Virtual-Device-Based Policy Enforcement in Multi-Admin Smart Environments

The Matter standard, formerly known as Connected Home over IP, has emerged as the preferred choice for most smart home IoT vendors and service providers for the next-generation smart home IoT systems. It enhances interoperability across different smart home ecosystems and introduces the multi-admin feature, allowing a device to be commissioned and managed by multiple platforms simultaneously. While this standard offers considerable convenience, it also presents challenges for security policy enforcement. Policy enforcement has been highlighted in various studies as a crucial countermeasure against smart home IoT system vulnerabilities. Existing smart home policy enforcement methods, designed for individual IoT admin platforms, operate under the assumption of having a global view and control over all IoT devices in a smart home. This assumption, however, is untenable in a multi-admin environment, where an admin may only have partial device access or a partial view. In this work, we thoroughly analyze these challenges in a multi-admin setting and propose the first cross-admin policy enforcement solution. Our solution can parse complex policies into deployable sub-policies for each admin, and create virtual device instances and virtual automation rules to interconnect various admins. We test our solution on a real-world testbed involving 12 IoT devices and three popular Matter-enabled IoT platforms. Our results show that our solution can enforce cross-admin policies with a 100% success rate and a very small delay.