Trust but Verify: Auditing the Secure Internet of Things

摘要: Internet-of-Things devices often collect and transmit sensitive information like camera footage, health monitoring data, or whether someone is home. These protect data in transit with end-to-end encryption, typically using TLS connections between associated cloud services. But these also prevent device owners from observing what their own are saying about them. Unlike traditional Internet applications, where the end user controls one of a connection (e.g., web browser) can observe its communication, vendors control software both cloud. As result, have no way to audit behavior devices, leaving them little choice but hope that transmitting only they should. This paper presents TLS--Rotate Release (TLS-RaR), system allows consumers, security researchers, consumer watchdogs) authorize called auditors, decrypt verify recent traffic without compromising future traffic. prior work, TLS-RaR requires changes TLS's wire format cipher suites, it device's owner conduct surprise inspection traffic, notice communications will be audited.