CS60055: Ubiquitous Computing

Security and Privacy in Ubiquitous Computing

When every sensor is also a side channel

INDIAN INSTITUTE OF TECHNOLOGY

KHARAGPUR

Sandip Chakraborty

sandipc@cse.iitkgp.ac.in

Department of Computer Science and Engineering

Where We Are in the Course

Every sensing technique you learned has a dual. A good sensor for us is a good sensor for the attacker.

Indian Institute of Technology Kharagpur

Today's Plan

A

Part A: Sensors as Side Channels

Learning secrets from motion, RF, light, power and traffic metadata

B

Part B: Attacks on Sensing Integrity

Injecting false readings through sound, ultrasound, laser, EMI and spoofed RF

C

Part C: Defences Across the Pipeline

Platform controls, signal-level defences, context pairing, private learning, RF obfuscation

D

Part D: People, Ethics and Regulation

Bystanders, contextual integrity, the DPDP Act, a case study, open problems

Indian Institute of Technology Kharagpur

Why Ubicomp Needs Its Own Threat Model

No perimeter

Devices live in homes, on bodies and across cities. No firewall separates a trusted inside from an untrusted outside.

No screen

Many devices have no display or keyboard. Notice, consent, alerts and pairing all need new channels.

Always on

Sensors stream continuously. Harm comes from inference over long time series, not from one leaked record.

Analog front door

The input is the physical world. Anyone who can emit sound, light or RF near the device can write into it.

Each attack in this lecture exploits at least one of these four assumptions

Indian Institute of Technology Kharagpur

Who Is the Adversary?

Write the threat model first: where the adversary sits, what it can observe, what it can transmit

Indian Institute of Technology Kharagpur

Attack Surface Along the Sensing Pipeline

1. Physical world

Optical, acoustic and RF eavesdropping

2. Transducer

Resonance, ultrasound, laser, EMI injection

3. Analog chain, ADC

Nonlinear demodulation, aliasing, saturation

4. Firmware, OS

Zero-permission reads, malicious apps

5. Network

Traffic metadata, spoofed devices

6. Cloud, models

Linking, inference, model attacks

• Part A attacks the pipeline to learn something; Part B attacks it to control something
• Stages 1 to 3 are analog: encryption, authentication and access control cannot reach them
• Parts C and D defend the whole chain, from physics up to policy

Cryptography protects only the right half of this pipeline

Indian Institute of Technology Kharagpur

Part A

Sensors as Side Channels

Learning secrets from signals that were never meant to carry them

Zero-permission motion sensors

Keystrokes and speech from IMUs

RF, optical and metadata channels

Body signals as identifiers

Indian Institute of Technology Kharagpur

The Enabler: Motion Sensors Need No Permission

• Default: an app, and often a web page, reads accelerometer and gyroscope without asking
• Motion data looked harmless in 2010; today we know it leaks
• Asymmetry: microphone needs permission, accelerometer does not
• yet both can pick up speech, as we will see
• Platforms now limit rate and context, not access

Android 12 onward

Apps capped at 200 Hz for motion sensors unless they declare HIGH_SAMPLING_RATE_SENSORS

iOS 13 onward

Web pages must call DeviceMotionEvent.requestPermission() in Safari

W3C Generic Sensor API

Secure context, focused frame and reduced frequency as mitigations

Rate caps shrink the channel but do not close it. Gyrophone (2014) worked under a 200 Hz cap.

Indian Institute of Technology Kharagpur

Keystrokes and PINs Leak Through Device Motion

• Physics: a tap at each screen position tilts and rotates the phone slightly differently
• Pipeline: segment taps, extract rotation and tilt features, classify the key
• the gesture pipeline you built, with a new label set
• Watch out: the leaking device need not be the one being typed on

Same segmentation and classification pipeline as gesture sensing, pointed at a secret

Indian Institute of Technology Kharagpur

Speech Leaks Into Motion Sensors

Coupling

Sound pressure moves the MEMS proof mass. The phone's own loudspeaker, on the same board, couples far more strongly than air.

Aliasing helps the attacker

Speech energy above half the sampling rate folds into the reported band. A 200 Hz cap does not remove it.

Recovery

Spectrogram features and a learned model recover speaker identity, words or digits.

