Related website: [SPLICE-project.org]
Related keywords: [authentication], [education], [iot], [mhealth], [privacy], [security], [sensors], [wearable], [wifi]
This era of "Smart Things," in which everyday objects become imbued with computational capabilities and the ability to communicate with each other and with services across the Internet, creates novel security and privacy risks. SPLICE research addresses these risks by examining the human, social, and technological scope of the security and privacy challenges emerging in Smart Homes across a wide range of residential stakeholders, including owners, occupants, renters, visitors, and domestic workers.
What follows is a summary of SPLICE research by David Kotz and his students and postdocs. For more information about the SPLICE project, and a broader description of its contributions and publications (not just those including David Kotz and his students), see the SPLICE website.
Home adoption of smart devices faces many challenges of scale and device heterogeneity: a home may soon include dozens or hundreds of devices, across many device types, and may include multiple residents and other stakeholders. We published a framework for reasoning about these challenges based on the deployment, operation, and decommissioning life cycle stages of smart devices within a smart home. We highlighted open research questions at each stage, and evaluated solutions from Apple and Google using our framework ... finding notable shortcomings in these products. Finally, we sketched some preliminary thoughts on a solution for the smart home of the near future. [mangar:framework]
Smart home devices provide convenient ways for users to stay up to date on what is happening in their homes. Users may either share all data with others, or no data, which can easily lead to oversharing in a multi-user environment. In a user study (n=1,992) we studied how people perceive data sharing with others in smart homes and inform future designs and research. Our results show that relationships matter the most, and data types matter more than device types. We also found that the types of access control that are desired by users can vary from scenario to scenario. Our paper provides strong evidence that a more dynamic access control system is needed and we can design it in a more usable way. [he:ci-survey]
The procedures for "onboarding" new smart-home devices - setting up a newly acquired smart device into operational mode - are complex and varied. We studied the complexity of device onboarding from users' perspectives, and found that onboarding smart home devices can often be tedious and confusing. Based on our observations, we give recommendations about how to support a more user-friendly onboarding process. [wang:onboarding]
The vision of a fully integrated smart home is becoming more achievable through standards such as the Matter protocol. We explored this new protocol by building a testbed and by comparing the major commercial platforms in their compatibility with the protocol.
We built a testbed and introduce a network utility device, designed to sniff network traffic and provide a wireless access point within IoT networks. We used the testbed to explore experience of students using the testbed in an academic scenario. [mangar:testbed]
We conducted (from May to August 2024) a comparative analysis to explore how Google Home Nest, Apple Homepod Mini, Samsung SmartThings station, and Amazon Echo Dot platforms leverage the power of Matter to provide seamless and integrated smart-home experiences. [zegeye:icnet25]
We envision a solution called the SPLICEcube whose goal is to detect smart devices, locate them in three dimensions within the home, securely monitor their network traffic, and keep an inventory of devices and important device information throughout the device's lifecycle. The SPLICEcube system consists of the following components: 1) a main cube, which is a centralized hub that incorporates and expands on the functionality of the home router, 2) a database that holds network data, and 3) a set of support cubelets that can be used to extend the range of the network and assist in gathering network data. [malik:thesis]
The first step in helping users gain control of their smart home is to alert them to the presence of potentially unwanted electronics. We developed a system that could help homeowners (or home dwellers) find electronic devices in their living space. Specifically, we demonstrate the use of harmonic radars (sometimes called nonlinear junction detectors). In [perez:presence] and [mazzaro:preliminary] we show that harmonic radar can detect the presence of electronics (at range up to 1 meter), and in [perez:identification] we further show that harmonic radar can identify various types of electronics, that is, to distinguish among known categories of electronic devices. In subsequent work we explore the range of harmonic radar's ability to detect the presence of electronics [perez:range] and even the ability to detect the presence of batteries [arguello:battery].
Of course, there are more-direct means of discovering networked devices using network-discovery protocols and tools. In [khanafer:discovery] we map out the kinds of capabilities needed for an effective "device discovery system" and summarize the capabilities of existing protocols and tools.
For at least the next decade, or so, we anticipate consumers will need assistance with installing, finding, and relocating smart-home devices. We envision a new professional, a "building inspector for IoT" with specialized tools and knowledge to help securely facilitate transfer of the home. [pierson:inspector].
A key challenge in securing a smart home is to detect whether a device belongs to one's own ecosystem, or to a neighbor -- or represents an unexpected adversary. An important part of determining whether a device is friend or adversary is to detect whether a device's location is within the physical boundaries of one's space (e.g. office, classroom, home). We proposed a system that, in a preliminary evaluation, was able to decide with 82% accuracy whether the location of an IoT device is inside or outside of a defined space based on a small number of transmitted Wi-Fi frames. Paul Gralla's undergraduate thesis explored this idea [gralla:inside-outside]; later, Chixiang Wang refined the ideas, conducted thorough experiments, and wrote up a full paper: [wang:insideout].
We present The Onion Router for Smart Homes (TorSH), a network of smart-home routers working collaboratively to defend smart-device traffic from analysis by ISP-like adversaries. We demonstrate that TorSH succeeds in deterring such profiling while preserving smart-device experiences and without encumbering latency-sensitive, non-smart-device experiences like web browsing. See Adam Vandenbussche's undergraduate thesis for details [vandenbussche:thesis].
VIA presents a method for detecting anomalous behavior in Bluetooth traffic, as observed by the central host -- with the goal of detecting malicious behavior by peripheral devices, or perhaps imposter peripherals that are spoofing legitimate peripherals; see the WiSec'21 paper [peters:via].
We developed an outreach program aimed at the general public and hosted by a local science museum. Our workshop curriculum centered on the smart-home device lifecycle: obtaining, installing, using, and removing devices in a home. For each phase of the lifecycle, we presented possible vulnerabilities along with preventative measures relevant to a general audience. We integrated a hands-on activity for participants to put best-practices into action throughout the presentation. For more information see the SIGCSE'23 paper [jois:sigcse].
The following people were involved in SPLICE research at Dartmouth, or were co-authors on one or more of the papers cited here: Nurzaman Ahmed, Abdulrahman AlRabah, César Arguello Martinez, Liam Cassidy, Jared Chandler, Nikoleta Chantzi, Ben Civjan, Paul Gralla, Carl Gunter, Weijia He, Tushar Jois, Berkay Kaplan, Mounib Khanafer, Kevin Kornegay, Logan Kostick, David Kotz, Namya Malik, Ravi Mangar, Greg Mazzaro, Carolyn Tomi Oluwaseun-Apo, Tina Pavlovich, Beatrice Perez, Travis Peters, Timothy Pierson, Jingyu Qian, Sougata Sen, Shalni Sundram, Adam Vandenbussche, Matthew Wallace, Chixiang Wang, Kaiyao Weng, Sam Yuan, Wondimu Zegeye.
NSF Secure and Trustworthy Computing (SaTC) award 1955805.
The views and conclusions contained on this site and in its documents are those of the authors and should not be interpreted as necessarily representing the official position or policies, either expressed or implied, of the sponsor(s). Any mention of specific companies or products does not imply any endorsement by the authors or by the sponsor(s).
This list includes only those including David Kotz as co-author or thesis advisor. For a complete list of SPLICE papers, see the SPLICE website.
[The list below is also available in BibTeX]
Papers are listed in reverse-chronological order.
Follow updates with RSS.