THaW graduate Tim Pierson will present SNAP, a method for proximity detection with single-antenna IoT devices at MobiCom in October.
Abstract: Providing secure communications between wireless devices that encounter each other on an ad-hoc basis is a challenge that has not yet been fully addressed. In these cases, close physical proximity among devices that have never shared a secret key is sometimes used as a basis of trust; devices in close proximity are deemed trustworthy while more distant devices are viewed as potential adversaries. Because radio waves are invisible, however, a user may believe a wireless device is communicating with a nearby device when in fact the user’s device is communicating with a distant adversary. Researchers have previously proposed methods for multi-antenna devices to ascertain physical proximity with other devices, but devices with a single antenna, such as those commonly used in the Internet of Things, cannot take advantage of these techniques.
We present theoretical and practical evaluation of a method called SNAP — SiNgle Antenna Proximity — that allows a single-antenna Wi-Fi device to quickly determine proximity with another Wi-Fi device. Our proximity detection technique leverages the repeating nature Wi-Fi’s preamble and the behavior of a signal in a transmitting antenna’s near-field region to detect proximity with high probability; SNAP never falsely declares proximity at ranges longer than 14 cm.
In Proceedings of the ACM International Conference on Mobile Computing and Networking (MobiCom), Article #1-15, October 2019. ACM Press. DOI 10.1145/3300061.3300120.
The paper was been recognized from a pool of submissions spanning 40 years with the inaugural IEEE Security and Privacy Test of Time Award, and its impact can be felt in every corner of the medical devices industry.
In the 11 years since the paper’s publication, Fu and others in his field have worked on solutions. Many of these have been technical, but most of the larger impact the paper has had has been in leadership.
“A lot of it is about community building and standards development,” Fu says, “which is sometimes a foreign concept in academia. But it’s really important to industry.”
Professor Avi Rubin recently testified at a Maryland State Senate Finance Committee, hearing regarding a bill about IoT security [February 26, 2019]. Below are his remarks.
My name is Avi Rubin, and I am a full professor of Computer Science at Johns Hopkins University and Technical Director of our Information Security Institute. I am also the Founder and Chief Scientist of Harbor Labs, a Maryland CyberSecurity company that has developed an IoT Security Analysis product. I have been an active researcher in the area of Computer and Network Security since 1992. The primary focus of my research is Security for the Internet of Things (IoT Security). These are the types of connected devices that are addressed in SB 553.
This one-hour talk by David Kotz was presented at ARM Research in Austin, TX at the end of January 2019. The first half covers some recent THaW research about Wanda and SNAP and the second half lays out some security challenges in the Internet of Things. Watch the video below.
Abstract: The homes, offices, and vehicles of tomorrow will be embedded with numerous “Smart Things,” networked with each other and with the Internet. Many of these Things interact with their environment, with other devices, and with human users – and yet most of their communications occur invisibly via wireless networks.How can users express their intent about which devices should communicate – especially in situations when those devices have never encountered each other before? We present our work exploring novel combinations of physical proximity and user interaction to ensure user intent in establishing and securing device interactions.
What happens when an occupant moves out or transfers ownership of her Smart Environment?How does an occupant identify and decommission all the Things in an environment before she moves out?How does a new occupant discover, identify, validate, and configure all the Things in the environment he adopts?When a person moves from smart home to smart office to smart hotel, how is a new environment vetted for safety and security, how are personal settings migrated, and how are they securely deleted on departure?When the original vendor of a Thing (or the service behind it) disappears, how can that Thing (and its data, and its configuration) be transferred to a new service provider?What interface can enable lay people to manage these complex challenges, and be assured of their privacy, security, and safety? We present a list of key research questions to address these important challenges.
Scott Breece, VP and CISO of Community Health Systems, discusses the rising security threat in healthcare with M. Eric Johnson, Dean of Vanderbilt University’s Owen Graduate School of Management. Scott highlights how health IT is transforming healthcare, improving the patient experience and outcomes. However, digitization of healthcare data also creates new risks for the healthcare system. Scott discusses how Community Health Systems is staying ahead of those threats and securing patient data. This video was partially supported by the THaW project, which is co-led by Eric Johnson.
Tim Pierson’s dissertation work resulted in an innovative method for single-antenna Wi-Fi devices (like many mHealth devices, medical devices, or those in the IoT) to determine with strong confidence whether a Wi-Fi transmitter is close by (within a few centimeters). This proximity detector can be the basis for trustworthy relationships between devices. A poster paper about this idea just won the best-poster award at MobiCom 2018, and the full paper was just accepted for presentation at MobiCom 2019. See below for the abstract, or check out the corresponding three-page paper.
As part of THaW’s efforts to discuss the state of security in the health care industry, Eric Johnson continues to meet with prominent Information Security Officers to discuss the current challenges in the industry. This time, Eric met with Cardinal Health’s Talvis Love to discuss a variety of topics, including the intricacies of a the migration to the cloud for data storage and retrieval. Click above to watch the discussion in full.
In a recent Viewpoint article in JAMA, THaW member Kevin Fu explored a recent pacemaker vulnerability, and its ramifications for medical device security in general. In the post, he discusses both the full extent of the vulnerabilities, as well as the practical considerations to be taken as a result. To read the full text of the article, click the link below.
THaW Researchers Xiaohui Liang, Tianlong Yun, Ronald Peterson, and David Kotz have been researching new methods for connecting wearables to external screens. Their paper, LightTouch: Securely Connecting Wearables to Ambient Displays with User Intent, has been accepted to INFOCOM 2017. In it, they explore a security system that uses a screen’s brightness level to ensure secure connection between screen and device. Moreover, they also address additional screen-based counter measures that can be taken to further secure the protocol. For more information and to read the paper, click the link below.
THaW contributor Eric Johnson’s conversations from the CISO conference continued with VP and CISO of Kindred Healthcare, Charles Lebo. The two had a conversation to discuss some of the emerging challenges of healthcare security. The topics ranged from the scope of large healthcare datasets, to the emergence of ransomware and maintaining data security.
Click here, or play the embedded video above, to hear the discussion in full.