Literature Review
Sources/A Conceptual Model of Security Context.pdf
Int. J. Inf. Secur. (2014) 13:571–581 DOI 10.1007/s10207-014-0229-x
R E G U L A R C O N T R I B U T I O N
A conceptual model of security context
Vladimir Jovanovikj · Dušan Gabrijelčič · Tomaž Klobučar
Published online: 8 March 2014 © Springer-Verlag Berlin Heidelberg 2014
Abstract Ubiquitous environments which embrace the trends of enterprise mobility and the consumerization of IT have an increasing social importance. In these envi- ronments, the same device and applications are simultane- ously used for both personal and professional purposes. Such usage blurs the boundaries between personal and profes- sional domains and presents many challenges for information security. Context-aware security has been proposed as a solu- tion for many of them. We argue that the existing approaches are limited and mainly deal with targeted use cases. They do not provide a clear and complete understanding of the context relevant for security, and use contextual information with an arbitrary level of abstraction. In order to address these issues, we propose a conceptual model of security context. The model identifies important concepts of security context and takes related social aspects into account. It represents the security context through a set of concepts at the appropriate level of abstraction. We show that our model is suitable to analyze various situations from the perspective of security and compare them with the existing approaches. The model promises to facilitate the specification and management of security policies containing contextual information as well.
Keywords Security · Context · Ubiquitous computing
1 Introduction
Ubiquitous computing is an intelligent coalition of the physi- cal and virtual world, integrated for the purpose to assist peo- ple in their everyday life [60]. Contemporary mobile devices
V. Jovanovikj (B) · D. Gabrijelčič · T. Klobučar Laboratory for Open Systems and Networks, Jožef Stefan Institute, Jamova cesta 39, 1000 Ljubljana, Slovenia e-mail: [email protected]
are bringing us closer to this vision as a single device capa- ble of supporting multiple functionalities of it [52]. Indeed, it has been shown that a mobile device can facilitate the interaction between people and objects and helps the user to access ubiquitous services [44]. Today, people are already extensively using mobile devices for communication, edu- cation, and entertainment, and enterprises are incorporating them into their practices to increase the efficiency, effective- ness, and convenience of their business processes [7, 8]. As people became attached to their own mobile devices, they insist using them, together with their familiar services, in their professional life as well. Initial positive experiences in the form of lower costs and increased employee productivity and satisfaction have recently caused this to develop into a modern enterprise trend known as the consumerization of IT [15, 18, 29, 42].
The ubiquitous environments encompassing the trends of enterprise mobility and the consumerization of IT has an increasing social importance. It means a user-owned mobile device is used to perform both personal and professional activities, anywhere and anytime. Many of these activities are often performed simultaneously, usually with the same consumer-oriented applications, and this blurs the bound- aries between the domains of personal and professional life. As people increasingly work for more than one organization and in complex collaboration patterns [30], these environ- ments will span over many administrative domains. We refer to these environments as ubiquitous social systems.
Ubiquitous social systems present three main challenges for information security. First, the enforcement of corporate security policies becomes difficult because enterprises have less control over the devices and applications used in their business processes. Since employees are the owners of the devices, enterprises cannot demand they use the strongest security outside the enterprise domain and do not install
123
572 V. Jovanovikj et al.
various applications on their devices. Second, the protection of resources becomes complicated as users make increased interactions with their devices. These interactions are often ad hoc, unplanned and with possible leakages of implicit information due to the modern forms of communication [13, 45, 47]. Finally, the security provision should understand the trade-off between security, performance, and efficiency in order to better utilize the limited hardware resources of mobile devices and operate with minimal human involve- ment [28, 45, 50, 58].
Many researchers have proposed context-aware secu- rity provisioning as a possible solution to overcome the challenges of ubiquitous social systems. However, their approaches provide only limited solutions. They deal only with targeted use cases (e.g., smart spaces: home [16], work- place [3], or hospital [2, 17, 37], mobile workers [23, 34, 59], or network communication [6, 36]) and mainly provide a sin- gle security service (e.g., access control [2, 16, 17, 23, 34, 37, 59], authentication [25, 46], secure channel communication [36, 48], or identity management [24, 56]). The consequences from this are twofold.
First, the existing context-aware security approaches are not based on a clear and complete understanding of the con- text relevant to security. They usually consider it identical to the context in general (e.g., [2, 4, 16, 23, 27, 36, 37, 59]), although it arises from activities relevant to security and is thus specific to the security domain. At the same time, they rarely specify what contextual information they take into consideration. Because of the variety of possible con- textual information, it is difficult to understand what they are aware of and adapt to. In addition, the existing approaches (e.g., [2, 4, 16, 34, 36, 41, 54, 59]) utilize only part of the avail- able contextual information and omit important contextual information, for example the social context.
Second, the existing context-aware security approaches (e.g., [4, 6, 16, 34, 46]) adapt to an arbitrary level of abstrac- tion of contextual information. This can be cumbersome, error-prone and can jeopardize the validity of the security service. Since there is a vast amount of information which can be used as the context, researchers have pointed out that it is more sophisticated for context-aware systems to adapt to contextual information with a higher level of abstraction [10, 19, 61]. These information meaningfully interpret raw sensor data through the process of context reasoning. They better represent the human perception of reality and are more stable than sensor data which can be uncertain and change frequently.
As a solution for ubiquitous social systems, we envision a security system with the following capabilities. Such sys- tem should manage various security mechanisms in order to provide several security services (e.g., access control, data confidentiality and integrity, auditing). It should support dif- ferent levels of security and multiple security mechanisms
for a single security service. Moreover, it should adapt these security levels and mechanisms depending on the domain in which the mobile device is used, and the surroundings. Sev- eral tasks are challenging in the designing and developing of such a security system, and in this paper, we point out the specification of the context relevant for security. A concep- tual model of the security context is required as prerequisite for this task.
This paper addresses the above issues and helps towards a better understanding of the security context. We propose a definition and conceptual model of the security context. The model identifies important concepts of the security con- text, at different levels of abstraction. It introduces several concepts which take into account the socially related aspect. The model represents the security context as a set of con- cepts which we consider to be at the appropriate level of abstraction. We evaluate the flexibility and sufficiency of the model using two methods. First, we use the model to ana- lyze the diverse use cases of ubiquitous social systems. Then, we compare it with the existing approaches, especially with their understanding of the security context. In addition, we point out several gaps in the existing approaches that elicited from the comparison. Our model promises to facilitate the specification of the security context in context-aware secu- rity systems that are applicable for ubiquitous social systems as a whole.
The paper is structured as follows. First, we describe a motivation scenario to illustrate ubiquitous social systems, in Sect. 2. Next, in Sect. 3, we make an overview of related works defining and describing the security context. After- ward, we give our working definition of the security context in Sect. 4. Then, we present our conceptual model of the secu- rity context in Sect. 5. This is followed by a discussion about the applicability of the model and the security requirements of the security context in Sect. 6. We evaluate the model with two methods, and for one of them, we use the scenario from Sect. 2. Finally, we conclude the paper in Sect. 7.
2 Motivation scenario
We present a typical scenario for ubiquitous social systems. It concentrates mainly on activities performed within the pro- fessional domain, since they are the more attractive targets for attacks and thus more challenging for security. However, its translation to the personal and other domains is quite straight- forward. The scenario includes general and simple use cases originating from the area of enterprise mobility. Similar use cases have been described in several works [7, 26, 57] and encountered in common practice. The use cases are further enriched with the characteristics of the IT consumerization, which are a major influence for security. In addition, they take
123
A conceptual model of security context 573
into account the security guidelines for enterprise mobility as presented in standardized security documents [32].
The scenario centers around Alice, a researcher working for the ACME company. Alice is allowed to use her personal mobile device for professional purposes, as well as various consumer applications that she finds productive. She is sat- isfied with this—her favorite file manager and office appli- cations are on the company’s list of allowed applications. However, she feels work to be a bit more difficult without the help from her favorite intelligent personal assistant.
The ACME company requires relevant parts of its secu- rity policy to be implemented on Alice’s device, although it is aware that it does not have full control over the device. In particular, it is interested in using appropriate security mechanisms and having control over its resources that are accessed through the device. Mobile malware is on the rise lately, and applications routinely require extensive permis- sions during installation [38]. Therefore, the company wishes to limit certain functionalities of some applications, such as access to data, sensors, and networks, while completely for- bidding applications whose core functionality is a threat to its resources. For example, intelligent personal assistant appli- cations are forbidden because they send audio recordings to remote servers and can potentially leak confidential company conversations.
Alice is currently participating in several research projects, in which the company collaborates with other partner orga- nizations. For one of them, a meeting is scheduled during a larger conference event hosted by the company. Alice is supposed to present her work at this meeting. The rest of the scenario centers around that particular conference day.
Scene 1: At Alice’s home: Alice is making the final revi- sion of her slides for the presentation. She is using her favorite office app on her mobile device for this purpose. While edit- ing, Alice opens a personal document with the same app. The app should be allowed to only read this document, but not edit it. This prevents it from transferring company data into the personal document. Alice leaves her apartment, while both documents remain open. The presentation slides should be closed automatically.
Scene 2: Coffee break at the hall: Alice and her colleague Bob are reviewing the slides for the meeting on their mobile devices. Alice sends Bob the latest version of the slides over a wireless channel, with her favorite file manager app. Usu- ally, the transmission of unencrypted company documents between colleagues is allowed in company premises, as long as there are only company employees around. However, at that moment, many visitors to the event are present in the hall. Some of them may be from a competitive company, trying to capture an unencrypted communication between ACME employees. Therefore, a secure channel between Alice’s and Bob’s mobile device must be established prior to the trans- mission.
Scene 3: Project meeting at a conference room: Alice is about to present her slides to the project members, using her mobile device. She activates the slideshow from the office app, and this activates the transmission to the projector. As outside the conference room there are people who are not members of this project, a secure channel with the projector is established first. During the presentation, the janitor suddenly enters the conference room. Since he is not a project member, he is not allowed to see the confidential project data on the screen. Therefore, the presentation should be automatically terminated.
Scene 4: On the way home: Alice leaves the company’s premises. According to the company’s security policy, log- ging is mandatory during work. Since Alice has finished work, this should be turned off automatically. Also, all open company documents and intranet pages should be closed. Alice starts her intelligent personal assistant app and requests it to start playing her favorite song. While walking home, she receives a call from her colleague. Prior to taking the call, the assistant app should be terminated and the logging should be turned on again. In addition, Alice should be warned to be careful as she is making a confidential conversation in insecure environment and somebody might listen to it.
3 Related work
The notion of context has been widely discussed during the past years by many researchers from various disciplines, such as computer science, linguistics, and psychology [9]. Although their understanding of context strongly depends on their specific domains, some characteristics of context appear to be common. Context acts as a set of information that influences the behavior of a system, such as the sys- tem’s description, the system’s users, and the environment in which the system operates. However, it arises from activity and includes only those items that are relevant to the partic- ular activity at hand [1, 20].
Only a few works have explicitly defined security context. Johnson [35] combined acknowledged definitions of context and security, and defined the security context as any infor- mation that characterizes the situation of an entity and has security implications. As an entity, she considers the user, the user’s computing device, and the surrounding environment. Kouadri-Mostefaoui [41] defines the security context as a set of information from the user’s and application’s environ- ments that are relevant for the security process. She further describes it as the state of these environments requiring secu- rity interventions. In addition, Bandinelli et al. [6] are con- cerned only with contextual information which originates from the communication between entities and is useful for providing end-to-end security.
123
574 V. Jovanovikj et al.
Existing definitions of the security context are incom- plete and do not represent the full nature of the context. They specify only information about part of the relevant enti- ties, namely the user and the particular device that hosts the context-aware system. This is insufficient for ubiqui- tous social systems, for which contextual information about other surrounding entities (people and devices) need to be also taken into consideration. Moreover, current definitions describe only the static nature of the context, omitting the notion of activities which guide the creation of the security context.
Furthermore, a few works also tried to more precisely describe the security context with taxonomies. Johnson [35] classifies the security context along two dimensions—the rel- evant entity and the affected security objective—and provides simple guidelines to identify the relevant security context. Evesti and Pantsar-Syväniemi [22] define important concepts for the security context and classify them into three groups: (i) the situation context, which contains concepts describing the usage of applications, (ii) the digital context, which con- tains concepts describing the surrounding environment, and (iii) the physical context, which contains concepts describ- ing the execution platform. Cuppens and Cuppens-Boulahia [17] recognize several types of security context in their tax- onomy: the temporal, the spatial, the user-declared, which is related to the user’s intention, and the prerequisite and the provisional contexts, which are related to the preconditions and obligations of activities. In addition, Bandinelli et al. [6] divide the possible security context into several categories: user, device, communication, and application, depending on their origin.
Current taxonomies do not seem very helpful for con- text specification. Although their category types are related to important concepts of the security context, they are still mostly useful only to describe the security context. More- over, they rarely take into account the related social aspect. Only a few of them, [17, 22], try to use social concepts, such as the role of the user and environment and the objective of the user. However, this is done only arbitrarily, without any attempt to define these concepts in a consistent manner.
4 Definition of security context
Our definition of security context combines the notions of security and context. It is based on one of the widely accepted definitions of context given by Day et al. [1]. It further empha- sizes the dynamic nature of context and the role of activities. For clarity, we do not include any explicit definition of secu- rity in it. We refer to security as the protection of resources in order to attain the objectives of confidentiality, integrity, and availability [11, 55]. Our definition of the security context is given below.
Security context is a set of contextual information consid- ered relevant for the process of security, regarding a partic- ular task or activity.
Contextual information is any information that can be used to characterize the situation of an entity. An entity can be a person or a device, which can be seen as a composition of its resources.
Analogously to systems in general [14], security systems can utilize the security context in two ways. Systems that can only present information about the security situation of the resources of interest, depending on the current security context, can be referred to as passive context-aware security systems. On the other hand, systems that automatically adapt their behavior during runtime in accordance with the discov- ered security context, in order to provide a more relevant service, are called active context-aware security systems. In the rest of the paper, the usage of the term context-aware security systems refers to the active ones.
5 Conceptual model of security context
We propose a conceptual model of security context in order to define its notion more precisely. The conceptual model iden- tifies important concepts that constitute the security context and the relations between them (Fig. 1). Many of these con- cepts elicit directly from the motivation scenario in Sect. 2. For example, there are persons (e.g., Alice and Bob) who use devices (e.g., their mobile devices) and perform various
Fig. 1 Conceptual model of security context
123
A conceptual model of security context 575
activities (e.g., share work documents) which are more pre- cisely described with the persons’ intention, social relation, and surrounding environment (e.g., sharing work documents with a colleague at a public event while working). We sepa- rate the identified concepts into three layers: entity, activity, and situation (Fig. 1). Each of them has a different level of abstraction from the perspective of a context-aware system— concepts from a lower layer are used to derive concepts from a higher layer and thus need to be determined beforehand. In fact, this represents how a system becomes aware of the context in which it operates, through the process of context reasoning.
5.1 Entity
An entity performs an activity and thus is the subject whose situation needs to be characterized. Our model centers around two types of entities—a person and a device. A person is a human individual that operates with devices, whereas a device is an object with computing and communication capa- bilities. We denote the set of entities, E = P ∪ Dev, as a union of the set of persons P and the set of devices Dev. Two entities are of particular importance for our discussion: the device that hosts the context-aware security system—the host, h ∈ Dev, and the person operating this device—the user, u ∈ P .
A device can be seen as a composition of three types of resources: data, channel, and method [40]. The data represent an information in a form understandable to devices or per- sons. It can be kept as a file, read from a sensor, or received from another entity. A channel represents a pathway through which the user or any other device communicates with the host. Examples of such pathways are sockets and named pipes. A method represents a software component that imple- ments a certain functionality, which can be executed through its interface (API). Methods are usually combined in applica- tions, which enable achievement of more complex function- alities. We recognize security mechanisms as methods in our model We denote the set of resources as Res = D ∪ M ∪ C , where D is the set of data, M is the set of methods, and C is the set of all active channels that a device, for example h, has.
