Privacy leakage via malware's unauthorized audio recording has become an emerging threat to mobile users. To counter this threat, we propose SafeChat which prevents unauthorized recording without requiring new audio privacy settings in operating systems. SafeChat utilizes sound masking to differentiate audio information between authorized and unauthorized recording apps. Specifically, SafeChat enables authorized recording apps to recover more private/secret information than the unauthorized apps even though both of them record identical audio signals from the same microphone. We have implemented SafeChat as an Android chat app. Our experiments on several commodity phones have shown that SafeChat can make an up-to-26dB difference in signal strength between authorized and unauthorized recording apps. This difference reduces the accuracy of state-of-the-art speech recognition engines, like Google Speech API, to less than 0.1% in understanding the unauthorized recording while comprehending the authorized recording with high accuracy. Moreover, none of the 317 testing participants we recruited online could comprehend the masked speech. Our usability study shows that only 35% of the participants were aware of this threat of privacy leakage and 60% of them wanted to use SafeChat to protect their private/secret information from unauthorized recording.

LibAS is a cross-platform framework to facilitate the rapid development of mobile acoustic sensing apps. It helps developers quickly realize their ideas by using a high-level Matlab script, and test them on various OS platforms, such as Android, iOS, Tizen, and Linux/Win. LibAS simplifies the development of acoustic sensing apps by hiding the platform-dependent details. For example, developers need not learn Objective-C/SWIFT or the audio buffer management in the CoreAudio framework when they want to implement acoustic sensing algorithms on an iPhone. Instead, developers only need to decide on the sensing signals and the callback function to handle each repetition of sensing signals. We have implemented apps covering three major acoustic sensing categories to demonstrate the benefits and simplicity of developing apps with LibAS. Our evaluation results show the adaptability of LibAS in supporting various acoustic sensing apps and tuning/improving their performance efficiently. Developers have reported that LibAS saves them a significant amount of time/effort and can reduce up to 90% lines of code in their acoustic sensing apps.

Studies have shown that using smartphones while walking-called distracted walking-significantly increases the risk of pedestrians colliding with dangerous objects. In this paper, we explore how to mitigate this problem by exploiting the phone's built-in sensors only and developing an application called BumpAlert. BumpAlert provides a generic solution without requiring any prior knowledge of the user's surroundings by estimating distances to nearby objects using the phone's speakers and microphones. This process is enhanced further by using the images acquired from the phone's rear camera, when necessary. We have evaluated BumpAlert under a variety of settings ranging from aisle to outdoor environments with walls, pillars, signboards, dustbins, and people, etc., that are common in our daily surroundings. Our evaluation has shown an average accuracy of BumpAlert to be higher than 95 percent with a less than 2 percent false-positive rate to detect frontal objects 2-4m away, which suffices for the user to react and avoid collision. Even though BumpAlert is unable to detect all dangerous situations, most participants of our user study feel safer when they walk with BumpAlert enabled. Integrating our current design of BumpAlert with other safety systems can provide a practical solution for protecting distracted pedestrians.

Charging mobile devices fast alleviates users' impatience in waiting for their devices to be charged. So, fast charging has been the focus of both industry and academia, developing and deploying various technologies, such as Quick Charge by Qualcomm, TurboPower by Motorola, Flash Charge by OPPO, etc. Fast charging, unfortunately, accelerates the capacity fading of device battery because it follows the Constant Current, Constant Voltage (CCCV) charge principle without considering the behavior of how users charge their devices. CCCV charging principle is a two-phase charging process consisting of (i) Constant-Current Charge (CC-Chg) and (ii) Constant-Voltage Charge (CV-Chg) [2] where CV-Chg is usually triggered at the end of charging (e.g., 80-100%) to stabilize the battery condition. However, fast charging technologies are agnostic of users' available charging time, resulting in premature termination of the planned charging if users only have limited time. This, in turn, leads to an incomplete CV-Chg phase or even skipping it completely. From our empirical measurements, we discovered that CV-Chg relaxes the batteries and slows down their capacity fading by up to 80% [1] incomplete CV-Chg shortens the battery life significantly over time!

Charging mobile devices "fast" has been the focus of both industry and academia, leading to the deployment of various fast charging technologies. However, existing fast charging solutions are agnostic of users' available time for charging their devices, causing early termination of the intended/planned charging. This, in turn, accelerates the capacity fading of device battery and thus shortens the device operation. In this paper, we propose a novel user-interactive charging paradigm, called iCharge, that tailors the device charging to the user's real-time availability and need. The core of iCharge is a relaxation-aware (R-Aware) charging algorithm that maximizes the charged capacity within the user's available time and slows down the battery's capacity fading. iCharge also integrates R-Aware with existing fast charging algorithms via a user-interactive interface, allowing users to choose a charging method based on their availability and need. We evaluate iCharge via extensive laboratory experiments and field-tests on Android phones, as well as user studies. R-Aware is shown to slow down the battery fading by more than 36% on average, and up to 60% in extreme cases, when compared to existing fast charging algorithms. This slowdown of capacity fading translates to, for instance, an up to 2-hour extension of the LTE time for a Nexus 5X phone after its use for 2 years, according to our trace-driven analysis of 976 device charging cases of 7 users over 3 months.

