CSR: Small: Surviving Cybersecurity and Privacy Threats in Wearable Mobile Cyber-Physical Systems

企业社会责任：小：应对可穿戴移动网络物理系统中的网络安全和隐私威胁

• 批准号: 1523960
• 负责人: Murtuza Jadliwala
• 金额: $ 38万
• 依托单位: Wichita State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2015
• 资助国家: 美国
• 起止时间: 2015-10-01 至 2018-04-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1523960&HistoricalAwards=false
• 关键词: CSR; Small; Surviving; Cybersecurity; Privacy

Smart wearable devices, such as smart watches, are very popular and fast replacing their traditional non-smart counterparts. By means of various high-precision on-board sensors, these devices capture rich contextual information about the wearer and his environment to enable several new and useful applications. However, this diverse set of on-board sensors also provides an additional attack surface. Access to these sensors, if not controlled appropriately, can be used as a side-channel by an adversary keen on obtaining private and sensitive information belonging to the wearer. Moreover, active misuse detection and resistance of these wearable device sensors is not straightforward. There is currently a lack of understanding of the various side-channel security vulnerabilities that are possible due to wearable devices and there is an urgent need to study the means for continuously protecting against them. The research in this project addresses this very timely topic.The goal of this research is twofold: first, to demonstrate that wearable devices enable novel side-channel security and privacy threats, and second, to design continuous authentication techniques and adaptive access control mechanisms to survive these threats. Specifically, this research will evaluate private data inference and wearer tracking threats in wearable devices that utilize unprotected sensors as side-channels. This will be accomplished by designing appropriate learning-based classification and prediction mechanisms that can be used by an adversary for inferring sensitive data. On the protection front, this project will develop a multi-sensor activity and identity classification framework. This framework will leverage rich contextual sensor data (e.g., fine-grained movements, application usage and critical body parameters) to enable continuous identification and authentication of legitimate wearers and their activities. By studying security and privacy preferences of a diverse population of users, this research will develop usable activity-based access control tools for this new wearable device paradigm. A significant research thrust of this project is to develop adaptive data-sharing mechanisms for dynamically regulating access to sensor data based on the wearers' security preferences, current context and perceived threats. Such mechanisms will serve as a good middle-ground between giving full access (no security) and making manual decisions for each access (poor usability). This project involves industry collaborators to facilitate adoption of research outcomes into the future design and development of wearable devices. Research results, including proof-of-concept applications, will be publicly available to allow dissemination, early industry adoption and integration with curricula.

智能可穿戴设备（如智能手表）非常受欢迎，并正在快速取代传统的非智能设备。通过各种高精度的机载传感器，这些设备可以捕获有关佩戴者及其环境的丰富上下文信息，以实现多种新的有用应用。然而，这种多样化的机载传感器也提供了额外的攻击面。如果控制不当，对这些传感器的访问可能会被热衷于获取佩戴者的私人和敏感信息的对手用作侧通道。此外，这些可穿戴设备传感器的主动误用检测和抵抗并不简单。目前，人们对可穿戴设备可能存在的各种侧通道安全漏洞缺乏了解，迫切需要研究持续防范这些漏洞的方法。本项目的研究正是针对这一非常及时的主题展开的，其目标有两个：第一，证明可穿戴设备会带来新的侧信道安全和隐私威胁;第二，设计持续身份验证技术和自适应访问控制机制来抵御这些威胁。具体来说，这项研究将评估利用不受保护的传感器作为侧通道的可穿戴设备中的私人数据推断和穿戴者跟踪威胁。这将通过设计适当的基于学习的分类和预测机制来实现，这些机制可以被对手用来推断敏感数据。在保护方面，该项目将开发一个多传感器活动和身份分类框架。该框架将利用丰富的上下文传感器数据（例如，精细的动作、应用程序使用和关键的身体参数），以实现对合法佩戴者及其活动的持续识别和认证。通过研究不同用户群体的安全和隐私偏好，本研究将为这种新的可穿戴设备范式开发可用的基于活动的访问控制工具。该项目的一个重要研究方向是开发自适应数据共享机制，用于根据佩戴者的安全偏好、当前上下文和感知到的威胁动态调节对传感器数据的访问。这样的机制将在提供完全访问（无安全性）和为每次访问做出手动决策（可用性差）之间充当一个很好的中间地带。该项目涉及行业合作者，以促进将研究成果应用于可穿戴设备的未来设计和开发。研究结果，包括概念验证应用程序，将公开提供，以便传播，早期行业采用和与课程整合。

项目成果

RandomPad: Usability of Randomized Mobile Keypads for Defeating Inference Attacks

• 发表时间: 2017
• 作者: Anindya Maiti;Kirsten Crager

Smartwatch-Based Keystroke Inference Attacks and Context-Aware Protection Mechanisms

• DOI: 10.1145/2897845.2897905
• 发表时间: 2016-05
• 期刊: Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security
• 作者: Anindya Maiti;Oscar Armbruster;Murtuza Jadliwala;Jibo He

(Smart)watch your taps: side-channel keystroke inference attacks using smartwatches

• DOI: 10.1145/2802083.2808397
• 发表时间: 2015-09
• 期刊: Proceedings of the 2015 ACM International Symposium on Wearable Computers
• 作者: Anindya Maiti;Murtuza Jadliwala;Jibo He;Igor Bilogrevic

Preventing shoulder surfing using randomized augmented reality keyboards

• DOI: 10.1109/percomw.2017.7917636
• 发表时间: 2017-03
• 期刊: 2017 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops)
• 作者: Anindya Maiti;Murtuza Jadliwala;Chase Weber

Information Leakage through Mobile Motion Sensors: User Awareness and Concerns

通过移动运动传感器的信息泄露：用户意识和担忧

• 发表时间: 2017
• 期刊: Proceedings of the European Workshop on Usable Security (EuroUSEC
• 作者: Kirsten Crager, Anindya Maiti