The wireless medium contains domain-specific information that can be used to complement and enhance traditional security mechanisms. In this paper we propose ways to exploit the fact that, in a typically rich scattering environment, the radio channel response decorrelates quite rapidly in space. Specifically, we describe a physical-layer algorithm that combines channel probing (M complex frequency response samples over a bandwidth W) with hypothesis testing to determine whether current and prior communication attempts are made by the same user (same channel response). In this way, legitimate users can be reliably authenticated and false users can be reliably detected. To evaluate the feasibility of our algorithm, we simulate spatially variable channel responses in real environments using the WiSE ray-tracing tool; and we analyze the ability of a receiver to discriminate between transmitters (users) based on their channel frequency responses in a given office environment. For several rooms in the extremities of the building we considered, we have confirmed the efficacy of our approach under static channel conditions. For example, measuring five frequency response samples over a bandwidth of 100 MHz and using a transmit power of 100 mW, valid users can be verified with 99% confidence while rejecting false users with greater than 95% confidence.
Browser fingerprinting consists in collecting attributes from a web browser to build a browser fingerprint. In this work, we assess the adequacy of browser fingerprints as an authentication factor, on a dataset of 4,145,408 fingerprints composed of 216 attributes. It was collected throughout 6 months from a population of general browsers. We identify, formalize, and assess the properties for browser fingerprints to be usable and practical as an authentication factor. We notably evaluate their distinctiveness, their stability through time, their collection time, and their size in memory. We sho…
Biometric authentication is getting increasingly popular due to the convenience of using unique individual traits, such as fingerprints, palm veins, irises. Especially fingerprints are widely used nowadays due to the availability and low cost of fingerprint scanners. To avoid identity theft or impersonation, fingerprint data is typically stored locally, e.g., in a trusted hardware module, in a single device that is used for user enrollment and authentication. Local storage, however, limits the ability to implement distributed applications, in which users can enroll their fingerprint once and u…
Modern browsers give access to several attributes that can be collected to form a browser fingerprint. Although browser fingerprints have primarily been studied as a web tracking tool, they can contribute to improve the current state of web security by augmenting web authentication mechanisms. In this paper, we investigate the adequacy of browser fingerprints for web authentication. We make the link between the digital fingerprints that distinguish browsers, and the biological fingerprints that distinguish Humans, to evaluate browser fingerprints according to properties inspired by biometric a…
Fingerprint authentication techniques have been employed in various Internet of Things (IoT) applications for access control to protect private data, but raw fingerprint template leakage in unprotected IoT applications may render the authentication system insecure. Cancelable fingerprint templates can effectively prevent privacy breaches and provide strong protection to the original templates. However, to suit resource-constrained IoT devices, oversimplified templates would compromise authentication performance significantly. In addition, the length of existing cancelable fingerprint templates…
Browser fingerprinting consists into collecting attributes from a web browser. Hundreds of attributes have been discovered through the years. Each one of them provides a way to distinguish browsers, but also comes with a usability cost (e.g., additional collection time). In this work, we propose FPSelect, an attribute selection framework allowing verifiers to tune their browser fingerprinting probes for web authentication. We formalize the problem as searching for the attribute set that satisfies a security requirement and minimizes the usability cost. The security is measured as the proportio…
In this demonstration, we put ourselves in the place of a website manager who seeks to use browser fingerprinting for web authentication. The first step is to choose the attributes to implement among the hundreds that are available. To do so, we developed BrFAST, an attribute selection platform that includes FPSelect, an algorithm that rigorously selects the attributes according to a trade-off between security and usability. BrFAST is configured with a set of parameters for which we provide values for BrFAST to be usable as is. We notably include the resources to use two publicly available bro…
