TWC: Small: Secure Mobile Devices through Multiple Lines of Defense

人类社会正处于一个无线和移动的时代。人们在享受移动设备带来的高品质生活的同时，也面临着越来越多的网络威胁。因此，迫切需要为移动设备开发安全和可用的保护机制。本提案概述了一项具有挑战性的研究计划，旨在开发、实施和评估针对移动设备新攻击的安全和可用对策。拟议研究的科学承诺将扩大对移动设备安全的基本理解。所提出的技术的成功开发和实施将对移动设备的安全使用产生深远的影响，从而显著提高美国和世界各地移动用户的信息安全。拟议的研究包括四个重点。第一个重点是开发安全和可用的防御视频辅助击键推断攻击，攻击者可以通过在用户输入过程中记录和分析设备背面的视频来推断用户在触摸屏上的输入。第二个重点是针对电源辅助应用推断攻击开发安全和可用的防御措施，攻击者通过受感染的应用侵入受害者的移动设备，然后访问设备的电源配置文件。第三个重点是开发安全可用的设备丢失/盗窃防御措施，一旦移动设备离开其所有者附近，就会自动锁定设备。提出的防御的关键思想是，通过检测和分析无线信号的变化，让移动设备自动、快速、准确地识别其与所有者的物理分离。最后一个要点是实现和评估发现的攻击和建议的防御。实施和评估将在智能手机、平板电脑、笔记本电脑和通用软件无线电外设平台上进行。

The human society is in a wireless and mobile era. People are enjoying quality life brought by mobile devices while subject to growing cyber threats. There is thus a pressing need to develop secure and usable protection mechanisms for mobile devices. This proposal outlines a challenging research plan on developing, implementing, and evaluating secure and usable countermeasures against new attacks on mobile devices. The scientific promise of the proposed research will expand the fundamental understandings about mobile device security. Successful development and implementations of the proposed techniques will have profound impact on secure mobile device usage, thus significantly improving the information security of mobile users in U.S. and around the world.The proposed research consists of four thrusts. The first thrust is to develop secure and usable defenses against video-assisted keystroke inference attacks in which an attacker can infer a user's typed inputs on the touchscreen by recording and analyzing the video of the device backside during the user's input process. The second thrust is to develop secure and usable defenses against power-assisted app inference attacks where an attacker intrudes the victim's mobile device through an infected app and then accesses the power profile of the device. The third thrust is to develop secure and usable defenses against device losses/thefts, which automatically lock a mobile device once it leaves the vicinity of its owner. The key idea of the proposed defenses is to let a mobile device automatically, quickly, and accurately recognize its physical separation from its owner by detecting and analyzing the changes in wireless signals. The last thrust is to implement and evaluate the discovered attacks and proposed defenses. The implementation and evaluation will be conducted on smartphones, tablets, laptops, and Universal Software Radio Peripheral platforms.