SLIDE 1 Televisions, Video Privacy, and Powerline Electromagnetic Interference
Miro Enev, Sidhant Gupta, Yoshi Kohno, & Shwetak Patel
Security & UbiComp Labs @ UW
SLIDE 2
Smart Home = Smart Devices + Smart Sensors
SLIDE 3 The Picture Today
Utility 3rd Parties power sensor
SLIDE 4 The Picture Today
Utility 3rd Parties UbiComp power sensor
SLIDE 5 Sophisticated electrical sensors are already deployed in homes to help achieve new efficiency and utility goals.
Emerging Trends:
Benefactors:
SLIDE 6
What private information is available from the powerline?
Research Q:
SLIDE 7
What private information is available from the powerline?
Research Q:
Answer:
Modern TVs leak substantial information on the power line that is indicative of the screen content
SLIDE 8
What private information is available from the powerline?
Research Q:
Answer:
Modern TVs leak substantial information on the power line that is indicative of the screen content Information can be collected using a single sensor installed anywhere on power line
SLIDE 9
U.S. Video Protection & Privacy Act of 1998 states that video viewing records be kept private
What’s the BIG deal?
SLIDE 10
U.S. Video Protection & Privacy Act of 1998 states that video viewing records be kept private
What’s the BIG deal?
We hope our work can inform future discourse about the directions of Powerline sensing technologies
SLIDE 11
Smart Sensor Power measurements reveal private information about homeowner’s activity [Markham 2010]; concurrent work also looks at TVs [Greveler 2011] In-line power measurement of a PC can reveal web browsing habits [Clark 2011]
SLIDE 12 Power Based Measurement
In-line with device
SLIDE 13 Voltage Based Measurement
Parallel with device
...
Home’s Powerline Infrastructure
SLIDE 14
Switched Mode Power Supply
SLIDE 15 Switching Circuits generate high frequency Electro Magnetic Interference (EMI)
Supply
Load Inductor
SLIDE 16 Switching Circuits generate high frequency Electro Magnetic Interference (EMI)
Supply
Load Inductor
SLIDE 17 Switching Circuits generate high frequency EMI
which couples onto the powerline
Supply
Load Inductor Home’s Power Line Infrastructure
SLIDE 18 Supply
Load Inductor Home’s Power Line Infrastructure
we record the EMI
Switching Circuits generate high frequency EMI
which couples onto the powerline
SLIDE 19 EMI: Summary
Many modern devices produce EMI! EMI can be collected with a single sensor! Signals live in the frequency domain!
Frequency (kHz)
ElectriSense (2010 Gupta et al. )
SLIDE 20
EMI @ Home
SLIDE 21 Movie Link
Video TV EMI
SLIDE 22 Our 8 TVs
58” 42” 32”
Panasonic 42-A Panasonic 42-B Sharp 42 Sharp 32-A Sharp 32-B
Samsung 32
Samsung 58-A Samsung 58-B
Plasma, 2010 LCD, 2007 - 2009
SLIDE 23
Q1: Do TVs produce repeatable EMI given repeated screen content? Q2: For a given TV, does different screen content produce different EMI? Q3: Is EMI consistent across TVs from the same model family? Q4: Can we use EMI to determine what is being watched on TV? Q5: Can we match lab EMI to EMI recorded in various home settings? Research Questions?
SLIDE 24
Q1: Do TVs produce repeatable EMI given repeated screen content? Q2: For a given TV, does different screen content produce different EMI? Q3: Is EMI consistent across TVs from the same model family? Q4: Can we use EMI to determine what is being watched on TV? Q5: Can we match lab EMI to EMI recorded in various home settings? Research Questions?
SLIDE 25 Screen Content = 20 IMDB Top Grossing Movies
Action Animation Comedy Documentary Drama
SLIDE 26 Lab Setup
(I)Isolation transformer
(A)Power Line Interface
(U) Universal Software Radio Peripheral
- analog to digital convertor
(A)Spectrum analyzer
SLIDE 27 Signal Extraction
Frequency (kHz)
30 100 200
Time (secs)
SLIDE 28 Signal Extraction
Frequency (kHz)
30 100 200
Time (secs)
SLIDE 29
Extracting TV EMI
SLIDE 30
Extracting TV EMI
SLIDE 31
Q1: Do TVs produce repeatable EMI given repeated screen content? Q2: For a given TV, does different screen content produce different EMI? Q3: Is EMI consistent across TVs from the same model family? Research Questions?
