Factory Calibration Fingerprinting of Sensors

Device fingerprinting aims to generate a distinctive signature, or fingerprint, that uniquely identifies individual computing devices. Fingerprints may be a privacy concern since apps and websites can use them to track user activity online. To protect user privacy, both Android and iOS have included a variety of measures to prevent such tracking. In this paper we present a new type of fingerprinting, factory calibration fingerprinting, that bypasses existing tracking protection. Our attack recovers embedded per-device factory calibration data from the accelerometer, gyroscope, and magnetometer sensors that are pervasive in modern smartphones by careful analysis of the sensor output alone. We discuss the factory calibration behaviour of each sensor and show that the calibration fingerprint is fast to generate, does not change over time or after a factory reset, and can be used to track users across apps and websites without any special permission from the user. We find the calibration fingerprint is very likely to be globally unique for iOS devices, with an estimated 67 bits of entropy for the iPhone 6S. In addition, we have analysed 146 Android device models from 11 vendors and found the attack also works on recent Google Pixel devices. For Pixel 4/4 XL, we estimate the calibration fingerprint provides about 57 bits of entropy. Following our disclosures, Apple deployed a mitigation in iOS 12.2 and Google in Android 11. We analyse Apple's fix and show that the mitigation is imperfect although it is likely to be sufficient in most threat models.China Scholarship Counci

Inertial sensor-based knee flexion/extension angle estimation

A new method for estimating knee joint flexion/extension angles from segment acceleration and angular velocity data is described. The approach uses a combination of Kalman filters and biomechanical constraints based on anatomical knowledge. In contrast to many recently published methods, the proposed approach does not make use of the earth’s magnetic field and hence is insensitive to the complex field distortions commonly found in modern buildings. The method was validated experimentally by calculating knee angle from measurements taken from two IMUs placed on adjacent body segments. In contrast to many previous studies which have validated their approach during relatively slow activities or over short durations, the performance of the algorithm was evaluated during both walking and running over 5 minute periods. Seven healthy subjects were tested at various speeds from 1 to 5 miles/hour. Errors were estimated by comparing the results against data obtained simultaneously from a 10 camera motion tracking system (Qualysis). The average measurement error ranged from 0.7 degrees for slow walking (1 mph) to 3.4 degrees for running (5mph). The joint constraint used in the IMU analysis was derived from the Qualysis data. Limitations of the method, its clinical application and its possible extension are discussed

SensorID: Sensor calibration fingerprinting for smartphones

Sensors are an essential component of many computer systems today. Mobile devices are a good example, containing a vast array of sensors from accelerometers and GPS units, to cameras and microphones. Data from these sensors are accessible to application programmers who can use this data to build context-aware applications. Good sensor accuracy is often crucial, and therefore manufacturers often use per-device factory calibration to compensate for systematic errors introduced during manufacture. In this paper we explore a new type of fingerprinting attack on sensor data: calibration fingerprinting. A calibration fingerprinting attack infers the per-device factory calibration data from a device by careful analysis of the sensor output alone. Such an attack does not require direct access to any calibration parameters since these are often embedded inside the firmware of the device and are not directly accessible by application developers. We demonstrate the potential of this new class of attack by performing calibration fingerprinting attacks on the inertial measurement unit sensors found in iOS and Android devices. These sensors are good candidates because access to these sensors does not require any special permissions, and the data can be accessed via both a native app installed on a device and also by JavaScript when visiting a website on an iOS and Android device. We find we are able to perform a very effective calibration fingerprinting attack: our approach requires fewer than 100 samples of sensor data and takes less than one second to collect and process into a device fingerprint that does not change over time or after factory reset. We demonstrate that our approach is very likely to produce globally unique fingerprints for iOS devices, with an estimated 67 bits of entropy in the fingerprint for iPhone 6S devices. In addition, we find that the accelerometer of Google Pixel 2 and Pixel 3 devices can also be fingerprinted by our approach.The Boeing Company Nokia Bell Lab

Sub-mm observations and modelling of Vega type stars

We present new sub-mm observations and modelling of Vega excess stars, using realistic dust grain models. For resolved disks, we find that different objects require very different dust grain properties in order to simultaneously fit the image data and SED. Fomalhaut and Vega require solid dust grains, whilst HR4796 and HD141569 can only be fitted using porous grains. The older stars tend to have less porous grains than younger stars, which may indicate that collisions have compacted the dust grains. Eps Eri appears to be deficient in small dust grains compared to our best fitting model. This may be due to factors which affect the size distribution of grains close to the radiation pressure blowout limit. Alternatively, this discrepancy may be due to some external influence on the disk (e.g. a planet). When the model is applied to unresolved targets, an estimate of the disk size can be made. However, the large diversity in dust composition for the resolved disks means that we cannot make a reliable assumption as to the composition of the grains in an unresolved disk, and there is corresponding uncertainty in the disk size. In addition, the poor fit for Eps Eri shows that the model cannot always account for the SED even if the disk size is known. These two factors mean that it may not be possible to determine a disk's size without actually resolving it.Comment: 15 pages, 15 figures, accepted by MNRAS. Revised Eps Eri modelling to show larger range of minimum size cutoffs with porous grains, Figure

