exacting control to protect life,
property and personal information.

*Implementable items have been selected, with their cost and cost effectiveness taken into
consideration, by checking against the Cyber Physical Security Framework (CPSF), based on therisk metrics calculations.

125ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

6.2.1 Security Secondary Requirements for Smarthome Service Information Platforms
Security Secondary Requirements for Smarthome Services Information Platform are summarized below. (Entry points: EP (1) to EP (2))

Table 6-4 Security Secondary Requirements for Smarthome Service Information
No.

Level

Scope
Smarthome

SR2-SP-1★★

Service
Information
Platform

Item
Responding toCommonRequirements

Description

UK

SB327

CPSF

・An equivalent of the security actions dictated by＝

Common Requirements ★ in the IoT Field Common

UK1＝

CPS.IP-1

Security Guidelines must be enforced.

UK6

1798.91.05

CPS.IP-6＝

UK13

CPS.PT-2

・Implement authentication over the API,supporting a scheme of authentication to allow

Smarthome
SR2-SP-2★★

Service

Authentication

Information

over the API

Platformauthentication information to be invalidated andreissued as needed.

○◎◎

・Take responses to combat reported

CPS.AC-3
CPS.AC-9

vulnerabilities as part of the authentication over
the API.

Smarthome
SR2-SP-3★★

Service
Information
Platform

User

A scheme of login user (operator) authentication

authentication on

must be maintained.

log-in from the・Actions are taken against brute force attacks.

administrative

The implementation must be such as to allow

CPS.AC-6

screen (interface

values to be changed if compromising is suspected.

CPS.AC-9＝
CPS.AC-3◎◎

CPS.AC-5

126ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
over which a
service overview isdisplayed orfunctions aremanaged)Smarthome
SR2-SP-4★★

Service
Information
Platform

・A scheme of login user (operator) authentication

＝

User

must be maintained.

CPS.AC-3

authentication on

・Actions are taken against brute force attacks.

server log-in

The implementation must be such as to allow

CPS.AC-6

values to be changed if compromising is suspected.

CPS.AC-9◎◎

CPS.AC-5

・A scheme of home gateway authentication must

Smarthome＝
SR2-SP-5★★

Service

Home gateway

Information

authentication

be maintained.
◎◎

CPS.AC-9

Platform

SR2-SP-6★★

Smarthome

Management ofService

information

Informationneeded for

Platformauthentication

CPS.AC-3

・A scheme of preventing the leakage of＝

information needed for authentication must be
implemented.

CPS.AC-3◎◎

CPS.AC-5
CPS.AC-6
CPS.AC-9127ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
・When security patches are released to fix any

Smarthome
SR2-SP-7★★

Service

Installation ofInformation

security patches

Platform
Smarthome
SR3-SP-1★★★

Service
Information
Platform

SR3-SP-2★★★

vulnerabilities found in the OS, boot program,＝＝server software, databases, applications or opensource libraries used, run testing on these patches◎
UK3

CPS.DS-7
CPS.MA-1

and then install them.
Responding to ★★
service・Security Secondary Requirements for a ★★
service platforms must be met.

※See ★★.

requirements

Smarthome

Prevention of・A function must be implemented to prevent

Serviceunauthorized

unauthorized access attempts from an external○◎

Information

access from anInternet.

Platform

external Internet

Example:Defensive function based on a firewall◎
CPS.PT-3

Take actions against attacks are launched from an

Smarthome
SR3-SP-3★★★

Service
Information
Platform

Actions against
attacks that
exploit Web
application
vulnerabilities

external network by exploiting Web application
vulnerabilities.
Example:WAF feature
・Where a Website or Web application is

○

○
◎

UK13

CPS.CM-3

implemented, take vulnerability actions adheringto the following guidelines:-"Building a Secure Website” [28]128ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Smarthome
SR3-SP-4★★★

Service
Information
Platform

・An intrusion detection function, which monitors＝
Detection andhosts or communication line and notifies theblocking ofadministrator when it detects intrusions, and a

intrusions

function that blocks unauthorized access or

SR3-SP-5★★★

Information

Service

CPS.CM-3
CPS.CM-5

testing and a certain level of load to preclude (D)＝DoS protection

Dos attacks that place server, network and otherresources under excessive load or exploit their

○
◎

UK9

CPS.DS-6

vulnerabilities.

