Safety Assurance in IoT-Based Smart Homes

Abstract

A smart home’s safety is a very urgent question due to several causes. This chapter analyzes current directions of smart house system safety technologies in use nowadays. Current studies are dedicated to the integration of Internet of Things (IoT) into smart home systems; critical situations that may arise; and specifications of sensors in the smart home system. The huge number of connected devices and the capacity embedded within these devices to direct demand resources make deliberate attacks on them and/or inadvertent downfall events such as abrupt bad interactions between connected devices, mechanical failure of devices, and unsuccessful communication may lead to IoT-based systems entering unreliable and threatening physical states. We review current trends in security-enabled safety monitoring frameworks for IoT-based smart homes. We demonstrate the use of various techniques in utilizing system analysis during design to develop a monitoring model that can be executed, providing run-time safety assurance for a system. This is achieved through collecting and analysis of operational data and evidence to assess the safety status of the system. Subsequently, appropriate actions are taken, and the safety status is communicated securely to system users, along with recommended actions to reduce the risk of the system entering an unsafe state.

1. Introduction

The Internet of Things (IoT) has occupied several aspects of our daily lives; specifically, it turns our place of right-mindedness and convenience into a pool of interacting smart devices that allow such comfort, adaptability, automation and stability. The rise of intelligent technologies in households offers a range of services and functionalities for people’s lives. Although a smart home (SH) offers significant opportunities for increased comfort and risk management, it presents new safety hazards and it also changes the nature of the already existing risks [1].

Modern smart home relies heavily on a mixed of hardware and software-intensive systems. These intensive systems include safety-critical systems such as urgent-care medical equipment, gas leakage detection, fire alarming system, and so on. In many of these systems, an abrupt problem in the software or hardware can lead to hazardous failures with the potential for loss of life. Since safety is a key requirement for the SHs, failures in safety-critical systems carry the potential for serious and disastrous impacts, including posing risks to human life or even causing loss of life [2]. Because of this delicate relationship between SHs and hazards originating from techniques these SHs employ, safety assurance and risk analysis techniques have become of paramount necessity in designing and operating of SHs.

Safety assurance is the planned and systematic process to ensure adequate confidence in the safety of a product, a service, or a functional system [3]. It represents the way to create a safety argument and to prove that this argument always indicates safe conditions [4]. Several definitions of safety have been introduced in the literature, for example, the Cambridge dictionary defines it as “a state in which or a place where you are safe and not in danger or at risk” [5]. However, the most appropriate one is given by Dezfuli et al. [4] when they define the safety as “freedom from conditions that may result in death, injury, occupational illness, equipment and property loss, or harm to the environment”.

The study’s assessment method is based on the analysis of works published in previous authentic, peer-reviewed, and famous scientific conferences and journals that are indexed in relevant scientific databases in addition to survey studies for distinguished related works.

The study provides a larger scope in the field of IoT safety than the previous studies; hence, it can be productively used by future researchers in the smart home safety assurance and give handy and deeper comprehension and guidance for the IoT-based smart home topic’s researches and professionals. The study’s main contribution is providing an updated literature revision on Safety Assurance (SA) approaches for Smart Home (SH) as a Cyber-Physical System (CPS), with a focus on the two main frameworks in this concern: design-time SA and run-time safety assurance. To reach this goal, the study is organized as follows: Section 2 explains the IoT architecture as introductory information for the reader. Section 3 provides the works related to this study. Section 4 presents challenges of Smart Home Safety Assurance (SHSA). Section 5 is reserved for SA problem. In Section 6, we conclude our study.

2. IoT architecture

Before discussing safety assurance in IoT-based SH, the existing layers of the IoT architecture will be briefly highlighted. The term IoT literally stands for “Internet of Things” and it refers to any combination of devices (things) that are connected to the Internet [6]. However, numerous intelligent devices rely on proxies like hubs or local connections via Bluetooth or Zigbee wireless instead of directly connecting to the internet, Radio Frequency Identification (RFID), or Wi-Fi. Wi-Fi provides enhanced ways to connect objects together and enable communication not only among themselves but also with the internet. For the sake of this study, the term IoT refers to any group of functions that includes at least two physical components that can be connected to over any kind of network. The Internet of Things utilizes specific protocols with sensing devices to facilitate communication for smart recognition, positioning, tracking, monitoring, control, operation, and management [7]. There are various IoT architectures available for IoT devices. In this study, we are going to depend on the 4 layers paradigm since it is simple and comprehensive.

