chownIoT Secure Handling of Smart Home IoT Devices Ownership Change Global Overview Samuel Marchal, Md Sakib Nizam Khan, N. Asokan Aalto University samuel.marchal@aalto.fi

IoT Smart Home Internet connected everyday objects in home Remotely accessible / controllable Sensing + collection of sensitive information Spying Inference of presence / habits User profiling Local / Cloud storage

Ownership change Ownership of Smart Home (SH) device can change during lifetime Lend Resell / stealing Change of tenant (rental places) May introduce unauthorized access to privacy sensitive data Historical / personal data not wiped (threat to previous owner) Authentication credentials for cloud / network access saved (threat to previous owner) Old authentication credentials still valid (threat to new owner) Etc.

Threats and attackers capabilities New Owner Local + remote control / access to device Physical memory + Cloud storage access Threat: Data + authentication credentials extraction (network + cloud) Previous Owner Remote control / access to device (through cloud) Cloud storage access Threat: Newly exported data extraction

chownIoT overview 1 4 2 Previous Owner New Owner 3 Detect Change of Ownership 4 2 Owner Change / Profile Retrieval & Management Protect Previous Owner Previous Owner New Owner Secure Use by New Owner 3

1. Automatic ownership change detection Smart Home (SH) devices: Static: dishwasher, integrated blinds, heating system, etc. Semi-static: DVR, smart plugs, etc. Remain in a same context Idea: Ownership Context How to measure context ? Context: Information about the surrounding environment Sensor modalities BUT different devices different sensors All SH devices have at least connectivity (e.g. WiFi) Wi-Fi access point < SSID, MAC, Auth > Context Owner Owner Change Context Change BUT Context Change Owner Change

1.1 Verification of ownership change SH devices setup and controlled using a control device (e.g. smartphone) Assumption: in vicinity if same owner change the context of SH device Verification: Challenge-response between control device and SH device (Bluetooth) SH device setup overhead Security association with control device (e.g. DH key exchange) trusted device Add new context to owner profile

2. Data Protection - Encryption   CCM = counter with CBC-MAC (cipher block chaining message authentication code) PBKDF2 (Password-Based Key Derivation Function 2) DK = PBKDF2(Pseudo Random Function, Password, Salt, count if iterations, key length)

3. Owner Profile Management Existing profile recovery Owner authentication (e.g. password) Addition of new trusted device (failed challenge) New profile creation Owner authentication setup + trusted device association Owner 1 Owner n … Profile management Control Device

4. Existing profile retrieval User prompt with existing profile names Profile choice + authentication (password) Decryption key derivation (PBKDF2) From authentication / stored for encryption Success = authentication + profile restored Profile retrieval Control Device

chownIoT decision flow summary Detect Ownership Change No Detected? Verify using Trusted Device yes Successful? Configure new Profile yes New Profile No Choice? Encrypt Profile Data Profile Retrieval/Creation Existing Profile Authenticate for Selected Profile Create New Known Context for Current Profile Successful? Decrypt Profile Data yes No

Prototype implementation Smart home device features: Raspberry Pi 3 Language: C++ Trusted Device/New Control Device features: Android application Communication: Bluetooth / Wi-Fi Custom protocol based on UDP

Summary Privacy enhancement protocol for ownership change of SH devices Automatic: ownership change detection based on WiFi AP Secure: owner authentication / device association / data encryption Usable: profile management + limited annoyance Prototype implementation Android management application C++ code for smart home device UDP based communication protocol

Future Work Improvements: Ownership change detection Abnormal power off Ownership change not detected Data remains unencrypted Potential solution: Always encrypt but costly / unrealistic Ownership change detection Reduce false positives Other sensor modalities Profile management Cloud-based management (no storage on device) Password based key derivation Brute force attack More robust key generation

chownIoT Secure Handling of Smart Home IoT Devices Ownership Change Global Overview Samuel Marchal, Md Sakib Nizam Khan, N. Asokan Aalto University samuel.marchal@aalto.fi

chownIoT initial configuration Smart Home Device Control Device setup shared secret Outcome Trusted device authentication Owner authentication Trusted device identification Known context Diffie-Hellman Key Exchange response setup authentication mechanism Password based Authentication + Profile Name response Password Hash store authentication info Bluetooth Device Name, MAC, Shared Secret store trusted device identity AP SSID, MAC & Password store context