Research ArticleUsing Physical Context-Based Authentication againstExternal Attacks Models and Protocols

Wilson S Melo Jr 1 Raphael C S Machado 12 and Luiz F R C Carmo13

1National Institute of Metrology Quality and Technology Rio de Janeiro RJ Brazil2Federal Center for Technological Education Rio de Janeiro RJ Brazil3Federal University of Rio de Janeiro Rio de Janeiro RJ Brazil

Correspondence should be addressed to Wilson S Melo Jr wsjuniorinmetrogovbr

Received 25 August 2017 Revised 17 December 2017 Accepted 21 January 2018 Published 25 February 2018

Academic Editor Indrakshi Ray

Copyright copy 2018 Wilson S Melo Jr et al This is an open access article distributed under the Creative Commons AttributionLicense which permits unrestricted use distribution and reproduction in any medium provided the original work is properlycited

Modern systems are increasingly dependent on the integration of physical processes and information technologies This trend isremarkable in applications involving sensor networks cyberphysical systems and Internet of Things Despite its complexity suchintegration results in physical context information that can be used to improve security especially authentication In this paperwe show that entities sharing the same physical context can use it for establishing a secure communication channel and protectingeach other against external attacksWe present such approach proposing a theoretical model for generating unique bitstreams Twodifferent protocols are suggested Each one is evaluated using probabilistic analysis and simulation In the end we implement theauthentication mechanism in a case study using networks radio signal as physical event generator The results demonstrate theperformance of each of the protocols and their suitability for applications in real world

1 Introduction

Authentication is the process of identifying an entity andreliably granting authorization to a resource Although it isa widely discussed and studied topic authentication remainsa crucial security issue [1ndash4] Nowadays technologies suchas sensor networks smart systems cyberphysical systems(CPS) and Internet ofThings (IoT) depend on small buildingblocks like sensors actuators measuring instruments andsmart devices These building blocks also become systementities and can require specific authentication mechanismsas evidenced in applications related to manufacturing [5]transportation [6ndash8] energymanagement [9 10] smart citiesand smart homes [11] and electronic healthcare [12] amongothers On the other hand the same ubiquitous componentsalso introduce a new asset the physical context informationamount resulting from the integration of physical processesand information technologies [3 13]

Context-aware computing has constituted a well-studiedtopic for the last twodecades [14] Recently a renewed interestin this area has emerged due to ubiquitous technologies

that expand the idea of context to the physical world [13]Physical context can provide information about a system andits entities where they are what they do and when they doit Different features in systems with ubiquitous technologiesalready take advantage of physical context information (egenergy saving based on environmental sensors) Howeverthat seldom happens with security mechanisms

We work with the hypothesis that physical contextinformation can be used to improve cybersecurity especiallyauthentication processes For example a person walkingdown a street can use the physical context related to her pacefor authenticating personal devices such as smartphonesor any wearable smart device that has an accelerometerThere are several works where authentication demands thatentities share the same physical context [8 10 12 15ndash18]Although this is a very particular authentication case it findsapplication in several practical scenarios related to systemswith ubiquitous technologies Manufacturing systems [5]for instance can authenticate products based on theirposition in an assembly line validating specific steps inmanufacturing processes and quality assurance Cooperative

HindawiSecurity and Communication NetworksVolume 2018 Article ID 6590928 14 pageshttpsdoiorg10115520186590928

2 Security and Communication Networks

vehicular applications such as collision avoidance andplatooning [7 8] usually need to restrict communicationto authenticated vehicles which are close to each otherRelay attacks against mobile and wireless networks canbe avoided using environmental sensing to determinethe proximity among entities before authenticating them[12 15 19] Furthermore two-factor authentication (2FA)mechanism using physical patterns to enforce identification[20] suggests that security can be remarkably improved whenphysical context information is part of the authenticationprocess

In this paper we provide a formal framework for study-ing and implementing physical context-based authenticationmechanisms Firstly we analyze related works in litera-ture that use physical context for enhancing authenticationprocesses We show that such strategy depends on theexistence of a secure communication channel otherwiseauthentication becomes vulnerable Most works assume thata secure channel is established using preshared secret keys[15 17 19] or traditional key agreement protocols (eg Diffie-Hellman TSL) [12 16 20ndash22] However these methods havedrawbacks associated with the management of presharedkeys [23] and traditional protocols complexity [24] Thenwe evaluate a less explored alternative that uses the physicalcontext information for establishing secret keys That resultsin an authentication mechanism which is very robust againstpassive and active external attackers

This paper brings the following main contributions

(i) We formalize the idea of physical context-basedauthentication and describe distinct attacks accordingto the communication channel security properties

(ii) We define the problem of using physical events togenerate unique bitstreams with high probability Wealso discuss probabilistic models to the problem andhow to use them to perform physical context-basedauthentication

(iii) We propose two protocols to generate unique bit-streams from physical context information Theseprotocols have the advantage of not disclosing infor-mation about the physical context during the hand-shake We analyze and compare both methods usingprobabilistic analysis simulation and real world data

(iv) We implement a case study using local Wi-Fi networksignal as physical events generator showing that ourmethod achieves fair accuracy rates and is suitable forpractical applications

The paper is organized as follows In Section 2 we revisethe literature related to physical context-based authentica-tion and we present the concepts and terminology necessaryto the proper understanding of the remainder of the paperIn Section 3 we provide a formal definition of the authen-tication problem as well as the attack model considered inthis paper describing two realistic scenarios according to thecommunication channel security properties In Section 4 weconsider the particular and more effective scenario wheretwo parties must generate the same bitstreams by observinga set of physical events We describe formal models to the

problem and obtain theoretical results that are corroboratedby simulation experiments in Section 5 Section 6 describesa case study for physical context-based authentication usingnetwork radio signals as physical events generator Section 7contains final considerations about our results and providesfuture directions for researching the theme

2 Preliminaries

21 Physical Context-Based Authentication in a Nutshell Theidea of physical context-based authentication is showed inFigure 1 Alice and Bob are entities in any system thatinteracts with the physical world being able to observe anddescribe a specific physical contextThey do that bymeasuringphysical quantities such as speed temperature electromag-netic spectrum or any other sensing information Bob wantsto prove to Alice that they share the same physical contextBobrsquos strategy is to show Alice that he can observe the samephysical events as herThe intuitive way that Bob can do that isby sending amessage describing the physical events in a givenperiod Alice then compares the description in Bobrsquos messagewith those physical events observed by her Naturally one canexpect to find differences between the event descriptionsTheprecise entities position noise synchronization errors andsensors physical properties are some of the factors that canaffect the physical event observation If Bob is a legitimateentity then event descriptions are quite similar By usingappropriate tools Alice can eventually be convinced that Bobdescribes the same physical context

However the communication between Alice and Bobaffects authentication effectiveness Alice and Bob needmechanisms for establishing a secure communication channelOtherwise any authentication protocol will be vulnerable toeavesdropping and active attacks

22 RelatedWorks Context-aware computing is an extensiveknowledge area that explores the use of complementaryinformation to characterize an entity situation [14] Context-aware authenticationmechanisms can be projected for takingadvantage of information related to the usersrsquo role andbehavior or even properties from the environment wheresystem entities are immersed Different works proposingcontext-aware authentication techniques for IoT are surveyedby Habib and Leister [13] Although the authors use theterm physical context to designate a specific context typejust a few works related to authentication using physical orenvironmental sensing are mentioned Despite that Habiband Leister [13] emphasize that physical context-basedmech-anisms are suitable for ubiquitous computing applications(eg sensor networks IoT and CPS) The reasons are theirdynamic and heterogeneous environment as well as theamount of context information from physical world gatheredby sensors and smart devices

Physical context information is often associated with aphysical location position or proximity [16 17 25] Authen-ticationmechanisms based on physical proximity explore thecolocation of devices as a countermeasure against relay andimpersonation attacks [17] The concept of ambient multi-sensing authentication in Shrestha et al [19] for instance

Security and Communication Networks 3

makes use of physical quantities such as temperature humid-ity and pressure for composing location identifiers whichare robust against relay attacks In Miettinen et al [16]context information related to positioning is used for pairingcolocated and wearable IoT devices Another example isConvoy [8] an authentication system for vehicle platoonadmission based on the vehiclersquos position using sensorssuch as accelerometers to estimate trajectories and roadconditions STASH [17] is also an authentication system thatuses the estimated trajectory of mobile devices for providingproximity verification as a countermeasure against relayattacks Proximity also works in 2FA schemes Karapanos etal [20] use ambient sound for providing 2FA authenticatingentities Gu and Liu [26] also explore ambient sound forimplementing group authentication of IoT devices

Physical context information can also be used for iden-tifying patterns related to an entity An example is energyload signature [27] where electrical load patterns are asso-ciated with individual appliances in a house enabling theiridentification Behavioral biometrics [28 29] also makeuse of patterns for identifying biological entities based ontheir physical actions (eyes blink keystrokes and gesturesamong others) An interesting example is the ldquocyberphysicalhandshakerdquo in Wu et al [22] where two persons wearingwatch-like smart devices equippedwith accelerometers shaketheir hands generating a physical event for mutual iden-tification Human voluntary actions can also be used forauthenticating smart devices In Mayrhofer and Gellersen[21] two devices with accelerometers are paired by shakingthem together Other approaches make use of involuntarybehavioral actions for identification Heart-to-Heart (H2H)authentication scheme proposed by Rostami et al [12] usestime-varying randomness from the heart beating signal forgranting remote access to an implantable medical device

One can also find ideas related to physical context-basedauthentication in works using events from physical layerin communication networks Scannell et al [30] use radioenvironment traces for generating identifiers attesting thattwo entities are physically close to each other Mathur etal [31] explore physical properties which assure that theradio channel between two entities is unique introducing theconcept of channel-based authentication Zhang et al [18]present a comprehensive study about alternatives for securingwireless communication of IoT devices using context infor-mation from network physical layer

An important aspect of physical context-based authenti-cation is the security of the communication channel Mostof the approaches rely on preexisting protection mechanismsassumed as secure The use of a secret key shared previouslyis the mechanism adopted in [15 17 19] for establishingencrypted sessions In turn key agreement protocols likeDiffie-Hellman and TLS (Transport Layer Security) areprotection measures used in [12 16 20ndash22] Such trend isexpected since protection mechanisms related to crypto-graphic premises are cornerstones for implementing securesystems [32] However the management of shared secretkeys can be complex and expensive in practical scenarios[23] Furthermore key agreement protocols also have theirlimitations as is the case of possible problems related to

the Diffie-Hellman implementation and TLS recent securityflaws [24]

An alternative approach consists of using physical con-text information for establishing a secret key between twoentities This concept is revealed in works related to physicallayer-based security in communication networks using aninformation-theoretic approach [33 34] One can expect thattwo entities observing the same physical context will getsimilar (although not equal) descriptions So a reconciliationmethod can be used to change different physical contextdescriptions into the same secret keyThemain reconciliationmethods are based on error correction codes (ECCs) [34]Although ECC is a reliable solution for communicationerrors its use in key agreement protocols implies a handshakethat discloses information about the key A channel subjectto a high error rate requires more information redundancyand consequently disclosesmore information compromisingthe keyrsquos secrecy Apart from works related to networkphysical layer-based security we have found just a few studiesproposing reconciliation protocols in physical context-basedauthentication One can mention Gu and Liu [26] who useBCH Reed-Muller Golay and Reed-Solomon codes andHan et al [8] using Reed-Solomon

23 What We Do Different In this paper we revisit the mainconcepts related to physical context-based authenticationWebelieve that this theme lacks a formal model for study andimplementation Thus we propose a comprehensive modelthat can be instantiated in practical applications involvinginteractions with the physical world Besides our work differsfrom previous ones in two main aspects

(i) We demonstrate that physical context informationis more than just a proximity evidence The firstreason is because we glimpse cases where the physicalcontext consists of information about a physical phe-nomenon that implies connectivity and not necessar-ily proximity For instance the energy flow in a smartgrid can generate a physical context shared by deviceswhich are connected to the same grid segmentalthough they are not close to each other The secondreason is because physical context information alsoincludes simultaneity evidence a property that resultsin natural protection against replay attacks

(ii) We emphasize the use of physical context informa-tion for establishing secret keys among the entitiesFurthermore we propose two key agreement algo-rithms that do not disclose information about thesecret keyThat constitutes a significant improvementwhen compared to solutions using error correctioncodes To the best of our knowledge we are the firstto propose such methods in physical context-basedauthentication

24 Potential Applications In this section we describe somepotential applications for the industry that can be abstractedfrom our authentication mechanism All the cases involvewell-known cyberphysical systems with high demand forsecurity solutions

4 Security and Communication Networks

241 Manufacturing Industry Critical concerns about thesecurity in manufacturing processes have been addressedin the literature [3 5] Physical context information fromindustrial processes environment can improve productsidentification and authentication Products embedding sen-sors and smart components able to store data can gatherinformation from physical events related to any physicalprocess Such information can attest that a specific productwas submitted to specific manufacturing steps and qualityassessment procedures As an example one can consider aproduct using accelerometers for measuring its movementinto an industrial conveyor belt The continuous startstopmovement on an assembly line produces a ldquokinetic finger-printrdquo which can confirm that this product has passed bythe specific manufacturing process Besides improving iden-tification and traceability of products after production suchapproach can also be explored in quality control One canimplement authentication checkpoints in the manufacturingline avoiding defects related to wrong steps sequences oreven the absence of specific manufacturing steps and testsThat solution could have a remarkable impact on conformityassessment and quality control in industrial processes

242 Vehicular Transportation Transportation implies themovement of vehicles into a physical environment Conse-quently vehicles can make use of rich physical context infor-mation for providing more sophisticated services Severalemerging applications involving smart autonomous vehiclesand vehicular networks can employ physical context-basedauthentication to increase security For instance vehiclesimplementing vehicle-to-vehicle communication (V2V) [6]can authenticate each other using physical context informa-tion that describes their environment and trajectory In aV2V environment vehicles are usually close to each otherand consequently can describe the same physical context [8]Signals from environmental sensors (temperature humidityand air pressure) and movement sensors (accelerometerscompass and GPS) can be used for obtaining a ldquocontext fin-gerprintrdquo A similar strategy could protect a moving vehicleagainst external attacks which aim to get access to the ControlArea Network (CAN) bus [7 35] In such situation thevehiclersquos Electronic Control Units (ECUs) can authenticateeach other by asking for credentials which also describethe vehiclersquos physical context including dynamic attributesrelated to its trajectory and environment Again movementand environmental sensors can be used for composing acontext identifier which only ECUs embedded in the vehiclecan determine The attacker placed outside the vehiclecannot guess or describe the respective physical context

243 Smart Grids One of the basic features provided bysmart grids consists of telemetry which enables the readingof end-usersrsquo consumption from a remote place [36] Dueto privacy reasons some solutions propose the existenceof a gateway to aggregate information from a group ofsmart meters (end-users) in the same neighborhood In turngateway and smart meters need to authenticate each otherbefore exchanging any consumption information Physicalcontext information can improve this process by providing

Physical world Physical context

BobAliceMarley

Communication channel

E(t)

E(t + 1)E(t + 2)

Figure 1 The physical context authentication problem

evidence that gateway and smart meters are in the samepower grid segment thus avoiding external attacks That canbe done by measuring physical events from the power gridOne possibility is to explore the variations in voltage levelsThe VoltVAR Control (VVC) [37] is the system that keepsa stable voltage profile in the power grid However slightvoltage variations can be observed along a grid segmentThey result from different energy loads supported in eachspecific grid segment Such phenomenon becomes evenmoredynamic in energy microgeneration scenarios creating asingular case of physical context given by the energy flow in agrid Thus gateway and smart meters placed in the same gridsegment can use such context for authenticating each other

3 Physical Context and Secure Channels

31 Defining Physical Context It is time to return to ourauthentication problem (Figure 1) Alice must authenticateBob before starting any communication Furthermore Bobneeds to prove to Alice that they are sharing the same physicalcontext If that is true then Alice and Bob also fulfill twoimportant conditions

(i) Colocation Alice and Bob are in the same physicallocation or relatively close to each other or connectedto an environment where the physical phenomenonoccurs

(ii) Simultaneity Alice and Bob are observing their phys-ical context at the same time

One should note that our definition implies that colo-cation is more than physical proximity For instance twosmart meters connected to the same smart grid segment candescribe the same physical context related to the grid energyflows even while being placed far away from each otherIndeed colocation can indicate a relative idea of proximity

Colocation and simultaneity are desirable properties toenforce security policies in situations where entities loca-tion and synchronism matter Usually this information isobtained using additional infrastructures such as positioningsystems (geographic or indoor) and timestamps servicesHowever colocation and simultaneity also can be evidenced

Security and Communication Networks 5

by physical events and physical context information withoutthe need for any additional infrastructure That happenswhen Alice and Bob can describe the same physical eventssomething expected when they share the same physicalcontext Besides that in the described scenario neither Alicenor Bob needs to interact with the physical world activelyThey could be just passive entities gathering informationfrom the physical world

32 Attack Model We assume that the attacker is a maliciousexternal entity (Marley) with total access to the communica-tion channel used by Alice and Bob Marley can listen to thischannel and intercept authentication messages MoreoverMarley can send fake messages performing man-in-the-middle attacks His primary intention is to impersonateBob fooling Alice and so getting nonauthorized accessto information and services However once Marley is anexternal entity he does not have access to Alice and Bobrsquosphysical context Consequently Marley cannot capture thesame physical events observed by them Despite that he cantry to find out physical context information from Alice andBob eavesdropping on their communication channel

Marleyrsquos attack capabilitiesmust be evaluated consideringthe two following scenarios

(1) Secure communication scenario we assume the exis-tence of a reliable mechanism that delivers the samesecret key to Alice and Bob This key can be used toestablish an encrypted communication channel usingany reliable cryptographic protocol We also assumethatMarley cannot steal that secret keyThusMarleyrsquoscapabilities are restricted to relay attacks by forward-ing messages of legitimate entities something thatdoes not represent any threat once all the messagesare encrypted

(2) Nonsecure communication scenario we assume thatthemessages are sent in plain text In this caseMarleyhas the following capabilities

(i) Steal information eavesdropping on the com-munication between Alice and Bob

(ii) Impersonate Bob using intercepted informa-tion from a legitimate entity in a relay attack

(iii) Impersonate Bob using authentication tokensfrom previous sessions in a replay attack

Since Marley has total control over the communicationchannel he can launch a diversity of attacks targetingavailability (eg injection attacks Denial-of-Service attacks)Such situation requires defense-in-depth strategies (eg aprevious authentication layer that prevents Marley from get-ting control over the communication channel [38]) Althoughthat is a relevant concern we do not consider such attacksin this study Thus we assume that Marley has no interest inattacks against system availability

33 AuthenticationMechanismUsing Physical Context Phys-ical context-based authentication can work in different waysfor each described attack scenario On one hand physical

context can be used only as evidence of colocation andsimultaneity between Alice and Bob That is the approachfollowed by most of the works related to physical context-based authentication (see Section 22) On the other handwhen we consider a nonsecure communication scenariothings become more interesting physical context can alsowork as an exclusive channel for secret key distribution

Suppose that Alice and Bob share the same physicalcontext So they know that their physical context descriptionis quite similar although not equalWe call these descriptionsas physical event identifiers All Alice and Bob need is areconciliation protocol that can convert both identifiers in thesame secret key Such protocol must disclose just a minimalinformation amount about the physical context descriptionand the respective identifiers Consequently Marley cannotfigure out the physical context or deduce the secret key OnceAlice and Bob have a shared secret key they can establish asecure channel reducing the attacker capabilities to the firstattack scenario

We formalized the idea expressed above in the followingprotocol If Alice and Bob are represented by 119860 and 119861respectively and 119875 is a proper reconciliation function wehave the following

(1) 119860 observes physical event 119864 and extracts ID119860(2) 119861 observes physical event 119864 and extracts ID119861 asymp ID119860(3) 119860 computes 119896 = 119875(ID119860)(4) 119861 computes 119896 = 119875(ID119861) = 119875(ID119860)(5) 119860 and 119861 can communicate using cryptographic pro-

tocols over the secret key 119896Two aspects must be properly addressed to confirm the

protocol security The first one is the 119875 function 119875 hasto be chosen in such manner that the differences betweenidentifiers ID119860 and ID119861 are suppressed Otherwise the 119896value will not be the same for 119860 and 119861 The second aspectis related to the interpretation of 119864 Since 119896 is proposedfor cryptographic use one expects that 119896 presents randomproperties So the physical context (and consequently eachphysical event) must be associated with nondeterministicprocesses

To point out a solution and make the security analysisclearer we propose a Unique Bitstream Generator model thatcan be implemented using physical context information Theidea will be formally exposed and discussed in the nextsection

4 Generation of Unique Bitstream fromPhysical Events

41 Probabilistic Theoretic Model We formalize the UniqueBitstream Generator based on a discrete probabilistic modelWe assume the existence of a random bit generator 119866 whosegenerated bitstream is accessible to any party that is locatedin a given environment The goal is to use these bitstreamsto generate cryptographic keys that will allow the securecommunication between the parties in this environmentHowever the communication between 119866 and the parties

6 Security and Communication Networks

Unique Bitstream Generator

Secret key

BobAlice

Physical event

ID-BID-A

Figure 2 The Unique Bitstream Generator 119866 description

inserts errors in the bits generated by119866Therefore the partiesreceive related but distinct bitstreams that will need to besomehow processed before generating cryptographic keysThe diagram in Figure 2 depicts the model

We denote by time unit the minimum amount of timeobserved by the parties Each time unit corresponds to aunique bit generated by 119866 Note that this bit is sent via acommunication channel that introduces errors So the partieswill not necessarily receive the bit generated by 119866 A time slotis a set of subsequent time units and the size of the time slotis the size of the set

42 Clock Errors and Transmission Delays One importantaspect for the Unique Bitstream problem is whether theparties can refer precisely to each time unit or whether clockerror and delays on the transmission of physical events canimpact the synchronization between the parties ldquoAbsolutesynchronizationrdquo allows the development of more powerfulprotocols but in general it is not a reasonable assumptionfor most real world applications In practice we assume thatsynchronization errors lead to bit transmission errors A bitassociated with a time unit can be interpreted differently by119860 and 119861 since the precise instants where the time unit beginsand finishes are not the same for 119860 and 11986143 Counting Events The Binomial Distribution Model Weconsider that the following strategy generates a unique key 119896from the bitstream generated by119866We partition the bitstreaminto time slots and count the number of bits 1 (ie wecompute the sum of the bits in the time units in each timeslot)Then we define a bit associated with each slot accordingto this sum Assuming the equiprobability of bits 0 and 1 andconsidering that the number of bits 1 in each slot follows abinomial distribution a typical choice is to associate bit 0witha slot whose sum is less than half the number of time units ofthis slot Formally we represent a time slot119879with 119896 time units

