CSR: Small: Surviving Cybersecurity and Privacy Threats in Wearable Mobile Cyber-Physical Systems

企业社会责任：小：应对可穿戴移动网络物理系统中的网络安全和隐私威胁

• 批准号: 1523960
• 负责人: Murtuza Jadliwala
• 金额: $ 38万
• 依托单位: Wichita State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2015
• 资助国家: 美国
• 起止时间: 2015-10-01 至 2018-04-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1523960&HistoricalAwards=false
• 关键词: CSR; Small; Surviving; Cybersecurity; Privacy

Smart wearable devices, such as smart watches, are very popular and fast replacing their traditional non-smart counterparts. By means of various high-precision on-board sensors, these devices capture rich contextual information about the wearer and his environment to enable several new and useful applications. However, this diverse set of on-board sensors also provides an additional attack surface. Access to these sensors, if not controlled appropriately, can be used as a side-channel by an adversary keen on obtaining private and sensitive information belonging to the wearer. Moreover, active misuse detection and resistance of these wearable device sensors is not straightforward. There is currently a lack of understanding of the various side-channel security vulnerabilities that are possible due to wearable devices and there is an urgent need to study the means for continuously protecting against them. The research in this project addresses this very timely topic.The goal of this research is twofold: first, to demonstrate that wearable devices enable novel side-channel security and privacy threats, and second, to design continuous authentication techniques and adaptive access control mechanisms to survive these threats. Specifically, this research will evaluate private data inference and wearer tracking threats in wearable devices that utilize unprotected sensors as side-channels. This will be accomplished by designing appropriate learning-based classification and prediction mechanisms that can be used by an adversary for inferring sensitive data. On the protection front, this project will develop a multi-sensor activity and identity classification framework. This framework will leverage rich contextual sensor data (e.g., fine-grained movements, application usage and critical body parameters) to enable continuous identification and authentication of legitimate wearers and their activities. By studying security and privacy preferences of a diverse population of users, this research will develop usable activity-based access control tools for this new wearable device paradigm. A significant research thrust of this project is to develop adaptive data-sharing mechanisms for dynamically regulating access to sensor data based on the wearers' security preferences, current context and perceived threats. Such mechanisms will serve as a good middle-ground between giving full access (no security) and making manual decisions for each access (poor usability). This project involves industry collaborators to facilitate adoption of research outcomes into the future design and development of wearable devices. Research results, including proof-of-concept applications, will be publicly available to allow dissemination, early industry adoption and integration with curricula.

智能可穿戴设备（例如智能手表）非常受欢迎且快速替代其传统的非智能对应物。通过各种高精度在板载传感器，这些设备捕获了有关佩戴者及其环境的丰富上下文信息，以实现几种新的有用的应用程序。但是，这套不同的车载传感器也提供了额外的攻击表面。如果无法适当控制这些传感器，则可以通过热衷于获得属于佩戴者的私人和敏感信息的对手将其用作侧渠道。此外，这些可穿戴设备传感器的主动滥用检测和阻力并不简单。当前，由于可穿戴设备而可能导致的各种侧道安全漏洞，因此缺乏了解，并且迫切需要研究不断保护它们的手段。该项目的研究涉及这个非常及时的主题。这项研究的目的是双重的：首先，证明可穿戴设备使新颖的侧道安全性和隐私威胁，其次，设计连续的身份验证技术和适应性访问控制机制，以在这些威胁中生存。具体来说，这项研究将评估私人数据推断和穿戴者跟踪威胁在可穿戴设备中的威胁，这些设备利用不受保护的传感器作为侧通道。这将通过设计适当的基于学习的分类和预测机制来实现，这些分类和预测机制可以被对手用于推断敏感数据。在保护方面，该项目将开发多传感器活动和身份分类框架。该框架将利用丰富的上下文传感器数据（例如，细粒度的运动，应用程序使用和关键的身体参数）来实现合法佩戴者及其活动的持续识别和身份验证。通过研究各种用户群体的安全性和隐私偏好，这项研究将为这种新的可穿戴设备范式开发基于活动的访问控制工具。该项目的一个重要研究作用是开发自适应数据共享机制，以根据佩戴者的安全偏好，当前上下文和感知到的威胁，动态调节传感器数据的访问。这种机制将在提供全面访问（无安全性）和为每种访问权限（可用性差）做出手动决策之间，是一个很好的中间场所。该项目涉及行业合作者，以促进将研究成果采用到未来的设计和可穿戴设备的开发中。包括概念验证申请在内的研究结果将公开使用，以允许传播，早期采用和与课程集成。

项目成果

RandomPad: Usability of Randomized Mobile Keypads for Defeating Inference Attacks

• 发表时间: 2017
• 作者: Anindya Maiti;Kirsten Crager

Smartwatch-Based Keystroke Inference Attacks and Context-Aware Protection Mechanisms

• DOI: 10.1145/2897845.2897905
• 发表时间: 2016-05
• 期刊: Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security
• 作者: Anindya Maiti;Oscar Armbruster;Murtuza Jadliwala;Jibo He

Information Leakage through Mobile Motion Sensors: User Awareness and Concerns

通过移动运动传感器的信息泄露：用户意识和担忧

• 发表时间: 2017
• 期刊: Proceedings of the European Workshop on Usable Security (EuroUSEC
• 作者: Kirsten Crager, Anindya Maiti

Preventing shoulder surfing using randomized augmented reality keyboards

• DOI: 10.1109/percomw.2017.7917636
• 发表时间: 2017-03
• 期刊: 2017 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops)
• 作者: Anindya Maiti;Murtuza Jadliwala;Chase Weber

(Smart)watch your taps: side-channel keystroke inference attacks using smartwatches

• DOI: 10.1145/2802083.2808397
• 发表时间: 2015-09
• 期刊: Proceedings of the 2015 ACM International Symposium on Wearable Computers
• 作者: Anindya Maiti;Murtuza Jadliwala;Jibo He;Igor Bilogrevic