Iotverif: Automatic Verification of SSL/TLS Certificate for IoT Applications

Although extensive research has been conducted on securing the Internet of Things (IoT) communication protocols, various vulnerabilities and exploits are continuously discovered reported. Since introduced from either insecure protocols or defectiveness applications, it is difficult to identify them during software development testing phase. In this paper, we present IoTVerif, a system that automatically verifies Secure Socket Layer/Transport Layer Security (SSL/TLS) certificate for IoT applications utilize broker-based messaging protocols. IoTVerif constructs specification an protocol its security properties, without relying prior knowledge about Once constructed, general-purpose model checker those as well generates counter-examples if any property does not hold. We analyze effectiveness with real-world IoT-related applications. Our evaluation results show can successfully which exploitable by man-in-the-middle (MITM) TLS renegotiation attacks. holds great promise reverse-engineering emerging identifies