No microphone permission is needed to hear the user in some settings

Indian Institute of Technology Kharagpur

WiFi and mmWave Sensing as Remote Surveillance

WiKey (MobiCom 2015)

Finger and hand motion while typing leaves distinct patterns in WiFi CSI. A nearby receiver recovers keystrokes.

WindTalker (CCS 2016)

A rogue hotspot collects CSI from the victim's phone and infers the PIN typed into a payment app.

mmSpy (IEEE S&P 2022)

An mmWave radar senses tiny earpiece vibrations and reconstructs the speech of a phone call.

• Threat model: the attacker needs only radio access; nothing runs on the victim device
• Consequence: no permission system on the phone can stop these attacks

The vital sign sensitivity we celebrated is the same sensitivity mmSpy exploits

Indian Institute of Technology Kharagpur

Anything That Vibrates or Flickers Is a Microphone

Visual Microphone (SIGGRAPH 2014)

High-speed video of a chip packet or a plant leaf recovers the sound that made it vibrate.

Lamphone (2020)

An electro-optical sensor aimed at a hanging bulb from a distance recovers room speech from its vibration.

Glowworm (2021)

The power LED of a speaker or hub changes intensity with power draw, which follows the audio.

• General rule: a transducer is any object whose observable state depends on the secret
• Many such objects were never designed as sensors, so nobody secures them

Exercise: find one unintended transducer in your own room

Indian Institute of Technology Kharagpur

Encrypted Traffic and Power Usage Still Talk

Smart home traffic

Apthorpe et al. (2017): the rate of encrypted IoT traffic reveals sleep times, presence and device use. A camera that uploads more on motion leaks motion.

Smart meters

Greveler et al. (2012): fine-grained electricity readings reveal appliance use, and in some cases the content shown on a TV.

• Defences: traffic shaping, padding and cover traffic; coarse or aggregated meter readings
• Cost: bandwidth and energy, which battery-powered devices often cannot spare

Encryption hides content. It does not hide timing, volume or the shape of power draw.

Indian Institute of Technology Kharagpur

Body Signals Are Quasi-Identifiers

Gait

Walking patterns from a pocket accelerometer are distinctive enough to identify people across sessions.

ECG morphology

The shape of the heartbeat is studied and used as a biometric. A health stream is also an identity stream.

Location traces

The Strava global heatmap (2018) exposed routes inside military bases, built only from fitness tracks.

Inferred health

Activity, sleep and heart rate streams reveal stress, illness and routine, even without labels.

Removing names does not anonymise a continuous body signal

Indian Institute of Technology Kharagpur

Part B

Attacks on Sensing Integrity

Writing false values into the physical input of a system

Transduction attacks: a taxonomy

Acoustic injection into MEMS

Inaudible voice commands

EMI, GNSS and radar spoofing

Indian Institute of Technology Kharagpur

Transduction Attacks Exploit Sensor Physics

In-band

The attack signal sits in the band the sensor is meant to measure: replayed speech, spoofed GNSS, a fake radar echo. Hard to filter because it looks legitimate.

Out-of-band

The signal sits outside the intended band and is folded in by an unintended path: resonance, amplifier nonlinearity or ADC aliasing. Examples: ultrasound, lasers, EMI.

• Key idea: software that trusts sensor readings inherits every weakness of the analog path
• Framework: Yan, Xu and Fu, SoK: A Minimalist Approach to Formalizing Analog Sensor Security, IEEE S&P 2020

The digital value is only as trustworthy as the analog path behind it

Indian Institute of Technology Kharagpur

Sound Can Steer MEMS Gyroscopes and Accelerometers

• Resonance: a MEMS proof mass has a mechanical resonant frequency, often in the kHz range
• a loud tone there makes it oscillate strongly
• Folding: the sampled output carries the tone at an alias frequency
• a controlled tone gives a controlled false reading

f_out = | f_inj − k · f_s |

alias of an injected tone near resonance

The aliasing rule from the digitisation lecture, now in the hands of an adversary

Indian Institute of Technology Kharagpur

Inaudible Commands Reach the Voice Assistant

s_in = (1 + m(t)) cos(ωt)

s_out ≈ a₁ s_in + a₂ s_in²

ω is the ultrasonic carrier. The square term recreates the command m(t) inside the microphone, where no later filter can remove it.

