Proximity based IoT device authentication

TLDR

IoT devices typically lack sophisticated user interfaces, making traditional pre‑shared‑key authentication impractical. This work proposes Move2Auth, a proximity‑based authentication scheme designed to strengthen IoT device security. Move2Auth requires users to hold a smartphone and perform hand gestures while the device measures RSS variations and matches RSS traces with smartphone sensor data to confirm proximity. Our evaluation on a Samsung Galaxy smartphone and commodity Wi‑Fi adapter shows that Move2Auth protects against active impersonation attacks, achieving a false‑positive rate below 0.5 % and preventing Wi‑Fi password leakage.

Abstract

Internet of Things (IoT) devices are largely embedded devices which lack a sophisticated user interface, e.g., touch screen, keyboard, etc. As a consequence, traditional Pre-Shared Key (PSK) based authentication for mobile devices becomes difficult to apply. For example, according to our study on home automation devices which leverage smartphone for PSK input, the current process does not protect against active impersonating attack and also leaks the Wi-Fi password to eavesdroppers, i.e., currently these IoT devices can be exploited to enter into critical infrastructures, e.g., home networks. Motivated by this real-world security vulnerability, in this paper we propose a novel proximity-based mechanism for IoT device authentication, called Move2Auth, for the purpose of enhancing IoT device security. In Move2Auth, we require user to hold smartphone and perform one of two hand-gestures (moving towards and away, and rotating) in front of IoT device. By combining (1) large RSS-variation and (2) matching between RSS-trace and smartphone sensor-trace, Move2Auth can reliably detect proximity and authenticate IoT device accordingly. Based on our implementation on Samsung Galaxy smartphone and commodity Wi-Fi adapter, we prove Move2Auth can protect against powerful active attack, i.e., the false-positive rate is consistently lower than 0.5%.