Human errors in performing security-critical tasks are typically blamed on the complexity of those tasks. However, such errors can also occur because of (possibly unexpected) sensory distractions. A sensory distraction that produces negative effects can be abused by the adversary that controls the environment. Meanwhile, a distraction with positive effects can be artificially introduced to improve user performance. The goal of this work is to explore the effects of visual stimuli on the performance of security-critical tasks. To this end, we experimented with a large number of subjects who were exposed to a range of unexpected visual stimuli while attempting to perform Bluetooth Pairing. Our results clearly demonstrate substantially increased task completion times and markedly lower task success rates. These negative effects are noteworthy, especially, when contrasted with prior results on audio distractions which had positive effects on performance of similar tasks. Experiments were conducted in a novel (fully automated and completely unattended) experimental environment. This yielded more uniform experiments, better scalability and significantly lower financial and logistical burdens. We discuss this experience, including benefits and limitations of the unattended automated experiment paradigm.
@cite_15 performed the first usability study of Bluetooth pairing techniques using SAS. It determined that the compare-and-confirm" method -- which involves the user comparing two 4-to-6-digit decimal numbers and indicating a match or lack thereof -- was the most accurate and usable approach.
@cite_15
2148165512 1644895716 2170108541 2040213547 2563417884 2096768518 2026968296 2135021336 2968588162 2508195202 2134512786 2166007208 1999153225 1990815658 2136266535 2143554828 2031481606 2061719810 2900294995 15257636
Secure Device Pairing is the bootstrapping of secure communication between two previously unassociated devices over a wireless channel. The human-imperceptible nature of wireless communication, lack of any prior security context, and absence of a common trust infrastructure open the door for Man-in-the-Middle (aka Evil Twin) attacks. A number of methods have been proposed to mitigate these attacks, each requiring user assistance in authenticating information exchanged over the wireless channel via some human-perceptible auxiliary channels, e.g., visual, acoustic or tactile. In this paper, we present results of the first comprehensive and comparative study of eleven notable secure device pairing methods. Usability measures include: task performance times, ratings on System Usability Scale (SUS), task completion rates, and perceived security. Study subjects were controlled for age, gender and prior experience with device pairing. We present overall results and identify problematic methods for certain classes of users as well as methods best-suited for various device configurations. As the proliferation of pervasive and ubiquitous computing devices continues, users will carry more devices. Without the ability for these devices to unobtrusively interact with one another, the user’s attention will be spent on coordinating, rather than using, these devices. We present a method to determine if two devices are carried by the same person, by analyzing walking data recorded by low-cost MEMS accelerometers using the coherence function, a measure of linear correlation in the frequency domain. We also show that these low-cost sensors perform similarly to more expensive accelerometers for the frequency range of human motion, 0 to 10Hz. We also present results from a large test group illustrating the algorithm’s robustness and its ability to withstand real world time delays, crucial for wireless technologies like Bluetooth and 802.11. We present results that show that our technique is 100 accurate using a sliding window of 8 seconds of data when the devices are carried in the same location on the body, is tolerant to inter-device communication latencies, and requires little communication bandwidth. In addition we present results for when devices are carried on different parts of the body. The rapid development of mobile Internet has offered the opportunity for WiFi indoor positioning to come under the spotlight due to its low cost. However, nowadays the accuracy of WiFi indoor positioning cannot meet the demands of practical applications. To solve this problem, this paper proposes an improved WiFi indoor positioning algorithm by weighted fusion. The proposed algorithm is based on traditional location fingerprinting algorithms and consists of two stages: the offline acquisition and the online positioning. The offline acquisition process selects optimal parameters to complete the signal acquisition, and it forms a database of fingerprints by error classification and handling. To further improve the accuracy of positioning, the online positioning process first uses a pre-match method to select the candidate fingerprints to shorten the positioning time. After that, it uses the improved Euclidean distance and the improved joint probability to calculate two intermediate results, and further calculates the final result from these two intermediate results by weighted fusion. The improved Euclidean distance introduces the standard deviation of WiFi signal strength to smooth the WiFi signal fluctuation and the improved joint probability introduces the logarithmic calculation to reduce the difference between probability values. Comparing the proposed algorithm, the Euclidean distance based WKNN algorithm and the joint probability algorithm, the experimental results indicate that the proposed algorithm has higher positioning accuracy. Over the last years, many different methods have been proposed for indoor localization and navigation services based on Radio frequency (RF) technology and Radio Signal Strength Indicator (RSSI). The accuracy achieved with such systems is typically low, mainly