Data Privacy in Trigger-Action Systems Yunang

celsa-spraggs

Published 2026-09-09 · 26 slides · 0 views

↓ Download

Data Privacy in Trigger-Action Systems Yunang

Data Privacy in Trigger-Action Systems Yunang - slide 1 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 2 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 3 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 4 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 5 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 6 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 7 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 8 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 9 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 10 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 11 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 12 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 13 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 14 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 15 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 16 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 17 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 18 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 19 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 20 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 21 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 22 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 23 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 24 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 25 of 26

Data Privacy in Trigger-Action Systems Yunang - slide 26 of 26

Description

Data Privacy in Trigger-Action Systems Yunang Chen, Amrita Roy Chowdhury, Ruizhe Wang, Andrei Sabelfeld, Rahul Chatterjee, Earlence Fernandes University of Wisconsin-Madison Chalmers University of Technology Online services with

Download this presentation From Below

"Data Privacy in Trigger-Action Systems Yunang" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation Transcript

Data Privacy in Trigger-Action Systems Yunang Chen*, Amrita Roy Chowdhury*, Ruizhe Wang*,
Andrei Sabelfeld†, Rahul Chatterjee*, Earlence Fernandes*

* University of Wisconsin-Madison
† Chalmers University of Technology

Online services with different APIs don’t talk to each other 2

Trigger-Action Platforms (TAPs) connect independent services to empower automation rules Popular Commercial Trigger-Action Platforms 3

Trigger-Action Automation Rules room PM level > turn on air purifier threshold IF , THEN new email received is from ring smart speaker bank IF , THEN new transaction happens with send SMS $100 IF THEN 4 transaction amount > AND midnight transaction time during with receiver = , contact information message body = transaction details AND phone number extract from “Warning: ” +

However, users risk their privacy and security What happens if TAP is compromised? Chat logs Emails Social networks Cloud files Control lights Control power outlets Control ovens Sensitive information is leaked Arbitrary actions can be performed 5

Security Concerns in TAPs: IFTTT as a Case Study IFTTT’s Term of Use states…

IFTTT operates on lots of sensitive information
Integrated with 600+ services
Has 20M+ users 6

Security Concerns in TAPs: IFTTT as a Case Study Access tokens acquired by IFTTT are overprivileged [Fernandes et al, 2018]

Gmail removed its triggers from IFTTT due to security concern in 2019 7 Trigger a rule when I upload a new file to Google Drive

How to design a secure trigger-action system? 8

eTAP: encrypted Trigger-Action Platform 9 Protect data privacy and integrity Support computations in rules Optimize for string operations Efficient protocol with low overhead

Abstract Paradigm of a Trigger-Action System trigger data action data Action Service Trigger-Action Platform (TAP) IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) Trigger Service 10 Programmed through User Client

Security Guarantees and Practical Consideration of eTAP 11 has fully infiltrated Security Guarantees
Attacker can’t learn trigger and action data
Attacker can’t modify or delay action data
Action Service can’t learn trigger data and vice versa
Action Service can only learn action data when f1 = true
Only client can learn user constant trigger data action data Action Service Trigger-Action Platform (TAP) IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) Trigger Service User Client [Chiang et al, 2020] [Fernandes et al, 2018],
[Chiang et al, 2020] honest but curious honest but curious malicious trusted Practical Consideration
Minimal changes to trigger and action service (no infrastructural change, constant extra storage per user, etc.)
Services don’t need to know each other or the rules
Client may not be always online

Design Overview of eTAP Use Garbled Circuit for secure function evaluation

Extend Garbled Circuit to satisfy all security goals
Asymmetric trust assumptions lead to more optimizations 12 Convert functions to garbled circuit
Encode input data Evaluate garbled circuit
Decode output data can be pre-computed w/o input computationally efficient

Phase #1: Setup (once, w/ client) Action Service Trigger-Action Platform (TAP) Trigger Service 13 During OAuth negotiation with Trigger/Action Service trigger secret key to generate GC encoding information action secret key to protect GC decoding information

Phase #2: Function Garbling (periodic, w/ client) 14 Trigger-Action Platform (TAP) Client does: Given a Rule:
IF f1(trigger data, constant),
THEN action data = f2(trigger data , constant) garbled circuit,
garbled constant,
decode blob f1, f2 encode info Garbled Circuit Generation garbled circuit decode info constant Symmetric Encryption Input Encoding decode blob garbled constant

Phase #3: Execution (whenever trigger happens, w/o client) 15 Action Service Trigger-Action Platform (TAP) Trigger Service Trigger Service does: encode info Input Encoding garbled trigger data trigger data garbled trigger data

Phase #3: Execution (whenever trigger happens, w/o client) 16 Action Service Trigger-Action Platform (TAP) Trigger Service TAP does: garbled trigger data garbled circuit garbled constant garbled trigger data Garbled Circuit Evaluation garbled action data garbled action data decode blob

Phase #3: Execution (whenever trigger happens, w/o client) 17 Action Service does: Action Service Trigger-Action Platform (TAP) Trigger Service garbled trigger data garbled action data decode blob decode blob Symmetric Decryption decode info Output Decoding action data garbled action data

Benefits of eTAP’s Design No need for oblivious transfer: All input data provided by “Circuit Generator”
Allows for efficient protocol: Extending semi-honest protocols with authenticity can defend against a malicious TAP 18

Common functions crawled from top IFTTT + Zapier rules 19

Common functions crawled from top IFTTT + Zapier rules 20 supported by common GC libraries / easy to implement

Common functions crawled from top IFTTT + Zapier rules 21 can be implemented with simple regular expression supported by common GC libraries / easy to implement Challenge: How to evaluate regular expression efficiently in garbled circuits?

Optimize for Regular Expression 22 Regular Expression Deterministic Finite Automaton (DFA) State Transition Circuit Can be replaced with XOR gate One-hot encoded XOR gates can be computed for free

Common functions crawled from top IFTTT + Zapier rules 23 hard to implement efficiently eTAP supports 93.4% of all Zapier rules and 100% of top 500 IFTTT rules can be implemented with simple regular expression supported by common GC libraries / easy to implement

Modest overhead of running encrypted rules in eTAP 24 Avg. 55% increase Avg. 59% decrease

Client Overhead Estimation Based on prior study [Mi et al, 2017] [Cobb et al, 2020], assuming that
an average user has 26 rules installed
each rule will be executed once every 15 minutes

Client needs to spend 10.2 seconds per day to generate garbled circuits of size 61.7 MB in total 25 / 1 min

Conclusion Trigger-action platforms provide desirable functionality but pose security and privacy threats if compromised.
We propose eTAP, a clean-slate design for trigger-action platforms 26 Yunang Chen yc@cs.wisc.edu Data privacy and integrity against malicious TAP Optimize garbled circuits with asymmetric trust assumptions Efficiently support common string operations Modest performance reduction for rule execution https://github.com/EarlMadSec/etap

Data Privacy in Trigger-Action Systems Yunang

Related Topics

Share

Embed code

Download this presentation From Below

Presentation Transcript