Smarthome
★★★

UK10

・Build a design rugged enough to withstand load

Platform

SR3-SP-6◎

intrusion communication, must be implemented.

SmarthomeService

CPS.CM-2○

Logging and・Operation logs, status logs and the like must be＝

kept to allow incidents to be analyzed when they

CPS.MA-2

occur.

CPS.PT-1○◎

Information

analysis

UK10

CPS.CM-2

Platform

CPS.CM-5
CPS.AN-2

Smarthome
SR3-SP-7★★★

ServiceAnti-malware/virus actions must be enforced on
Malwareservice platforms.

○◎

Information

protection◎
CPS.PT-3

Platform

129ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
・Basic server security actions as outlined below
must be enforced:

Smarthome
SR3-SP-8★★★

Service

Server security

Information

actionPlatform

1)Closure of unnecessary services and deletion of○○

unnecessary applications
2)Change from the default administrative privilege◎
UK6

CPS.AC-8
CPS.PT-2

accounts
3)Deletion of unnecessary accounts
Paths of communication with Smarthome Service
Information Platforms and home gateways must be
encrypted.
*Otherwise, the communication paths must be
configured for higher security strength by using

Smarthome
SR3-SP-9★★★

Service
Information
Platform

leased lines, VPNs and so on.
Encryption of*If cryptography with authentication iscommunication

implemented in Secondary Requirement

paths"Authentication" for a ★★ service, however, no

○

○
◎

UK5

CPS.DS-3

response to this secondary requirement is required
because such implementation addresses thesecondary requirement for an encrypted
communication path at the same time.
*Cryptography must be implemented to comply
with the Guidelines by consulting the following:130ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021“TLS Encryption Setup Guidelines" [22]“List of Cyphers to be Referenced for Procurement
for the e-Government" [23] or "CRYPTREC
Cryptographic Technology Guidelines (Lightweight
Cryptography)" [24]・Assets to be protected must be encrypted.
*For information about the assets to be protected,
see Table 3-2, Section 3.2 of this document.
Smarthome
SR3-SP-10★★★

Service
Information

Encryption of data

Platform* Encrypt those assets having a higher level of○importance based on services and use cases.

UK4*Cryptography must be implemented to comply

UK8

○
◎
CPS.DS-2

with the Guidelines by consulting the following:“TLS Encryption Setup Guidelines" [22]“CRYPTREC Cyphers List" [23]・Enforce proper management of the keys used toencrypt communication paths and data.

Smarthome
SR3-SP-11★★★

Service
Information
Platform*The method of key management must be○
Key management

implemented to comply with the Guidelines by
consulting the following:

○
◎

UK4

CPS.DS-5“NIST SP (Special Publications) 800-57" [25]“Survey and Review for Revising SSL/TLS

131ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Encryption Setup Guidelines and for Creating KeyManagement Guidelines - Survey Report -" [26]・The implementation must be such as to minimize

Smarthome
SR3-SP-12★★★

Service

Minimization of

the collection of data.

＝◎

Information◎collected data

CPS.GV-2

Platform

SR3-SP-13★★★

Smarthome

Vulnerability

Servicescanning andInformation

penetration

Platform

testing

Run vulnerability scanning and penetration
testing periodically to check for any○
vulnerabilities. The method and timing of suchcheck should be set individually to suit the◎◎
CPS.CM-7

services provided.

132ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

6.2.2 Security Secondary Requirements for Service Provider Information Platforms
Security Secondary Requirements for Service Provider Information Platform are summarized below. (Entry points: EP③ to EP④)

Table 6-5 Security Secondary Requirements for Service Provider Information Platform
No.

