IoTell: A Privacy-Preserving Protocol for Large-scale Monitoring of IoT Security Status
Yongwoo Oh, Michael Yiqing Hu, Xin Zhe Khooi, Jehyun Lee, Dinil Mon Divakaran, Min Suk Kang · 2024
As Internet of Things (IoT) devices become more attractive attack targets, cyber threat intelligence would require accurate information about these smart gadgets within a city or a region of interest. Yet, collecting the security status (e.g., whether the latest security patches have been installed) of the deployed IoT devices at a large scale remains challenging, due to the lack of technical capability. In this work, we propose and develop a technical solution to this problem—we propose IoTell for enabling local regulators to monitor the security status of deployed IoT devices. With IoTell in place, a security regulator receives accurate, periodically-updated (e.g., every day) counts of all IoT firmware versions operating in a region (e.g., a city). A naïve approach to IoTell would easily violate user privacy and become vulnerable to data manipulation. In this work, we present an end-to-end privacy-preserving protocol architecture for IoTell that addresses the potential privacy and security risks. IoTell requires only widely available market-ready technical capabilities and minimal addition to IoT devices and network operators.