In this work, we characterize the potential information leakage from IoT platforms during their setup phase. Setup involves an IoT device, its ''app'', and a cloud-based service. We assume that the on-device firmware is inaccessible, e.g., read-protected. We focus on the combination of information that can be extracted from analyzing the app and the local communication between the app and the IoT device. An attacker can trivially obtain the app, analyze its operation, and potentially eavesdrop on the wireless communication occurring during the setup phase. We develop a semi-automated general methodology involving off-the-shelf tools to examine information disclosure during the setup phase. We tested our methodology on twenty commodity-grade IoT devices. The outcome reveals a wide range of device-dependent choices for encryption at various layers and the potential for exposure of, among other things, device-identifying information and local networking (WiFi) credentials. Our methodology contributes towards a means to assess and ''certify'' IoT devices.

The massive growth in popularity of household IoT devices has brought new capabilities to our lives while also bringing new challenges to network providers. In particular, large numbers of devices have been used to cause disruptions to critical Internet services. Understanding which devices are connected to a network empowers administrators to mitigate threats with target-specific interventions. This information is obtained by analyzing traffic through a process known as device fingerprinting. Current device fingerprinting solutions face major scalability issues in high-speed and high-volume networks, either relying on middleboxes to perform their tasks or targeting a single household. This paper introduces a novel in-network fingerprinting system, PoirIoT, capable of real-time, accurate, and scalable IoT device fingerprinting. Specifically, PoirIoT takes advantage of recent programmable switches and use standard packet metadata, length, and direction information to gain high-throughput and per-packet fingerprinting granularity. We show the effectiveness (100% device detection accuracy) of our solution using a publicly available dataset on a testbed consisting of Intel Tofino switches. Moreover, PoirIoT adds no additional latency to the regular traffic flow and utilizes minimal switch resources (e.g., memory).

IoT devices such as wearables, voice assistants and home appliances are becoming an integral part of our lives. However, these devices still represent a security and privacy risk with large-scale coordinated attacks often populating the news. The ability to tell which IoT devices are where in a network (i.e., to fingerprint them) can help administrators to mitigate such attacks at the earliest stages. While fingerprinting solutions exist, they often work offline, depend on sampled data or rely on payload information to work. In this paper, we propose PoirIoT, a high-speed in-network system for fingerprinting IoT devices. PoirIoT is based only on packet metadata (e.g., length and direction) and can detect a device as soon as it exchanges its first packets. We implement a prototype of PoirIoT on a Tofino-based programmable switch and show it can detect all possible IoT devices on a publicly available dataset. Moreover, PoirIoT runs at line rate and incurs minimal resource overhead on the programmable switch ASIC.

Computer vision is a crucial component in many modern applications (e.g., medical image analysis, environmental monitoring and self-driving cars). However, their stringent computational, latency and bandwidth requirements still pose a huge challenge to system architects, which must seek for alternatives to both the limited resources (e.g., low-end CPU) on client devices and the hurdles of moving data from clients to cloud/edge servers for analysis. In this work, we advocate for the usage of emerging programmable network devices to speed up ML-based computer vision tasks, particularly image classification, on resource constrained environments. To take the first step towards this new paradigm, we propose NetPixel, a framework that enables P4-programmable switches to classify images in realtime, accurately and at scale. We implemented a prototype of NetPixel in a software switch to show its feasibility and conducted a preliminary evaluation on widely adopted datasets. Our results show that NetPixel can classify images with an accuracy within 8% that of a server-based implementation even for shallow classifiers and low-resolution images.

This poster presents P4-EncKV, an in-network proxy for accelerating encrypted data stores using recent programmable switches. P4-EncKV can perform operations over encrypted data while reducing query latency and required bandwidth. As proof-of-concept, we implement a prototype of P4-EncKV using BMv2 software switch, and show it can speedup encrypted queries by 20-25% using basic caching operations. Our optimized cache design also reduces memory consumption by 18% compared to the state-of-the-art in-network caching approach, thanks to a novel hash-based indexing scheme.