More Like this

1. Insider-Resistant Context-Based Pairing for Multimodality Sleep Apnea Test

   https://doi.org/10.1109/GLOBECOM46510.2021.9685852  

   Zheng, Yao; Islam, Shekh Md; Pan, Yanjun; Millan, Marionne; Aggelopoulos, Samson; Lu, Brian; Yang, Alvin; Yang, Thomas; Aelmore, Stephanie; Chang, Willy; et al (December 2021, 2021 IEEE Global Communications Conference (GLOBECOM))

   The increasingly sophisticated at-home screening systems for obstructive sleep apnea (OSA), integrated with both contactless and contact-based sensing modalities, bring convenience and reliability to remote chronic disease management. However, the device pairing processes between system components are vulnerable to wireless exploitation from a noncompliant user wishing to manipulate the test results. This work presents SIENNA, an insider-resistant context-based pairing protocol. SIENNA leverages JADE-ICA to uniquely identify a user’s respiration pattern within a multi-person environment and fuzzy commitment for automatic device pairing, while using friendly jamming technique to prevent an insider with knowledge of respiration patterns from acquiring the pairing key. Our analysis and test results show that SIENNA can achieve reliable (> 90% success rate) device pairing under a noisy environment and is robust against the attacker with full knowledge of the context information. 

   more » « less
2. Do You Feel What I Hear? Enabling Autonomous IoT Device Pairing Using Different Sensor Types

   https://doi.org/10.1109/sp.2018.00041  

   Han, Jun; Chung, Albert Jin; Sinha, Manal Kumar; Harishankar, Madhumitha; Pan, Shijia; Noh, Hae Young; Zhang, Pei; Tague, Patrick (May 2018, 39th IEEE Symposium on Security and Privacy (Oakland 2018))

   Context-based pairing solutions increase the usability of IoT device pairing by eliminating any human involvement in the pairing process. This is possible by utilizing on-board sensors (with same sensing modalities) to capture a common physical context (e.g., ambient sound via each device’s microphone). However, in a smart home scenario, it is impractical to assume that all devices will share a common sensing modality. For example, a motion detector is only equipped with an infrared sensor while Amazon Echo only has microphones. In this paper, we develop a new context-based pairing mechanism called Perceptio that uses time as the common factor across differing sensor types. By focusing on the event timing, rather than the specific event sensor data, Perceptio creates event fingerprints that can be matched across a variety of IoT devices. We propose Perceptio based on the idea that devices co-located within a physically secure boundary (e.g., single family house) can observe more events in common over time, as opposed to devices outside. Devices make use of the observed contextual information to provide entropy for Perceptio’s pairing protocol. We design and implement Perceptio, and evaluate its effectiveness as an autonomous secure pairing solution. Our implementation demonstrates the ability to sufficiently distinguish between legitimate devices (placed within the boundary) and attacker devices (placed outside) by imposing a threshold on fingerprint similarity. Perceptio demonstrates an average fingerprint similarity of 94.9% between legitimate devices while even a hypothetical impossibly well-performing attacker yields only 68.9% between itself and a valid device. 

   more » « less
3. An Insider Threat Mitigation Framework Using Attribute Based Access Control

   Balogun, Olusesi; Takabi, Daniel (December 2022, 7th Workshop on Research for Insider Threats (WRIT) - Annual Computer Security Applications Conference (ACSAC) 2022)

   Insider Threat is a significant and potentially dangerous security issue in corporate settings. It is difficult to mitigate because, unlike external threats, insiders have knowledge of an organization’s access policies, access hierarchy, access protocols, and access scheduling. In addition, the complexity, time, and skill required to locate the threat source, model, and timestamp make it more difficult for organizations to combat. Several approaches to reducing insider threat have been proposed in the literature. However, the integration of access control and moving target defense (MTD) for deceiving insiders has not been adequately discussed. In this paper, we combine MTD, deception, and attribute-based access control to make it more difficult and expensive for an insider to gain unauthorized access. We introduce the concept of correlated attributes into ABAC and extend the ABAC model with MTD by generating mutated policy using the correlated attributes for insider threat mitigation. The evaluation results show that the proposed framework can effectively identify correlated attributes and produce adequate mutated policy without affecting the usability of the access control systems. 

   more » « less
4. Causal Model Extraction from Attack Trees to Attribute Malicious Insider Attacks

   https://doi.org/10.1007/978-3-030-62230-5_1  

   Ibrahim, A; Rehwald, S; Scemama, A; Andres, F; Pretschner, A (November 2020, Lecture notes in computer science)

   null (Ed.)

   In the context of insiders, preventive security measures have a high likelihood of failing because insiders ought to have sufficient privileges to perform their jobs. Instead, in this paper, we propose to treat the insider threat by a detective measure that holds an insider accountable in case of violations. However, to enable accountability, we need to create causal models that support reasoning about the causality of a violation. Current security models (e.g., attack trees) do not allow that. Still, they are a useful source for creating causal models. In this paper, we discuss the value added by causal models in the security context. Then, we capture the interaction between attack trees and causal models by proposing an automated approach to extract the latter from the former. Our approach considers insider-specific attack classes such as collusion attacks and causal-model-specific properties like preemption relations. We present an evaluation of the resulting causal models’ validity and effectiveness, in addition to the efficiency of the extraction process. 

   more » « less
5. UniverSense: IoT Device Pairing through Heterogeneous Sensing Signals

   https://doi.org/10.1145/3177102.3177108  

   Pan, Shijia; Ruiz, Carlos; Han, Jun; Bannis, Adeola; Tague, Patrick; Noh, Hae Young; Zhang, Pei (February 2018, 19th Intl Workshop on Mobile Computing Systems and Applications (HotMobile))

   Easily establishing pairing between Internet-of-Things (IoT) devices is important for fast deployment in many smart home scenarios. Traditional pairing methods, including passkey, QR code, and RFID, often require specific user interfaces, surface’s shape/material, or additional tags/readers. The growing number of low-resource IoT devices without an interface may not meet these requirements, which makes their pairing a challenge. On the other hand, these devices often already have sensors embedded for sensing tasks, such as inertial sensors. These sensors can be used for limited user interaction with the devices, but are not suitable for pairing on their own. In this paper, we present UniverSense, an alternative pairing method between low-resource IoT devices with an inertial sensor and a more powerful networked device equipped with a camera. To establish pairing between them, the user moves the low-resource IoT device in front of the camera. Both the camera and the on-device sensors capture the physical motion of the low-resource device. UniverSense converts these signals into a common state-space to generate fingerprints for pairing. We conduct real-world experiments to evaluate UniverSense and it achieves an F1 score of 99.9% in experiments carried out by five participants. 

   more » « less