CRII: SaTC: Towards Understanding Typing Privacy: Vulnerabilities and Protection

打字无处不在，在人与计算机设备的交互中扮演着重要的角色。新出现的工作已经确定了一类可以以非侵入性方式窃听键盘敲击的攻击，而无需预先用恶意软件感染目标计算机。它们共同的基本原则是，按下键盘上的一个键会对该键产生微妙的环境影响，这种影响可以在所有键上观察到并相互关联。然而，这些技术需要一个训练阶段来建立观察到的环境变化和按特定键的动作之间的关系。这样的训练阶段对于大多数攻击场景来说是不切实际的。该项目确定了一种无需训练阶段的新型非侵入式击键推断技术。该项目的目标是系统地利用与通过键盘打字过程相关的副作用，了解新的安全威胁，并设计有效的防御机制来应对此类攻击。本研究将开发一种新型的输入隐私推断技术，针对现实场景中的各种输入，如字母和数字，并建立相应的防御措施，以保护输入隐私免受这些击键窃听攻击。这项计划将有助深入了解打字私隐泄露所带来的保安风险，并大大改善各电脑系统的键盘界面的保安。这项研究的结果将被公开分享。该项目还将为研究生和本科生提供获得安全和隐私领域研究经验的机会。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Typing is ubiquitous and plays a significantly important role in the interaction between humans and computer devices. Emerging work has identified a class of attacks that can eavesdrop keystrokes in a non-invasive way without pre-infecting the target computer with malware. Their common underlying principle is that pressing a key on a keyboard causes subtle environmental impacts unique to that key, which can be observed and correlated for all keys. However, those techniques require a training phase to establish the relationship between an observed environmental change and the action of pressing a specific key. Such a training phase is impractical for most attack scenarios. This project identifies a new type of non-invasive keystroke inference technique without requiring the training phase. The goal of this project is to systematically exploit the side effects associated with the typing process via a keyboard, understand new security threats, and design effective defense mechanisms against such attacks.This research will develop a novel type of typing privacy inference technique targeting various input such as letters and numbers in real-world scenarios and build corresponding defenses to protect typing privacy against those keystroke eavesdropping attacks. The project will provide a much-needed insight into the security risks of typing privacy disclosure, and also substantially improve the security of various computer systems with keyboard interfaces. The results from this research will be openly shared. This project will also offer graduate and undergraduate students opportunities to gain research experience in security and privacy areas.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.