Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic
Noah Apthorpe, Dillon Reisman, Srikanth Sundaresan, Arvind Narayanan,, Nick Feamster

TL;DR
This paper shows that privacy-sensitive activities in smart homes can be inferred from encrypted IoT traffic and evaluates mitigation strategies, finding traffic shaping to be effective with minimal bandwidth overhead.
Contribution
It demonstrates the privacy risks of encrypted smart home traffic and evaluates practical mitigation strategies, especially traffic shaping, to protect user privacy.
Findings
Traffic analysis can infer in-home activities despite encryption.
Traffic shaping with 40KB/s bandwidth overhead effectively mitigates privacy risks.
Traffic shaping is practical within typical home Internet limits.
Abstract
The growing market for smart home IoT devices promises new conveniences for consumers while presenting new challenges for preserving privacy within the home. Many smart home devices have always-on sensors that capture users' offline activities in their living spaces and transmit information about these activities on the Internet. In this paper, we demonstrate that an ISP or other network observer can infer privacy sensitive in-home activities by analyzing Internet traffic from smart homes containing commercially-available IoT devices even when the devices use encryption. We evaluate several strategies for mitigating the privacy risks associated with smart home device traffic, including blocking, tunneling, and rate-shaping. Our experiments show that traffic shaping can effectively and practically mitigate many privacy risks associated with smart home IoT devices. We find that 40KB/s…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsInternet Traffic Analysis and Secure E-voting · Advanced Malware Detection Techniques · Network Security and Intrusion Detection
