Matter is the latest interoperability standard for the consumer Internet of Things (IoT) market, developed by the Connectivity Standards Alliance (CSA). Matter's design pays particular attention to security and privacy: it provides validated secure session establishment protocols, and it uses robust security algorithms to encrypt communications between IoT devices and Matter controllers. However, little is known about the extent to which information can still be inferred from encrypted traffic. This paper investigates whether a passive adversary can identify Matter interactions and device types by analyzing encrypted traffic metadata. Using datasets collected from both real-world and simulated Matter deployments, we identify repeatable fingerprints based on packet lengths, directions, and packet sequences. Our results show that Matter interactions can be identified with over 95% accuracy even under packet loss and delay conditions. Furthermore, device types such as lighting, lock, and plug appliances can be inferred with accuracy exceeding 88%. These findings reveal a significant privacy risk affecting Matter-enabled deployments regardless of vendor. The CSA acknowledged our findings and indicated that mitigation mechanisms may be considered in future Matter versions.

翻译：暂无翻译