Securing Node-RED Applications
Kapitel i bok, 2021

Trigger-Action Platforms (TAPs) play a vital role in fulfilling the promise of the Internet of Things (IoT) by seamlessly connecting otherwise unconnected devices and services. While enabling novel and exciting applications across a variety of services, security and privacy issues must be taken into consideration because TAPs essentially act as persons-in-the-middle between trigger and action services. The issue is further aggravated since the triggers and actions on TAPs are mostly provided by third parties extending the trust beyond the platform providers.
Node-RED, an open-source JavaScript-driven TAP, provides the opportunity for users to effortlessly employ and link nodes via a graphical user interface. Being built upon Node.js, third-party developers can extend the platform’s functionality through publishing nodes and their wirings, known as flows.
This paper proposes an essential model for Node-RED, suitable to reason about nodes and flows, be they benign, vulnerable, or malicious. We expand on attacks discovered in recent work, ranging from exfiltrating data from unsuspecting users to taking over the entire platform by misusing sensitive APIs within nodes. We present a formalization of a runtime monitoring framework for a core language that soundly and transparently enforces fine-grained allowlist policies at module-, API-, value-, and context-level. We introduce the monitoring framework for Node-RED that isolates nodes while permitting them to communicate via well-defined API calls complying with the policy specified for each node.

Författare

Seyed Mohammad Mehdi Ahmadpanah

Chalmers, Data- och informationsteknik, Informationssäkerhet

Musard Balliu

Kungliga Tekniska Högskolan (KTH)

Daniel Hedin

Chalmers, Data- och informationsteknik, Informationssäkerhet

Mälardalens högskola

Lars Eric Olsson

Chalmers, Data- och informationsteknik, Datavetenskap

Andrei Sabelfeld

Chalmers, Data- och informationsteknik, Informationssäkerhet

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

03029743 (ISSN) 16113349 (eISSN)

Vol. 13066 LNCS 1-21

WebSec: Säkerhet i webb-drivna system

Stiftelsen för Strategisk forskning (SSF) (RIT17-0011), 2018-03-01 -- 2023-02-28.

Ämneskategorier

Datavetenskap (datalogi)

Datorsystem

DOI

10.1007/978-3-030-91631-2_1

Mer information

Senast uppdaterat

2024-07-12