Loud And Clear Security

1、Center for Cyber-Security and Privacy1Loud And Clear SecurityMichael T. Goodrich, Michael Sirivianos, John Solis, Gene Tsudik and Ersin Uzun.goodrich,msirivia,jsolis,gts,Center for Cyber-Security and Privacy2Problem Statement uthentication of communication channels between devices th

2、at lack any previous secure association.Center for Cyber-Security and Privacy3Challenges Human verifiable authentication. Introduce user in the authentication loop. No previous shared secrets. No online or offline authority. Limited computational resources on portable devices. Support for multiple b

3、roadcast mediums.Center for Cyber-Security and Privacy4Previous Approaches Human Comparable Visual HashesCumbersome TaskHigh Error Rate Seeing is Believing 2D barcodes to authenticate devices with camera phones Many devices lack a camera or barcode scanner Need graphical display or sticker Visually-

4、impaired users Poor visibility scenarios (e.g., smoke, darkness) Requires sufficiently clear picture Center for Cyber-Security and Privacy5Our Solution: L&C Audio channel for human-assisted authentication of previously un-associated devices Derive auditorially-robust, syntactically correct sente

5、nce (MadLib) from hash of a public key Vocalize sentence Combine vocalization on one (or both) devices with the display of the same information on other device Suitable for secure device pairing (e.g key exchange) and similar tasks Only need speaker on one device and small (text) display on the othe

6、rCenter for Cyber-Security and Privacy6Personal DeviceTarget DeviceCell phone:speaker &small displayHandheld/PDA:speaker &displaySmart Watch:tiny speaker &tiny displayMP3 player:audio out &no displayPrinter or FAX:speaker &small displayBase Station:no speaker &no displayMutua

7、l authenticationpossiblyrequiredSample Use ScenariosCenter for Cyber-Security and Privacy7L&C Use TypesTYPE 4: Compare text displayed on each device.TYPE 1: Hear and compare two audible sequences, one from each deviceTYPE 2: Hear audible sequence from target device, compare it to text displayed

8、by personal deviceTYPE 3: Hear audible sequence from personal device, compare it to text displayed by target device.Center for Cyber-Security and Privacy8Implementation-PerformanceProgramming SystemBuilt on highly-portable Ewe Java VM. Runs on any Pocket or Windows PC.TTS EngineCan use any portable TTS engineDi