In recent years, the intelligent door lock market has developed rapidly. With the advent of the Internet of things era, all walks of life are seeking intelligent transformation, intelligent door lock has gradually become the focus of public attention. The huge growth space of smart lock market cannot be underestimated, but as an important link to protect the personal and property security, the following security has become the key point of the development of smart lock.
Development trend of intelligent door lock & main risks in application
Intelligent door lock is improved on the basis of traditional mechanical lock. Its core function is "keyless unlocking". After networking, it can realize the distribution of unlocking authority, access to the state of door lock, and linkage with other equipment. Based on these four functions, many specific functions are distributed. According to the survey data in 2018, more than 2000 enterprises have entered the field of smart door locks. In 2019, the whole smart door lock market will exceed 29 million units. By 2020, the whole smart door lock market will exceed 40 million units, and the market scale will reach 40 billion. There is a huge development space in the future.
Data source: National lock industry information center
According to the classification of customers, the smart door lock is divided into family smart door lock and apartment smart door lock. The customer of family lock is the resident family in China, and the customer of apartment lock is the operation subject of long-term and short-term rental apartments in China. The "apartment" caliber is the residential housing operated by all b-end (merchants) for rental, including centralized and decentralized apartments.
The realization of smart door lock function mainly includes smart door lock device, smart home gateway, mobile app, cloud service and other components. According to the function layer, it can be divided into perception layer, transmission layer and application layer. The technology of transmission layer and application layer is the existing Internet technology. The user identity authentication mode of perception layer mainly includes fixed password, temporary password, fingerprint, palmprint, face, RFID, NFC and app, and the near-field access technology mainly includes WiFi, Bluetooth, ZigBee, 433MHz and 315MHz.
(photo source: Jing Zhundong, in-depth research report on China's intelligent door lock industry)
According to the analysis of the main components related to the function realization of the intelligent door lock, its safety risks can be divided into the following five aspects:
(1) Security risk of intelligent door lock (against the attack of intelligent door lock equipment);
(2) Security risk of mobile application (attack on smart door lock mobile app);
(3) Near field communication security risk (for WiFi, ZigBee, Bluetooth and other communication mode attacks);
(4) Network security risks (attacks against home intelligent gateway and wired data interception);
(5) Application security risk (attack against smart door lock cloud platform).
Further risk and case analysis are conducted for the security risks related to mobile Internet, mainly including the following aspects:
1. Security risks of mobile applications
There are various common security risks in mobile app, such as: fixed encryption and decryption key is used in mobile app code or firmware; mobile app code does not adopt reinforcement and confusion technology to make the code completely reverse, so as to understand and crack the unlocking mechanism and then construct control instructions for attack; code bug left by developers may lead to bypass of relevant problems Authority verification; mobile terminal operating system has related vulnerabilities, resulting in malicious code implanted to control mobile phone attack; mobile terminal app and device authentication problems, if there is a vulnerability in the authentication process between mobile terminal app and device, it is easy to lead to man in the middle attack, that is, forging a fake mobile terminal app and real device to communicate to achieve the purpose of deception Attack.
The attacker uses these vulnerabilities or defects of the app corresponding to the smart door lock to bypass the pre-set logic of the smart door lock, app and cloud service, and realize the unauthorized unlocking operation.
2. Network communication security risk
Some smart door locks are directly connected to the Internet through WiFi signals, while the door locks of other communication modes will also be connected to the Internet through WiFi signals after they are connected to the corresponding gateway. At the same time, when the mobile app is at home, it will also be connected to the smart door lock and cloud server through WiFi. Considering that a large number of smart door lock communication protocols adopt plaintext transmission, or there are loopholes in the encrypted transmission process, the control of smart door lock can be realized by attacking WiFi router, smart home gateway, or intercepting WiFi signal.
3. Security risks of cloud platform services
(1) User identity authentication vulnerability
The complexity of the password is not limited, the number of illegal login is not limited, and the SMS verification code for resetting the password is generated locally or exists in the returned packet.
(2) Access control vulnerability
The back-end information system does not verify the important access control parameters in the data package, which leads to the unauthorized operation. There is also a remote code execution vulnerability, which can execute root permission commands. Important reply information is hijacked.
(3) Web security problems in cloud management platform system
Common web security vulnerabilities also exist in smart door lock cloud management platform, such as SQL injection, arbitrary file upload, invalid authentication and call back management, cross site script attack, insecure direct object reference, security configuration error, sensitive information disclosure, lack of function level access control, cross site request forgery, using components with existing vulnerabilities and unverification Redirection and forwarding.
Relevant policies and standards for security reinforcement of smart door locks
Intelligent door lock is a kind of lock controlled by information technology. It has complex interface. For different components, it faces different threats, has different purposes to resist threats, and needs different security functions in design. In addition, in view of the pain points of smart door lock in the market, we need to strengthen the security design of smart door lock, attach importance to the security of mobile Internet applications, select compliant cloud service providers, attach importance to the requirements of personal information protection, attach importance to the response mechanism of regular evaluation and vulnerability repair.