due to the variability of RSSI values, unsuitable for classic localization methods (e.g. triangulation). In this paper, we propose a novel approach based on multiple neural networks. We demonstrate with experimental results that by training and then activating different neural networks, tailored on the user orientation, high definition accuracy is achievable, allowing indoor navigation with a cost effective Bluetooth (BT) architecture. This study investigated the impact of Bluetooth Low Energy devices in advertising beaconing mode on fingerprint-based indoor positioning schemes. Early experimentation demonstrated that the low bandwidth of BLE signals compared to WiFi is the cause of significant measurement error when coupled with the use of three BLE advertising channels. The physics underlying this behaviour is verified in simulation. A multipath mitigation scheme is proposed and tested. It is determined that the optimal positioning performance is provided by 10Hz beaconing and a 1 second multipath mitigation processing window size. It is determined that a steady increase in positioning performance with fingerprint size occurs up to 7 ±1, above this there is no clear benefit to extra beacon coverage. A fairly common modern setting entails users, each in possession of a personal wireless device, wanting to communicate securely, via their devices. If these users (and their devices) have no prior association, a new security context must be established. In order to prevent potential attacks, the initial context (association) establishment process must involve only the intended devices and their users. A number of methods for initial secure association of two devices have been proposed; their usability factors have been explored and compared extensively. However, a more challenging problem of initial secure association of a group of devices (and users) has not received much attention. Although a few secure group association methods have been proposed, their usability aspects have not been studied, especially, in a comparative manner. This paper discusses desirable features and evaluation criteria for secure group association, identifies suitable methods and presents a comparative usability study. Results show that some simple methods (e.g., peer- or leader-based number comparisons) are quite attractive for small groups, being fast, reasonably secure and well-received by users. Background: We investigate direct use of 802.15.4 radio signal strength indication (RSSI) for human activity recognition when 1) a user carries a wireless node (device-bound) and when 2) a user moves in the wireless sensor net (WSN) without a WSN node (device-free). We investigate recognition feasibility in respect to network topology, subject and room geometry (door open, half, closed). Methods: In a 2 person office room 8 wireless nodes are installed in a 3D topology. Two subjects are outfitted with a sensor node on the hip. Acceleration and RSSI are recorded while subject performs 6 different activities or room is empty. We apply machine learning for analysis and compare our results to acceleration data. Results: 10-fold cross-validation with all nodes gives accuracies of 0.896 (device-bound), 0.894 (device-free) and 0.88 (accelerometer). Topology investigation reveals that similar accuracies may be reached with only 5 (device-bound) or 4 (device-free) selected nodes. Applying trained data from one subject to the other and vice-versa shows higher recognition difference on RSSI than on acceleration. Changing of door state has smaller effect on both systems than subject change; with least impact when door is closed. Conclusion: 802.15.4 RSSI suited for activity recognition. 3D topology is helpful in respect to type of activities. Discrimination of subjects seems possible. Practical systems must adapt no only to long-term environmental dispersion but consider typical geometric changes. Adaptable, robust recognition models must be developed. We provide an elaborate discussion on Bluetooth signal parameters with respect to localization, whereby we collectively designate all types of Bluetooth specification parameters that are related to signal strength - such as RSSI, Link Quality, Received and Transmit Power Level - as Bluetooth signal, parameters. According to our analysis and experimental results, "RSSI" and "Transmit Power Level" turn out to be poor candidates for localization, while "Link Quality" has its limitations. On the other hand, "Received Power Level" correlates nicely with distance, which makes it the most desirable Bluetooth signal parameter to be used in location systems. We contend that it is vital to choose the appropriate signal parameter in Bluetooth location systems, and we expect our work to provide useful pointers in any future design of such systems. Existing systems can also benefit by adopting the appropriate Bluetooth signal parameter in their systems, and thereby, improve their location accuracy. Fingerprinting techniques, which are a common method for indoor localization, have been recently applied with success into outdoor settings. Particularly, the communication signals of Low Power Wide Area Networks (LPWAN) such as Sigfox, have been used for localization. In this rather recent field of study, not many publicly available datasets, which would facilitate the consistent comparison of different positioning systems, exist so far. In the current study, a published dataset of RSSI measurements on a Sigfox network deployed in Antwerp, Belgium is used to analyse the appropriate selection of preprocessing steps and to tune the hyperparameters of a kNN fingerprinting method. Initially, the tuning of hyperparameter k for a variety of distance metrics, and the selection of efficient data transformation schemes, proposed by relevant works, is presented. In addition, accuracy improvements are achieved in this study, by a detailed examination of the appropriate adjustment of the