On a General Theoretical Framework for Radio Frequency Fingerprint-Based Authentication
School of Computer Science & Technology, Xidian University（西安电子科技大学计算机科学与技术学院）；Shaanxi Key Laboratory of Network and System Security（陕西省网络与系统安全重点实验室）；College of Cybersecurity, Tarim University（塔里姆大学网络安全学院）；School of Systems Information Science, Future University Hakodate（函馆未来大学系统情报学系）
Radio frequency (RF) fingerprinting is a tool which allows for authentication by utilizing distinct and random distortions in a received signal based on characteristics of the transmitter. We introduce a deep learning-based authentication method for a novel RF fingerprinting system called Physically Unclonable Wireless Systems (PUWS). An element of PUWS is based on the concept of Chaotic Antenna Arrays (CAAs) that can be cost effectively manufactured by utilizing mask-free laser-enhanced direct print additive manufacturing (LE-DPAM). In our experiments, using simulation data of 300 CAAs each e…
In this emerging data-driven world, secure and ubiquitous authentication mechanisms are necessary prior to any confidential information delivery. Biometric authentication has been widely adopted as it provides a unique and non-transferable solution for user authentication. In this article, the authors envision the need for an in-field, remote and on-demand authentication system for a highly mobile and tactical environment, such as critical information delivery to soldiers in a battlefield. Fingerprint-based in-field biometric authentication combined with the conventional password-based techniq…
University of Washington（华盛顿大学）；Northeastern University（东北大学）
In this paper, we provide an overview of fingerprint sensing methods used for authentication. We analyze the current fingerprint sensing technologies, from algorithmic, as well as from hardware perspectives. We then focus on methods to detect physical liveness, defined as techniques that can be used to ensure that a living human user is attempting to authenticate on a system. We analyze how effective these methods are at preventing attacks where a malicious entity tries to trick a fingerprint-based authentication system to accept a fake finger as a real one (spoofing attacks). We then identify…
Physical layer authentication relies on detecting unique imperfections in signals transmitted by radio devices to isolate their fingerprint. Recently, deep learning-based authenticators have increasingly been proposed to classify devices using these fingerprints, as they achieve higher accuracies compared to traditional approaches. However, it has been shown in other domains that adding carefully crafted perturbations to legitimate inputs can fool such classifiers. This can undermine the security provided by the authenticator. Unlike adversarial attacks applied in other domains, an adversary h…
Especially in context of critical urban infrastructures, trust in IoT data is of utmost importance. While most technology stacks provide means for authentication and encryption of device-to-cloud traffic, there are currently no mechanisms to rule out physical tampering with an IoT device's sensors. Addressing this gap, we introduce a new method for extracting a hardware fingerprint of an IoT sensor which can be used for secret-free authentication. By comparing the fingerprint against reference measurements recorded prior to deployment, we can tell whether the sensing hardware connected to the …
Radio Frequency fingerprints (RFF) authentication is one of the methods for the physical-layer information security, which uses the hardware characteristics of the transmitter to identify its real identity. In order to improve the performance of RFF based on preamble with fixed duration, a nonlinear RFF authentication method based on payload symbols is proposed for the wireless OFDM devices with the bit mapping scheme of QPSK. The communication system is modeled as a Hammerstein system containing the nonlinear transmitter and wireless multipath fading channel. A parameter separation technique …
While the literature on RF fingerprinting-based authentication and key distillation is vast, the two topics have customarily been studied separately. In this paper, starting from the observation that the wireless channel is a composite, deterministic / stochastic process, we propose a power domain decomposition that allows performing the two tasks simultaneously. We devise intelligent pre-processing schemes to decompose channel state information (CSI) observation vectors into "predictable" and "unpredictable" components. The former, primarily due to large-scale fading, can be used for node aut…