Level

Scope

Item
Responding to

SR2-PP-1～★★

SR2-PP-7

ServiceCommonProviderRequirements

Information～

Platform

Installation of
security patches

SR3-PP-1～★★★

SR3-PP-13

SR3-PP-14★★★

Description

UK

SB327

CPSF

※The same actions as those required by the
Security Secondary Requirements for Smarthome
Services information platform must be
implemented.
*To find out more about the Secondary※See “Smarthome Service
Information Platform.

Requirements, see SR2-SP-1 to SR2-SP-7, Section
6.2.1.

Responding to ★★

*The same actions as those required by theServiceservice requirements

security Requirements for Smarthome Services

Provider～information platform must be implemented.

※See “Smarthome Service

Information

Vulnerability*To find out more about the Secondary

Information Platform.

Platformscanning andRequirements, see SR3-SP-1 to SR3-SP13, Section

penetration testing

6.2.1.

Service

Deletion of personal

Providerinformation

・The platform must support a function for＝＝deleting collected personal information when it is
no longer needed or when a request to delete is◎
UK8

CPS.GV-2
CPS.IP-6

133ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
Information

received from the service provider.

Platform
As for each servicer accesses the infoemation

Service
SR3-PP-15★★★

ProviderAuthentication of each

Information

servicer＝

platform, perform appropriate access

CPS.AC-2

management.

◎◎

CPS.AC-3
CPS.AC-5

Platform

CPS.AC-9

6.2.3 Security Secondary Requirements for Home Gateways
Security Secondary Requirements for a home gateway are summarized below. (Entry points: EP⑤ to EP⑥)

Table 6-6 Security Secondary Requirements for Home Gateways
No.

SR2-H-1

SR2-H-2

Level

★★

★★

Scope

Home
gatewayHome
gateway

Item
Responding toCommonDescription

UK

SB327

・Common Requirements ★ defined in the IoT＝

Field Common Security Guidelines must be met.

UK1＝

CPS.IP-1

UK6

1798.91.05

CPS.IP-6

Requirements

＝

UK13

CPS.PT-2

・A scheme of mutual authentication among theAuthentication

CPSF

connected devices must be implemented.

＝◎◎

CPS.AC-3
CPS.AC-9134ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
・A scheme of preventing the leakage of

SR2-H-3★★

Management of

information needed for mutual authenticationHome

informationmust be implemented.

gatewayneeded for mutual○◎◎

CPS.AC-3
CPS.AC-9

authentication

Carry out operation monitoring and fault＝
SR2-H-4★★

Home
gateway

Device operation

monitoring of service-compatible devices

monitoring, fault

regarding the following points:monitoring

1)Device alive management

CPS.DS-7○◎
UK10

CPS.CM-2
CPS.CM-3

2)Connection of unauthorized devices
・Make USB terminals (ports) hardly accessible
to any personnel other than operators to reduce

SR2-H-5★★

Home
gateway

USB terminal
protection

the risks of improper connection. Further, do not○install USB terminals that are not needed for◎◎
CPS.PT-2

service purposes.
Example:Use a physical cover on any USB
terminal, and so on.

Release of・If vulnerabilities have been reported in the OS,Home

software updates

boot program or applications used, run testing＝gateway

to fix reported

and release software updates promptly.

UK3＝
SR2-H-6★★

◎vulnerabilities

CPS.DS-7
CPS.MA-1

135ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
SR3-H-1

SR3-H-2

★★★

★★★

Home
gatewayHome
gateway

Responding to ★★

・Security Requirements for similar devices used

servicefor ★★ must be fulfilled.

