Ripple: Communicating through Physical Vibration Nirupam Roy, Mahanth Gowda, and Romit Roy Choudhury, University of Illinois at Urbana-Champaign https://www.usenix.org/conference/nsdi15/technical-sessions/presentation/roy This paper is included in the Proceedings of the 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’15). May 4–6, 2015 • Oakland, CA, USA ISBN 978-1-931971-218 Open Access to the Proceedings of the 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’15) is sponsored by USENIX Ripple: Communicating through Physical Vibration Nirupam Roy Mahanth Gowda Romit Roy Choudhury University of Illinois at Urbana-Champaign Abstract cation with vibrations. Still, researchers conceived cre- ative applications, including secure smartphone pairing This paper investigates the possibility of communicat- and keyless access control [47]. ing through vibrations. By modulating the vibration mo- tors available in all mobile phones, and decoding them This paper is aimed at improving the data rates of vi- through accelerometers, we aim to communicate small bratory communication, as well as its security features. packets of information. Of course, this will not match the We design Ripple, a system that breaks away from the bit rates available through RF modalities, such as NFC intuitive morse-code style ON/OFF pulses and engages or Bluetooth, which utilize a much larger bandwidth. techniques such as orthogonal multi-carrier modulation, However, where security is vital, vibratory communica- gray coding, adaptive calibration, vibration braking, tion may offer advantages. We develop Ripple, a system side-channel suppression, etc. While some techniques that achieves up to 200 bits/s of secure transmission us- are borrowed from RF/acoustic communication, unique ing off-the-shelf vibration motor chips, and 80 bits/s on challenges (and opportunities) emerge from the vibra- Android smartphones. This is an outcome of designing motor/accelerometer platform, as well as from solid- and integrating a range of techniques, including multi- materials on which they rest. For instance, the motor carrier modulation, orthogonal vibration division, vibra- and the materials exhibit resonant frequencies that need tion braking, side-channel jamming, etc. Not all these to be adaptively suppressed; accelerometers sense vibra- techniques are novel; some are borrowed and suitably tion along 3 orthogonal axes, offering the opportunity modified for our purposes, while others are unique to this to use them as parallel channels, with some degree of relatively new platform of vibratory communication. leakage. In addition to such techniques, we also design a receiver cradle – a wooden cantilever structure – that amplifies/dampens the vibrations in a desired way. A vi- 1 Introduction bration based product in the future, say a point-of-sale Data communication has been studied over a wide range equipment for credit card transactions, may potentially of modalities, including radio frequency (RF), acoustic, benefit from such a design. visible light, etc. This paper envisions vibration as a new From a security perspective, Ripple recognizes the threat mode of communication. We explore the possibility of of acoustic leakage due to vibration, i.e., an eavesdrop- using vibration motors, present in all cell phones today, per could listen to the sound of vibration and decode the as a transmitter, while accelerometers, also popular in transmitted bits. To thwart such side channel attacks, we mobile devices, as a receiver. By carefully regulating the design the transmitter to also listen to the sounds and vibrations at the transmitter, and sensing them through adaptively play a synchronized acoustic signal (through accelerometers, two mobile devices should be able to its speaker) to cancel the sound. The transmitter also su- communicate via physical touch. perimposes a jamming sequence, ultimately offering in- herent protection from acoustic eavesdroppers. We ob- We are not the first to recognize this opportunity. Acous- serve that application layer securities may not apply in tic communication operates on the same fundamental all such scenarios – public/symmetric key based encryp- principles and has been studied for decades (over air tion infrastructure may not scale to billions of phones and [24, 20] and under water [12]). In recent years, authors other use-cases such as internet of things (IoT). Blocking in [32] identified the possibility of using vibra-motors access to the signal, at the physical layer itself, is desir- and accelerometers in mobile phones, as an opportunity able in these spontaneous, peer-to-peer, and perhaps dis- to exchange information. The benefits were identified connected situations [41]. as security and