Shake well before use: Authentication based on Accelerometer Data

Small, mobile devices without user interfaces, such as Bluetooth headsets, often need to communicate securely over wireless networks. Active attacks can only be prevented by authenticating wireless communication, which is problematic when devices do not have any a priori information about each other. We introduce a new method for device-to-device authentication by shaking devices together. This paper describes two protocols for combining cryptographic authentication techniques with known methods of accelerometer data analysis to the effect of generating authenticated, secret keys. The protocols differ in their design, one being more conservative from a security point of view, while the other allows more dynamic interactions. Three experiments are used to optimize and validate our proposed authentication method

Exploring Bluetooth based Mobile Phone Interaction with the Hermes Photo Display

One of the most promising possibilities for supporting user interaction with public displays is the use of personal mobile phones. Furthermore, by utilising Bluetooth users should have the capability to interact with displays without incurring personal financial connectivity costs. However, despite the relative maturity of Bluetooth as a standard and its widespread adoption in today’s mobile phones, little exploration seems to have taken place in this area - despite its apparent significant potential. This paper describe the findings of an exploratory study nvolving our Hermes Photo Display which has been extended to enable users with a suitable phone to both send and receive pictures over Bluetooth. We present both the technical challenges of working with Bluetooth and, through our user study, we present initial insights into general user acceptability issues and the potential for such a display to facilitate notions of community

HandiVote: simple, anonymous, and auditable electronic voting

We suggest a set of procedures utilising a range of technologies by which a major democratic deficit of modern society can be addressed. The mechanism, whilst it makes limited use of cryptographic techniques in the background, is based around objects and procedures with which voters are currently familiar. We believe that this holds considerable potential for the extension of democratic participation and control

Kaistan ulkopuolisten todennuskanavien arviointi

One of the challenges in entirely wireless communication systems is authentication. In pervasive computing and peer-to-peer networks, it is often not possible to rely on the existence of a trusted third party or other infrastructure. Therefore, ad hoc verification of keys via an out-of-band (OOB) channel is often the only way to achieve authentication. Nimble out-of-band for EAP (EAP-NOOB) protocol is intended for bootstrapping security between IoT devices with no provisioned authentication credentials and minimal user interface. The protocol supports a user-assisted OOB channel to mutually authenticate the key-exchange performed over an insecure wireless network between the peer and the server. The protocol allows peers to scan for available networks and, based on the results, generate multiple dynamic OOB messages. The user then delivers one of these messages to the server to register the device and authenticate the key-exchange. We implemented the OOB channels using NFC, QR codes and sound with EAP-NOOB as the bootstrapping protocol. The implementation requires an auxiliary device such as the user's smartphone. We evaluated the usability and security as well as the benefits and limitations of the OOB channels. Our results show that NFC and QR codes are capable in displaying multiple OOB messages while the sound-based channel is suitable for one or two messages due to its lower bandwidth. When the peer device generates multiple OOB messages, the process becomes more complex for the user who needs to browse through them and identify the correct server. However, we showed that this cumbersome step can be removed with the help of a mobile application. Furthermore, we identified vulnerabilities in each technology when used as an OOB channel. While some of these vulnerabilities can be mitigated with the mobile application, some require more refined solutions.Yksi täysin langattomien järjestelmien haasteista on todennus. Sulautetussa tietotekniikassa sekä vertaisverkkoissa ei usein voida luottaa maailmanlaajuisesti luotettavan kolmannen osapuolen olemassaoloon. Siksi salausavainten ad hoc-varmennus erillistä tiedonsiirtokanavaa (OOB) käyttäen on usein ainoa ratkaisu turvallisen kommunikaation käynnistämiseksi. Se luo resilienssiä eri hyökkäyksiä vastaan tuomalla järjestelmään toisen, itsenäisen tiedonsiirtokanavan. EAP-NOOB protokolla on tarkoitettu IoT-laitteille, joilla on minimaalinen käyttöliittymä eikä esiasennettuja avaimia. EAP-NOOB tukee käyttäjäavustettua OOB-tiedonsiirtokanavaa, jota käytetään todentamaan suojaamattomassa verkossa suoritettu laitteen ja palvelimen keskinäinen salausavainten vaihto. Protokolla sallii laitteiden kartoittaa käytettävissä olevia verkkoja ja tuottaa sen perusteella dynaamisia todennusviestejä, jotka käyttäjä toimittaa palvelimelle laitteen rekisteröimiseksi. Tässä työssä tutkittiin EAP-NOOB protokollan OOB kanavaa käyttäen NFC:tä, QR-koodeja ja ääntä. Todennusviestin lukeminen laitteelta vaatii käyttäjältä älypuhelimen. Työssä arvioitiin toteutettujen todennuskanavien käytettävyyttä, tietoturvaa, hyötyjä sekä näitä rajoittavia tekijöitä. Työn tulokset osoittavat, että NFC ja QR-koodit soveltuvat näyttämään useita OOB-viestejä. Sen sijaan äänipohjainen kanava soveltuu vain yhdelle tai kahdelle viestille hitaamman tiedonsiirron johdosta. Kun IoT-laite tuottaa useita OOB-viestejä, käyttäjäkokemus muuttuu monimutkaisemmaksi, koska käyttäjän on tunnistettava oikea viesti ja palvelin. Työssä osoitetaan, että tämä käyttäjälle hankala vaihe voidaan välttää erillisellä mobiilisovelluksella. Lisäksi työssä tunnistettiin toteutettujen tiedonsiirtomenetelmien haavoittuvuuksia, kun niitä käytettiin OOB-kanavana. Vaikka osa näistä haavoittuvuuksista voidaan eliminoida mobiilisovelluksen avulla, jotkut niistä vaativat tehokkaampia ratkaisuja