Entities can be described with various contextual infor- mation that can be acquired from physical and virtual sen- sors. Physical sensors are hardware components, such as GPS, camera, microphone, accelerometer, and many oth- ers which can be already present in contemporary mobile devices, whereas virtual sensors are software components providing contextual information taken from various sources [5], such as applications, protocols, social networks. Contex- tual information can be acquired either from sensors on the host or from an external context provider. Table 1 shows
Table 1 Examples of contextual information, associated with entities
Entity Contextual information
Person Age, gender, relations, religion
Device OS information, owner, location, time
Resource Data value, protocol, sec. mech. strength
examples of contextual information, associated with the rep- resenting entities.
5.2 Activity
An activity is the process in which an entity executes orga- nized operations while trying to accomplish certain goals. It is performed either explicitly by the user while interact- ing with the host or implicitly by the host itself. An activity whose goals are related to the protection of resources is called security activity.
Generally, activities are performed with an application by executing a specific method over resources. Some activities are more complex than other and comprise several activities that are consecutively performed. We represent an activity in our model as a tuple of tuples (app, op, ob j ), where app ⊆ M is the application used for performing the activity, op ∈ M is the method that implements the operation of the activity, and ob j ⊆ Res are the resources upon which the activity is performed, i.e., objects of an activity. We denote the set of all activities as A. For clarity reasons, in the rest of the paper, we represent activities with their description in words. For example, an activity described as “o f f app reads data d1” is represented as a tuple (o f f app, r ead − dat a, d1).
As an example of complex activity, consider an activity described as “o f f app presents data d1”, which comprises several other activities: “o f f app reads data d1”, “o f f app opens channel c1”, and “o f f app shares screen through chan- nel c1”. Similarly, a complex security activity is “app1 estab- lishes confidential channel c1”, which is comprised of several (security) activities that are executed during the SSL protocol handshake.
5.3 Situation
A situation better interprets an activity and gives more mean- ing to it. It describes the state of the relevant entities and the relationship among them [10, 19]. We define several concepts suitable for representing situation. We separate them in two groups—social concepts and properties.
5.3.1 Social concepts
Social scientists have observed that during their life, people do not act simply as individuals in an undefined manner, but
123
576 V. Jovanovikj et al.
take part of various social groups (communities) in order to achieve their goals more easily [21, 43]. The common goals and interests of these groups shape the activities performed within them. Group members divide these activities among themselves according to the qualifications needed to accom- plish them successfully, and this is represented as roles in the social group. The roles and the distribution of activities make social groups highly organized. Depending on these goals and roles, social groups can be categorized into social domains. Examples of social domains include family, friends, workplace, education, health care, research department, city, country, while examples of social groups include their par- ticular realization. A research department social domain, for example, is defined by roles such as the head of the depart- ment, researcher, student or developer, and common goals such as solving scientific challenging problems, proving the feasibility of proposed solutions.
Devices and data can also be associated with social groups. Some devices perform important activities in ubiquitous social systems and are useful for a number of people, not just for a single person. Therefore, they can be consid- ered as members of social groups and can have assigned roles that stem directly from the purpose of their use. Such devices are for example: printers, network access points, pay- ment terminals, access control devices, attendance devices, information devices. On the other hand, a data can have assigned a social group according to the meaning of its content, which is especially important for protection of its confidentiality.
Since people (and devices) are often part of a single social group from a social domain, in the rest of the paper, we will refer to social groups by their social domains, to make things as clear as possible. For example, instead of referring to a particular family as a social group, we will refer to it as a family group, from the perspective of the user. Moreover, we will consider that by default all entities are part of a general social group called public social group.
We refer to an entity which can be a member of a social group as a social entity, se ∈ S E , S E = P ∪ S Dev, where S Dev ⊆ Dev. Let G be a set of possible goals that can result from activities and Rol be a set of possible roles that can represent qualifications needed to successfully accom- plish activities. A social domain sd ∈ S D is defined as a tuple, sd = (gls, r ls), of specific goals gls ⊆ G whose achievement is a reason for social entities to organize in a social group, and a set of specific roles r ls ⊆ Rol accord- ing to which activities that result in goals gls are divided between those entities. A social group, sg ⊆ S E × Rol, is an implementation of a social domain and is defined as a set of tuples (se, r ol) of social entities se and their assigned role r ol, such that all roles are part of a single social domain sd. We represent the set of all social groups as SG.
Based on the notion of social groups, we define three social concepts: focus, association, and setting.
Focus People often consecutively perform activities from different social domains in ubiquitous social systems. Some activities and their related goals are more important than oth- ers at a given moment and are thus considered as primary. For example, while working, a person can quickly do something related to other social domains (e.g., call a friend or read personal email), but their work activities and goals remain primary. The focus describes the primary intention and ori- entation of the user and motivates their behavior at a given moment. We define focus, f ocus ∈ SG as a primary social group for the user at a given moment.
Association Except the user, other entities can also be involved in an activity as participants. We denote the set of participants of an activity a as para ⊆ S E \{u}. It is imprac- tical to represent the participants individually as their number can be large for some activities. Instead, a social group com- mon for all of them describes them better. Let seg ⊆ SG represents the set of social groups that a social entity se is part of. Also, let common : 2S E → 2SG be a function that maps an arbitrary set of social entities B ⊆ S E to an inter- section of social groups they are all part of, common(B) = {sg ∈ SG | ∀se ∈ B(sg ∈ seg )}. Then, we define associa- tion of an activity a, assoca ∈ SG, as a common social group of the user and a non-empty set of participants in that activity, assoca ∈ common({u} ∪ para ), para �= ∅. In case there is a single common social group, association is uniquely deter- mined. However, in case of more than one common social groups between participants, focus can be of help in deter- mining association. If f ocus ∈ common({u} ∪ para ), then assoca = f ocus, else assoca = publi c, since all entities are members of the public social group by default. In addi- tion, if there are no participants in an activity, the association for it is null, assoca = ∅.
Setting Activities are performed in various environments, which can change dynamically in ubiquitous social sys- tems. Except the participants, these environments can com- prise many other social entities, referred to as observers. An observer of an activity is an entity that is near the user or is part of a channel used in that activity. We denote the set of observers of an activity a as obsa ⊆ S E \{u}. In a same way as participants, observers are better described with their common social group than individually. We define setting of an activity a, set ta ∈ SG, as a common social group of the user and a non-empty set of observers of that activ- ity set ta ∈ common({u} ∪ obsa ), obsa �= ∅. Same as for association, focus can be of help in determining setting. If f ocus ∈ common({u} ∪ obsa ), then set ta = f ocus, else
123
A conceptual model of security context 577
set ta = publi c. In addition, if there are no observers for an activity, the setting for it is null, set ta = ∅. 5.3.2 Property
A property is a quality that describes a resource or its usage. We define a property pr as a function that maps a resource r ∈ Res to a certain value. In its simplest form, it is a func- tion pr : Res → {0, 1}. In this case, a value pr (r ) = 1 denotes that the property of the resource is achieved, whereas pr (r ) = 0 denotes the opposite. We denote the set of all properties as P R.
From all properties, security properties of resources are of special importance for our discussion. Generally recog- nized security properties are confidentiality, c, integrity, i , and availability, a [11]. We emphasize that evaluation of security properties of resources should not be seen as ver- ification that security services, or their implementation, pro- vide the particular security properties. Except as contex- tual information, security properties of resources are often used as an indicator of the security system operation. For an activity a, the current values of security properties of all resources that are of interest and are involved in a comprise a tuple, s pr opa = ( pr1(r1), pr1(r2), . . . , prn (rm )), where pri ∈ P R and r j ∈ Res.
5.4 Summary
To sum up, the security context for a particular activity a is a tuple, SecC on = (a, f ocus, assoca , set ta , s pr opa ), con- sisted of the activity itself, the focus of the user, f ocus, the social concepts that characterize a—association, assoca , and setting, set ta , and the current values of the security properties of resources that are currently involved in a. For a continuous activity, the security context is dynamically updated as other activities are performed.
6 Discussion
We show the applicability of our model in an empirical man- ner. First, we use it to analyze the motivation scenario from Sect. 2. During this analysis, we describe a possible operation of a context-aware security system (CASS) that utilizes our model. Then, we compare it with the existing approaches, especially their understanding of the security context. Apart from showing the ability of our model in representing the security context, this comparison is also an evaluation of the understanding and specification of the security context in the existing approaches. Finally, we present the security require- ments of the security context.
6.1 Model application in example scenario
We analyze two scenes from the motivation scenario into more detail. For our analysis, we assume that Alice is the user u and her mobile device is the host h of the context-aware security system that uses our model of secu- rity context. Alice is a member of four social groups: (i) the ACME company, wor k = { Ali ce, Bob}, in which she has a role of researcher, (ii) the particular research project, pr oj ect = { Ali ce, . . .}, in which she also has a role of researcher, (iii) her particular home, home = { Ali ce}, in which she has a role of inhabitant, and (iv) the particular city, publi c = { Ali ce, Bob, j ani t or, . . .}, in which she has a role of citizen. We denote this as u g = {wor k, pr oj ect, home, publi c}. In addition, we assume that Alice’s mobile device will keep information about the structure of the social groups she is member, i.e., about the members and their roles.
Scene 1 Alice registers to the company’s time tracking soft- ware before she starts working. Based on this activity, the CASS changes her focus to her work social group, f ocus = wor k. In order to start reviewing her presentation slides d1, she initiates an activity a1: “o f f app edits data d1”, where o f f app denotes the office application. The CASS needs to examine the security context for this activity before allow- ing or denying it. One can imagine that this is done in the following way. Based on the facts that her focus is the work group and that d1 is assigned for her project group, the CASS changes her focus to the project group, f ocus = pr oj ect . For activity a1, there are no other participants except Alice. Thus, the association for this activity is null. Setting is deter- mined after the CASS scans the environment for wireless signals. Based on the recognized Alice’s access point and TV, which are members of her home social group, as well as a previous activity of arriving home, setting for this activity is set to be Alice’s home group, set ta1 = home. The office app is authorized to edit project data during project focus in home setting. Therefore, CASS allows a1 to be executed. After a1 is started, confidentiality of d1 is set in s pr opa1 as achieved. Furthermore, Alice tries to read the home docu- ment with the office app. After examining the security context in similar manner, the CASS deduces that focus and setting remain the same. The office app has only permissions to read data from other groups during project focus, in order data leakage to be prevented. Thus, the CASS allows this activity too. Finally, Alice leaves her apartment with the documents remained opened. The CASS changes her focus to her public social group, f ocus = publi c. Since it is not allowed for the office app to edit project data in public focus, the con- fidentiality of d1 is deprived. In response, the CASS closes this document.
123
578 V. Jovanovikj et al.
Scene 3 Imagine that Alice uses her mobile device to authen- ticate at the conference room entrance. The project meet- ing is about to begin, so Alice’s calendar notifies about the event start. Based on these two activities, the CASS is able to determine that the Alice’s focus is her project social group, f ocus = pr oj ect . The CASS recognizes that Alice is ini- tiating a complex activity with the office application over the presentation slides, a1: “o f f app presents data d1”. As described in Sect. 5.2, several activities precede this, dur- ing which a channel c1 is established with a projector p1. In order to decide whether to allow or deny a1 (in fact the last initiated activity that led to its recognition), the CASS consults the security context for this activity. Association for a1 can be determined based on information received from the conference room access control system (as a con- text provider) and the structure of Alice’s social groups. As only people from partner institutions are currently present in the room, association for a1 is set to be the project social group, assoca1 = pr oj ect , which is their only common social group. Similarly, setting for a1 can be derived based on various captured wireless signals. Except for the projector p1, which is a member of the work social group p1 ∈ wor k, the signals mainly come from unknown attendants outside the conference room. As a result, the setting for a1 is set to be the public social group, set ta1 = publi c. Presentation of project data in front of project association during project focus and in public setting is allowed only if confidential- ity and integrity of the channel c1 are achieved in advance. Security properties can be derived from previous activities. Since c1 is unprotected, confidentiality and integrity of c1 are not currently achieved. In order a1 to be allowed, the CASS needs to adapt and establishes a secure channel over c1, for example by using the SSL protocol. After the pre- sentation is started, confidentiality of data d1 is set to be achieved in s pr opa1 . Furthermore, when the janitor enters the room, the conference door access control system notifies the CASS. As a result, the security context for a1 is updated. The association for a1 now becomes the public social group, assoca1 = publi c. Since it is not allowed to present project data in front of public association, confidentiality of d1 is deprived. In order to protect confidentiality of d1, the CASS reacts by turning off the screen sharing with the projector.
6.2 Model comparison with existing approaches
We compare our model with various approaches of context- aware and adaptable security. In their characteristics and goals, they are very similar; the differences are mainly in their emphasis—the former are more concerned with the diversity of context and how to utilize it, whereas the latter mainly deal with the adaptation of their behavior. In particular, we map the security context that the existing approaches take into consideration, to our model. Moreover, we specify their
adaptable behavior, which is in fact the security service these approaches provide. The results are presented in Table 2.
The comparison elicited several additional gaps in the existing approaches.
– The existing approaches seriously lack a context specifi- cation. Because of the variety of possible contextual infor- mation, it is difficult to understand what these systems can be aware of and adapt to. As a result, their applicability can become unclear.
– The existing approaches mainly adapt to low-level contex- tual information, acquired directly from sensors. On the one hand, this makes the definition of policies cumber- some and error-prone, because of the granularity, uncer- tainty, and the frequent change of this information. On the other hand, it gives an additional burden to policy evalu- ation and can compromise its performance, as it leads to performing context reasoning during this process.
– The existing approaches rarely use complex activities as contextual information, especially security activities. The creation of their security context is mainly guided by sim- ple activities, which is a poor characteristic.
– Only few approaches [17, 22, 24, 27, 37, 56] take contex- tual information from the social domain into considera- tion. They mainly use the concept of social relation. How- ever, this is done only arbitrarily, without any attempt to define this concept in a consistent manner. Moreover, these approaches mainly use social contextual information to support and describe only activities, despite other possi- ble applications.
– The existing approaches are mainly concerned only with the security properties they can achieve. They evaluate security properties on the basis of the characteristics of the security mechanisms that provide these properties, such as their strength or performance. An exception of this is [54], which tries to evaluate what specific security properties does a set of security activities achieve.
– The existing approaches mainly implicitly try to bal- ance the trade-offs between security and other properties. Except for [46, 48, 51], none of the approaches track other properties more precisely.
6.3 Security requirements of security context
The correct operation of any context-aware system depends on how accurately the contextual information represents real- ity [12, 39]. Since the contextual information directly influ- ence the integrity of context-aware systems, their manipu- lation is an attractive attack vector for these systems. This applies especially to context-aware security systems, whose application is critical and can have rather severe conse- quences for its users. Any incorrect operation of these sys-
123
A conceptual model of security context 579
Table 2 Security context in context-aware security systems
References Name Context Adaptable behavior
Entity Activity Social Property
Person Device Resource Simple Complex Focus Assoc Setting SP OP
Covington et al. [16] Env. roles � � � � AC Al-Muhtadi et al. [3] Cerberus � � � � � A, AC Johnson et al. [34] Shrink-wrap. sec. � � � AC Toninelli et al. [59] Proteus � � � � AC Hachem et al. [27] Mob. Soc. ecosys. � � � � AC Riva et al. [46] Progressive auth. � � � � � � A Evesti and Pantsar-Syväniemi [22] Smart Space Arc. � � � � � � � � Sev.Serv. Spanoudakis et al. [54] Serenity � � � � � � Sev.Serv. Ksiezopolski and Kotulski [36] Adapt. PKI � � � SC Bandinelli et al. [6] CASec for NGN � � � � SC Rocha et al. [48] Adapt. protocols � � � � � SC Kulkarni and Tripathi [37] CA-RBAC � � � � AC Bai et al. [4] ConUCON � � � � AC Strimpakou et al. [56] Daidalos � � � � � IM Frank et al. [24] Persist � � � � � � IM Ahmed and Zhang [2] CRAAC � � � AC Cuppens and
Cuppens-Boulahia [17]
OrBAC � � � � � � AC
Ganger [25] Auth. Confidence � � � A Hulsebosch et al. [31] CS Adapt. Auth. � � � � A Saxena et al. [51] Auto. Sec. FW � � � � � � � A, AC, SC Kouadri-Mostefaoui [41] CoDiS � � � � Sev.Serv. Feth and Jung [23] Data UCON � � � � AC Zhang et al. [62] RelBAC � � � � � AC Sabzevar et al. [49] Chameleon � � � � � AC
A checkmark (�) denotes that the system takes into consideration this type of contextual information. Please note that a mark in the device column denotes that the system takes into consideration contextual information about the device as a whole Assoc association, SP security property, OP other property, AC access control, A authentication, SC security channel, IM identity management, Sev.Serv. several services
tems can compromise them and cause an (easier) exploitation of resources of interest they are protecting.