We propose an enhanced version of the Authentication with Built-in Camera (ABC) protocol by employing a deep learning solution based on built-in motion sensors. The standard ABC protocol identifies mobile devices based on the photo-response non-uniformity (PRNU) of the camera sensor, while also considering QR-code-based meta-information. During authentication, the user is required to take two photos that contain two QR codes presented on a screen. The presented QR code images also contain a unique probe signal, similar to a camera fingerprint, generated by the protocol. During verification, th…
Graduate School of Science and Engineering of Kansai University（关西大学理工学部）；Osaka Research Institute of Industrial Science and Technology（大阪工业科学技术研究所）；Faculty of Engineering Science of Kansai University（关西大学工程科学部）
In recent years, biometric authentication technology for smartphones has become widespread, with the mainstream methods being fingerprint authentication and face recognition. However, fingerprint authentication cannot be used when hands are wet, and face recognition cannot be used when a person is wearing a mask. Therefore, we examine a personal authentication system using the pinna as a new approach for biometric authentication on smartphones. Authentication systems based on the acoustic transfer function of the pinna (PRTF: Pinna Related Transfer Function) have been investigated. However, th…
Prairie View A&M University（普雷里维尤农工大学）；Texas A&M University System（德州农工大学系统）
In this paper, we propose Device Authentication Code (DAC), a novel method for authenticating IoT devices with wireless interface by exploiting their radio frequency (RF) signatures. The proposed DAC is based on RF fingerprinting, information theoretic method, feature learning, and discriminatory power of deep learning. Specifically, an autoencoder is used to automatically extract features from the RF traces, and the reconstruction error is used as the DAC and this DAC is unique to the device and the particular message of interest. Then Kolmogorov-Smirnov (K-S) test is used to match the distri…
Radio Frequency Fingerprinting through Deep Learning (RFFDL) is a data-driven IoT authentication technique that leverages the unique hardware-level manufacturing imperfections associated with a particular device to recognize (fingerprint) the device based on variations introduced in the transmitted waveform. The proposed SignCRF is a scalable, channel-agnostic, data-driven radio authentication platform with unmatched precision in fingerprinting wireless devices based on their unique manufacturing impairments and independent of the dynamic channel irregularities caused by mobility. SignCRF cons…
Internet banking (IB) continues to face security concerns arising from illegal access to users accounts. Use of personal identification numbers (PIN) as a single authentication method for IB users is prone to insecurities such as phishing, hacking and shoulder surfing. Fingerprint matching (FPM) as an alternative to PIN equally has a downside as fingerprints reside on individual mobile devices. A survey we conducted from 170 IB respondents of 5 different banks in Brunei established that majority (65%) of them preferred use of biometric authentication methods. In this work, we propose a two-lev…
Reaping the benefits of the Internet of things (IoT) system is contingent upon developing IoT-specific security solutions. Conventional security and authentication solutions often fail to meet IoT security requirements due to the computationally limited and portable nature of IoT objects. In this paper, an IoT objects authentication framework is proposed. The framework uses device-specific information, called fingerprints, along with a transfer learning tool to authenticate objects in the IoT. The framework tracks the effect of changes in the physical environment on fingerprints and uses uniqu…
Consider impersonation attack by an active malicious nano node (Eve) on a diffusion based molecular communication (DbMC) system---Eve transmits during the idle slots to deceive the nano receiver (Bob) that she is indeed the legitimate nano transmitter (Alice). To this end, this work exploits the 3-dimensional (3D) channel impulse response (CIR) with $L$ taps as device fingerprint for authentication of the nano transmitter during each slot. Specifically, Bob utilizes the Alice's CIR as ground truth to construct a binary hypothesis test to systematically accept/reject the data received in each s…
Biometrics are widely used for authentication in consumer devices and business settings as they provide sufficiently strong security, instant verification and convenience for users. However, biometrics are hard to keep secret, stolen biometrics pose lifelong security risks to users as they cannot be reset and re-issued, and transactions authenticated by biometrics across different systems are linkable and traceable back to the individual identity. In addition, their cost-benefit analysis does not include personal implications to users, who are least prepared for the imminent negative outcomes,…
