Title: Perils of Zero-Interaction Security in the Internet of Things,
Abstract: The Internet of Things (IoT) demands authentication systems which can provide
both security and usability. Recent research utilizes the rich sensing
capabilities of smart devices to build security schemes operating without human
interaction, such as zero-interaction pairing (ZIP) and zero-interaction
authentication (ZIA). Prior work proposed a number of ZIP and ZIA schemes and
reported promising results. However, those schemes were often evaluated under
conditions which do not reflect realistic IoT scenarios. In addition, drawing
any comparison among the existing schemes is impossible due to the lack of a
common public dataset and unavailability of scheme implementations.
In this paper, we address these challenges by conducting the first
large-scale comparative study of ZIP and ZIA schemes, carried out under
realistic conditions. We collect and release the most comprehensive dataset in
the domain to date, containing over 4250 hours of audio recordings and 1
billion sensor readings from three different scenarios, and evaluate five
state-of-the-art schemes based on these data. Our study reveals that the
effectiveness of the existing proposals is highly dependent on the scenario
they are used in. In particular, we show that these schemes are subject to
error rates between 0.6% and 52.8%.