Unique Bitstream Generator

Err-A Err-B

0110010110

01000

010001011001100 11110

010110 1

01

0110011110

ff

Figure 3 The Unique Bitstream Generator counting events exam-ple

as a 119896-tuple (1198871 119887119896) of binary digits The sum 119878119879 is givenby

119878119879 =119896

sum119894=1

119887119894 (1)

The bit 119873119879 associated with slot 119879 is 1 if 119878119879 lt 1198962 and is 0otherwise Figure 3 depicts an example

Consider a time slot 119879 = (1198871 119887119896) transmitted to119860 and119861 and received by 119860 as 119879119860 = (1198871198601 119887119860119896 ) and by 119861 as 119879119861 =(1198871198611 119887119861119896 ) Recall that each bit 119887119894 can be flipped with a givenprobability 119901119864 so that the probability that 119887119860119894 = 119887119861119894 for eachbit received by 119860 and 119861 is given by

119901 = 2119901119864 (1 minus 119901119864) (2)

Considering the possibility of error it is possible that thetotal number of bits counted by 119860 and 119861 is not the same Sothe associated bits are distinct

An important aspect of our proposedmodel is that it takesadvantage of classic probabilistic models and paradigms Aswe saw the model is strongly based on the so-called binomialdistribution Furthermore the behavior observed in the sim-ulation and the case study is properly explained by analyzingthe scenarios defined over the binomial distribution function

44 Naive Counting Protocol (NC) We start by consideringthemore simple protocol where the bit associated with a timeslot is determined by the majority of the bits in this time slotFormally the protocol associates bit 0 with a time slot 119879 =(1198871 119887119896) if 119878119879 lt 1198962 and bit 1 otherwise

In the above model the probability of an error is theprobability that one party say 119860 receives a time slot whosemajority is distinct to the majority in the time slot receivedby the other party 119861mdashthis could happen due to transmissionerrors

In the following subsection we generalize the NaiveCounting Protocol and derive bounds for the probability oferrors

Security and Communication Networks 7

45 The Band of Guard Protocol (BG) As we show in theprevious section the Naive Counting Protocol presents anonnegligible probability that 119860 and 119861 associate distinctbits with a time slot In the present section we define analternative protocol The idea is to define a ldquobandrdquo thatdetermines whether time slot presents a high probability oferror Intuitively a time slot has a high probability of errorif the number of 1s is close to half the number of time unitsof the slots In practice 119860 and 119861 agree about a number 119887 ifthe number of bits 1 in a slot is between 1198962 minus 119887 and 1198962 + 119887where 119896 is the number of time units in a time slot If a slot119879119860 observed by 119860 (resp slot 119879119861 observed by 119861) has a sumof bits that falls inside the band that is between 1198962 minus 119887 and1198962 + 119887 then 119879119860 (resp 119879119861) does not generate a bit In otherwords the bit associated with a slot can be bit 0 if the numberof bits 1 is below 1198962 minus 119887 bit 1 if the number of bits 1 is above1198962 + 119887 and ldquoundefinedrdquo if the sum of bits is between 1198962 minus 119887and 1198962 + 119887

Note that the ldquoband of guardrdquo protocol is a generalizationof the ldquonaive countingrdquo protocol where the ldquonaive countingrdquoprotocol has a band of guard 119896 = 0

The advantage of the above strategy is that the probabilitythat a slot119879 gives origin to distinct bits for119860 and119861 is lower asa larger number of bit flips would need to occur On the otherside the bit production rate is lower due to the ldquoundefinedrdquobits Besides the parties should interact to informwhich slotsgenerated undefined bits (hence need to be discarded) Notethat the fact that the parties indicate discarded slots doesnot allow an attacker to obtain any information about thegenerated bits

One disadvantage of the ldquoband of guard protocolrdquo is therapid decrease of throughput as a function of the size of theguard Indeed the binomial distribution leads to a strongconcentration around themeanUsingChernoff bounds [39]it can be proved that

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

12radic6119899 log119890 (119899)) le 2

119899 (3)

where 119883 is the number of bits 1 in a time slot with 119899 bitsIn practice that means that the concentration on the

number of bits 1 around the mean 1198992 is very tight mostof the time the deviation from this mean is on the order of119874(119899 log(119899))

Anotherway of using theChernoff bound technique gives

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

1198994) le 2119890minus11989924 (4)

which indicates exponential decrease on the size of the slotfor the probability of the total number of bits 1 to be below1198994 or above 31198994 As a consequence a small increase in thesize of the band of guard leads to a relevant decrease in thepercentage of valid time slots

46 The Best Slots Protocol (BS) We describe a strategy toreduce the number of errors in the generation of bitstreamsfrom physical events Basically instead of using time slotswith predefined timeframes that is set of time units we allowthe beginning and the end of each slot to be dynamically

Discarded bits Best slot

Next slot

0110010110100110101

0110010110100110101

Figure 4 How the choosing best slots protocol works

defined so that the number of bits 1 or bits 0 is guaranteedto be above the desired threshold therefore leading to anadequate error rate

The idea is simple Consider a time slot 119879 = (1198871 119887119896)transmitted to119860 and119861 and received by119860 as119879119860 = (1198871198601 119887119860119896 )and by 119861 as 119879119861 = (1198871198611 119887119861119896 ) Assume that 119860 and 119861 agreedabout a value 119896 for a threshold for the band of guard If thenumber of bits 1 observed by 119860 in 119879119860 (resp observed by 119861 in119879119861) is between 1198962 minus 119887 and 1198962 + 119887 where 119896 is the number oftime units in a time slot then 119860 (resp 119861) sinalizes that (s)hedoes not wish to use slot119879 as the generator of a bitThen each119860 and each119861 considers the ldquonext slotrdquo119879 = (1198872 119887119896+1) thatis we slide right the time slot

It is important to mention that the checksum update canbe efficiently computed by considering only the values of bits1198871 119887119896 1198872 and 119887119896+1mdashthere is no need to perform an additionalcounting of bits 1 in the new time slot 119879 = (1198872 119887119896 + 1)

The protocol works as follows (see Figure 4)We start likein BG protocol selecting time slots 119879 = (1198871 119887119896) Beforeaccepting a new time slot 119879 one of the parties (the verifier)checks the sum of the bits 119878119879 If 119878119879 is inside the band of guardthe first bit 1198871 isin 119879 is discarded and the bits are shifted doing119887119894 = 119887119894+1 The next bit will be again 119887119896 and the procedurerepeats until 119878119879 generates 0 or 1 When it happens the newtime slot119879 is accepted and the verifier informs the other parthow many bits must be discarded to get 119879

5 Simulation Results

The protocols proposed in the previous section were verifiedusing simulation We suppose that two entities 119860 and 119861 tryto establish a secure communication channel using physicalevents The experiment is set up as follows We use a randombinary stream generated by website wwwrandomorg whichwas checked using the NIST Statistical Test Suite for Randomand Pseudorandom Number Generators [40] The binarystream works as an oracle of ldquovirtualrdquo physical events justlike in the Unique BitstreamModel previously described Wesimulate 119860 and 119861 as entities that observe physical events andtry to determine a secret key 119896 implementing each one of thedescribed protocols

The simulation results show each protocol accuracy andthroughput By accuracy we mean the rate of simulated caseswhere Alice and Bob are successful in establishing the samesecret key 119896 In turn the throughput is the rate of physicalevents (in our simulation bits) which are effectively used onvalid slots Aiming to make the simulation more realisticwe define an error rate err which determines the probabilitywhich an entity can miss a described event That means aphysical event 119864 = 0 can be observed as 1198641015840 = 1 with aprobability of err and vice versa

8 Security and Communication Networks

Table 1 Theoretical NC and BG protocols simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 (NC) 55 05 00 1001 125 18 00 7532 827 570 54 3433 100 899 472 1084 100 100 632 219

Table 2 Theoretical BS protocol simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 217 57 03 9761 948 813 353 9382 9987 991 918 9193 100 9949 949 2414 100 100 100 134

For practical reasons we fixed some parameters fordetermining the Unique Bitstream We consider each bit as1 time unit The time slot is fixed as 10 time units and we tryto obtain 64-bit unique bitstreams which means that eachprotocol will consume the binary stream until it finds 64ldquogoodrdquo slots

Table 1 summarizes the results obtained for Naive Count-ing (NC) and Counting with Band of Guard (BG) protocolsThe Band column indicates the band of guard size (in bits)adopted on each simulation One can note that accuracy andthroughput reach better rates when the band of guard valueis increased The gain in accuracy depends on the simulatederror rate err something already expected once the UniqueBitstream generation protocols shall work better with lowerror rates

Table 2 describes the simulation results for best slots(BS) protocol One shall observe that BS protocol presents abetter performance when compared to NC and BG protocolsBesides the higher accuracy its results show a significantgain in throughput In practice such performance implies afaster authentication process once BS protocol requires lessphysical events to determine 1198966 Case Study Using Radio Signal

61 Radio Signals as Physical Events In this section wepresent a practical case study related to the activities ofthe National Institute of Metrology Quality and Technology(Inmetro) in Brazil The Inmetro delegates notified bodiesto inspect measurement instruments under legal regulationSuch activity called metrological surveillance is done ininstruments already in use on the field (eg scales fuelpumps) Albeit these measuring instruments are connectedto the Internet surveillance agents (ie notified bodiesrsquotechnicians) need to go to the instrumentrsquos site for proceedingwith a complete visual inspection So the Inmetro wants to

check the suitability of using physical context to authenticatesurveillance agents before granting access to the instrument

Measuring instruments employed for regulating con-sumer relations are typically used in places such as supermar-kets stores shops and gas stations Nowadays these placesare surrounded by different radio-based communicationinfrastructures (eg WLANs) The radio signal propagationgenerates physical context information creating an ldquoelec-tromagnetic fingerprintrdquo That can be used as evidence ofcolocation and simultaneity of measuring instruments andsurveillance agents In this case study we use the signalgenerated by public IEEE 80211 wireless (Wi-Fi) networksThe IEEE 80211 is a well-disseminated network standard andcan be easily found in practically any public place

We see Wi-Fi network packets as physical events Theycan be detected and measured by any device using a properradio in monitoring mode In our study the Wi-Fi networkis treated as a physical event generator and not as a com-munication channel Thus the authenticating devices are notconnected to the Wi-Fi network Instead they just use theirradios as sensors receivingWi-Fi packets as physical contextinformation

The study case contemplates a measuring instrument 119860and a surveillance agent 119861 Both entities are equipped withWi-Fi radios and share the same physical context describedby the electromagnetic fingerprint of a local Wi-Fi network(Figure 5) At the same time 119872 is a malicious surveillanceagent who wants to counterfeit a visual inspection of 119860 Thethree entities are connected to the Internet but 119860 and 119861 donot use theirWi-Fi radio for that We also assume that119872 hasall the capabilities and restrictions described in Section 32

Wi-Fi radios can be configured in monitoring mode andwork as sensorsThey can ldquosenserdquo allWi-Fi traffic and identifydifferent packets with their respective source and destinationaddresses Such information constitutes our physical contextWe use it for composing a physical event identifier that

Security and Communication Networks 9

WLAN physical context

InternetA

BM

Figure 5 Using Wi-Fi signals as physical event

results from the interaction among several connected devicessendingWi-Fi packets in a given moment Once the networkcoverage field is limited only entities placed in this same areaat the same time can obtain the event identifier

62 The Physical Event Identifier We associate the ideaof physical context with the Wi-Fi network traffic Eachpacket sent by any node in the network is considered aphysical event Since 119860 and 119861 have Wi-Fi radios they canbe configured for monitoring any specific Wi-Fi networkchannel Thus they use the Wi-Fi tracing information todetermine a physical event identifier

Firstly 119860 and 119861 process tracing information by extract-ing only packets source addresses and timestamps Sourceaddresses link a physical event with the location where itoccurs Wi-Fi networks are sharply distinguished by theirnodes mobility So one can expect that a public Wi-Finetwork will present different nodes (and consequentlydifferent addresses) when we compare traces extracted atdifferent moments We use119860 and 119861 local clocks to obtain thepackets timestamps which implies that the devices are notsynchronized Timestamps are necessary to know when eachnode is sending information to the network Doing that wecan determine time slots by assigning zero when a node doesnot send any information and one when otherwiseThe resultis a physical context description that can be analyzed usingthe Unique Bitstream Generator model already describedFurthermore such time slots present a nondeterministicpattern once it is hard to predict when a network nodewill send a packet A problem emerges due to the hiddennode problem 119860 can detect packages from a node which ishidden from 119861 or vice versa This condition can affect 119860 and119861 physical event identifiers compromising authenticationWe avoid such problem proposing an additional messageinterchange which enables 119860 and 119861 to determine a commonset of communicating node addresses for extracting theirrespective physical event identifiers ID119860 and ID119861

The authentication protocol is initiated by 119861 asking 119860for authentication After that 119860 challenges 119861 to presentthe physical context proof Both the entities start to collectnetwork traces during a predefined time interval After

collecting all the traces 119860 and 119861 will have two similar setsof partial identifiers given by the following equation

ID119894 = ⟨1199041 1199051⟩ ⟨119904119896 119905119896⟩ ⟨119904119870 119905119870⟩ (5)

where 119870 is the number of different nodes identified in theWi-Fi trace 119904119896 is the 119896th network node MAC (Media AccessControl) address and 119905119896 is a119871-bit binary string correspondingto the frequency distribution of the 119896th network node signal

For security reasons 119904119896 could be obfuscated by any hashfunction preventing the disclosure of private informationabout the Wi-Fi network node Regardless our experimentconsiders the use of a public Wi-Fi network implying thatMAC addresses are public as well

In turn 119905119896 is given by the following algorithm

(1) Define 119871 slots of time and compute a frequency dis-tribution 119865 = 1198911 1198912 119891119871 counting each packetwhere the source address corresponds to 119904119896 usingtimestamp information

(2) Extract a binary 119871-bits representation where for eachclass 119897 = 1 2 119871 in 119865 the 119897th bit 119887119897 is given by theBoolean operation 119887119897 = (119891119897 gt 0)

(3) Do 119905119896 = ⟨1198871 1198872 119887119871⟩Figure 6 illustrates the proposed algorithm with 119871 =

16 Packets from the same source address are sampled in afrequency distribution histogram One can observe that insubgraphs119860 and119861 Finally the binary representation showedin graph 119862 is computed as a partial identifier 119905119896

Once 119860 and 119861 have their respective partial identifiersID119860 and ID119861 they need to solve the hidden node prob-lem determining the intersection among their known nodeaddresses 119904119896 Supposing that Addr119860 andAddr119861 are the subsetscontaining 1199041 119904119870 of ID119860 and ID119861 respectively wepropose the following sequence of messages

119861 997888rarr 119860 Addr119861119860 119868 = Addr119860 cap Addr119861

119860 119904119877 isin 119868 | 119877 = rand ()119860 997888rarr 119861 119904119877

119860 119861 119896 = 119905119877

(6)

Although the proposed messages reveal the nodeaddresses chosen to determine the physical event identifierthey do not disclose any information about the selectedfrequency distribution of 119905119877 That keeps the authenticationprotocol secure against an attacker 119872 with capabilitiesdescribed at Section 32

63 Experiment Description Our experiment is imple-mented using two computers with different Wi-Fi adapterssimulating119860 and 119861 devices respectively Both computers runUbuntu 1404 Linux operating systemTheir Wi-Fi interfaceswork as sensors using monitoring mode to gather all Wi-Fipackages traffic

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

Security and Communication Networks 3

makes use of physical quantities such as temperature humid-ity and pressure for composing location identifiers whichare robust against relay attacks In Miettinen et al [16]context information related to positioning is used for pairingcolocated and wearable IoT devices Another example isConvoy [8] an authentication system for vehicle platoonadmission based on the vehiclersquos position using sensorssuch as accelerometers to estimate trajectories and roadconditions STASH [17] is also an authentication system thatuses the estimated trajectory of mobile devices for providingproximity verification as a countermeasure against relayattacks Proximity also works in 2FA schemes Karapanos etal [20] use ambient sound for providing 2FA authenticatingentities Gu and Liu [26] also explore ambient sound forimplementing group authentication of IoT devices

Physical context information can also be used for iden-tifying patterns related to an entity An example is energyload signature [27] where electrical load patterns are asso-ciated with individual appliances in a house enabling theiridentification Behavioral biometrics [28 29] also makeuse of patterns for identifying biological entities based ontheir physical actions (eyes blink keystrokes and gesturesamong others) An interesting example is the ldquocyberphysicalhandshakerdquo in Wu et al [22] where two persons wearingwatch-like smart devices equippedwith accelerometers shaketheir hands generating a physical event for mutual iden-tification Human voluntary actions can also be used forauthenticating smart devices In Mayrhofer and Gellersen[21] two devices with accelerometers are paired by shakingthem together Other approaches make use of involuntarybehavioral actions for identification Heart-to-Heart (H2H)authentication scheme proposed by Rostami et al [12] usestime-varying randomness from the heart beating signal forgranting remote access to an implantable medical device

One can also find ideas related to physical context-basedauthentication in works using events from physical layerin communication networks Scannell et al [30] use radioenvironment traces for generating identifiers attesting thattwo entities are physically close to each other Mathur etal [31] explore physical properties which assure that theradio channel between two entities is unique introducing theconcept of channel-based authentication Zhang et al [18]present a comprehensive study about alternatives for securingwireless communication of IoT devices using context infor-mation from network physical layer

An important aspect of physical context-based authenti-cation is the security of the communication channel Mostof the approaches rely on preexisting protection mechanismsassumed as secure The use of a secret key shared previouslyis the mechanism adopted in [15 17 19] for establishingencrypted sessions In turn key agreement protocols likeDiffie-Hellman and TLS (Transport Layer Security) areprotection measures used in [12 16 20ndash22] Such trend isexpected since protection mechanisms related to crypto-graphic premises are cornerstones for implementing securesystems [32] However the management of shared secretkeys can be complex and expensive in practical scenarios[23] Furthermore key agreement protocols also have theirlimitations as is the case of possible problems related to

the Diffie-Hellman implementation and TLS recent securityflaws [24]

An alternative approach consists of using physical con-text information for establishing a secret key between twoentities This concept is revealed in works related to physicallayer-based security in communication networks using aninformation-theoretic approach [33 34] One can expect thattwo entities observing the same physical context will getsimilar (although not equal) descriptions So a reconciliationmethod can be used to change different physical contextdescriptions into the same secret keyThemain reconciliationmethods are based on error correction codes (ECCs) [34]Although ECC is a reliable solution for communicationerrors its use in key agreement protocols implies a handshakethat discloses information about the key A channel subjectto a high error rate requires more information redundancyand consequently disclosesmore information compromisingthe keyrsquos secrecy Apart from works related to networkphysical layer-based security we have found just a few studiesproposing reconciliation protocols in physical context-basedauthentication One can mention Gu and Liu [26] who useBCH Reed-Muller Golay and Reed-Solomon codes andHan et al [8] using Reed-Solomon

23 What We Do Different In this paper we revisit the mainconcepts related to physical context-based authenticationWebelieve that this theme lacks a formal model for study andimplementation Thus we propose a comprehensive modelthat can be instantiated in practical applications involvinginteractions with the physical world Besides our work differsfrom previous ones in two main aspects

(i) We demonstrate that physical context informationis more than just a proximity evidence The firstreason is because we glimpse cases where the physicalcontext consists of information about a physical phe-nomenon that implies connectivity and not necessar-ily proximity For instance the energy flow in a smartgrid can generate a physical context shared by deviceswhich are connected to the same grid segmentalthough they are not close to each other The secondreason is because physical context information alsoincludes simultaneity evidence a property that resultsin natural protection against replay attacks

(ii) We emphasize the use of physical context informa-tion for establishing secret keys among the entitiesFurthermore we propose two key agreement algo-rithms that do not disclose information about thesecret keyThat constitutes a significant improvementwhen compared to solutions using error correctioncodes To the best of our knowledge we are the firstto propose such methods in physical context-basedauthentication

24 Potential Applications In this section we describe somepotential applications for the industry that can be abstractedfrom our authentication mechanism All the cases involvewell-known cyberphysical systems with high demand forsecurity solutions

4 Security and Communication Networks

241 Manufacturing Industry Critical concerns about thesecurity in manufacturing processes have been addressedin the literature [3 5] Physical context information fromindustrial processes environment can improve productsidentification and authentication Products embedding sen-sors and smart components able to store data can gatherinformation from physical events related to any physicalprocess Such information can attest that a specific productwas submitted to specific manufacturing steps and qualityassessment procedures As an example one can consider aproduct using accelerometers for measuring its movementinto an industrial conveyor belt The continuous startstopmovement on an assembly line produces a ldquokinetic finger-printrdquo which can confirm that this product has passed bythe specific manufacturing process Besides improving iden-tification and traceability of products after production suchapproach can also be explored in quality control One canimplement authentication checkpoints in the manufacturingline avoiding defects related to wrong steps sequences oreven the absence of specific manufacturing steps and testsThat solution could have a remarkable impact on conformityassessment and quality control in industrial processes

242 Vehicular Transportation Transportation implies themovement of vehicles into a physical environment Conse-quently vehicles can make use of rich physical context infor-mation for providing more sophisticated services Severalemerging applications involving smart autonomous vehiclesand vehicular networks can employ physical context-basedauthentication to increase security For instance vehiclesimplementing vehicle-to-vehicle communication (V2V) [6]can authenticate each other using physical context informa-tion that describes their environment and trajectory In aV2V environment vehicles are usually close to each otherand consequently can describe the same physical context [8]Signals from environmental sensors (temperature humidityand air pressure) and movement sensors (accelerometerscompass and GPS) can be used for obtaining a ldquocontext fin-gerprintrdquo A similar strategy could protect a moving vehicleagainst external attacks which aim to get access to the ControlArea Network (CAN) bus [7 35] In such situation thevehiclersquos Electronic Control Units (ECUs) can authenticateeach other by asking for credentials which also describethe vehiclersquos physical context including dynamic attributesrelated to its trajectory and environment Again movementand environmental sensors can be used for composing acontext identifier which only ECUs embedded in the vehiclecan determine The attacker placed outside the vehiclecannot guess or describe the respective physical context

