The research undertaken with the support of this award focuses on cybersecurity threats to "softphones"; mobile devices including cell phones, small mobile computers,  embedded systems and a myriad of ubiquitous on-line devices.  These threats represent increasingly serious risks to the core of  modern technology and  must be assessed and secured in the near future.

The theme of the proposed work is a broad-based inquiry into two central classes of emerging threats. The first, threats from the user's  standpoint, are that softphones bring the opportunity for new assaults on user privacy and anonymity. From a system standpoint, the phones capacitate potentially catastrophic disruptions of or malicious changes to functionality, both of the phones and  of the networks they use. Our goal is to study and understand such threats and to find ways to identify them and avoid their intended effects.

This was a large award occupying the research efforts of many scientists and resulted  in notable progress in several related areas. The following examples of our activity illustrates the breadth and variety of the scientific work that was produced.

Research Outcomes

We have researched the attack surfaces of smartphone subsystems, with examples such as
* side-channel attacks on sensors (e.g. audio keylogging and visual fingerprinting)
* gait-based owner identification from accelerometer data
* flash-based data leakage due to wear-leveling
These various attack surfaces were incorporated into a broad overview of privacy-preserving technologies in modern smartphones.

We have also identified practical and theoretical directions for defending smartphones against external attacks.  Notable results include:
(i) the design and analysis of a micro-Trusted Computing Base for secure app functionality, and
(ii) a novel implementation of deniable encryption.

We have developed a theoretical framework to formally analyze the vulnerabilities of radio communication protocols (e.g., rate adaptation algorithms) to targeted jamming attacks.  The key contributions of this framework are:

1) The definition of a new metric, referred to as Rate of Jamming (RoJ).
A low RoJ implies that a protocol is highly vulnerable to jamming attacks while a high RoJ implies that the protocol is resilient.
2) The introduction of a new adversarial model which allowed us to establish that several state-of-the-art protocols have low RoJ.
3) The development of counter-measures offering provable performance guarantees.
Using tools from renewal theory we showed that the introduction of randomization in the design of the communication protocols can enhance their resiliency by a factor of 3.

A medical data application for mobile devices  was developed for use in a hospital setting. The app which, includes strong privacy and data security methods, was designed and prototyped in collaboration a medical group at a major area hospital. The app's purpose is to identify and ameliorate surgical risks in post-operative hospital care and to minimize the complications that occur there. The latest version was designed using the Ionic application framework and a prototype implemented for use on iPhones and iPads.


We have developed new approaches to the problem of phone-based authentication, such as authentication of a user to a phone, or authentication of a user to a remote service with the help of a phone. Currently, such authentication is accomplished with the help of passwords or pin codes, which are both insecure and inconvenient. Our approaches will allow authentication with other data, such as user-drawn pictures or biometrics acquired with the phone's sensors. Such data sources are often more secure than passwords, but are difficult to use for authentication because they are inherently noisy.  If noise is too high, then authentication fails.
We have shown how to securely tolerate more noise than was previously thought possible.


Two new classes of attack detection codes (Robust and AMD codes)  were developed which provide security for transmission channels or memory against a variety of  weak and strong attacks.  Compared with similar codes with the same parameters, robust and AMD codes have the highest attack detection probability. Additionally, these codes can be used by mobile devices to provide strong security to secret sharing systems.  Also developed were  a new class of low cost multi-error correcting codes: GTB codes.  GTB codes can be applied to cache and flash memories of phones and computers and provide much  improved reliability for memory recovery from multiple random errors while maintaining the same read/write speed. Finally, a new security scheme against Man-In-The-Middle (MITM) attacks has been designed which can  protect phones  and  networks, and human interface devices (HID) such as keyboards or mice,  from eavesdropping, hijack, tampering, and replay attacks. Our scheme protects phones and computers against all these attacks which no current HID manufacturers do.

Last Modified: 11/23/2016
Modified by: Steven E Homer