Biblio

Context-based zero-interaction has become the trend for smart IoT device pairing. In this paper, we propose a secure and usable mechanism to authenticate devices co-located in smart home scenario, and build a secure communication channel between legitimate devices by utilizing on-board microphones to capture a common audio context. After receiving randomly generated sound signals, smart IoT device uses the time intervals between salient sound signals to derive audio fingerprint which can be matched among co-present devices and then be used to bootstrap trust of the devices. The protocol is based on the idea that devices co-located within a physical security boundary (e.g., single family house) can hear similar sounds, and the devices outside would miss parts of sound signals due to the attenuation when sounds pass through the wall. To accelerate the generation rate of audio fingerprint, an extra sound source is introduced. We implement our protocol on Android devices, and the experiment results show that the protocol can distinguish the malicious devices outside from the legitimate devices located inside a security boundary and can quickly establish a strong secret-key between legitimate devices.

Securely pairing wearables with another device is the key to many promising applications, such as mobile payment, sensitive data transfer and secure interactions with smart home devices. This paper presents Touch-And-Guard (TAG), a system that uses hand touch as an intuitive manner to establish a secure connection between a wristband wearable and the touched device. It generates secret bits from hand resonant properties, which are obtained using accelerometers and vibration motors. The extracted secret bits are used by both sides to authenticate each other and then communicate confidentially. The ubiquity of accelerometers and motors presents an immediate market for our system. We demonstrate the feasibility of our system using an experimental prototype and conduct experiments involving 12 participants with 1440 trials. The results indicate that we can generate secret bits at a rate of 7.84 bit/s, which is 58% faster than conventional text input PIN authentication. We also show that our system is resistant to acoustic eavesdroppers in proximity.