243 Smart Grids One of the basic features provided bysmart grids consists of telemetry which enables the readingof end-usersrsquo consumption from a remote place [36] Dueto privacy reasons some solutions propose the existenceof a gateway to aggregate information from a group ofsmart meters (end-users) in the same neighborhood In turngateway and smart meters need to authenticate each otherbefore exchanging any consumption information Physicalcontext information can improve this process by providing

Physical world Physical context

BobAliceMarley

Communication channel

E(t)

E(t + 1)E(t + 2)

Figure 1 The physical context authentication problem

evidence that gateway and smart meters are in the samepower grid segment thus avoiding external attacks That canbe done by measuring physical events from the power gridOne possibility is to explore the variations in voltage levelsThe VoltVAR Control (VVC) [37] is the system that keepsa stable voltage profile in the power grid However slightvoltage variations can be observed along a grid segmentThey result from different energy loads supported in eachspecific grid segment Such phenomenon becomes evenmoredynamic in energy microgeneration scenarios creating asingular case of physical context given by the energy flow in agrid Thus gateway and smart meters placed in the same gridsegment can use such context for authenticating each other

3 Physical Context and Secure Channels

31 Defining Physical Context It is time to return to ourauthentication problem (Figure 1) Alice must authenticateBob before starting any communication Furthermore Bobneeds to prove to Alice that they are sharing the same physicalcontext If that is true then Alice and Bob also fulfill twoimportant conditions

(i) Colocation Alice and Bob are in the same physicallocation or relatively close to each other or connectedto an environment where the physical phenomenonoccurs

(ii) Simultaneity Alice and Bob are observing their phys-ical context at the same time

One should note that our definition implies that colo-cation is more than physical proximity For instance twosmart meters connected to the same smart grid segment candescribe the same physical context related to the grid energyflows even while being placed far away from each otherIndeed colocation can indicate a relative idea of proximity

Colocation and simultaneity are desirable properties toenforce security policies in situations where entities loca-tion and synchronism matter Usually this information isobtained using additional infrastructures such as positioningsystems (geographic or indoor) and timestamps servicesHowever colocation and simultaneity also can be evidenced

Security and Communication Networks 5

by physical events and physical context information withoutthe need for any additional infrastructure That happenswhen Alice and Bob can describe the same physical eventssomething expected when they share the same physicalcontext Besides that in the described scenario neither Alicenor Bob needs to interact with the physical world activelyThey could be just passive entities gathering informationfrom the physical world

32 Attack Model We assume that the attacker is a maliciousexternal entity (Marley) with total access to the communica-tion channel used by Alice and Bob Marley can listen to thischannel and intercept authentication messages MoreoverMarley can send fake messages performing man-in-the-middle attacks His primary intention is to impersonateBob fooling Alice and so getting nonauthorized accessto information and services However once Marley is anexternal entity he does not have access to Alice and Bobrsquosphysical context Consequently Marley cannot capture thesame physical events observed by them Despite that he cantry to find out physical context information from Alice andBob eavesdropping on their communication channel

Marleyrsquos attack capabilitiesmust be evaluated consideringthe two following scenarios

(1) Secure communication scenario we assume the exis-tence of a reliable mechanism that delivers the samesecret key to Alice and Bob This key can be used toestablish an encrypted communication channel usingany reliable cryptographic protocol We also assumethatMarley cannot steal that secret keyThusMarleyrsquoscapabilities are restricted to relay attacks by forward-ing messages of legitimate entities something thatdoes not represent any threat once all the messagesare encrypted

(2) Nonsecure communication scenario we assume thatthemessages are sent in plain text In this caseMarleyhas the following capabilities

(i) Steal information eavesdropping on the com-munication between Alice and Bob

(ii) Impersonate Bob using intercepted informa-tion from a legitimate entity in a relay attack

(iii) Impersonate Bob using authentication tokensfrom previous sessions in a replay attack

Since Marley has total control over the communicationchannel he can launch a diversity of attacks targetingavailability (eg injection attacks Denial-of-Service attacks)Such situation requires defense-in-depth strategies (eg aprevious authentication layer that prevents Marley from get-ting control over the communication channel [38]) Althoughthat is a relevant concern we do not consider such attacksin this study Thus we assume that Marley has no interest inattacks against system availability

33 AuthenticationMechanismUsing Physical Context Phys-ical context-based authentication can work in different waysfor each described attack scenario On one hand physical

context can be used only as evidence of colocation andsimultaneity between Alice and Bob That is the approachfollowed by most of the works related to physical context-based authentication (see Section 22) On the other handwhen we consider a nonsecure communication scenariothings become more interesting physical context can alsowork as an exclusive channel for secret key distribution

Suppose that Alice and Bob share the same physicalcontext So they know that their physical context descriptionis quite similar although not equalWe call these descriptionsas physical event identifiers All Alice and Bob need is areconciliation protocol that can convert both identifiers in thesame secret key Such protocol must disclose just a minimalinformation amount about the physical context descriptionand the respective identifiers Consequently Marley cannotfigure out the physical context or deduce the secret key OnceAlice and Bob have a shared secret key they can establish asecure channel reducing the attacker capabilities to the firstattack scenario

We formalized the idea expressed above in the followingprotocol If Alice and Bob are represented by 119860 and 119861respectively and 119875 is a proper reconciliation function wehave the following

(1) 119860 observes physical event 119864 and extracts ID119860(2) 119861 observes physical event 119864 and extracts ID119861 asymp ID119860(3) 119860 computes 119896 = 119875(ID119860)(4) 119861 computes 119896 = 119875(ID119861) = 119875(ID119860)(5) 119860 and 119861 can communicate using cryptographic pro-

tocols over the secret key 119896Two aspects must be properly addressed to confirm the

protocol security The first one is the 119875 function 119875 hasto be chosen in such manner that the differences betweenidentifiers ID119860 and ID119861 are suppressed Otherwise the 119896value will not be the same for 119860 and 119861 The second aspectis related to the interpretation of 119864 Since 119896 is proposedfor cryptographic use one expects that 119896 presents randomproperties So the physical context (and consequently eachphysical event) must be associated with nondeterministicprocesses

To point out a solution and make the security analysisclearer we propose a Unique Bitstream Generator model thatcan be implemented using physical context information Theidea will be formally exposed and discussed in the nextsection

4 Generation of Unique Bitstream fromPhysical Events

41 Probabilistic Theoretic Model We formalize the UniqueBitstream Generator based on a discrete probabilistic modelWe assume the existence of a random bit generator 119866 whosegenerated bitstream is accessible to any party that is locatedin a given environment The goal is to use these bitstreamsto generate cryptographic keys that will allow the securecommunication between the parties in this environmentHowever the communication between 119866 and the parties

6 Security and Communication Networks

Unique Bitstream Generator

Secret key

BobAlice

Physical event

ID-BID-A

Figure 2 The Unique Bitstream Generator 119866 description

inserts errors in the bits generated by119866Therefore the partiesreceive related but distinct bitstreams that will need to besomehow processed before generating cryptographic keysThe diagram in Figure 2 depicts the model

We denote by time unit the minimum amount of timeobserved by the parties Each time unit corresponds to aunique bit generated by 119866 Note that this bit is sent via acommunication channel that introduces errors So the partieswill not necessarily receive the bit generated by 119866 A time slotis a set of subsequent time units and the size of the time slotis the size of the set

42 Clock Errors and Transmission Delays One importantaspect for the Unique Bitstream problem is whether theparties can refer precisely to each time unit or whether clockerror and delays on the transmission of physical events canimpact the synchronization between the parties ldquoAbsolutesynchronizationrdquo allows the development of more powerfulprotocols but in general it is not a reasonable assumptionfor most real world applications In practice we assume thatsynchronization errors lead to bit transmission errors A bitassociated with a time unit can be interpreted differently by119860 and 119861 since the precise instants where the time unit beginsand finishes are not the same for 119860 and 11986143 Counting Events The Binomial Distribution Model Weconsider that the following strategy generates a unique key 119896from the bitstream generated by119866We partition the bitstreaminto time slots and count the number of bits 1 (ie wecompute the sum of the bits in the time units in each timeslot)Then we define a bit associated with each slot accordingto this sum Assuming the equiprobability of bits 0 and 1 andconsidering that the number of bits 1 in each slot follows abinomial distribution a typical choice is to associate bit 0witha slot whose sum is less than half the number of time units ofthis slot Formally we represent a time slot119879with 119896 time units

Unique Bitstream Generator

Err-A Err-B

0110010110

01000

010001011001100 11110

010110 1

01

0110011110

ff

Figure 3 The Unique Bitstream Generator counting events exam-ple

as a 119896-tuple (1198871 119887119896) of binary digits The sum 119878119879 is givenby

119878119879 =119896

sum119894=1

119887119894 (1)

The bit 119873119879 associated with slot 119879 is 1 if 119878119879 lt 1198962 and is 0otherwise Figure 3 depicts an example

Consider a time slot 119879 = (1198871 119887119896) transmitted to119860 and119861 and received by 119860 as 119879119860 = (1198871198601 119887119860119896 ) and by 119861 as 119879119861 =(1198871198611 119887119861119896 ) Recall that each bit 119887119894 can be flipped with a givenprobability 119901119864 so that the probability that 119887119860119894 = 119887119861119894 for eachbit received by 119860 and 119861 is given by

119901 = 2119901119864 (1 minus 119901119864) (2)

Considering the possibility of error it is possible that thetotal number of bits counted by 119860 and 119861 is not the same Sothe associated bits are distinct

An important aspect of our proposedmodel is that it takesadvantage of classic probabilistic models and paradigms Aswe saw the model is strongly based on the so-called binomialdistribution Furthermore the behavior observed in the sim-ulation and the case study is properly explained by analyzingthe scenarios defined over the binomial distribution function

44 Naive Counting Protocol (NC) We start by consideringthemore simple protocol where the bit associated with a timeslot is determined by the majority of the bits in this time slotFormally the protocol associates bit 0 with a time slot 119879 =(1198871 119887119896) if 119878119879 lt 1198962 and bit 1 otherwise

In the above model the probability of an error is theprobability that one party say 119860 receives a time slot whosemajority is distinct to the majority in the time slot receivedby the other party 119861mdashthis could happen due to transmissionerrors

In the following subsection we generalize the NaiveCounting Protocol and derive bounds for the probability oferrors

Security and Communication Networks 7

45 The Band of Guard Protocol (BG) As we show in theprevious section the Naive Counting Protocol presents anonnegligible probability that 119860 and 119861 associate distinctbits with a time slot In the present section we define analternative protocol The idea is to define a ldquobandrdquo thatdetermines whether time slot presents a high probability oferror Intuitively a time slot has a high probability of errorif the number of 1s is close to half the number of time unitsof the slots In practice 119860 and 119861 agree about a number 119887 ifthe number of bits 1 in a slot is between 1198962 minus 119887 and 1198962 + 119887where 119896 is the number of time units in a time slot If a slot119879119860 observed by 119860 (resp slot 119879119861 observed by 119861) has a sumof bits that falls inside the band that is between 1198962 minus 119887 and1198962 + 119887 then 119879119860 (resp 119879119861) does not generate a bit In otherwords the bit associated with a slot can be bit 0 if the numberof bits 1 is below 1198962 minus 119887 bit 1 if the number of bits 1 is above1198962 + 119887 and ldquoundefinedrdquo if the sum of bits is between 1198962 minus 119887and 1198962 + 119887

Note that the ldquoband of guardrdquo protocol is a generalizationof the ldquonaive countingrdquo protocol where the ldquonaive countingrdquoprotocol has a band of guard 119896 = 0

The advantage of the above strategy is that the probabilitythat a slot119879 gives origin to distinct bits for119860 and119861 is lower asa larger number of bit flips would need to occur On the otherside the bit production rate is lower due to the ldquoundefinedrdquobits Besides the parties should interact to informwhich slotsgenerated undefined bits (hence need to be discarded) Notethat the fact that the parties indicate discarded slots doesnot allow an attacker to obtain any information about thegenerated bits

One disadvantage of the ldquoband of guard protocolrdquo is therapid decrease of throughput as a function of the size of theguard Indeed the binomial distribution leads to a strongconcentration around themeanUsingChernoff bounds [39]it can be proved that

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

12radic6119899 log119890 (119899)) le 2

119899 (3)

where 119883 is the number of bits 1 in a time slot with 119899 bitsIn practice that means that the concentration on the

number of bits 1 around the mean 1198992 is very tight mostof the time the deviation from this mean is on the order of119874(119899 log(119899))

Anotherway of using theChernoff bound technique gives

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

1198994) le 2119890minus11989924 (4)

which indicates exponential decrease on the size of the slotfor the probability of the total number of bits 1 to be below1198994 or above 31198994 As a consequence a small increase in thesize of the band of guard leads to a relevant decrease in thepercentage of valid time slots

46 The Best Slots Protocol (BS) We describe a strategy toreduce the number of errors in the generation of bitstreamsfrom physical events Basically instead of using time slotswith predefined timeframes that is set of time units we allowthe beginning and the end of each slot to be dynamically

Discarded bits Best slot

Next slot

0110010110100110101

0110010110100110101

Figure 4 How the choosing best slots protocol works

defined so that the number of bits 1 or bits 0 is guaranteedto be above the desired threshold therefore leading to anadequate error rate

The idea is simple Consider a time slot 119879 = (1198871 119887119896)transmitted to119860 and119861 and received by119860 as119879119860 = (1198871198601 119887119860119896 )and by 119861 as 119879119861 = (1198871198611 119887119861119896 ) Assume that 119860 and 119861 agreedabout a value 119896 for a threshold for the band of guard If thenumber of bits 1 observed by 119860 in 119879119860 (resp observed by 119861 in119879119861) is between 1198962 minus 119887 and 1198962 + 119887 where 119896 is the number oftime units in a time slot then 119860 (resp 119861) sinalizes that (s)hedoes not wish to use slot119879 as the generator of a bitThen each119860 and each119861 considers the ldquonext slotrdquo119879 = (1198872 119887119896+1) thatis we slide right the time slot

It is important to mention that the checksum update canbe efficiently computed by considering only the values of bits1198871 119887119896 1198872 and 119887119896+1mdashthere is no need to perform an additionalcounting of bits 1 in the new time slot 119879 = (1198872 119887119896 + 1)

The protocol works as follows (see Figure 4)We start likein BG protocol selecting time slots 119879 = (1198871 119887119896) Beforeaccepting a new time slot 119879 one of the parties (the verifier)checks the sum of the bits 119878119879 If 119878119879 is inside the band of guardthe first bit 1198871 isin 119879 is discarded and the bits are shifted doing119887119894 = 119887119894+1 The next bit will be again 119887119896 and the procedurerepeats until 119878119879 generates 0 or 1 When it happens the newtime slot119879 is accepted and the verifier informs the other parthow many bits must be discarded to get 119879

5 Simulation Results

The protocols proposed in the previous section were verifiedusing simulation We suppose that two entities 119860 and 119861 tryto establish a secure communication channel using physicalevents The experiment is set up as follows We use a randombinary stream generated by website wwwrandomorg whichwas checked using the NIST Statistical Test Suite for Randomand Pseudorandom Number Generators [40] The binarystream works as an oracle of ldquovirtualrdquo physical events justlike in the Unique BitstreamModel previously described Wesimulate 119860 and 119861 as entities that observe physical events andtry to determine a secret key 119896 implementing each one of thedescribed protocols

The simulation results show each protocol accuracy andthroughput By accuracy we mean the rate of simulated caseswhere Alice and Bob are successful in establishing the samesecret key 119896 In turn the throughput is the rate of physicalevents (in our simulation bits) which are effectively used onvalid slots Aiming to make the simulation more realisticwe define an error rate err which determines the probabilitywhich an entity can miss a described event That means aphysical event 119864 = 0 can be observed as 1198641015840 = 1 with aprobability of err and vice versa

8 Security and Communication Networks

Table 1 Theoretical NC and BG protocols simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 (NC) 55 05 00 1001 125 18 00 7532 827 570 54 3433 100 899 472 1084 100 100 632 219

Table 2 Theoretical BS protocol simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 217 57 03 9761 948 813 353 9382 9987 991 918 9193 100 9949 949 2414 100 100 100 134

For practical reasons we fixed some parameters fordetermining the Unique Bitstream We consider each bit as1 time unit The time slot is fixed as 10 time units and we tryto obtain 64-bit unique bitstreams which means that eachprotocol will consume the binary stream until it finds 64ldquogoodrdquo slots

Table 1 summarizes the results obtained for Naive Count-ing (NC) and Counting with Band of Guard (BG) protocolsThe Band column indicates the band of guard size (in bits)adopted on each simulation One can note that accuracy andthroughput reach better rates when the band of guard valueis increased The gain in accuracy depends on the simulatederror rate err something already expected once the UniqueBitstream generation protocols shall work better with lowerror rates

Table 2 describes the simulation results for best slots(BS) protocol One shall observe that BS protocol presents abetter performance when compared to NC and BG protocolsBesides the higher accuracy its results show a significantgain in throughput In practice such performance implies afaster authentication process once BS protocol requires lessphysical events to determine 1198966 Case Study Using Radio Signal

61 Radio Signals as Physical Events In this section wepresent a practical case study related to the activities ofthe National Institute of Metrology Quality and Technology(Inmetro) in Brazil The Inmetro delegates notified bodiesto inspect measurement instruments under legal regulationSuch activity called metrological surveillance is done ininstruments already in use on the field (eg scales fuelpumps) Albeit these measuring instruments are connectedto the Internet surveillance agents (ie notified bodiesrsquotechnicians) need to go to the instrumentrsquos site for proceedingwith a complete visual inspection So the Inmetro wants to

check the suitability of using physical context to authenticatesurveillance agents before granting access to the instrument

Measuring instruments employed for regulating con-sumer relations are typically used in places such as supermar-kets stores shops and gas stations Nowadays these placesare surrounded by different radio-based communicationinfrastructures (eg WLANs) The radio signal propagationgenerates physical context information creating an ldquoelec-tromagnetic fingerprintrdquo That can be used as evidence ofcolocation and simultaneity of measuring instruments andsurveillance agents In this case study we use the signalgenerated by public IEEE 80211 wireless (Wi-Fi) networksThe IEEE 80211 is a well-disseminated network standard andcan be easily found in practically any public place

We see Wi-Fi network packets as physical events Theycan be detected and measured by any device using a properradio in monitoring mode In our study the Wi-Fi networkis treated as a physical event generator and not as a com-munication channel Thus the authenticating devices are notconnected to the Wi-Fi network Instead they just use theirradios as sensors receivingWi-Fi packets as physical contextinformation

The study case contemplates a measuring instrument 119860and a surveillance agent 119861 Both entities are equipped withWi-Fi radios and share the same physical context describedby the electromagnetic fingerprint of a local Wi-Fi network(Figure 5) At the same time 119872 is a malicious surveillanceagent who wants to counterfeit a visual inspection of 119860 Thethree entities are connected to the Internet but 119860 and 119861 donot use theirWi-Fi radio for that We also assume that119872 hasall the capabilities and restrictions described in Section 32

Wi-Fi radios can be configured in monitoring mode andwork as sensorsThey can ldquosenserdquo allWi-Fi traffic and identifydifferent packets with their respective source and destinationaddresses Such information constitutes our physical contextWe use it for composing a physical event identifier that

Security and Communication Networks 9

WLAN physical context

InternetA

BM

Figure 5 Using Wi-Fi signals as physical event

results from the interaction among several connected devicessendingWi-Fi packets in a given moment Once the networkcoverage field is limited only entities placed in this same areaat the same time can obtain the event identifier

62 The Physical Event Identifier We associate the ideaof physical context with the Wi-Fi network traffic Eachpacket sent by any node in the network is considered aphysical event Since 119860 and 119861 have Wi-Fi radios they canbe configured for monitoring any specific Wi-Fi networkchannel Thus they use the Wi-Fi tracing information todetermine a physical event identifier

Firstly 119860 and 119861 process tracing information by extract-ing only packets source addresses and timestamps Sourceaddresses link a physical event with the location where itoccurs Wi-Fi networks are sharply distinguished by theirnodes mobility So one can expect that a public Wi-Finetwork will present different nodes (and consequentlydifferent addresses) when we compare traces extracted atdifferent moments We use119860 and 119861 local clocks to obtain thepackets timestamps which implies that the devices are notsynchronized Timestamps are necessary to know when eachnode is sending information to the network Doing that wecan determine time slots by assigning zero when a node doesnot send any information and one when otherwiseThe resultis a physical context description that can be analyzed usingthe Unique Bitstream Generator model already describedFurthermore such time slots present a nondeterministicpattern once it is hard to predict when a network nodewill send a packet A problem emerges due to the hiddennode problem 119860 can detect packages from a node which ishidden from 119861 or vice versa This condition can affect 119860 and119861 physical event identifiers compromising authenticationWe avoid such problem proposing an additional messageinterchange which enables 119860 and 119861 to determine a commonset of communicating node addresses for extracting theirrespective physical event identifiers ID119860 and ID119861

The authentication protocol is initiated by 119861 asking 119860for authentication After that 119860 challenges 119861 to presentthe physical context proof Both the entities start to collectnetwork traces during a predefined time interval After

collecting all the traces 119860 and 119861 will have two similar setsof partial identifiers given by the following equation

ID119894 = ⟨1199041 1199051⟩ ⟨119904119896 119905119896⟩ ⟨119904119870 119905119870⟩ (5)

where 119870 is the number of different nodes identified in theWi-Fi trace 119904119896 is the 119896th network node MAC (Media AccessControl) address and 119905119896 is a119871-bit binary string correspondingto the frequency distribution of the 119896th network node signal

For security reasons 119904119896 could be obfuscated by any hashfunction preventing the disclosure of private informationabout the Wi-Fi network node Regardless our experimentconsiders the use of a public Wi-Fi network implying thatMAC addresses are public as well

In turn 119905119896 is given by the following algorithm

(1) Define 119871 slots of time and compute a frequency dis-tribution 119865 = 1198911 1198912 119891119871 counting each packetwhere the source address corresponds to 119904119896 usingtimestamp information

(2) Extract a binary 119871-bits representation where for eachclass 119897 = 1 2 119871 in 119865 the 119897th bit 119887119897 is given by theBoolean operation 119887119897 = (119891119897 gt 0)