• The human hears nothing; the microphone circuit demodulates the command itself

Nonlinearity turns an out-of-band signal into an in-band command

Indian Institute of Technology Kharagpur

EMI and GNSS Spoofing

Ghost Talk (IEEE S&P 2013)

Low-power EMI coupled into the analog leads of sensors injected false signals into cardiac devices and microphones. Medical wearables are in scope.

GNSS spoofing

In 2013 a University of Texas team led by Todd Humphreys steered a yacht off course with counterfeit GPS signals. The open civil signal carries no authentication.

• Location is an input for geofenced attendance, fleet tracking and drone return-home
• Each such service trusts a signal that anyone can transmit

If anyone can transmit it, a system should not trust it alone

Indian Institute of Technology Kharagpur

Radar Spoofing and Adversarial Sensing Models

Radar spoofing

MadRadar (NDSS 2024): automotive FMCW radar made to see false objects, lose real ones or misplace them, by an attacker who learns radar parameters on the fly.

Adversarial inputs

Small crafted perturbations to IMU or CSI inputs flip a classifier's label. The attacker must realise them through the physical channel.

Poisoning

Crowdsourced and federated training data can be poisoned so the model fails on a trigger pattern chosen by the attacker.

Open question: robustness under physically realisable perturbations, not just bounded digital noise

Indian Institute of Technology Kharagpur

Part C

Defences Across the Pipeline

From platform policy down to the analog front end

Platform controls and gaps

Signal-level defences

Pairing and keys from context

Private learning and RF obfuscation

Indian Institute of Technology Kharagpur

Platform Controls and Their Gaps

Should sensors be grouped by what they can reveal, rather than by what they measure?

Indian Institute of Technology Kharagpur

Signal-Level Defences

Shield and filter

Acoustic damping around MEMS parts, EMI shielding on leads and proper low-pass filtering before the ADC remove many out-of-band paths.

Randomise sampling

Random or phase-shifted sampling instants break the clean alias an attacker relies on, as the WALNUT authors suggest.

Cross-check sensors

Fuse heterogeneous sensors and flag readings that violate physics, such as rotation without matching acceleration.

Challenge the channel

PyCRA (CCS 2015) turns an active sensor's transmitter off at random moments. Energy received during silence reveals an attacker.

Defend the analog path with physics and redundancy, not with cryptography

Indian Institute of Technology Kharagpur

Pairing Without Screens Using Shared Context

• Problem: how do two headless devices pair securely?
• Idea: co-located devices observe nearly the same ambient signal; use it as proof of proximity or shared randomness

Amigo (UbiComp 2007)

Compares WiFi signal strength traces from both devices to confirm co-location before authenticating a key exchange.

ProxiMate (MobiSys 2011)

Uses fading of ambient FM and TV signals, which decorrelates over a short distance, to derive a shared key.

Limits

An attacker close by sees a similar signal. Entropy per second is low, so pairing takes time.

The leakage of Part A, turned into an authentication signal

Indian Institute of Technology Kharagpur

Keys From Signals on the Same Body

H2H (CCS 2013)

An implanted device and a programmer on the skin both measure the heartbeat. Inter-pulse intervals give shared random bits.

Walkie-Talkie (IPSN 2016)

Devices worn on the same body derive keys from the gait acceleration they both feel while walking.

Device A

Measures signal w

Gen(w)

Outputs key R and public helper P

Device B

Measures noisy w′, receives P

Rep(w′, P)

Recovers R if d(w, w′) ≤ t

Fuzzy extractors (Dodis et al., 2004) turn two noisy readings into the same exact key, while P leaks little about R

Ask: can a remote radar measure the same heartbeat the key came from?

Indian Institute of Technology Kharagpur

Learning From Sensor Data With Privacy

On-device inference

Raw data never leaves the device; only labels or events do. The app or the model output can still leak.

Federated learning

Devices train locally and send updates. Secure aggregation hides single updates, but gradients can be inverted.

Differential privacy

Calibrated noise makes the output barely depend on any one person. A formal guarantee at a cost in accuracy.

Pr[ M(D) ∈ S ] ≤ e^ε · Pr[ M(D′) ∈ S ]

for all neighbouring datasets D, D′ and all output sets S. Smaller ε means stronger privacy.

