What are the steps to the privacy leak described?
Basically there are three parts in getting the information described in the paper.
- An interested party recording the outgoing traffic (2)
- Said party being able to split the traffic streams (4.1)
- Analyzing the different traffic streams
- Identifying device (type) (4.2)
- Analyzing device pattern (5)
Recording the outgoing traffic
While the attacker is simply assumed in the paper as prerequisite this is already quite the hurdle.
Specifically, an adversary in this model can observe and record all wide-area network traffic, including traffic to and from home gateway routers.
That's not a lot of potential attackers. Basically, that's the ISP you use to connect to the Internet, the WAN carriers and interested intelligence agencies. Thankfully the one with the easiest access, your ISP, is likely not interested since it doesn't really help their business model. On the other hand, the ISPs are the ones courts can compel to record and provide these information.
We assume that ISPs are typically uninterested in performing targeted active attacks on individual users.
Whilst not being interested in these attacks, they might very well be forced to provide the information. Of course, that depends on the laws of the country they operate in.
Assuming you haven't gotten a court to compel your ISP or attracted the attention of an intelligence agency with the necessary capabilities to record the traffic the likeliest attacker that can use the further steps would be a compromised home router.
Splitting traffic streams
The split into traffic streams is assumed to be performed by grouping them by the external communication partner, e.g. the services the IoT devices communicate with. The aforementioned attacker obviously has the target IP, after all the information is needed to get the information where they belong.
A good possibility that Mawg describes in his answer is the use of a VPN service provider. With the use of a VPN the ISP or otherwise capable attacker cannot deduce the actual target of the communication since every communication is addressed at the VPN service provider. However, that enables another party to be the attacker of this model—the VPN service provider.
By using a VPN router you essentially enable another party to be this attacker. The advantage of the TOR network as mentioned in Sylvain's answer is the obfuscation of streams while simultaneously not enabling another player to the proverbial man-in-the-middle. If you're using TOR you'll need either really bad luck in TOR nodes or really really interested parties to enable the attacker to identify the streams.
This Wiki article subsection describes the theoretical possibilities to still identify source and target of TOR communications. Although, these methods require serious resources and access to the basic Internet structure, which again brings us back to the same group of potential attackers than mentioned before. However, they would need even more motivation to invest the effort to track that traffic.
If you VPN with either solution over jurisdictions (continents or at least countries, not counties or the like) you are likely safe from court proceedings.
- When using a dedicated VPN provider you have to weigh the trustworthiness of said provider versus your own ISP. This just moves the ability of attack to another party.
- When using TOR consider how it works and who owns (and pays for) the exit nodes
- Either solution adds significant hurdles in splitting the traffic stream.
- Either solution will likely make court proceedings to get the data useless when spanning several jurisdictions. 1
Analyzing the different traffic streams
This is actually trivial for anyone who has jumped the first two hurdles. Unless you have a home-made solution the traffic patterns of any IoT device can be easily recorded and afterwards recognized when the data set is sufficient.
However, as Sean describes in his answer you can still muddy the waters. If you device sends additional spoofing data or bulk transmits data that does not have to be real-time the pattern analysis gets really complicated.
1 not a lawyer