Related website: [THaW.org]
Related projects: [Amanuensis], [Amulet], [Auracle], [SIMBA], [TISH]
Related keywords: [authentication], [education], [iot], [mhealth], [patent], [privacy], [security], [sensors], [survey], [wearable], [wifi]
In the Trustworthy Health and Wellness (THaW) project, which was a broad project involving multiple universities, my group was focused mostly wearable and portable devices for use in health monitoring and management, with an emphasis on the security and privacy issues that arise with these devices and their apps. We considered wearable, mobile, or home-based technologies being used by patients or clinical staff, and addressed issues of data integrity and authenticity, person identification and authentication, and usability.
What follows is a summary of THaW research by David Kotz and his students and postdocs. For more information about the THaW project, and a broader description of its contributions and publications (not just those including David Kotz and his students), see the THaW website and the annotated bibliography of all THaW work (through 2020) at [landwehr:thaw-tr].
Many of these ideas have patents that are available for license from Dartmouth [pierson:wanda-patent, pierson:wanda-patent2, pierson:snap-patent, pierson:closetalker-patent, pierson:closetalker-patent2, liang:lighttouch-patent] or from EMC [molina-markham:patent9961547].
Nearly every setting is increasingly populated with wireless and mobile devices -- whether appliances in a home, medical devices in a health clinic, sensors in an industrial setting, or devices in an office or school. There are three fundamental operations when bringing a new device into any of these settings: (1) to configure the device to join the wireless local-area network, (2) to partner the device with other nearby devices so they can work together, and (3) to configure the device so it connects to the relevant individual or organizational account in the cloud. The challenge is to accomplish all three goals simply, securely, and consistent with user intent. Tim Pierson's PhD thesis focused on simple and secure means for a person to introduce two Wi-Fi devices, and to securely transfer information between them, resulting in systems called Wanda, SNAP, and CloseTalker. [pierson:thesis]. Each is described below.
Wanda is a 'magic wand' that accomplishes all three of the above goals; we developed and evaluated a prototype implementation [pierson:wanda-demo, pierson:wanda, pierson:wanda-tr]. pierson:wanda-patent, pierson:wanda-patent2, pierson:thesis].
SNAP -- SiNgle Antenna Proximity -- allows a single-antenna Wi-Fi device to quickly determine proximity with another Wi-Fi device. Our technique leverages the repeating nature Wi-Fi's preamble and the behavior of a signal in a transmitting antenna's near-field region to detect proximity with high probability; SNAP never falsely declares proximity at ranges longer than 14 cm. [pierson:snap, pierson:snap-poster, pierson:snap-patent, pierson:s3, pierson:thesis].
CloseTalker allows simple, secure, ad hoc communication between devices in close physical proximity, while jamming the signal so it is unintelligible to any receivers more than a few centimeters away. CloseTalker exploits Wi-Fi MIMO antennas and the fundamental physics of radio to establish secure communication between devices that have never previously met. We demonstrate that CloseTalker is able to facilitate secure in-band communication between devices in close physical proximity (about 5 cm), even though they have never met nor shared a key [pierson:closetalker, pierson:closetalker-patent, pierson:closetalker-patent2, pierson:thesis].
In another approach for secure introductions, VibeRing automatically and transparently shares a secret between a user and a handheld smart device. VibeRing uses an out-of-band communication channel -- vibration, generated by a custom smartRing -- to share a secret with a compatible IoT device. Through a user study with 12 participants we show that in the best case we can exchange 85.9% messages successfully [sen:vibering-poster, sen:vibering, sen:vibering-j].
In another approach for secure introductions, LightTouch uses standard RF methods (like Bluetooth) for communicating the data to display, securely bootstrapped with a key shared via a brightness channel between the low cost, low power, ambient light sensor of a wearable and the screen of the display. A screen touch gesture is adopted by users to ensure the modulation of screen brightness can be accurately and securely captured by the ambient light sensor. Wireless coordination with the processor driving the display establishes a shared secret based on the brightness channel information. We further propose novel on-screen localization and correlation algorithms to improve security and reliability. Through experiments we demonstrate that LightTouch is compatible with current display and wearable designs, easy-to-use (5-6 seconds), reliable for connecting multiple displays in various ambient light conditions (98% success connection ratio), and secure against impersonation attacks [liang:lighttouch-patent, liang:jlighttouch, liang:lighttouch, liang:healthtech14.
