# Security Challenges for Users of Extensible Smart Home Hubs: A Systematic Literature Review
## 3 Results
### Summary of the Literature
They categorize security issues in smart home systems into malicious entity behavior and network-based attacks, where entities can be control points, hubs, or devices. Using their approach, the authors highlight vulnerabilities in the Philips Hue smart lighting system, including discovery request abuse, flawed authentication, lack of authorization, and replay attacks. In 2021, [PERSON] et al. [25] surveyed mechanisms for access control and authorization in smart home systems, presenting an overview and guidelines for future work and open challenges to consider when developing frameworks. The authors introduce different models for access control and the requirements for access control in smart homes: scalability, heterogeneity, reliability, and lightweight. The survey emphasizes how the most common access control and authorization models are ineffective for smart home uses due to their static nature, indicating the need for more advanced models like Attribute-based Access Control (ABAC). Finally, it is argued that the ideal access control framework is centralized and policy-based, making dynamic access decisions. Future challenges for this model include multi-user management and the dynamic nature of smart home systems, where devices are continuously added and removed. Also in 2021, [PERSON] et al. [26] argued that free open-source home automation systems are good solutions to vendor lock-in in the smart home space and explained the requirements for the systems to succeed: secure APIs, protocol interoperability, constrained device support, and consolidated management of heterogeneous devices. The authors provide an overview of 20 free open-source home automation systems and a deeper analysis of the four most promising ones: Home Assistant, openHAB, ioBroker, and Domoticz, based on challenges identified by related works. Among these are biometric authentication, multi-user authentication, authorization management, and quality control for third-party extensions. Finally, the authors point to the lack of role-based access control as an open issue for future work. [PERSON] and [PERSON] (2022) cover the approaches currently being used to secure smart home systems in their paper from 2022. Some security threats highlighted include direct remote operation, compromised user accounts, user impersonation, and permission abuse in malicious third-party extensions. Conventional security approaches include Intrusion Detection Systems (IDSs), user authentication, access control models, and anomaly detection. The authors conclude that conventional methods are insufficient to secure the operation of smart home systems, and further work is needed on securing app-based and multi-user smart home systems. [PERSON] and [PERSON] (2022) introduced in 2022 a threat model tailored to extensible smart home hubs designed to be extended using third-party extensions. The purpose of the model is to provide a tool for extension developers. The threat model focuses on how extensions might interfere with confidentiality, integrity, availability, and non-repudiation by accessing and/or changing device states and information not within their scope. The authors validate the threat model by creating sample integrations for the Home Assistant open-source extensible smart home hub that access data outside their scope, including sometimes even data belonging to another integration. The sample integrations were able to demonstrate all but three of the threats in the threat model. The article concludes that there is a need for more detailed examples of each threat and that an improved security architecture is required in the Home Assistant platform API for integrations. In 2022, [PERSON] et al. (2022) analyzed device integration bugs in the Home Assistant home automation platform and applied the lessons to the systems that allow third-party extensions to add device support. These systems have three main concepts: device integration through third-party extensions, a unified automation and monitoring interface, and a device mapping system.