{"id":"https://openalex.org/W7155173756","doi":"https://doi.org/10.1109/jiot.2026.3686461","title":"NASchecker: Automatically Identifying the Performance, Security, and Privacy Issues of NAS Devices","display_name":"NASchecker: Automatically Identifying the Performance, Security, and Privacy Issues of NAS Devices","publication_year":2026,"publication_date":"2026-04-22","ids":{"openalex":"https://openalex.org/W7155173756","doi":"https://doi.org/10.1109/jiot.2026.3686461"},"language":null,"primary_location":{"id":"doi:10.1109/jiot.2026.3686461","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2026.3686461","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134241388","display_name":"Guangyue Ren","orcid":"https://orcid.org/0009-0007-6662-5942"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangyue Ren","raw_affiliation_strings":["School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China"],"raw_orcid":"https://orcid.org/0009-0007-6662-5942","affiliations":[{"raw_affiliation_string":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jincheng Wang","orcid":"https://orcid.org/0009-0003-4496-0978"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jincheng Wang","raw_affiliation_strings":["School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China"],"raw_orcid":"https://orcid.org/0009-0003-4496-0978","affiliations":[{"raw_affiliation_string":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027733268","display_name":"Le Yu","orcid":"https://orcid.org/0000-0003-1457-6329"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Le Yu","raw_affiliation_strings":["School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-1457-6329","affiliations":[{"raw_affiliation_string":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090306459","display_name":"Liping Han","orcid":"https://orcid.org/0000-0002-1676-8263"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liping Han","raw_affiliation_strings":["School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-1676-8263","affiliations":[{"raw_affiliation_string":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121255212","display_name":"Mingzhe Hu","orcid":null},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mingzhe Hu","raw_affiliation_strings":["School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0001-9808-4967","affiliations":[{"raw_affiliation_string":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023806511","display_name":"Wei Chen","orcid":"https://orcid.org/0000-0002-6248-1298"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wei Chen","raw_affiliation_strings":["School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-6248-1298","affiliations":[{"raw_affiliation_string":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121525811","display_name":"Tingting Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tingting Liu","raw_affiliation_strings":["School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-7649-2385","affiliations":[{"raw_affiliation_string":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134308889","display_name":"Xiapu Luo","orcid":null},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Xiapu Luo","raw_affiliation_strings":["Faculty of Computer and Mathematical Sciences, The Hong Kong Polytechnic University, Kowloon, Hong Kong"],"raw_orcid":"https://orcid.org/0000-0002-9082-3208","affiliations":[{"raw_affiliation_string":"Faculty of Computer and Mathematical Sciences, The Hong Kong Polytechnic University, Kowloon, Hong Kong","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5021136987","display_name":"Guozi Sun","orcid":"https://orcid.org/0000-0003-1888-7001"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guozi Sun","raw_affiliation_strings":["School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-1888-7001","affiliations":[{"raw_affiliation_string":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.46827488,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":"13","first_page":"29723","last_page":"29745"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3285999894142151,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3285999894142151,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.1251000016927719,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.04010000079870224,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.4839000105857849},{"id":"https://openalex.org/keywords/privacy-protection","display_name":"Privacy protection","score":0.34450000524520874},{"id":"https://openalex.org/keywords/privacy-software","display_name":"Privacy software","score":0.3441999852657318},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.31049999594688416},{"id":"https://openalex.org/keywords/electronic-mail","display_name":"Electronic mail","score":0.2946999967098236},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.27959999442100525}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.784500002861023},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.4839000105857849},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4634999930858612},{"id":"https://openalex.org/C3017597292","wikidata":"https://www.wikidata.org/wiki/Q25052250","display_name":"Privacy