CT-ISG: User-Aided Secure Association of Wireless Devices

CT-ISG：用户辅助的无线设备安全关联

• 批准号: 0831526
• 负责人: Gene Tsudik
• 金额: $ 25万
• 依托单位: University of California-Irvine
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2008
• 资助国家: 美国
• 起止时间: 2008-10-01 至 2014-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0831526&HistoricalAwards=false
• 关键词: CT; ISG; User; Aided; Secure

The popularity of personal gadgets opens up many new services for ordinary users. Many everyday usage scenarios involve two or more devices "working together". (Emerging scenarios are beginning to involve sensors and personal RFID tags.) Before working together, devices must be securely "paired" to enable secure and private communication. However, the human-imperceptible nature of wireless communication prompts the very real threat of Man-in-the-Middle (MiTM) attacks. Another challenge arises due to the lack of a global security infrastructure. Consequently, traditional cryptographic means alone are unsuitable, since unfamiliar devices have no prior security context and no common point of trust. Therefore, some human involvement in secure device pairing is unavoidable. At the same time, most devices have limited hardware and/or user interfaces, thus complicating human involvement. This project?s goals are three-fold: (1) design a set of pairing methods suitable for most common devices and a general user population, based on comprehensive and comparative usability studies, (2) develop secure pairing techniques for personal RFID tags, and (3) construct a set of user-friendly, scalable and secure methods for sensor initialization. Benefits of this project will include accumulation of valuable expertise in designing truly usable security methods. Notably, the project expects to experimentally assess the value of usable security with respect to the general population. Furthermore, the need for, and the utility of, user-centric secure control of personal RFID tags and sensors will be demonstrated. Since device pairing is one of the very few areas where security directly involves and affects the average user, the greatest impact of proposed research is expected to be the broader participation in security practices and better appreciation of security and its benefits. The project also emphasizes industry outreach and technology transfer by working with manufacturers and industrial consortia. In addition, students taking part in the project are expected to acquire currently uncommon skills at the cusp of Human-Computer Interaction, Usability and Cyber Trust.

个人电子设备的普及为普通用户提供了许多新的服务。许多日常使用场景涉及两个或更多个设备“一起工作”。（新兴的场景开始涉及传感器和个人RFID标签。在一起工作之前，设备必须安全地“配对”，以实现安全和私密的通信。然而，人类无法感知的无线通信的性质提示非常真实的威胁的中间人（MiTM）攻击。另一个挑战是缺乏全球安全基础设施。因此，传统的加密手段本身是不合适的，因为不熟悉的设备没有先前的安全上下文，也没有共同的信任点。因此，安全设备配对中的一些人为参与是不可避免的。同时，大多数设备具有有限的硬件和/或用户界面，因此使人类参与复杂化。这个项目？的目标有三个方面：（1）基于全面和比较的可用性研究，设计一套适用于大多数常见设备和一般用户群体的配对方法，（2）开发个人RFID标签的安全配对技术，以及（3）构建一套用户友好、可扩展和安全的传感器初始化方法。该项目的好处将包括在设计真正可用的安全方法方面积累宝贵的专业知识。值得注意的是，该项目预计将试验性地评估可用安全对一般民众的价值。此外，需要，和效用，以用户为中心的个人RFID标签和传感器的安全控制将被证明。由于设备配对是安全直接涉及和影响普通用户的极少数领域之一，因此拟议研究的最大影响预计将是更广泛地参与安全实践，并更好地了解安全及其好处。该项目还强调通过与制造商和工业联合体合作进行工业外联和技术转让。此外，参加该项目的学生预计将获得目前在人机交互，可用性和网络信任的尖端不寻常的技能。