通过视觉通道和视觉检测保护使用移动终端的交互式会话
Securing Interactive Sessions Using Mobile Device through Visual Channel and Visual Inspection
摘要：
从显示器到设备的摄像头建立的通信信道被称为可视信道，它有助于保护密钥交换协议。在本文中，我们研究了如何利用视觉信道可以由网络终端和移动终端，以共同验证信息在一个交互式会话，以及如何这样的信息可以共同呈现在一个用户友好的方式，考虑到移动终端只能捕获和显示一个小的区域，用户可能只想认证的选择性区域的利益。受Kiosk计算和多因素认证应用的启发，我们考虑了三种安全模型：（1）移动终端是可信的，（2）终端或移动终端中至多有一个是不诚实的，（3）终端和设备都是不诚实的，但它们不合谋或通信。我们给出了两个协议，并在上述模型下进行了研究。我们指出了一种形式的重放攻击，使一些其他简单的实现繁琐的使用。为了提高用户友好性，我们提出了一个解决方案，使用嵌入到二维条形码的视觉线索，并结合“增强现实“的框架，通过视觉检查，易于验证。我们给出了一个概念验证的实现，以表明我们的方案在实践中是可行的。
英文摘要：
Communication channel established from a display to a device's camera is known as visual channel, and it is helpful in securing key exchange protocol. In this paper, we study how visual channel can be exploited by a network terminal and mobile device to jointly verify information in an interactive session, and how such information can be jointly presented in a user-friendly manner, taking into account that the mobile device can only capture and display a small region, and the user may only want to authenticate selective regions-of-interests. Motivated by applications in Kiosk computing and multi-factor authentication, we consider three security models: (1) the mobile device is trusted, (2) at most one of the terminal or the mobile device is dishonest, and (3) both the terminal and device are dishonest but they do not collude or communicate. We give two protocols and investigate them under the abovementioned models. We point out a form of replay attack that renders some other straightforward implementations cumbersome to use. To enhance user-friendliness, we propose a solution using visual cues embedded into the 2D barcodes and incorporate the framework of "augmented reality" for easy verifications through visual inspection. We give a proof-of-concept implementation to show that our scheme is feasible in practice.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
