AirMask: Enabling Air-to-Air Masking of Wireless Traffic Fingerprints in WiFi-Based IoT Environments

The Internet of Things (IoT) commonly adopts IEEE 802.11 wireless communication. However, the latest studies have revealed the advanced attacks that can analyze side-channel behavioral fingerprints of wireless frames to infer privacy-sensitive user behaviors. Obfuscating such fingerprints at the originating device has been widely regarded as the most fundamental defense strategy. However, thisdevice-to-airapproach conflicts with the realities of IoT: extreme heterogeneity, proprietary firmware, and limited resources render device-level modification impractical. As a result, what appears conceptually natural becomes a key barrier to scalable defense, leaving IoT users broadly exposed to the latest advanced attacks. To counter these emerging threats while enabling practical, wide-scale deployment, we presentAirMask, the firstair-to-airdefense system that works transparently to IoT devices while protecting them adaptively.AirMaskpassively senses fingerprints in the air and injects carefully crafted frames into the air to mask occurring traffic fingerprints as needed. Despite its promise, the air-to-air defense faces three challenges: i) observing time-varying traffic of all devices while adaptively sensing occurring fingerprints for each device, ii) promptly injecting crafted frames that can mask fingerprints once they occur, and iii) camouflaging crafted frames to withstand adversarial filtering. To address these challenges,AirMaskoperates in a predict-inject-assess loop. This loop iteratively adapts to changing traffic patterns, proactively injects principally crafted frames upon the prediction of occurring fingerprints, and continuously refines device-specific obfuscation strategies against attacks. The injection removes fingerprints while maintaining the crafted frames’ context indistinguishability (e.g., protocol fields and sequence states) from authentic ones. We have implementedAirMaskas a functional hardware prototype, offeringIntegrated,TAP, andAirmodes for flexible deployment within WiFi networks to protect surrounding IoT devices. Extensive evaluations on 90 types of IoT devices and 53 fine-grained behaviors confirmAirMask’s defensive effectiveness, while incurring negligible bandwidth and latency overhead.