Network Traffic Shaping for Enhancing Privacy in IoT Systems

TL;DR

This paper introduces a differential privacy-based traffic shaping mechanism for IoT networks that balances privacy protection with transmission efficiency, adaptable to various traffic conditions and device scales.

Contribution

It proposes a novel, memoryless DP traffic shaper with a convex optimization framework for optimal privacy-efficiency tradeoffs in IoT traffic.

Findings

Shaping overhead improves privacy protection.

Tradeoff exists between dummy traffic and delay.

Larger IoT networks facilitate privacy guarantees.

Abstract

Motivated by privacy issues caused by inference attacks on user activities in the packet sizes and timing information of Internet of Things (IoT) network traffic, we establish a rigorous event-level differential privacy (DP) model on infinite packet streams. We propose a memoryless traffic shaping mechanism satisfying a first-come-first-served queuing discipline that outputs traffic dependent on the input using a DP mechanism. We show that in special cases the proposed mechanism recovers existing shapers which standardize the output independently from the input. To find the optimal shapers for given levels of privacy and transmission efficiency, we formulate the constrained problem of minimizing the expected delay per packet and propose using the expected queue size across time as a proxy. We further show that the constrained minimization is a convex program. We demonstrate the effect of shapers on both synthetic data and packet traces from actual IoT devices. The experimental results reveal inherent privacy-overhead tradeoffs: more shaping overhead provides better privacy protection. Under the same privacy level, there naturally exists a tradeoff between dummy traffic and delay. When dealing with heavier or less bursty input traffic, all shapers become more overhead-efficient. We also show that increased traffic from a larger number of IoT devices makes guaranteeing event-level privacy easier. The DP shaper offers tunable privacy that is invariant with the change in the input traffic distribution and has an advantage in handling burstiness over traffic-independent shapers. This approach well accommodates heterogeneous network conditions and enables users to adapt to their privacy/overhead demands.