[go: up one dir, main page]
More Web Proxy on the site http://driver.im/ skip to main content
research-article

IoT Notary: Attestable Sensor Data Capture in IoT Environments

Published: 27 October 2021 Publication History

Abstract

Contemporary IoT environments, such as smart buildings, require end-users to trust data-capturing rules published by the systems. There are several reasons why such a trust is misplaced—IoT systems may violate the rules deliberately or IoT devices may transfer user data to a malicious third-party due to cyberattacks, leading to the loss of individuals’ privacy or service integrity. To address such concerns, we propose IoT Notary, a framework to ensure trust in IoT systems and applications. IoT Notary provides secure log sealing on live sensor data to produce a verifiable “proof-of-integrity,” based on which a verifier can attest that captured sensor data adhere to the published data-capturing rules. IoT Notary is an integral part of TIPPERS, a smart space system that has been deployed at the University of California, Irvine to provide various real-time location-based services on the campus. We present extensive experiments over real-time WiFi connectivity data to evaluate IoT Notary, and the results show that IoT Notary imposes nominal overheads. The secure logs only take 21% more storage, while users can verify their one day’s data in less than 2 s even using a resource-limited device.

References

[2]
[n.d.]. Filecoin: A Decentralized Storage Network by Protocol Labs. Retrieved from https://filecoin.io/filecoin.pdf.
[3]
Paarijaat Aditya et al. 2016. I-Pic: A platform for privacy-compliant image capture. In MobiSys. 235–248.
[4]
Stephen Kwamena Aikins. 2016. Connectivity of smart devices: Addressing the security challenges of the Internet of Things. In Connectivity Frameworks for Smart Devices: The Internet of Things from a Distributed Computing Perspective.
[5]
Moreno Ambrosin et al. 2016. SANA: Secure and scalable aggregate network attestation. In CCS. 731–742.
[6]
N. Asokan et al. 2015. SEDA: Scalable embedded device attestation. In CCS. 964–975.
[7]
Eli Ben-Sasson et al. 2013. SNARKs for C: Verifying program executions succinctly and in zero knowledge. In CRYPTO, Vol. 8043.
[8]
Alastair R. Beresford et al. 2004. Mix zones: User privacy in location-aware services. In PerCom. 127–131.
[9]
Rihab Boussada et al. 2019. Privacy-preserving aware data transmission for IoT-based e-health. Comput. Netw. 162 (2019).
[10]
Elette Boyle et al. 2015. Function secret sharing. In EUROCRYPT. 337–367.
[11]
X. Carpent et al. 2018. Remote attestation of IoT devices via SMARM: Shuffled measurements against roving malware. In HOST. 9–16.
[12]
Supriyo Chakraborty et al. 2014. ipShield: A framework for enforcing context-aware privacy. In NSDI. 143–156.
[13]
Mauro Conti et al. 2019. RADIS: Remote attestation of distributed IoT services. In SDS. 25–32.
[14]
Victor Costan et al. 2016. Intel SGX explained. IACR Cryptology ePrint Archive 2016 (2016), 86.
[15]
Andy Crabtree et al. 2018. Building accountability into the Internet of Things: the IoT Databox model. J. Reliab. Intell. Environ. 4, 1 (2018), 39–55.
[16]
Scott A. Crosby et al. 2009. Efficient data structures for tamper-evident logging. In USENIX. 317–334.
[17]
Nigel Davies et al. 2016. Privacy mediators: Helping IoT cross the chasm. In HotMobile. 39–44.
[18]
Yves-Alexandre De Montjoye et al. 2014. openpds: Protecting the privacy of metadata through safeanswers. PLoS One 9, 7 (2014), e98790.
[19]
Whitfield Diffie et al. 1976. New directions in cryptography. IEEE Trans. Inf. Theory 22, 6 (1976), 644–654.
[20]
Yuefeng Du et al. 2021. Enabling secure and efficient decentralized storage auditing with blockchain. IEEE Trans. Depend. Sec. Comput. (2021).
[21]
Saba Eskandarian et al. 2017. Certificate transparency with privacy. Proc. Priv. Enhanc. Technol 2017, 4 (2017), 329–344.
[22]
Earlence Fernandes et al. 2017. Security implications of permission models in smart-home application frameworks. IEEE Secur. Priv. 15, 2 (2017), 24–30.
[23]
Jonathan Frankle et al. 2018. Practical accountability of secret processes. In USENIX. 657–674.
[24]
Jayavardhana Gubbi et al. 2013. Internet of Things (IoT): A vision, architectural elements, and future directions. Fut. Gen. Compu. Syst.7 (2013), 1645–1660.
[25]
Ahmad Ibrahim et al. 2016. DARPA: Device attestation resilient to physical attacks. In WiSec. 171–182.
[26]
Ahmad Ibrahim et al. 2018. AID: Autonomous attestation of IoT devices. In SRDS. 21–30.
[27]
Wei Jiang et al. 2008. Transforming semi-honest protocols to ensure accountability. Data Knowl. Eng. 65, 1 (2008), 57–74.
[28]
Sye Loong Keoh et al. 2014. Securing the Internet of Things: A standardization perspective. IoT J. 1, 3 (2014), 265–275.
[29]
Hugo Krawczyk. 2003. SIGMA: The ‘SIGn-and-MAc’ approach to authenticated diffie-hellman and its use in the IKE protocols. In CRYPTO. 400–425.
[30]
Somayya Madakam et al. 2016. Security mechanisms for connectivity of smart devices in the Internet of Things. In Connectivity Frameworks for Smart Devices. 23–41.
[31]
Sharad Mehrotra et al. 2016. TIPPERS: A privacy cognizant IoT environment. In PerCom Workshops. 1–6.
[32]
Min Y. Mun et al. 2010. Personal data vaults: A locus of control for personal data streams. In CoNEXT. 17.
[33]
G. Myles et al. 2003. Preserving privacy in environments with location-based applications. IEEE Perv. Comput. 2, 1 (2003), 56–64.
[34]
Neha Narula et al. 2018. zkLedger: Privacy-preserving auditing for distributed ledgers. In NSDI. 65–80.
[35]
Bryan Parno et al. [n.d.]. Pinocchio: Nearly practical verifiable computation. In IEEE SP. 238–252.
[36]
Ashwini Rao et al. 2016. Expecting the unexpected: Understanding mismatched privacy expectations online. In SOUPS. 77–96.
[37]
Yasmeen Rashidi et al. [n.d.]. “You don’t want to be the next meme”: College Students’ workarounds to manage privacy in the era of pervasive photography. In SOUPS. 143–157.
[38]
Franziska Roesner et al. 2014. World-driven access control for continuous sensing. In CCS. 1169–1181.
[39]
Jiayu Shu et al. 2018. Cardea: Context-aware visual privacy protection for photo taking and sharing. In MMSys. 304–315.
[40]
Wenjuan Tang et al. 2019. Secure data aggregation of lightweight E-healthcare IoT devices with fair incentives. IEEE IoT J. 6, 5 (2019), 8714–8726.
[41]
David Vorick et al. 2014. SIA: Simple decentralized storage. Retrieved May (2014), 2018.
[42]
Junjue Wang et al. 2017. A scalable and privacy-aware IoT service for live video analytics. In MMSys. ACM, 38–49.
[43]
J. Wang et al. 2018. Enabling security-enhanced attestation with Intel SGX for remote terminal and IoT. TCDICS 37, 1 (2018), 88–96.
[44]
Wenhao Wang et al. 2017. Leaky cauldron on the dark land: Understanding memory side-channel hazards in SGX. In CCS. 2421–2434.
[45]
Brent R. Waters et al. 2004. Building an encrypted and searchable audit log. In NDSS, Vol. 4. 5–6.
[46]
Zhi Xu et al. 2015. SemaDroid: A privacy-aware sensor management framework for smartphones. In CODASPY. 61–72.
[47]
Yang Yang et al. 2018. Privacy-preserving fusion of IoT and big data for e-health. Fut. Gener. Comput. Syst. 86 (2018), 1437–1455.
[48]
E. Zarepour et al. 2016. A context-based privacy preserving framework for wearable visual lifeloggers. In PerCom Workshops. IEEE Computer Society, 1–4.
[49]
Shams Zawoad et al. 2016. Towards building forensics enabled cloud through secure logging-as-a-service. IEEE Trans. Depend. Sec. Comput. 13 (2016), 148–162.
[50]
Yupeng Zhang et al. 2017. vSQL: Verifying arbitrary SQL queries over dynamic outsourced databases. In IEEE SP. 863–880.