(3) Do 119905119896 = ⟨1198871 1198872 119887119871⟩Figure 6 illustrates the proposed algorithm with 119871 =

16 Packets from the same source address are sampled in afrequency distribution histogram One can observe that insubgraphs119860 and119861 Finally the binary representation showedin graph 119862 is computed as a partial identifier 119905119896

Once 119860 and 119861 have their respective partial identifiersID119860 and ID119861 they need to solve the hidden node prob-lem determining the intersection among their known nodeaddresses 119904119896 Supposing that Addr119860 andAddr119861 are the subsetscontaining 1199041 119904119870 of ID119860 and ID119861 respectively wepropose the following sequence of messages

119861 997888rarr 119860 Addr119861119860 119868 = Addr119860 cap Addr119861

119860 119904119877 isin 119868 | 119877 = rand ()119860 997888rarr 119861 119904119877

119860 119861 119896 = 119905119877

(6)

Although the proposed messages reveal the nodeaddresses chosen to determine the physical event identifierthey do not disclose any information about the selectedfrequency distribution of 119905119877 That keeps the authenticationprotocol secure against an attacker 119872 with capabilitiesdescribed at Section 32

63 Experiment Description Our experiment is imple-mented using two computers with different Wi-Fi adapterssimulating119860 and 119861 devices respectively Both computers runUbuntu 1404 Linux operating systemTheir Wi-Fi interfaceswork as sensors using monitoring mode to gather all Wi-Fipackages traffic

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

4 Security and Communication Networks

241 Manufacturing Industry Critical concerns about thesecurity in manufacturing processes have been addressedin the literature [3 5] Physical context information fromindustrial processes environment can improve productsidentification and authentication Products embedding sen-sors and smart components able to store data can gatherinformation from physical events related to any physicalprocess Such information can attest that a specific productwas submitted to specific manufacturing steps and qualityassessment procedures As an example one can consider aproduct using accelerometers for measuring its movementinto an industrial conveyor belt The continuous startstopmovement on an assembly line produces a ldquokinetic finger-printrdquo which can confirm that this product has passed bythe specific manufacturing process Besides improving iden-tification and traceability of products after production suchapproach can also be explored in quality control One canimplement authentication checkpoints in the manufacturingline avoiding defects related to wrong steps sequences oreven the absence of specific manufacturing steps and testsThat solution could have a remarkable impact on conformityassessment and quality control in industrial processes

242 Vehicular Transportation Transportation implies themovement of vehicles into a physical environment Conse-quently vehicles can make use of rich physical context infor-mation for providing more sophisticated services Severalemerging applications involving smart autonomous vehiclesand vehicular networks can employ physical context-basedauthentication to increase security For instance vehiclesimplementing vehicle-to-vehicle communication (V2V) [6]can authenticate each other using physical context informa-tion that describes their environment and trajectory In aV2V environment vehicles are usually close to each otherand consequently can describe the same physical context [8]Signals from environmental sensors (temperature humidityand air pressure) and movement sensors (accelerometerscompass and GPS) can be used for obtaining a ldquocontext fin-gerprintrdquo A similar strategy could protect a moving vehicleagainst external attacks which aim to get access to the ControlArea Network (CAN) bus [7 35] In such situation thevehiclersquos Electronic Control Units (ECUs) can authenticateeach other by asking for credentials which also describethe vehiclersquos physical context including dynamic attributesrelated to its trajectory and environment Again movementand environmental sensors can be used for composing acontext identifier which only ECUs embedded in the vehiclecan determine The attacker placed outside the vehiclecannot guess or describe the respective physical context

243 Smart Grids One of the basic features provided bysmart grids consists of telemetry which enables the readingof end-usersrsquo consumption from a remote place [36] Dueto privacy reasons some solutions propose the existenceof a gateway to aggregate information from a group ofsmart meters (end-users) in the same neighborhood In turngateway and smart meters need to authenticate each otherbefore exchanging any consumption information Physicalcontext information can improve this process by providing

Physical world Physical context

BobAliceMarley

Communication channel

E(t)

E(t + 1)E(t + 2)

Figure 1 The physical context authentication problem

evidence that gateway and smart meters are in the samepower grid segment thus avoiding external attacks That canbe done by measuring physical events from the power gridOne possibility is to explore the variations in voltage levelsThe VoltVAR Control (VVC) [37] is the system that keepsa stable voltage profile in the power grid However slightvoltage variations can be observed along a grid segmentThey result from different energy loads supported in eachspecific grid segment Such phenomenon becomes evenmoredynamic in energy microgeneration scenarios creating asingular case of physical context given by the energy flow in agrid Thus gateway and smart meters placed in the same gridsegment can use such context for authenticating each other

3 Physical Context and Secure Channels

31 Defining Physical Context It is time to return to ourauthentication problem (Figure 1) Alice must authenticateBob before starting any communication Furthermore Bobneeds to prove to Alice that they are sharing the same physicalcontext If that is true then Alice and Bob also fulfill twoimportant conditions

(i) Colocation Alice and Bob are in the same physicallocation or relatively close to each other or connectedto an environment where the physical phenomenonoccurs

(ii) Simultaneity Alice and Bob are observing their phys-ical context at the same time

One should note that our definition implies that colo-cation is more than physical proximity For instance twosmart meters connected to the same smart grid segment candescribe the same physical context related to the grid energyflows even while being placed far away from each otherIndeed colocation can indicate a relative idea of proximity

Colocation and simultaneity are desirable properties toenforce security policies in situations where entities loca-tion and synchronism matter Usually this information isobtained using additional infrastructures such as positioningsystems (geographic or indoor) and timestamps servicesHowever colocation and simultaneity also can be evidenced

Security and Communication Networks 5

by physical events and physical context information withoutthe need for any additional infrastructure That happenswhen Alice and Bob can describe the same physical eventssomething expected when they share the same physicalcontext Besides that in the described scenario neither Alicenor Bob needs to interact with the physical world activelyThey could be just passive entities gathering informationfrom the physical world

32 Attack Model We assume that the attacker is a maliciousexternal entity (Marley) with total access to the communica-tion channel used by Alice and Bob Marley can listen to thischannel and intercept authentication messages MoreoverMarley can send fake messages performing man-in-the-middle attacks His primary intention is to impersonateBob fooling Alice and so getting nonauthorized accessto information and services However once Marley is anexternal entity he does not have access to Alice and Bobrsquosphysical context Consequently Marley cannot capture thesame physical events observed by them Despite that he cantry to find out physical context information from Alice andBob eavesdropping on their communication channel

Marleyrsquos attack capabilitiesmust be evaluated consideringthe two following scenarios

(1) Secure communication scenario we assume the exis-tence of a reliable mechanism that delivers the samesecret key to Alice and Bob This key can be used toestablish an encrypted communication channel usingany reliable cryptographic protocol We also assumethatMarley cannot steal that secret keyThusMarleyrsquoscapabilities are restricted to relay attacks by forward-ing messages of legitimate entities something thatdoes not represent any threat once all the messagesare encrypted

(2) Nonsecure communication scenario we assume thatthemessages are sent in plain text In this caseMarleyhas the following capabilities

(i) Steal information eavesdropping on the com-munication between Alice and Bob

(ii) Impersonate Bob using intercepted informa-tion from a legitimate entity in a relay attack

(iii) Impersonate Bob using authentication tokensfrom previous sessions in a replay attack

Since Marley has total control over the communicationchannel he can launch a diversity of attacks targetingavailability (eg injection attacks Denial-of-Service attacks)Such situation requires defense-in-depth strategies (eg aprevious authentication layer that prevents Marley from get-ting control over the communication channel [38]) Althoughthat is a relevant concern we do not consider such attacksin this study Thus we assume that Marley has no interest inattacks against system availability

33 AuthenticationMechanismUsing Physical Context Phys-ical context-based authentication can work in different waysfor each described attack scenario On one hand physical

context can be used only as evidence of colocation andsimultaneity between Alice and Bob That is the approachfollowed by most of the works related to physical context-based authentication (see Section 22) On the other handwhen we consider a nonsecure communication scenariothings become more interesting physical context can alsowork as an exclusive channel for secret key distribution

Suppose that Alice and Bob share the same physicalcontext So they know that their physical context descriptionis quite similar although not equalWe call these descriptionsas physical event identifiers All Alice and Bob need is areconciliation protocol that can convert both identifiers in thesame secret key Such protocol must disclose just a minimalinformation amount about the physical context descriptionand the respective identifiers Consequently Marley cannotfigure out the physical context or deduce the secret key OnceAlice and Bob have a shared secret key they can establish asecure channel reducing the attacker capabilities to the firstattack scenario

We formalized the idea expressed above in the followingprotocol If Alice and Bob are represented by 119860 and 119861respectively and 119875 is a proper reconciliation function wehave the following

(1) 119860 observes physical event 119864 and extracts ID119860(2) 119861 observes physical event 119864 and extracts ID119861 asymp ID119860(3) 119860 computes 119896 = 119875(ID119860)(4) 119861 computes 119896 = 119875(ID119861) = 119875(ID119860)(5) 119860 and 119861 can communicate using cryptographic pro-

tocols over the secret key 119896Two aspects must be properly addressed to confirm the

protocol security The first one is the 119875 function 119875 hasto be chosen in such manner that the differences betweenidentifiers ID119860 and ID119861 are suppressed Otherwise the 119896value will not be the same for 119860 and 119861 The second aspectis related to the interpretation of 119864 Since 119896 is proposedfor cryptographic use one expects that 119896 presents randomproperties So the physical context (and consequently eachphysical event) must be associated with nondeterministicprocesses

To point out a solution and make the security analysisclearer we propose a Unique Bitstream Generator model thatcan be implemented using physical context information Theidea will be formally exposed and discussed in the nextsection

4 Generation of Unique Bitstream fromPhysical Events

41 Probabilistic Theoretic Model We formalize the UniqueBitstream Generator based on a discrete probabilistic modelWe assume the existence of a random bit generator 119866 whosegenerated bitstream is accessible to any party that is locatedin a given environment The goal is to use these bitstreamsto generate cryptographic keys that will allow the securecommunication between the parties in this environmentHowever the communication between 119866 and the parties

6 Security and Communication Networks

Unique Bitstream Generator

Secret key

BobAlice

Physical event

ID-BID-A

Figure 2 The Unique Bitstream Generator 119866 description

inserts errors in the bits generated by119866Therefore the partiesreceive related but distinct bitstreams that will need to besomehow processed before generating cryptographic keysThe diagram in Figure 2 depicts the model

We denote by time unit the minimum amount of timeobserved by the parties Each time unit corresponds to aunique bit generated by 119866 Note that this bit is sent via acommunication channel that introduces errors So the partieswill not necessarily receive the bit generated by 119866 A time slotis a set of subsequent time units and the size of the time slotis the size of the set

42 Clock Errors and Transmission Delays One importantaspect for the Unique Bitstream problem is whether theparties can refer precisely to each time unit or whether clockerror and delays on the transmission of physical events canimpact the synchronization between the parties ldquoAbsolutesynchronizationrdquo allows the development of more powerfulprotocols but in general it is not a reasonable assumptionfor most real world applications In practice we assume thatsynchronization errors lead to bit transmission errors A bitassociated with a time unit can be interpreted differently by119860 and 119861 since the precise instants where the time unit beginsand finishes are not the same for 119860 and 11986143 Counting Events The Binomial Distribution Model Weconsider that the following strategy generates a unique key 119896from the bitstream generated by119866We partition the bitstreaminto time slots and count the number of bits 1 (ie wecompute the sum of the bits in the time units in each timeslot)Then we define a bit associated with each slot accordingto this sum Assuming the equiprobability of bits 0 and 1 andconsidering that the number of bits 1 in each slot follows abinomial distribution a typical choice is to associate bit 0witha slot whose sum is less than half the number of time units ofthis slot Formally we represent a time slot119879with 119896 time units

Unique Bitstream Generator

Err-A Err-B

0110010110

01000

010001011001100 11110

010110 1

01

0110011110

ff

Figure 3 The Unique Bitstream Generator counting events exam-ple

as a 119896-tuple (1198871 119887119896) of binary digits The sum 119878119879 is givenby

119878119879 =119896

sum119894=1

119887119894 (1)

The bit 119873119879 associated with slot 119879 is 1 if 119878119879 lt 1198962 and is 0otherwise Figure 3 depicts an example

Consider a time slot 119879 = (1198871 119887119896) transmitted to119860 and119861 and received by 119860 as 119879119860 = (1198871198601 119887119860119896 ) and by 119861 as 119879119861 =(1198871198611 119887119861119896 ) Recall that each bit 119887119894 can be flipped with a givenprobability 119901119864 so that the probability that 119887119860119894 = 119887119861119894 for eachbit received by 119860 and 119861 is given by

119901 = 2119901119864 (1 minus 119901119864) (2)

Considering the possibility of error it is possible that thetotal number of bits counted by 119860 and 119861 is not the same Sothe associated bits are distinct

An important aspect of our proposedmodel is that it takesadvantage of classic probabilistic models and paradigms Aswe saw the model is strongly based on the so-called binomialdistribution Furthermore the behavior observed in the sim-ulation and the case study is properly explained by analyzingthe scenarios defined over the binomial distribution function

44 Naive Counting Protocol (NC) We start by consideringthemore simple protocol where the bit associated with a timeslot is determined by the majority of the bits in this time slotFormally the protocol associates bit 0 with a time slot 119879 =(1198871 119887119896) if 119878119879 lt 1198962 and bit 1 otherwise

In the above model the probability of an error is theprobability that one party say 119860 receives a time slot whosemajority is distinct to the majority in the time slot receivedby the other party 119861mdashthis could happen due to transmissionerrors

In the following subsection we generalize the NaiveCounting Protocol and derive bounds for the probability oferrors

Security and Communication Networks 7

45 The Band of Guard Protocol (BG) As we show in theprevious section the Naive Counting Protocol presents anonnegligible probability that 119860 and 119861 associate distinctbits with a time slot In the present section we define analternative protocol The idea is to define a ldquobandrdquo thatdetermines whether time slot presents a high probability oferror Intuitively a time slot has a high probability of errorif the number of 1s is close to half the number of time unitsof the slots In practice 119860 and 119861 agree about a number 119887 ifthe number of bits 1 in a slot is between 1198962 minus 119887 and 1198962 + 119887where 119896 is the number of time units in a time slot If a slot119879119860 observed by 119860 (resp slot 119879119861 observed by 119861) has a sumof bits that falls inside the band that is between 1198962 minus 119887 and1198962 + 119887 then 119879119860 (resp 119879119861) does not generate a bit In otherwords the bit associated with a slot can be bit 0 if the numberof bits 1 is below 1198962 minus 119887 bit 1 if the number of bits 1 is above1198962 + 119887 and ldquoundefinedrdquo if the sum of bits is between 1198962 minus 119887and 1198962 + 119887

Note that the ldquoband of guardrdquo protocol is a generalizationof the ldquonaive countingrdquo protocol where the ldquonaive countingrdquoprotocol has a band of guard 119896 = 0

The advantage of the above strategy is that the probabilitythat a slot119879 gives origin to distinct bits for119860 and119861 is lower asa larger number of bit flips would need to occur On the otherside the bit production rate is lower due to the ldquoundefinedrdquobits Besides the parties should interact to informwhich slotsgenerated undefined bits (hence need to be discarded) Notethat the fact that the parties indicate discarded slots doesnot allow an attacker to obtain any information about thegenerated bits

One disadvantage of the ldquoband of guard protocolrdquo is therapid decrease of throughput as a function of the size of theguard Indeed the binomial distribution leads to a strongconcentration around themeanUsingChernoff bounds [39]it can be proved that

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

12radic6119899 log119890 (119899)) le 2

119899 (3)

where 119883 is the number of bits 1 in a time slot with 119899 bitsIn practice that means that the concentration on the

number of bits 1 around the mean 1198992 is very tight mostof the time the deviation from this mean is on the order of119874(119899 log(119899))

Anotherway of using theChernoff bound technique gives

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

1198994) le 2119890minus11989924 (4)

which indicates exponential decrease on the size of the slotfor the probability of the total number of bits 1 to be below1198994 or above 31198994 As a consequence a small increase in thesize of the band of guard leads to a relevant decrease in thepercentage of valid time slots

46 The Best Slots Protocol (BS) We describe a strategy toreduce the number of errors in the generation of bitstreamsfrom physical events Basically instead of using time slotswith predefined timeframes that is set of time units we allowthe beginning and the end of each slot to be dynamically

Discarded bits Best slot

Next slot

0110010110100110101

0110010110100110101

Figure 4 How the choosing best slots protocol works

defined so that the number of bits 1 or bits 0 is guaranteedto be above the desired threshold therefore leading to anadequate error rate

The idea is simple Consider a time slot 119879 = (1198871 119887119896)transmitted to119860 and119861 and received by119860 as119879119860 = (1198871198601 119887119860119896 )and by 119861 as 119879119861 = (1198871198611 119887119861119896 ) Assume that 119860 and 119861 agreedabout a value 119896 for a threshold for the band of guard If thenumber of bits 1 observed by 119860 in 119879119860 (resp observed by 119861 in119879119861) is between 1198962 minus 119887 and 1198962 + 119887 where 119896 is the number oftime units in a time slot then 119860 (resp 119861) sinalizes that (s)hedoes not wish to use slot119879 as the generator of a bitThen each119860 and each119861 considers the ldquonext slotrdquo119879 = (1198872 119887119896+1) thatis we slide right the time slot

It is important to mention that the checksum update canbe efficiently computed by considering only the values of bits1198871 119887119896 1198872 and 119887119896+1mdashthere is no need to perform an additionalcounting of bits 1 in the new time slot 119879 = (1198872 119887119896 + 1)

The protocol works as follows (see Figure 4)We start likein BG protocol selecting time slots 119879 = (1198871 119887119896) Beforeaccepting a new time slot 119879 one of the parties (the verifier)checks the sum of the bits 119878119879 If 119878119879 is inside the band of guardthe first bit 1198871 isin 119879 is discarded and the bits are shifted doing119887119894 = 119887119894+1 The next bit will be again 119887119896 and the procedurerepeats until 119878119879 generates 0 or 1 When it happens the newtime slot119879 is accepted and the verifier informs the other parthow many bits must be discarded to get 119879

5 Simulation Results

The protocols proposed in the previous section were verifiedusing simulation We suppose that two entities 119860 and 119861 tryto establish a secure communication channel using physicalevents The experiment is set up as follows We use a randombinary stream generated by website wwwrandomorg whichwas checked using the NIST Statistical Test Suite for Randomand Pseudorandom Number Generators [40] The binarystream works as an oracle of ldquovirtualrdquo physical events justlike in the Unique BitstreamModel previously described Wesimulate 119860 and 119861 as entities that observe physical events andtry to determine a secret key 119896 implementing each one of thedescribed protocols

The simulation results show each protocol accuracy andthroughput By accuracy we mean the rate of simulated caseswhere Alice and Bob are successful in establishing the samesecret key 119896 In turn the throughput is the rate of physicalevents (in our simulation bits) which are effectively used onvalid slots Aiming to make the simulation more realisticwe define an error rate err which determines the probabilitywhich an entity can miss a described event That means aphysical event 119864 = 0 can be observed as 1198641015840 = 1 with aprobability of err and vice versa

8 Security and Communication Networks

Table 1 Theoretical NC and BG protocols simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 (NC) 55 05 00 1001 125 18 00 7532 827 570 54 3433 100 899 472 1084 100 100 632 219

Table 2 Theoretical BS protocol simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 217 57 03 9761 948 813 353 9382 9987 991 918 9193 100 9949 949 2414 100 100 100 134

For practical reasons we fixed some parameters fordetermining the Unique Bitstream We consider each bit as1 time unit The time slot is fixed as 10 time units and we tryto obtain 64-bit unique bitstreams which means that eachprotocol will consume the binary stream until it finds 64ldquogoodrdquo slots

Table 1 summarizes the results obtained for Naive Count-ing (NC) and Counting with Band of Guard (BG) protocolsThe Band column indicates the band of guard size (in bits)adopted on each simulation One can note that accuracy andthroughput reach better rates when the band of guard valueis increased The gain in accuracy depends on the simulatederror rate err something already expected once the UniqueBitstream generation protocols shall work better with lowerror rates

Table 2 describes the simulation results for best slots(BS) protocol One shall observe that BS protocol presents abetter performance when compared to NC and BG protocolsBesides the higher accuracy its results show a significantgain in throughput In practice such performance implies afaster authentication process once BS protocol requires lessphysical events to determine 1198966 Case Study Using Radio Signal

61 Radio Signals as Physical Events In this section wepresent a practical case study related to the activities ofthe National Institute of Metrology Quality and Technology(Inmetro) in Brazil The Inmetro delegates notified bodiesto inspect measurement instruments under legal regulationSuch activity called metrological surveillance is done ininstruments already in use on the field (eg scales fuelpumps) Albeit these measuring instruments are connectedto the Internet surveillance agents (ie notified bodiesrsquotechnicians) need to go to the instrumentrsquos site for proceedingwith a complete visual inspection So the Inmetro wants to

check the suitability of using physical context to authenticatesurveillance agents before granting access to the instrument

Measuring instruments employed for regulating con-sumer relations are typically used in places such as supermar-kets stores shops and gas stations Nowadays these placesare surrounded by different radio-based communicationinfrastructures (eg WLANs) The radio signal propagationgenerates physical context information creating an ldquoelec-tromagnetic fingerprintrdquo That can be used as evidence ofcolocation and simultaneity of measuring instruments andsurveillance agents In this case study we use the signalgenerated by public IEEE 80211 wireless (Wi-Fi) networksThe IEEE 80211 is a well-disseminated network standard andcan be easily found in practically any public place

We see Wi-Fi network packets as physical events Theycan be detected and measured by any device using a properradio in monitoring mode In our study the Wi-Fi networkis treated as a physical event generator and not as a com-munication channel Thus the authenticating devices are notconnected to the Wi-Fi network Instead they just use theirradios as sensors receivingWi-Fi packets as physical contextinformation

The study case contemplates a measuring instrument 119860and a surveillance agent 119861 Both entities are equipped withWi-Fi radios and share the same physical context describedby the electromagnetic fingerprint of a local Wi-Fi network(Figure 5) At the same time 119872 is a malicious surveillanceagent who wants to counterfeit a visual inspection of 119860 Thethree entities are connected to the Internet but 119860 and 119861 donot use theirWi-Fi radio for that We also assume that119872 hasall the capabilities and restrictions described in Section 32