2.1 Perception layer

The IoT architecture’s perception layer consists of a variety of devices that focus on sensing the environment and activating physical processes. Various devices and technologies that receive information from the surroundings are included in the perception layer. Pressure sensors, smoke sensors, vibration sensors, and RFID sensors are some of the devices and technologies available [5] to precept physical parameters, such as object properties, biometrics, and physiological or environmental conditions. Moreover, this layer includes actuators that work according to commands coming from processing layer. These devices are anticipated to possess a high level of dependability, user-friendliness, increased clarity, heightened responsiveness, intelligent detection, minimal energy usage, and other features [6].

2.2 Network layer

The network layer, the second in the IoT architecture, ensures the dependable transfer of data from the perception layer to the computational unit for processing sensing data [7, 8]. The network layer transports data through interfaces and gateways using communication technologies and protocols [9]. This level of the IoT structure establishes guidelines for collecting data. The network layer combines devices like hubs, switches, gateways, along with technologies like Bluetooth, Wi-Fi, and Long-Term Evolution (LTE) [10].

2.3 Processing layer

The data-processing layer in the IoT system is responsible for processing events, enabling smooth software communication for storing and handling IoT data [11, 12, 13, 14]. The processing layer serves as a link connecting the application and network layers, carrying out tasks such as data accumulation, abstraction, and analysis [15]. Data are processed through cloud computing and multiparty computation, enabling both bulk data processing and intelligent handling. The layer uses machine learning, deep-learning algorithms, and data processing elements to analyze the data from the perception layer, creating new insights and sometimes predicting hazards and issuing warnings.

2.4 Application layer

The top layer of the IoT architecture is the application layer, which provides personalized services based on the end-users’ specific needs [16]. The application layer serves as a bridge between external applications. The layer acts as the main connection between the users and the applications. It processes the data received from the network layer to provide the services required by the customer. The layer decodes patterns found in IoT data, then translates them into easy-to-understand summarized patterns displayed in graphs, tables, and pictorial formats for users (Figure 1) [17, 18].

Figure 1.

IoT architecture.

3. Related works

Security gets the lion’s share of research but safety is barely left with crumbs. Several studies have been conducted on the subject of smart home security/safety assurance; however, most of them focus on security and privacy issues and neglecting, almost totally, safety concerns within SH.

Safety assurance and risk analysis have been previously discussed, with a primary emphasis on System Theoretic Process Analysis (STPA), a well-known dynamic method. A more detailed explanation of the method was provided, as well as its extensions aiming to enhance hazard analysis in intricate systems [19]. Our research, seen from a different perspective, examines primary static and dynamic safety assurance methods, emphasizing their benefits and limitations.

Another study offers a comprehensive overview emphasizing issues of reliability present in the functioning of IoT layers. It explains models trying to depict the criteria for system failure in a logical and organized way [20], but it does not address ensuring the safety of smart homes. In contrast, our research focuses primarily on investigating safety concerns associated with IoT-enabled smart homes.

A detailed examination of the security of the smart home ecosystem is conducted in a study [21]. The authors have looked into various cyber-attacks and threats that could disrupt the proper operation of various devices and services in smart homes, ultimately impacting safety. However, safety concerns were not considered in that study.

Challenges in smart home technologies enlisted by researchers were 13 [22], however, safety is not discussed. The analysis given in [22] focuses on the technical elements of these obstacles.

A closer survey to our study, with some differences, is presented by Abdulhamid et al. [23]. The researchers give a comprehensive explanation of the interwoven nature of security and safety in IoT system. The study clarifies that safety and security share four types of interplays: conditional dependency, mutual reinforcement, antagonistic relationship, and independent relationship [24, 25]. However, our study focuses on the fourth type of these interplays through explaining the major approaches used for safety assurance in isolation of the security factor.