At present, the penetration rate of intelligent door lock is relatively low, and the standard of intelligent door lock focuses on mechanical safety and functional safety, and the safety problems need to be solved. In this context, the state has issued national standards such as information security equal protection 2.0 to carry out unified security deployment requirements from the two dimensions of technical requirements and management requirements, and detailed the relevant security requirements of mobile Internet from physical and environmental security, network and communication security, equipment and computing security, application and data security in part 3 mobile internet security extension requirements.
At the end of 2018, the national intelligent Standard Committee officially issued the guidelines for the application of intelligent door lock security technology in digital technology in buildings and residential areas, in which the framework of intelligent door lock system is defined, and specific contents such as the security of intelligent door lock terminal, smart key, cloud service platform, client, general and smart door lock are specified.
Architecture of intelligent door lock system
The relevant safety requirements include:
1. Security requirements for cloud service infrastructure platform
As a unified storage and management platform for device data and user data, the security mechanism of cloud service infrastructure platform should include data security, information security, management security and personal privacy protection security.
2. IOT platform security requirements
IOT platform shall provide connection management, equipment management and other functions, mainly involving equipment access security and equipment data management security, including:
(1) Secure transmission protocol shall be adopted between intelligent lock and IOT platform;
(2) HTTPS bidirectional authentication shall be supported between IOT platform and business platform to ensure transmission security;
(3) The identity authentication mechanism should be supported between the intelligent lock and the IOT platform to ensure the access of legal devices;
(4) It has the ability to resist traffic attack and the external interface has the ability of intrusion prevention
(5) Support host IDS mechanism
3. Data integrity
In order to ensure that the data will not be tampered with in the process of transmission, the client should use key technology to sign the integrity of the data sent by the server.
4. Data confidentiality
In order to prevent the sensitive data in the client from being stolen, the client shall design data confidentiality, including:
(1) Encryption technology shall be adopted to ensure the confidentiality of sensitive data when stored locally
(2) Ensure that sensitive data in the client cannot be read by other application operations
(3) The sensitive data or the whole message in the communication process shall be encrypted and protected;
(4) The client shall turn off the function of debugging log printing before release to prevent the leakage of sensitive data.
5. Data transmission security
When the smart lock is used to unlock or exchange sensitive data such as key distribution by wireless way, the communication parties shall conduct authentication to prevent sensitive data from being leaked or tampered, and shall meet the relevant requirements of the guidelines.
6. Authentication encryption capability
For communication equipment with data storage and equipment management, hardware security module shall be used for encryption calculation. It shall support at least the national secret algorithm and optionally the international algorithm.
Smart door lock mobile internet security reinforcement technology and strategy suggestions
After years of research and practice, several-dimensional security is analyzed and studied in combination with the application scenario characteristics and security risks of smart door lock. Guided by national policies and industry standards, and combined with the company's technical research, the security reinforcement strategies of smart door lock mobile Internet are proposed, including:
1. Cloud management end protection strategy
The security needs to be realized by multiple links. Starting from the main components of the intelligent door lock function, the key to achieve the security goal is to build the overall security reinforcement solution from the cloud tube end.
2. Terminal firmware and app code virtualization protection
Protect the core part of the smart lock (firmware + APP) to ensure that the core key and business logic are not broken by the attacker in reverse, so as to protect the smart lock from being attacked. Traditional security reinforcement can only be used for security encryption of applications in black box app (. APK /. IPA) state. Kiwivm virtual machine virtualizes the source code from the source code compilation stage based on llvm, which can be applied to various platforms and architectures. In other words, as long as the R & D platform can use llvm compiler, kiwivm can be used for virtualization encryption of the source code. In this way, kiwivm can reinforce the firmware and app simultaneously, so as to prevent them from being broken by the attacker's reverse analysis.
3. Virtualization implementation
Through the front-end code collection kit, the source code is collected, the code is virtualized by LLVM-IR, and finally compiled into the executable file of the applicable platform
Flow chart of virtualization implementation
Taking the deployment of several dimension security technology products as an example, the company independently developed kiwivm virtualization protection scheme technology based on the full platform and full architecture of llvm compiler, which uses white box key protection technology products to secure data transmission and ensure the integrity and confidentiality of communication; through terminal application reinforcement technology products to encrypt code, to achieve application data integrity and security Security protection; resource control through deployment of defensive SDK for detection.
Knot language
With the rapid development of Internet of things, 5g and other technologies, and the in-depth promotion of intelligence, the general application of intelligent door lock will be the general trend. However, as a key point related to personal and property security, intelligent door lock security still faces many challenges. 2019 will be a key year for all forces to continue to increase investment, the rise of intelligent door lock industry and the continuous development of scene landing. The following years, through Under the guidance of the government and in-depth cooperation in the industry chain, we will further promote the standardization of smart door locks, ensure the construction of a safe environment and promote industrial development.