※See ★★.

requirements
Prevention of・A function must be implemented to prevent

unauthorized

unauthorized access attempts from an external

access attempts

Internet.

from an external

Example:Defensive function based on a firewall○◎◎
CPS.PT-3

Internet

SR3-H-3★★★

Home
gateway

Actions against

・If a function managing Web application or Web

attacks that

API-based settings or operations is implemented,

exploit Web

take vulnerability actions adhering to theapplication

following guidelines:

vulnerabilities-"Building a Secure Website" [28]

○

○
◎

UK13

CPS.CM-3

・ For communication with the external
Encryption of theSR3-H-4★★★

Home
gatewaypaths ofcommunication
with externalInternet

Internet, encrypt the communication path.
*If cryptography with authentication is
implemented in Secondary Requirement No.2
"Authentication" for a ★★ service, however, no

○

○
◎

UK5

CPS.DS-3

response to this requirement is required becausesuch implementation addresses the secondary
requirement for an encrypted communication path136
ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
at the same time.
*Cryptography must be implemented to comply
with the Guidelines by consulting the following:-“TLS Encryption Setup Guidelines" [22]-“CRYPTREC Cyphers List” [23] or ”CRYPTREC
Cryptographic Technology Guidelines(Lightweight Cryptography)" [24]・The paths of communication with LAN-attacheddevices must be encrypted.

*This does not apply where the home gateway is
wired to devices on the LAN.
Encryption of theSR3-H-5★★★

Home
gatewaypaths of*If cryptography with authentication iscommunication

implemented in Secondary Requirement No.2

with LAN-"Authentication" for a ★★ service, however, noattached devices

response to this requirement is required because

○

○
◎

UK5

CPS.DS-3

such implementation addresses the secondary
requirement for an encrypted communication pathat the same time.
*Cryptography must be implemented to comply
with the Guidelines by consulting the following:137ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021“TLS Encryption Setup Guidelines" [22]-“CRYPTREC Cyphers List" [23] or“CRYPTREC

Cryptographic Technology Guidelines(Lightweight Cryptography)” [24]・Encrypt the assets to be protected that havebeen saved.
*For information about the assets to be protected,
see Table 3-2, Section 3.2 of this document.
* Encrypt those assets having a higher level of○
SR3-H-6★★★

Home
gateway

Data encryption

importance to reflect services and use cases.
*Cryptography must be implemented to comply
with the Guidelines by consulting the following:

○
UK4

◎
CPS.DS-2

UK8-“TLS Encryption Setup Guidelines" [22]-“CRYPTREC Cyphers List" [23] or ”CRYPTREC
Cryptographic Technology Guidelines(Lightweight Cryptography)" [24]・Enforce proper management of the keys used to
SR3-H-7★★★

Home
gateway

Key management

encrypt communication paths and data.

○○◎*The method of key management must be

UK4

CPS.DS-5

implemented to comply with the Guidelines by

138ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
consulting the following:“NIST SP (Special Publications) 800-57” [25]“Survey and Review for Revising SSL/TLS
Encryption Setup Guidelines and for Creating KeyManagement Guidelines - Survey Report -" [26]SR3-H-8★★★

Home
gateway

Logging andanalysis

Vulnerability
SR3-H-9★★★

Home
gatewayscanning andpenetration
testing

・Access logs must be kept to allow incidents to＝be analyzed on the Service Information Platform◎◎
CPS.MA-2

as they occur.
・When the development of a new product iscompleted or software is updated, run○
vulnerability scanning and penetration testing tocheck for presence or absence of any◎◎
CPS.CM-7

vulnerabilities.

139ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

6.2.4 Security Secondary Requirements for Smarthome-Compatible Devices
Security Secondary Requirements for smarthome-compatible devices are outlined below. (Entry points: EP⑦ to EP⑧)

Table 6-7 Security Secondary Requirements for Smarthome-Compatible Devices
No.

SR2-D-1

Level

★★

Scope

Item

Smarthome-

Responding tocompatible

CommondevicesRequirements★★

compatible

UK

SB327

Authentication

CPSF

・Common Requirements ★ in the Common＝

Security Guidelines must be fulfilled.