Wi-Fi radios can be configured in monitoring mode andwork as sensorsThey can ldquosenserdquo allWi-Fi traffic and identifydifferent packets with their respective source and destinationaddresses Such information constitutes our physical contextWe use it for composing a physical event identifier that

Security and Communication Networks 9

WLAN physical context

InternetA

BM

Figure 5 Using Wi-Fi signals as physical event

results from the interaction among several connected devicessendingWi-Fi packets in a given moment Once the networkcoverage field is limited only entities placed in this same areaat the same time can obtain the event identifier

62 The Physical Event Identifier We associate the ideaof physical context with the Wi-Fi network traffic Eachpacket sent by any node in the network is considered aphysical event Since 119860 and 119861 have Wi-Fi radios they canbe configured for monitoring any specific Wi-Fi networkchannel Thus they use the Wi-Fi tracing information todetermine a physical event identifier

Firstly 119860 and 119861 process tracing information by extract-ing only packets source addresses and timestamps Sourceaddresses link a physical event with the location where itoccurs Wi-Fi networks are sharply distinguished by theirnodes mobility So one can expect that a public Wi-Finetwork will present different nodes (and consequentlydifferent addresses) when we compare traces extracted atdifferent moments We use119860 and 119861 local clocks to obtain thepackets timestamps which implies that the devices are notsynchronized Timestamps are necessary to know when eachnode is sending information to the network Doing that wecan determine time slots by assigning zero when a node doesnot send any information and one when otherwiseThe resultis a physical context description that can be analyzed usingthe Unique Bitstream Generator model already describedFurthermore such time slots present a nondeterministicpattern once it is hard to predict when a network nodewill send a packet A problem emerges due to the hiddennode problem 119860 can detect packages from a node which ishidden from 119861 or vice versa This condition can affect 119860 and119861 physical event identifiers compromising authenticationWe avoid such problem proposing an additional messageinterchange which enables 119860 and 119861 to determine a commonset of communicating node addresses for extracting theirrespective physical event identifiers ID119860 and ID119861

The authentication protocol is initiated by 119861 asking 119860for authentication After that 119860 challenges 119861 to presentthe physical context proof Both the entities start to collectnetwork traces during a predefined time interval After

collecting all the traces 119860 and 119861 will have two similar setsof partial identifiers given by the following equation

ID119894 = ⟨1199041 1199051⟩ ⟨119904119896 119905119896⟩ ⟨119904119870 119905119870⟩ (5)

where 119870 is the number of different nodes identified in theWi-Fi trace 119904119896 is the 119896th network node MAC (Media AccessControl) address and 119905119896 is a119871-bit binary string correspondingto the frequency distribution of the 119896th network node signal

For security reasons 119904119896 could be obfuscated by any hashfunction preventing the disclosure of private informationabout the Wi-Fi network node Regardless our experimentconsiders the use of a public Wi-Fi network implying thatMAC addresses are public as well

In turn 119905119896 is given by the following algorithm

(1) Define 119871 slots of time and compute a frequency dis-tribution 119865 = 1198911 1198912 119891119871 counting each packetwhere the source address corresponds to 119904119896 usingtimestamp information

(2) Extract a binary 119871-bits representation where for eachclass 119897 = 1 2 119871 in 119865 the 119897th bit 119887119897 is given by theBoolean operation 119887119897 = (119891119897 gt 0)

(3) Do 119905119896 = ⟨1198871 1198872 119887119871⟩Figure 6 illustrates the proposed algorithm with 119871 =

16 Packets from the same source address are sampled in afrequency distribution histogram One can observe that insubgraphs119860 and119861 Finally the binary representation showedin graph 119862 is computed as a partial identifier 119905119896

Once 119860 and 119861 have their respective partial identifiersID119860 and ID119861 they need to solve the hidden node prob-lem determining the intersection among their known nodeaddresses 119904119896 Supposing that Addr119860 andAddr119861 are the subsetscontaining 1199041 119904119870 of ID119860 and ID119861 respectively wepropose the following sequence of messages

119861 997888rarr 119860 Addr119861119860 119868 = Addr119860 cap Addr119861

119860 119904119877 isin 119868 | 119877 = rand ()119860 997888rarr 119861 119904119877

119860 119861 119896 = 119905119877

(6)

Although the proposed messages reveal the nodeaddresses chosen to determine the physical event identifierthey do not disclose any information about the selectedfrequency distribution of 119905119877 That keeps the authenticationprotocol secure against an attacker 119872 with capabilitiesdescribed at Section 32

63 Experiment Description Our experiment is imple-mented using two computers with different Wi-Fi adapterssimulating119860 and 119861 devices respectively Both computers runUbuntu 1404 Linux operating systemTheir Wi-Fi interfaceswork as sensors using monitoring mode to gather all Wi-Fipackages traffic

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

Security and Communication Networks 5

by physical events and physical context information withoutthe need for any additional infrastructure That happenswhen Alice and Bob can describe the same physical eventssomething expected when they share the same physicalcontext Besides that in the described scenario neither Alicenor Bob needs to interact with the physical world activelyThey could be just passive entities gathering informationfrom the physical world

32 Attack Model We assume that the attacker is a maliciousexternal entity (Marley) with total access to the communica-tion channel used by Alice and Bob Marley can listen to thischannel and intercept authentication messages MoreoverMarley can send fake messages performing man-in-the-middle attacks His primary intention is to impersonateBob fooling Alice and so getting nonauthorized accessto information and services However once Marley is anexternal entity he does not have access to Alice and Bobrsquosphysical context Consequently Marley cannot capture thesame physical events observed by them Despite that he cantry to find out physical context information from Alice andBob eavesdropping on their communication channel

Marleyrsquos attack capabilitiesmust be evaluated consideringthe two following scenarios

(1) Secure communication scenario we assume the exis-tence of a reliable mechanism that delivers the samesecret key to Alice and Bob This key can be used toestablish an encrypted communication channel usingany reliable cryptographic protocol We also assumethatMarley cannot steal that secret keyThusMarleyrsquoscapabilities are restricted to relay attacks by forward-ing messages of legitimate entities something thatdoes not represent any threat once all the messagesare encrypted

(2) Nonsecure communication scenario we assume thatthemessages are sent in plain text In this caseMarleyhas the following capabilities

(i) Steal information eavesdropping on the com-munication between Alice and Bob

(ii) Impersonate Bob using intercepted informa-tion from a legitimate entity in a relay attack

(iii) Impersonate Bob using authentication tokensfrom previous sessions in a replay attack

Since Marley has total control over the communicationchannel he can launch a diversity of attacks targetingavailability (eg injection attacks Denial-of-Service attacks)Such situation requires defense-in-depth strategies (eg aprevious authentication layer that prevents Marley from get-ting control over the communication channel [38]) Althoughthat is a relevant concern we do not consider such attacksin this study Thus we assume that Marley has no interest inattacks against system availability

33 AuthenticationMechanismUsing Physical Context Phys-ical context-based authentication can work in different waysfor each described attack scenario On one hand physical

context can be used only as evidence of colocation andsimultaneity between Alice and Bob That is the approachfollowed by most of the works related to physical context-based authentication (see Section 22) On the other handwhen we consider a nonsecure communication scenariothings become more interesting physical context can alsowork as an exclusive channel for secret key distribution

Suppose that Alice and Bob share the same physicalcontext So they know that their physical context descriptionis quite similar although not equalWe call these descriptionsas physical event identifiers All Alice and Bob need is areconciliation protocol that can convert both identifiers in thesame secret key Such protocol must disclose just a minimalinformation amount about the physical context descriptionand the respective identifiers Consequently Marley cannotfigure out the physical context or deduce the secret key OnceAlice and Bob have a shared secret key they can establish asecure channel reducing the attacker capabilities to the firstattack scenario

We formalized the idea expressed above in the followingprotocol If Alice and Bob are represented by 119860 and 119861respectively and 119875 is a proper reconciliation function wehave the following

(1) 119860 observes physical event 119864 and extracts ID119860(2) 119861 observes physical event 119864 and extracts ID119861 asymp ID119860(3) 119860 computes 119896 = 119875(ID119860)(4) 119861 computes 119896 = 119875(ID119861) = 119875(ID119860)(5) 119860 and 119861 can communicate using cryptographic pro-

tocols over the secret key 119896Two aspects must be properly addressed to confirm the

protocol security The first one is the 119875 function 119875 hasto be chosen in such manner that the differences betweenidentifiers ID119860 and ID119861 are suppressed Otherwise the 119896value will not be the same for 119860 and 119861 The second aspectis related to the interpretation of 119864 Since 119896 is proposedfor cryptographic use one expects that 119896 presents randomproperties So the physical context (and consequently eachphysical event) must be associated with nondeterministicprocesses

To point out a solution and make the security analysisclearer we propose a Unique Bitstream Generator model thatcan be implemented using physical context information Theidea will be formally exposed and discussed in the nextsection

4 Generation of Unique Bitstream fromPhysical Events

41 Probabilistic Theoretic Model We formalize the UniqueBitstream Generator based on a discrete probabilistic modelWe assume the existence of a random bit generator 119866 whosegenerated bitstream is accessible to any party that is locatedin a given environment The goal is to use these bitstreamsto generate cryptographic keys that will allow the securecommunication between the parties in this environmentHowever the communication between 119866 and the parties

6 Security and Communication Networks

Unique Bitstream Generator

Secret key

BobAlice

Physical event

ID-BID-A

Figure 2 The Unique Bitstream Generator 119866 description

inserts errors in the bits generated by119866Therefore the partiesreceive related but distinct bitstreams that will need to besomehow processed before generating cryptographic keysThe diagram in Figure 2 depicts the model

We denote by time unit the minimum amount of timeobserved by the parties Each time unit corresponds to aunique bit generated by 119866 Note that this bit is sent via acommunication channel that introduces errors So the partieswill not necessarily receive the bit generated by 119866 A time slotis a set of subsequent time units and the size of the time slotis the size of the set

42 Clock Errors and Transmission Delays One importantaspect for the Unique Bitstream problem is whether theparties can refer precisely to each time unit or whether clockerror and delays on the transmission of physical events canimpact the synchronization between the parties ldquoAbsolutesynchronizationrdquo allows the development of more powerfulprotocols but in general it is not a reasonable assumptionfor most real world applications In practice we assume thatsynchronization errors lead to bit transmission errors A bitassociated with a time unit can be interpreted differently by119860 and 119861 since the precise instants where the time unit beginsand finishes are not the same for 119860 and 11986143 Counting Events The Binomial Distribution Model Weconsider that the following strategy generates a unique key 119896from the bitstream generated by119866We partition the bitstreaminto time slots and count the number of bits 1 (ie wecompute the sum of the bits in the time units in each timeslot)Then we define a bit associated with each slot accordingto this sum Assuming the equiprobability of bits 0 and 1 andconsidering that the number of bits 1 in each slot follows abinomial distribution a typical choice is to associate bit 0witha slot whose sum is less than half the number of time units ofthis slot Formally we represent a time slot119879with 119896 time units

Unique Bitstream Generator

Err-A Err-B

0110010110

01000

010001011001100 11110

010110 1

01

0110011110

ff

Figure 3 The Unique Bitstream Generator counting events exam-ple

as a 119896-tuple (1198871 119887119896) of binary digits The sum 119878119879 is givenby

119878119879 =119896

sum119894=1

119887119894 (1)

The bit 119873119879 associated with slot 119879 is 1 if 119878119879 lt 1198962 and is 0otherwise Figure 3 depicts an example

Consider a time slot 119879 = (1198871 119887119896) transmitted to119860 and119861 and received by 119860 as 119879119860 = (1198871198601 119887119860119896 ) and by 119861 as 119879119861 =(1198871198611 119887119861119896 ) Recall that each bit 119887119894 can be flipped with a givenprobability 119901119864 so that the probability that 119887119860119894 = 119887119861119894 for eachbit received by 119860 and 119861 is given by

119901 = 2119901119864 (1 minus 119901119864) (2)

Considering the possibility of error it is possible that thetotal number of bits counted by 119860 and 119861 is not the same Sothe associated bits are distinct

An important aspect of our proposedmodel is that it takesadvantage of classic probabilistic models and paradigms Aswe saw the model is strongly based on the so-called binomialdistribution Furthermore the behavior observed in the sim-ulation and the case study is properly explained by analyzingthe scenarios defined over the binomial distribution function

44 Naive Counting Protocol (NC) We start by consideringthemore simple protocol where the bit associated with a timeslot is determined by the majority of the bits in this time slotFormally the protocol associates bit 0 with a time slot 119879 =(1198871 119887119896) if 119878119879 lt 1198962 and bit 1 otherwise

In the above model the probability of an error is theprobability that one party say 119860 receives a time slot whosemajority is distinct to the majority in the time slot receivedby the other party 119861mdashthis could happen due to transmissionerrors

In the following subsection we generalize the NaiveCounting Protocol and derive bounds for the probability oferrors

Security and Communication Networks 7

45 The Band of Guard Protocol (BG) As we show in theprevious section the Naive Counting Protocol presents anonnegligible probability that 119860 and 119861 associate distinctbits with a time slot In the present section we define analternative protocol The idea is to define a ldquobandrdquo thatdetermines whether time slot presents a high probability oferror Intuitively a time slot has a high probability of errorif the number of 1s is close to half the number of time unitsof the slots In practice 119860 and 119861 agree about a number 119887 ifthe number of bits 1 in a slot is between 1198962 minus 119887 and 1198962 + 119887where 119896 is the number of time units in a time slot If a slot119879119860 observed by 119860 (resp slot 119879119861 observed by 119861) has a sumof bits that falls inside the band that is between 1198962 minus 119887 and1198962 + 119887 then 119879119860 (resp 119879119861) does not generate a bit In otherwords the bit associated with a slot can be bit 0 if the numberof bits 1 is below 1198962 minus 119887 bit 1 if the number of bits 1 is above1198962 + 119887 and ldquoundefinedrdquo if the sum of bits is between 1198962 minus 119887and 1198962 + 119887

Note that the ldquoband of guardrdquo protocol is a generalizationof the ldquonaive countingrdquo protocol where the ldquonaive countingrdquoprotocol has a band of guard 119896 = 0

The advantage of the above strategy is that the probabilitythat a slot119879 gives origin to distinct bits for119860 and119861 is lower asa larger number of bit flips would need to occur On the otherside the bit production rate is lower due to the ldquoundefinedrdquobits Besides the parties should interact to informwhich slotsgenerated undefined bits (hence need to be discarded) Notethat the fact that the parties indicate discarded slots doesnot allow an attacker to obtain any information about thegenerated bits

One disadvantage of the ldquoband of guard protocolrdquo is therapid decrease of throughput as a function of the size of theguard Indeed the binomial distribution leads to a strongconcentration around themeanUsingChernoff bounds [39]it can be proved that

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

12radic6119899 log119890 (119899)) le 2

119899 (3)

where 119883 is the number of bits 1 in a time slot with 119899 bitsIn practice that means that the concentration on the

number of bits 1 around the mean 1198992 is very tight mostof the time the deviation from this mean is on the order of119874(119899 log(119899))

Anotherway of using theChernoff bound technique gives

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

1198994) le 2119890minus11989924 (4)

which indicates exponential decrease on the size of the slotfor the probability of the total number of bits 1 to be below1198994 or above 31198994 As a consequence a small increase in thesize of the band of guard leads to a relevant decrease in thepercentage of valid time slots

46 The Best Slots Protocol (BS) We describe a strategy toreduce the number of errors in the generation of bitstreamsfrom physical events Basically instead of using time slotswith predefined timeframes that is set of time units we allowthe beginning and the end of each slot to be dynamically

Discarded bits Best slot

Next slot

0110010110100110101

0110010110100110101

Figure 4 How the choosing best slots protocol works

defined so that the number of bits 1 or bits 0 is guaranteedto be above the desired threshold therefore leading to anadequate error rate

The idea is simple Consider a time slot 119879 = (1198871 119887119896)transmitted to119860 and119861 and received by119860 as119879119860 = (1198871198601 119887119860119896 )and by 119861 as 119879119861 = (1198871198611 119887119861119896 ) Assume that 119860 and 119861 agreedabout a value 119896 for a threshold for the band of guard If thenumber of bits 1 observed by 119860 in 119879119860 (resp observed by 119861 in119879119861) is between 1198962 minus 119887 and 1198962 + 119887 where 119896 is the number oftime units in a time slot then 119860 (resp 119861) sinalizes that (s)hedoes not wish to use slot119879 as the generator of a bitThen each119860 and each119861 considers the ldquonext slotrdquo119879 = (1198872 119887119896+1) thatis we slide right the time slot

It is important to mention that the checksum update canbe efficiently computed by considering only the values of bits1198871 119887119896 1198872 and 119887119896+1mdashthere is no need to perform an additionalcounting of bits 1 in the new time slot 119879 = (1198872 119887119896 + 1)

The protocol works as follows (see Figure 4)We start likein BG protocol selecting time slots 119879 = (1198871 119887119896) Beforeaccepting a new time slot 119879 one of the parties (the verifier)checks the sum of the bits 119878119879 If 119878119879 is inside the band of guardthe first bit 1198871 isin 119879 is discarded and the bits are shifted doing119887119894 = 119887119894+1 The next bit will be again 119887119896 and the procedurerepeats until 119878119879 generates 0 or 1 When it happens the newtime slot119879 is accepted and the verifier informs the other parthow many bits must be discarded to get 119879

5 Simulation Results

The protocols proposed in the previous section were verifiedusing simulation We suppose that two entities 119860 and 119861 tryto establish a secure communication channel using physicalevents The experiment is set up as follows We use a randombinary stream generated by website wwwrandomorg whichwas checked using the NIST Statistical Test Suite for Randomand Pseudorandom Number Generators [40] The binarystream works as an oracle of ldquovirtualrdquo physical events justlike in the Unique BitstreamModel previously described Wesimulate 119860 and 119861 as entities that observe physical events andtry to determine a secret key 119896 implementing each one of thedescribed protocols

The simulation results show each protocol accuracy andthroughput By accuracy we mean the rate of simulated caseswhere Alice and Bob are successful in establishing the samesecret key 119896 In turn the throughput is the rate of physicalevents (in our simulation bits) which are effectively used onvalid slots Aiming to make the simulation more realisticwe define an error rate err which determines the probabilitywhich an entity can miss a described event That means aphysical event 119864 = 0 can be observed as 1198641015840 = 1 with aprobability of err and vice versa

8 Security and Communication Networks

Table 1 Theoretical NC and BG protocols simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 (NC) 55 05 00 1001 125 18 00 7532 827 570 54 3433 100 899 472 1084 100 100 632 219

Table 2 Theoretical BS protocol simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 217 57 03 9761 948 813 353 9382 9987 991 918 9193 100 9949 949 2414 100 100 100 134

For practical reasons we fixed some parameters fordetermining the Unique Bitstream We consider each bit as1 time unit The time slot is fixed as 10 time units and we tryto obtain 64-bit unique bitstreams which means that eachprotocol will consume the binary stream until it finds 64ldquogoodrdquo slots

Table 1 summarizes the results obtained for Naive Count-ing (NC) and Counting with Band of Guard (BG) protocolsThe Band column indicates the band of guard size (in bits)adopted on each simulation One can note that accuracy andthroughput reach better rates when the band of guard valueis increased The gain in accuracy depends on the simulatederror rate err something already expected once the UniqueBitstream generation protocols shall work better with lowerror rates

Table 2 describes the simulation results for best slots(BS) protocol One shall observe that BS protocol presents abetter performance when compared to NC and BG protocolsBesides the higher accuracy its results show a significantgain in throughput In practice such performance implies afaster authentication process once BS protocol requires lessphysical events to determine 1198966 Case Study Using Radio Signal

61 Radio Signals as Physical Events In this section wepresent a practical case study related to the activities ofthe National Institute of Metrology Quality and Technology(Inmetro) in Brazil The Inmetro delegates notified bodiesto inspect measurement instruments under legal regulationSuch activity called metrological surveillance is done ininstruments already in use on the field (eg scales fuelpumps) Albeit these measuring instruments are connectedto the Internet surveillance agents (ie notified bodiesrsquotechnicians) need to go to the instrumentrsquos site for proceedingwith a complete visual inspection So the Inmetro wants to

check the suitability of using physical context to authenticatesurveillance agents before granting access to the instrument

Measuring instruments employed for regulating con-sumer relations are typically used in places such as supermar-kets stores shops and gas stations Nowadays these placesare surrounded by different radio-based communicationinfrastructures (eg WLANs) The radio signal propagationgenerates physical context information creating an ldquoelec-tromagnetic fingerprintrdquo That can be used as evidence ofcolocation and simultaneity of measuring instruments andsurveillance agents In this case study we use the signalgenerated by public IEEE 80211 wireless (Wi-Fi) networksThe IEEE 80211 is a well-disseminated network standard andcan be easily found in practically any public place

We see Wi-Fi network packets as physical events Theycan be detected and measured by any device using a properradio in monitoring mode In our study the Wi-Fi networkis treated as a physical event generator and not as a com-munication channel Thus the authenticating devices are notconnected to the Wi-Fi network Instead they just use theirradios as sensors receivingWi-Fi packets as physical contextinformation

The study case contemplates a measuring instrument 119860and a surveillance agent 119861 Both entities are equipped withWi-Fi radios and share the same physical context describedby the electromagnetic fingerprint of a local Wi-Fi network(Figure 5) At the same time 119872 is a malicious surveillanceagent who wants to counterfeit a visual inspection of 119860 Thethree entities are connected to the Internet but 119860 and 119861 donot use theirWi-Fi radio for that We also assume that119872 hasall the capabilities and restrictions described in Section 32

Wi-Fi radios can be configured in monitoring mode andwork as sensorsThey can ldquosenserdquo allWi-Fi traffic and identifydifferent packets with their respective source and destinationaddresses Such information constitutes our physical contextWe use it for composing a physical event identifier that

Security and Communication Networks 9

WLAN physical context

InternetA

BM

Figure 5 Using Wi-Fi signals as physical event

results from the interaction among several connected devicessendingWi-Fi packets in a given moment Once the networkcoverage field is limited only entities placed in this same areaat the same time can obtain the event identifier

62 The Physical Event Identifier We associate the ideaof physical context with the Wi-Fi network traffic Eachpacket sent by any node in the network is considered aphysical event Since 119860 and 119861 have Wi-Fi radios they canbe configured for monitoring any specific Wi-Fi networkchannel Thus they use the Wi-Fi tracing information todetermine a physical event identifier