Debris disk size distributions: steady state collisional evolution with P-R drag and other loss processes

We present a new scheme for determining the shape of the size distribution, and its evolution, for collisional cascades of planetesimals undergoing destructive collisions and loss processes like Poynting-Robertson drag. The scheme treats the steady state portion of the cascade by equating mass loss and gain in each size bin; the smallest particles are expected to reach steady state on their collision timescale, while larger particles retain their primordial distribution. For collision-dominated disks, steady state means that mass loss rates in logarithmic size bins are independent of size. This prescription reproduces the expected two phase size distribution, with ripples above the blow-out size, and above the transition to gravity-dominated planetesimal strength. The scheme also reproduces the expected evolution of disk mass, and of dust mass, but is computationally much faster than evolving distributions forward in time. For low-mass disks, P-R drag causes a turnover at small sizes to a size distribution that is set by the redistribution function (the mass distribution of fragments produced in collisions). Thus information about the redistribution function may be recovered by measuring the size distribution of particles undergoing loss by P-R drag, such as that traced by particles accreted onto Earth. Although cross-sectional area drops with 1/age^2 in the PR-dominated regime, dust mass falls as 1/age^2.8, underlining the importance of understanding which particle sizes contribute to an observation when considering how disk detectability evolves. Other loss processes are readily incorporated; we also discuss generalised power law loss rates, dynamical depletion, realistic radiation forces and stellar wind drag.Comment: Accepted for publication by Celestial Mechanics and Dynamical Astronomy (special issue on EXOPLANETS

Accretion-related properties of Herbig Ae/Be stars. Comparison with T Tauris

We look for trends relating the mass accretion rate (Macc) and the stellar ages (t), spectral energy distributions (SEDs), and disk masses (Mdisk) for a sample of 38 HAeBe stars, comparing them to analogous correlations found for classical T Tauri stars. Our goal is to shed light on the timescale and physical processes that drive evolution of intermediate-mass pre-main sequence objects. Macc shows a dissipation timescale \tau = 1.3^{+1.0}_{-0.5} Myr from an exponential law fit, while a power law yields Macc(t) \propto t^{-\eta}, with \eta = 1.8^{+1.4}_{-0.7}. This result is based on our whole HAeBe sample (1-6 Msun), but the accretion rate decline most probably depends on smaller stellar mass bins. The near-IR excess is higher and starts at shorter wavelengths (J and H bands) for the strongest accretors. Active and passive disks are roughly divided by 2 x 10^{-7} Msun/yr. The mid-IR excess and the SED shape from the Meeus et al. classification are not correlated with Macc. We find Macc \propto Mdisk^{1.1 +- 0.3}. Most stars in our sample with signs of inner dust dissipation typically show accretion rates ten times lower and disk masses three times smaller than the remaining objects. The trends relating Macc with the near-IR excess and Mdisk extend those for T Tauri stars, and are consistent with viscous disk models. The differences in the inner gas dissipation timescale, and the relative position of the stars with signs of inner dust clearing in the Macc-Mdisk plane, could be suggesting a slightly faster evolution, and that a different process - such as photoevaporation - plays a more relevant role in dissipating disks in the HAeBe regime compared to T Tauri stars. Our conclusions must consider the mismatch between the disk mass estimates from mm fluxes and the disk mass estimates from accretion, which we also find in HAeBe stars.Comment: 11 pages, 7 figures, 1 appendix. Accepted in A&

Observational diagnostics of gas in protoplanetary disks

Protoplanetary disks are composed primarily of gas (99% of the mass). Nevertheless, relatively few observational constraints exist for the gas in disks. In this review, I discuss several observational diagnostics in the UV, optical, near-IR, mid-IR, and (sub)-mm wavelengths that have been employed to study the gas in the disks of young stellar objects. I concentrate in diagnostics that probe the inner 20 AU of the disk, the region where planets are expected to form. I discuss the potential and limitations of each gas tracer and present prospects for future research.Comment: Review written for the proceedings of the conference "Origin and Evolution of Planets 2008", Ascona, Switzerland, June 29 - July 4, 2008. Date manuscript: October 2008. 17 Pages, 6 graphics, 134 reference

Nonlinear Model Predictive Control for heterogeneous process models in water resources

10.3182/20110828-6-IT-1002.02858IFAC Proceedings Volumes (IFAC-PapersOnline)18PART 110565-1057