UK1＝

CPS.IP-1

UK6

1798.91.05

CPS.IP-6＝

UK13

CPS.PT-2

・A scheme of mutual authentication must be

SmarthomeSR2-D-2

Description

implemented.

＝◎◎

devices

CPS.AC-3
CPS.AC-9

・A scheme of preventing the leakage ofSmarthomeSR2-D-3★★

compatible
devicesManagement of

information needed for mutual authentication

information neededmust be implemented.

for mutual＝◎◎

CPS.AC-3
CPS.AC-9

authentication

140ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
・Make USB terminals (ports) hardly accessible
to any personnel other than operators to reduce
SmarthomeSR2-D-4★★

compatible
devices

USB terminal
protection

the risks of unauthorized connection. Further, do○
not install USB terminals that are not needed for◎◎
CPS.PT-2

service purposes.
Example:Cover USB connection terminals with aphysical cover, and more.

SmarthomeSR2-D-5★★

compatible
devices

SR3-D-1★★★

Release of software・If vulnerabilities have been reported on the

updates to fix

software or firmware installed in devices, run＝

reported

testing and release software updates promptly.

UK3

＝
◎

CPS.MA-1

vulnerabilities

Smarthome-

Responding to ★★

・Security Secondary Requirements for similar

compatible

servicedevices used for ★★ must be fulfilled.

devicesrequirements

CPS.DS-7※See ★★.

・The paths f communication with LAN-attachedncryption of theSR3-D-2★★★

devices must be encrypted.

Smarthome-

path ofcompatible

communication*No response to this secondary requirement isdeviceswith LAN-attachedrequired for a wired connection.

devices*If cryptography with authentication is

○

○
◎

UK5

CPS.DS-3

implemented in Secondary Requirement No.2

141ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021"Authentication" for a ★★ service, however, no
response to this secondary requirement isrequired because such implementation addresses
the secondary requirement for an encrypted
communication path at the same time.
*Cryptography must be implemented to comply
with the Guidelines by consulting the following:-TLS Encryption Setup Guidelines" [22]-“CRYPTREC Cyphers List" [23] or ”CRYPTREC
Cryptographic Technology Guidelines(Lightweight Cryptography)" [24]・Enforce proper management of the keys used

SmarthomeSR3-D-3★★★

＝
compatible

Key management

for encrypting communication paths.

Smarthome-

Communications

Implement connectivity with the home gateway

compatible

I/F allowing forto allow for availability to suit the service

devicesavailability

provided.

Smarthome-

Vulnerability

compatible

scanning anddevices

penetration testing

devices

SR3-D-4

SR3-D-5

★★★

★★★

＝
◎

UK4

CPS.DS-5＝◎◎
CPS.DS-7

・When the development of a new product iscompleted or software is updated, run○◎

vulnerability scanning and penetration testing to◎
CPS.CM-7

check for presence or absence of any

142ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021
vulnerabilities.

143ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

6.2.5 Security Secondary Requirements for Smartphone Applications
Security Secondary Requirements for Smartphone Applications are summarized below. (Entry points: EP⑨ to EP⑩)
*At present, relevant Secondary Requirements are limited to ★★.

Table 6-8 Security Secondary Requirements for Smartphone Applications
No.

SR2-A-1

Level

★★

Scope
Smartphone
Application

Item

Description

UK

SB327

・Security actions based on multi-factor
User authentication

authentication must be enforced when

CPSF
＝

◎

◎

smartphone applications are used.

CPS.AC-3
CPS.AC-9

Security-conscious design and coding compliant

SR2-A-2★★

Smartphone
Application

Secure design

with the following guidelines must be＝
implemented:◎◎
CPS.RA-4

・Coding“Android Application Secure Design and Secure
Coding Guide” [27].
・Whenever security holes or bugs that could＝
SR2-A-3★★

Smartphone

Updating Smartphone

affect smartphone applications are identified,＝

Application

Applications

software updates must be released promptly to fix

UK3

◎
them.