SLIDE 32 Q4:
Can we use EMI to determine what is
being watched on a TV?
SLIDE 33 Match EMI to a DB Approach:
Q4:
Can we use EMI to determine what is
being watched on a TV?
SLIDE 34 . . .
Time (mins.) 60
. . .
Building an EMI Database
EMI
SLIDE 35 Time (mins.) 60
Multiple TVs Same Content
Pan42A Pan42B
Multiple Runs
SLIDE 36 Multiple Runs
Time (mins.) 60
Multiple TVs Same Content
Pan42A Pan42B
Query DB
vs
SLIDE 37 Time (mins.)
15
= ?
Query DB
vs
TV
Movie
Q.Len
SLIDE 38 Time (mins.)
15
= ?
Query DB
vs
TV
Movie
Q.Len
SLIDE 39 Time (mins.)
15
= ?
Query DB
vs
TV
Movie
Q.Len
Best match
SLIDE 40 Possible Query Results
- Hit: the search engine is confident* in the match (accept)
and the match was the movie from which the query itself was extracted. (Success.)
- Miss: the search engine is confident* in the match
(accept) but there is a mismatch between the search engine’s best guess and the query origin. (Failure.)
- Reject: the best match was a not a clear winner*,
and the matching algorithm chooses not to respond. (Neither success nor failure.) * Confidence is the gap size between the top match and the runner up
SLIDE 41 Query Length & Confidence
Reject
Confidence is the gap size between the top match and the runner up
Reject
Reject
Reject
Query Length
1 min
6 min 12 min 15 min
SLIDE 42
Q4: Can we determine what is being watched from EMI?
SLIDE 43
Q4: Can we determine what is being watched from EMI?
SLIDE 44
Q5: Can we match lab EMI to home EMI?
SLIDE 45 Home Details
Style Year Built Size Single family Home 2003 3000 sq. ft Apartment 2009 657 sq. ft. Multi-family Home 1906 800 sq. ft.
SLIDE 46
Home Setup
SLIDE 47
Home Setup
SLIDE 48
Q5: Can we match lab EMI to EMI recorded in home settings
SLIDE 49
Can we predict EMI from screen content without a TV?
Extensions:
SLIDE 50 Predicting EMI
Input Features:
Extract Features Train Model Predict EMI
Model: Neural Net
- Brightness: cumulative sum of averaged RGB intensities
- Flux: change in brightness between consecutive frames
- Edge Intensity: pixelsum of a Canny Edge filter
- FFT: slope of the best fit line to an FFT
- Color: mean and standard deviation for Gaussians fitted
to R, G, and B color histograms
- Bitrate: kbits/second computed using FFMPEG
Cross Validation:
10 Train, 5 Test
SLIDE 51
Predicting EMI
SLIDE 52
Predicting EMI
SLIDE 53 AC
@60Hz
use save TV EMI
SMPS
TV EMI: Theory of Operation
light scene dark scene
Backlight (brightness) is key source of TV EMI
SLIDE 54
Defenses and Tensions
> Better filtering by power supplies > Signal Injection & Jamming (Energy Star) > Battery Masking [Mclaughlin 2011] > Infrequent sensor readings
SLIDE 55
Takeaways
> Devices produce EMI on the powerline > Single sensor tracks many devices > EMI can be > Growing attack surface
SLIDE 56
Questions?
miro@cs.washington.edu
SLIDE 57
Does EMI matching scale?
SLIDE 58
Does EMI matching scale?
SLIDE 59
Sharp 32 and SNR
SLIDE 60 “Our research shows that the analysis of the household’s electricity usage profile does reveal what channel the TV set in the household was displaying. “
Related Work
SLIDE 61 Q1: repeatable EMI from repeated screen content?
Cross Correlation
A & B : Lion King C: Bourne Ultimatum
EMI Time (secs)
SLIDE 62 58”
B Samsung 58-A
TVs (1)
SLIDE 63 42”
Panasonic 42-A B
TVs (2)
SLIDE 64 32”
B
Sharp 32-A
TVs (3)