Keeping the Smart Home Private with Smart(er) IoT Traffic Shaping

Apthorpe, Noah; Huang, Danny Yuxing; Reisman, Dillon; Narayanan, Arvind; Feamster, Nick

doi:10.2478/popets-2019-0040

Cited by 161 publications

(139 citation statements)

References 38 publications

Supporting

Mentioning

138

Contrasting

Unclassified

Order By: Relevance

“…In [40], the authors used the application source code to correlate Zigbee traffic and device events. Finally, as far as we know, the Wi-Fi sniffer threat model has not been widely studied: it has only been presented in [19] and [8].…”

Section: Related Workmentioning

confidence: 99%

Packet-Level Signatures for Smart Home Devices

Trimananda

Varmarken

Markopoulou

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

103

105

View full text Add to dashboard Cite

Smart home devices are vulnerable to passive inference attacks based on network traffic, even in the presence of encryption. In this paper, we present Ping-Pong, a tool that can automatically extract packetlevel signatures (i.e., simple sequences of packet lengths and directions) from the network traffic of smart home devices, and use those signatures to detect occurrences of specific device events (e.g., light bulb turning ON/OFF). We evaluated PingPong on popular smart home devices ranging from smart plugs to thermostats and home security systems. We have successfully: (1) extracted packet-level signatures from 18 devices (11 of which are the most popular smart home devices on Amazon) from 15 popular vendors, (2) used those signatures to detect occurrences of specific device events with an average recall of more than 97%, and (3) shown that the signatures are unique among tens of millions of packets of real world network traffic.

show abstract

Section: Related Workmentioning

confidence: 99%

Packet-Level Signatures for Smart Home Devices

Trimananda

Varmarken

Markopoulou

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

103

105

View full text Add to dashboard Cite

show abstract

“…We used SHA-128 as the hashing algorithm. 9 OIT distributed the desired security keys to the desired entities, as mentioned in §5. After executing the control phase, the desired encrypted data (as mentioned in §5.1) is outsourced to a cloud machine of 8 cores and 32 GB RAM.…”

Section: Resultsmentioning

confidence: 99%

“…Step 2: Deleting sensor reading (Lines [1][2][3][4][5][6][7][8][9][10][11][12][13][14]. Suppose that in an epoch T i , n sensor records are needed to be deleted.…”

Section: State Transition Phasementioning

confidence: 99%

“…While data captured by sensors is useful for service provisioning, it has significant privacy implications. Several studies [9,12,40] have recently highlighted how sensor data can lead to unexpected inferences about individuals and their behavior. Regulations, such as General Data Protection Regulation (GDPR) [1], California Online Privacy Protection Act (CalOPPA) [2], and California Consumer Privacy Act (CCPA) [3], have imposed several requirements on the organizations in which they can retain their user data.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

IoT Expunge

Panwar

Sharma

Gupta

et al. 2020

Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy

View full text Add to dashboard Cite

The growing deployment of Internet of Things (IoT) systems aims to ease the daily life of end-users by providing several value-added services. However, IoT systems may capture and store sensitive, personal data about individuals in the cloud, thereby jeopardizing user-privacy. Emerging legislation, such as California's CalOPPA and GDPR in Europe, support strong privacy laws to protect an individual's data in the cloud. One such law relates to strict enforcement of data retention policies. This paper proposes a framework, entitled IoT Expunge that allows sensor data providers to store the data in cloud platforms that will ensure enforcement of retention policies. Additionally, the cloud provider produces verifiable proofs of its adherence to the retention policies. Experimental results on a real-world smart building testbed show that IoT Expunge imposes minimal overheads to the user to verify the data against data retention policies. CCS CONCEPTS• Security and privacy → Security protocols; Mobile and wireless security; Domain-specific security and privacy architectures; Social aspects of security and privacy.1 Since secure enclave is a trusted agent of SDP, it can decrypt and compute over encrypted data.There are challenges in computing using enclaves due to side-channel attacks, e.g., cache-line, branch shadow, page-fault attacks [42], but since the focus of this paper is on implementing data retention policies, we do not address those challenges in this paper.

show abstract

“…The Raspberry's WiFi interface was used to connect the instrumented access point to the Internet and allow the IA devices to send data to their cloud services. This setup is similar to the one described by Apthorpe et al…”

Section: Case Of Study: Intelligent Voice Assistantsmentioning

confidence: 98%

A review and an empirical analysis of privacy policy and notices for consumer Internet of things

Pérez

Zeadally

Cochran

2018

Security and Privacy

View full text Add to dashboard Cite

The privacy policies and practices of six consumer Internet of things (IoT) devices were reviewed and compared. In addition, an empirical verification of the compliance of privacy policies for data collection practices on two voice‐activated intelligent assistant devices, namely the Amazon Echo Dot and Google Home devices was performed. The review shows that IoT privacy policies may not be usable from the human‐computer interaction perspective because IoT policies are included as part of the manufacturers' general privacy policy (which may include policies unrelated to the device), or the IoT policy requires to read (in addition to the IoT policies) the manufacturers' general privacy policy which increase the cognitive load for the user. It was also found that future policy changes along with the approach to provide user consent to changes may adversely affect the privacy of the consumer because changes to policies may not provide choice to consumers to opt out from data collection practices if consumers are not aware of the changes. Finally, the empirical results for the Amazon Echo Dot and the Google Home devices demonstrate they adhere to their privacy policies when voice is collected through these devices.

show abstract

Keeping the Smart Home Private with Smart(er) IoT Traffic Shaping

Cited by 161 publications

References 38 publications

Packet-Level Signatures for Smart Home Devices

Packet-Level Signatures for Smart Home Devices

IoT Expunge

A review and an empirical analysis of privacy policy and notices for consumer Internet of things

Contact Info

Product

Resources

About