VibeRing
Sougata Sen, David F. Kotz · 2020
Some Internet of Things (IoT) devices - a.k.a. "smart Things" - collect meaningful information when they are in use and in physical contact with their user (e.g., a blood-pressure monitor). A Thing's wireless connectivity allows it to transfer that data to its user's trusted device, such as a smartphone. However, an adversary could also establish a communication channel with the Thing, impersonate the user and obtain access to the user's information collected by that Thing. Thus, it is essential that the Thing connects to the correct user's device. Bootstrapping such communication channels usually require an out-of-band channel to share a secret, e.g., by asking the user to input a PIN. However, manual PIN entry is cumbersome, especially when a Thing is used transiently. In this paper, we investigate the use of vibration, generated by a custom Ring, as an out-of-band communication channel to unobtrusively share a secret with a Thing. This exchanged secret can be used to bootstrap a secure wireless channel over which the Ring (or another trusted device) and the Thing can communicate. We present the design, implementation, and evaluation of this system, which we call VibeRing. Through a user study we demonstrate that it is possible to share a secret with various objects accurately and securely.