The legitimate driver of a vehicle traditionally gains authorization to access their vehicle via tokens such as ignition keys, some modern versions of which feature RFID tags. However, this token-based approach is not capable of detecting all instances of vehicle misuse. Technology trends have allowed for affordable and efficient collection of various sensor data in real time from the vehicle, its surroundings, and devices carried by the driver, such as smartphones. In this paper, we propose to use this sensory data to actively identify and authenticate the driver of a vehicle by determining characteristics which uniquely categorize individuals' driving behavior. Our approach is capable of continuously authenticating a driver throughout a driving session, as opposed to alternative approaches which are either performed offline or as a session starts. This means our modeling approach can be used to detect mid-session driving attacks, such as carjacking, which are beyond the scope of alternative driver authentication solutions. A simulated driving environment was used to collect sensory data of driver habits including steering wheel position and pedal pressure. These features are classified using a Support Vector Machine (SVM) learning algorithm. Our pilot study with 10 human subjects shows that we can use various aspects of how a vehicle is operated to successfully identify a driver under 2.5 minutes with a 95% confidence interval and with at most one false positive per driving day.

Many RFID tags store valuable information privy to their users that can easily be subject to unauthorized reading, leading to owner tracking or impersonation. RFID tags are also susceptible to different forms of relay attacks. This paper presents novel sensing-enabled defenses to unauthorized reading and relay attacks against RFID systems without necessitating any changes to the traditional RFID usage model. More specifically, the paper proposes the use of on-board tag sensors to (automatically) acquire useful contextual information about the tag's environment (or its owner, or the tag itself). It suggests how this information can be used to achieve two security functionalities. First, such context recognition can be leveraged for the purpose of selective tag unlocking - the tag will respond selectively to reader interrogations, i.e., only when it is deemed safe to do so. Second, context recognition can be used as a basis for transaction verification in order to provide protection against a severe form of relay attacks involving malicious RFID readers. To demonstrate the feasibility of the overall idea, a novel selective unlocking mechanism based on owner's posture recognition is presented. The evaluation of the proposed mechanism shows its effectiveness in significantly raising the bar against many different RFID attacks.

Personal RFID tags store valuable information private to their users that can easily be subject to eavesdropping, unauthorized reading, owner tracking, and cloning. RFID tags are also susceptible to relay attacks and likely to get lost and stolen. In this paper, we introduce the problem of user authentication to RFID tags. This allows users to control when and where their RFID tags can be accessed. We present a novel approach for user authentication to multiple RFID tags called “Vibrate-to-Unlock” (VtU). This technique uses a mobile phone as an authentication token, forming an unidirectional tactile communication channel between users and their RFID tags. Authenticating to an RFID tag involves touching a vibrating phone to the tag or an object carrying the tag, such as a wallet. We discuss the design and implementation of this new method on Intel's WISP tags. We also report on a preliminary usability evaluation of our VtU prototype.

Accelerometers are versatile sensors that are nearly ubiquitous. They are available on a wide variety of devices and are particularly common on those that are mobile or have wireless capabilities. Accelerometers are applicable in a number of settings and circumstances, including important security and privacy domains. In this paper, we investigate the use of accelerometers for the purpose of true random number generation. As our first contribution, we discover that an accelerometer possesses two unique and appealing properties when used as an entropy source. First, contrary to intuition, an accelerometer can derive sufficient entropy even when it is stationary (i.e., not subject to perceivable acceleration). Next, and more importantly, the entropy of a stationary accelerometer can not be reduced in the presence of a variety of environmental variations or even under adversarial manipulations. This means that, unlike other sensors, accelerometers are resistant to changing environments, benign or otherwise. To support this claim, we develop a thorough experimental adversarial model for accelerometers that supply a system with entropy. To the authors' knowledge, this is the first real world model in the context of entropy collection. As our second contribution, we demonstrate the validity of accelerometer based random number generation on an RFID tag, which is a highly resource constrained device. We present the design and implementation of our method on an Intel WISP tag and conduct several novel experiments to evaluate its feasibility. Our results indicate that a high quality 128-bit random number can be extracted using an accelerometer in about 1.5 seconds even when the sensor is in a stationary state. To our knowledge, this is the first random number generation technique that is known to be viable for RFID devices based on general-purpose hardware.

No abstract available.

The operation of achieving authenticated key agreement between two human-operated devices over a short-range wireless communication channel (such as Bluetooth or WiFi) is referred to as "Pairing". The devices in such a scenario are ad hoc in nature, i.e., they can neither be assumed to have a prior context (such as pre-shared secrets) with each other nor do they share a common trusted on- or off-line authority. However, the devices can generally be connected using auxiliary physical channel(s) (such as audio, visual, etc.) that can be authenticated by the device user(s) and thus form a basis for pairing.