Blocking Without Breaking
Identification and Mitigation of Non-Essential IoT Traffic
Anna Maria Mandalari (Imperial College London), Daniel J. Dubois (Northeastern University), Roman Kolcun (Imperial College London), Muhammad Talha Paracha (Northeastern University), Hamed Haddadi (Imperial College London), David Choffnes (Northeastern University)
Last updated: 05/17/2021
News
- 05/01/2021. This research has been accepted for publication at the 21th Privacy Enhancing Technologies Symposium (PETS2021) with the paper titled “Blocking without Breaking: Identification and Mitigation of Non-Essential IoT Traffic.“
Abstract
Despite the prevalence of Internet of Things (IoT) devices, there is little information about the purpose and risks of the Internet traffic these devices generate, and consumers have limited options for controlling those risks. A key open question is whether one can mitigate these risks by automatically blocking some of the Internet connections from IoT devices, without rendering the devices inoperable.
In this paper, we address this question by developing a rigorous methodology that relies on automated IoT-device experimentation to reveal which network connections (and the information they expose) are essential, and which are not. We further develop strategies to automatically classify network traffic destinations as either required (i.e., their traffic is essential for devices to work properly) or not, hence allowing firewall rules to block traffic sent to non-required destinations without breaking the functionality of the device. We find that indeed 16 among the 31 devices we tested have at least one blockable non-required destination, with the maximum number of blockable destinations for a device being 11. We further analyze the destination of network traffic and find that all third parties observed in our experiments are blockable, while first and support parties are neither uniformly required or non-required. Finally, we demonstrate the limitations of existing blocklists on IoT traffic, propose a set of guidelines for automatically limiting non-essential IoT traffic, and we develop a prototype system that implements these guidelines.
About this publication
Our research will be published in the proceedings of the 21th Privacy Enhancing Technologies Symposium (PETS 2021).
Paper title: Blocking without Breaking: Identification and Mitigation of Non-Essential IoT Traffic
Authors: Anna Maria Mandalari (Imperial College London), Daniel J. Dubois (Northeastern University), Roman Kolcun (Imperial College London), Muhammad Talha Paracha (Northeastern University), Hamed Haddadi (Imperial College London), David Choffnes (Northeastern University)
Full Text (PDF): pre-print available.
Software and data: available on Github.
Presentation: will be added after the symposium.
Citation:
@inproceedings{mandalari-pets21,
title={{Blocking without Breaking: Identification and Mitigation of Non-Essential IoT Traffic}},
author={Mandalari, Anna Maria and Dubois, Daniel J. and Kolcun, Roman and Paracha, Muhammad Talha and Haddadi, Hamed and Choffnes, David},
booktitle={Proc. of the Privacy Enhancing Technologies Symposium (PETS)},
year={2021}
}
Acknowledgments
- This research was partially supported by:
- EPSRC (Databox EP/N028260/1, DADA EP/R03351X/1, and HDI EP/R045178/1)
- NSF (BehavIoT CNS-1909020, ProperData SaTC-1955227)
- Consumer Reports (Digital Lab Fellowship for Daniel J. Dubois)