Contextual information needs to be appropriately secured and verified prior to its use in context-aware security sys- tems, in the same manner as data in general. In particular, three integrity properties of data need to be assured [53]: (i) data integrity, which is the property that the value contained in the data have not been changed in an unauthorized man- ner, (ii) source integrity, which is the property of the data to be trustworthy, based on its source, and (iii) correctness integrity, which is the property that the underlying informa- tion represented by the data is accurate and consistent. For this purpose, standard security mechanisms for data security can be used [33]. In addition, the confidence in correctness
of contextual information can be built on the basis of their quality, usually represented through accompanying quality parameters [12, 39].
7 Conclusion
Ubiquitous social systems require context-aware security provisioning. However, the existing approaches are not applicable as they do not have a clear and complete under- standing of the security context and use contextual infor- mation with an arbitrary level of abstraction. We proposed a conceptual model of the security context to address these issues. The model identified the important concepts of the
123
580 V. Jovanovikj et al.
security context, introducing several social concepts defined in a consistent manner. We demonstrated the flexibility and sufficiency of our model with two methods. First, we applied it to analyze a typical ubiquitous social system scenario from the perspective of security. Then, we compared it with the existing approaches, especially regarding their understand- ing of the security context. We observed several additional issues of existing systems from this comparison. Addition- ally, we discussed the security requirements of the security context.
Our conceptual model of the security context brings sev- eral benefits. It may facilitate the specification, management, and reuse of security policies for ubiquitous social systems, as it introduces meaningful concepts with a higher level of abstraction. At the same time, it may improve the process of policy evaluation, as it promotes the decoupling of this process from the context reasoning. As a result, our model promises to improve the design and development of context- aware security systems that overcome many of the security challenges of ubiquitous social systems.
Acknowledgments This work was supported by the Slovenian Research Agency (ARRS).
References
1. Abowd, G.D., Dey, A.K., Brown, P.J., Davies, N., Smith, M., Steggles, P.: Towards a better understanding of context and context- awareness. In: Gellersen, H.W. (ed.) Handheld and Ubiquitous Computing. Lecture Notes in Computer Science, vol. 1707, pp. 304–307. Springer, Berlin (1999)
2. Ahmed, A., Zhang, N.: Towards the realisation of context-risk- aware access control in pervasive computing. Telecommun. Syst. 45(2–3), 127–137 (2010)
3. Al-Muhtadi, J., Ranganathan, A., Campbell, R., Mickunas, M.D.: Cerberus: a context-aware security scheme for smart spaces. In: Proceedings of the IEEE International Conference on Pervasive Computing and Communications, PerCom ’03, pp. 489–496. IEEE Computer Society (2003)
4. Bai, G., Gu, L., Feng, T., Guo, Y., Chen, X.: Context-aware usage control for android. In: Jajodia, S., Zhou, J. (eds.) Security and Pri- vacy in Communication Networks, Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunica- tions Engineering, vol. 50, pp. 326–343. Springer, Berlin (2010)
5. Baldauf, M., Dustdar, S., Rosenberg, F.: A survey on context-aware systems. Int. J. Ad Hoc Ubiquitous Comput. 2(4), 263–277 (2007)
6. Bandinelli, M., Paganelli, F., Vannuccini, G., Giuli, D.: A context- aware security framework for next generation mobile networks. In: Schmidt, A., Lian, S. (eds.) Security and Privacy in Mobile Information and Communication Systems. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecom- munications Engineering, vol. 17, pp. 134–147. Springer, Berlin (2009)
7. Basole, R.C.: The value and impact of mobile information and com- munication technologies. In: Proceedings of the IFAC Symposium on Analysis, Modeling & Evaluation of Human-Machine Systems, pp. 1–7 (2004)
8. Basole, R.C.: The emergence of the mobile enterprise: a value- driven perspective. In: International Conference on the Manage- ment of Mobile Business, ICMB 2007, pp. 41–41. IEEE (2007)
9. Bazire, M., Brézillon, P.: Understanding context before using it. In: Dey, A., Kokinov, B., Leake, D., Turner, R. (eds.) Modeling and Using Context. Lecture Notes in Computer Science, vol. 3554, pp. 29–40. Springer, Berlin (2005)
10. Bettini, C., Brdiczka, O., Henricksen, K., Indulska, J., Nicklas, D., Ranganathan, A., Riboni, D.: A survey of context modelling and reasoning techniques. Pervasive Mob. Comput. 6(2), 161–180 (2010)
11. Bishop, M.A.: The Art and Science of Computer Security. Addison- Wesley, Boston (2002)
12. Buchholz, T., Schiffers, M.: Quality of context: What it is and why we need it. In: Proceedings of the 10th Workshop of the OpenView University Association: OVUA’03 (2003)
13. Campbell, R., Al-Muhtadi, J., Naldurg, P., Sampemane, G., Mick- unas, M.D.: Towards security and privacy for pervasive computing. In: Okada, M., Pierce, B., Scedrov, A., Tokuda, H., Yonezawa, A. (eds.) Software Security : Theories and Systems. Lecture Notes in Computer Science, vol. 2609, pp. 1–15. Springer, Berlin (2003)
14. Chen, G., Kotz, D.: A survey of context-aware mobile comput- ing research. Technical report, Department of Computer Science, Dartmouth College (2000)
15. Clarke, J., Hidalgo, M.G., Lioy, A., Petkovic, M., Vishik, C., Ward, J.: Consumerization of IT: top risks and opportunities. Techni- cal report, European Network and Information Security Agency (ENISA) (2012)
16. Covington, M.J., Long, W., Srinivasan, S., Dev, A.K., Ahamad, M., Abowd, G.D.: Securing context-aware applications using environ- ment roles. In: Proceedings of the ACM Symposium on Access Control Models and Technologies, SACMAT ’01, pp. 10–20. ACM (2001)
17. Cuppens, F., Cuppens-Boulahia, N.: Modeling contextual security policies. Int. J. Inf. Secur. 7(4), 285–305 (2008)
18. D’Arcy, P.: CIO strategies for consumerization: the future of enter- prise mobile computing (2011)
19. Dey, A.K.: Understanding and using context. Pers. Ubiquitous Comput. 5(1), 4–7 (2001)
20. Dourish, P.: What we talk about when we talk about context. Pers. Ubiquitous Comput. 8(1), 19–30 (2004)
21. Engeström, Y., et al.: Activity theory and individual and social transformation. Perspectives on activity theory, pp. 19–38 (1999)
22. Evesti, A., Pantsar-Syväniemi, S.: Towards micro architecture for security adaptation. In: Proceedings of the European Conference on Software Architecture: Companion Volume, ECSA ’10, pp. 181– 188. ACM (2010)
23. Feth, D., Jung, C.: Context-aware, data-driven policy enforcement for smart mobile devices in business environments. In: Schmidt, A., Russello, G., Krontiris, I., Lian, S. (eds.) Security and Pri- vacy in Mobile Information and Communication Systems. Lec- ture Notes of the Institute for Computer Sciences, Social Infor- matics and Telecommunications Engineering, vol. 107, pp. 69–80. Springer, Berlin (2012)
24. Frank, K., Kalatzis, N., Roussaki, I., Liampotis, N.: Challenges for context management systems imposed by context inference. In: Proceedings of the International Workshop on Managing Ubiqui- tous Communications and Services, MUCS ’09, pp. 27–34. ACM (2009)
25. Ganger, G.R.: Authentication confidences. In: Proceedings of the Workshop on Hot Topics in Operating Systems, HOTOS ’01, p. 169. IEEE Computer Society (2001)
26. Giessmann, A., Stanoevska-Slabeva, K., De Visser, B.: Mobile enterprise applications: current state and future directions. In: Pro- ceedings of the 45th Hawaii International Conference on System Science, HICSS 2012, pp. 1363–1372. IEEE (2012)
27. Hachem, S., Toninelli, A., Pathak, A., Issarny, V.: Policy-based access control in mobile social ecosystems. In: Proceedings of the IEEE International Symposium on Policies for Distributed Systems
123
A conceptual model of security context 581
and Networks, POLICY ’11, pp. 57–64. IEEE Computer Society (2011)
28. Haque, M., Ahamed, S.I.: Security in pervasive computing: current status and open issues. Int. J. Netw. Secur. 3(3), 203–214 (2006)
29. Harris, J., Ives, B., Junglas, I.: IT consumerization: when gadgets turn into enterprise IT tools. MIS Q. Exec. 11(3), 99–111 (2012)
30. Hines, A., Carbone, C.: The future of knowledge work. Employ. Relat. Today 40(1), 1–17 (2013)
31. Hulsebosch, R., Bargh, M., Lenzini, G., Ebben, P., Iacob, S.: Con- text sensitive adaptive authentication. In: Kortuem, G., Finney, J., Lea, R., Sundramoorthy, V. (eds.) Smart Sensing and Context. Lec- ture Notes in Computer Science, vol. 4793, pp. 93–109. Springer, Berlin (2007)
32. ISO/IEC: ISO/IEC 27002:2005: Information technology— Security techniques—Code of practice for information security management. Technical Report 27002:2005, ISO/IEC (2005)
33. ITU-T: Security architecture for open systems interconnection for CCITT applications. Technical Report. Recommendation X.800, International Telecommunications Union (ITU) (1991)
34. Johnson, G., Shakarian, P., Gupta, N., Agrawala, A.: Towards shrink-wrapped security: practically incorporating context into security services. Procedia Comput. Sci. 5, 782–787 (2011)
35. Johnson, G.M.: Towards shrink-wrapped security: a taxonomy of security-relevant context. In: Proceedings of the IEEE International Conference on Pervasive Computing and Communications, Per- Com ’09, pp. 1–2. IEEE Computer Society (2009)
36. Ksiezopolski, B., Kotulski, Z.: Adaptable security mechanism for dynamic environments. Comput. Secur. 26(3), 246–255 (2007)
37. Kulkarni, D., Tripathi, A.: Context-aware role-based access con- trol in pervasive computing systems. In: Proceedings of the ACM Symposium on Access Control Models and Technologies, SAC- MAT ’08, pp. 113–122. ACM (2008)
38. La Polla, M., Martinelli, F., Sgandurra, D.: A survey on security for mobile devices. Commun. Surv. Tutor. IEEE 15(1), 446–471 (2013)
39. Lacoste, M., Privat, G., Ramparany, F.: Evaluating confidence in context for context-aware security. In: Ambient Intelligence, pp. 211–229. Springer (2007)
40. Manadhata, P.K., Wing, J.M.: An attack surface metric. IEEE Trans. Softw. Eng. 37(3), 371–386 (2011)
41. Kouadri-Mostefaoui, G.: Towards a conceptual and software framework for integrating context-based security in pervasive envi- ronments. Ph.D. thesis, University of Fribourg (2004)
42. Niehaves, B., Köffer, S., Ortbach, K.: IT consumerization: a the- ory and practice review. In: Americas Conference on Information Systems, AMCIS 2012 (2012)
43. Nissenbaum, H.F.: Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford Law & Politics (2010)
44. Papadopoulou, E., Gallacher, S., Taylor, N.K., Williams, M.H.: A personal smart space approach to realising ambient ecologies. Pervasive Mob. Comput. 8(4), 485–499 (2012)
45. Ramakrishna, V., Eustice, K., Schnaider, M.: Approaches for ensur- ing security and privacy in unplanned ubiquitous computing inter- actions. In: Reiher, P., Makki, K., Pissinou, N., Makki, S., Makki, S. (eds.) Mob. Wirel. Netw. Secur. Priv., pp. 167–189. Springer, US (2007)
46. Riva, O., Qin, C., Strauss, K., Lymberopoulos, D.: Progressive authentication: deciding when to authenticate on mobile phones. In: Proceedings of the USENIX Security Symposium, Security ’12, pp. 15–15. USENIX Association (2012)
47. Robinson, P., Beigl, M.: Trust context spaces: an infrastructure for pervasive security in context-aware environments. In: Hutter, D., Müller, G., Stephan, W., Ullmann, M. (eds.) Security in Pervasive Computing. Lecture Notes in Computer Science, vol. 2802, pp. 157–172. Springer, Berlin (2004)
48. Rocha, B.P., Costa, D.N., Moreira, R.A., Rezende, C.G., Loureiro, A.A., Boukerche, A.: Adaptive security protocol selection for mobile computing. J. Netw. Comput. Appl. 33(5), 569–587 (2010)
49. Sabzevar, A., Sousa, J.: Chameleon: a model of identification, authorization and accountability for ubicomp. In: Hsu, C.H., Yang, L., Ma, J., Zhu, C. (eds.) Ubiquitous Intelligence and Comput- ing. Lecture Notes in Computer Science, vol. 6905, pp. 326–339. Springer, Berlin (2011)
50. Sandhu, R.: Good-enough security. Internet Comput. 7(1), 66–68 (2003)
51. Saxena, A., Lacoste, M., Jarboui, T., Lücking, U., Steinke, B.: A software framework for autonomic security in pervasive envi- ronments. In: McDaniel, P., Gupta, S. (eds.) Information Systems Security. Lecture Notes in Computer Science, vol. 4812, pp. 91– 109. Springer, Berlin (2007)
52. Schmidt, A., Pfleging, B., Alt, F., Sahami, A., Fitzpatrick, G.: Inter- acting with 21st-century computers. Pervasive Comput. 11(1), 22– 31 (2012)
53. Shirey, R.W: Internet security glossary, version 2. Technical Report RFC: 4949, The Internet Engineering Task Force (IETF) (2007)
54. Spanoudakis, G., Kokolakis, S., Gomez, A.M.: Security and Dependability for Ambient Intelligence. Springer, Berlin (2009)
55. Stallings, W., Brown, L.V.: Computer Security: Principles and prac- tice. Prentice-Hall, New Jersey (2008)
56. Strimpakou, M., Roussaki, I., Pils, C., Angermann, M., Robert- son, P., Anagnostou, M.: Context modelling and management in ambient-aware pervasive environments. In: Strang, T., Linnhoff- Popien, C. (eds.) Location- and Context-Awareness. Lecture Notes in Computer Science, vol. 3479, pp. 83–94. Springer, Berlin (2005)
57. The Australian Signals Directorate: Risk management of enter- prise mobility including bring your own device. Technical report, Australian Governament, Department of Defence, Intelligence and Security (2013)
58. Thomas, R.K., Sandhu, R.: Models, protocols, and architectures for secure pervasive computing: challenges and research directions. In: Proceedings of the IEEE Conference on Pervasive Computing and Communications, PerCom ’04, pp. 164–168. IEEE Computer Society (2004)
59. Toninelli, A., Montanari, R., Kagal, L., Lassila, O.: Proteus: a semantic context-aware adaptive policy model. In: Proceedings of the IEEE International Symposium on Policies for Distributed Sys- tems and Networks, POLICY ’07, pp. 129–140. IEEE Computer Society (2007)
60. Weiser, M.: The computer for the 21st century. Sci. Am. 265(3), 94–104 (1991)
61. Ye, J., Dobson, S., McKeever, S.: Situation identification tech- niques in pervasive computing: a review. Pervasive Mob. Comput. 8(1), 36–66 (2012)
62. Zhang, R., Giunchiglia, F., Crispo, B., Song, L.: Relation-based access control: an access control model for context-aware comput- ing environment. Wirel. Pers. Commun. 55(1), 5–17 (2010)
123
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
- c.10207_2014_Article_229.pdf
- A conceptual model of security context
- Abstract
- 1 Introduction
- 2 Motivation scenario
- 3 Related work
- 4 Definition of security context
- 5 Conceptual model of security context
- 5.1 Entity
- 5.2 Activity
- 5.3 Situation
- 5.3.1 Social concepts
- 5.3.2 Property
- 5.4 Summary
- 6 Discussion
- 6.1 Model application in example scenario
- 6.2 Model comparison with existing approaches
- 6.3 Security requirements of security context
- 7 Conclusion
- Acknowledgments
- References
Sources/A Snapshot of Trusted Personal Devices.pdf
O R I G I N A L A R T I C L E
A snapshot of trusted personal devices applicable to transaction processing
David Moreland Æ Surya Nepal Æ Hon Hwang Æ John Zic
Received: 29 February 2008 / Accepted: 9 March 2009 / Published online: 19 April 2009
� Springer-Verlag London Limited 2009
Abstract In recent years, a clear trend has emerged
where businesses need to provide flexible access to its
services so as to increase their usage by a much wider
cross-section of users operating over public infrastructures
but still within a trusted environment. This trusted envi-
ronment must be established between all participating users
and service provider entities before any transactions are
carried out. To meet the challenge of enabling mobile users
to work within a trusted environment on any untrusted
machine, the notion of a trusted personal device (TPD) has
emerged. This paper provides a survey giving a snapshot of
the growing body of work ongoing in the area of TPDs and
the services they support.