BASTION-SGX presents work towards realizing architectural support for Bluetooth Trusted I/O on SGX-enabled platforms, with the goal of providing I/O data protection that does not rely on system software security. The paper describes our proof-of-concept work that extends existing over-the-air Bluetooth security all the way to an SGX enclave by securing user data between the Bluetooth Controller and an SGX enclave [peters:bastionsgx, peters:thesis].
VIA presents a method for detecting anomalous behavior in Bluetooth traffic, as observed by the central host -- with the goal of detecting malicious behavior by peripheral devices, or perhaps imposter peripherals that are spoofing legitimate peripherals; see Chapter 4 in Travis Peters' thesis [peters:thesis] and a WiSec'21 paper derived from that chapter [peters:via].
Seamless Authentication using Wristbands (SAW) is an authentication method for desktop computers that addresses the lack of 'intentionality' in prior proximity-based methods. In SAW, a user wears a wristband that acts as the user's identity token; to authenticate to a desktop, the user provides a low-effort input by tapping a key on the keyboard multiple times or wiggling the mouse with the wristband hand. This input to the desktop conveys that someone wishes to log in to the desktop, and SAW verifies the user who wishes to log in by confirming the user's proximity and correlating the received keyboard or mouse inputs with the user's wrist movement, as measured by the wristband [mare:saw, mare:thesis]. These ideas are patented and are available for license from Dartmouth [mare:saw-patent].
We then extended SAW to CSAW: Continuous Smartphone Authentication using Wristbands. In CSAW, users wear a wristband (a smartwatch or a fitness band) with built-in motion sensors, and by comparing the wristband's motion with the phone's motion, CSAW continuously produces a score indicating its confidence that the person holding (and using) the phone is the person wearing the wristband. This score provides the foundation for a wide range of authentication decisions (e.g., unlocking phone, deauthentication, or limiting phone access). CSAW was able to conduct initial authentication with over 99% accuracy and continuous authentication with over 96.5% accuracy [mare:csaw19, molina-markham:patent9961547, mare:thesis].
We also explored a ring-based alternative to SAW. In AuthoRing an eligible desktop-computer user wears a digital ring with accelerometers and wireless communication capability. When input is detected at the mouse or keyboard, the computer's AuthoRing system correlates hand-motion data received from the ring with the input data from the computer's window manager, and detects imposter attacks when these data are insufficiently correlated. We implemented the AuthoRing system and evaluated its security, efficiency, and usability; we found that imposter attacks can be effectively detected and the required operations happen quickly with negligible delays experienced by the user [liang:wearsys17].
Finally, related to CSAW, we also explored methods for continuous smartphone authentication based on the user's patterns of use of that smartphone [wang:auth].
For many wearable devices, it is critical to identify the wearer, allowing sensor data to be properly labeled or personalized behavior to be properly achieved. We proposed the use of vocal resonance, that is, the sound of the person's voice as it travels through the person's body -- a method we anticipate would be suitable for devices worn on the head, neck, or chest. In this regard, we go well beyond the simple challenge of speaker recognition: we want to know who is wearing the device. Our DNN method achieved balanced accuracy 0.914 for identification and 0.961 for verification by using an LSTM-based deep-learning model, while our efficient GMM method achieved balanced accuracy 0.875 for identification and 0.942 for verification [liu:vocalresonance, liu:mobisys17, liu:wearsys17].
We developed SPICE, a crowdsourcing system that extends the capabilities of location-based applications and allows users to connect and exchange information with users in spatial and temporal proximity. We define this incident of spatio-temporal proximity as a close encounter. Typically, location-based application users store their information on a server, and trust the server to provide access only to authorized users, not misuse the data or disclose their location history. Our system, called SPICE, addresses these privacy issues by leveraging Wi-Fi access points to connect users and encrypt their information before it is exchanged, so only users in close encounters have access to the information. We present the design of the system and describe the challenges in implementing the protocol in a real-world application [prasad:spice, prasad:thesis].
