{"id":"https://openalex.org/W4401210766","doi":"https://doi.org/10.1109/jiot.2024.3429417","title":"Uncovering Access Token Security Flaws in Multiuser Scenario of Smart Home Platforms","display_name":"Uncovering Access Token Security Flaws in Multiuser Scenario of Smart Home Platforms","publication_year":2024,"publication_date":"2024-08-01","ids":{"openalex":"https://openalex.org/W4401210766","doi":"https://doi.org/10.1109/jiot.2024.3429417"},"language":"en","primary_location":{"id":"doi:10.1109/jiot.2024.3429417","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2024.3429417","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048531636","display_name":"Yiyu Yang","orcid":"https://orcid.org/0000-0002-7452-3934"},"institutions":[{"id":"https://openalex.org/I4210108629","display_name":"Computer Network Information Center","ror":"https://ror.org/01s0wyf50","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210108629"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yiyu Yang","raw_affiliation_strings":["National Computer Network Intrusion Protection Center, School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-7452-3934","affiliations":[{"raw_affiliation_string":"National Computer Network Intrusion Protection Center, School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210108629","https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075243974","display_name":"Jice Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I4210108629","display_name":"Computer Network Information Center","ror":"https://ror.org/01s0wyf50","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210108629"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jice Wang","raw_affiliation_strings":["National Computer Network Intrusion Protection Center, School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Computer Network Intrusion Protection Center, School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210108629","https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100346828","display_name":"Peng Liu","orcid":"https://orcid.org/0000-0002-5091-8464"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peng Liu","raw_affiliation_strings":["College of Information Sciences and Technology, Pennsylvania State University, State College, PA, USA"],"raw_orcid":"https://orcid.org/0000-0002-5091-8464","affiliations":[{"raw_affiliation_string":"College of Information Sciences and Technology, Pennsylvania State University, State College, PA, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048592388","display_name":"Anmin Fu","orcid":"https://orcid.org/0000-0002-1632-5737"},"institutions":[{"id":"https://openalex.org/I36399199","display_name":"Nanjing University of Science and Technology","ror":"https://ror.org/00xp9wg62","country_code":"CN","type":"education","lineage":["https://openalex.org/I36399199"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Anmin Fu","raw_affiliation_strings":["School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-1632-5737","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing, China","institution_ids":["https://openalex.org/I36399199"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100401884","display_name":"Yuqing Zhang","orcid":"https://orcid.org/0000-0001-8306-7195"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]},{"id":"https://openalex.org/I20942203","display_name":"Hainan University","ror":"https://ror.org/03q648j11","country_code":"CN","type":"education","lineage":["https://openalex.org/I20942203"]},{"id":"https://openalex.org/I4210108629","display_name":"Computer Network Information Center","ror":"https://ror.org/01s0wyf50","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210108629"]},{"id":"https://openalex.org/I4210136859","display_name":"Xi\u2019an University of Posts and Telecommunications","ror":"https://ror.org/04jn0td46","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210136859"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuqing Zhang","raw_affiliation_strings":["National Computer Network Intrusion Protection Center, School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China","also with the School of Cyber Engineering, Xidian University, Xi'an, China","School of Cyberspace Security, Xi'an University of Posts and Telecommunications, Xi'an, China","School of Computer Science and Cyberspace Security, Hainan University, Haikou, China"],"raw_orcid":"https://orcid.org/0000-0001-8306-7195","affiliations":[{"raw_affiliation_string":"National Computer Network Intrusion Protection Center, School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210108629","https://openalex.org/I4210165038"]},{"raw_affiliation_string":"also with the School of Cyber Engineering, Xidian University, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"School of Cyberspace Security, Xi'an University of Posts and Telecommunications, Xi'an, China","institution_ids":["https://openalex.org/I4210136859"]},{"raw_affiliation_string":"School of Computer Science and Cyberspace Security, Hainan University, Haikou, China","institution_ids":["https://openalex.org/I20942203"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.9172,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.72923843,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":96,"max":97},"biblio":{"volume":"11","issue":"22","first_page":"36841","last_page":"36857"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9847999811172485,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9847999811172485,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9815000295639038,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.964900016784668,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7919238805770874},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7393086552619934},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.6065837740898132},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5404354929924011},{"id":"https://openalex.org/keywords/home-automation","display_name":"Home