Program analysis that is used to confirm security and safety aspects of IoT applications have been offered and suggested a variety of categorization and classification characteristics to improve comprehension of safety/security research areas. Additionally, obstacles examined are addressed in the research and the possible strategies that could be implemented to safeguard the security and safety of IoT systems [26]. Our research attempts, anyway, tries to split safety assurance in smart home from security issues and to draw a slim border between runtime and deign-time safety assurance.

Breaches in IoT security happen when threats take advantage of weaknesses in hardware or software. However, IoT safety breaches typically occur due to computer malfunctions caused by hardware or software issues from risks [27], yet basic safety concepts do not offer a comprehensive examination of SA methods. Our research, though, provides a comprehensive explanation of SHSA methods.

4. Smart home safety assurance challenges

4.1 Huge data

The tremendous amount of data generated and transmitted between connected devices has affected researchers interested in dynamic safety assurance of the SH’s strategies, as it is difficult for ML approaches to deal with such big data in a timely manner. It is estimated that a full 90% of all the data in the world has been generated over the last 2 years [28].

4.2 Complexity

Complexity expresses the growing unpredictability of the system’s behavior, which may jeopardize its safe and reliable operation [29]. Sharing data and connecting devices in smart homes requires using the Internet of Things as a backbone for communication. The Internet of Things comprises various levels and layers of software/hardware along with standard protocols. Due to the significant rise in shared data and connected devices, the complexity of used software/hardware and standard protocols will also increase [30]. This leads to increased unpredictability and hence more hazards.

4.3 Cybersecurity

Cybersecurity embraces both security and privacy. There is a strong relationship between safety and cybersecurity in Cyber-Physical Systems (CPSs), including smart homes. This relationship can be characterized as a mutual dependent coexistent relationship. This is due the fact that cyber-attacks can benefit from shortfalls in the protection systems, protocols, or human careless disregard for consequences and directly influence the integrity or availability of the data and control systems [31, 32]. For example, a thief can steal a house if he can hack the cameras and control them. There are already tremendous works that meant to deal with cybersecurity challenges in IoT [33, 34, 35, 36, 37, 38, 39, 40], and these studies have detailed the cybersecurity issues and their alleviation methods. Hence, in this study, we are not covering this subject any further.

4.4 Safety

Irrespective of safety issues related to cybersecurity, safety issues in SHs are numerous and they accommodate a wide spectrum of hardware and software problems. Smart homes include several smart things, and these things can create unsafe conditions and increase the hazard of harm to persons and property if their collective operation goes into unpredictable situation. The halt in a system’s capability to carry out a necessary task or its failure to operate within set boundaries results in harm or damage [27]. For example, consider this scenario:

$$\begin{array}{l}Leaked-gasdetectorisON+UserisatHome+ItisMorning\\ +Userwanttodrinkcoffee+SpeakerOn+StoveisOn\to Safestatus\end{array}$$E1

$$\begin{array}{l}Leaked-gasdetectorisON+Leaked-gasdetectorisidle+UserisatHome\\ +ItisMorning+Userwanttodrinkcoffee+SpeakerOn\\ +StoveisOn\to Hazardousstatus\end{array}$$E2

An inadequate safety legalization and standard in IoT systems also adds difficulties to this safety process. For example, unknown life times; given that Things may outlive their maintainers and the software used to control them, we need to consider how to manage Things that last longer than expected.

4.5 Human factors

These originate from human errors, hardware/software design shortcomings, confusion, and misunderstanding of the system during all system lifecycle stages. For example, inadequate requirement specifications, design mistakes, coding errors, operation pitfalls, hardware/software misconfiguration, and incomplete/erroneous software updates, to name just a few. These factors affect system behavior and may lead it to enter erroneous status.

5. IoT smart home safety assurance problem

5.1 IoT smart home safety assurance problem setup

As any automatic system, a smart home relies on learning-enabled components (LECs) [41]. These components are supplied with sensors and are typically controlled using event-driven software applications. The software applications receive their inputs as sensed data from these sensors, extended triggers, from the Cloud (or internet), user inputs, or any combination of two or more of these data feeders. Consequently, the controller (mostly resided in a central hub or any processing-capable device) software application issues a command to one or more actuators to provide different forms of automation, and this must be accompanied by checking the safety status of the whole smart home system.

