School of Management, China University of Mining and Technology (Beijing), Beijing 100083, China.
Sensors (Basel). 2023 May 11;23(10):4664. doi: 10.3390/s23104664.
Although the smart home industry is rapidly emerging, it faces the risk of privacy security that cannot be neglected. As this industry now has a complex combination system involving multiple subjects, it is difficult for the traditional risk assessment method to meet these new security requirements. In this study, a privacy risk assessment method based on the combination of system theoretic process analysis-failure mode and effect analysis (STPA-FMEA) is proposed for a smart home system, considering the interaction and control of 'user-environment-smart home product'. A total of 35 privacy risk scenarios of 'component-threat-failure-model-incident' combinations are identified. The risk priority numbers (RPN) was used to quantitatively assess the level of risk for each risk scenario and the role of user and environmental factors in influencing the risk. According to the results, the privacy management ability of users and the security state of the environment have significant effects on the quantified values of the privacy risks of smart home systems. The STPA-FMEA method can identify the privacy risk scenarios of a smart home system and the insecurity constraints in the hierarchical control structure of the system in a relatively comprehensive manner. Additionally, the proposed risk control measures based on the STPA-FMEA analysis can effectively reduce the privacy risk of the smart home system. The risk assessment method proposed in this study can be widely applied to the field of risk research of complex systems, and this study can contribute to the improvement of privacy security of smart home systems.
尽管智能家居行业正在迅速崛起,但它面临着不容忽视的隐私安全风险。由于该行业现在涉及多个主体的复杂组合系统,传统的风险评估方法难以满足这些新的安全要求。在这项研究中,针对智能家居系统,提出了一种基于系统理论过程分析-失效模式和影响分析(STPA-FMEA)相结合的隐私风险评估方法,考虑了“用户-环境-智能家居产品”的交互和控制。总共确定了 35 种“组件-威胁-失效模式-事件”组合的隐私风险场景。使用风险优先数(RPN)定量评估每个风险场景的风险水平以及用户和环境因素对风险的影响程度。根据结果,用户的隐私管理能力和环境的安全状态对智能家居系统隐私风险的量化值有显著影响。STPA-FMEA 方法可以相对全面地识别智能家居系统的隐私风险场景和系统层次控制结构中的不安全约束。此外,基于 STPA-FMEA 分析提出的风险控制措施可以有效降低智能家居系统的隐私风险。本研究提出的风险评估方法可以广泛应用于复杂系统风险研究领域,有助于提高智能家居系统的隐私安全性。