In ENACT we explore the concept of close encounters in the context of privacy-preserving contact tracing, in which a person infected with a contagious disease could alert others to whom they may have spread the virus. We designed a smartphone-based system that allows people infected with a contagious virus to send alerts to other users who may have been exposed to the same virus due to a close encounter. We addressed three challenges: finding devices in close encounters with minimal changes to existing infrastructure, ensuring authenticity of alerts, and protecting privacy of all users [prasad:enact, prasad:thesis].
Mobile devices allow people to collect and share health and health-related information with recipients such as health providers, family and friends, employers and insurance companies, to obtain health, emotional or financial benefits. People may consider certain health information sensitive and prefer to disclose only what is necessary. This dissertation presents our findings about factors that affect people's sharing behavior, describes scenarios in which people may wish to collect and share their personal health-related information with others, and proposes frameworks to provide the desired privacy controls. It also expands on SPICE and ENACT (described above). Finally, it includes an evaluation of how Bluetooth beacons and Wi-Fi access points could be used in support of these systems for close encounters, and present our experiences and findings from a deployment study on Dartmouth campus. [prasad:thesis, prasad:mobisys-poster].
In related work in the Amulet project, we explored the use of attribute-based access control and hash-chaining techniques to allow privacy-preserving data sharing... allowing the mHealth data subject to decide with whom, and when, their mHealth data will be shared [greene:sharehealth, greene:thesis]. This cloud-based data-sharing platform was meant to receive data securely from mHealth devices, and we developed an efficient crypographic protocol for mHealth devices to communicate through a smartphone and into the cloud [harmon:thesis].
In related work in the Amanuensis project, we expanded on that idea to support end-to-end data provenance, allowing data from mHealth devices to be secured at the source (the mHealth device), into cloud storage, through data-processing steps that may aggregate or transform the data, and limit access to authorized parties... wherein those data 'consumers' can validate the provenance of the resulting information through blockchain and trusted-hardware mechanisms [hardin:thesis].
As part of our THaW research we took four opportunities to convey a broader sense of the state of the art, and the challenges ahead, in security and privacy for mobile health, healthcare information systems, cloud technology, and the emerging Internet of Things [kotz:agenda, kotz:frontiers, reza:nocloud, kotz:safethings].
In a THaW team effort we developed an educational module in which high-school students were introduced to mHealth, security, privacy, and computing careers, through a short hands-on experience with FitBit exercise trackers. [carrigan:fitbit].
The following people were co-authors on one or more of the papers cited here: José Camacho, Joseph Carrigan, Cory Cornelius, Kevin Fu, Carl Gunter, David Kotz, Santosh Kumar, Reshma Lal, Carl Landwehr, Xiaohui Liang, Rui Liu, Shrirang Mare, Varun Mishra, Andrés Molina-Markham, Pradeep Pappachan, Travis Peters, Ron Peterson, Timothy Pierson, Aarathi Prasad, Reza Rawassizadeh, Avi Rubin, Sougata Sen, Srikanth Varadarajan, Bingyue Wang, Jonathan Weiner, and Tianlong Yun.
THaW was primarily funded by the US National Science Foundation (Secure and Trustworthy Computing, SaTC) under award 1329686. Some projects or authors had additional sources of funding, noted in the acknowledgement section of individual papers.
The views and conclusions contained on this site and in its documents are those of the authors and should not be interpreted as necessarily representing the official position or policies, either expressed or implied, of the sponsor(s). Any mention of specific companies or products does not imply any endorsement by the authors or by the sponsor(s).
This list includes only those including David Kotz as co-author or thesis advisor. For a complete list of THaW papers, see the THaW website.
[The list below is also available in BibTeX]
Papers are listed in reverse-chronological order;
click an entry to pop up the abstract.
For full information and pdf, please click Details link.
Follow updates with RSS.