Firstly 119860 and 119861 process tracing information by extract-ing only packets source addresses and timestamps Sourceaddresses link a physical event with the location where itoccurs Wi-Fi networks are sharply distinguished by theirnodes mobility So one can expect that a public Wi-Finetwork will present different nodes (and consequentlydifferent addresses) when we compare traces extracted atdifferent moments We use119860 and 119861 local clocks to obtain thepackets timestamps which implies that the devices are notsynchronized Timestamps are necessary to know when eachnode is sending information to the network Doing that wecan determine time slots by assigning zero when a node doesnot send any information and one when otherwiseThe resultis a physical context description that can be analyzed usingthe Unique Bitstream Generator model already describedFurthermore such time slots present a nondeterministicpattern once it is hard to predict when a network nodewill send a packet A problem emerges due to the hiddennode problem 119860 can detect packages from a node which ishidden from 119861 or vice versa This condition can affect 119860 and119861 physical event identifiers compromising authenticationWe avoid such problem proposing an additional messageinterchange which enables 119860 and 119861 to determine a commonset of communicating node addresses for extracting theirrespective physical event identifiers ID119860 and ID119861

The authentication protocol is initiated by 119861 asking 119860for authentication After that 119860 challenges 119861 to presentthe physical context proof Both the entities start to collectnetwork traces during a predefined time interval After

collecting all the traces 119860 and 119861 will have two similar setsof partial identifiers given by the following equation

ID119894 = ⟨1199041 1199051⟩ ⟨119904119896 119905119896⟩ ⟨119904119870 119905119870⟩ (5)

where 119870 is the number of different nodes identified in theWi-Fi trace 119904119896 is the 119896th network node MAC (Media AccessControl) address and 119905119896 is a119871-bit binary string correspondingto the frequency distribution of the 119896th network node signal

For security reasons 119904119896 could be obfuscated by any hashfunction preventing the disclosure of private informationabout the Wi-Fi network node Regardless our experimentconsiders the use of a public Wi-Fi network implying thatMAC addresses are public as well

In turn 119905119896 is given by the following algorithm

(1) Define 119871 slots of time and compute a frequency dis-tribution 119865 = 1198911 1198912 119891119871 counting each packetwhere the source address corresponds to 119904119896 usingtimestamp information

(2) Extract a binary 119871-bits representation where for eachclass 119897 = 1 2 119871 in 119865 the 119897th bit 119887119897 is given by theBoolean operation 119887119897 = (119891119897 gt 0)

(3) Do 119905119896 = ⟨1198871 1198872 119887119871⟩Figure 6 illustrates the proposed algorithm with 119871 =

16 Packets from the same source address are sampled in afrequency distribution histogram One can observe that insubgraphs119860 and119861 Finally the binary representation showedin graph 119862 is computed as a partial identifier 119905119896

Once 119860 and 119861 have their respective partial identifiersID119860 and ID119861 they need to solve the hidden node prob-lem determining the intersection among their known nodeaddresses 119904119896 Supposing that Addr119860 andAddr119861 are the subsetscontaining 1199041 119904119870 of ID119860 and ID119861 respectively wepropose the following sequence of messages

119861 997888rarr 119860 Addr119861119860 119868 = Addr119860 cap Addr119861

119860 119904119877 isin 119868 | 119877 = rand ()119860 997888rarr 119861 119904119877

119860 119861 119896 = 119905119877

(6)

Although the proposed messages reveal the nodeaddresses chosen to determine the physical event identifierthey do not disclose any information about the selectedfrequency distribution of 119905119877 That keeps the authenticationprotocol secure against an attacker 119872 with capabilitiesdescribed at Section 32

63 Experiment Description Our experiment is imple-mented using two computers with different Wi-Fi adapterssimulating119860 and 119861 devices respectively Both computers runUbuntu 1404 Linux operating systemTheir Wi-Fi interfaceswork as sensors using monitoring mode to gather all Wi-Fipackages traffic

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

6 Security and Communication Networks

Unique Bitstream Generator

Secret key

BobAlice

Physical event

ID-BID-A

Figure 2 The Unique Bitstream Generator 119866 description

inserts errors in the bits generated by119866Therefore the partiesreceive related but distinct bitstreams that will need to besomehow processed before generating cryptographic keysThe diagram in Figure 2 depicts the model

We denote by time unit the minimum amount of timeobserved by the parties Each time unit corresponds to aunique bit generated by 119866 Note that this bit is sent via acommunication channel that introduces errors So the partieswill not necessarily receive the bit generated by 119866 A time slotis a set of subsequent time units and the size of the time slotis the size of the set

42 Clock Errors and Transmission Delays One importantaspect for the Unique Bitstream problem is whether theparties can refer precisely to each time unit or whether clockerror and delays on the transmission of physical events canimpact the synchronization between the parties ldquoAbsolutesynchronizationrdquo allows the development of more powerfulprotocols but in general it is not a reasonable assumptionfor most real world applications In practice we assume thatsynchronization errors lead to bit transmission errors A bitassociated with a time unit can be interpreted differently by119860 and 119861 since the precise instants where the time unit beginsand finishes are not the same for 119860 and 11986143 Counting Events The Binomial Distribution Model Weconsider that the following strategy generates a unique key 119896from the bitstream generated by119866We partition the bitstreaminto time slots and count the number of bits 1 (ie wecompute the sum of the bits in the time units in each timeslot)Then we define a bit associated with each slot accordingto this sum Assuming the equiprobability of bits 0 and 1 andconsidering that the number of bits 1 in each slot follows abinomial distribution a typical choice is to associate bit 0witha slot whose sum is less than half the number of time units ofthis slot Formally we represent a time slot119879with 119896 time units

Unique Bitstream Generator

Err-A Err-B

0110010110

01000

010001011001100 11110

010110 1

01

0110011110

ff

Figure 3 The Unique Bitstream Generator counting events exam-ple

as a 119896-tuple (1198871 119887119896) of binary digits The sum 119878119879 is givenby

119878119879 =119896

sum119894=1

119887119894 (1)

The bit 119873119879 associated with slot 119879 is 1 if 119878119879 lt 1198962 and is 0otherwise Figure 3 depicts an example

Consider a time slot 119879 = (1198871 119887119896) transmitted to119860 and119861 and received by 119860 as 119879119860 = (1198871198601 119887119860119896 ) and by 119861 as 119879119861 =(1198871198611 119887119861119896 ) Recall that each bit 119887119894 can be flipped with a givenprobability 119901119864 so that the probability that 119887119860119894 = 119887119861119894 for eachbit received by 119860 and 119861 is given by

119901 = 2119901119864 (1 minus 119901119864) (2)

Considering the possibility of error it is possible that thetotal number of bits counted by 119860 and 119861 is not the same Sothe associated bits are distinct

An important aspect of our proposedmodel is that it takesadvantage of classic probabilistic models and paradigms Aswe saw the model is strongly based on the so-called binomialdistribution Furthermore the behavior observed in the sim-ulation and the case study is properly explained by analyzingthe scenarios defined over the binomial distribution function

44 Naive Counting Protocol (NC) We start by consideringthemore simple protocol where the bit associated with a timeslot is determined by the majority of the bits in this time slotFormally the protocol associates bit 0 with a time slot 119879 =(1198871 119887119896) if 119878119879 lt 1198962 and bit 1 otherwise

In the above model the probability of an error is theprobability that one party say 119860 receives a time slot whosemajority is distinct to the majority in the time slot receivedby the other party 119861mdashthis could happen due to transmissionerrors

In the following subsection we generalize the NaiveCounting Protocol and derive bounds for the probability oferrors

Security and Communication Networks 7

45 The Band of Guard Protocol (BG) As we show in theprevious section the Naive Counting Protocol presents anonnegligible probability that 119860 and 119861 associate distinctbits with a time slot In the present section we define analternative protocol The idea is to define a ldquobandrdquo thatdetermines whether time slot presents a high probability oferror Intuitively a time slot has a high probability of errorif the number of 1s is close to half the number of time unitsof the slots In practice 119860 and 119861 agree about a number 119887 ifthe number of bits 1 in a slot is between 1198962 minus 119887 and 1198962 + 119887where 119896 is the number of time units in a time slot If a slot119879119860 observed by 119860 (resp slot 119879119861 observed by 119861) has a sumof bits that falls inside the band that is between 1198962 minus 119887 and1198962 + 119887 then 119879119860 (resp 119879119861) does not generate a bit In otherwords the bit associated with a slot can be bit 0 if the numberof bits 1 is below 1198962 minus 119887 bit 1 if the number of bits 1 is above1198962 + 119887 and ldquoundefinedrdquo if the sum of bits is between 1198962 minus 119887and 1198962 + 119887

Note that the ldquoband of guardrdquo protocol is a generalizationof the ldquonaive countingrdquo protocol where the ldquonaive countingrdquoprotocol has a band of guard 119896 = 0

The advantage of the above strategy is that the probabilitythat a slot119879 gives origin to distinct bits for119860 and119861 is lower asa larger number of bit flips would need to occur On the otherside the bit production rate is lower due to the ldquoundefinedrdquobits Besides the parties should interact to informwhich slotsgenerated undefined bits (hence need to be discarded) Notethat the fact that the parties indicate discarded slots doesnot allow an attacker to obtain any information about thegenerated bits

One disadvantage of the ldquoband of guard protocolrdquo is therapid decrease of throughput as a function of the size of theguard Indeed the binomial distribution leads to a strongconcentration around themeanUsingChernoff bounds [39]it can be proved that

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

12radic6119899 log119890 (119899)) le 2

119899 (3)

where 119883 is the number of bits 1 in a time slot with 119899 bitsIn practice that means that the concentration on the

number of bits 1 around the mean 1198992 is very tight mostof the time the deviation from this mean is on the order of119874(119899 log(119899))

Anotherway of using theChernoff bound technique gives

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

1198994) le 2119890minus11989924 (4)

which indicates exponential decrease on the size of the slotfor the probability of the total number of bits 1 to be below1198994 or above 31198994 As a consequence a small increase in thesize of the band of guard leads to a relevant decrease in thepercentage of valid time slots

46 The Best Slots Protocol (BS) We describe a strategy toreduce the number of errors in the generation of bitstreamsfrom physical events Basically instead of using time slotswith predefined timeframes that is set of time units we allowthe beginning and the end of each slot to be dynamically

Discarded bits Best slot

Next slot

0110010110100110101

0110010110100110101

Figure 4 How the choosing best slots protocol works

defined so that the number of bits 1 or bits 0 is guaranteedto be above the desired threshold therefore leading to anadequate error rate

The idea is simple Consider a time slot 119879 = (1198871 119887119896)transmitted to119860 and119861 and received by119860 as119879119860 = (1198871198601 119887119860119896 )and by 119861 as 119879119861 = (1198871198611 119887119861119896 ) Assume that 119860 and 119861 agreedabout a value 119896 for a threshold for the band of guard If thenumber of bits 1 observed by 119860 in 119879119860 (resp observed by 119861 in119879119861) is between 1198962 minus 119887 and 1198962 + 119887 where 119896 is the number oftime units in a time slot then 119860 (resp 119861) sinalizes that (s)hedoes not wish to use slot119879 as the generator of a bitThen each119860 and each119861 considers the ldquonext slotrdquo119879 = (1198872 119887119896+1) thatis we slide right the time slot

It is important to mention that the checksum update canbe efficiently computed by considering only the values of bits1198871 119887119896 1198872 and 119887119896+1mdashthere is no need to perform an additionalcounting of bits 1 in the new time slot 119879 = (1198872 119887119896 + 1)

The protocol works as follows (see Figure 4)We start likein BG protocol selecting time slots 119879 = (1198871 119887119896) Beforeaccepting a new time slot 119879 one of the parties (the verifier)checks the sum of the bits 119878119879 If 119878119879 is inside the band of guardthe first bit 1198871 isin 119879 is discarded and the bits are shifted doing119887119894 = 119887119894+1 The next bit will be again 119887119896 and the procedurerepeats until 119878119879 generates 0 or 1 When it happens the newtime slot119879 is accepted and the verifier informs the other parthow many bits must be discarded to get 119879

5 Simulation Results

The protocols proposed in the previous section were verifiedusing simulation We suppose that two entities 119860 and 119861 tryto establish a secure communication channel using physicalevents The experiment is set up as follows We use a randombinary stream generated by website wwwrandomorg whichwas checked using the NIST Statistical Test Suite for Randomand Pseudorandom Number Generators [40] The binarystream works as an oracle of ldquovirtualrdquo physical events justlike in the Unique BitstreamModel previously described Wesimulate 119860 and 119861 as entities that observe physical events andtry to determine a secret key 119896 implementing each one of thedescribed protocols

The simulation results show each protocol accuracy andthroughput By accuracy we mean the rate of simulated caseswhere Alice and Bob are successful in establishing the samesecret key 119896 In turn the throughput is the rate of physicalevents (in our simulation bits) which are effectively used onvalid slots Aiming to make the simulation more realisticwe define an error rate err which determines the probabilitywhich an entity can miss a described event That means aphysical event 119864 = 0 can be observed as 1198641015840 = 1 with aprobability of err and vice versa

8 Security and Communication Networks

Table 1 Theoretical NC and BG protocols simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 (NC) 55 05 00 1001 125 18 00 7532 827 570 54 3433 100 899 472 1084 100 100 632 219

Table 2 Theoretical BS protocol simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 217 57 03 9761 948 813 353 9382 9987 991 918 9193 100 9949 949 2414 100 100 100 134

For practical reasons we fixed some parameters fordetermining the Unique Bitstream We consider each bit as1 time unit The time slot is fixed as 10 time units and we tryto obtain 64-bit unique bitstreams which means that eachprotocol will consume the binary stream until it finds 64ldquogoodrdquo slots

Table 1 summarizes the results obtained for Naive Count-ing (NC) and Counting with Band of Guard (BG) protocolsThe Band column indicates the band of guard size (in bits)adopted on each simulation One can note that accuracy andthroughput reach better rates when the band of guard valueis increased The gain in accuracy depends on the simulatederror rate err something already expected once the UniqueBitstream generation protocols shall work better with lowerror rates

Table 2 describes the simulation results for best slots(BS) protocol One shall observe that BS protocol presents abetter performance when compared to NC and BG protocolsBesides the higher accuracy its results show a significantgain in throughput In practice such performance implies afaster authentication process once BS protocol requires lessphysical events to determine 1198966 Case Study Using Radio Signal

61 Radio Signals as Physical Events In this section wepresent a practical case study related to the activities ofthe National Institute of Metrology Quality and Technology(Inmetro) in Brazil The Inmetro delegates notified bodiesto inspect measurement instruments under legal regulationSuch activity called metrological surveillance is done ininstruments already in use on the field (eg scales fuelpumps) Albeit these measuring instruments are connectedto the Internet surveillance agents (ie notified bodiesrsquotechnicians) need to go to the instrumentrsquos site for proceedingwith a complete visual inspection So the Inmetro wants to

check the suitability of using physical context to authenticatesurveillance agents before granting access to the instrument

Measuring instruments employed for regulating con-sumer relations are typically used in places such as supermar-kets stores shops and gas stations Nowadays these placesare surrounded by different radio-based communicationinfrastructures (eg WLANs) The radio signal propagationgenerates physical context information creating an ldquoelec-tromagnetic fingerprintrdquo That can be used as evidence ofcolocation and simultaneity of measuring instruments andsurveillance agents In this case study we use the signalgenerated by public IEEE 80211 wireless (Wi-Fi) networksThe IEEE 80211 is a well-disseminated network standard andcan be easily found in practically any public place

We see Wi-Fi network packets as physical events Theycan be detected and measured by any device using a properradio in monitoring mode In our study the Wi-Fi networkis treated as a physical event generator and not as a com-munication channel Thus the authenticating devices are notconnected to the Wi-Fi network Instead they just use theirradios as sensors receivingWi-Fi packets as physical contextinformation

The study case contemplates a measuring instrument 119860and a surveillance agent 119861 Both entities are equipped withWi-Fi radios and share the same physical context describedby the electromagnetic fingerprint of a local Wi-Fi network(Figure 5) At the same time 119872 is a malicious surveillanceagent who wants to counterfeit a visual inspection of 119860 Thethree entities are connected to the Internet but 119860 and 119861 donot use theirWi-Fi radio for that We also assume that119872 hasall the capabilities and restrictions described in Section 32

Wi-Fi radios can be configured in monitoring mode andwork as sensorsThey can ldquosenserdquo allWi-Fi traffic and identifydifferent packets with their respective source and destinationaddresses Such information constitutes our physical contextWe use it for composing a physical event identifier that

Security and Communication Networks 9

WLAN physical context

InternetA

BM

Figure 5 Using Wi-Fi signals as physical event

results from the interaction among several connected devicessendingWi-Fi packets in a given moment Once the networkcoverage field is limited only entities placed in this same areaat the same time can obtain the event identifier

62 The Physical Event Identifier We associate the ideaof physical context with the Wi-Fi network traffic Eachpacket sent by any node in the network is considered aphysical event Since 119860 and 119861 have Wi-Fi radios they canbe configured for monitoring any specific Wi-Fi networkchannel Thus they use the Wi-Fi tracing information todetermine a physical event identifier

Firstly 119860 and 119861 process tracing information by extract-ing only packets source addresses and timestamps Sourceaddresses link a physical event with the location where itoccurs Wi-Fi networks are sharply distinguished by theirnodes mobility So one can expect that a public Wi-Finetwork will present different nodes (and consequentlydifferent addresses) when we compare traces extracted atdifferent moments We use119860 and 119861 local clocks to obtain thepackets timestamps which implies that the devices are notsynchronized Timestamps are necessary to know when eachnode is sending information to the network Doing that wecan determine time slots by assigning zero when a node doesnot send any information and one when otherwiseThe resultis a physical context description that can be analyzed usingthe Unique Bitstream Generator model already describedFurthermore such time slots present a nondeterministicpattern once it is hard to predict when a network nodewill send a packet A problem emerges due to the hiddennode problem 119860 can detect packages from a node which ishidden from 119861 or vice versa This condition can affect 119860 and119861 physical event identifiers compromising authenticationWe avoid such problem proposing an additional messageinterchange which enables 119860 and 119861 to determine a commonset of communicating node addresses for extracting theirrespective physical event identifiers ID119860 and ID119861

The authentication protocol is initiated by 119861 asking 119860for authentication After that 119860 challenges 119861 to presentthe physical context proof Both the entities start to collectnetwork traces during a predefined time interval After

collecting all the traces 119860 and 119861 will have two similar setsof partial identifiers given by the following equation

ID119894 = ⟨1199041 1199051⟩ ⟨119904119896 119905119896⟩ ⟨119904119870 119905119870⟩ (5)

where 119870 is the number of different nodes identified in theWi-Fi trace 119904119896 is the 119896th network node MAC (Media AccessControl) address and 119905119896 is a119871-bit binary string correspondingto the frequency distribution of the 119896th network node signal

For security reasons 119904119896 could be obfuscated by any hashfunction preventing the disclosure of private informationabout the Wi-Fi network node Regardless our experimentconsiders the use of a public Wi-Fi network implying thatMAC addresses are public as well

In turn 119905119896 is given by the following algorithm

(1) Define 119871 slots of time and compute a frequency dis-tribution 119865 = 1198911 1198912 119891119871 counting each packetwhere the source address corresponds to 119904119896 usingtimestamp information

(2) Extract a binary 119871-bits representation where for eachclass 119897 = 1 2 119871 in 119865 the 119897th bit 119887119897 is given by theBoolean operation 119887119897 = (119891119897 gt 0)

(3) Do 119905119896 = ⟨1198871 1198872 119887119871⟩Figure 6 illustrates the proposed algorithm with 119871 =

16 Packets from the same source address are sampled in afrequency distribution histogram One can observe that insubgraphs119860 and119861 Finally the binary representation showedin graph 119862 is computed as a partial identifier 119905119896

Once 119860 and 119861 have their respective partial identifiersID119860 and ID119861 they need to solve the hidden node prob-lem determining the intersection among their known nodeaddresses 119904119896 Supposing that Addr119860 andAddr119861 are the subsetscontaining 1199041 119904119870 of ID119860 and ID119861 respectively wepropose the following sequence of messages

119861 997888rarr 119860 Addr119861119860 119868 = Addr119860 cap Addr119861

119860 119904119877 isin 119868 | 119877 = rand ()119860 997888rarr 119861 119904119877

119860 119861 119896 = 119905119877

(6)

Although the proposed messages reveal the nodeaddresses chosen to determine the physical event identifierthey do not disclose any information about the selectedfrequency distribution of 119905119877 That keeps the authenticationprotocol secure against an attacker 119872 with capabilitiesdescribed at Section 32

63 Experiment Description Our experiment is imple-mented using two computers with different Wi-Fi adapterssimulating119860 and 119861 devices respectively Both computers runUbuntu 1404 Linux operating systemTheir Wi-Fi interfaceswork as sensors using monitoring mode to gather all Wi-Fipackages traffic

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

Security and Communication Networks 7

45 The Band of Guard Protocol (BG) As we show in theprevious section the Naive Counting Protocol presents anonnegligible probability that 119860 and 119861 associate distinctbits with a time slot In the present section we define analternative protocol The idea is to define a ldquobandrdquo thatdetermines whether time slot presents a high probability oferror Intuitively a time slot has a high probability of errorif the number of 1s is close to half the number of time unitsof the slots In practice 119860 and 119861 agree about a number 119887 ifthe number of bits 1 in a slot is between 1198962 minus 119887 and 1198962 + 119887where 119896 is the number of time units in a time slot If a slot119879119860 observed by 119860 (resp slot 119879119861 observed by 119861) has a sumof bits that falls inside the band that is between 1198962 minus 119887 and1198962 + 119887 then 119879119860 (resp 119879119861) does not generate a bit In otherwords the bit associated with a slot can be bit 0 if the numberof bits 1 is below 1198962 minus 119887 bit 1 if the number of bits 1 is above1198962 + 119887 and ldquoundefinedrdquo if the sum of bits is between 1198962 minus 119887and 1198962 + 119887

Note that the ldquoband of guardrdquo protocol is a generalizationof the ldquonaive countingrdquo protocol where the ldquonaive countingrdquoprotocol has a band of guard 119896 = 0

The advantage of the above strategy is that the probabilitythat a slot119879 gives origin to distinct bits for119860 and119861 is lower asa larger number of bit flips would need to occur On the otherside the bit production rate is lower due to the ldquoundefinedrdquobits Besides the parties should interact to informwhich slotsgenerated undefined bits (hence need to be discarded) Notethat the fact that the parties indicate discarded slots doesnot allow an attacker to obtain any information about thegenerated bits