automation","score":0.46597859263420105},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.45858263969421387},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.4167071580886841},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.16115501523017883}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7919238805770874},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7393086552619934},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.6065837740898132},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5404354929924011},{"id":"https://openalex.org/C507571656","wikidata":"https://www.wikidata.org/wiki/Q848436","display_name":"Home automation","level":2,"score":0.46597859263420105},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.45858263969421387},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.4167071580886841},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.16115501523017883},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2024.3429417","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2024.3429417","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Decent work and economic growth","score":0.41999998688697815,"id":"https://metadata.un.org/sdg/8"}],"awards":[{"id":"https://openalex.org/G2011081604","display_name":null,"funder_award_id":"U1836210","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3625357762","display_name":null,"funder_award_id":"U2336203","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":40,"referenced_works":["https://openalex.org/W2012921353","https://openalex.org/W2112995928","https://openalex.org/W2133723082","https://openalex.org/W2218971720","https://openalex.org/W2254160488","https://openalex.org/W2283736639","https://openalex.org/W2290364824","https://openalex.org/W2295733304","https://openalex.org/W2400427673","https://openalex.org/W2508433864","https://openalex.org/W2512179496","https://openalex.org/W2559870021","https://openalex.org/W2562586545","https://openalex.org/W2765511846","https://openalex.org/W2791710451","https://openalex.org/W2929275958","https://openalex.org/W2941399919","https://openalex.org/W2942680566","https://openalex.org/W2943233581","https://openalex.org/W2955962760","https://openalex.org/W2969759835","https://openalex.org/W2991334710","https://openalex.org/W2995926045","https://openalex.org/W2998879240","https://openalex.org/W3015797940","https://openalex.org/W3031816651","https://openalex.org/W3044372812","https://openalex.org/W3109376429","https://openalex.org/W3163385614","https://openalex.org/W3211475103","https://openalex.org/W4221001515","https://openalex.org/W4287848621","https://openalex.org/W4290996325","https://openalex.org/W4387609078","https://openalex.org/W6744196339","https://openalex.org/W6748246993","https://openalex.org/W6764964240","https://openalex.org/W6766492497","https://openalex.org/W6766802360","https://openalex.org/W6782007757"],"related_works":["https://openalex.org/W2393340519","https://openalex.org/W4298219515","https://openalex.org/W3118510577","https://openalex.org/W2021298062","https://openalex.org/W2185499427","https://openalex.org/W1883246888","https://openalex.org/W2371301679","https://openalex.org/W2527966616","https://openalex.org/W2188018701","https://openalex.org/W1526913711"],"abstract_inverted_index":{"Access":[0],"tokens":[1,21],"have":[2,162],"been":[3],"thoroughly":[4],"researched":[5],"in":[6,27,184],"website":[7],"and":[8,86,114,181,195,197,206],"mobile":[9,57],"application":[10,18,101],"security.":[11],"However,":[12],"we":[13,108,188,212],"believe":[14],"that":[15,64,75,138,164],"the":[16,33,84,100,121,142,218],"traditional":[17],"of":[19,36,46,62,102,141,192],"access":[20,50,69,103,151],"must":[22],"fulfill":[23],"new":[24,132],"security":[25,72,77,97,159,166],"requirements":[26],"smart":[28,126,145],"home":[29,41,127,146],"environments":[30],"due":[31],"to":[32,48,51,68,99,119,123,171],"distinct":[34],"features":[35],"multiuser":[37],"sharing":[38],"usage.":[39],"Smart":[40],"platforms":[42,147],"allow":[43],"different":[44],"types":[45],"users":[47],"share":[49],"a":[52,110,116],"single":[53],"IoT":[54],"device":[55],"through":[56],"apps,":[58],"with":[59],"varying":[60],"levels":[61],"permissions":[63],"are":[65,148],"closely":[66],"tied":[67],"tokens.":[70,104],"One":[71],"concern":[73],"is":[74],"existing":[76],"standards":[78],"or":[79],"literature,":[80],"as":[81,83],"well":[82],"development":[85],"implementation":[87],"by":[88,150],"vendors,":[89],"may":[90],"overlook":[91],"these":[92,131,165,193],"features,":[93],"thereby":[94],"introducing":[95],"potential":[96],"risks":[98],"In":[105],"this":[106],"work,":[107],"propose":[109],"novel":[111],"testing":[112,135],"framework":[113],"conduct":[115],"systematic":[117],"study":[118],"test":[120],"extent":[122],"which":[124,155],"real-world":[125,144,185],"platform":[128],"implementations":[129],"neglect":[130],"requirements.":[133],"The":[134],"results":[136],"show":[137],"seven":[139,199],"out":[140],"11":[143],"plagued":[149],"token":[152],"management":[153],"flaws,":[154],"collectively":[156],"violate":[157],"four":[158],"properties.":[160],"We":[161],"found":[163],"flaws":[167,194],"can":[168],"be":[169],"exploited":[170],"enable":[172],"unrestricted":[173],"file":[174],"upload,":[175],"DoS":[176],"attack,":[177],"remote":[178],"command":[179],"execution,":[180],"illegal":[182],"surveillance":[183],"scenarios.":[186],"Finally,":[187],"conducted":[189],"responsible":[190],"disclosure":[191],"attacks":[196],"obtained":[198],"China":[200],"national":[201],"vulnerability":[202,204,209],"database":[203],"IDs":[205],"one":[207],"CVE":[208],"ID.":[210],"Additionally,":[211],"also":[213],"provide":[214],"suggestions":[215],"for":[216],"mitigating":[217],"vulnerabilities.":[219]},"counts_by_year":[{"year":2025,"cited_by_count":3}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}