At any moment, the safety status of the smart home may change from a safe status to a vulnerable status due to any intentional targeting (privacy and security attacks)), or due to an unintentional failure like design errors, configuration mistakes, updating failures, operational errors, or communication malfunctioning (most safety problems in Io-T smart homes are unintentional). After entering the vulnerable status, the system moves forward to a hazardous status (if there are no curbs/controls to alleviate the hazard and return the system to the safe status, or at least, to the vulnerable status), in which the system is ready to slip into consequence status. Once the system is in the consequence status, there will be (almost) only a little to do about safety assurance because the damage has already occurred. The moment of entering the vulnerable status represents a decisive point in smart homes since it is at this stage the system should be able to recognize the causes of this vulnerability and be prepared to deal with several situations to get the system back to the safe status. Figure 2 illustrates the IoT-based SH safety status transitions.

Figure 2.

IoT-based SH safety status transitions.

The fundamental concepts that are related to the smart home safety assurance are:

1. Failure is defined as the ways in which something might went wrong.

2. Vulnerability it is the exposure of the system to the possibility of being under any kind of hazard.

3. A hazard is a condition that could lead to an undesirable situation for the system. For example, undetected leaked gas could lead to an explosion.

4. Consequence is an undesirable and unexpected situation for the system [42]. For example, an explosion resulted from SH device failure.

5. Curbs are components required to prevent the hazards from leading the system to a consequence. For example, a gas clogging valve can prevent an explosion.

6. Risk is a combination of the probability (or frequency) of hazard occurrence and the severity (or consequence) [42].

5.2 Smart home safety assurance frameworks

A smart home is a complex system that consists of hardware and software components. All hazards in SH are caused by hardware component because software, as stated by Leveson [43] and Abdulkhaleq et al. [44] “software by itself is not hazardous and cannot directly cause damage to human life or environment; it can only contribute to hazards in a system context.” Software has the ability to generate dangerous system conditions either by manipulating the system’s fault controls or by misleading the system’s human operators during their decision-making process. Safety assurance frameworks can be classified into two categories: static and dynamic. Each of these frameworks has its own advantages and disadvantages. These methods rely on creating views by analyzing thorough models of the systems’ static and dynamic behaviors using techniques from available modeling languages features. Most present frameworks have been developed using the unified modeling language (UML) or system modeling language (SML) [23, 45, 46].

5.2.1 Static smart home safety assurance frameworks

This type of safety assurance techniques is achieved during the design phase of the intended SH system’s System Development Life Cycle (SDLC). The reader is referred to Sommerville [47] for detailed information about software design phases. They are also called static or reliability-based safety assurance frameworks because their effect is lost once the system enters its real operation. In these methods, the system subjected to a series of testing-verification-validation processes to ensure that the final product will work in an accepted level of operational safety. Main drawbacks of this type of SA frameworks are:

1. They use qualitative data that might be biased,

2. The injected modeling/simulation/testing data may not be enough for capturing real system behavior,

3. Many design-time assumptions mismatch with real run-time environment uncertainties,

4. Most of these approaches do not provide mitigation/alleviation risk strategies.

The main advantages of these approaches can be summed up by:

1. They are closer to software design philosophies,

2. Easy to grasp, comprehend and implement,

3. Can serve as a vital preemptive defense against safety violations.

4. As it the case always, they are the input for runtime safety assurance approaches.

Ericson [48] presents a system safety technique used only for identifying expected hazards at the early design level when there is not enough detailed design information available; he named it Preliminary Hazard Analysis (PHA).

Currently, the Fault-Tree Analysis (FTA) [49] method is one of the most commonly utilized approaches for conducting safety analysis. The goal of an FTA is to identify and follow the impact of a system-level danger on separate failures of specific system parts and sub-parts. The approach employed by [50] creates a thorough security hierarchy following the overall structure of a smart home. Later on, the technique is assessed in a scenario involving successful breaches on a lightbulb network operating via the ZigBee protocol.

Saeed et al. [51] presents static approach for IoT-based intelligent home fire prevention system using multiple sensors. They use simulation technique to simulate fire in a smart home using the Fire Dynamic Simulator (FDS).

