Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Supervising Smart Home Device Interactions: A Profile-Based Firewall Approach

François De Keersmaeker, Ramin Sadre, Cristel Pelsser

TL;DR

The paper addresses security gaps in Smart Home IoT by showing that the existing MUD framework cannot capture inter-device traffic patterns. It introduces an expressive device-profile language and a lightweight firewall built on NFTables/NFQueue, coupled with an automated translator to generate firewall rules and per-device NFQueue code. Through real-device experiments and fuzzing, the authors demonstrate accurate blocking of non-conforming traffic with negligible latency and low resource usage on consumer hardware. This approach enables practical, scalable protection for Smart Homes by enforcing realistic interaction patterns without sacrificing performance, and points to future work in automated profile generation and cross-device collaboration.

Abstract

Internet of Things devices can now be found everywhere, including in our households in the form of Smart Home networks. Despite their ubiquity, their security is unsatisfactory, as demonstrated by recent attacks. The IETF's MUD standard has as goal to simplify and automate the secure deployment of end devices in networks. A MUD file contains a device specific description of allowed network activities (e.g., allowed IP ports or host addresses) and can be used to configure for example a firewall. A major weakness of MUD is that it is not expressive enough to describe traffic patterns representing device interactions, which often occur in modern Smart Home platforms. In this article, we present a new language for describing such traffic patterns. The language allows writing device profiles that are more expressive than MUD files and take into account the interdependencies of traffic connections. We show how these profiles can be translated to efficient code for a lightweight firewall leveraging NFTables to block non-conforming traffic. We evaluate our approach on traffic generated by various Smart Home devices, and show that our system can accurately block unwanted traffic while inducing negligible latency.

Supervising Smart Home Device Interactions: A Profile-Based Firewall Approach

TL;DR

The paper addresses security gaps in Smart Home IoT by showing that the existing MUD framework cannot capture inter-device traffic patterns. It introduces an expressive device-profile language and a lightweight firewall built on NFTables/NFQueue, coupled with an automated translator to generate firewall rules and per-device NFQueue code. Through real-device experiments and fuzzing, the authors demonstrate accurate blocking of non-conforming traffic with negligible latency and low resource usage on consumer hardware. This approach enables practical, scalable protection for Smart Homes by enforcing realistic interaction patterns without sacrificing performance, and points to future work in automated profile generation and cross-device collaboration.

Abstract

Internet of Things devices can now be found everywhere, including in our households in the form of Smart Home networks. Despite their ubiquity, their security is unsatisfactory, as demonstrated by recent attacks. The IETF's MUD standard has as goal to simplify and automate the secure deployment of end devices in networks. A MUD file contains a device specific description of allowed network activities (e.g., allowed IP ports or host addresses) and can be used to configure for example a firewall. A major weakness of MUD is that it is not expressive enough to describe traffic patterns representing device interactions, which often occur in modern Smart Home platforms. In this article, we present a new language for describing such traffic patterns. The language allows writing device profiles that are more expressive than MUD files and take into account the interdependencies of traffic connections. We show how these profiles can be translated to efficient code for a lightweight firewall leveraging NFTables to block non-conforming traffic. We evaluate our approach on traffic generated by various Smart Home devices, and show that our system can accurately block unwanted traffic while inducing negligible latency.
Paper Structure (35 sections, 12 figures, 1 table)

This paper contains 35 sections, 12 figures, 1 table.

Table of Contents

  1. Introduction
  2. Motivating example
  3. Device interactions
  4. Example of Attacks & MUD Shortcomings
  5. Threat model
  6. Overview and design principles
  7. System overview
  8. System Description
  9. Devices profiles
  10. Device metadata
  11. Interactions
  12. The Firewall
  13. A quick introduction to NFTables
  14. User-space packet queuing with NFQueue
  15. State machine for interactions
  16. ...and 20 more sections

Figures (12)

  • Figure 1: Motivating attack example. CPE: Customer Premises Equipment. AP: Access point.
  • Figure 2: System components
  • Figure 3: Minimal device profile example. User defined labels are highlighted in green. Builtin keywords are shown in black.
  • Figure 4: General NFTables/NFQueue firewall operation
  • Figure 5: Finite State Machine representing an interaction consisting of a one-off policy $A$, a periodic policy $B$ and a transient policy $C$. "fwd" and "bwd" specify the direction of the packet. "below" indicates a packet within the limits of a transient policy. "*" stands for all non-matching traffic.
  • ...and 7 more figures