Exploring privacy breaches and mitigation strategies of occupancy sensors in smart buildings

Abstract

Occupancy sensors are an integral part of many smart building applications, including energy and space optimizations. However, as more occupancy data is collected at an increasingly fine-grained level, possibilities of potential privacy breaches also increase. In this paper, we propose an attack in which the adversary associates an individual with the occupancy sensor by combining the occupancy data with other public information that could easily be obtained online. We conduct an experiment using real-world data to demonstrate that the proposed attack is not only feasible, but the adversary can efficiently identify a small set of sensor IDs that contains the ID of interest given a relatively small amount of additional information. We also summarize a number of mitigation strategies against the proposed attack.