Distinguishing Users with Capacitive Touch Communication Tam Vu , - PowerPoint PPT Presentation

ACM MobiCom 2012 Distinguishing Users with Capacitive Touch Communication Tam Vu , Akash Baid, Simon Gao, Marco Gruteser, Richard Howard, Janne Lindqvist, Predrag Spasojevic, Jeffrey Walling WINLAB, Rutgers University www.winlab.rutgers.edu/~tamvu

NEWS If only the phone knows who is interacting with it by itself ...

Current identification/authentication methods Users switch from one device to another more often

Other identification/authentication methods • Biometric based • Require additional hardware or space • Bluetooth token • Accidentally authenticate devices within the close proximity

Other identification/authentication methods • NFC-based methods • Require NFC hardware What could be a more intuitive way of identifying users for today’s off-the-shelf devices ?

Identifying users through their touches Capacitive touch sensing is pervasive Associating user identifier to touches Capacitive Touch Communication (Hardware token + Software decoder)

Capacitive Touch Communication Overview Generates • A wearable hardware token electrical pulses • Generates electrical pulses • Spoofs the touch screen to create touch events • Software decoder • Retrieves originally transmitted Touch events bits from the touch events are registered and decoded • No modification to hardware or firmware of off-the-shelf devices

Creating Artificial Touches Capacitive touch screen background S3 C i S1 S2 V sig • Sensors measure the additional capacitance of a human body • Array of conducting electrodes behind an insulating glass layer • Structure of a touch event registered to the operating system (X,Y) Touch Timestamp Event Type Pointer ID Touch Size coordinates Amplitude

Creating Artificial Touches “Spoof” the touch screen S3 C i S1 S2 V sig • Affecting the capacitance measurement by injecting signal to create artificial touch events

Creating Artificial Touches Experimented with different signal sources • Different waveforms • Voltages: 1-20Vpeak to peak • Frequency: 100Hz to 120KHz Samsung Galaxy Tab 10.1'

Creating Artificial Touches Experimented with different signal sources 45 41.92 events/s Average number of events per second 40 35 30 25 20 15 10 5 0 2 3 4 5 10 10 10 10 Electrical pulse frequency (Hz) Touch screen responses to 10 Vp-p square wave signals at frequency from 100Hz to 120KHz

Encoding bits with touch events 1 1 0 1 0 ... Input bit sequence Input ... Transmitter Tx Signal ( A hardware token ) On-Off Keying modulation Electrical Pulses Channel ( Touch screen hardware and firmware ) Artificial Touch Events Receiver Threshold-based demodulation (Software decoder) 1 1 0 1 0 Output Received bit sequence bit period

Encoding bits with touch events On-Off Keying modulation Input bit sequence Threshold-based demodulation Transmitter • Unsynchronized ( A hardware token ) • Unknown processing delay Electrical Pulses • Highly correlated channel Channel • Variable delay between symbols ( Touch screen hardware and firmware ) • Low bandwidth Artificial Touch Events • Offline calibration to select thresholds Receiver (Software decoder) • Simultaneously synchronize and demodulate Received bit sequence

Offline Calibration Determine number events for ones and zeros • Transmit a known bit sequence. • Synchronize Tx and Rx using a sliding window: – The correct bit synchronization maximizes number of events in all 1 s and minimize that of 0 s • Count the number of events in each bit 0s and 1s

Offline Calibration Determine number events for ones and zeros 400 bit 0 bit 1 350 300 Fequency (times) 250 200 150 100 50 • Offline calibration to select thresholds 0 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Number of events in one bit • Simultaneously synchronize and demodulate Number of events in bit one and bit zero for transmissions at 4 bits/s

Minimum Distance Demodulation Simultaneously synchronize and demodulate • Assumption: – All possible messages are known • Demodulation: – Try all possible starting points – At each starting point, compute the correlation between the event sequence and all messages – Select the message and starting point that give the highest correlation (decoded message) Example Message = 011 1e = 7 Possible Messages = {001, 011, 111} 0e = 1 Starting Starting 001 011 111 001 011 111 … 1 1 0 1 1 0 … Position Position 1 1 11 5 2 11 5 2 ... .....|||||||||||||||...||.|..|||||||||||||||.......||.. ... ... 2 ... ... ... 5 7 6 3 202 18 0 6 7 1 7 ... ... ... ... ...

Evaluation with Function Generator • Metrics: – Detection Rate & False Acceptance Rate • Methodology: – Messages with length of 2-5 bits. – Repeatedly transmitted 5000 times for each message

Evaluation with Function Generator 2 bits 3 bits 4 bits 5 bits 100 90 Detection Rate (%) 80 70 60 50 40 30 20 10 0 4 bits/s 5 bits/s 8 bits/s 10 bits/s • Bit period gets smaller as the data rate increases

Evaluation with Function Generator False Acceptance Rate (%) 5 2 bits 3 bits 4 bits 5 bits 4 3 2 1 0 4 bits/s 5 bits/s 8 bits/s 10 bits/s • Bit period gets smaller as the data rate increases

Prototype Building a wearable hardware token TI-MSP430 9V F2722 180 Ω 30pF C B 560 Ω E Ring Surface

Prototype Building a wearable hardware token • The ring generates pulses with longer rise time • Contact point is not as good as of the AFG electrode

Prototype Building a wearable hardware token 100 2 bits 3 bits 4 bits 5 bits 80 Detection Rate (%) 60 40 20 0 4 bits/s 5 bits/s

Prototype Building a wearable hardware token False Acceptance Rate (%) 2 2 bits 3 bits 4 bits 5 bits 1.5 1 0.5 0 4 bits/s 5 bits/s • Can be improved with better hardware design • Trading data rate for DR and FAR by ECC

Possible applications • Parental control applications – Sharing devices with your children/spouse – 2-3 bits to be transmitted • Weak authentication – Pincode level (i.e ~13 bit of entropy) Parental control

Possible applications • Distinguishing different types of tokens – Board games on touch screens – Different coloring styluses – A few bits to be transmitted

Possible applications • Multi-user games/collaboration – 1-2 bits to be transmitted

Transmitting through a finger • The electrode in contact with a human finger Samsung Galaxy Tab 10.1' • Detecting the presence of the ring when the user swipe

Transmitting through a finger • Ring-presence detection rate 97% 92% 100 Detection rate 80 False positive rate Percentage 60 40 20 0 200 400 600 800 1000 1200 1400 1600 Swipe Duration (ms)

Conclusion Capacitive Touch Communication Device authentication Multi-user Vehicular games security Signet Ring Parental Home security control Payment Medical security Credit Ring Portable SIMCARD

Thank you ! Demo video is available on YouTube at: ACM MobiCom 2012 http://tinyurl.com/8nc65ro www.winlab.rutgers.edu/~tamvu