T2Pair: Secure and Usable Pairing for Heterogeneous IoT Devices
T2Pair: Secure and Usable Pairing for Heterogeneous IoT Devices
复制标题
DOI：
10.1145/3372297.3417286
复制
发表时间：
2020-10
期刊：
影响因子：
--
通讯作者：
Xiaopeng Li;Qiang Zeng;Lannan Luo;Tongbo Luo
中科院分区：
文献类型：
--
作者：
Xiaopeng Li;Qiang Zeng;Lannan Luo;Tongbo Luo
安全配对是物联网（IoT）设备可靠部署和应用的关键。然而，物联网设备缺乏传统的用户界面，如键盘和显示器，这使得许多传统的配对方法不适用。基于邻近度的配对方法非常有用，但可能被位于同一地点的恶意设备利用。基于用户在物联网设备上的物理操作的方法更安全，但通常需要惯性传感器，而许多设备不满足这一要求。可应用于异构IoT设备的安全且可用的配对方法仍然不存在。我们开发了一种技术，通用操作传感，它允许物联网设备在不需要惯性传感器的情况下感知用户的物理操作。通过这种技术，手持智能手机或佩戴腕带的用户可以通过一些非常简单的操作在几秒钟内完成配对，例如，按下按钮或拧动旋钮。此外，本文还揭示了原有模糊承诺存在的不准确性问题，提出了忠实模糊承诺来解决这一问题，设计了一个基于忠实模糊承诺的配对协议，并建立了一个原型系统Touch-to-Pair（T2 Pair，简称T2 Pair）。综合评价表明，该系统是安全可用的。
Secure pairing is key to trustworthy deployment and application of Internet of Things (IoT) devices. However, IoT devices lack conventional user interfaces, such as keyboards and displays, which makes many traditional pairing approaches inapplicable. Proximity-based pairing approaches are very usable, but can be exploited by co-located malicious devices. Approaches based on a user's physical operations on IoT devices are more secure, but typically require inertial sensors, while many devices do not satisfy this requirement. A secure and usable pairing approach that can be applied to heterogeneous IoT devices still does not exist. We develop a technique, Universal Operation Sensing, which allows an IoT device to sense the user's physical operations on it without requiring inertial sensors. With this technique, a user holding a smartphone or wearing a wristband can finish pairing in seconds through some very simple operations, e.g., pressing a button or twisting a knob. Moreover, we reveal an inaccuracy issue in original fuzzy commitment and propose faithful fuzzy commitment to resolve it. We design a pairing protocol using faithful fuzzy commitment, and build a prototype system named Touch-to-Pair (T2Pair, for short). The comprehensive evaluation shows that it is secure and usable.