One disadvantage of the ldquoband of guard protocolrdquo is therapid decrease of throughput as a function of the size of theguard Indeed the binomial distribution leads to a strongconcentration around themeanUsingChernoff bounds [39]it can be proved that

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

12radic6119899 log119890 (119899)) le 2

119899 (3)

where 119883 is the number of bits 1 in a time slot with 119899 bitsIn practice that means that the concentration on the

number of bits 1 around the mean 1198992 is very tight mostof the time the deviation from this mean is on the order of119874(119899 log(119899))

Anotherway of using theChernoff bound technique gives

Pr(1003816100381610038161003816100381610038161003816119883 minus 11989921003816100381610038161003816100381610038161003816 ge

1198994) le 2119890minus11989924 (4)

which indicates exponential decrease on the size of the slotfor the probability of the total number of bits 1 to be below1198994 or above 31198994 As a consequence a small increase in thesize of the band of guard leads to a relevant decrease in thepercentage of valid time slots

46 The Best Slots Protocol (BS) We describe a strategy toreduce the number of errors in the generation of bitstreamsfrom physical events Basically instead of using time slotswith predefined timeframes that is set of time units we allowthe beginning and the end of each slot to be dynamically

Discarded bits Best slot

Next slot

0110010110100110101

0110010110100110101

Figure 4 How the choosing best slots protocol works

defined so that the number of bits 1 or bits 0 is guaranteedto be above the desired threshold therefore leading to anadequate error rate

The idea is simple Consider a time slot 119879 = (1198871 119887119896)transmitted to119860 and119861 and received by119860 as119879119860 = (1198871198601 119887119860119896 )and by 119861 as 119879119861 = (1198871198611 119887119861119896 ) Assume that 119860 and 119861 agreedabout a value 119896 for a threshold for the band of guard If thenumber of bits 1 observed by 119860 in 119879119860 (resp observed by 119861 in119879119861) is between 1198962 minus 119887 and 1198962 + 119887 where 119896 is the number oftime units in a time slot then 119860 (resp 119861) sinalizes that (s)hedoes not wish to use slot119879 as the generator of a bitThen each119860 and each119861 considers the ldquonext slotrdquo119879 = (1198872 119887119896+1) thatis we slide right the time slot

It is important to mention that the checksum update canbe efficiently computed by considering only the values of bits1198871 119887119896 1198872 and 119887119896+1mdashthere is no need to perform an additionalcounting of bits 1 in the new time slot 119879 = (1198872 119887119896 + 1)

The protocol works as follows (see Figure 4)We start likein BG protocol selecting time slots 119879 = (1198871 119887119896) Beforeaccepting a new time slot 119879 one of the parties (the verifier)checks the sum of the bits 119878119879 If 119878119879 is inside the band of guardthe first bit 1198871 isin 119879 is discarded and the bits are shifted doing119887119894 = 119887119894+1 The next bit will be again 119887119896 and the procedurerepeats until 119878119879 generates 0 or 1 When it happens the newtime slot119879 is accepted and the verifier informs the other parthow many bits must be discarded to get 119879

5 Simulation Results

The protocols proposed in the previous section were verifiedusing simulation We suppose that two entities 119860 and 119861 tryto establish a secure communication channel using physicalevents The experiment is set up as follows We use a randombinary stream generated by website wwwrandomorg whichwas checked using the NIST Statistical Test Suite for Randomand Pseudorandom Number Generators [40] The binarystream works as an oracle of ldquovirtualrdquo physical events justlike in the Unique BitstreamModel previously described Wesimulate 119860 and 119861 as entities that observe physical events andtry to determine a secret key 119896 implementing each one of thedescribed protocols

The simulation results show each protocol accuracy andthroughput By accuracy we mean the rate of simulated caseswhere Alice and Bob are successful in establishing the samesecret key 119896 In turn the throughput is the rate of physicalevents (in our simulation bits) which are effectively used onvalid slots Aiming to make the simulation more realisticwe define an error rate err which determines the probabilitywhich an entity can miss a described event That means aphysical event 119864 = 0 can be observed as 1198641015840 = 1 with aprobability of err and vice versa

8 Security and Communication Networks

Table 1 Theoretical NC and BG protocols simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 (NC) 55 05 00 1001 125 18 00 7532 827 570 54 3433 100 899 472 1084 100 100 632 219

Table 2 Theoretical BS protocol simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 217 57 03 9761 948 813 353 9382 9987 991 918 9193 100 9949 949 2414 100 100 100 134

For practical reasons we fixed some parameters fordetermining the Unique Bitstream We consider each bit as1 time unit The time slot is fixed as 10 time units and we tryto obtain 64-bit unique bitstreams which means that eachprotocol will consume the binary stream until it finds 64ldquogoodrdquo slots

Table 1 summarizes the results obtained for Naive Count-ing (NC) and Counting with Band of Guard (BG) protocolsThe Band column indicates the band of guard size (in bits)adopted on each simulation One can note that accuracy andthroughput reach better rates when the band of guard valueis increased The gain in accuracy depends on the simulatederror rate err something already expected once the UniqueBitstream generation protocols shall work better with lowerror rates

Table 2 describes the simulation results for best slots(BS) protocol One shall observe that BS protocol presents abetter performance when compared to NC and BG protocolsBesides the higher accuracy its results show a significantgain in throughput In practice such performance implies afaster authentication process once BS protocol requires lessphysical events to determine 1198966 Case Study Using Radio Signal

61 Radio Signals as Physical Events In this section wepresent a practical case study related to the activities ofthe National Institute of Metrology Quality and Technology(Inmetro) in Brazil The Inmetro delegates notified bodiesto inspect measurement instruments under legal regulationSuch activity called metrological surveillance is done ininstruments already in use on the field (eg scales fuelpumps) Albeit these measuring instruments are connectedto the Internet surveillance agents (ie notified bodiesrsquotechnicians) need to go to the instrumentrsquos site for proceedingwith a complete visual inspection So the Inmetro wants to

check the suitability of using physical context to authenticatesurveillance agents before granting access to the instrument

Measuring instruments employed for regulating con-sumer relations are typically used in places such as supermar-kets stores shops and gas stations Nowadays these placesare surrounded by different radio-based communicationinfrastructures (eg WLANs) The radio signal propagationgenerates physical context information creating an ldquoelec-tromagnetic fingerprintrdquo That can be used as evidence ofcolocation and simultaneity of measuring instruments andsurveillance agents In this case study we use the signalgenerated by public IEEE 80211 wireless (Wi-Fi) networksThe IEEE 80211 is a well-disseminated network standard andcan be easily found in practically any public place

We see Wi-Fi network packets as physical events Theycan be detected and measured by any device using a properradio in monitoring mode In our study the Wi-Fi networkis treated as a physical event generator and not as a com-munication channel Thus the authenticating devices are notconnected to the Wi-Fi network Instead they just use theirradios as sensors receivingWi-Fi packets as physical contextinformation

The study case contemplates a measuring instrument 119860and a surveillance agent 119861 Both entities are equipped withWi-Fi radios and share the same physical context describedby the electromagnetic fingerprint of a local Wi-Fi network(Figure 5) At the same time 119872 is a malicious surveillanceagent who wants to counterfeit a visual inspection of 119860 Thethree entities are connected to the Internet but 119860 and 119861 donot use theirWi-Fi radio for that We also assume that119872 hasall the capabilities and restrictions described in Section 32

Wi-Fi radios can be configured in monitoring mode andwork as sensorsThey can ldquosenserdquo allWi-Fi traffic and identifydifferent packets with their respective source and destinationaddresses Such information constitutes our physical contextWe use it for composing a physical event identifier that

Security and Communication Networks 9

WLAN physical context

InternetA

BM

Figure 5 Using Wi-Fi signals as physical event

results from the interaction among several connected devicessendingWi-Fi packets in a given moment Once the networkcoverage field is limited only entities placed in this same areaat the same time can obtain the event identifier

62 The Physical Event Identifier We associate the ideaof physical context with the Wi-Fi network traffic Eachpacket sent by any node in the network is considered aphysical event Since 119860 and 119861 have Wi-Fi radios they canbe configured for monitoring any specific Wi-Fi networkchannel Thus they use the Wi-Fi tracing information todetermine a physical event identifier

Firstly 119860 and 119861 process tracing information by extract-ing only packets source addresses and timestamps Sourceaddresses link a physical event with the location where itoccurs Wi-Fi networks are sharply distinguished by theirnodes mobility So one can expect that a public Wi-Finetwork will present different nodes (and consequentlydifferent addresses) when we compare traces extracted atdifferent moments We use119860 and 119861 local clocks to obtain thepackets timestamps which implies that the devices are notsynchronized Timestamps are necessary to know when eachnode is sending information to the network Doing that wecan determine time slots by assigning zero when a node doesnot send any information and one when otherwiseThe resultis a physical context description that can be analyzed usingthe Unique Bitstream Generator model already describedFurthermore such time slots present a nondeterministicpattern once it is hard to predict when a network nodewill send a packet A problem emerges due to the hiddennode problem 119860 can detect packages from a node which ishidden from 119861 or vice versa This condition can affect 119860 and119861 physical event identifiers compromising authenticationWe avoid such problem proposing an additional messageinterchange which enables 119860 and 119861 to determine a commonset of communicating node addresses for extracting theirrespective physical event identifiers ID119860 and ID119861

The authentication protocol is initiated by 119861 asking 119860for authentication After that 119860 challenges 119861 to presentthe physical context proof Both the entities start to collectnetwork traces during a predefined time interval After

collecting all the traces 119860 and 119861 will have two similar setsof partial identifiers given by the following equation

ID119894 = ⟨1199041 1199051⟩ ⟨119904119896 119905119896⟩ ⟨119904119870 119905119870⟩ (5)

where 119870 is the number of different nodes identified in theWi-Fi trace 119904119896 is the 119896th network node MAC (Media AccessControl) address and 119905119896 is a119871-bit binary string correspondingto the frequency distribution of the 119896th network node signal

For security reasons 119904119896 could be obfuscated by any hashfunction preventing the disclosure of private informationabout the Wi-Fi network node Regardless our experimentconsiders the use of a public Wi-Fi network implying thatMAC addresses are public as well

In turn 119905119896 is given by the following algorithm

(1) Define 119871 slots of time and compute a frequency dis-tribution 119865 = 1198911 1198912 119891119871 counting each packetwhere the source address corresponds to 119904119896 usingtimestamp information

(2) Extract a binary 119871-bits representation where for eachclass 119897 = 1 2 119871 in 119865 the 119897th bit 119887119897 is given by theBoolean operation 119887119897 = (119891119897 gt 0)

(3) Do 119905119896 = ⟨1198871 1198872 119887119871⟩Figure 6 illustrates the proposed algorithm with 119871 =

16 Packets from the same source address are sampled in afrequency distribution histogram One can observe that insubgraphs119860 and119861 Finally the binary representation showedin graph 119862 is computed as a partial identifier 119905119896

Once 119860 and 119861 have their respective partial identifiersID119860 and ID119861 they need to solve the hidden node prob-lem determining the intersection among their known nodeaddresses 119904119896 Supposing that Addr119860 andAddr119861 are the subsetscontaining 1199041 119904119870 of ID119860 and ID119861 respectively wepropose the following sequence of messages

119861 997888rarr 119860 Addr119861119860 119868 = Addr119860 cap Addr119861

119860 119904119877 isin 119868 | 119877 = rand ()119860 997888rarr 119861 119904119877

119860 119861 119896 = 119905119877

(6)

Although the proposed messages reveal the nodeaddresses chosen to determine the physical event identifierthey do not disclose any information about the selectedfrequency distribution of 119905119877 That keeps the authenticationprotocol secure against an attacker 119872 with capabilitiesdescribed at Section 32

63 Experiment Description Our experiment is imple-mented using two computers with different Wi-Fi adapterssimulating119860 and 119861 devices respectively Both computers runUbuntu 1404 Linux operating systemTheir Wi-Fi interfaceswork as sensors using monitoring mode to gather all Wi-Fipackages traffic

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

8 Security and Communication Networks

Table 1 Theoretical NC and BG protocols simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 (NC) 55 05 00 1001 125 18 00 7532 827 570 54 3433 100 899 472 1084 100 100 632 219

Table 2 Theoretical BS protocol simulation results

Band Accuracy () Throughputerr = 001 err = 002 err = 005

0 217 57 03 9761 948 813 353 9382 9987 991 918 9193 100 9949 949 2414 100 100 100 134

For practical reasons we fixed some parameters fordetermining the Unique Bitstream We consider each bit as1 time unit The time slot is fixed as 10 time units and we tryto obtain 64-bit unique bitstreams which means that eachprotocol will consume the binary stream until it finds 64ldquogoodrdquo slots

Table 1 summarizes the results obtained for Naive Count-ing (NC) and Counting with Band of Guard (BG) protocolsThe Band column indicates the band of guard size (in bits)adopted on each simulation One can note that accuracy andthroughput reach better rates when the band of guard valueis increased The gain in accuracy depends on the simulatederror rate err something already expected once the UniqueBitstream generation protocols shall work better with lowerror rates

Table 2 describes the simulation results for best slots(BS) protocol One shall observe that BS protocol presents abetter performance when compared to NC and BG protocolsBesides the higher accuracy its results show a significantgain in throughput In practice such performance implies afaster authentication process once BS protocol requires lessphysical events to determine 1198966 Case Study Using Radio Signal

61 Radio Signals as Physical Events In this section wepresent a practical case study related to the activities ofthe National Institute of Metrology Quality and Technology(Inmetro) in Brazil The Inmetro delegates notified bodiesto inspect measurement instruments under legal regulationSuch activity called metrological surveillance is done ininstruments already in use on the field (eg scales fuelpumps) Albeit these measuring instruments are connectedto the Internet surveillance agents (ie notified bodiesrsquotechnicians) need to go to the instrumentrsquos site for proceedingwith a complete visual inspection So the Inmetro wants to

check the suitability of using physical context to authenticatesurveillance agents before granting access to the instrument

Measuring instruments employed for regulating con-sumer relations are typically used in places such as supermar-kets stores shops and gas stations Nowadays these placesare surrounded by different radio-based communicationinfrastructures (eg WLANs) The radio signal propagationgenerates physical context information creating an ldquoelec-tromagnetic fingerprintrdquo That can be used as evidence ofcolocation and simultaneity of measuring instruments andsurveillance agents In this case study we use the signalgenerated by public IEEE 80211 wireless (Wi-Fi) networksThe IEEE 80211 is a well-disseminated network standard andcan be easily found in practically any public place

We see Wi-Fi network packets as physical events Theycan be detected and measured by any device using a properradio in monitoring mode In our study the Wi-Fi networkis treated as a physical event generator and not as a com-munication channel Thus the authenticating devices are notconnected to the Wi-Fi network Instead they just use theirradios as sensors receivingWi-Fi packets as physical contextinformation

The study case contemplates a measuring instrument 119860and a surveillance agent 119861 Both entities are equipped withWi-Fi radios and share the same physical context describedby the electromagnetic fingerprint of a local Wi-Fi network(Figure 5) At the same time 119872 is a malicious surveillanceagent who wants to counterfeit a visual inspection of 119860 Thethree entities are connected to the Internet but 119860 and 119861 donot use theirWi-Fi radio for that We also assume that119872 hasall the capabilities and restrictions described in Section 32

Wi-Fi radios can be configured in monitoring mode andwork as sensorsThey can ldquosenserdquo allWi-Fi traffic and identifydifferent packets with their respective source and destinationaddresses Such information constitutes our physical contextWe use it for composing a physical event identifier that

Security and Communication Networks 9

WLAN physical context

InternetA

BM

Figure 5 Using Wi-Fi signals as physical event

results from the interaction among several connected devicessendingWi-Fi packets in a given moment Once the networkcoverage field is limited only entities placed in this same areaat the same time can obtain the event identifier

62 The Physical Event Identifier We associate the ideaof physical context with the Wi-Fi network traffic Eachpacket sent by any node in the network is considered aphysical event Since 119860 and 119861 have Wi-Fi radios they canbe configured for monitoring any specific Wi-Fi networkchannel Thus they use the Wi-Fi tracing information todetermine a physical event identifier

Firstly 119860 and 119861 process tracing information by extract-ing only packets source addresses and timestamps Sourceaddresses link a physical event with the location where itoccurs Wi-Fi networks are sharply distinguished by theirnodes mobility So one can expect that a public Wi-Finetwork will present different nodes (and consequentlydifferent addresses) when we compare traces extracted atdifferent moments We use119860 and 119861 local clocks to obtain thepackets timestamps which implies that the devices are notsynchronized Timestamps are necessary to know when eachnode is sending information to the network Doing that wecan determine time slots by assigning zero when a node doesnot send any information and one when otherwiseThe resultis a physical context description that can be analyzed usingthe Unique Bitstream Generator model already describedFurthermore such time slots present a nondeterministicpattern once it is hard to predict when a network nodewill send a packet A problem emerges due to the hiddennode problem 119860 can detect packages from a node which ishidden from 119861 or vice versa This condition can affect 119860 and119861 physical event identifiers compromising authenticationWe avoid such problem proposing an additional messageinterchange which enables 119860 and 119861 to determine a commonset of communicating node addresses for extracting theirrespective physical event identifiers ID119860 and ID119861

The authentication protocol is initiated by 119861 asking 119860for authentication After that 119860 challenges 119861 to presentthe physical context proof Both the entities start to collectnetwork traces during a predefined time interval After

collecting all the traces 119860 and 119861 will have two similar setsof partial identifiers given by the following equation

ID119894 = ⟨1199041 1199051⟩ ⟨119904119896 119905119896⟩ ⟨119904119870 119905119870⟩ (5)

where 119870 is the number of different nodes identified in theWi-Fi trace 119904119896 is the 119896th network node MAC (Media AccessControl) address and 119905119896 is a119871-bit binary string correspondingto the frequency distribution of the 119896th network node signal

For security reasons 119904119896 could be obfuscated by any hashfunction preventing the disclosure of private informationabout the Wi-Fi network node Regardless our experimentconsiders the use of a public Wi-Fi network implying thatMAC addresses are public as well

In turn 119905119896 is given by the following algorithm

(1) Define 119871 slots of time and compute a frequency dis-tribution 119865 = 1198911 1198912 119891119871 counting each packetwhere the source address corresponds to 119904119896 usingtimestamp information

(2) Extract a binary 119871-bits representation where for eachclass 119897 = 1 2 119871 in 119865 the 119897th bit 119887119897 is given by theBoolean operation 119887119897 = (119891119897 gt 0)

(3) Do 119905119896 = ⟨1198871 1198872 119887119871⟩Figure 6 illustrates the proposed algorithm with 119871 =

16 Packets from the same source address are sampled in afrequency distribution histogram One can observe that insubgraphs119860 and119861 Finally the binary representation showedin graph 119862 is computed as a partial identifier 119905119896

Once 119860 and 119861 have their respective partial identifiersID119860 and ID119861 they need to solve the hidden node prob-lem determining the intersection among their known nodeaddresses 119904119896 Supposing that Addr119860 andAddr119861 are the subsetscontaining 1199041 119904119870 of ID119860 and ID119861 respectively wepropose the following sequence of messages

119861 997888rarr 119860 Addr119861119860 119868 = Addr119860 cap Addr119861

119860 119904119877 isin 119868 | 119877 = rand ()119860 997888rarr 119861 119904119877

119860 119861 119896 = 119905119877

(6)

Although the proposed messages reveal the nodeaddresses chosen to determine the physical event identifierthey do not disclose any information about the selectedfrequency distribution of 119905119877 That keeps the authenticationprotocol secure against an attacker 119872 with capabilitiesdescribed at Section 32

63 Experiment Description Our experiment is imple-mented using two computers with different Wi-Fi adapterssimulating119860 and 119861 devices respectively Both computers runUbuntu 1404 Linux operating systemTheir Wi-Fi interfaceswork as sensors using monitoring mode to gather all Wi-Fipackages traffic

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

Security and Communication Networks 9

WLAN physical context

InternetA

BM

Figure 5 Using Wi-Fi signals as physical event

results from the interaction among several connected devicessendingWi-Fi packets in a given moment Once the networkcoverage field is limited only entities placed in this same areaat the same time can obtain the event identifier

62 The Physical Event Identifier We associate the ideaof physical context with the Wi-Fi network traffic Eachpacket sent by any node in the network is considered aphysical event Since 119860 and 119861 have Wi-Fi radios they canbe configured for monitoring any specific Wi-Fi networkchannel Thus they use the Wi-Fi tracing information todetermine a physical event identifier

Firstly 119860 and 119861 process tracing information by extract-ing only packets source addresses and timestamps Sourceaddresses link a physical event with the location where itoccurs Wi-Fi networks are sharply distinguished by theirnodes mobility So one can expect that a public Wi-Finetwork will present different nodes (and consequentlydifferent addresses) when we compare traces extracted atdifferent moments We use119860 and 119861 local clocks to obtain thepackets timestamps which implies that the devices are notsynchronized Timestamps are necessary to know when eachnode is sending information to the network Doing that wecan determine time slots by assigning zero when a node doesnot send any information and one when otherwiseThe resultis a physical context description that can be analyzed usingthe Unique Bitstream Generator model already describedFurthermore such time slots present a nondeterministicpattern once it is hard to predict when a network nodewill send a packet A problem emerges due to the hiddennode problem 119860 can detect packages from a node which ishidden from 119861 or vice versa This condition can affect 119860 and119861 physical event identifiers compromising authenticationWe avoid such problem proposing an additional messageinterchange which enables 119860 and 119861 to determine a commonset of communicating node addresses for extracting theirrespective physical event identifiers ID119860 and ID119861

The authentication protocol is initiated by 119861 asking 119860for authentication After that 119860 challenges 119861 to presentthe physical context proof Both the entities start to collectnetwork traces during a predefined time interval After

collecting all the traces 119860 and 119861 will have two similar setsof partial identifiers given by the following equation

ID119894 = ⟨1199041 1199051⟩ ⟨119904119896 119905119896⟩ ⟨119904119870 119905119870⟩ (5)

where 119870 is the number of different nodes identified in theWi-Fi trace 119904119896 is the 119896th network node MAC (Media AccessControl) address and 119905119896 is a119871-bit binary string correspondingto the frequency distribution of the 119896th network node signal

