arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 1812.08970cs.CR
收藏

关于IoT的区块链活动隐私

On the Activity Privacy of Blockchain for IoT

Ali Dorri, Clemence Roulin, Raja Jurdak, Salil Kanhere

摘要:

由于物联网设备的异构性和资源限制,安全性是物联网(IoT)的基本挑战之一。设备分类方法通过检测未注册的设备或流量模式来增强物联网的安全性。近年来,区块链作为一种分布式的无信任平台,以增强物联网的安全性,受到了极大的关注。传统的设备识别方法不能直接应用于基于区块链的物联网,因为网络层数据包没有存储在区块链中。此外,交易是广播的,因此没有目的地IP地址,包含公钥作为用户身份,并永久存储在区块链中,可以由网络中的任何实体读取。我们表明,区块链中的设备识别会带来隐私风险,因为恶意节点可以通过分析区块链中交易的时间模式来识别用户的活动模式。我们通过分析存储在区块链中的信息来研究对物联网设备进行分类的可能性,据我们所知,这是同类工作中的第一项。我们使用灵巧家庭作为代表性的物联网场景。首先,根据真实世界的灵巧家庭流量数据集填充区块链。然后,我们对存储在区块链中的数据应用机器学习算法来分析设备分类的成功率,对知情和盲目的攻击者进行建模。我们的结果表明,在分类设备的成功率超过90%。我们提出了三种时间戳混淆方法,即将多个数据包合并到单个事务中,合并多个设备的账本,以及随机延迟事务,以降低设备分类的成功率。所提出的时间戳混淆方法可以将分类成功率降低到20%。

英文摘要:

Security is one of the fundamental challenges in the Internet of Things (IoT) due to the heterogeneity and resource constraints of the IoT devices. Device classification methods are employed to enhance the security of IoT by detecting unregistered devices or traffic patterns. In recent years, blockchain has received tremendous attention as a distributed trustless platform to enhance the security of IoT. Conventional device identification methods are not directly applicable in blockchain-based IoT as network layer packets are not stored in the blockchain. Moreover, the transactions are broadcast and thus have no destination IP address and contain a public key as the user identity, and are stored permanently in blockchain which can be read by any entity in the network. We show that device identification in blockchain introduces privacy risks as the malicious nodes can identify users' activity pattern by analyzing the temporal pattern of their transactions in the blockchain. We study the likelihood of classifying IoT devices by analyzing their information stored in the blockchain, which to the best of our knowledge, is the first work of its kind. We use a smart home as a representative IoT scenario. First, a blockchain is populated according to a real-world smart home traffic dataset. We then apply machine learning algorithms on the data stored in the blockchain to analyze the success rate of device classification, modeling both an informed and a blind attacker. Our results demonstrate success rates over 90\% in classifying devices. We propose three timestamp obfuscation methods, namely combining multiple packets into a single transaction, merging ledgers of multiple devices, and randomly delaying transactions, to reduce the success rate in classifying devices. The proposed timestamp obfuscation methods can reduce the classification success rates to as low as 20%.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