parameters of the data transformation schemes tested, and of the handling of out of range values. With the appropriate tuning of these factors, the achieved mean localization error was 298 meters, and the median error was 109 meters. To facilitate the reproducibility of tests and comparability of results, the code and train validation test split used in this study are available. During the last decades, location based services have become very popular and the developed indoor positioning systems have achieved an impressive accuracy. The problem though is that even if the only requirement is room-level localization, those systems are most of the times not cost-efficient and not easy to set-up, since they often require time-consuming calibration procedures. This paper presents a low-cost, threshold-based approach and introduces an algorithm that takes into account both the Received Signal Strength Indication (RSSI) of the Bluetooth Low Energy (BLE) beacons and the geometry of the rooms the beacons are placed in. Performance evaluation was done via measurements in an office environment composed of three rooms and in a house environment composed of six rooms. The experimental results show an improved accuracy in room detection when using the proposed algorithm, compared to when only considering the RSSI readings. This method was developed to provide context awareness to the international research project named SmartHeat. The projects aims to provide a system that efficiently heats a house, room by room, based on the habitants' habits and preferences. Text entry user interfaces have been a bottleneck of non traditional computing devices. One of the promising methods is the virtual keyboard on touch screens. Various layouts have been manually designed to replace the dominant QWERTY layout. This paper presents two computerized quantitative design techniques to search for the optimal virtual keyboard. The first technique simulated the dynamics of a keyboard with “digraph springs” between keys, which produced a “Hooke’s” keyboard with 41.6 wpm performance. The second technique used a Metropolis random walk algorithm guided by a “Fitts energy” objective function, which produced a “Metropolis” keyboard with 43.1 wpm performance. The paper also models and evaluates the perfo rmance of four existing keyboard layouts. We corrected erroneous estimates in the literature and predicted the performance of QWERTY, CHUBON, FITALY, OPTI to be in the neighborhood of 30, 33, 36 and 38 wpm respectively. Our best design was 40 faster than QWERTY and 10 faster than OPTI, illustrating the advantage of quantitative user interface design techniques based on models of human performance over traditional trial and error designs guided by heuristics. We present a method for performing fault localization using similar program spectra. Our method assumes the existence of a faulty run and a larger number of correct runs. It then selects according to a distance criterion the correct run that most resembles the faulty run, compares the spectra corresponding to these two runs, and produces a report of "suspicious" parts of the program. Our method is widely applicable because it does not require any knowledge of the programinput and no more information from the user than a classification of the runs as either "correct" or "faulty". To experimentally validate the viability of the method, we implemented it in a tool, WHITHER using basic block profiling spectra. We experimented with two different similarity measures and the Siemens suite of 132 programs with injected bugs. To measure the success of the tool, we developed a generic method for establishing the quality of a report. The method is based on the way an "ideal user" would navigate the program using the report to save effort during debugging. The best results we obtained were, on average, above 50 , meaning that our ideal user would avoid looking at half of the program. Since humans are fundamentally social beings and interact frequently with others in their daily life, understanding social context is of primary importance in building context-aware applications. In this paper, using smartphone Bluetooth as a proximity sensor to create social networks, we present a probabilistic approach to mine human interaction types in real life. Our analysis is conducted on Bluetooth data continuously sensed with smartphones for over one year from 40 individuals who are professionally or personally related. The results show that the model can automatically discover a variety of social contexts. We objectively validated our model by studying its predictive and retrieval performance. We implemented the Prediction-by-Partial-Match data compression algorithm as a predictor of future locations. Positioning was done using IEEE 802.11 wireless access logs. Several experiments were run to determine how to divide the data for training and testing and how to best represent the data as a string of symbols. Our test data consisted of 198 datasets containing over 28,000 pairs, obtained from the UCSD Wireless Topology Discovery project. Tests of a first-order PPM model revealed a 90 success rate in predicting a user's location given the time. The third-order model, which is given the previous time and location and asked to predict the location at a given time, is correct 92 of the time. We consider the joint optimization of beamformers and linear receivers in a MIMO interference network. Each transmitter transmits a single beam corresponding to a rank-one precoder. When the number of users K is greater than the number of antennas at each terminal N, the maximum degrees of freedom is achieved via spatial interference alignment. Interference alignment is feasible for up to K = 2N−1 users, in which case there is a finite number of solutions to the alignment conditions. This number of solutions increases rapidly with N, and the solutions depend only on the cross-channel coefficients (i. e., they are independent of the direct channels). To maximize the achievable sum rate at high SNRs we therefore wish to select an aligned solution which is best matched to the direct channels. We evaluate the performance of this scheme for large K and N, assuming that the solution is the best out of a random subset of aligned solutions. We then compare numerically this performance with the performance of previously proposed numerical (e. g., forward-backward) techniques for optimizing beams, and a new technique which tracks the local optimum as the SNR is incrementally increased, similar to a homotopy method for improving convergence properties. We observe that the incremental technique typically achieves better performance than the previously proposed methods. We introduce a system for sensing complex social systems with data collected from 100 mobile phones over the course of 9 months. We demonstrate the ability to use standard Bluetooth-enabled mobile telephones to measure information access and use in different contexts, recognize social patterns in daily user activity, infer relationships, identify socially significant locations, and model organizational rhythms. Solutions for pairing devices without prior security associations typically require users to actively take part in the pairing process of the devices. Scenarios involving new types of devices like Internet-of-Things (IoT) appliances and wearable devices make it, however, desirable to be able to pair users' personal devices without user involvement. In this paper, we present a new approach for secure zero-interaction pairing suitable for IoT and wearable devices. We primarily require pairing to happen between "correct" devices -- the devices that the user intends to pair. Our pairing scheme identifies the correct devices based on measuring sustained co-presence over time. We do this by having the devices compute a fingerprint of their ambient context using information gathered through commonly available sensor modalities like ambient noise and luminosity. We introduce a novel robust and inexpensive approach for fingerprinting contexts over time. Co-present devices will observe roughly similar context fingerprints that we use in a key evolution protocol to gradually increase the confidence in the authenticity of the correct devices. Our experiments show the effectiveness of this approach for zero-interaction pairing. In this paper, we present the first study on this new security issue, which we call external Device Mis-Bonding or DMB, under the context of Bluetooth-enabled Android devices. Our research shows that this problem is both realistic and serious: oftentimes an unauthorized app can download sensitive user data from an Android device and also help the adversary to deploy a spoofed device that injects fake data into the original device’s official app on the phone. Specifically, we performed an in-depth analysis on four popular health medical devices that collect sensitive user information and successfully built end-toend attacks that stealthily gathered sensitive user data and fed arbitrary information into the user’s health medical account, using nothing but Bluetooth permissions and public information disclosed by the phone. Our further study of 68 relevant deviceusing apps from Google Play confirms that the vast majority of the devices on the market are vulnerable to this new threat. To defend against it, we developed the first OS-level protection, called Dabinder. Our approach automatically generates secure bonding policies between a device and its official app, and enforces them when an app attempts to establish Bluetooth connections with a device and unpair the phone from the device (for resetting the Bluetooth link key). Our evaluation shows that this new technique effectively thwarts the DMB attacks and incurs only a negligible impact on the phone’s normal operations. Positioning is an essential element in most Internet of Things (IoT) applications. Global Positioning System (GPS) chips have high cost and power consumption, making it unsuitable for long-range (LoRa) and low-power IoT devices. Alternatively, low-power wide-area (LPWA) signals can be used for simultaneous positioning and communication. We summarize previous studies related to LoRa signal-based positioning systems, including those addressing proximity, a path loss model, time difference of arrival (TDoA), and fingerprint positioning methods. We propose a LoRa signal-based positioning method that uses a fingerprint algorithm instead of a received signal strength indicator (RSSI) proximity or TDoA method. The main objective of this study was to evaluate the accuracy and usability of the fingerprint algorithm for large areas in the real world. We estimated the locations using probabilistic means based on three different algorithms that use interpolated fingerprint RSSI maps. The average accuracy of the three proposed algorithms in our experiments was 28.8 m. Our method also reduced the battery consumption significantly compared with that of existing GPS-based positioning methods. We explore the use of extrinsic motivation to improve the state of user-centered security mechanisms. Specifically, we study applications of scores as user incentives in the context of secure device pairing. We develop a scoring functionality that can be integrated with traditional pairing approaches. We then report on a usability study that we performed to evaluate the effect of scoring on the performance of users in comparison operations. Our results demonstrate that individuals are likely to commit fewer errors and show more acceptance when working with the scoring based pairing approach. Framing pairing as a game and providing feedback to users in the form of a score is an efficient way to improve pairing security, particularly among users such as children who may not be aware of the consequences of their decisions while performing security tasks.