For security reasons 119904119896 could be obfuscated by any hashfunction preventing the disclosure of private informationabout the Wi-Fi network node Regardless our experimentconsiders the use of a public Wi-Fi network implying thatMAC addresses are public as well

In turn 119905119896 is given by the following algorithm

(1) Define 119871 slots of time and compute a frequency dis-tribution 119865 = 1198911 1198912 119891119871 counting each packetwhere the source address corresponds to 119904119896 usingtimestamp information

(2) Extract a binary 119871-bits representation where for eachclass 119897 = 1 2 119871 in 119865 the 119897th bit 119887119897 is given by theBoolean operation 119887119897 = (119891119897 gt 0)

(3) Do 119905119896 = ⟨1198871 1198872 119887119871⟩Figure 6 illustrates the proposed algorithm with 119871 =

16 Packets from the same source address are sampled in afrequency distribution histogram One can observe that insubgraphs119860 and119861 Finally the binary representation showedin graph 119862 is computed as a partial identifier 119905119896

Once 119860 and 119861 have their respective partial identifiersID119860 and ID119861 they need to solve the hidden node prob-lem determining the intersection among their known nodeaddresses 119904119896 Supposing that Addr119860 andAddr119861 are the subsetscontaining 1199041 119904119870 of ID119860 and ID119861 respectively wepropose the following sequence of messages

119861 997888rarr 119860 Addr119861119860 119868 = Addr119860 cap Addr119861

119860 119904119877 isin 119868 | 119877 = rand ()119860 997888rarr 119861 119904119877

119860 119861 119896 = 119905119877

(6)

Although the proposed messages reveal the nodeaddresses chosen to determine the physical event identifierthey do not disclose any information about the selectedfrequency distribution of 119905119877 That keeps the authenticationprotocol secure against an attacker 119872 with capabilitiesdescribed at Section 32

63 Experiment Description Our experiment is imple-mented using two computers with different Wi-Fi adapterssimulating119860 and 119861 devices respectively Both computers runUbuntu 1404 Linux operating systemTheir Wi-Fi interfaceswork as sensors using monitoring mode to gather all Wi-Fipackages traffic

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

10 Security and Communication Networks

Table 3 Experiment datasets generated for analyzing the proposed authentication mechanism

Experiment location Alias Auth tries errFederal University of Rio de Janeiro FND 112 631Starbucks day 1 STB1 141 279Starbucks day 2 STB2 150 255

RSSI

(dB)

minus45minus50minus55minus60minus65minus70

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

(a) Packets of the same source address

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Pack

ets

6543210

(b) Packets frequency distribution histogram

Time (secs)0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Bool

ean 1

0

(c) Histogram binary representation (partial ID)

Figure 6 How 119905119894 is generated from packets tracing information

An authentication script is triggered at the same timein both computers The script is responsible for collectingnetwork packets traces for approximately one minute Thetrace is obtained invoking Linux tcpdump command Noparticular filter is used neither is the kernel modified todrop packets The experiment does not make use of anymechanism for synchronizing 119860 and 119861 That is purposefulsince we aim to evaluate the method robustness againstdelays in processing and network signal propagation Aftercollecting the traces a second script extracts timestampsand packets source addresses It also determines each partialidentifier 119905119896 performing the algorithm described in theprevious section

We run the experiment in two different testing environ-ments (1) a building of research labs at the Federal Universityof Rio de Janeiro and (2) a Starbucks Coffee located insidea crowded shopping mall at Rio de Janeiro downtown Inthe second environment we perform the simulation on twodifferent days Therefore we have three different simulationdatasets whose details are shown at Table 3 For each one wedescribe the number of authentication tries (Auth tries) andthe estimated sensing error err which means the probabilityof119860 and 119861 disagreeing about a physical event binary descrip-tion (0 or 1)

Just like we did in Section 5 we fixed some parameters fordetermining the physical event identifiers We consider thetime unit as 002 seconds or 20 milliseconds The time slotcorresponds to 10 time units or 200 milliseconds We obtain64-bit identifiers (119871 = 64) We keep these values aiming tocompare the theoretical simulation results with the practical

study case In turn we choose time unit trying to keep theauthentication time below 30 seconds

64 Experiment Results We evaluated the experiment resultsfor both attack scenarios described at Section 32 At the firstone 119896 value has only the function of providing colocation andsimultaneity evidence We perform authentication followingthe same idea found in previous works Once the commu-nication channel is protected 119861 can just send his 119896119861 valueto 119860 119860 evaluates 119896119860 and 119896119861 similarity using a comparisonfunction 119862 and defining an acceptance threshold value ThSuch strategy can be described as follows

119862 (119896119860 119896119861) le Th (7)

On the other hand when one analyzes the nonsecurecommunication scenario a protected channel can be estab-lished if and only if 119896119860 = 119896119861 That imposes a more restrictiveaccuracy condition So we evaluate the second scenario firstaiming to determine the accuracy and throughput rates of BGand BS protocols in each dataset

Table 4 summarizes accuracy (Acc) and throughput(Thr) rates for datasets FND STB1 and STB2 when BGprotocol is performed One shall note that BG works betterin FND physical context Such behavior was expected dueto the lower sensing error (err) observed in this datasetThe rates resulted from STB1 and STB2 datasets are low forauthentication applications even when the band of guard isincreased in BG protocol One can note a limit when a largerband of guard decreases accuracy rate Such results point out

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

Security and Communication Networks 11

Table 4 Case study NC and BG protocols simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

0 625 100 156 100 166 1001 687 964 163 948 180 9492 803 892 319 836 326 8353 910 833 439 704 426 6964 955 684 510 501 480 4945 973 619 460 402 500 382

Table 5 Case study BS protocol simulation results

Band FND dataset STB1 dataset STB2 datasetAcc Thr Acc Thr Acc Thr

1 696 996 205 994 206 9952 848 990 319 984 393 9853 928 983 524 972 526 9744 955 800 517 759 566 7945 964 678 439 483 506 481

the need for the best protocols to deal with situations whensensing error is increased

In turn Table 5 shows accuracy and throughput ratesusing BS protocol One can observe a little increase inaccuracy while the gain is expressive in throughput Thatwas already expected due to the discussed theoretical modelproperties However we found the same BG protocol weak-ness accuracy rates are not good enough for authenticationin physical contexts where sensing error is higher than 20

Now we investigate the authentication in a secure com-munication scenario We define an acceptance threshold Ththat should increase the proposed authenticationmechanismaccuracy At the same time Th introduces type I and type IIerrors in our statistical hypothesis testing both representedby false acceptance rate (FAR) and false rejection rate (FRR)(FAR and FRR are error rates commonly used for evaluatingidentification algorithms in biometrics They also can bereferenced as false positive rate (FPR) and false negative rate(FNR)) We need to determine the confusion matrix for eachspecific situation evaluating how it changes with Th valueWe do that by creating fake pairs of identifiers combining119860 and 119861 identifiers generated at different moments Suchpractice is interesting for analyzing because it also simulatesa replay attack We selected 20 pairs of identifiers generatedby both BG and BS protocols from each collected datasetperforming a total of six test cases For each one of thedescribed tests we experiment different values of thresholdTh aiming to minimize FAR and FRR For practical reasonswe analyze just the cases associatedwith BG andBS protocolsrsquobest results from nonsecure communication scenario So wefixed band of guard Band = 4

Figure 7 shows how FRR and FAR change with Th valuein each one of the six proposed test cases These resultsexpose a weak aspect of the proposed mechanism it presentsa high FAR Consequently fake pairs of identifiers have a

high probability to be accepted as correct pairsThis behavioris notably in FND dataset tests One can observe that FARstarts from 023 in BG protocol and 011 in BS protocolThe test cases related to STB1 and STB2 datasets presentbetter boundary conditions One can establish a reasonabletradeoff between FRR and FAR Again BS protocol presentsbetter results than BG protocol So we decided to estimate theaccuracy increase just for BS choosing a Th value that keepsFAR below 005 (except for FND dataset) and determiningour best authentication results according to the metrics inTable 6

Comparing the results in Table 5 (when Band = 4) andTable 6 one can note that the gain using acceptance thresholdis not meaningful Although we can increase accuracy whilekeeping a low FAR in STB1 and STB2 datasets precision andrecall rates indicate an enhancement no more than 10 insuccessful authentication cases

7 Conclusions

This work presented a comprehensive study of physicalcontext-based authentication Such context information isusually available in ubiquitous modern systems due to theintegration of physical processes and information technolo-gies We explored this asset proposing an authenticationmechanism for entities that share the same physical contextWe evaluated two different approaches according to theassumptions about the communication channel The maincontributions are the model for generating a Unique Bit-stream using physical events and the two key agreementprotocols BG and BS They can be used for establishinga secure communication channel and protecting authenti-cation processes against external attackers We also devel-oped the probabilistic analysis simulation and presented apractical case study The results are promising since they

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

12 Security and Communication Networks

Table 6 Authentication performance rates for BS protocol with different Th values

FNDTh = 0 STB1Th = 9 STB2Th = 2OK NOK OK NOK OK NOK

Correct ID 17 3 13 7 11 9Fake ID 21 169 9 181 8 182FRR 015 035 045FAR 011 0047 0042Precision 0447 059 0578Recall 085 065 055Accuracy 885 923 919

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

) 08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Rate

s (

)

08

06

04

02

0

Threshold (bits)0 05 1 15 2 25 3 35 4 45 5 55 6 65

BG protocol-FND dataset BS protocol-FND dataset

BG protocol-STB1 dataset BS protocol-STB1 dataset

BG protocol-STB2 dataset BS protocol-STB2 dataset

FRRFAR

Threshold (bits)0 1 2 3 4 5 6 7 8 9

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28

FRRFAR

Threshold (bits)0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30

FRRFAR

Threshold (bits)0 5 10 15 2520 30 35

FRRFAR

Figure 7 FRR and FAR for scenario RS attack with different Th values

indicate that our contributions are suitable for practicalapplications

We also point out two main weaknesses in our studyThe first one is the need for a low error rate in physicalcontext description Simulation and practical experimentswith an error rate around 5 showed good results On theother hand real datasets with an error rate higher than 20resulted in insufficient accuracy for practical applications

in authentication The second deficiency is the high falseacceptance rate FAR Such result suggests that the generatedsecret keys present low entropy That raises the risk ofcollisions in key generation and consequently compromisessecurity

Our next steps will include new case studies as wellas the development of new alternatives to deal with thedrawbacks above We intend to apply our authentication

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

Security and Communication Networks 13

mechanisms in different practical cases involving manu-facturing transportation and smart grids see Section 24We also foresee some strategies for improving our UniqueBitstream protocolsThey include themerge with some ECCsfeatures and zero-interaction authentication approaches

Conflicts of Interest

The authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

The present research was partially supported by FAPERJ(JCNE E-262015512014) and by CNPq (Universal 4210072016-8)

References

[1] M A Simplicio Jr B T De Oliveira C B Margi P S L MBarreto T C M B Carvalho and M Naslund ldquoSurvey andcomparison of message authentication solutions on wirelesssensor networksrdquo Ad Hoc Networks vol 11 no 3 pp 1221ndash12362013

[2] F Pasqualetti F Dorfler and F Bullo ldquoAttack detection andidentification in cyber-physical systemsrdquo Institute of Electricaland Electronics Engineers Transactions on Automatic Controlvol 58 no 11 pp 2715ndash2729 2013

[3] A-R Sadeghi C Wachsmann and M Waidner ldquoSecurityand privacy challenges in industrial internet of thingsrdquo inProceedings of the 52nd ACMEDACIEEE Design AutomationConference (DAC rsquo15) pp 1ndash6 IEEE San Francisco Calif USAJune 2015

[4] J Giraldo E Sarkar A A Cardenas M Maniatakos and MKantarcioglu ldquoSecurity and Privacy in Cyber-Physical SystemsA Survey of Surveysrdquo IEEE Design and Test vol 34 no 4 pp7ndash17 2017

[5] K Islam W Shen and X Wang ldquoWireless sensor networkreliability and security in factory automation a surveyrdquo IEEETransactions on Systems Man and Cybernetics Part C Applica-tions and Reviews vol 42 no 6 pp 1243ndash1256 2012

[6] M Durresi A Durresi and L Barolli ldquoSecure Inter VehicleCommunicationsrdquo in Proceedings of the 2012 Sixth InternationalConference on Complex Intelligent and Software Intensive Sys-tems (CISIS) pp 177ndash183 Palermo Italy July 2012

[7] K Han S D Potluri and K G Shin ldquoOn authentication ina connected vehiclerdquo in Proceedings of the the ACMIEEE 4thInternational Conference p 160 Philadelphia PennsylvaniaApril 2013

[8] J Han M Harishankar X Wang A J Chung and P TagueldquoConvoy Physical context verification for vehicle platoonadmissionrdquo in Proceedings of the 18th International WorkshoponMobile Computing Systems andApplications HotMobile 2017pp 73ndash78 USA February 2017

[9] H Khurana M Hadley N Lu and D A Frincke ldquoSmart-gridsecurity issuesrdquo IEEE Security amp Privacy vol 8 no 1 pp 81ndash852010

[10] A C-F Chan and J Zhou ldquoCyberndashPhysical Device Authen-tication for the Smart Grid Electric Vehicle Ecosystemrdquo IEEEJournal on Selected Areas in Communications vol 32 no 7 pp1509ndash1517 2014

[11] N Komninos E Philippou and A Pitsillides ldquoSurvey in smartgrid and smart home security issues challenges and counter-measuresrdquo IEEE Communications Surveys amp Tutorials vol 16no 4 pp 1933ndash1954 2014

[12] M Rostami A Juels and F Koushanfar ldquoHeart-to-Heart(H2H) Authentication for Implanted Medical Devicesrdquo in Pro-ceedings of the 2013 ACM SIGSAC conference on Computer com-munications security - CCS 13 pp 1099ndash1112 2013 httpdlacmorgcitationcfm

[13] K Habib and W Leister ldquoContext-Aware Authentication forthe Internet of Thingsrdquo in Proceedings of the in InternationalConference on Autonomic and Autonomous Systems Context-Aware pp 134ndash139 2015

[14] C Perera A Zaslavsky P Christen and D GeorgakopoulosldquoContext aware computing for the internet of things a surveyrdquoIEEE Communications Surveys amp Tutorials vol 16 no 1 pp414ndash454 2014

[15] H T T Truong X Gao B Shrestha N Saxena N Asokan andP Nurmi ldquoUsing contextual co-presence to strengthen Zero-Interaction Authentication Design integration and usabilityrdquoPervasive and Mobile Computing vol 16 pp 187ndash204 2015

[16] M Miettinen N Asokan T D Nguyen A-R Sadeghi andM Sobhani ldquoContext-based zero-interaction pairing and keyevolution for advanced personal devicesrdquo in Proceedings ofthe 21st ACM Conference on Computer and CommunicationsSecurity CCS 2014 pp 880ndash891 USA November 2014

[17] M Juuti C Vaas I Sluganovic H Liljestrand N Asokanand I Martinovic ldquoSTASH Securing Transparent Authenti-cation Schemes Using Prover-Side Proximity Verificationrdquo inProceedings of the 14th Annual IEEE International Conference onSensing Communication and Networking SECON 2017 USAJune 2017

[18] J Zhang T Q Duong R Woods and A Marshall ldquoSecuringwireless communications of the internet of things from thephysical layer an overviewrdquo Entropy vol 19 no 8 article no420 2017

[19] B Shrestha N Saxena H T T Truong N Asokan and NAsokan ldquoDrone to the rescue Relay-resilient authenticationusing ambient multi-sensingrdquo Lecture Notes in Computer Sci-ence (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) Preface vol 8437 pp 349ndash364 2014

[20] N Karapanos CMarforio C Soriente and S Capkun ldquoSound-proof usable two-factor authentication based on ambientsoundrdquo in Proceedings of the 24th USENIX Conference on Secu-rity Symposium (SEC rsquo15) pp 483ndash498 2015 httpdlacmorgcitationcfm

[21] R Mayrhofer and H Gellersen ldquoShake Well Before UseAuthentication Based onrdquo in Proceedings of the 5th InternationalConference PERVASIVE 2007 pp 144ndash161 2007

[22] F-J Wu F-I Chu and Y-C Tseng ldquoCyber-physical hand-shakerdquo ACM SIGCOMM Computer Communication Reviewvol 41 no 4 p 472 2011

[23] L C Priya and S D Patil ldquoA Survey on Sensor Authenticationin Dynamic Wireless Sensor Networksrdquo in Proceedings of theInternational Journal of Computer Science and InformationTechnology Research vol 2 pp 454ndash461 2014

[24] D Adrian K Bhargavan Z Durumeric et al ldquoImperfectforward secrecy How diffie-hellman fails in practicerdquo in Pro-ceedings of the 22nd ACM SIGSAC Conference on Computer andCommunications Security CCS 2015 pp 5ndash17 USA October2015

14 Security and Communication Networks

[25] J E Bandram R E Kjaeligr and M Oslash Pedersen ldquoContext-AwareUser Authentication ndash Supporting Proximity-Based Login inPervasive Computingrdquo in UbiComp 2003 Ubiquitous Comput-ing vol 2864 of Lecture Notes in Computer Science pp 107ndash123Springer Berlin Heidelberg Berlin Heidelberg 2003

[26] Z-L Gu andY Liu ldquoScalable group audio-based authenticationscheme for IoT devicesrdquo in Proceedings of the 12th InternationalConference onComputational Intelligence and Security CIS 2016pp 277ndash281 chn December 2016

[27] A Zoha A Gluhak M A Imran and S Rajasegarar ldquoNon-intrusive load monitoring approaches for disaggregated energysensing a surveyrdquo Sensors vol 12 no 12 pp 16838ndash16866 2012

[28] D Gafurov E Snekkenes and P Bours ldquoGait authenticationand identification using wearable accelerometer sensorrdquo in Pro-ceedings of the 2007 IEEEWorkshop on Automatic IdentificationAdvanced Technologies AUTOID 2007 pp 220ndash225 Italy June2007

[29] R V Yampolskiy and V Govindaraju ldquoBehavioural biometricsa survey and classificationrdquo International Journal of Biometricsvol 1 no 1 pp 81ndash113 2008

[30] A Scannell A Varshavsky A LaMarca and E de LaraldquoProximity-based authentication of mobile devicesrdquo Interna-tional Journal of Security and Networks vol 4 no 1-2 pp 4ndash162009

[31] S Mathur A Reznik C Ye et al ldquoExploiting the physicallayer for enhanced securityrdquo IEEE Wireless CommunicationsMagazine vol 17 no 5 pp 63ndash70 2010

[32] K-A Shim ldquoA survey of public-key cryptographic primitivesin wireless sensor networksrdquo IEEE Communications Surveys ampTutorials vol 18 no 1 pp 577ndash601 2016

[33] Y E H Shehadeh and D Hogrefe ldquoA survey on secretkey generation mechanisms on the physical layer in wirelessnetworksrdquo Security and Communication Networks vol 8 no 2pp 332ndash341 2015

[34] C Huth R Guillaume T Strohm P Duplys I A Samuel andT Guneysu ldquoInformation reconciliation schemes in physical-layer security A surveyrdquo Computer Networks vol 109 pp 84ndash104 2016

[35] C Miller and C Valasek ldquoAdventures in Automotive Networksand Control Unitsrdquo in Proceedings of the DEF CON 21 vol 21pp 260ndash264

[36] W-L Chin Y-H Lin and H-H Chen ldquoA Framework ofMachine-to-Machine Authentication in Smart Grid A Two-Layer Approachrdquo IEEE Communications Magazine vol 54 no12 pp 102ndash107 2016

[37] R W Uluski ldquoVVC in the smart grid erardquo in Proceedings of theIEEE PES General Meeting PES 2010 USA July 2010

[38] T Peng C Leckie and K Ramamohanarao ldquoSurvey ofnetwork-based defense mechanisms countering the DoS andDDoS problemsrdquoACMComputing Surveys vol 39 no 1 ArticleID 1216373 2007

[39] M Mitzenmacher and E Upfal Probability and computingCambridge University Press Cambridge 2005

[40] A Rukhin J Sota J Nechvatal et al ldquoA statistical testsuite for random and pseudorandom number generators forcryptographic applicationsrdquo Special Publication NIST 800-22National Institute of Standards and Technology 2010

International Journal of

AerospaceEngineeringHindawiwwwhindawicom Volume 2018

RoboticsJournal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Active and Passive Electronic Components

VLSI Design

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Shock and Vibration

Hindawiwwwhindawicom Volume 2018

Civil EngineeringAdvances in

Acoustics and VibrationAdvances in

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Electrical and Computer Engineering

Journal of

Advances inOptoElectronics

Hindawiwwwhindawicom

Volume 2018

Hindawi Publishing Corporation httpwwwhindawicom Volume 2013Hindawiwwwhindawicom

The Scientific World Journal

Volume 2018

Control Scienceand Engineering

Journal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom

Journal ofEngineeringVolume 2018

SensorsJournal of

Hindawiwwwhindawicom Volume 2018

International Journal of

RotatingMachinery

Hindawiwwwhindawicom Volume 2018

Modelling ampSimulationin EngineeringHindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Chemical EngineeringInternational Journal of Antennas and

Propagation

International Journal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Navigation and Observation

International Journal of

Hindawi

wwwhindawicom Volume 2018

Advances in

Multimedia

Submit your manuscripts atwwwhindawicom

International Journal of

AerospaceEngineeringHindawiwwwhindawicom Volume 2018

RoboticsJournal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Active and Passive Electronic Components

VLSI Design

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Shock and Vibration

Hindawiwwwhindawicom Volume 2018

Civil EngineeringAdvances in

Acoustics and VibrationAdvances in

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Electrical and Computer Engineering

Journal of

Advances inOptoElectronics

Hindawiwwwhindawicom

Volume 2018

Hindawi Publishing Corporation httpwwwhindawicom Volume 2013Hindawiwwwhindawicom

The Scientific World Journal

Volume 2018

Control Scienceand Engineering

Journal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom

Journal ofEngineeringVolume 2018

SensorsJournal of

Hindawiwwwhindawicom Volume 2018

International Journal of

RotatingMachinery

Hindawiwwwhindawicom Volume 2018

Modelling ampSimulationin EngineeringHindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Chemical EngineeringInternational Journal of Antennas and

Propagation

International Journal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Navigation and Observation

International Journal of

Hindawi

wwwhindawicom Volume 2018

Advances in

Multimedia

Submit your manuscripts atwwwhindawicom