Keywords Trusted personal device � Untrusted host � Transaction processing
1 Introduction
Traditionally, people who work within enterprises have
been constrained to operate within carefully managed
infrastructures for reasons of minimizing security risks and
guaranteeing quality of service requirements. However, in
recent years a clear trend has emerged where the business
community needs to provide on-demand access to its ser-
vices in order to make them accessible to a wide cross-
section of users operating over public infrastructures (i.e.,
beyond the administration boundaries of securely-managed
enterprise domains), but still within a secure, private and
trusted context. This business model, which is underpinned
by the progressive utilization of service oriented architec-
ture (SOA) [1] and Web Services technologies [2], has
motivated research in the area of dynamic collaborations
and virtual organizations [3–7] with the key objective of
being able to support a growing number of service appli-
cations within various domains (i.e., eCommerce, eHealth,
eGovernment, etc.), so that these services can be accessible
to users from anywhere at anytime [8]. This business model
fundamentally relies on the provision and support of a
trustworthy environment within which users operate. This
environment must be established between user and service
provider entities before they can proceed with exchanging
information with each other with the understanding that
this environment meets the mutually agreed business
requirements of security, trust and privacy. This presents a
significant challenge to mobile users who need to conduct
business from untrusted host machines.
To meet the challenge of enabling mobile users to work
within a trusted environment on any untrusted machine, the
notion of a trusted personal device (TPD) has emerged.
Essentially this is a device (a fuller explanation of which is
given later on) that constitutes a link in a chain-of-trust
which extends from the trusted environment, established by
the TPD, and within which a client works, to a networked
service provider. A variety of specialized attestation pro-
tocols are used to establish a trusted environment for the
clients and the resources offered by the service provider
before any transactions occur between these entities. The
role of the TPD in this system is to provide the end-point
assurance in the chain-of-trust which enables clients (TPD
users) and service providers (TPD certifiers) to operate
with greater confidence.
D. Moreland (&) � S. Nepal � H. Hwang � J. Zic Networking Technologies Laboratory, CSIRO ICT Centre,
Corner of Vimiera and Pembroke Roads, Marsfield,
NSW 2122, Australia
e-mail: [email protected]
123
Pers Ubiquit Comput (2010) 14:347–361
DOI 10.1007/s00779-009-0235-6
The focus of this paper is to survey the emerging classes
of TPDs that satisfy these requirements. To pull this survey
together, we draw from the referenced sources of a number
of significant commercial and research initiatives covering
a range of device types with associated protocols/mecha-
nisms that enable users to ‘‘connect’’ with the service
provider community such that the confidentiality, integrity
and authenticity of transactions can be certified as being
trustworthy.
The aim of this survey is to provide a snapshot of a
growing body of work ongoing in the area of TPDs and the
services they support. The TPDs included in this review are
small, tamper proof artifacts that are both portable and
mobile. Their portability enables the user to change access
points as they move from one location to another. Their
mobility offers a user the ability to maintain the same
identity irrespective of the terminal used and the point of
network attachment. Depending on the type of personal
device and its scenario of use, a device will be supported
by fit-for-purpose protocols and technologies [e.g., Trusted
Platform Module (TPM), virtual machines] that may be
embedded in the device itself, the host to which the device
is attached or the service provider entity that the device
communicates with.
One obvious class of device that falls within the ambit
of this survey is the ubiquitous smart card in its various
forms. However, since smart cards have already been well
covered in the literature [9], we only consider the more
recent network derivate [10, 11] since it more closely
aligns with the type of TPDs we have in mind for this
survey. We also report on the emerging classes of TPD that
have built-in functionality to facilitate trust as an integral
part of their design. Other well established devices, such as
mobile phones and PDAs, which are considered to be a
type of TPD, are also included in this survey, but more
from a research perspective to explore specific trust issues
in novel scenarios of use.
1.1 Motivational areas
The main motivations for TPD transactional processing are
as follows:
• Collaboration: Flexible and dynamic ways of working are becoming more common place. This is evidenced
by the proliferation of initiatives for collaborative
working over public/private infrastructures [12, 13].
One scenario is where a set of privileged user groups
need to form temporary alliances with each other (e.g.,
the creation of a virtual company) to collectively
benefit from mutually agreeable transient business
opportunities that arise within a dynamic market space
[3, 14]. This way of working however raises trust
management issues (i.e., access control, key manage-
ment, third party mediation, policy conflict resolution)
between disparate user groups who may normally be
competitors, or at least not fully trusted parties, but who
need to work together by sharing each others digital
assets and resources. Trusted devices with appropriate
protocols, of the type addressed in this paper, are
required for collaborative environments to ensure
access to sensitive information but only by trusted
entities.
• eServices: Services are seen to be increasingly present- ing new business opportunities. Underpinning the
adoption of service based systems are the use of SOAs
in their design, and then their implementation using
Web services technologies. However, in order to
substantially increase the scope of trusted applications
and the enabling of new deployment scenarios for
eServices, trust management functionality must be an
integral part of the whole services architecture [15, 16].
This is particularly true within the client domain, which
is where TPDs play their part in addressing trust issues
relating to the environment within which the end user
operates. Expanding on this point, application scenarios
abound where end users need to use untrusted machines
in the public domain with the assurance that their
privacy will not be compromised, e.g., working from
public access points (kiosks/terminals [17–19]) to
securely access remote personal computing resources.
As such there is a real need to address the issue of the
chain-of-trust as it relates to the bigger picture of end-
to-end security. The first weak link in this chain is the
untrusted host machine that end users interface to via a
TPD.
These motivational areas, amongst others, present a
number of significant trust management challenges. How-
ever, this paper focuses on TPDs with associated protocols/
mechanisms for the establishment of trust relationships for
transactional processing between host machines and ser-
vice provider resources located somewhere in the Internet.
The devices covered in this survey encompass a broad class
of research ideas and commercial products, applicable to a
diverse range of applications. We address various facets of
trust that constitute the trustworthiness of transactions,
between users and service providers, namely confidential-
ity, integrity, authentication, non-repudiation, etc.
Our paper is structured as follows. In Sect. 2, we define
trust and TPDs and describe various categories of TPD.
Section 3 gives a brief overview of the network smart card
as a type of TPD. Section 4 gives an overview of three
types of emerging TPDs. Section 5 focuses on research that
enhances PDAs and cell phones for use as TPDs; three
examples are given. We conclude our survey in Sect. 6.
348 Pers Ubiquit Comput (2010) 14:347–361
123
2 Trusted personal devices
2.1 A definition of trust
A common mantra frequently heard today is that, secu-
rity mechanisms and technologies alone are not enough;
the reason being is that they can be and often are
breached by determined attackers. Apart from security,
privacy issues are rapidly coming to the fore as users
wish to maintain their anonymity and control over the
use and dissemination of their personal information in
the face of malicious threats such as identity theft. Fur-
ther, assuring trust, security and privacy of any system
that we operate within must by definition include both
the technological and human socio-legal methods and
support systems.
Complementary to security and privacy is the notion of
trust which may be considered as a means of instilling a
greater measure of confidence in a system by implementing
robust confidentiality, authentication and integrity mecha-
nisms. In this sense, trust augments the overall security and
privacy of a system. Although the following definition of
trust may vary, we regard trust as the expectation that a
device or system will faithfully behave in a particular
manner to fulfill its intended purpose, e.g., a computer is
trustworthy if its software and hardware can be depended
on to perform as expected such that its services are still
available today, unaltered, and behave in exactly the same
way as they did yesterday [20].
2.2 What is a trusted personal device?
One definition of a TPD, proposed by the Integrated secure
platform for interactive Trusted Personal Devices
(InspireD) project [21, 22], is, ‘‘A TPD is a small device
belonging to a single person to enable trusted operations
with other entities in an Information Technology & Com-
munication infrastructure.’’ According to this definition, a
TPD encompasses a wide range of future products opti-
mized for a combination of portability, identification,
security, privacy, and personal data storage. At the time of
writing, a trusted device is typically embodied as a SIM
card, which is utilized in different form factors (i.e., bank
cards, mobile phones, PDAs, etc.). However, InspireD
embraces a common vision of the smart card industry on
how the success of the smart card can be extended dra-
matically from today’s smart card technology through a
major technological evolution. The result of this evolution
is envisaged to be the TPD, where the term TPD does not
define a product in itself but an architectural concept and a
set of technologies applicable to a wide range of future
products with similar or related features. As such the TPD
will be much more than what we understand today’s smart
cards to be. According to InspireD, TPDs will aim to meet
the strong demands for trust, privacy, and security of
sensitive and valuable data in an Ambient Intelligence
Environment (AmI) of ubiquitous computing. This vision
implies a much closer integration of devices with the IT
infrastructure (i.e., they essentially become part of it) for
the purpose of providing full Internet connectivity, which is
also the intention of network smart cards. According to
InspireD, the TPD therefore fulfils the following
requirements:
• Trusted: Strong cryptography supported by dedicated hardware to provide integrated security from the
hardware level through to the application level.
• Personal: A TPD is meant to be a personal belonging, which is convenient to use, provides individual access
control and supports biometrics.
• Device: The TPD is deployed as a device within existing and future networked IT infrastructures. Key
features of the TPD are, amongst others, high-band-
width communication facilities, support of standard
network protocols (TCP/IP), and Web server
functionality.
Again the InspireD project views these requirements as
being embodied in a TPD which is, ‘‘a secure, portable,
personal Web server with optional near field communica-
tion and support of biometric authentication’’. TPDs with
this functionality are already beginning to appear in the
market place. An example of this type of TPD is the net-
work smart card [10, 11]. Furthermore, research is
exploring the utilization of the virtualization for virtual
machines [23] and TPM [24], for advanced access control
and the facilitating of trust management within untrusted
environments of host computers. This research is a catalyst
for investigating various combinations these technologies
for developing new TPDs that can be tailored to specific
application scenarios. With this in mind, we survey
emerging TPDs and the research motivating the next gen-
eration of these devices.
But first we present a classification scheme for the TPDs
that we use to structure the survey of TPDs.
2.3 Classification of trusted personal devices
We classify the TPDs surveyed into the broad categories
depicted in Fig. 1. Our classification scheme is based the
observation that TPDs can fall into either a smart card
branch (as they are currently understood), along with a
branch for the ‘‘super’’ smart cards that represent the
newer, emerging breed of TPDs. These ‘‘super’’ smart
cards move beyond the capabilities and uses of current
devices (largely for authentication and authorization) by
offering increased processing power, high degree of
Pers Ubiquit Comput (2010) 14:347–361 349
123
flexibility that allows the development of multiple novel
applications, possibly co-existing on the same TPD.
2.3.1 Smart cards
Smart cards have been around for decades, and represent a
mature, stable and well understood technology that is used
for a wide range of transaction processing applications,
including mobile communications, bank transactions,
physical and logical access control, network access control,
transportation and digital identity [9]. The privacy and
security aspects of smart cards, for the growing number of
applications in which they are used, are becoming
increasingly important in order to counter malicious
behavior such as identity theft and fraud. However, smart
cards use a different protocol from the ones computers use
to communicate with each other over a network. Because
of these protocol differences, a smart card when ‘‘con-
nected’’ to a computer cannot talk directly to a remote
machine using the network protocols. The computer must
use middleware to do protocol translation so that the two
protocols (i.e., card/computer and computer/network) can
understand each other. This arrangement is required for
example if a smart card needs to communicate with a
remote server on the Internet; middleware is required either
on the host computer or on both the host machine and a
remote server. Furthermore, a smart card needs a card
reader and associated drivers in order to connect with a
computer, but unfortunately most computers do not have
built-in card readers. Therefore, implementing a smart card
solution requires a supporting infrastructure including card
reader, device drivers and middleware for protocol trans-
lation. These technical constraints provided the stimulus
for research into a new generation of smart card known as
the network smart card [11], which talks directly to a
remote service provider via a host machine’s Internet
connection; i.e., sessions are handled by the network smart
card itself with the host machine providing a network
bridge to the remote server. A detailed survey of smart
cards is given in ref. [9] but we only consider the network
smart card in Sect. 3 as one type of TPD.
2.3.2 Emerging breed of TPD
The justification for network smart cards, as outlined in the
following section, is clear. However, in the face of the
increasing number of security and privacy threats leveled at
the smart card space, due to the lucrative potential afforded
by fraud, identify theft and all that this entails, a smart card
must also embody trust technology if it is to be truly
considered a TPD. This implies that the dependency of
smart cards on the perceived trustworthiness of public host
machines, to which they interface, should be eliminated
and that security, based only on cryptography and SSL/
TLS technology, needs to be augmented with trust tech-
nologies and protocols. To satisfy these requirements an
alternative breed of TPD is emerging that specifically
addresses the problem of creating a trusted environment on
an untrusted host using a combination of TPM, to establish
a root of trust, and virtualization technology supporting
virtual machines to provide isolation. As network smart
cards and TPDs evolve, utilizing similar technologies and
form factors (e.g., USB token), the technical distinction
between them will become increasingly blurred. As such
the dominant distinguishing factor between these two
classes of device will no doubt be the application scenarios
of use.
Newer types of TPD, examples of which are described
later on, fall into two broad categories when it comes to
establishing trust. The first provides trust by loading a
trusted environment at boot-time, while the second pro-
vides trust by loading a trusted environment at run-time.