Intelligent Remote Monitoring and Management system for Type1 Diabetes

The work presented in this thesis focuses on developing a telemedicine system for better management of type1 diabetes in children and teenagers. The research and development of the system is motivated by the inadequate communication in the current system of management of the disease, which results in non-compliance of patients following the regimen. This non-compliance generally results in uncontrolled blood glucose levels, which can result in hypoglycaemia, hyperglycaemia and later life health complications. This further results in an increase in health care costs. In this context, the thesis presents a novel end-to-end, low cost telemedicine system, WithCare+, developed in close collaboration between the University of Sheffield (Electronics & Electrical Engineering) and Sheffield Children’s Hospital. The system was developed to address the challenges of implementing modern telemedicine in type 1 diabetic care with particular relevance to National Health Service children’s clinics in the United Kingdom, by adopting a holistic care driven approach (involving all stakeholders) based on specific key enabler technologies such as low cost and reconfigurable design. However, one of the major issues with current telemedicine system is non-compliance of the patients due to invasive procedure of the glucose measurement which could be clearly addressed by non-invasive method of glucose measurement. Hence, the thesis also makes a contribution towards non-invasive glucose measurement using Near Infrared spectroscopy in terms of addressing the calibration challenge; two methods are proposed to improve the calibration of the Near Infrared instrument. The first method combines locally weighted regression and partial least square regression and the second method combines digital band pass filtering with support vector regression. The efficacy of the proposed methods is validated in experiments carried out in a non-controlled environment and the results obtained demonstrate that the proposed methods improved the performance of the calibration model in comparison to traditional calibration techniques such as Principal Component Regression and Partial Least Squares regression