Failure Modes, Effects, and Criticality Analysis (FMECA) is developed by NASA as an extended version for Failure Modes and Effects Analysis (FMEA). It is a design-time safety assurance approach that assigns a criticality ranking for each failure. Several recent researchers use this approach for safety analysis tasks. For example, it has been used by [52, 53]; the earlier use it for risk assessment of medical devices while the later use it after amalgamating dynamic wavelet neural network with it for prognostic devices fault prediction.

In this category of SHSA, the most recent approach is given by [54] when the researchers try to map the problem of safety assurance for the IoT system into a model checking problem. They design a framework to work with Samsung SmartThings platform and named it IOTSAN (for IOT sanitizer) that catches, as they claim, IoT safety violations. No mitigation measures are given in IOTSAN system, and it is only a diagnostic tool.

In the same manner, authors in [55] have turned the safety assurance problem in SH into a model checking problem, and they call their framework safe Internet of Things (SIFT). SIFT receives user’s program of IoT app with a series of event-based rules from multiple users. By aggregating rules together, complex system behavior analysis can be reached using backward chaining strategy. If any safety-related conflict is detected, suggestions for changing the user rules are issued.

SOTERIA is a static analysis system for IoT apps that performs model checking. It automatically generates a state model from IoT-based smart device’s app source code and uses model checking to detect safety and security issues [56].

5.2.2 Dynamic smart home safety assurance frameworks

This type of safety assurance techniques is achieved to overcome the limitations of design phase SA. They usually extend and overlap with design-time approaches. They also called dynamic or system-control-based safety assurance frameworks because their effect continues through the whole system life cycle. These methods build upon the design-time approaches and use them to their benefit. In this sense, we emphasize they are not solely run-time paradigms, see Figure 3, so they (most of them) are a combination of static and dynamic approaches.

Figure 3.

Safety assurance in design time and runtime, adopted from [42], with some modifications.

Run-time safety assurance approaches try to provide, according to Denny et al. [57] “safety cases for through-life safety assurance” via introducing a harmonic cooperation between design-time and run-time approaches. So, the system in the runtime phase has to pass through sense-detect-asses-mitigate loop, see Figure 2 to overcome any safety-related design pitfalls.

The sense-detect-asses-mitigate loop is summarized as follows:

• Sense: is the first step to grasp operational data and passing them to next step,

• Detect: is the second step and it is responsible for detecting the suspicious system behavior during running,

• Asses: third step that receives its input from Detect step to evaluate and to decide the status the system entering (safe, vulnerable, hazardous, or consequent). Accordingly, the safety engine will decide whether to go to Mitigate step or to continue running the system,

• Mitigate: this step is the last choice the safety engine may call for.

Mitigation is not always available or possible but if it possible then can be implemented in two main ways:

1. The first is by blocking the system in its current status and trying to figure out how to return the system back to its previous status.

2. The second way is by augmenting the system with a verified safety wrapper (a backup version of the safety engine or safety controller) that can take control of the SH in order to avoid violations of formal safety properties.

Under unsafe operating conditions or system faults, the decision logic switches from the main safety engine to the safety controller to maintain safety [58]. Main drawbacks of this type of SA frameworks are:

1. They use quantitative data which put a processing burden on SH devices,

2. Hard to grasp, comprehend, and implement,

3. Have to depend on already-made design artifact.

Main advantages of this type of SA frameworks are:

1. Most of them provide risk mitigation strategies,

2. They capture the dynamic nature of the SH.

Most of the dynamic safety assurance methods make use of design-time safety risk management processes as a blueprint for the run-time safety assurance processes. Then, the remedies suggested during the run-time operation of the system are used as feedback information to enhance design-time safety assurance, see Figure 4.

Figure 4.

The FAA framework for system safety management adopted from [59] with some modifications. It shows static and dynamic security assurance.

Several dynamic safety assurance methods have been proposed by smart home community’s researchers previously. A prominent approach for dynamic safety assurance has been suggested: it involves automatically identifying trigger-action programming rule semantics from the source codes of IoT applications [60]. In this approach, the meaning of the source code rules is derived, and the TAPInspector builds these rules along with rule interactions as a finite state machine (FSM).