Each category has its own advantages and disadvantages
with regards to usability and security. For example, for the
TPD Classifications
Emerging Breed of TPD
Traditional Smart Card - communication via card reader and middleware
infrastructure
Smart Cards
Network Smart Card - communication via
Internet TCP/IP software stack
Trust establishment at boot-time
Trust establishment at run-time
Fig. 1 TPD classifications
350 Pers Ubiquit Comput (2010) 14:347–361
123
boot-time category of TPDs, a user’s workflow is inter-
rupted as the use of this system requires a reboot of their
computer to load the trusted environment, in some
instances at the exclusion of the user’s normal operating
environment. This means that (1) the user has to interrupt
their work and load the trusted environment and (2) if the
trusted environment does not contain the appropriate soft-
ware, then the user cannot access the required functionality
to resume normal workflows. However, with regard to
security, by rebooting from a ‘‘closed’’ and trusted oper-
ating environment there is more confidence that the
established environment is more trustworthy. A significant
assumption here is made for correct operation of the sys-
tem. This assumption is that the boot sequence of a com-
puter has not been interfered with during the normal,
untrusted operation of the computer (for example, by the
introduction of a rootkit). If this assumption is valid, then
this category of TPD is more trustworthy since it has no
interaction with the native operating system (OS) of the
host machine.
As for the trust establishment of the run-time category of
TPD, the full richness of the host software is available to
the user at all times, so will not impact on normal work
practices and enhances the usability of this additional,
trusted environment for the user. However, the guest
software (OS and applications) is vulnerable to a variety of
well-known attacks from within the host OS [25, 26], and a
critical risk/benefit analysis is required before the system is
deployed and distributed to users. We consider both cate-
gories of TPD in this paper.
3 Network smart card
The network smart card, also known as a network card
[27], Internet smart card [28, 29], WebCard [30], TCP/IP
smart card and IP smart card [31], has two major benefits
over the traditional more well-known smart card, which
are, (1) a significant reduction in costs due to the
elimination of middleware and card reader development,
maintenance and deployment, and (2) the elimination of
the card reader infrastructure barrier, which opens up
opportunities to a much richer space for transactional
processing services over an increasingly pervasive Internet
due to the transparent and secure download and activation
of new card services via USB ports. The technology
choices, shown in Fig. 2 [10], are indicative of how far
network smart card technology has progressed in recent
years. We do not intend to survey all these technologies but
pick out one path (shown by the shaded boxes in Fig. 2)
which is a promising candidate for the network smart card
as a TPD of the future.
Potential TPD devices on this path exhibit some com-
pelling features at various layers:
• Physical layer: Network smart cards may be embodied in the form factor of a USB token, since USB ports
have a number of advantages: (1) they are ubiquitous in
personal computing platforms, (2) many electronic
devices, currently operate at a speed of 480 Mbits/s
(USB 2.0) and will operate at 2.4 Gbits/s for USB 3.0,
which is on the horizon. Also network smart cards
require no card reader or middleware. Although
network smart cards have recently been prototyped
[32], the USB hardware for these cards is yet to mature.
However, the issues hampering USB hardware support
should gradually diminish due to technological
advances. It is therefore quite likely that the USB
token will be the preferred technology of choice for
network smart cards, subject of course to the respective
organizational and enterprise policies.
• Link layer: There are two standards [33] that allow USB devices to be connected together at the link local
level while also offering connectivity to the wider
Internet through allowing the USB protocol to tunnel
Ethernet Frames. These two standards are the USB
Ethernet Networking Control Model (USB-ECM) and
the USB Ethernet Emulation Model (USB-EEM).
However, because USB-EEM is simpler, more
Fig. 2 Technology choices for network smart cards
Pers Ubiquit Comput (2010) 14:347–361 351
123
efficient, has good OS vendor support and has the
flexibility allow multiple USB network devices to
connect to one host, USB-EEM is regarded as the
standard of choice for implementing network smart
cards. For example, Gemalto [32] have recently
released a USB network smart cards that uses the
USB-EEM standard.
• Network/transport layer: Implementing TCP/IP inside a smart card [32] provides connectivity to the Internet for
these devices. Network smart cards still need drivers
but do not require middleware support on the host
machine because they communicate using the same
network protocol stack as do other computers con-
nected to the Internet. As such, TCP/IP smart cards are
essentially network nodes where the hosting computer
performs IP routing for the smart card to send or
receive messages to/from the remote machine.
• Device drivers: Interfacing between the communication hardware and the OS’s communication stack requires
specialized software device drivers. In the case of the
network smart card, the device driver is responsible for
taking Ethernet frames and associated protocols from
the OS and converting it into protocols and message
formats of the USB hardware. USB-EEM has been
endorsed in principle by major vendors (Microsoft,
Apple), and have indicated that they plan to include
USB-EEM drivers [34] in future releases of their OS. In
the mean time, commercially available drivers are
available [35] to allow network smart cards to be used
with current releases of the popular OS.
It is envisaged that future generations of network smart
cards will incorporate virtualization and virtual machine
technology with TPM to enable attestable trusted transac-
tions across the network. This technology, coupled with
full speed USB communication hardware, EEM drivers for
carrying Ethernet frames, TCP/IP and SSL/TLS on card,
will enable the realization of new use case scenarios that
require only a USB token device for trusted and secure
communications. Such a device raises a number of inter-
esting challenges. One of which is, instead of carrying
around a pocket full of USBs, i.e., one per application, as is
the case for current smart card technology (e.g., one per
financial institution) how can a single device be made to
service many applications spanning different enterprises?
This raises some interesting questions regarding device
management such as, who issues this ‘‘universal’’ device (a
central agency on behalf of an enterprise collective?), how
can applications be kept isolated from each other so that
there is no leakage of information between applications
(Type I/II/hybrid VMs?) and how are devices revoked if
lost/stolen? As hinted at above, virtualization, VM and
TPM technologies will play a significant part in answering
some of these, and other, questions and will consequently
motivate research into appropriate mechanisms for the
management of multi-application devices. The combina-
tion of these powerful technologies bodes well for future
generations of network smart card.
4 An emerging breed of TPD
To convey what we mean by this category, we give an
overview of three representative devices. Apart from the
objective of creating a trusted environment on an untrusted
machine, each device surveyed has a network connection
enabling the download of information from anywhere. The
first device, known as trust extension device (TED), is
covered in more detail since we have first hand experience
of it [36, 37]. The other two devices reviewed are Digital
Online Registration and Identification System (DORIS)
with Dynamic Isolation of Virtualized Applications
(DIVA) [38, 39] and Encryptakey [40]. The three devices
surveyed demonstrate the technologies and applications of
use for these new TPDs. We are also aware of other
devices, such as SoulPad [41], which is a portable (USB)
artifact carrying a software stack (guest applications and
OS, encrypted VM, VMM and auto-configuring host OS),
that allows a user to resume a personal computing session,
on an untrusted machine, that was suspended on another
machine. SoulPad is conceptually similar to Internet Sus-
pend and Resume [42] and is self-contained in that it does
not need to connect to the network to download informa-
tion from a remote entity. This is in contrast to the concept
behind the reviewed devices, where TED, Encryptakey and
DORIS/DIVA, enable end users to connect to remote
entities. Categorizing the devices surveyed in accordance
with the classifications outlined above, the current imple-
mentation of TED and DORIS/DIVA establish trust at run-
time whereas Encryptakey and SoulPad establish trust at
boot-time.
4.1 Trust extension device
Within the enterprise environment a common method of
establishing trust between a client and a remote entity is to
use certificates. A remote entity issues a certificate to a
client, which the client then uses to establish a trust rela-
tionship between the local machine on which the client is
working and the remote (certificate issuing) authority.
However we have identified two main shortcomings with
issuing digital certificates, which are:
• Lack of trustworthiness: Certificates are vulnerable to software attacks and as a consequence so is the
information guarded by them.
352 Pers Ubiquit Comput (2010) 14:347–361
123
• Mobility and portability: Digital certificates can be used on any computer to bind an identity to a computer’s
pair of electronic keys which are used to encrypt and
sign digital information. Unless a certificate can be
bound to a machine of use then there is no way of
authenticating the trustworthiness of the machine as a
valid source.
In order to address the first problem, the Trusted Com-
puting Group (TCG) has proposed a hardware-based trus-
ted system. Trusted systems that are specified, for example
in accordance with the TCG [24], are often assumed to be
used in well managed and controlled computing and net-
working elements of an infrastructure typically belonging
to a single enterprise. If however the certificate is bound to
a machine, for example using TPM, then clients must use
this particular machine to establish a trust relationship with
the remote host. This constrains the certificate to a partic-
ular machine. Furthermore, this managed infrastructure and
its elements are assumed to have a completely controlled,
uniform operational environment, including standard set of
applications, OS, hardware platforms and facilities for
issuing, revoking and maintaining encryption keys and
authorization certificates (such as PKI [43]). Because these
assumptions do not hold in situations where there are either
mobile or heterogeneous, unmanaged Internet connected
elements, deployment and uptake of trusted secure systems
based on TPM has not been as successful has been very
limited. The approach with TED for overcoming these
limitations is based on the realization that the issuing
enterprise typically will have complete control of a small,
limited range of functions and applications available to the
users through a standardized operational environment. This
operational environment (hardware platform, drivers, OS
and applications) is completely defined and controlled by
the issuer of the TED when the device is created, and user
based changes are not possible. This allows the deployment
of portable, trusted and secure systems on heterogeneous
computing and networking infrastructure.
Trust extension device was invented to address these
two shortcomings; the first was addressed by using trusted
computing technologies, namely TPM in the TED and the
second by using virtualization technologies. Virtualization
technologies enable the implementation of a virtual
machine [23] (with associated memory, input/output and
network resources) which runs as an application of the host
OS. The key features of TED include:
• Incorporation of trusted computing technologies into a portable device.
• Use of these trusted computing technologies to estab- lish trust.
• The needs for TED to be physically close to, and connected to, an untrusted host that provides the
underlying resources (i.e., computer peripherals and
network connections).
• Use of virtual machine technology in combination with trusted computing technologies to create a trusted
environment on untrusted host machines. The virtual
machine technology creates an operating environment
and the remote attestation technology uses the TPM
microcontroller in the portable device to establish trust.
4.1.1 Context of use
Physically, TED is a ‘‘closed-box’’ system (i.e., tamper
resistant) that can be conveniently carried in the pocket.
TED launches its own OS and a combination of precon-
figured applications and other software service modules
that are loaded by service providers in accordance with the
attestation protocol described in Fig. 3. The central com-
ponent of the attestation procedure is the TED manager,
which issues TEDs offline and verifies their run-time
integrity. The TED manager also acts as a centralized
certifying authority on behalf of multiple third party service
operators. In this arrangement it is possible for a TED to
host service modules (i.e., service applications) from
multiple service providers, with the burden of attestation
for each service provider handled by the TED manager.
The interactions shown in Fig. 3, between a TED, TED
manager and third party service providers, are briefly
described as follows [5]:
• Steps 1 and 2: For the TED manager to act as the certifying authority and trust attester, all service
providers must register themselves and update their
service module signatures with the TED manager.
• Step 3: When a user subscribes to a particular service, the TED sends a request to the service provider to
acquire the appropriate service module.
• Step 4: On receiving the request, the service provider sends a challenge to the TED.
• Steps 5 and 6: On receiving the challenge, the TED’s TPM generates a session key which in turn is used to
digitally sign the ‘‘integrity measurement’’ of the TED.
• Step 7: The Platform Configuration Register stores the integrity measurement, including all existing service
modules (i.e., sm0 … smi), which is sent to the TED manager for verification.
• Step 8: On receipt of the integrity measurement, the TED manager attests its trustworthiness against the
TPM credentials and the service module signatures.
Note that these signatures were previously uploaded by
the service providers in point 2.
• Step 9: After successfully verifying the integrity measurement, the TED manager issues a signed service
credential which is sent back to the TED.
Pers Ubiquit Comput (2010) 14:347–361 353
123
• Step 10: The TED, on receiving and verifying the service credential, sends it in a challenge response to
the service provider.
• Steps 11 and 12: Upon receipt of the challenge response and verification of the service credential (signed by the
TED manager), the service provider issues the
requested service module to the TED.
This protocol shows the applicability of trust attestation
for TED wherever it is plugged into an untrusted envi-
ronment. Also we envisage that a single TED can suffice
for running different applications supported by various
service providers, instead of having a TED per service
provider. To ensure integrity of the whole collaboration
life-cycle all transactions between a TED and a service
provider are mutually attested using procedures similar to
those described in ref. [44].
We believe that the combination of trust portability,
application specificity and service provider independence
coupled with TPM and virtual machine technology distin-
guishes the TED from other TPDs in the same class.
4.1.2 TED emulation
To demonstrate aspects of trust portability, on a simplified
testbed, a software-emulated TED was developed with
associated trust attestation protocols. The emulated TED
fulfils the following criteria:
• The compelling physical attributes of TED, namely, self-contained, powered by the host and portability, are
preserved.
• No special software is required in the host computer to support TED operations.
• There is no need to reboot the host. • The accommodation of a guest OS within a virtual
machine to resemble the self-contained trusted envi-
ronment of an envisaged hardware implementation.
• The primary functionality of TED shall be trust attestable.
A first implementation of an emulated TED was a USB
memory stick preloaded with a number of software pack-
ages. Referring to Fig. 4, the guest OS (Ubuntu v 6.06 [45])
was supported by QEMU virtualization software (v 0.8.2
[46]) to achieve isolation between the guest and host OS.
The QEMU product was selected because its operation
does not require the installation of special drivers in a host
machine. To emulate the TPM function the software-based
TPM Emulator v 0.4 [47] was used which runs on top of
the Ubuntu guest OS.
A simple demonstration of TED portability is shown in
Fig. 5, using an online banking application. Here the TED
manager and the third party service provider are combined
in a single entity. The network was preconfigured for three
laptops where two laptops acted as untrusted hosts and the
third as the TED manager/service provider. The USB was
TPM
TED
3rd party service
provider
TED manager
1. register service provider
2. update all service module signatures
sm0
3. service request
4. challenge
7. pass integrity measurement to the TED manager
smi
9. service credential (certificate signed by the TED manager)
10. challenge response(service cred)
12. challenge success(smj)
5. generate session key
6. generate integrity measurement with the session key
8. verify integrity measurement and generate service credential
11. verify service credential signed by TED manager
Fig. 3 Trust attestation procedures for issuing a service
module to a TED
PC Hardware
Host Operating System
Host ApplicationsVirtualisation Software
Guest Operating System
Secure Applications
TPM
Untrusted Host
Emulated TED
Fig. 4 Functional components of emulated TED
354 Pers Ubiquit Comput (2010) 14:347–361
123
preloaded with the Ubuntu, QEMU and TPM software
packages plus an online banking application. On plugging
the TED into an untrusted host, the QEMU virtual machine
is first launched and once running, the Ubuntu guest OS is
then launched. Again, when the guest OS is running, the
banking client is invoked and automatically attested by the
service provider once the client logs in.
Each transaction in this implementation of the TED
requires that it successfully completes the trust attestation
protocol. For example, client record with account details
are transferred to the TED (see Fig. 6) only once the trust
attestation successfully completes. To demonstrate trust
portability of TED, the USB memory stick upon which it
was implemented was unplugged and inserted into another
untrusted, and as before the online banking application
launched and was trust attested. This arrangement was
successfully demonstrated to and well received by the
members of a commercially based Enterprise Focus Group
[48] in May 2007. Figure 6 shows a demonstration screen
snapshot of the user interface, i.e., the emulated TED
operating within the host environment. Within the QEMU
virtualization window, the Ubuntu guest OS runs the online
banking application to retrieve a customer’s record. A
logging window (used for debugging) shows the operation
of the trust attestation protocol, i.e., a session key is suc-
cessfully attested by the TED manager of the service
provider.
TED Manager and 3rd Party
Service Provider
Untrusted Host #1
Untrusted Host #2
Emulated TED
online banking
application
attestation protocol
Fig. 5 Simplified demonstration of TED portability
Fig. 6 Screen snapshot of the emulated TED demonstrating an
online banking application
Pers Ubiquit Comput (2010) 14:347–361 355
123
4.2 DORIS/DIVA
4.2.1 DORIS
As part of its ‘‘Securing the Intelligent Nation’’ initiative the
Singaporean Ministry of Home Affairs [38] has introduced
a standardized nationwide security smart token called
DORIS which is a ‘‘security innovation driving Singapore’s
nationwide proliferation of personal security devices’’ [39].