NFC and mobile payments today

Tese de mestrado em Segurança Informática, apresentada à Universidade de Lisboa, através da Faculdade de Ciências, 2011NFC (Near Field Communication) e pagamentos móveis são duas áreas que se tornaram muito populares ultimamente, ambas duplicaram o seu índice de volume de pesquisas medido pelo Google Trends no último ano. NFC é uma tecnologia de comunicação sem fios já disponível em alguns telemóveis, sendo que mais estão anunciados para breve, e os pagamentos móveis são um serviço cuja utilização se espera que cresça a um ritmo bastante acelerado nos próximos anos. Este crescimento já foi previsto antes, e as expectativas saíram goradas, mas pensa-se que a NFC seja a tecnologia que vai trazer os pagamentos móveis às massas. Esta tese foca-se nestas duas áreas e em como a NFC pode ser útil num protocolo para executar pagamentos móveis nos dias de hoje. Para isto, um novo protocolo chamado mTrocos é apresentado. Este possui várias características desejáveis tais como anonimato, alta segurança, boa usabilidade, a não dependência de bancos ou instituições financeiras tradicionais, o suporte para micro-pagamentos e não requer nenhum hardware especial. O seu desenho é baseado no conceito de dinheiro digital e em protocolos de estabelecimento de chaves ad-hoc. Estes últimos são úteis visto que a NFC é um meio sem fios que não oferece nenhuma segurança de raiz para além do seu curto alcance. É detalhada uma prova de conceito da implementação usando um telefone com o sistema operativo Android e um leitor NFC de secretária, provando que ela funciona usando apenas hardware comum disponível actualmente. No entanto, a API (Application Programming Interface) de NFC do Android revelou-se limitada, o que influenciou o desenho do mTrocos, e o impediu de fazer uso apenas da NFC para a troca das suas mensagens. Como parte da avaliação do protocolo, foram feitos testes com utilizadores que mostram que o mTrocos é fácil de usar e que é indicado para o cenário pensado: máquinas de venda automática. Outra conclusão a que se pode chegar é que a NFC é uma tecnologia que melhora a experiência de utilização e que vai ser de grande utilidade para o crescimento dos pagamentos móveis.NFC (Near Field Communication) and mobile payments are two areas that have received a significant amount of attention lately. NFC is a wireless communication technology already available on some mobile phones, with more to come in the near future, and mobile payments are a service whose usage is expected to grow at a significant rate in the coming years. This growth has been predicted before, and expectations have been let down, but NFC is thought to be the technology that will bring mobile payments to the masses. This thesis is focused on these two areas and how NFC can be of use in a protocol to conduct mobile payments. For this, a new protocol called mTrocos is presented that possesses several desirable characteristics such as anonymity, high security, good usability, unbanked, support for micropayments and no special hardware requirements. Its design is based on digital money concepts and ad-hoc key establishment protocols. The latter are useful because NFC is a wireless medium and offers no built-in security other than its limited range. A proof-of-concept implementation with an Android phone and a desktop NFC reader is detailed, proving that it works using only commodity equipment currently available. However, Android’s NFC API (Application Programming Interface) was found to be limited, which influenced the design of mTrocos, preventing it from relying only on NFC for the exchange of the messages. As part of the protocol’s evaluation, user tests were conducted which show that mTrocos is easy to use and that it is suited to the envisaged scenario: vending machines. Another conclusion is that NFC is a technology that improves the user experience and will be of great help for the growth of mobile payments

A proof-of-proximity framework for device pairing in ubiquitous computing environments

Ad hoc interactions between devices over wireless networks in ubiquitous computing environments present a security problem: the generation of shared secrets to initialize secure communication over a medium that is inherently vulnerable to various attacks. However, these ad hoc scenarios also offer the potential for physical security of spaces and the use of protocols in which users must visibly demonstrate their presence and/or involvement to generate an association. As a consequence, recently secure device pairing has had significant attention from a wide community of academic as well as industrial researchers and a plethora of schemes and protocols have been proposed, which use various forms of out-of-band exchange to form an association between two unassociated devices. These protocols and schemes have different strengths and weaknesses – often in hardware requirements, strength against various attacks or usability in particular scenarios. From ordinary user‟s point of view, the problem then becomes which to choose or which is the best possible scheme in a particular scenario. We advocate that in a world of modern heterogeneous devices and requirements, there is a need for mechanisms that allow automated selection of the best protocols without requiring the user to have an in-depth knowledge of the minutiae of the underlying technologies. Towards this, the main argument forming the basis of this dissertation is that the integration of a discovery mechanism and several pairing schemes into a single system is more efficient from a usability point of view as well as security point of view in terms of dynamic choice of pairing schemes. In pursuit of this, we have proposed a generic system for secure device pairing by demonstration of physical proximity. Our main contribution is the design and prototype implementation of Proof-of-Proximity framework along with a novel Co- Location protocol. Other contributions include a detailed analysis of existing device pairing schemes, a simple device discovery mechanism, a protocol selection mechanism that is used to find out the best possible scheme to demonstrate the physical proximity of the devices according to the scenario, and a usability study of eight pairing schemes and the proposed system