Research of confidential information processed by smart devices

[root]

Research of confidential information processed by smart devices​

Abstract: Technological progress, growing at an incredible pace, seeks to make human life easier in many of its areas, while generating new threats to security and privacy. Internet of Things (IoT) devices, designed to help people make decisions and take actions based on the information they process. The article examines and analyzes the data collected by modern household IoT devices about their owners, as well as the nature of this data.

Key words: information, smart devices. Keywords: information, smart devices.

Introduction

For the safe operation of smart home devices, it is necessary to pay attention to the aspects of confidentiality of information about the owners and about the places of use of information processed by such devices. The need to investigate this issue is driven by the growing proliferation of smart devices. According to research company GfK, sales of smart devices in European countries in 2018 amounted to 2.5 billion euros. In the same year, in Russia, about 100 thousand smart devices were sold monthly [1].

Currently, smart large household appliances (washing machines and refrigerators) are still disproportionately expensive compared to small household appliances (kettles, scales, etc.), which are in the same price range as similar simple appliances, accelerating their distribution to consumers. ...

Generalized network topology of smart home devices

The generalized topology of a network of smart home appliances is shown in Figure 1. As can be seen from Figure 1, wireless data transmission channels [2] are most often used for direct control of large smart home appliances:

Wi-fi;
Bluetooth;
Infrared data transmission channels.
Devices transmitting control signals can be:

User's mobile device (smartphone) - used to control directly in the local network of smart devices, in the near radius, in the event that it is required to send a command manually, study statistical data, change device settings.
Smart device gateway - if settings and automation schemes for devices are stored on the local network.
Cloud server - in the event that control, changing settings, obtaining statistics is carried out remotely via the Internet.
Undoubtedly, in order to study data confidentiality threats, it is necessary to take into account the complexity of intercepting the transmission of confidential data. In this case, data privacy threats can be considered at the following levels:

At the cloud storage level;
At the level of operating systems of a user mobile device, gateway of smart devices, home router;
At the security level of wireless data transmission channels used locally.


Figure 1. Generalized network topology of smart home appliances.

Confidential Information Threat Models

The models of confidentiality threats to which users can be exposed can be subdivided, based on the classification of their topology and location, into the following types [3]:

Local threats - characterized by the need for an attacker to be present or physically approach the premises to gain access to data from smart devices transmitted via standard wireless data transfer protocols (Wi-fi, Bluetooth).
Global threats are threats related to the transfer of user information over the Internet to the cloud servers of the smart device manufacturer, as well as its storage and processing, for example, for making a decision by the device.
Threats related to vulnerabilities in the software or operating systems of the user's mobile device, router, gateway of smart devices.
The severity of the threat to the user's privacy is directly proportional to the number of devices capable of transmitting information: the more smart devices that have privacy problems of the transmitted data are in the room, the more chances there are for identifying the user, his material status and other personal data, ranging from sleep and the presence of the house, ending with the materials of his clothing.

 

[root]

Analysis of confidential information​

Next, we will consider the ten most common smart home devices and provide information about the processed and transmitted confidential information, as well as how such information can be used to identify a person.

Lighting devices: light bulbs, table lamps, LED strips.

Transmitted information

Smart lighting devices can process and transmit the following information: their operating mode (on or off), the color or brightness of the lighting, the unique identifier of the device (model, serial number), the schedule of their work and automation schemes - the sequence of reactions to certain events, for example, triggering motion sensor.

Communication channels

Power on, mode change, presets can be processed both locally and remotely. Data from such devices can circulate throughout the entire network topology of smart devices (Figure 1), which makes them vulnerable to all the threats described in clause 3.

Using information to identify a user

The data on the operation of light sources can be used to calculate the time of a person's presence in an apartment or in a certain room, as well as the time zone in which this device operates. Often, applications for setting up smart home systems use the allocation and binding of devices to a specific room in which they are used.

Robot vacuum cleaners

Transmitted information

Robot vacuum cleaners are able to collect and transmit the following information: a plan of the owner's apartment, taking into account the objects contained in it, sound information, GPS location of the owner of the phone. In 2020, engineers from Singapore presented a method to use the laser beam from the navigation sensor of a robot vacuum cleaner to detect sounds in a room. [4] Such a threat is real, since the robot vacuum cleaner is a complex technical device with a Linux-based operating system and support for network connections.

Communication channels

Wi-Fi networks can be used to transfer information from the robot vacuum cleaner, then the information is sent using a router or user mobile device via the Internet to the server of the equipment supplier.

Using information to identify a user

The robot vacuum cleaner can be triggered by a timer, as well as by a signal from the gateway of smart devices, which has access to the owner's GPS location - such information can indicate the presence or absence of the owner of the house.

