IoT Device Classification in Edge-Cloud Models

IoT edge networks are constructed with Internet of Things (IoT) devices deployed near data sources at the network edge. These networks often include a middle tier of computationally robust devices designed to enhance IoT compute resources and boost network performance at an intermediary stage. By utilizing this middle tier for network capture, we introduce a novel side-channel attack through DNS pooling, AWS cloud services, and a rainbow table of AWS endpoint URLs. Our attack demonstrates the capability to correlate IoT edge devices with AWS cloud services, allowing us to determine a device’s role within the IoT edge network. This identification is crucial in reducing the time required to physically compromise the network by swapping out IoT edge devices with malicious counterparts. Furthermore, linking our attack to one or more AWS vulnerabilities amplifies the severity and scale of the exploit. Mitigating this technique is challenging as it exploits the inherent dependencies on DNS queries and the structure of AWS cloud services. Our experiment included a diverse set of IoT devices related to home automation and security. We accurately grouped IoT edge devices by analyzing traffic patterns, throughput, latency, cloud service endpoints, and human interaction patterns. Cloud service endpoint matching was achieved by utilizing AWS developer documentation, constructing EC2 pools through repeated DNS queries, and matching IP addresses to endpoints using a rainbow table of cloud service endpoints. Although AWS is highlighted in our experiment, other cloud services are similarly vulnerable due to their unique structural characteristics.