zero-configuration, meaning that the two devices need not discover each other’s addresses to com- Its natural to wonder what kind of applications will use municate. The act of physical contact would serve as the vibratory communication, especially in light of NFC. We implicit address. However, authors identified the draw- do not have a killer app to propose, and even believe that backs of such a system to be low bit rates ( 5 bits/s), most applications would prefer NFC, mainly due to its ∼ based on the “morse-code” style of ON/OFF communi- higher data rates (NFC uses 1.8MHz bandwidth achiev- USENIX Association 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’15) 265 ing more than 100 Kbits/s, in contrast to 800Hz with to- 2.1 Vibration Motor day’s vibra-motors). However, our hope is that bringing A vibration motor (also called “vibra-motor”) is an the vibratory bit rates to a respectable level – say credit electro-mechanical device that moves a metallic mass card transactions in a second – may trigger new ideas and around a neutral position to generate vibrations. The mo- use-cases. In particular, strict security-sensitive applica- tion is typically periodic and causes the center of mass tions may be the candidates. Despite the very short com- (CoM) of the system to shift rhythmically. There are munication range in NFC, recent results [40, 28] confirm mainly two types of vibra-motors depending on their that security threats are real. Authors decode NFC trans- working principle: missions from 1m away [14, 21, 22] and conjecture that high-gain beamforming antennas can further increase the (1) Eccentric Rotating Mass (ERM): This type of vi- separation. With the natural security benefits of touch- bration generators uses a DC motor to rotate an eccentric based communication (over RF), and supplemented with mass around an axis as depicted in Figure 1(a). As the acoustic cancellation and jamming, we attempt to set a mass is not symmetric with respect to its axis of rota- higher security bar for Ripple. tion, it causes the device to vibrate during the motion. Both the amplitude and frequency of vibration depend Moreover, the ubiquity of vibration motors in every cell on the rotational speed of the motor, which can in turn be phone, even in developing regions, presents an immedi- controlled through an input DC voltage. With increasing ate market for vibratory communication. Peer to peer input voltages, both amplitude and frequency increase al- money exchange with recorded logs is a global prob- most linearly and can be measured by an accelerometer. lem, recently recognized by the Gates Foundation; hid- (2) Linear Resonant Actuators (LRA) generate vibra- den camera attacks on ATM kiosks have been rampant in tion by linear movement of a magnetic mass, as opposed many parts of India and south Asia [25]. Paying local cab to rotation in ERM (Figure 1)(b). With LRA, the mass is drivers with phone-vibrations, or using phones as ATM attached to a permanent magnet which is suspended near cards can perhaps be of interest in developing countries. a coil, called “voice coil”. Upon applying AC current to Clandestine operations may benefit where information the motor, the coil also behaves like a magnet (due to the need to be exchanged without leaving any trace in the generated electromagnetic field) and causes the mass to wireless channel or in the Internet. Finally, if link capac- be attracted or repelled, depending on the direction of the ity proves to be the only bottleneck, perhaps improved current. This generates vibration at the same frequency vibration motors can be included to mitigate it in the as the input AC signal, while the amplitude of vibration next phone models. While it’s difficult to anticipate the is determined by the signal’s peak-to-peak voltage. Thus needs of the future, we focus our attention on enabling LRAs allow for regulating both the magnitude and fre- and pushing forward this new modality of vibratory com- quency of vibration separately. Fortunately, most mobile munication. To this end, our main contributions may be phones today use LRA based vibra-motors. summarized as: !"# Eccentric Harnessing the vibration motor hardware and its func- mass • Vibration tionalities, from a communication perspective. axes Developing an orthogonal multi-carrier communication • (a) ERM vibration motor stack using vibra-motor and accelerometer chips, and re- peating the same for Samsung smartphones. Design de- &"# Voice coil Magnetic cisions for the latter are different due to software/API mass Vibration axis limitations on smartphones, where vibra-motors were $# %# mainly integrated for simple alerts/notifications. (b) LRA vibration motor Identifying acoustic side channel attacks and using signal