Robot vacuum cleaners have lidars that help them navigate in space and not bump into interior items. The laser beam is able to read vibrations, keeping the entire vibration amplitude of the vibrating object. Thus, the vibrations of the membranes of the speakers in the room can appear in the memory of a robotic vacuum cleaner, and since many membranes are sensitive enough to vibrate even from the sound of the voice of a person speaking nearby, conversations can also end up in the memory of vacuum cleaners.

To build a map, the robot uses an algorithm that processes an image from a built-in camera. The result of recognizing the boundaries of objects is compared with the data of distance sensors. With the help of the built map, the vacuum cleaner orientates itself in space, goes for recharging and returns to the place from which it is necessary to continue cleaning. Using the camera of the robot vacuum cleaner, you can find out not only the layout of the premises, but also what is in them.

Smart refrigerator

Transmitted information

Modern refrigerators can store information about the products that their owner prefers to buy, photos of the products and the owners themselves, bank card data.

Communication channels

Wi-Fi networks can be used to transfer information, then the information is sent using a router via the Internet to the server of the supplier of equipment and food.

Using information to identify a user

Food data may indicate a person's material condition, his / her diseases associated with the consumption of certain, for example, exclusively dietary products, which may indicate a specific disease, such as gastritis or sugar-free foods, which may indicate diabetes in the owner or a member of it families.

To track the quantity and types of products, modern models of refrigerators use video cameras, which, when the device's control system is compromised or modified, can capture frames with images of its users. From this information, both the material condition of the owner and information about the number of family members, their age, etc. can follow.

Teapot

Transmitted information

Smart kettles use the following information for their work, along with the on and off commands: water temperature, period of maintaining the set temperature.

Communication channels

Usually, I limit the possibilities of controlling the kettle

 

[root]

Smart TVs, digital TV receivers​

Transmitted information

Researchers at Northeastern University and Imperial College London determined that a number of TVs, including those made by Samsung and LG, as well as Roku and Amazon FireTV services, were sending user data, such as the location and IP address of Netflix and third-party advertisers. The data was sent regardless of whether the user had a Netflix account. [five]

Smart TV devices can also use gesture and speech recognition technologies, which means they can potentially have access to confidential audio and video information. Additionally, such devices may have access to their owners' social media accounts and their payment information.

Communication channels

Wi-Fi networks can be used to transfer information from the TV, then the information is sent using a router via the Internet to the server of the equipment supplier.

Using information to identify a user

The video and audio information recorded by such devices can be used by cybercriminals to blackmail users or spy upon gaining access to control of a smart TV. Also, smart TV is often used behind the scenes to personalize advertising offers, accumulating behavioral information about the user and his preferences.

Washing machines

Transmitted information

From a smart washing machine, you can get information such as: device status (on or off) and audio information. There are washing machines that can voice the desired washing parameters, which makes it possible to record and store the owner's voice.

Communication channels

Wi-Fi networks can be used to transfer information from a smart washing machine, then the information is sent using a router or user mobile device via the Internet to the manufacturer's server.

Using information to identify a user

The software supplied with smart washing machines can set or read wash modes. Using this information, you can specify the most commonly used materials, preferred by its owner. Also, the activity of the washing machine may indicate the presence of the owner in the immediate vicinity of it.

Electricity meters

Transmitted information

Often, the information processed and transmitted by smart electricity meters is: network voltage, network frequency, device status (turned off or on), the current value of electricity consumption and other statistics on electricity consumption. [6]

Communication channels

Local wireless networks can be used to transfer information from smart electricity meters, and then the information transmitted by them is sent using a router or user mobile device via the Internet to the server of the equipment supplier and / or to the server of the power supply company.

Using information to identify a user

Information on energy consumption from general households (in the case of use in a private house) or from apartment meters can talk about the periods of the owner's activity, his absence or presence at home, periods of activity, time zone, makes it possible to add up the idea of the number and use of electrical appliances.

Smart sockets

Transmitted information

The information processed and transmitted by the sockets is the mains voltage, mains frequency, socket status (turned off or on), the current value of electricity consumption.

Communication channels

To transfer information from the sockets to the device gateway, local Wi-Fi networks are used, then the information is sent using a router to the server of the equipment supplier for collecting and storing statistical data. [7]

Using information to identify a user

Information on power consumption from sockets can show the type of connected device (large or small household appliances) and the time of its use, information from a group of outlets can show the number of connected electrical appliances, which indirectly allows us to assess the financial situation of their owner, his periods of activity, time zone.

Smart iron

Transmitted information

Irons support remote control, for example, turning on the lock when the user is not at home, determining the location of the iron in the house, as well as smart irons using a camera and artificial intelligence can independently determine the types of fabrics for subsequent setting the desired temperature. [eight]

Communication channels

The stored information can be transmitted over a Wi-Fi network, then the information is sent using a router or a user's mobile device over the Internet.