Indian Institute of Technology Kharagpur

Differential Privacy for Continuous Streams

• Problem: samples are correlated and streams are long
• sequential composition: T samples, each ε-DP, cost T · ε
• Release less: features or events rather than raw samples
• Local DP: randomised response for categorical labels
• Choose the unit of privacy carefully

The privacy unit is a modelling decision, not a parameter to tune

Indian Institute of Technology Kharagpur

Defending Against Passive RF Sensing

IRShield (IEEE S&P 2022)

An intelligent reflecting surface randomises the channel. Communication continues, but a passive eavesdropper's WiFi sensing stops tracking motion.

RF-Protect (SIGCOMM 2022)

A controlled reflector creates phantom human trajectories, so an unauthorised radar sees people who are not there.

Sense only what you need

Process on the sensor and export coarse features, such as range bins or event flags, instead of raw point clouds or CSI.

The person being sensed has no device to configure, so defence must live in the environment

Indian Institute of Technology Kharagpur

Part D

People, Ethics and Regulation

Who is sensed, who consents, and what the law asks for

Bystanders and contextual integrity

India's DPDP Act and Rules

Case study: elder-care radar

Open problems

Indian Institute of Technology Kharagpur

Contextual Integrity and Bystanders

• Nissenbaum (2004): a flow is appropriate when it matches the norms of its context: actors, information type, transmission principle

Bystanders

Visitors, domestic workers and children are sensed by systems they never set up. Radar and WiFi sensing work through walls, so a bystander may be in the next flat.

Design for them: physical notice, sensing zones, and data that cannot single them out

Privacy is about appropriate flows, not about secret versus public

Indian Institute of Technology Kharagpur

What the DPDP Act 2023 Means for Sensing Systems

Timeline

DPDP Rules notified on 14 November 2025, with phased compliance over 18 months.

Hard question

How do you give notice and take consent on a device with no screen, for people who are only passing by?

Sensor-derived inferences about an identifiable person are personal data

Indian Institute of Technology Kharagpur

Case Study: mmWave Fall Detector in an Elder's Home

Indian Institute of Technology Kharagpur

Open Problems

Sensor foundation models

Models trained on many users' sensor data may memorise them. Membership inference is largely unstudied for IMU and RF.

LLM agents with sensor context

Agents reasoning over home or body sensor streams can leak that context through prompts, tools and logs.

Certified physical robustness

Guarantees against attacks that must pass through a real acoustic or RF channel, not just digital noise.

Consent without screens

Usable notice and consent for screenless, shared and through-wall sensing, and for bystanders.

Each of these is a good thesis topic

Indian Institute of Technology Kharagpur

Summary

• Every sensing capability is also a leakage channel: write the threat model first
• Side channels (Part A): motion, RF, light, power and traffic metadata leak keystrokes, speech, identity and health
• Integrity attacks (Part B): resonance, nonlinearity and aliasing let attackers write into sensors from outside the band
• Defences (Part C): platform controls, physics-level checks, context-based keys, private learning, environment-level obfuscation
• People (Part D): judge flows by context, design for bystanders, and treat DPDP consent as a design requirement

The analog front end is part of the attack surface. Cryptography cannot fix it.

Indian Institute of Technology Kharagpur

References and Further Reading

• C. Yan, H. Shin, C. Bolton, W. Xu, Y. Kim, K. Fu, "SoK: A Minimalist Approach to Formalizing Analog Sensor Security", IEEE S&P 2020
• Y. Michalevsky, D. Boneh, G. Nakibly, "Gyrophone: Recognizing Speech from Gyroscope Signals", USENIX Security 2014
• G. Zhang et al., "DolphinAttack: Inaudible Voice Commands", ACM CCS 2017
• T. Sugawara et al., "Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems", USENIX Security 2020
• S. Basak, M. Gowda, "mmSpy: Spying Phone Calls using mmWave Radars", IEEE S&P 2022
• P. Staat et al., "IRShield: A Countermeasure Against Adversarial Physical-Layer Wireless Sensing", IEEE S&P 2022
• M. Rostami, A. Juels, F. Koushanfar, "Heart-to-Heart (H2H): Authentication for Implanted Medical Devices", ACM CCS 2013
• H. Nissenbaum, "Privacy as Contextual Integrity", Washington Law Review 79(1), 2004
• Digital Personal Data Protection Act, 2023, and DPDP Rules, 2025, Government of India

Indian Institute of Technology Kharagpur