SyncBleed：针对零介入配对与认证（ZIPA）的现实威胁模型及缓解策略
SyncBleed: A Realistic Threat Model and Mitigation Strategy for Zero-Involvement Pairing and Authentication (ZIPA)
AI总结：
针对 ZIPA 在公共无线信道泄露密钥信息的问题，本文提出被动攻击 SyncBleed，并设计不泄露信息且可在 4 秒内生成密钥、达到 90–95% 比特一致率的 TREVOR 缓解方法。
摘要：
零介入配对与认证（ZIPA）是一项很有前景的技术，可用于大规模物联网（IoT）设备网络的自动配置。目前，这些网络采用基于密码的认证，难以扩展到少数几台设备以上。为应对这一挑战，支持 ZIPA 的设备能够从周围环境信号中自主提取相同的认证或加密密钥。然而，在密钥协商过程中，现有 ZIPA 系统会在公共无线信道上泄露信息，使攻击者得以获知密钥。我们展示了一种名为 SyncBleed 的被动攻击，它利用泄露的信息重构 ZIPA 系统生成的密钥。为缓解 SyncBleed，我们提出 TREVOR，这是一种改进的密钥生成技术，能够在不泄露信息的情况下从环境信号中生成近乎相同的比特序列。我们证明，TREVOR 可在 4 秒内从多种环境信号类型生成密钥，并且在各类环境源中的不同设备之间持续达到 90–95% 的比特一致率。
英文摘要：
Zero Involvement Pairing and Authentication (ZIPA) is a promising technique for auto-provisioning large networks of Internet-of-Things (IoT) devices. Presently, these networks use password-based authentication, which is difficult to scale to more than a handful of devices. To deal with this challenge, ZIPA enabled devices autonomously extract identical authentication or encryption keys from ambient environmental signals. However, during the key negotiation process, existing ZIPA systems leak information on a public wireless channel which can allow adversaries to learn the key. We demonstrate a passive attack called SyncBleed, which uses leaked information to reconstruct keys generated by ZIPA systems. To mitigate SyncBleed, we present TREVOR, an improved key generation technique that produces nearly identical bit sequences from environmental signals without leaking information. We demonstrate that TREVOR can generate keys from a variety of environmental signal types under 4 seconds, consistently achieving a 90-95% bit agreement rate across devices within various environmental sources.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
