# Security Challenges for Users of Extensible Smart Home Hubs: A Systematic Literature Review
## 3 Results
### Summary of the Literature  
In their 2019 paper [20], [PERSON] and [PERSON] explore the concept of extensible smart home hubs, with a focus on the openHAB smart home system. They begin by explaining the overall architecture of these hubs and the abstraction of specific devices into generic \"things\". The paper then describes a reference smart home system setup, which includes a local network of devices, a microcomputer hub, and cloud services integrated through the hub. The authors share their experiences with the added and missing functionalities of openHAB compared to native apps. They also compare the open-source openHAB solution to one of the leading commercial solutions at the time, SmartThings, which Samsung acquired in 2014. Regarding cybersecurity, the paper cites two studies indicating that researchers could manipulate smart home devices controlled by the SmartThings system. At the same time, the open-source openHAB solution only revealed minor API errors. This suggests that openHAB is a safer alternative, although it has a more complicated setup process. In the same year (2019), [PERSON] et al. [21] presented an approach to enforce user expectation policies in applied smart home systems that utilize Trigger-Action Pro  
Figure 2: PRISMA flow diagram. gramming. This approach ensures that automations act according to user expectations regarding what can and cannot happen in their smart home environment. The need for this approach arises from the paradigm of unvetted third-party apps running as part of smart home systems, which the authors address through their malicious app-based threat model. Instead of validating actions using static analysis, the authors' approach inspects requested actions at runtime and either allows or disallows them based on user-provided invariants, such as \"I expect the front door to unlock only when vacation mode is off\". They present an openHAB-based implementation of their approach and test it with previously studied problematic automation rules. In 2020, [PERSON] et al. [22] introduced a blockchain-based perspective on smart home system security, specifically utilizing the advantages of blockchain technology for authentication and permission control. The authors break down the architecture of centralized systems into user, permission, data, and message subsystems, highlighting the disadvantages of a centralized system: account security, admin abuse, and a single point of failure. A system is proposed where accounts are replaced with a blockchain encryption method that avoids account management pitfalls. Further, the system is decentralized without a single device to control the rest, ensuring that the remaining system stays up even when parts of it fail. The authors show how blockchain technology can be used to implement short-term permissions, multi-user permissions, and a control hierarchy. In 2021, [PERSON] and [PERSON] [23] introduced a model for a multi-device and multi-user access control scheme for smart home systems. They highlight the lack of a fine-grained permissions structure in popular smart home systems or the lack of restraint in the default assignments of permissions where fine-grained permissions do exist. The authors categorize common user groups, such as home adults, home children, and guest adults, and discuss their specific needs. They explain the challenge of balancing over-privileging and under-privileging different users. Their proposed solution involves different default levels of privilege, which can be temporarily overridden. For example, a child could be allowed to use the stove for an hour with parental permission. Future work on this model includes implementing and testing it in a smart home system. [PERSON] et al. [24] scrutinized smart home systems from an integration perspective in 2021, utilizing an approach that extracts application-layer protocols and behaviors from integration implementations to derive a unified abstraction for analysis.