Flashing displays: user-friendly solution for bootstrapping secure associations between multiple constrained wireless devices

Abstract

Future healthcare systems, smart homes, and similar will involve a large number of smart inter-connected wireless devices (such as wireless sensor nodes). One of the major challenges to securing these systems presents loading initial cryptographic credentials into a relatively large number of wireless devices. Furthermore, many of these technologies involve low-cost and highly interface constrained devices (lacking usual wired interfaces, displays, keypads, and alike). We propose two novel multichannel key deployment schemes for wireless networks that only require a presence of a light source device, such as a multi-touch screen (tablet or smartphone device). The first key deployment scheme is based on secret key cryptography and is suitable for interface/resource-constrained wireless devices. The second scheme assumes a strong attacker and requires the use of public key cryptography. In both our solutions, we use one-way visible light channel of multi-touch screens (flashing displays) to initialize devices in a secure, usable, and scalable way. From the user's perspective, this boils down to placing the devices on the multitouch screen after which the remaining process is fully automatized. We showed through the experiments with 48 users that our solution is user-friendly and scales linearly with the number of nodes.

Security Analysis of Out-of-Band Device Pairing Protocols: A Survey

“…(3) Flashing displays [60]: it utilizes two channels, wireless radio as an in-band channel and a unidirectional VLC, where the former is considered as insecure and the latter is used as out-of-band. A VLC is established between the display of a smartphone and a light sensor of a constrained device once it is on top of the screen (4) Secure barcode-based visible light communication (SBVLC) [61]: a full duplex VLC channel between two camera/display-enabled devices using 2D barcodes.…”

Survey and Systematization of Secure Device Pairing

“…Application classes P r i v a t e P u b l i c S o c i a l U n a t t e n d e d Push Button Configuration [54] Integrity codes [55] Tamper-evident pairing [56] Just Works [43] Noisy tags [63] Adopted-Pet [64] Near Field Communication [17] Out-of-band [67] KeyLED [69] Enlighten Me! [70] Flashing displays [71] Talking to Strangers [7] Loud and Clear [41] HAPADEP [33] Zero-Power pairing [76] Ultrasonic ranging [79] SBVLC [72] Vibrate-to-unlock [80] Shot [38] Vibreaker [81] Amigo [27] Good Neighbor [84] Wanda [85] Ambient Audio pairing [28] Zero-interaction pairing [19] MagPairing [86] Touch-and-Guard [21] MANA [190] Access point authentication [191] Shake Them Up! [192] Shake Well Before Use [193] SAPHE [194] Authentication using ultrasound [195] Synchronized Audio-Visual Patterns [34] RhythmLink [196] Seeing-Is-Believing [197] Visible Laser Light [198] VIC (mutual authentication) [199] BEDA [33] Playful Security [188] Safeslinger [200] Synchronized Drawing [185] Proximity Authent...…”

BlinkComm: Initialization of IoT Devices Using Visible Light Communication

“…The use of visible light communication (VLC) for the initial configuration of the IoT devices (such as wireless sensor devices) presents an acceptable and commercially viable solution. Some existing solutions such as LIRA [27] and flashing displays [28] use Manchester coding in combination with "ON-OFF" keying, but that solution achieves transmission speeds up to 10 bps (20 Manchester encoded bps). Some commercial products such as ElectricImp [29] platform also uses flashing screens for information transmission over the VLC (using a smartphone and/or a tablet), and they use it to initialize a device with an SSID and a password.…”

“…The proposed solution is based on a multichannel protocol in which information is transmitted over both a radio and VLC channel, where user performs the key verification by visually comparing synchronized LED blinking from wireless devices. Kovacevic et al propose solutions LIRA [27] and flashing displays [28] which also exploit VLC for the secure initialization of IoT devices, while Gauger et al [48] propose screen-to-photodiode communication from PDA to sensor node. These solutions are very user friendly, but the data transfer rate via VLC is very low, up to 10 bps.…”

“…One approach to recover from frame overflow would be to use Manchester coding (as proposed in [27,28]), where bit "1" is encoded as "10", while bit "0" is encoded as "01". Using this coding technique, we can achieve speed up to 30bps Manchester encoded (15bps information bits).…”