SoK: Privacy-enhancing Smart Home Hubs

Zavalyshyn, Igor; Legay, Axel; Rath, Annanda Thavymony; Rivière, Étienne

doi:10.56553/popets-2022-0097

Cited by 6 publications

(2 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently, Zavalyshyn at al. [50] examine 10 industrial and 37 academic smart home systems and compared their system and threat models, as well as the ways they deal with sensitive sensor and user data. However, they do not target IoT safeguards and their methodology does not allow them to systematically assess security and privacy threat reactions.…”

Section: Related Workmentioning

confidence: 99%

Blocking Without Breaking: Identification and Mitigation of Non-Essential IoT Traffic

Mandalari

Dubois

Kolcun

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Despite the prevalence of Internet of Things (IoT) devices, there is little information about the purpose and risks of the Internet traffic these devices generate, and consumers have limited options for controlling those risks. A key open question is whether one can mitigate these risks by automatically blocking some of the Internet connections from IoT devices, without rendering the devices inoperable. In this paper, we address this question by developing a rigorous methodology that relies on automated IoT-device experimentation to reveal which network connections (and the information they expose) are essential, and which are not. We further develop strategies to automatically classify network traffic destinations as either required (i.e., their traffic is essential for devices to work properly) or not, hence allowing firewall rules to block traffic sent to non-required destinations without breaking the functionality of the device. We find that indeed 16 among the 31 devices we tested have at least one blockable non-required destination, with the maximum number of blockable destinations for a device being 11. We further analyze the destination of network traffic and find that all third parties observed in our experiments are blockable, while first and support parties are neither uniformly required or non-required. Finally, we demonstrate the limitations of existing blocklists on IoT traffic, propose a set of guidelines for automatically limiting non-essential IoT traffic, and we develop a prototype system that implements these guidelines.

show abstract

Section: Related Workmentioning

confidence: 99%

Blocking Without Breaking: Identification and Mitigation of Non-Essential IoT Traffic

Mandalari

Dubois

Kolcun

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…Gupta and Ghanavati [46] conducted a systematic literature review on IoT privacy practices and technologies, providing a comprehensive summary of several issues related to privacy protection. Zavalyshyn et al [47] focus on privacy-enhancing technologies for the smart gateway, as gateways are at the center of the entire system. In contrast, our research starts from the traffic perspective, concerning user privacy and exploring IoT traffic analysis related to security.…”

Section: A Iot Privacy and Securitymentioning

confidence: 99%

Identifying key sectors based on cascading effect along paths in the embodied CO2 emission flow network in Beijing-Tianjin-Hebei region, China

Jia

Gao

et al. 2020

Environ Sci Pollut Res

View full text Add to dashboard Cite

For the past few years, the Consumer Internet of Things (CIoT) has entered public lives. While CIoT has improved the convenience of people's daily lives, it has also brought new security and privacy concerns. In this survey, we try to figure out what researchers can learn about the security and privacy of CIoT by traffic analysis, a popular method in the security community. From the security and privacy perspective, this survey seeks out the new characteristics in CIoT traffic analysis, the state-of-the-art progress in CIoT traffic analysis, and the challenges yet to be solved. We collected 310 papers from January 2018 to December 2023 related to CIoT traffic analysis from the security and privacy perspective and summarized the process of CIoT traffic analysis in which the new characteristics of CIoT are identified. Then, we detail existing works based on five application goals: device fingerprinting, user activity inference, malicious traffic analysis, security analysis, and measurement. At last, we discuss the new challenges and future research directions.

show abstract