This token offers all Singaporean companies and citizens a
single security-certified solution that allows, for example,
corporate PC logon, contractor visitor management, canteen
payment, and biometric entry access. Used as a form of
‘‘mobile identity’’ with multiple factor authentication,
DORIS is also implemented in a USB sized memory stick,
but with the addition of a secure microcontroller, flash-
based, some wireless communications chips and a small
antenna, along side the usual memory. The device com-
municates with a transceiver through a wireless interface
that supports electronic identity and online/offline authen-
tication. DORIS generally supports existing PC applications
because they can leverage off the many encryption and key
management features supported by companies like Micro-
soft and Adobe to ensure information integrity and confi-
dentiality [49]. DORIS is based on the Smart Visa for
Identification with Passport (VIP) [50] and supports virtual
smart cards [51] where a user can have a virtual card for
each organization. One implementation of virtual smart
cards is where DORIS is used in conjunction with digital
identity applications such as Microsoft’s CardSpace [52].
Microsoft CardSpace is an identity selector for Windows
that enables users to provide their digital identity online in a
more simple and secure way. The DORIS token further
enhances its security by providing strong multifactor cre-
dentials for authenticating the Microsoft Security Token
Service [53] when using CardSpace.
However, when plugged into a host machine, DORIS
needs to download the appropriate driver for the virtual
smart card utilized. This presents a number of non-trivial
operational issues, which are addressed by a subsequent
development known as DIVA, as explained in the follow-
ing section.
4.2.2 DIVA
To overcome the limitations of DORIS a software
enhancement was developed called DIVA, which acts as a
user’s own trusted software execution space to provide
secure access to a wide variety of applications. A core
function of the DIVA software is also to authenticate the
identity of a user in an electronic transaction.
When plugged into a PC, DIVA creates an isolated
command window which allows a user to run any
applications within it; at the same time applications con-
tinue to run on the local PC environment but isolated from
the DIVA created command window. By way of example,
when an application runs on the local PC, such as Internet
Explorer (IE), DIVA creates a separate copy of IE and runs
it isolated from the host environment in the command
window; this is what the developers of DIVA call a virtual
application (see Fig. 7). Furthermore, the user interacts
with the virtual application via a virtual keyboard to mit-
igate the risk of key stroke logging attacks. A virtual
application never interacts with a remote entity (e.g., bank
server) directly but rather indirectly via the Web Server
within DIVA. The DIVA Web Server talks to the remote
entity in a peer-to-peer fashion, which provides a safeguard
to help evade many possible attacks.
With DIVA, mobile users’ no longer need to take a PDA
or notebook with them. Instead they can simply plug a USB
device into someone else’s PC (at a Kiosk, hotel/airport,
client’s office, etc.) start DIVA and then work securely in
an isolated and trusted environment. And, when DIVA is
disconnected from the hosting machine no trace of trans-
acted activity remains on the machine.
4.3 Encryptakey
Encryptakey is a small portable (USB form factor) device
that allows mobile users access to their remote data at
anytime, from anywhere using any platform (e.g., Win-
dows, Mac, Linux) such that the data accessed is com-
pletely secure [40]. Encryptakey is a biometrically
authenticated device which offers multiple levels of
authentication and comprises of a specialized microcon-
troller, memory, RFID capability and Bluetooth interface.
One scenario of use for Encryptakey is when a tax agent,
working on behalf of a government tax office, needs to
audit clients’ tax records at the clients’ premises. The agent
plugs Encryptakey into any client PC to create a trusted
environment in which to work when connecting to a remote
machine (e.g., tax office server). The key to creating a
trusted environment on an untrusted host is that En-
cryptakey, when plugged into a local computer, unloads the
native OS of the host machine and downloads its own OS
which it works with exclusively. In doing so Encryptakey
is shielded from any form of malware (e.g., viruses, key
loggers, screen scrapers) that may reside on the OS of the
host machine. Furthermore, the Encryptakey OS is
embedded in its microchip such that it cannot be written to
and hence nothing can be saved. As such the Encryptakey
environment is completely isolated from the untrusted host
machine’s environment. On loading the Encryptakey OS,
the appropriate encryption algorithm is selected and a VPN
tunnel is created providing direct login to a remote
machine for secure download of applications.
356 Pers Ubiquit Comput (2010) 14:347–361
123
Encryptakey embodies the same principle of isolation
for creating a trusted environment on an untrusted host
machine similar to TED and DORIS/DIVA, albeit using a
different technical approach. One significant difference
however between TED and Encryptakey is that TED does
not unload the native OS to install its own OS as En-
cryptakey does, but loads a guest OS atop of the host OS.
5 Enhanced PDAs and cell phones
Trust is recognized to be a significant issue in the suc-
cessful deployment and uptake of specialized, secure
applications. These applications are frequently driven by
the daily demands of commonplace activities like on-line
shopping and remote access to personal computers from
ubiquitous public domain computing terminals. In addition
to network smart cards and the emerging breed of TPD
cited above, recent research [54–56] has demonstrated how
general purpose PDAs and cell phones may be enhanced to
function as TPDs. But before moving on, we need to clarify
that although PDAs and cell phones are already recognized
as being personal trusted devices, in the sense that they are
tamper proof entities operating within a ‘‘closed’’ appli-
cation framework, such as GSM/UTMS or 3 G, they still
require enhancement in order to authenticate the identify
and integrity of credentials prior to the transacting of
sensitive information between local and remote entities in
the context of interfacing to untrusted public machines.
These enhancements strengthen the trust element of
transaction processing for PDAs and cell phones, in the
sense that trust adds to the overall security of the ‘‘closed’’
systems within which these devices operate. Following are
a number of representative examples, each of which is a
very thorough and comprehensive piece of research, of the
type of work ongoing in this area. The first two examples
consider two distinct problems in on-line shopping: pro-
viding non-repudiable proof of transactions, and the second
to prevent illicit capture of sensitive personal information.
The final example shows how the integrity, and hence
trustworthiness, of a publicly accessible information kiosk
can be maintained.
1. Resolving credit card disputes when dealing with on-
line shops remains an issue. For example, the current
resolution mechanisms are not particularly attractive,
with the vendor (or in some circumstances, the issuing
bank) responsible for refunding disputed transaction.
For example, should the customer refute the purchase
of an item from an on-line vendor, the bank must
charge the vendor in order to recover the costs to
reimburse the customer. Usually, the primary cause of
such disputes arises from the fact that there is no
requirement for a strong, non-repudiable signature to
be associated with every electronic credit card trans-
action. The use of on-line certificates and signatures
USB device containing DIVA
DIVA isolated command window running virtual application
Host machine
PC application copied to DIVA command window
Virtual keyboard
Another instance of a command window running a different virtual application
Fig. 7 Dynamic isolation of virtualized applications with
virtual keyboard
Pers Ubiquit Comput (2010) 14:347–361 357
123
from the customer’s computer to provide the non-
repudiable signature is fraught with the usual trust
problems caused by the fact that the customer’s
computer is in an unknown, and possibly malicious,
state and there are no guarantees about the integrity of
the certificates or keys used to sign a transaction. The
solution proposed in ref. [54] is based on the use of a
device such as a Smartphone or GSM connected PDA.
This device comprises of several components:
a. A tamper proof component such as a smart card,
containing information (the customer’s private
key, and a non-repudiation PIN entered by the
customer) that allows the customer to generate the
signed transaction authorization.
b. A small, trusted payment application accessible to
the user.
c. The SIM Application Toolkit (STK) [55] for GSM
systems (or USIM Application Toolkit for 3G
systems) allowing access to value added services
from their handset.
d. A set of security services for subscriber identifi-
cation and protection of the air interface through
STK communication. These services together with
appropriately managed digital signatures, provide
customer authentication and proof of receipt,
assure that messages are delivered without inter-
ference or modification and be used to detect
anomalous behaviors (such those caused by man-
in-the-middle attacks).
This represents a closely controlled application devel-
opment environment and platform, and allows the devel-
opment of tailored security solutions in this prototype TPD.
In order to overcome the credit card dispute problem
pointed out earlier, the TPD prototype is meant to be used as
follows. First, the customer negotiates the purchase through
the use of the Internet connected untrusted computer. When
complete and final payment is required, the smartcard/PDA
uses a combination of the above components and a separate
message authorization channel—the GSM network—from
that of the purchase negotiation—the Internet—is used to
provide the non-repudiable authorization and signatures for
that transaction. This authorization channel (and associated
components and environment) is trusted. The negotiation
channel (i.e., the customer’s computer and Internet connec-
tion) is assumed to be untrusted. By separating out the
transaction to rely on these channels, clearly partitioning the
system into trusted and untrusted components, and applying
the correct protocols allows each on-line credit card trans-
action to have a non-repudiable authorization.
2. The second example [56] is based on using a PDA to
provide user defined access controlled information and
offer a known trusted environment, including a
physically alternate keyboard and secondary display.
This minimizes the risks on any transactions that are
initiated from the PDA: key loggers, screen scrapers
and memory attacks are defeated since the keyboard,
display and memory space (holding sensitive informa-
tion, keys and certificates) are completely separate
from the untrusted computer that the device plugs into.
The intended use is that this modified PDA plugs into
some local, untrusted computer to provide access to
the user’s (remote) home computer. The PDA provides
a secured keyboard and mouse access that is ‘‘invis-
ible’’ to the untrusted local computer, and allows for
portions of the user’s home computer information to be
securely accessed and displayed through the local
untrusted machine and onto the PDA. The user,
through the use of the modified PDA, specifies what
is accessible in their home computer or system, and
authenticates all input events (mouse and keyboard)
against their home computing environment through an
encrypted SSL connection. The PDA never exposes
the authentication credentials used to encrypt the input
events to the untrusted terminal, making it difficult for
the untrusted terminal to issue its own input events.
Furthermore, the PDA also issues and updates time
limited credentials to the untrusted terminal. These
credentials are used to display selected components of
the home computer through the use of a virtual desktop
application executing on the PDA. Upon session
completion and termination, or unplugging of the
PDA from the local untrusted computer, the last issued
credential expires and leaves the local computer
unable to access the user’s remote home computer.
This combination of the PDA features, and allowing
controlled, read only access by the untrusted local
computer assures the user of secure transaction with
their home computer system.
3. Publicly accessible computers are commonly available
at Internet cafés and airport terminals and configured
as kiosks. But although these offer the benefits of free
or low cost publicly accessible Internet connected
computers, little can be assumed about their integrity
or trustworthiness due to the pervasiveness of malware
(e.g., keystroke logging, screen scraping and memory
attacks). In some circumstances, users need to be
assured that transactions and exchange of sensitive
information are secure and the kiosk operates in a
trusted manner. The research presented in ref. [19]
addresses this issue by using a mobile device that
connects to the kiosk to provide the assurance that the
kiosk is running only trustworthy software. This is
done through the use of an attestation protocol to
358 Pers Ubiquit Comput (2010) 14:347–361
123
verify the identity and integrity of the software running
on a kiosk.
It is assumed in the article that each kiosk has a TPM
cryptographic microcontroller built in, and this is used
within an Integrity Measurement Architecture (IMA) [57]
incorporating the mobile device. The mobile device runs an
IMA verifier client, with the kiosk running an IMA server.
The verifier client has access to the expected hash values of
all software components loaded on a kiosk. The kiosk
calculates, through the use of the TPM, the current set of
hash values and (as per the TPM 1.2 specification) signs
them. These two items are then compared, and if the
attestation protocol completes successfully (i.e., the
expected hash values agree with the received IMA mea-
surement list and signed TPM quote), the mobile device
then informs the user that that the kiosk is trustworthy. The
user may then proceed to reveal personal information via
the kiosk. A prototype of this device is described in ref.
[19]. A minor extension of this scenario supports the case
where the user wishes to run their personal applications on
a kiosk. In this case, the trust establishment protocol out-
lined above is modified so as to verify that a kiosk is
running a trustworthy hypervisor environment. Once con-
firmed, the user is then allowed to run a virtual machine
which then executes the user’s personal applications on the
kiosk.
6 Conclusions
Such is the momentum that is building in the area of trust
that it is now timely to take a snapshot, as we have done
within this paper, of an array of representative portable
TPDs, both commercial and research, that enable mobile
users to safely work from anywhere using untrusted host
machines. Although the TPDs surveyed use current tech-
nologies in an innovative way to achieve their desired
objectives, we believe that virtualization, as it becomes
more ubiquitous, will be the dominant technology influ-
encing future generations of TPD. To support this claim,
the TCG [24], have instigated a new work group on vir-
tualized computing platforms. The TCG defines a trusted
virtualized computing platform as ‘‘a platform with an
interface to virtualized hardware, that publishes evidence
about the trustworthiness of the interface and the entity that
implements the interface’’. The charter for this work group
is to create specifications to enable users and third parties
to trust virtualized trusted computing platforms, incorpo-
rating mainstream commercial products like hypervisors
and virtual machines, which are embedded in PC clients,
servers and mobile phones; and also we believe TPDs.
Furthermore, the utilization of virtualized platforms for
different use case scenarios will raise many issues that will
undoubtedly impact the shaping of future of TPDs.
Although smart cards continue to make advances [58], we
believe there will be an increasing overlap with the
emerging breed of TPD brought about by the unifying
influence of virtualization, VMs and TPM.
The focus on TPDs so far has been driven mainly by
technology. However, one important aspect of TPDs that
has not been adequately addressed is their usability. The
usability of the TPDs has two important aspects: the
environment within which they operate and the form factor
of the device. With regard to the form factor, we believe
that the ubiquity and capacity of the USB memory stick
will be a popular choice for TPDs. However, further
analysis is required to ascertain what form factor is likely
to dominate in a particular environment, i.e., USB device,
smart card, mobile phone, etc. The other usability aspect of
TPDs is the environments within which they will operate.
For example, how easy is the TPD to program (software
downloads), how secure are they in untrusted environs,
how well do they perform, can one TPD be used for
multiple organizations? These questions, and others, need
to be rigorously tested and evaluated in ‘‘stretching’’ sce-
narios of use. We believe that there is much further work to
be done in the areas of usability, just outlined, from the
users experience perspective.