A new method for detecting dynamically, named PATRIoT, has been suggested [61]. While the IoT app is running, PATRIoT observes the entire system’s interaction. If PATRIoT detects a breach of any defined security/safety policy, it will restrict the app’s activity.

Celik et al. [62] designed a dynamic policy enforcement tool, IOTGUARD, which supports safety and security violations detection and enforcement in IoT apps. IOTGUARD directly blocks unsafe and undesired states in an individual app and multi-app environments.

A proposal for automatically transforming the IoT system into a Linear Hybrid Automata (LHA) model is introduced [63]. The inspection procedure aims to identify safety and security breaches and offer repair recommendations to its customers. The way they carry out the verification involves three main steps: Utilizing Linear Hybrid Automata Automatic Modeling to create LHA models, Examining the reachability of LHA models to assess the system against both positive and negative states through path-oriented checking, and finally, generating suggestions for fixing any verification issues.

A method called IoTBox, which relies on data mining techniques, is suggested for analyzing data produced by sandboxes in IoT systems [64]. Next, it is employed to identify alterations in behavior within IoT systems. A sandbox created based on rules from a smart home will yield minimal false positives and generates rules that can be checked by a human user. IoTBox detects the context in which actions are carried out and generates rules to identify actions that are either missing or in violation. Nevertheless, the requirement for human engagement renders this method somewhat infeasible and inappropriate for independent IoT SH systems.

The researchers in [65] use a combination of FTA and fuzzy neural networks in aquaculture IoT systems. They formulate an intelligent method for fault diagnosis. In their approach, the FTA is manually constructed for each component of the system, and later, they use a rule-based style on rules extracted from the FTA to be used as inputs for the fuzzy neural network so that to train the relationship model between fault safety violations and faults.

McCall et al. [66] present an approach called SAFETAP for safe trigger-action programming (TAP) paradigm. They use it to create automation rules that are triggered based on some condition and perform an action as a result. It is a dynamic safety assurance technique for SHs. SAFETAP is a rule-based analyzer that works on top of symbolic model checking (SMC) algorithms for checking TAP rules for any violations of the properties.

An approach called IotCom is introduced for analyzing hidden and unsafe interaction threats in IoT-based smart home through composition analysis [67]. IotCom utilizes path-sensitive static analysis to create an inter-procedural control flow graph (ICFG) for every application and then employs a graph abstraction method to represent the behavior pertaining to the connected devices in the app as a behavioral rule graph (BRG). BRG creates rules by connecting the triggers, actions, and logical conditions of each control flow in IoT applications.

A dynamic testing method for IoT physical interaction discovery called IOTSAFE is introduced [68]. IOTSAFE creates physical models of devices based on identified interactions, to forecast potential risky situations and prevent unsafe device states. A prototype of IOTSAFE was developed and integrated into the SmartThings platform.

Another dynamic approach is presented [69], named HOMEGUARD. HOMEGUARD is a system designed for IoT platforms in the form of apps to identify and address Cross-App Interference (CAI) risks. An automation semantics extracting module is created for IoT apps. The meanings of various IoT applications are examined together to assess how they interact and identify potential CAI risks.

6. Conclusion

The widespread adoption of IoT-based smart home systems in both private and public sectors necessitates that safety assurance must be given appropriate consideration to avoid the catastrophic consequences of underlying malfunctions. This study presents a different point of view by surveying major static and dynamic safety assurance approaches and highlighting their advantages and drawbacks. The study focuses on the independent relationship between cybersecurity and safety by explaining the major approaches used for safety assurance in isolation of security factor. This is achieved via splitting safety assurance in smart home from security issues and to draw a slim border between runtime and design-time safety assurance. The study’s assessment method is based on the analysis of works published in previous authentic, peer-reviewed, and famous scientific conferences and journals indexed in relevant scientific databases, in addition to survey studies for distinguished related works. The study provides a larger scope in the field of IoT safety than previous studies; hence, it can e productively used by future researchers in the smart home safety assurance and give convenient and deeper comprehension and guidance for the IoT-based smart home topic’s researches and professionals.

For future outlook, the study recommends that the design-time and runtime methods must be amalgamated into general methods to provide ongoing safety assurance guarantee. Moreover, safety can be affected by a combination of devices working together at the same time, so a holistic view of the system when designing safety guards must be taken.