Retrofitting Security and Privacy Measures to Smart Home Devices

There is a current trend for Internet of Things (IoT) technology in the home. However, device vendors provide no guarantees of security or privacy of their gadgets, nor can such things be measured by consumers. By now, there have been many incidents of vulnerable devices being sold and real-world attacks. Despite proposals for improving the quality of consumer devices, vulnerable devices are likely to remain in use, with it being highly difficult to replace or patch their hardware or software. In this paper, we set out to design a mitigation framework so that home networks can be made resilient to vulnerable devices. First, we select a representative collection of home IoT devices with different functions, and investigate their security and privacy, discovering a range of exploitable flaws. Then we design a framework based on a dedicated router, firewall, an IoT control platform and other mechanisms, which allows mitigation of current and potential future vulnerabilities. The framework is designed to be adaptable and extensible for all kinds of devices. We implement this framework and evaluate it against the sample devices, finding that it can indeed prevent most of the known exploits and the new exploits we found. Based on this study, we make some design suggestions for the future enhanced home cyber-security platforms.