protection","level":2,"score":0.34450000524520874},{"id":"https://openalex.org/C509729295","wikidata":"https://www.wikidata.org/wiki/Q7246032","display_name":"Privacy software","level":3,"score":0.3441999852657318},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.31049999594688416},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.2946999967098236},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.27959999442100525},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.2696000039577484},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2655999958515167},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.25529998540878296},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.25429999828338623}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2026.3686461","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2026.3686461","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G14048707","display_name":null,"funder_award_id":"62171217","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2360891922","display_name":null,"funder_award_id":"24KJB520030","funder_id":"https://openalex.org/F4320335440","funder_display_name":"Natural Science Research of Jiangsu Higher Education Institutions of China"},{"id":"https://openalex.org/G5038635535","display_name":null,"funder_award_id":"25KJB520029","funder_id":"https://openalex.org/F4320335440","funder_display_name":"Natural Science Research of Jiangsu Higher Education Institutions of China"},{"id":"https://openalex.org/G5215826601","display_name":null,"funder_award_id":"62472234","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7829884108","display_name":null,"funder_award_id":"62502226","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335440","display_name":"Natural Science Research of Jiangsu Higher Education Institutions of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Network":[0],"attached":[1],"storage":[2],"(NAS)":[3],"devices":[4,149,160,173,194],"are":[5,161,174,234],"widely":[6],"deployed":[7],"for":[8,23,39,49,249],"personal":[9],"data":[10],"storage.":[11],"However,":[12],"their":[13,202],"distributed":[14],"architecture":[15],"and":[16,27,56,77,89,98,109,166,183,227,244,252],"limited":[17],"inspection":[18],"interfaces":[19],"pose":[20],"significant":[21],"challenges":[22],"comprehensive":[24],"performance,":[25],"security,":[26],"privacy":[28,57,126,130,191,204],"analysis.":[29],"In":[30],"this":[31],"paper,":[32],"we":[33,43,213],"first":[34],"establish":[35],"a":[36,45,156,190],"threat":[37],"model":[38],"NAS":[40,60,139],"ecosystems.":[41],"Then,":[42],"present":[44],"systematic":[46],"framework":[47],"NASchecker":[48,73,92,114,135],"discovering":[50],"performance":[51],"optimization":[52],"mechanisms,":[53],"security":[54,79,157],"threats,":[55],"leakage":[58],"in":[59,121,125,201,221],"devices.":[61,140],"By":[62],"analyzing":[63],"traffic":[64,83,122],"generated":[65],"during":[66],"varied":[67],"file":[68,151],"operations":[69],"on":[70,136],"crafted":[71],"files,":[72],"infers":[74],"implemented":[75],"optimizations":[76],"identifies":[78],"flaws":[80],"within":[81],"the":[82,147,208,211,222,246],"(e.g.,":[84],"susceptibility":[85],"to":[86,102,128,163,168,210],"passive":[87,164],"sniffing":[88,165],"replay":[90,169],"attacks).":[91],"also":[93],"integrates":[94],"NAS-specific":[95],"protocol":[96],"fuzzing":[97],"firmware":[99],"reverse":[100],"engineering":[101],"uncover":[103],"deep-seated":[104],"command":[105,177],"injection,":[106,178],"memory":[107,181],"corruption,":[108,182],"improper":[110,186],"access":[111,187],"control":[112],"vulnerabilities.":[113],"compares":[115],"personally":[116],"identifiable":[117],"information":[118],"(PII)":[119],"leaked":[120,195],"against":[123],"declarations":[124],"policies":[127],"detect":[129],"compliance":[131],"issues.":[132],"We":[133],"evaluated":[134],"twelve":[137],"commercial":[138],"Our":[141],"results":[142],"reveal":[143],"that":[144,197],"none":[145],"of":[146,224,232,255],"tested":[148],"employ":[150],"compression":[152],"or":[153],"deduplication.":[154],"From":[155,189],"standpoint,":[158],"ten":[159],"vulnerable":[162],"seven":[167,172],"attacks.":[170],"Moreover,":[171],"affected":[175],"by":[176,180,185,217],"four":[179,193],"eleven":[184],"control.":[188],"perspective,":[192],"PIIs":[196],"were":[198],"not":[199],"disclosed":[200],"respective":[203],"policies.":[205],"After":[206],"reporting":[207],"findings":[209,240],"manufacturers,":[212,219],"have":[214],"been":[215],"acknowledged":[216],"several":[218],"resulting":[220],"assignment":[223],"20":[225],"CVEs":[226],"6":[228],"NVDB":[229],"entries":[230],"(16":[231],"them":[233],"rated":[235],"as":[236],"high":[237],"severity).":[238],"These":[239],"validate":[241],"NASchecker\u2019s":[242],"effectiveness":[243],"underscore":[245],"urgent":[247],"need":[248],"improved":[250],"design":[251],"testing":[253],"practices":[254],"NAS.":[256]},"counts_by_year":[],"updated_date":"2026-06-27T06:13:17.587685","created_date":"2026-04-23T00:00:00"}