This increasing popularity has also made the IoT devices and applications in the center of attention among attackers. From small household devices to large industrial machines, the vision of IoT has made it possible to connect the devices with the physical world around them. The concept of Internet of Things (IoT) has become more popular in the modern era of technology than ever before. We find, via a laboratory user study, that attacks can be prevented at a much higher rate (54-64% improvement) and via a field user study, that ENTRUST requires no more than three additional authorizations per program with respect to the first-use approach, while incurring modest performance (<1%) and memory overheads (5.5 KB per program). To demonstrate this approach, we implement the ENTRUST authorization system for Android. ENTRUST tracks user input as well as delegation events and restricts the execution of such events to compute unambiguous delegation paths to enable accurate and reusable authorization of sensor operations. In this paper, we propose ENTRUST, a system that enables users to authorize sensor operations that follow their input events, even if the sensor operation is performed by a program different from the program receiving the input event. Furthermore, proposed delegation methods do not enable users to control the use of their input events accurately. Researchers have proposed that programs should only be authorized to access system sensors on a user-approved input event, but these methods do not account for possible delegation done by the program receiving the user input event. However, untrusted programs may exploit interactions with other programs to obtain unauthorized access to system sensors either directly or through privileged services. Instead of placing all functionality into a single program, programs cooperate to complete tasks requested by users. Modern operating systems such as Android, iOS, Windows Phone, and Chrome OS support a cooperating program abstraction.

Download rat