IoTRemedy: Non-Intrusive Rule Decomposition for User Privacy in Modern IoT Platforms

With the pervasiveness and popularity of Internet of Thing (IoT) devices in smart homes, end users gain a lot of valuable services at the expense of data leakage risks, which eventually leads to disclosure of user privacy. Specifically, device data are usually reported to an IoT platform's backend cloud for it to run services such as home automation. Various vulnerabilities of the cloud and insider attacks can put the data collected by clouds in jeopardy. To mitigate data leakage in home automation, we propose a new data flow control framework IoTRemedy, which reduces data leakage by transparently performing most automation rule operations within the home network and only reports necessary data to the cloud for executing operations which cannot be localized. To this end, we design a rule decomposition algorithm for splitting each real rule that was executed by clouds into a localized rule (LRule) and a cloud rule (CRule), based on eight specific situations; thus, the resultant rules accomplish the same functions while retaining at local as much data as possible. We evaluate the performance of IoTRemedy by interfacing with two popular platforms: SmartThings and IFTTT. The result validates the effectiveness of IoTRemedy.