CPS.DS-7
CPS.MA-1

144ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

7 Conclusion
This Guidelines has presented a typical smartphone system model, along with use cases to help
discuss possible threats and actions relevant to it. Then, the categorizations of smarthome
products and services and the impact of smarthome characteristics upon security were reviewed
and threats to use cases and the actions were analyzed and assessed. A summary description of the
security actions to be taken in the life cycles of development work for smarthome services andsmarthomes (houses) was also included. The Guidelines proceeds to sort security actions required
for smarthome services and systems and devices, and compile them into Security Requirements
and Secondary Requirements.
The authors hope that this Guidelines will aid readers in taking relevant approaches to planning,
designing and developing smarthome products and services in the present context of growing
popularity of smarthomes.

While the calculation of risk metrics based on the Smarthome Unique Method presented in thisGuidelines has taken Life and Property Impact and Information Importance into consideration,
further studies should be directed at determining whether it is necessary to capture othersmarthome-specific security characteristics. Further, because the procedural flow of risk analyses
and assessment outlined in this Guidelines is a time-consuming step to follow, it should require
further refinement.

The authors would like to update the Guidelines to reflect changes of the times by responding toemerging smarthome products and services and by responding to emerging attack techniques, aswell as develop responses to these issues at a higher level of refinement.

Although this document has been prepared as Security Guidelines for the smarthome field, its
threat assumptions and security efforts made in the life cycle of a smarthome might apply to othercategories as well. It is the authors’ wish that the reader will make positive use of the Guidelines
in pursuing security actions in their respective processes of developing various products andservices.

145ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Citation / References[1] State of California, "SB-327 Information privacy: connected devices.”
http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB327[2] IoT 推進コンソ ーシアム,総務省,経済産業省, ”IoT セキュリティガイドライン”
http://www.meti.go.jp/press/2016/07/20160705002/20160705002-1.pdf[3] 総務省, “平成 28 年版情報通信白書” 第 1 部 第 2 章 第 1 節 1 p.80
http://www.soumu.go.jp/johotsusintokei/whitepaper/ja/h28/pdf/n2100000.pdf[4] IPA, ”つながる世界の開発指針～安全安心な IoT の実現に向けて開 発者に認識してほしい重要ポ

イント～”https://www.ipa.go.jp/files/000051411.pdf[5] CCDS, ”IoT 分野共通セキュリティ要件ガイドライン 2018 年度版（案）”https://www.ccds.or.jp/public/document/other/IoT 分野共通セキュリティ要件ガイドライン 2018 年度版（案）.pdf[6] IPA, “IoT 開発におけるセキュリティ設計の手引き”
https://www.ipa.go.jp/security/iot/iotguide.html[7] 経済産業省, “別表第八 電気用品安全法施行令（昭和三十七年政令第 三百二十四号）別表第一第六号
か ら 第 九 号 ま で及 び 別 表 第 二 第 七 号 か ら 第十 一 号 ま で に 掲 げ る 交 流 用 電 気 機 械 器 具 並 び に 携 帯 発 電機”
http://www.meti.go.jp/policy/consumer/seian/denan/kaishaku/gijutsukijunkaishaku/
beppyoudai8.pdf[8] 国立研究開発法人産業技術総合研究所, “国際標準化の新規開発提案が承認される”
https://www.aist.go.jp/aist_j/news/nr20180330.html

146ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021[9] 総務省, “クラ ウドサービス提供における情報セキュリティ対策ガイドライン（第 2 版）”
http://www.soumu.go.jp/menu_news/s-news/01cyber01_02000001_00001.html[10] CCDS, “製品分野別セキュリティガイドライン IoT-GW 編 Ver.2.0”
https://www.ccds.or.jp/public/document/other/CCDS Product Field-Specific Security
Guidelines_IoT-GW_Ver2.0.pdf[11]STRIDE:A scheme of threat classification proposed by Microsoft.
https://docs.microsoft.com/ja-jp/azure/security/azure-security-threat-modeling tool-threats[12] CCDS, “IoT システム調達のためのセキュリティ要件フレームワーク”
https://www.ccds.or.jp/public/document/other/CCDS_IoT シ ス テ ム 調 達 の た め の セ キ ュ リ テ ィ 要 件 フ
レームワーク.pdf[13] JPCERT/CC, “インシデントとは？“
https://www.jpcert.or.jp/aboutincident.html[14] IPA, “つながる世 界の開 発指針第 2 版”
https://www.ipa.go.jp/sec/reports/20170630.html[15] CCDS, “IoT セキュリティ評価検証ガイドライン Rev1.0”
https://www.ccds.or.jp/public/document/other/guidelines/CCDS_IoT セキュリティ評価検証ガイドライ
ン_rev1.0.pdf[16] FIRST (Forum of Incident Response and Security Teams),“Common Vulnerability Scoring System v3.0: Specification Document”
https://www.first.org/cvss/specification-document[17] IPA, “共通脆弱性 評価シ ステム CVSS v3 概説”
https://www.ipa.go.jp/security/vuln/CVSS v3.html[18]OTA, “IoT Security & Privacy Trust Framework v2.5”
https://www.internetsociety.org/wp content/uploads/2018/05/iot_trust_framework2.5a_Japanese.pdf

147ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021[19 OWASP, “Top 10 IoT Vulnerabilities (2014)”
https://www.owasp.org/index.php/Top_10_IoT_Vulnerabilities_(2014)[20] 経済産業省, “サイバー・フィジカル・セキュリティ対策フレームワーク Version1.0”
https://www.meti.go.jp/press/2019/04/20190418002/20190418002-2.pdf[21] GOV.UK, “Code of Practice for Consumer IoT Security”
https://www.gov.uk/government/publications/code-of-practice-for-consumer-iot security[22] IPA, “TLS 暗号設定ガイドライン”
https://www.ipa.go.jp/security/vuln/ssl_crypt_config.html[23] CRYPTREC, “電子政府における調達のために参照すべき暗号のリスト”
https://www.cryptrec.go.jp/list.html[24] CRYPTREC, “CRYPTREC 暗号技術ガイドライン(軽量暗号)”
https://www.cryptrec.go.jp/tech_guidelines.html[25] National Institute of Standards and Technology (NIST), NIST SP800-57 Part 1“Recommendations for Key Management (Part I: General Matters)”
https://www.ipa.go.jp/files/000055491.pdf[26] IPA, “SSL/TLS 暗号設定ガイドライン改定及び鍵管理ガイドライン 作成のための調査・検討－調査
報告 書－”
https://www.ipa.go.jp/files/000067459.pdf[27] JSSEC, “Android アプリのセキュア設計・セキュアコーディングガイド”
https://www.jssec.org/dl/android_securecoding.pdf[28] IPA, “安全なウェ ブサイ トの作り方”
https://www.ipa.go.jp/files/000017316.pdf

148ⓒ2020 Connected Consumer Device Security Council Proprietary

CCDS-SH02-2021
CCDS-SH03-2021

Authors/Editors
Project General Manager:Sekisui House, Ltd.

Project Deputy Manager:LIXIL Corporation

Smarthome WG
ALPHA Corporation
Sekisui Home Techno Co., Ltd.
Nippon Systemware Co., Ltd.
Bunka Shutter Co., Ltd.
Rinnai Corporation
MAST TOP Co., Ltd.

Guidelines Supervisory Board
President:
Tsukasa OginoRepresentative Director, Connected Consumer Device Security Council, generalincorporated association

Membership:
Yasuo Tan, Professor, Graduate School of Science and Technology, Japan Advanced Institute of
Science and Technology

Katsunari Yoshioka
Associate Professor, Yokohama National University Graduate School of Environment andInformation Sciences/Institute of Advanced Sciences149ⓒ2020 Connected Consumer Device Security Council Proprietary