## 8 Conclusions and Future Work
Additionally, rule generation can be improved by using AI-based Intrusion Detection Systems [46; 97] or by using automated tools that can check if data flows or device's network capabilities comply with predefined rules, such as _COPSEC_ checking for GDPR compliance [44]. Then, rules can be created based on the results of those systems or the vulnerabilities found. This would further enhance the reliability of filtering and provide additional assistance to the user in making decisions regarding filtering rules. * **Improve networks' ability to separate data flows**: Successful network filtering requires that the filtering device is in a unique position of the network in order to see and thus filter the data flow. Configuring the magnitude of devices, e.g., providing them the Smart Home's WLAN passphrase requires often tedious manufacturer setup procedures. In this work, we only very briefly touched on the aspect that the 802.11 WLAN standard [33] would enable to use the passphrase different for each wireless device. We have termed this idea as _per-device-802.11-passphrase_ to specify and look up if a different key for the encryption and decryption is within the 802.11 WLAN standard, which specifies explicitly a 'keyLookup' [33] operator and is implemented within the Linux implementation of a WLAN access point hostapd. (The documentation from the hostapd package (see [[https://packages.debian.org/en/sid/hostapd](https://packages.debian.org/en/sid/hostapd)]([https://packages.debian.org/en/sid/hostapd](https://packages.debian.org/en/sid/hostapd)) (accessed: 19 January 2025)) states that 'Optionally, WPA PSKs can be read from a separate text file (containing list of (PSK, MAC address) pairs.' Note that this list often is formatted to be first MAC then PSK.) The latter would separate the devices cryptographically and not only prevent direct communication among the wireless clients but also means that one compromised device would not leak a common passphrase to the WLAN. In combination with per-device filtering rules, this would also limit the effect of MAC spoofing: an attacker could communicate in the way filtering allows it for that spoofed device but not more. Further, the proliferation of software-defined networks (SDNs) into also home networks in the future would further allow to make use of the facilities within software-defined networks to enforce rules to limit the data flow [47; 97], extract the data flow for visualisation [47], or use it for identifying problems using an AI-based intrusion detection [97]. * **Improve the coverage and decrease the load of security functionality provided by the network**: If devices themselves are insecure or too weak to uphold the needed level of security, e.g., they obtain no updates but are vulnerable, other devices within a Smart Home IoT network could take over. The weaker or insecure devices could delegate their filtering (or other security functions) to other Smart Home Devices. **Author Contributions:** Conceptualization, H.C.P., F.K. ([PERSON]), E.G. and F.K. ([PERSON]); Methodology, H.C.P., F.K. ([PERSON]), E.G. and F.K. ([PERSON]); Validation, H.C.P., F.K. ([PERSON]), E.G. and F.K. ([PERSON]); Formal analysis, H.C.P., F.K. ([PERSON]), E.G. and F.K. ([PERSON]); Investigation, H.C.P., F.K. ([PERSON]), E.G. and F.K. ([PERSON]); Writing--original draft, H.C.P., F.K. ([PERSON]), E.G. and F.K. ([PERSON]); Writing--review & editing, H.C.P., F.K. ([PERSON]), E.G. and F.K. ([PERSON]). All authors have read and agreed to the published version of the manuscript. **Funding:** The work of [PERSON], [PERSON] and [PERSON] was funded by the Bavarian State Ministry of Science and Arts (BayStMWK), under the projects 'Secure Encapsulation' and 'Architectures and services for secure everyday digitalisation' of the Bavarian Research Association 'FORDaySec' (see [[https://fordaysec.de](https://fordaysec.de)]([https://fordaysec.de](https://fordaysec.de)) (accessed on 19 January 2025)): \"Security in Everyday Use of Digital Technologies'.