Lux: Enabling Ephemeral Authorization for Display-Limited IoT Devices

Logan Blue, Samuel Marchal, Patrick Traynor, N. Asokan

Research output: Chapter in Book/Report/Conference proceedingConference article in proceedingsScientificpeer-review

1 Citation (Scopus)
21 Downloads (Pure)


Smart speakers are increasingly appearing in homes, enterprises, and businesses including hotels. These systems serve as hubs for other IoT devices and deliver content from streaming media services. However, such an arrangement creates a number of security concerns. For instance, providing such devices with long-term secrets is problematic with regards to vulnerable devices and fails to capture the increasingly transient nature of the relationship between users and the devices (e.g., in hotel or airbnb settings, this device is not owned by the customer and may only be used for a single day). Moreover, the limited interfaces available to such speakers make entering such credentials in a safe manner difficult. We address these problems with Lux, a system to provide ephemeral, fine-grained authorization to smart speakers which can be automatically revoked when the user and hub are no longer in the same
location. We develop protocols using the LED/light channel available to many smart speaker devices to help users properly identify the device with which they are communicating, and demonstrate through a formally validated protocol that such authorization takes only a few seconds in practice. Through this effort, we demonstrate that Lux can safely authorize devices to access user accounts while
limiting any long-term exposure to compromise.
Original languageEnglish
Title of host publicationIoTDI 2021 - Proceedings of the 2021 International Conference on Internet-of-Things Design and Implementation
Number of pages13
ISBN (Electronic)978-1-4503-8354-7
Publication statusPublished - 18 May 2021
MoE publication typeA4 Conference publication
EventInternational Conference on Internet-of-Things Design and Implementation - Charlottesville, United States
Duration: 18 May 202121 May 2021
Conference number: 6


ConferenceInternational Conference on Internet-of-Things Design and Implementation
Abbreviated titleIoTDI
Country/TerritoryUnited States


Dive into the research topics of 'Lux: Enabling Ephemeral Authorization for Display-Limited IoT Devices'. Together they form a unique fingerprint.

Cite this