[Paper Review] Acoustic Integrity Codes: Secure Device Pairing Using Short-Range Acoustic Communication

Florentin Putz, María Flor Álvarez Taboada+1 more|arXiv (Cornell University)|May 18, 2020

User Authentication and Security Systems36 references4 citations

TL;DR

This paper proposes Acoustic Integrity Codes (AICs), a physical-layer security scheme that enables secure device pairing using short-range audio communication on off-the-shelf smartphones. By leveraging low-autocorrelation signals and a ternary decision function with a threshold, AICs resist signal cancellation and overshadowing attacks, achieving a bit error rate below 0.1% at 100 bps with 14 dB SNR.

ABSTRACT

Secure Device Pairing (SDP) relies on an out-of-band channel to authenticate devices. This requires a common hardware interface, which limits the use of existing SDP systems. We propose to use short-range acoustic communication for the initial pairing. Audio hardware is commonly available on existing off-the-shelf devices and can be accessed from user space without requiring firmware or hardware modifications. We improve upon previous approaches by designing Acoustic Integrity Codes (AICs): a modulation scheme that provides message authentication on the acoustic physical layer. We analyze their security and demonstrate that we can defend against signal cancellation attacks by designing signals with low autocorrelation. Our system can detect overshadowing attacks using a ternary decision function with a threshold. In our evaluation of this SDP scheme's security and robustness, we achieve a bit error ratio below 0.1% for a net bit rate of 100 bps with a signal-to-noise ratio (SNR) of 14 dB. Using our open-source proof-of-concept implementation on Android smartphones, we demonstrate pairing between different smartphone models.

Motivation & Objective

• Address the lack of usable, hardware-agnostic out-of-band channels for secure device pairing (SDP) in ubiquitous computing environments.
• Overcome limitations of existing SDP schemes that rely on specialized hardware like NFC, cameras, or vibration motors.
• Enable secure, low-interaction pairing using only built-in audio hardware (speakers and microphones) available on standard smartphones.
• Design a physical-layer authentication mechanism that eliminates the need for manual verification steps common in prior acoustic SDP protocols.
• Ensure robustness against active attacks such as signal cancellation and signal overshadowing in acoustic channels.

Proposed method

• Design Acoustic Integrity Codes (AICs) based on Integrity Codes from Čapkun et al., adapted for acoustic waveforms.
• Use signals with low autocorrelation (e.g., Gaussian-distributed) to resist signal cancellation attacks by minimizing correlation between on-slot and off-slot energy.
• Implement a ternary decision function at the receiver with a configurable detection threshold to detect and reject malicious signals.
• Apply the decision function to distinguish between legitimate on/off slots and attacker-modified signals, enabling detection of signal overshadowing.
• Optimize system parameters including bandwidth, signal-to-noise ratio (SNR), and gross bit rate to balance robustness and data rate.
• Implement a proof-of-concept on Android smartphones using user-space audio I/O, avoiding firmware or hardware modifications.

Experimental results

Research questions

• RQ1 Can acoustic communication be used as a secure, hardware-agnostic out-of-band channel for device pairing without requiring specialized hardware?
• RQ2 How can physical-layer integrity be enforced in acoustic channels to prevent signal cancellation and overshadowing attacks?
• RQ3 What signal design parameters (e.g., autocorrelation, bandwidth, SNR) are required to achieve low bit error rates under realistic channel conditions?
• RQ4 To what extent can a ternary decision function with a threshold detect active attacks while maintaining robustness to noise and interference?
• RQ5 Can a practical, open-source SDP protocol be implemented on standard Android devices using only audio hardware?

Key findings

• AICs achieve a bit error rate (BER) below 0.1% at a net bit rate of 100 bps with a signal-to-noise ratio (SNR) of 14 dB, demonstrating high reliability under realistic conditions.
• For gross bit rates below 450 bps and SNR above 11 dB, BER remains below 1% when using bandwidths greater than 4 kHz.
• Signal cancellation attacks are effectively mitigated by using signals with low autocorrelation, such as those with Gaussian distribution.
• The ternary decision function successfully detects signal overshadowing attacks by distinguishing between legitimate on/off slots and attacker-injected signals.
• Detection thresholds significantly impact BER: optimal performance occurs when the threshold is set just below the average signal power, avoiding both ISI-induced errors and false negatives.
• Robustness improves at lower bit rates due to reduced inter-symbol interference (ISI), with a wider range of viable detection thresholds for low-rate transmissions.