Pairing Smartphones in Close Proximity Using Magnetometers
Total Page：16
File Type：pdf, Size：1020Kb
MagPairing: Pairing Smartphones in Close Proximity Using Magnetometers Rong Jin∗, Liu Shiy, Kai Zengz , Amit Pandex, Prasant Mohapatrax ∗School of Electronic Information and Communications, Huazhong University of Science and Technology Email: [email protected] yDepartment of Computer and Information Science, University of Michigan - Dearborn, MI 48128 Email: [email protected] z Department of Electrical and Computer Engineering, George Mason University, VA 22030 Email: [email protected] xDepartment of Computer Science, University of California, Davis, CA, 95616 Email: famit,[email protected] Abstract—With the prevalence of mobile computing, lots of Using auxiliary out-of-band (OOB) channels to facilitate wireless devices need to establish secure communication on the device pairing has been studied as a feasible option involving fly without pre-shared secrets. Device pairing is critical for visual [1, 2, 3, 4, 5, 6, 7, 8], acoustic [9, 10, 11, 12, 13], bootstrapping secure communication between two previously u- nassociated devices over the wireless channel. Using auxiliary out- tactile [14] or vibrational sensors [15, 16]. However, these of-band channels involving visual, acoustic, tactile or vibrational methods are not optimized in terms of usability, which is sensors has been proposed as a feasible option to facilitate device considered of utmost importance in pairing scheme based on pairing. However, these methods usually require users to perform OOB channels [2, 17, 18, 19], and require users to perform additional tasks such as copying, comparing, and shaking. It is additional tasks such as copying, comparing and shaking. It preferable to have a natural and intuitive pairing method with minimal user tasks. is preferable to have a natural and intuitive pairing method In this paper, we introduce a new method, called MagPairing, designed with minimal user tasks. for pairing smartphones in close proximity by exploiting corre- In this work, we focus on device pairing using magnetome- lated magnetometer readings. In MagPairing, users only need to ter sensors in the smartphones and develop an intuitive scheme, naturally tap the smartphones together for a few seconds without called MagPairing, which pairs two smartphones when they performing any additional operations in authentication and key establishment. Our method exploits the fact that smartphones are tapped together. We prefer the use of magnetometer sensors are equipped with tiny magnets. Highly correlated magnetic over audio and visual schemes [2, 9] because this involves field patterns are produced when two smartphones are close to minimal user intervention and achieves better usability. Device each other. We design MagPairing protocol and implement it on pairing using accelerometer sensors [15, 16] involves asking Android smartphones. We conduct extensive simulations and real user to perform some typical task such as shaking the phones world experiments to evaluate MagPairing. Experiments verify that the captured sensor data on which MagPairing is based which is less intuitive than simply tapping the devices. has high entropy and sufficient length, and is nondisclosure to In MagPairing, users only need to naturally tap the smart attackers more than few centimeters away. Usability tests on phones together for a few seconds without performing any various kinds of smartphones by totally untrained users show additional operations in authentication and key establishment. that the whole pairing process needs only 4.5 seconds on average The embedded magnetometer sensor in smartphones provides with more than 90% success rate. a measure of magnetic field along X, Y, and Z directions [20, 21]. Our method exploits the fact that smartphones are equipped with tiny magnets themselves. When two smart- I. INTRODUCTION phones are tapped together, their magnetometers are reading Smartphones have become increasingly popular in recent the magnetic fields at almost the same point, yielding highly years, leading to many new applications such as file swapping, correlated sensor data of magnetic field patterns. The sensor music sharing, and collaborative gaming, where nearby users data are used to authenticate early established DH-key to engage in spontaneous wireless data communications using prevent man-in-the-middle attacks. Bluetooth or WiFi interfaces. An important security issue In MagPairing, we tackle the challenge that sensor data during bootstrap phase is to securely associate two devices and collected by distributed smartphones are not synchronized and generate shared secret keys to protect the subsequent wireless spatial aligned. Moreover, we consider the problem that user communications, often without any prior context. Such “device may wag and rotate unconsciously when holding smartphones. pairing” or “first connect” is critical for bootstrapping secure We implemented MagPairing on Android smartphones. We communication between two previously unassociated devices conduct extensive simulations and real world experiments to over the wireless channel. evaluate MagPairing. Experiments verify that the captured sensor data on which MagPairing is based has high entropy z Kai Zeng is the Corresponding author and sufficient length; the sensor data information cannot be estimated and forged by attacker to perform man-in-the-middle to transmit cryptographic protocol messages and requires the attacker even when the attacker is a few centimeters away from user to merely monitor device interaction for any extraneous tapped smartphones. Usability tests by totally untrained users interference. A pairing method based on synchronized audio- show that the whole pairing process needs only 4.5 seconds visual patterns [13] are further developed. The proposed meth- on average with more than 90% success rate. Scalability tests ods, “Blink–Blink”, “Beep–Beep” and “Beep–Blink”, involve on 3 types of smartphones: Google Nexus 5, GALAXY 3 and users comparing very simple audiovisual patterns, e.g., in the MEIZU MX 4 validate that MagPairing is widely applicable form of “beeping” and “blinking”, transmitted as simultaneous and easy to use. The main contributions of this paper are streams, forming two synchronized channels. Comparing with summarized as follows: our solution, the use of acoustic signal is considered taking 1) We design a protocol to achieve secure smartphone more user’s attention of listening and comparing. While, in device paring by using the correlated readings on re- MagPairing, the comparing of the similarity of sensor data spective magnetometers. is done by smartphones automatically. Moreover, the use of 2) We conduct extensive simulations to evaluate our acoustic signal is constrained within noiseless environment. method. 3) We implement the protocol on Android smartphones and C. Tactile channel conduct extensive experiments to evaluate and validate Another approach [14], “Button-Enabled Device Authenti- our proposed method. cation (BEDA)”, suggests pairing devices with the help of user Although MagPairing is validated on smartphones, it can button presses, thus utilizing the tactile OOB channel. This be applied to facilitate the pairing of other wireless devices method has several variants: “LED–Button”, “Beep–Button”, which are equipped with magnetometers, such as generic body “Vibration–Button”, and “Button–Button”. In the first two sensors and wearable computing devices [19, 22], providing a variants, the sending device blinks its LED (or vibrates or method for intuitive secure device pairing. beeps) and the user presses a button on the receiving device. In the Button–Button variant, the user simultaneously presses II. RELATED WORK buttons on both devices. Comparing with our solution, the One prominent research direction for device pairing is the action of “button pressing” itself is considered taking more use of auxiliary – also referred to as “out-of-band” (OOB) user’s attention. channels, which are both perceivable and manageable by the users who own and operate the devices. Existing option D. Vibration channel involves 1) visual, 2) acoustic, 3) tactile or 4) vibrational “Smart-Its-Friends” [15] and “Shake-Well-Before-Use” [16] sensors. exploit common movement pattern to communicate a shared secret to both devices as they are shaken together by the A. Visual channel user. The user needs to hold the devices together and perform In some early approaches [3, 4, 5], OOB data are encoded shaking for around 5 seconds. Comparing with our solution, into images and the users are asked to compare them on the action of “shaking” is considered taking more strength two devices. In a more recent approach [6], “Seeing-is- than the action of “tapping”. Moreover, “shaking” is usually Believing” (SiB), one device encodes the public key into a an “up-down” movement, which provides randomness only in two-dimensional bar code and displays it on its screen, and z direction, leading to a relative longer pairing time. the other device “reads it” using a photo camera, operated by the user. Follow-on work [8] considers the scalability problem E. OOB channel summary when applying SiB to multiple handheld devices. It devises a system that takes only one photo during the authentication A usability analysis of the existing popular device pairing protocol for two handheld devices. Another approach [7], schemes are presented in [17]. It reports that many of the similar to SiB, requires that LED-equipped device transmits existing schemes have a large computational time and high OOB data via the blinking. Comparing