VibeRing: using vibrations from a smart ring as an out-of-band channel for sharing secret keys
VibeRing: using vibrations from a smart ring as an out-of-band channel for sharing secret keys
复制标题
DOI：
10.1145/3410992.3410995
复制
发表时间：
2020-10
期刊：
影响因子：
--
通讯作者：
Sougata Sen;D. Kotz
中科院分区：
文献类型：
--
作者：
Sougata Sen;D. Kotz
一些物联网 (IoT) 设备（也称为“智能设备”）会在使用时以及与用户进行物理接触时收集有意义的信息（例如血压计）。 Thing 的无线连接使其能够将数据传输到用户的可信设备，例如智能手机。然而，攻击者也可以与该物体建立通信通道，冒充用户并获取对该物体收集的用户信息的访问权限。因此，事物连接到正确的用户设备至关重要。引导此类通信通道通常需要带外通道来共享秘密，例如，通过要求用户输入 PIN。然而，手动输入 PIN 码很麻烦，尤其是在短暂使用物体时。在本文中，我们研究了如何使用自定义环生成的振动作为带外通信通道，以不引人注目地与物体共享秘密。此交换的秘密可用于引导安全无线通道，环（或其他受信任的设备）和物体可以通过该通道进行通信。我们介绍了这个系统的设计、实现和评估，我们称之为 VibeRing。通过用户研究，我们证明可以准确、安全地与各种对象共享秘密。
Some Internet of Things (IoT) devices - a.k.a. "smart Things" - collect meaningful information when they are in use and in physical contact with their user (e.g., a blood-pressure monitor). A Thing's wireless connectivity allows it to transfer that data to its user's trusted device, such as a smartphone. However, an adversary could also establish a communication channel with the Thing, impersonate the user and obtain access to the user's information collected by that Thing. Thus, it is essential that the Thing connects to the correct user's device. Bootstrapping such communication channels usually require an out-of-band channel to share a secret, e.g., by asking the user to input a PIN. However, manual PIN entry is cumbersome, especially when a Thing is used transiently. In this paper, we investigate the use of vibration, generated by a custom Ring, as an out-of-band communication channel to unobtrusively share a secret with a Thing. This exchanged secret can be used to bootstrap a secure wireless channel over which the Ring (or another trusted device) and the Thing can communicate. We present the design, implementation, and evaluation of this system, which we call VibeRing. Through a user study we demonstrate that it is possible to share a secret with various objects accurately and securely.