A novel attack model is proposed against the existing wireless link-based source identification, which classifies packet sources according to the physical-layer link signatures. A link signature is believed to be a more reliable indicator than an IP or MAC address for identifying packet source, as it is generally harder to modify/forge. It is therefore expected to be a future authentication against impersonation and DoS attacks. However, if an attacker is equipped with the same capability/hardware as the authenticator to process physical-layer signals, a link signature can be easily manipulated by any nearby wireless device during the training phase. Based on this finding, we propose an attack model, called the analog man-in-the-middle (AMITM) attack, which utilizes the latest full-duplex relay technology to inject semi-controlled link signatures into authorized packets and reproduce the injected signature in the fabricated packets. Our experimental evaluation shows that with a proper parameter setting, 90% of fabricated packets are classified as those sent from an authorized transmitter. A countermeasure against this new attack is also proposed for the authenticator to inject link-signature noise by the same attack methodology.

ForcePhone is a novel system that enables commodity phones to recognize the force applied to their touch screen and body. Researchers have shown the usefulness and importance of this expressive input interface (especially for the one-hand operation), but this advanced function has not yet been realized and deployed in most state-of-the-art smartphones. Instead of employing or augmenting specialized/proprietary sensors, ForcePhone uses only the phone's built-in sensors to measure the applied force via a physical property called structure-borne sound propagation. ForcePhone has been implemented and evaluated on both iOS and Android phones. Multiple demo applications, such as getting the option menu by hard-pressing a button or surfing the previous webpage by squeezing the phone, have been implemented and tested successfully. The estimated force is shown highly correlated to the real applied force and the estimation error is less than 54g when the phone is stationary. Users can easily control the applied force at two different levels with a 97% accuracy. Moreover, ForcePhone can detect the squeeze of the phone body with a higher than 90% accuracy. Most participants in our usability study were able to master the ForcePhone-based apps and find them very useful.

We propose a novel mobile system, called EchoTag, that enables phones to tag and remember indoor locations without requiring any additional sensors or pre-installed infrastructure. The main idea behind EchoTag is to actively generate acoustic signatures by transmitting a sound signal with a phone's speakers and sensing its reflections with the phone's microphones. This active sensing provides finer-grained control of the collected signatures than the widely-used passive sensing. For example, because the sensing signal is controlled by EchoTag, it can be intentionally chosen to enrich the sensed signatures and remove noises from useless reflections. Extensive experiments show that EchoTag distinguishes 11 tags at 1cm resolution with 98% accuracy and maintains 90% accuracy even a week after its training. With this accurate location tagging, one can realize many interesting applications, such as automatically turning on the silent mode of a phone when it is placed at a pre-defined location/area near the bed or streaming favorite songs to speakers if it is placed near a home entertainment system. Most participants of our usability study agree on the usefulness of EchoTag's potential applications and the adequacy of its sensing accuracy for supporting these applications.

Multiple-In-Multiple-Out (MIMO) offers great potential for increasing network capacity by exploiting spatial diversity with multiple antennas. Multiuser MIMO (MU-MIMO) further enables Access Points (APs) with multiple antennas to transmit multiple data streams concurrently to several clients. In MU-MIMO, clients need to estimate Channel State Information (CSI) and report it to APs in order to eliminate interference between them. We explore the vulnerability in clients' plaintext feedback of estimated CSI to the APs and propose two advanced attacks that malicious clients can mount by reporting forged CSI: (1) sniffing attack that enables concurrently transmitting malicious clients to eavesdrop other ongoing transmissions; (2) power attack that enables malicious clients to enhance their own capacity at the expense of others?. We have implemented and evaluated these two attacks in a WARP testbed. Based on our experimental results, we suggest a revision of the current CSI feedback scheme and propose a novel CSI feedback system, called the CSIsec, to prevent CSI forging without requiring any modification at the client side, thus facilitating its deployment.

In multiuser MIMO (MU-MIMO) networks, the optimal bit rate of a user is highly dynamic and changes from one packet to the next. This breaks traditional bit rate adaptation algorithms, which rely on recent history to predict the best bit rate for the next packet. To address this problem, we introduce TurboRate, a rate adaptation scheme for MU-MIMO LANs. TurboRate shows that clients in a MU-MIMO LAN can adapt their bit rate on a per-packet basis if each client learns two variables: its SNR when it transmits alone to the access point, and the direction along which its signal is received at the AP. TurboRate also shows that each client can compute these two variables passively without exchanging control frames with the access point. A TurboRate client then annotates its packets with these variables to enable other clients to pick the optimal bit rate and transmit concurrently to the AP. A prototype implementation in USRP-N200 shows that traditional rate adaptation does not deliver the gains of MU-MIMO WLANs, and can interact negatively with MU-MIMO, leading to low throughput. In contrast, enabling MU-MIMO with TurboRate provides a mean throughput gain of 1.7x and 2.3x, for 2-antenna and 3-antenna APs respectively.

Peer-to-Peer (P2P) storage systems are cost-effective and reliable platforms that enable users to share their storage to support variant emerging applications, such as peer-to-peer social networks and distributed backup systems. Because different users have heterogeneous online characteristics and bandwidth capabilities, how to replicate data at suitable peers has become an important issue to ensure that users can access any replica with a high probability. Previous work on data replication in a P2P storage system only considers online characteristic of each user, and aims at increasing data availability. However, we notice that, without considering the bandwidth capability of each user, a system might replicate popular data at a user who has a long online duration but does not have enough bandwidth capability to support all the requests. Therefore, in this work, we propose a swap-based replication scheme that jointly considers online characteristic, data popularity and bandwidth capability to improve not only data availability, but also access probability for each data item.