Cited By

View all
  • (2024)BatchIT: Intelligent and Efficient Batching for IoT Workloads at the EdgeNOMS 2024-2024 IEEE Network Operations and Management Symposium10.1109/NOMS59830.2024.10575298(1-7)Online publication date: 6-May-2024
  • (2024)Privacy-preserving human activity sensing: A surveyHigh-Confidence Computing10.1016/j.hcc.2024.1002044:1(100204)Online publication date: Mar-2024
  • (2022)Data stationProceedings of the VLDB Endowment10.14778/3551793.355186115:11(3172-3185)Online publication date: 1-Jul-2022

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Transactions on Internet of Things
ACM Transactions on Internet of Things  Volume 3, Issue 1
February 2022
201 pages
EISSN:2577-6207
DOI:10.1145/3492447
Issue’s Table of Contents

Publisher

Association for Computing Machinery

New York, NY, United States

Journal Family

Publication History

Published: 27 October 2021
Accepted: 01 July 2021
Revised: 01 July 2021
Received: 01 May 2020
Published in TIOT Volume 3, Issue 1

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Internet of Things
  2. smart homes
  3. user privacy
  4. channel and device activity
  5. inference attacks

Qualifiers

  • Research-article
  • Refereed

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)115
  • Downloads (Last 6 weeks)13
Reflects downloads up to 14 Dec 2024

Other Metrics

Citations

Cited By

View all
  • (2024)BatchIT: Intelligent and Efficient Batching for IoT Workloads at the EdgeNOMS 2024-2024 IEEE Network Operations and Management Symposium10.1109/NOMS59830.2024.10575298(1-7)Online publication date: 6-May-2024
  • (2024)Privacy-preserving human activity sensing: A surveyHigh-Confidence Computing10.1016/j.hcc.2024.1002044:1(100204)Online publication date: Mar-2024
  • (2022)Data stationProceedings of the VLDB Endowment10.14778/3551793.355186115:11(3172-3185)Online publication date: 1-Jul-2022

View Options

Login options

Full Access

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Full Text

View this article in Full Text.

Full Text

HTML Format

View this article in HTML Format.

HTML Format

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media