IoT Mask: Analyzing and Obfuscating Traffic Rates for Internet of Things Devices

Abstract

Because of rapid growth in the number of Internet-connected devices, alongside recent advances in the field of data mining, the Internet of Things (IoT) presents an interesting problem for researchers concerned with user privacy. The simplicity of these devices combined with the narrow use cases of individual IoT devices causes their traffic patterns to reveal sensitive information about user activities and behaviors to passive network observers, such as an Internet service provider (ISP). This is true even for encrypted traffic and even if only the data rate is observed over time. This is particularly problematic in the absence of regulation and in the presence of the increasingly profitable field of user data mining for advertising or other purposes. This thesis aims to address this issue by tackling the problem first for two specific devices: the Belkin WeMo Switch and the Nest Cam Indoor Security Camera. This takes the form of a traffic shaping scheme where packets are only added to the network, rather than being intentionally delayed or dropped. This scheme would run partially on the device and partially on the server communicating with the device. This technique is then generalized so that it can be applied to other IoT devices as well.