Using information to identify a user

If intruders break into an iron with a Wi-Fi module, then there is a possibility of arson, by remote setting a maximum

 

[root]

Climate control devices: air conditioner, water purifier, air purifier​

Transmitted information

Smart climate controllers have a timetable for their automatic on and off, preset data and user preferred climatic conditions. Such devices can also transmit data on temperature, humidity and atmospheric pressure both indoors and out, on the quality and contamination of water with certain substances, on the composition and pollution of the air.

Communication channels

Smart climate controllers often have the ability to synchronize with the manufacturer's servers and the user's mobile device over Wi-Fi wireless networks. Additionally, in some cases, such devices support setting their operating modes by sending an infrared signal from the control panel.

Using information to identify a user

Supporting the management, synchronization and maintenance of climate change statistics through the network, the Internet smart air conditioner can become a source of data on the user's climate zone. Based on the database processed by the water purifier, the user's location can be calculated based on the specific properties of the water for a particular area, just as with the database of a smart air purifier, one can assume whether the user lives in a city or in the countryside. In addition to all of the above, as with previous devices, in smart climate control devices it is possible to determine user behavioral patterns based on the schedules set by him and the time when devices are turned on and off. [nine]

Conclusion

Obtaining the above information can be interpreted as an invasion of privacy. Thus, smart devices pose a threat by collecting data passively, without the knowledge of users, and processing it in the background. Such situations can create conditions for the emergence of security threats called "profiling", which is a serious problem for users of smart devices. Profiling can result in erroneous automated decisions, unwanted advertisements, and even life-threatening situations. These issues reinforce the idea that data protection in any smart device system is one of the most important elements to consider in the earliest stages of smart system development.

Although research is currently underway to ensure the security of location data - most of them are focused on smartphones, while the main data flow passes through smart devices - their sensors and cameras. [10]

Methods for protecting confidential and personal information should be developed and implemented as early as possible to ensure the safety and privacy of users. Unfortunately, sometimes this is not feasible due to the speed of development of smart devices. However, in any case, the responsibility for security cannot be assigned solely to the users. Considering that the collection and analysis of user data for decision-making is taken as the basis for the operation of smart devices, protection methods should ensure a balance between innovation and user safety. Otherwise, progress may be hindered, which will be disadvantageous to society, or the lives of consumers may be at risk.

Literature

Press release "AI with meaning": AI with meaning Date accessed: 11/01/2021
Kolybelnikov Alexander Ivanovich Review of wireless network technologies // Proceedings of MIPT. 2012. No. 2-14. URL: I'm a banana. (date of access: 01/11/2021).
Novokhrestov Aleksey Konstantinovich, Konev Anton Aleksandrovich, Shelupanov Aleksandr Aleksandrovich, Egoshin Nikolay Sergeevich Model of threats to the security of information and its carriers // Bulletin of ISTU. 2017. No. 12 (131). URL: I'm a banana. (date of access: 01/11/2021).
Sriram Sami, Yimin Dai, Sean Rui Xiang Tan, Nirupam Roy, and Jun Han. 2020. Spying with your robot vacuum cleaner: eavesdropping via lidar sensors. Proceedings of the 18th Conference on Embedded Networked Sensor Systems. Association for Computing Machinery, New York, NY, USA, 354-367. DOI: https: //doi.org/10.1145/3384419.3430781 (date accessed: 15.01.2021)
Ren, Jingjing and Dubois, Daniel J. and Choffnes, David and Mandalari, Anna Maria and Kolcun, Roman and Haddadi, Hamed. 2019. Information Exposure for Consumer IoT Devices: A Multidimensional, Network-Informed Measurement Approach. Proc. of the Internet Measurement Conference (IMC). URL: IoT Information Exposure (IMC'19) - Mon (IoT) r Research Group (date accessed: 01/17/2021)
A. V. Voloshko, Yu. S. Vishnyavskaya Modernization of electricity consumption metering systems in order to reduce the commercial losses of electricity // Energosberezhenie. Energy. Energy audit. 2010. No. 11 (81). URL: I'm a banana. (date of access: 20.01.2021).
Lodneva Olga Nikolaevna, Romasevich Egor Pavlovich Traffic analysis of devices of the Internet of Things // Modern information technologies and IT education. 2018. No. 1.

 

[Матушкин Андрей Николаевич]

Analysis of confidential information

Next, we will consider the ten most common smart home devices and provide information about the processed and transmitted confidential information, as well as how such information can be used to identify a person.

Thanks for the interesting selection of articles!

 

[Детективное агентство Израиль.]

What can we do against smart devices?

 

[Детективное агентство. Грузия.]

Smart devices are dangerous in the wrong hands

 

[Частный детектив. Армения. Ереван.]

Thanks for the informative article colleague.

 

[Детективное агентство Одесса]

And technology does not stand still

 

[частный детектив. Узбекистан. Ташкент.]

Colleague for more such articles!