DE-auth of the Blue! Transparent De-authentication Using Bluetooth Low Energy Beacon

Conti, Mauro; Tricomi, Pier Paolo; Tsudik, Gene

doi:10.1007/978-3-030-58951-6_14

Cited by 3 publications

(5 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, researchers [20] have shown that a brief training is sufficient to imitate typing pattern of the target users, even when their typing patterns are only partially known. DEB [8] instruments an office chair with two Bluetooth low-energy beacons. An application running on the target system monitors the signal strength of the received Bluetooth beacons.…”

Section: Related Workmentioning

confidence: 99%

“…The ALS data feed is processed in real-time by a simple application running in the background on the target computer. Since the primary goal of any de-authentication mechanism is to prevent lunchtime attacks that are prevalent at typical workplaces [1], [2], [8], our proposed system is expected to be used in conventional workplace setups. DEAL is absolutely unobtrusive.…”

Section: A System Modelmentioning

confidence: 99%

“…col. 12), gaze tracking employs an expensive eye-tracking device. Though the price of FADEWICH and pulse-response is unknown, we [9] Medium ($100-200) 20 Gaze tracking [1] High ($2-5k) 30 Assentication [2] Medium ($150) 30 Pulse-response [6] Unknown 10 Keystroke dynamics [19] Low (free) 33 FADEWICH [7] Unknown 3 DEB [8] Low ($10) 15 BLUFADE [12] Low ($5) 30 ZIA [10] Low ($10-30) 1 1DMRLBP [11] Medium ($50-200) -DEAL (our proposal) Low (free) 120…”

Section: A Comparison With Existing De-authentication Schemesmentioning

confidence: 99%

“…The state-of-the-art solutions (cf. Section II) require external equipments [1], [2], [6]- [11], are relatively expensive [1], [2], [9], [11], need physical customization or specific installation [1], [2], [7], [8], [12], are complex to deploy [2], [6], [7], involve regular maintenance [2], [8]- [10], or sometimes cause inconvenience to the user [6], [9]- [11]. Such limitations hinder a broader adoption of the existing solutions.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

De-Authentication Using Ambient Light Sensor

Gangwal,

Paliwal,

Conti

2024

IEEE Access

Self Cite

View full text Add to dashboard Cite

While user authentication happens before initiating or resuming a login session, deauthentication detects the absence of a previously-authenticated user to revoke her currently active login session. The absence of proper de-authentication can lead to well-known lunchtime attacks, where a nearby adversary takes over a carelessly departed user's running login session. The existing solutions for automatic de-authentication have distinct practical limitations, e.g., extraordinary deployment requirements or high initial cost of external equipment. In this paper, we propose ''DE-authentication using Ambient Light sensor'' (DEAL), a novel, inexpensive, fast, and user-friendly de-authentication approach. DEAL utilizes the built-in ambient light sensor of a modern computer to determine if the user is leaving her work-desk. DEAL, by design, is resilient to natural shifts in lighting conditions and can be configured to handle abrupt changes in ambient illumination (e.g., due to toggling of room lights). We collected data samples from 4800 sessions with 120 volunteers in 4 typical workplace settings and conducted a series of experiments to evaluate the quality of our proposed approach thoroughly. Our results show that DEAL can de-authenticate a departing user within 4 seconds with a hit rate of 89.15% and a fall-out of 7.35%. Finally, bypassing DEAL to launch a lunchtime attack is practically infeasible as it requires the attacker to either take the user's position within a few seconds or manipulate the sensor readings sophisticatedly in real-time.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: A System Modelmentioning

confidence: 99%

Section: A Comparison With Existing De-authentication Schemesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

De-Authentication Using Ambient Light Sensor

Gangwal,

Paliwal,

Conti

2024

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Assentication [22] detects user presence through pressure sensors in the chair cushion. Whereas, [10] instruments a chair with BLE beacons to detect whether the user is currently sitting. Facial recognition can be used for CAuth by continuously monitoring faces that appear in front of the camera, while being user-transparent [12], [35], [38].…”

Section: A De-authenticationmentioning

confidence: 99%

Privacy-Friendly De-authentication with BLUFADE: Blurred Face Detection

Cardaioli¹,

Conti²,

Tricomi³

et al. 2022

2022 IEEE International Conference on Pervasive Computing and Communications (PerCom)

Self Cite

View full text Add to dashboard Cite

Ideally, secure user sessions should start and end with authentication and de-authentication phases, respectively. While the user must pass the former to start a secure session, the latter's importance is often ignored or underestimated. Dangling or unattended sessions expose users to well-known Lunchtime Attacks. To mitigate this threat, the research community focused on automated de-authentication systems. Unfortunately, no single approach offers security, privacy, and usability. For instance, although facial recognition-based methods might be a good fit for security and usability, they violate user privacy by constantly recording the user and the surrounding environment.In this work, we propose BLUFADE, a fast, secure, and transparent de-authentication system that takes advantage of blurred faces to preserve user privacy. We obfuscate a webcam with a physical blur layer and use deep learning algorithms to perform face detection continuously. To assess BLUFADE's practicality, we collected two datasets formed by 30 recruited subjects (users) and thousands of physically blurred celebrity photos. The former was used to train and evaluate the deauthentication system performances, the latter to assess the privacy and to increase variance in training data. We show that our approach outperforms state-of-the-art methods in detecting blurred faces, achieving up to 95% accuracy. Furthermore, we demonstrate that BLUFADE effectively de-authenticates users up to 100% accuracy in under 3 seconds, while satisfying security, privacy, and usability requirements.

show abstract