DB-PAISA: Discovery-Based Privacy-Agile IoT Sensing+Actuation

TL;DR

DB-PAISA introduces a pull-based discovery mechanism for IoT devices, enhancing privacy and reducing unnecessary network traffic by revealing device presence only upon user request, with a secure response guarantee.

Contribution

This work presents a novel pull-based IoT device discovery system that ensures secure, timely responses without hardware modifications, demonstrated through a practical prototype.

Findings

Prototype implementation on commodity hardware shows feasibility.

Energy consumption is optimized with the pull-based approach.

System effectively balances privacy, security, and device discoverability.

Abstract

Internet of Things (IoT) devices are becoming increasingly commonplace in numerous public and semi-private settings. Currently, most such devices lack mechanisms to facilitate their discovery by casual (nearby) users who are not owners or operators. However, these users are potentially being sensed, and/or actuated upon, by these devices, without their knowledge or consent. This naturally triggers privacy, security, and safety issues. To address this problem, some recent work explored device transparency in the IoT ecosystem. The intuitive approach is for each device to periodically and securely broadcast (announce) its presence and capabilities to all nearby users. While effective, when no new users are present, this push-based approach generates a substantial amount of unnecessary network traffic and needlessly interferes with normal device operation. In this work, we construct DB-PAISA which addresses these issues via a pull-based method, whereby devices reveal their presence and capabilities only upon explicit user request. Each device guarantees a secure timely response (even if fully compromised by malware) based on a small active Root-of-Trust (RoT). DB-PAISA requires no hardware modifications and is suitable for a range of current IoT devices. To demonstrate its feasibility and practicality, we built a fully functional and publicly available prototype. It is implemented atop a commodity MCU (NXP LCP55S69) and operates in tandem with a smartphone-based app. Using this prototype, we evaluate energy consumption and other performance factors.