A group of academics has proposed a machine learning approach
that uses authentic interactions between devices in Bluetooth
networks as a foundation to handle device-to-device authentication
reliably.
Called “Verification of Interaction
Authenticity[1]” (aka VIA), the
recurring authentication scheme aims to solve the problem of
passive, continuous authentication and automatic deauthentication
once two devices are paired with one another, which remain
authenticated until an explicit deauthentication action is taken,
or the authenticated session expires.
“Consider devices that pair via Bluetooth, which commonly follow
the pattern of pair once, trust indefinitely. After two devices
connect, those devices are bonded until a user explicitly removes
the bond. This bond is likely to remain intact as long as the
devices exist, or until they transfer ownership,” Travis Peters,
one of the co-authors of the study, said[2].
“The increased adoption of (Bluetooth-enabled) IoT devices and
reports of the inadequacy of their security makes indefinite trust
of devices problematic. The reality of ubiquitous connectivity and
frequent mobility gives rise to a myriad of opportunities for
devices to be compromised,” Peters added.
Authentication is a process to verify that an individual or a
system is, in fact, who or what it claims to be. While
authentication can also be achieved by identification — something
who you are — the latest research approaches it from a verification
perspective in that it aims to validate that apps and devices
interact in a manner that’s consistent with their prior
observations. In other words, the device’s interaction patterns act
as a barometer of its overall behavior.
To this end, the recurring validation of interaction patterns
allows for authenticating the device by cross-checking the device’s
behavior against a previously learned machine learning model that
represents typical, trustworthy interactions, with the first
authentication factor being the use of traditional Bluetooth
identifiers and credentials.
“For example, a user that has a blood-pressure device may really
only care if a blood-pressure monitor device is ‘hooked up’ to the
measurement app, and is operating in a way that is consistent with
how a blood-pressure monitor should operate,” the researchers
outlined.
“Presumably, so long as these properties hold, there is no
immediate or obvious threat. If, however, a device connects as a
blood-pressure monitor and then goes on to interact in a way that
is inconsistent with typical interactions for this type of device,
then there may be cause for concern.”
VIA works by extracting features from packet headers and
payloads and comparing them to a verification model to corroborate
whether the ongoing interactions are consistent with this known
authentic behavioral model, and if so, permit the devices to
continue communicating with each other. As a consequence, any
deviation from authentic interactions will result in failed
verification, allowing devices to take steps to mitigate any future
threat.
The model is constructed using a combination of features, such
as n-grams[3]
built from deep packet inspection, protocol identifiers and packet
types, packet lengths, and packet directionality. The dataset
consists of a collection of 300 Bluetooth HCI network traces that
capture interactions between 20 distinct smart health and smart
home devices and 13 different smartphone apps installed on a Nexus
5 smartphone running Android 6.0.1.
“We see VIA’s recurring verification of interaction patterns as
a sort of second factor for authenticating the device,” the
researchers said. “As a result of this scheme, we introduce the
notion of recurring behavioral authentication for Bluetooth
connections, which can be integrated into a Bluetooth gateway
device, such as a smartphone.”