In this thesis, we present an end-to-end solution for providing information provenance for mHealth data, which begins by securing mHealth data at its source: the mHealth device. To this end, we devise a memory-isolation method that combines compiler-inserted code and Memory Protection Unit (MPU) hardware to protect application code and data on ultra-low-power micro-controllers. Then we address the security of mHealth data outside of the source (e.g., data that has been uploaded to smartphone or remote-server) with our health-data system, Amanuensis, which uses Blockchain and Trusted Execution Environment (TEE) technologies to provide confidential, yet verifiable, data storage and computation for mHealth data. Finally, we look at identity privacy and data freshness issues introduced by the use of blockchain and TEEs. Namely, we present a privacy-preserving solution for blockchain transactions, and a freshness solution for data access-control lists retrieved from the blockchain.
To address this problem, in this paper, we investigate the use of vibration, generated by a smartRing, as an out-of-band communication channel to unobtrusively share a secret with a smartThing. This exchanged secret can be used to bootstrap a secure wireless channel over which the smartphone (or another trusted device) and the smartThing can communicate. We present the design, implementation, and evaluation of this system, which we call VibeRing. We describe the hardware and software details of the smartThing and smartRing. Through a user study we demonstrate that it is possible to share a secret with various objects quickly, accurately and securely as compared to several existing techniques. Overall, we successfully exchange a secret between a smartRing and various smartThings, at least 85.9% of the time. We show that VibeRing can perform this exchange at 12.5 bits/second at a bit error rate of less than 2.5%. We also show that VibeRing is robust to the smartThing’s constituent material as well as the holding style. Finally, we demonstrate that a nearby adversary cannot decode or modify the message exchanged between the trusted devices.
In this special issue, we sought to assemble a set of articles addressing novel computational research related to any aspect of the design or use of wearables in medicine and health, including wearable hardware design, AI and data analytics algorithms, human-device interaction, security/privacy, and novel applications. Here, in Part 2 of a two-part collection of articles on this topic, we are pleased to share four articles about the use of wearables for skill assessment, activity recognition, mood recognition, and deep learning.
In this special issue, we sought to assemble a set of articles addressing novel computational research related to any aspect of the design or use of wearables in medicine and health, including wearable hardware design, AI and data analytics algorithms, human-device interaction, security/privacy, and novel applications. Here, in Part 1 of a two-part collection of articles on this topic, we are pleased to share seven articles about the use of wearables for emotion sensing, physiotherapy, virtual reality, automated meal detection, a human data model, and a survey of physical-activity tracking.
In the Internet of Things (IoT), everyday objects are equipped with the ability to compute and communicate. These smart things have invaded the lives of everyday people, being constantly carried or worn on our bodies, and entering into our homes, our healthcare, and beyond. This has given rise to wireless networks of smart, connected, always-on, personal things that are constantly around us, and have unfettered access to our most personal data as well as all of the other devices that we own and encounter throughout our day. It should, therefore, come as no surprise that our personal devices and data are frequent targets of ever-present threats. Securing these devices and networks, however, is challenging. In this dissertation, we outline three critical problems in the context of Wireless Personal Area Networks (WPANs) and present our solutions to these problems.
First, I present our Trusted I/O solution (BASTION-SGX) for protecting sensitive user data transferred between wirelessly connected (Bluetooth) devices. This work shows how in-transit data can be protected from privileged threats, such as a compromised OS, on commodity systems. I present insights into the Bluetooth architecture, Intel’s Software Guard Extensions (SGX), and how a Trusted I/O solution can be engineered on commodity devices equipped with SGX.
Second, I present our work on AMULET and how we successfully built a wearable health hub that can run multiple health applications, provide strong security properties, and operate on a single charge for weeks or even months at a time. I present the design and evaluation of our highly efficient event-driven programming model, the design of our low-power operating system, and developer tools for profiling ultra-low-power applications at compile time.
Third, I present a new approach (VIA) that helps devices at the center of WPANs (e.g., smartphones) to verify the authenticity of interactions with other devices. This work builds on past work in anomaly detection techniques and shows how these techniques can be applied to Bluetooth network traffic. Specifically, we show how to create normality models based on fine- and course-grained insights from network traffic, which can be used to verify the authenticity of future interactions.