Physical unclonable function (PUF) has been proposed as a promising and trustworthy solution to a variety of cryptographic applications. Here we propose a non-imaging based authentication scheme for optical PUFs materialized by random scattering media, in which the characteristic fingerprints of optical PUFs are extracted from stochastical fluctuations of the scattered light intensity with respect to laser challenges which are detected by a single-pixel detector. The randomness, uniqueness, unpredictability, and robustness of the extracted fingerprints are validated to be qualified for real au…
In this paper, we show that a recently published lightweight adaptation of a Fingerprint matching algorithm called the Minutia Cylinder-Code may not be secure as intruders may be able to illegitimately yet successfully authenticate themselves to the system under consideration. We also show that the lightweight adaptation has other privacy related vulnerabilities that make it unsuitable for use in Biometrics. We make it clear that we are neither investigating nor commenting on the security of the original Minutia Cylinder-Code algorithm by itself, rather we highlight the vulnerabilities of the …
University of Tennessee at Chattanooga（田纳西大学查塔努加分校）
It is estimated that the number of IoT devices will reach 75 billion in the next five years. Most of those currently, and to be deployed, lack sufficient security to protect themselves and their networks from attack by malicious IoT devices that masquerade as authorized devices to circumvent digital authentication approaches. This work presents a PHY layer IoT authentication approach capable of addressing this critical security need through the use of feature reduced Radio Frequency-Distinct Native Attributes (RF-DNA) fingerprints and Support Vector Machines (SVM). This work successfully demon…
Rapid LoRA Aggregation for Wireless Channel Adaptation in Open-Set Radio Frequency Fingerprinting
School of Internet of Things, Nanjing University of Posts and Telecommunications（南京邮电大学物联网学院）；School of Cyber Science and Engineering, Southeast University（东南大学网络空间安全学院）；National Mobile Communications Research Lab, Southeast University（东南大学国家移动通信研究中心）
Physical-layer security is regaining traction in the research community, due to the performance boost introduced by deep learning classification algorithms. This is particularly true for sender authentication in wireless communications via radio fingerprinting. However, previous research efforts mainly focused on terrestrial wireless devices while, to the best of our knowledge, none of the previous work took into consideration satellite transmitters. The satellite scenario is generally challenging because, among others, satellite radio transducers feature non-standard electronics (usually aged…
In Internet of Things, where billions of devices with limited resources are communicating with each other, security has become a major stumbling block affecting the progress of this technology. Existing authentication schemes-based on digital signatures have overhead costs associated with them in terms of computation time, battery power, bandwidth, memory, and related hardware costs. Radio frequency fingerprint (RFF), utilizing the unique device-based information, can be a promising solution for IoT. However, traditional RFFs have become obsolete because of low reliability and reduced user cap…
BEACON: A Multimodal Dataset for Learning Behavioral Fingerprints from Gameplay Data
Computer Science and Engineering Department Thapar Institute of Engineering and Technology（计算机科学与工程系 泰帕尔工程与技术学院）；David R Cheriton School of Computer Science University of Waterloo, Canada（大卫·R·切里顿计算机科学学院 温哥华大学）
Previous research works have endorsed the use of delays and clock skews for detecting intrusions or fingerprinting ECUs on the CAN bus. Similar techniques have been also proposed for establishing a time-covert cryptographic authentication channel, in this way cleverly removing the need for cryptographic material inside the limited payload of CAN frames. The main shortcoming of such works is the limited security level that can be achieved under normal CAN-bus traffic. In this work we endeavour to test the limits of the achievable security level by relying on optimization algorithms for scheduli…
Radio Frequency Fingerprinting (RFF) is one of the promising passive authentication approaches for improving the security of the Internet of Things (IoT). However, with the proliferation of low-power IoT devices, it becomes imperative to improve the identification accuracy at low SNR scenarios. To address this problem, this paper proposes a general Denoising AutoEncoder (DAE)-based model for deep learning RFF techniques. Besides, a partially stacking method is designed to appropriately combine the semi-steady and steady-state RFFs of ZigBee devices. The proposed Partially Stacking-based Convol…
