Novel Physical Protection of Personal Mobile Assets

点击翻译按钮获取中文摘要

The design of physical security for smartphones and other mobile devices dates back to the first smartphones introduced more than 12 years ago, when they were intended to be little more than music players with calling capabilities and a more usable user interface. At that time, just a PIN (now known more generally as "passcode") was good enough to play music and make phone calls. Smartphones and other mobile devices are used these days for much more than that. A growing body of empirical evidence suggests that the physical security and privacy of mobile devices is not good enough any more. Smartphone apps have widely varying levels of sensitivity, yet unlocking the device is still necessary and sufficient for launching most of the apps. This all-or-nothing role of unlocking results in unnecessarily high overhead for accessing low-sensitivity apps (e.g., public information retrieval apps, such as weather, Wikipedia, IMDB) on the one hand, and insufficient security of high-sensitivity apps (e.g., financial, dating, medical, messaging) on the other hand. Smartphones and other mobile devices are commonly shared with others, yet the access control mechanisms support only single-user model, in which whoever unlocks the phone has access to its apps, data, and services. Snooping on mobile device by social insiders has been established as a real threat, which cannot be ignored. Yet, passcode (easily shoulder-surfed by social insiders) remains the primary authentication mechanism, knowledge of which is sufficient not only to unlock the device but also to change any settings on it. It's prime time to rethink physical security for mobile devices, particularly smartphones. I propose to explore the design space for improving physical security and privacy of mobile devices. My proposed research program for the next five years comprises investigation in systems design as well as human and social aspects of privacy and security. Together with the graduate students from my research group as well as my industry and academic collaborators, I will explore and evaluate alternative designs that support secure and usable device sharing, optimize usability and security in the context of apps and services of varying degrees of sensitivity, and address the threat of social insider.