References
1. Erl T (2005) Service-oriented architecture (SOA): concepts,
technology and design. Prentice Hall, Upper Saddle River
2. W3C Web Services Activity. http://www.w3.org/2002/ws
3. Chan J, Rogers G, Agahari D, Moreland D, Zic J (2006) Enter-
prise collaborative contexts and their provisioning for secure
managed extranets. In: Proceedings of the 15th IEEE interna-
tional workshops on enabling technologies: infrastructure for
collaborative enterprises (WETICE’06), Manchester, pp 313–318
4. Camarinha-Matos L, Afsarmanesh H (2005) Collaborative net-
works: a new scientific discipline. J Intell Manuf 16:439–452
5. Chan J, Nepal S, Moreland D, Hwang H, Chen S, Zic J (2007)
User-controlled collaborations in the context of trust extended
environments. In: Proceedings of the 16th international work-
shops on enabling technologies: infrastructure for collaborative
enterprises (WETICE’07), Paris, pp 389–394
6. Camarinha-Matos L, Afsarmanesh H, Ollus M (2005) Virtual
organizations: systems and practices. Springer, Boston
7. Plisson J, Ljubic P, Mozetic I, Lavrac N (2007) An ontology for
virtual organization breeding environments. IEEE Trans Syst
Man Cybern C 37(6):1327–1341
8. Henkel M, Perjons E, Zdravkovic J (2007) Towards guidelines
for the evolution of e-service environments. Int J Public Inf Syst
3:183–200
9. Rankl W, Effing W (2004) Smart card handbook. Wiley, New
York
10. Lu H (2007) Network smart card review and analysis. J Comput
Netw 51(9):2234–2248
Pers Ubiquit Comput (2010) 14:347–361 359
123
11. Aussel J (2007) Smart cards and digital security. In: Proceedings
of the 4th international conference on mathematical methods,
models and architectures for computer network security (MMM-
ACNS), St Petersburg, pp 42–56
12. Prinz W, Loh H, Pallot M, Schaffers H, Skarmeta A, Decker S
(2006) ECOSPACE—towards an integrated collaboration space
for eProfessionals. In: The 2nd international conference on col-
laborative computing: networking, applications and worksharing
(CollaborateCom’06), Atlanta, pp 1–7
13. Wilson M, Arenas A, Schubert L (2007) IST-FP6 TrustCoM
framework for trust, security and contract management V4.
http://www.eu-trustcom.com
14. Bobba R, Gavrila S, Gligor V, Khurana H, Koleva (2005)
Administering access control in dynamic coalitions. In: Pro-
ceedings of the 19th large installation system administration
conference (LISA’05), San Diego, pp 249–261
15. Seamons K, Chan T, Child E, Halcrow M et al (2003) Trust-
Builder: negotiating trust in dynamic coalitions. In: Proceeding of
the DARPA information survivability conference and exposition,
vol 2, Washington, pp 49–51
16. Ajayi O, Sinnott R, Stell A (2007) Trust realisation in multi-
domain collaborative environments. In: Proceedings of the 6th
IEEE/ACIS international conference on computer and informa-
tion science (ICIC’07), Melbourne, pp 906–911
17. Asokan N, Debar H, Steiner M, Waidner M (1999) Authenti-
cating public terminals. J Comput Netw 31:861–870
18. Surie A, Perrig A, Satyanarayanan M, Farber D (2006) Rapid
trust establishment for transient use of unmanaged hardware. In:
Technical Report CMU-CS-06-176
19. Garriss S, Caceres R, Berger S, Sailer R, Van Doorn L, Zhang X
(2007) Towards trustworthy Kiosk computing. In: Proceedings of
the 8th IEEE workshop on mobile computing systems and
applications (HotMobile’07), Tucson, pp 41–45
20. Lin C, Varadharajan V (2006) Trust enhanced security—a new
philosophy for secure collaboration of mobile agents. In: Col-
laborative computing: networking, applications and worksharing
(CollaborateCom’06), Atlanta, pp 1–8
21. Bormann F, Manteau L, Linke A (2005) European research
project ‘‘InspireD’’ (http://www.inspiredproject.com)—the future
of smart cards. In: SIT Smart Card Workshop, Darmstadt
22. Bormann F, Manteau L, Linke A, Pailles J, Dijk J (2006) Concept
for trusted personal devices in a mobile and networked envi-
ronment. In: 15th IST mobile and wireless communication
summit, Myconos
23. Smith J, Nair R (2005) Virtual machines: versatile platforms for
systems and processes. Morgan Kaufmann, San Francisco
24. Trusted Computing Group. http://www.trustedcomputinggroup.
org
25. Ormandy T (2007) An empirical study into the security exposure
to hosts of hostile virtualized environments. In: The 8th annual
CanSecWest conference, Vancouver
26. Ferrie P (2006) Attacks on virtual machine emulators. In: The 9th
annual association of antivirus Asia researchers international
conference (AVAR’06), Auckland
27. Montgomery M, Ali A, Lu H (2004) Secure network card—imple-
mentation of a standard network stack in a smart card. In: Proceedings
of the 6th international conference on smart card research and
advanced application (Cardis’04), Toulouse, pp 193–208
28. Giesecke & Devrient Internet Smart Card Technology (2006)
http://www.gi-de.com/portal/page?_pageid=42,54860&_dad=
portal&_schema=PORTAL
29. Urien P (2000) Internet card, a smartcard as a true Internet node. J
Comput Commun 23(17):1655–1666
30. Rees J, Honeyman P (2000) Webcard: a Java card web server. In:
Proceedings of the 4th working conference on smart card research
and advanced application (Cardis’00), Bristol, pp 197–208
31. Zouari B, Afifi H, Hecker A, Labiod H, Pujolle G, Urien P (2003)
A novel authentication model based on secured IP smart cards.
In: Proceedings of the IEEE International Conference on Com-
munications (ICC ‘03), vol 2, Anchorage, pp 809–813
32. Gemalto (formerly Axalto and Gemplus). http://www.gemalto.
com
33. USB Implementers Forum. http://www.usb.org/
34. Remote NDIS (RNDIS) and Windows (2004). http://www.
microsoft.com/whdc/device/network/NDIS/rmNDIS.mspx
35. Belcarra Technologies Extends USBLAN Support for Microsoft
Windows TM
to Include Ethernet Emulation Model (2006).
http://www.belcarra.com/pdf/usb-otg-eem_announce_1.0.pdf
36. Nepal S, Zic J, Hwang H, Moreland D (2007) Trust extension
device: providing mobility and portability of trust in cooperative
information systems. In: Proceedings of the 15th international
conference on cooperative information systems (CoopIS’07),
LNCS 4803, Vilamoura, pp 253–271
37. Nepal S, Zic J (2006) A portable trusted device. In: Provisional
Australian Patent
38. Ministry of Home Affairs Singapore (2006) In: The 15th annual
governmentware securing intelligent enterprises (GovWare’06),
Singapore
39. Gratzer V, Naccache D (2007) Trust on a nationwide scale. IEEE
Secur Priv Mag 5(5):69–71
40. Encryptakey. http://www.encryptakey.com
41. Caceres R, Carter C, Narayanaswami C, Raghunath M (2005)
Reincarnating PCs with portable SoulPads. In: Proceedings of
the 3rd international conference on mobile systems, applica-
tions, and services (MobiSys’05), ACM Press, New York, pp
65–78
42. Kozuch M, Satyanarayanan M, Bressoud T, Helfrich C, Sinna-
mohideen S (2004) Seamless mobile computing on fixed infra-
structure. IEEE Comput 37(7):65–72
43. Adams C, Lloyd S (2002) Understanding PKI: concepts, standards,
and deployment considerations. Pearson Education, London
44. Nepal S, Zic J, Kraehenbuehl G, Jaccard F (2007) A trusted
system for sharing patient electronic records in autonomous
distributed healthcare systems. Int J Healthc Inf Syst Informat
2(1):14–34
45. Ubuntu. http://www.ubuntu.com
46. QEMU. http://fabrice.bellard.free.fr/qemu
47. TPM. http://developer.berlios.de/projects/tpm-emulator
48. CeNTIE Enterprise Systems Focus Group. http://www.ict.csiro.
au/page.php?did=14#enterprise
49. Tan L (2007) Personal security gets DIVA treatment. In: Busi-
nessWeek. http://www.businessweek.com/globalbiz/content/
sep2007/gb20070926_102683.htm?chan=top?news_top?news?
index_global?business
50. Ong A (2004) Smart VIP (smart visa for identification with pass-
port). http://www.ida.gov.sg/Technology/20061002195651.aspx
51. Forget G, Stervinou A (2007) The virtual smart card. Card
Technol Today 19(7–8):12
52. Microsoft Development Network (MSDN) CardSpace. http://
msdn2.microsoft.com/en-au/netframework/aa663320.aspx
53. Microsoft Live Labs Security Token Service (2006) http://sts.
labs.live.com/
54. Bottoni A, Dini G (2007) Improving authentication of remote
card transactions with mobile personal trusted devices. J Comput
Commun 30(8):1697–1712
55. European Telecommunications Standards Institute (ETSI) Digital
cellular telecommunications system (Phase 2?); specification of
the SIM application toolkit for the subscriber identity module—
mobile equipment (SIM–ME) interface. ETSI TS 101 267 (GSM
11.14)
56. Oprea A, Balfanz D, Durfee G, Smetters D (2004) Securing a
remote terminal application with a mobile trusted device. In:
360 Pers Ubiquit Comput (2010) 14:347–361
123
Proceedings of the 20th annual computer security applications
conference (ACSAC’04), Tucson, pp 438–447
57. Sailer R, Zhang X, Jaeger T, Van Doorn L (2004) Design and
implementation of a TCG-based integrity measurement
architecture. In: Proceedings of the 13th USENIX security sym-
posium, San Diego, pp 223–238
58. Mayes K, Markantonakis K (2008) Smart cards, tokens, security
and applications. Springer, New York
Pers Ubiquit Comput (2010) 14:347–361 361
123
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
- c.779_2009_Article_235.pdf
- A snapshot of trusted personal devices applicable to transaction processing
- Abstract
- Introduction
- Motivational areas
- Trusted personal devices
- A definition of trust
- What is a trusted personal device?
- Classification of trusted personal devices
- Smart cards
- Emerging breed of TPD
- Network smart card
- An emerging breed of TPD
- Trust extension device
- Context of use
- TED emulation
- DORIS/DIVA
- DORIS
- DIVA
- Encryptakey
- Enhanced PDAs and cell phones
- Conclusions
- References
Sources/Dangerous WiFi AP.pdf
O R I G I N A L A R T I C L E
Dangerous Wi-Fi access point: attacks to benign smartphone applications
Min-Woo Park • Young-Hyun Choi •
Jung-Ho Eom • Tai-Myoung Chung
Received: 2 July 2013 / Accepted: 26 September 2013 / Published online: 29 October 2013
� Springer-Verlag London 2013
Abstract Personalization by means of third party appli-
cation is one of the greatest advantages of smartphones. For
example, when a user looks for a path to destination, he can
download and install a navigation application with ease
from official online market such as Google Play and
Appstore. Such applications require an access to the
Internet, and most users prefer Wi-Fi networks which are
free to use, to mobile networks which cost a fee. For this
reason, when they have no access to free Wi-Fi networks,
most smartphone users choose to try to use unknown Wi-Fi
access points (AP). However, this can be highly dangerous,
because such unknown APs are sometimes installed by an
adversary with malicious intentions such as stealing
information or session hijacking. Today, smartphones
contains all kinds of personal information of the users
including e-mail address, passwords, schedules, business
document, personal photographs, etc., making them an
easy target for malicious users. If an adversary takes
smartphone, he will get all of information of the users. For
this reason, smartphone security has become very impor-
tant today. In wireless environments, malicious users can
easily eavesdrop on and intervene in communication
between an end-user and the internet service providers,
meaning more vulnerability to man-in-the-middle attacks.
In this paper, we try to reveal the risk of using unknown
APs by presenting demonstration results. The testbed is
composed of two smartphones, two APs, and one server.
The compromised AP forwards messages of victim
smartphone to the fake server by using domain name sys-
tem spoofing. Thus, the application that is running on the
victim smartphone transfers HTTP request to the fake
server. As a result, this application displays the abnormal
pop-up advertisement, which contains malicious codes and
links. Our demonstration shows that merely connecting to
compromise APs can make a malicious behavior even the
applications are benign.
Keywords Security of smartphone application � Wireless security � Man-in-the-middle attack � Smartphone and ubiquitous computing
1 Introduction
The technology of mobile phones has advanced dramati-
cally over the last decade, in both hardware and software.
The performance of its hardware is now almost comparable
with portable computers. For example, the Samsung Gal-
axy S3 manufactured in 2012 contains in it a 1.5 GHz dual-
core processor and a 2-GB RAM, along with various high-
end sensor gadgets such as GPS, gyroscope, and acceler-
ometer. With these technological advancements in hard-
ware, smartphones are now able to perform numerous
intelligent functions like, for example, automatically
M.-W. Park � Y.-H. Choi Department of Electrical and Computer Engineering,
Sungkyunkwan University, 300 Cheoncheon-dong, Jangan-gu,
Suwon-si, Gyeonggi-do, Korea
e-mail: [email protected]
Y.-H. Choi
e-mail: [email protected]
J.-H. Eom
Military Studies, Taejeon University, 62 Daehakro, Dong-Gu,
Daejeon, Korea
e-mail: [email protected]
T.-M. Chung (&) Department of Software, Sungkyunkwan University, 300
Cheoncheon-dong, Jangan-gu, Suwon-si, Gyeonggi-do, Korea
e-mail: [email protected]
123
Pers Ubiquit Comput (2014) 18:1373–1386
DOI 10.1007/s00779-013-0739-y
adjusting the brightness of display according to illumina-
tion value. A great technological advancement was also
made in software. The main role for this was played by
major OS manufacturers such as Google, Apple, and
Symbian, which have released the open SDK and created
official markets for smartphone applications. With the
creation and subsequent growth of such application mar-
kets, many developers now spend their time and money to
invent new smartphone applications, bringing ever more
intelligent applications to smartphone users. Thanks to all
these technological advancements in hardware and soft-
ware, mobile phones have now evolved into smart phones.
However, some types of these intelligent applications
require internet connections to identify users and store their
information in web storage. Some other types of applica-
tions also need internet connections for downloading real-
time information like real-time traffic information. In
gaining such internet connections, many users avoid using
mobile networks because they cost them money, and
instead use free Wi-Fi, sometimes even if the access points
for Wi-Fi are unknown.
But, it can be very dangerous connecting their smart-
phones to unknown access points, because wireless com-
munication, which transmits information on air, is more
vulnerable to external intervention than wired communi-
cation, which transmits information through cables. This
signifies malicious users can more easily eavesdrop on
conversations or intercept messages by installing rogue
access points.
Today, a smartphone has become a necessity for many
of us: we need it to wake up in the morning, check
schedules or emails, save memos, and communicate with
colleagues through social applications. Because of these
broad uses for everyday life, many smartphone users
knowingly and unknowingly save in their phone much of
their personal information such as e-mail passwords,
schedules, business documents, and personal photographs
in their smartphones, making them an easy target for those
with malicious intentions. The security of smartphones is
now in more danger than ever before, although most people
remain unaware of the danger.
In this paper, we seek to show the risk of using unknown
Wi-Fi access points. To this end, we demonstrate the
MITM attacks, and we show that the benign application
can import and display injected HTML documents. For
understanding, we describe briefly security model of the
smartphone. However, smartphone OSs are not the same.
So we would focus on the Android OS because we believe
it is more open and thus more vulnerable. The security
model of the Android OS has three security holes in this
model; (1) Android OS will be left a big responsibility to
ignorant user about security (2) permission-based security
model is vulnerable about privilege escalation attacks, and
(3) permission-based security model is not able to cover
application-level vulnerability.
The rest of this paper is organized as follows. Section 2
describes the role of the smartphone in ubiquitous com-
puting environment. We can easily associate the smart
devices like smartphone and tablet PC when we imagine
the vision of the ubiquitous computing. Section 3 gives the
security model of the Android OS and vulnerability of this.
And, Sect. 4 shows results of MITM attack demonstration.
Finally, Sect. 5 concludes the work.
2 Smartphone in ubiquitous computing
The smartphones have become very important devices in
ubiquitous computing. In this section, we describe defini-
tion, core requirements of ubiquitous computing, and roles
of the smartphone in ubiquitous computing.
2.1 Definition of ubiquitous computing
The word ‘‘ubiquitous’’ derives from the Latin word ubi-
que, which means ‘‘present everywhere at the same time.’’
Ubiquitous computing (UbiComp) indicates the environ-
ments where people have access at anytime and anywhere
to information and communication technology (ICT) sys-
tem. In other words, a ubiquitous system allows people to
surround themselves with computing devices that under-
stand and support their life cycles. The term ubiquitous
computing, first used in 1991 by Mark Weiser in his journal
[1], has been redefined by various researchers and institutes
[1–5]. Mark Weiser first defined UbiComp as actualization
of the ‘‘virtual reality’’ by using invisible computing.
Friedemann Mattern [2] now redefines it as comprehensive
computerization and interconnection of everyday objects.
Yvonne Rogers [3] proposes a new definition of the term:
changing roles of the users from calming people to
engaging people in UbiComp environment.
