A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic

By Noah J. Apthorpe, D. Reisman, N. Feamster. arXiv.org, 2017

348 citations recorded by the source corpus.

The increasing popularity of specialized Internet-connected devices and appliances, dubbed the Internet-of-Things (IoT), promises both new conveniences and new privacy concerns. Unlike traditional web browsers, many IoT devices have always-on sensors that constantly monitor fine-grained details of users' physical environments and influence the devices' network communications. Passive network observers, such as Internet service providers, could potentially analyze IoT network traffic to infer sensitive details about users. Here, we examine four IoT smart home devices (a Sense sleep monitor, a Nest Cam Indoor security camera, a WeMo switch, and an Amazon Echo) and find that their network traffic rates can reveal potentially sensitive user interactions even when the traffic is encrypted. These results indicate that a technological solution is needed to protect IoT device owner privacy, and that IoT-specific concerns must be considered in the ongoing policy debate around ISP data collection and usage.

Subfields: Artificial Intelligence, Computer Networks and Communications, Sociology and Political Science

View Paper: https://www.semanticscholar.org/paper/94553fea5859029573854411edcb124238b4b624

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Sociology and Political Science

Citations in the corpus

Peek-a-boo: i see your smart home activities, even encrypted! (2018, background): “Some earlier works [4, 5, 43] have shown that it is relatively easy to make some simple inferences such as device type inference [28], identifying the user occupancy via detecting the mode transition between the device activities [14], or simple device mode inference [5].”
Machine Learning DDoS Detection for Consumer Internet of Things Devices (2018, methodology): “IP Destination Address Cardinality and Novelty: IoT devices are characterized by the limited number of endpoints with which they communicate [7].”
DÏoT: A Federated Self-learning Anomaly Detection System for IoT (2018, background): “Some solutions address device-type identification with the same granularity as we do [19], [68]–[71], while considering different definitions of “type”.”
SoK: Security Evaluation of Home-Based IoT Deployments (2019, background): “3) Stakeholders: The vendor controls the cloud endpoints (see Figure 1) and the users do not have a way to inspect or control what their device sends to the cloud endpoints [66], [75].”
Edge Computing Security: State of the Art and Challenges (2019, methodology): “[53] monitored the encrypted IoT traffics and developed a three-step attack by first separating the traffic into individual device flows using the IP addresses of the edge servers, then correlating each flow with its responsible IoT device according to unique identifiers, and finally inferring user ”
User Perceptions of Smart Home IoT Privacy (2018, background): “Related work on smart home privacy has outlined technical and design challenges [4, 8] and revealed potential attacks to recognize users and behaviors from data collected from smart environments [2, 13, 37, 39, 50].”