We present theoretical and practical evaluation of a method called SNAP -- SiNgle Antenna Proximity -- that allows a single-antenna Wi-Fi device to quickly determine proximity with another Wi-Fi device. Our proximity detection technique leverages the repeating nature Wi-Fi’s preamble and the behavior of a signal in a transmitting antenna’s near-field region to detect proximity with high probability; SNAP never falsely declares proximity at ranges longer than 14 cm.
Our system, CloseTalker, allows simple, secure, ad hoc communication between devices in close physical proximity, while jamming the signal so it is unintelligible to any receivers more than a few centimeters away. CloseTalker does not require any specialized hardware or sensors in the devices, does not require complex algorithms or cryptography libraries, occurs only when intended by the user, and can transmit a short burst of data or an address and key that can be used to establish long-term or long-range communications at full bandwidth.
In this paper we present a theoretical and practical evaluation of CloseTalker, which exploits Wi-Fi MIMO antennas and the fundamental physics of radio to establish secure communication between devices that have never previously met. We demonstrate that CloseTalker is able to facilitate secure in-band communication between devices in close physical proximity (about 5 cm), even though they have never met nor shared a key.
We present an authentication method for desktops called Seamless Authentication using Wristbands (SAW), which addresses the lack of intentionality limitation of proximity-based methods. SAW uses a low-effort user input step for explicitly conveying user intentionality, while keeping the overall usability of the method better than password-based methods. In SAW, a user wears a wristband that acts as the user’s identity token, and to authenticate to a desktop, the user provides a low-effort input by tapping a key on the keyboard multiple times or wiggling the mouse with the wristband hand. This input to the desktop conveys that someone wishes to log in to the desktop, and SAW verifies the user who wishes to log in by confirming the user’s proximity and correlating the received keyboard or mouse inputs with the user’s wrist movement, as measured by the wristband. In our feasibility user study (n=17), SAW proved quick to authenticate (within two seconds), with a low false-negative rate of 2.5% and worst-case false-positive rate of 1.8%. In our user perception study (n=16), a majority of the participants rated it as more usable than passwords.
We propose a new approach: using jamming to thwart adversaries located more than a few centimeters away, while still allowing devices in close physical proximity to securely share data. To accomplish this secure data transfer we exploit MIMO antennas and the Inverse-Square Law.
We present and evaluate a prototype implementation to demonstrate this protocol’s feasibility on low-power wearable devices, and present a case for the system’s ability to meet critical security properties under a specific adversary model and trust assumptions.
First, we present the findings of a user study we conducted to understand people’s authentication behavior: things they authenticate to, how and when they authenticate, authentication errors they encounter and why, and their opinions about authentication. In our study, participants performed about 39 authentications per day on average; the majority of these authentications were to personal computers (desktop, laptop, smartphone, tablet) and with passwords, but the number of authentications to other things (e.g., car, door) was not insignificant. We saw a high failure rate for desktop and laptop authentication among our participants, affirming the need for a more usable authentication method. Overall, we found that authentication was a noticeable part of all our participants’ lives and burdensome for many participants, but they accepted it as cost of security, devising their own ways to cope with it.
Second, we propose a new approach to authentication, called bilateral authentication, that leverages wrist-wearable technology to enable seamless authentication for things that people use with their hands, while wearing a smart wristband. In bilateral authentication two entities (e.g., user’s wristband and the user’s phone) share their knowledge (e.g., about user’s interaction with the phone) to verify the user’s identity. Using this approach, we developed a seamless authentication method for desktops and smartphones. Our authentication method offers quick and effortless authentication, continuous user verification while the desktop (or smartphone) is in use, and automatic deauthentication after use. We evaluated our authentication method through four in-lab user studies, evaluating the method’s usability and security from the system and the user’s perspective. Based on the evaluation, our authentication method shows promise for reducing users’ authentication burden for desktops and smartphones.
We address this problem of balancing disclosure and utility of personal information collected by mobile technologies. We believe subjects can decide how best to share their information if they are aware of the benefits and risks of sharing. We developed ShareBuddy, a privacy-aware architecture that allows recipients to request information and specify the benefits the subjects will receive for sharing each piece of requested information; the architecture displays these benefits and warns subjects about the risks of sharing. We describe the ShareBuddy architecture in this poster.