The Mark Weiser’s vision of UbiComp is composed of
three devices, as described in Table 1. The devices are
Table 1 The smart device: tab, pad, and board
Devices Functionalities
Tab Tab is a window that is extended from user’s computer
screen
It can display what is displayed on user’s computer screen
Pad Pad is interface for transmitting commands to the
UbiComp
It can handle all devices that make up the UbiComp
Board Board is the biggest device that has a yard-size display
It is used for the sharing of information between people
mainly
1374 Pers Ubiquit Comput (2014) 18:1373–1386
123
classified according to the size of their display. A tab,
which is about the size of an ID card, is the smallest device,
and a board, which is about a yard size, is the biggest one,
with the pad between them. The tab is designed for
wearable devices, and this is mainly used for personal
functions such as calendar and diary. The pad is a hand-
hold device, and it is intended to replace paper. Users can
easily read, write, and scrap information using pads. And
also the pad is a main interface for handling UbiComp.
Boards are used for playing video or sharing information
between co-workers.
Nowadays, we can easily associate the smartphone and
tablet PC when we imagine a tab and a pad. It means that
UbiComp has already been partly realized, and the rest
may be fulfilled soon.
2.2 Core requirements of ubiquitous computing
The following are core requirements of UbiComp distinct
from distributed computing: context-aware computing,
ambient and ubiquitous intelligence, and recording, track-
ing and monitoring [3, 6, 7]. The most important charac-
teristic of UbiComp is context-aware computing. Service
provider expects that UbiComp can provide suitable ser-
vices to a suitable person at a proper moment without user
intervention. For this service, computing ability to under-
stand context information about personal and environ-
mental context is required in UbiComp. In order to collect
context information, sensor devices which can collect
information and transfer collected information to base
station are deployed in UbiComp field. We call this com-
puting environment context-aware computing. Context-
aware computing is used to infer situation and decide next
operation. This process is important because if the infer-
ence result does not match up with the actual user’s
expectations, UbiComp will lose trust from the user. This is
a difficult part of research about context-aware computing.
Second core requirement is related to ambient and
ubiquitous intelligence. Sometimes, more accurate inter-
face is necessary in UbiComp. For example, when the user
wants to adjust the volume of the audio or change the TV
channel, he needs accurate interfaces for communication
with the UbiComp system. Generally, speech recognition
and gesture recognition technology are often used in this
area. However, the error rate is still high, and therefore,
technical research is needed to enhance accuracy.
The rest of the requirements are recording, tracking and
monitoring. These requirements are adopted to develop
human-assistive applications through sensing and alerting
[3]. UbiComp has sufficient information for tracking and
monitoring human resources because sensor devices of
context-aware computing periodically report personal and
environmental contexts to it. If UbiComp tracks and
monitors the vulnerable people such as the elderly, the
physically and mentally disabled, UbiComp can respond to
emergency situations. However, it has the following
problems. First, it is difficult to record, track, and monitor
all of the transactions that occur in UbiComp because of
the massive amounts of transactions. UbiComp is com-
posed of a lot of sensor devices that collect context infor-
mation or wait user input. Thus, the massive amounts of
transactions occur in short time. Second, recording, track-
ing, and monitoring personal information are conflicted
with the protection of personal information.
2.3 Smartphone in ubiquitous computing
Over the last decade, a mobile phone has made remarkable
advancements in both hardware and software. The mobile
phone, also called smartphone, is equipped with a high-
speed multi-core processor and enough gigabytes storage
incomparable with those of the past feature phone. Fur-
thermore, the smartphone has various built-in sensor gad-
gets such as GPS, an accelerometer, and a gyroscope. As a
result, the smartphone has become so intelligent and more
user-friendly as to support our life, just like the vision of
UbiComp envisioned. Table 2 shows the specification of
Samsung Galaxy S3.
And also, there have been great advancements in soft-
ware technology. Smartphone OS manufacturers like Go-
ogle, Apple and Symbian, release the SDK for developing
smartphone applications. And also, they create official
markets for application deployment. With the growth of
markets, many developers are now motivated to invent new
smartphone applications, producing a large number of
useful applications reactive to context by means of multiple
sensors built in the smartphone. According to the Android
official blog, the Google Play has reached 25 billion
downloads and 675,000 total apps [8].
Evolution of the smartphone has greatly changed our
lifestyle. From a morning call service to a remote control
vehicle service, the smartphone offers various services to
the user [9]. The smartphone already plays the roles similar
to the tab and the pad as envisioned by Weiser. People at
anytime and everywhere carry their smartphones like
wearable devices. And the smartphone performs most of
Table 2 The specification of Samsung Galaxy S3
Segments Specifications
Processor 1.5 GHz dual-core processor
Memory 32 gigabytes of storage and 2 gigabytes of RAM
Connectivity Bluetooth, Wi-Fi, NFC, etc.
Built-in
sensors
Accelerometer, gyroscope, proximity, compass, and
barometer
Pers Ubiquit Comput (2014) 18:1373–1386 1375
123
the personal tasks such as scheduling, checking e-mail, and
sharing files. It is similar to the tab in the vision of Weiser.
And also, the size of smartphone is similar to that of the
pad. Moreover, the user writes notes on and clips infor-
mation to his smartphone. All these technological advances
are realization of Weiser’s vision [10].
Furthermore, we expect the smartphone to become the
most important equipment in UbiComp. The smartphone
can be used for satisfying the core requirements of Ubi-
Comp. The smartphone can collect context information and
transfer collected information to the base station through
wireless communication. And also, the smartphone can be
used for human interfaces. Lastly, the smartphone can be
utilized as an identification of its owner by using universal
subscriber identity module (USIM) information.
The smartphone can play the role of deployed sensor
devices in context-aware computing. Context-aware sys-
tem needs wireless sensor networks for collecting context
information. Thus, large numbers of sensor devices are
deployed in UbiComp to continuously collect context
information such as personal and environmental context
and transfer it to the base station. However, it is highly
costly to construct these sensor networks. Moreover, these
sensor devices have energy limitation. So, sensor devices
cannot perform permanently. However, most of these
problems can be solved by using the smartphone. People
always carry their smartphone with them, which contains
various built-in sensors. And all smartphones have wireless
network interfaces. Thus, the smartphone can easily
transfer messages to the base station. Since the smartphone
is fully charged on a daily basis, so users can be free of the
fear of energy shortage. As a result, the smartphone can
play a role of deployed sensor devices in UbiComp field.
Andrew et al. [11] and Tor-Morten et al. [12] show several
examples of sensing applications for cognitive phones.
Next topic is the suitability of smartphones for Human–
Computer interfaces. The smartphone has various inter-
faces for interactive functions such as camera, touch panel,
gyroscope, and up-down buttons. Various technologies
already have been used for interaction between human and
devices in smartphone. For examples, the smartphone can
adjust the brightness of the screen automatically by rec-
ognizing the user’s eye, and the scroll of web browser is
controlled by just tilting the device. Rafael et al. [13]
and George et al. [14] suggest a possibility of smartphone
usable as an input device in UbiComp. Following them, we
expect interaction between humans and UbiComp using the
smartphone is possible.
The last core requirements of UbiComp are recording,
tracking and monitoring the people. It can reduce the cost
spent identifying and tracking the user by using the
smartphone. Generally, the smartphone has a USIM card
with unique serial numbers, which is issued by mobile
network providers for identification of the owner. Thus, if
UbiComp can read USIM information, it will be able to
easily track and monitor human resources.
Figure 1 illustrates the abstract roles of the smartphone
and its interactions with UbiComp environment. The
smartphone has resources such as privacy information
(e.g., schedule, contact, etc.), built-in sensor devices (e.g.,
GPS module, gyroscope, accelerometer, etc.), and appli-
cations for UbiComp that are optionally installed with the
permission of the user. The solid line points to interaction
between the human and the computer and the dotted line
machine-to-machine interaction. The Context-aware
Computing component demands context information of
personal and environmental context. So, this component
communicates with optional applications to receive per-
sonal context. Every component of UbiComp interacts with
built-in sensors of the smartphone to collect context
information. The Context-aware Computing component
and Ambient and Ubiquitous computing component have
direction access to sensor devices. These components
receive raw data from the smartphone and process them
according to their function. On the other hand, the
Recording, Tracking and Monitoring component commu-
nicates with optional applications because this component
requires refined data.
3 Threats of the compromised access points
In this section, we describe the security model of the
smartphone through the Android platform and critical
security threats posed by the MITM attack, which can
occur from compromised AP connections.
3.1 Security model of smartphone
The smartphone has a dual- or quad-core processor and a
gigabyte memory and storage. Whenever and wherever
users desire, they can gain connections to the Internet using
mobile networks or Wi-Fi networks. And, it can access
user information stored in the device or on the web.
Although functional aspects of the smartphone have grown
significantly, the security technology of the smartphone
still falls short of expectations of many. Smartphone OSs
are slightly different from each other, and we will focus on
the Android OS, because it is more open and thus more
vulnerable to external invasion. In this subsection, we
describe security flaws of the Android OS.
Basically, all applications run within their own sandbox,
and no application can escape this sandbox. However,
these restrictions are so strong as to cut off most of the
functionality of smartphone application. So, the Android
platform allows use of the API depending on application
1376 Pers Ubiquit Comput (2014) 18:1373–1386
123
permissions as approved by the user [15]. Every Android
application has permission information that is approved
during the install time in its own AndroidManifest.xml file.
This permission never changes until the application is re-
installed. Figure 2 shows an example code of the Adn-
roidManifest.xml file of the Test Application 1 [34]. The
permissions are defined separately for each API that has a
risk of being exploited. The permission ‘‘INTERNET,’’
that is in the Fig. 2, is necessary for connection with
Internet. Android OS verifies permission just when the user
application calls the API that has a risk of being exploited.
In other words, if some application does not call API, that
is, related socket, the Android OS will never check the
permission ‘‘INTERNET.’’
The permission-based security model of Android OS has
the following security holes. First, Android OS will be left
a big responsibility to ignorant user about security [16–19].
Most users do not understand about the risk of approving
the permission to applications. Furthermore, the user has
only the two choices giving an approval or not. As a result,
Fig. 1 The abstract roles of Smartphone and interactions
with UbiComp environments
Fig. 2 An example code of permissions that is stored in AndroidManifest.xml file
Pers Ubiquit Comput (2014) 18:1373–1386 1377
123
the user thinks less of permission authorizing process
because of this permission policy. Second, the permission-
based security model is vulnerable to privilege escalation
attacks [20, 21]. Multiple applications share the role for
achieving their purpose. For an example, malicious appli-
cation A has permission for accessing to sensitive internal
data such as the contact, but it does not have permission for
sending message through the Internet. Malicious applica-
tion B does not have permission for accessing to sensitive
internal data, but it has permission about the Internet. In
this case, malicious application A is to transmit the contact
to malicious application B by using internal communica-
tion path and malicious application B flows out the contact
through the Internet [22]. Last, the permission base security
model is only able to cover low-level behaviors that are
related to API call. If android application has application-
level vulnerability, the Android OS will not be able to
protect itself. We focus on this security hole. In the next
section, we demonstrate the MITM attack by using this
application-level vulnerability.
3.2 Threats of the compromised access points
According to growth of wireless networks, wireless network
interface becomes the most basic parts of a portable com-
puting device. Some research predicts that wireless com-
munications will exceed wired communications by 2015.
Like this, wireless communication technology has become
the most important communication means for connecting the
smart device. The growth of wireless communication con-
tributes to realize UbiComp and popularizes smartphone.
However, security threats exist in the hidden side of the
rapidly growth of wireless communication.
We can easily see that wireless APs are installed in a
narrow area more than needs. Figure 3 shows the map that
presents the density of APs in Chicago. We obtain this map
from wireless geographic logging engine (WIGLE) project
which is a dataset for collecting the wireless hotspots
around the world [23, 24]. Wireless APs are distributed in
Chicago more difficult to read the map. According to
WIGLE project, about 5 million APs exist in California
that is a region where the AP is installed most in the United
States. Density of the wireless AP is very high considering
that the each AP can support a range of up to 150 feet
indoors and 300 feet outdoors. Table 3 shows regions and
the number of wireless APs. We are surrounded by many
wireless APs. It is look like a spider web that is configured
in a wireless network. In fact, all of the AP that is searched
by our devices is not a benign. When you indiscriminately
try to connect to unknown AP, you and your device will be
in danger.
In the wired network, the MITM attacks are very diffi-
cult attack technique [25]. It is impossible that an adversary
physically break into an end-user and the ISP. Thus, an
adversary uses domain name system (DNS) cache poi-
soning for changing the direction of traffic flows [26] in
Fig. 4a. However, in the wireless network, an adversary
can easily break into an end-user and the ISP [27–31] in
Fig. 4b because the messages are transmitted on air in
wireless network. Thus, wireless network is more vulner-
able than wired networks.
Generally, the smartphone user wants his smartphone is
always connected to the Internet because applications that
are installed in his smartphone usually requires the Internet
connection for uploading or downloading the real-time
information. Thus, the smartphone user often searches open
wireless networks. Therefore, if an adversary installs open
AP, he can easily connect to victims. The way to install the
AP for the MITM attack can be divided into two major
types. First, an adversary installs the compromised AP on
the public places such as airport, bank, and coffee shop
[31]. An adversary can easily catch victims in these places,
because the probability of using the smartphone is
increased when the people stay a long time in one place.
Second method is use rogue AP [27, 28]. Rogue AP is
installed outside range of benign AP and masquerade as
this benign AP. An end-user is easily cheated because
rogue AP use the SSID of the benign AP.
In particular, the smartphone users are required more
attention about this unknown APs because the smart-
phone has became the critical point of user’s information
security. Generally, all information is included in his
smartphone from privacy photographs to business docu-
ments. Thus, if the smartphone is compromised by an
adversary, the user will suffer socially or financially
irreparable damage.
Fig. 3 The map of wireless APs in Chicago
1378 Pers Ubiquit Comput (2014) 18:1373–1386
123
4 Demonstrations
To indicate the risk of unknown AP, we demonstrate the
MITM attack by using compromised AP. We show that an
adversary can easily intercept your message and inject
modified message into communication between your
handset and the service provider. In this section, we
describe our demonstration environments and progresses.
After then, we explain the results of our penetration test.
4.1 Testbed for the MITM attack
We use five devices for demonstration; two Samsung
Galaxy S3s are Android handsets for running applica-
tions; a laptop serves as the compromised AP; an Iptimes
N40006R is benign wireless AP; and a server for MITM
attack. The basic architecture of our testbed is shown in
Fig. 5. Two Android handsets connect to each AP through
Wireless Local Area Network based on IEEE 802.11. The
Android handset 1 is connected to the benign AP, and the
other handset is connected to compromise AP. Each AP
and the spoofing server which serves as the DNS spoofing
server and web proxy server connect to the Internet
through same gateway. We set DNS configuration of
compromised AP to the spoofing server for DNS spoof-
ing. An adversary is able to catch every packets pass
through these compromised AP and divert some packets
by using DNS spoofing.
Table 4 shows the tools and software used in our dem-
onstrations. We use top five applications that are registered
in ‘‘Top New Free Games’’ of Google Play. These appli-
cations import pop-up advertisements of event notification
and commercial advertisement from their web servers.
Wireshark and Connectify Hotspot are installed on the
laptop. Wireshark is used to analyze packets to find vul-
nerability of communication process. Connectify Hotspot
is used to set up the laptop as Wi-Fi AP. Apache2 and Bind
is installed on the desktop. Apache2 is used to reply HTTP
requests, and Bind is used to deceive Android handset 2.
4.2 Preliminaries
We obtained abstract operations of android applications by
analyzing the traffic of applications, as following Fig. 6.
Generally, applications communicate with more than one
server. First one is a data server. The data server checks
application suitability such as user authentication, appli-
cation version and integrity, and so on. If application fails
to test the suitability or access to the date server, then this
application is immediately terminated. The second server is
an advertisement server, and this server is an optional
object. The advertisement server provides html files and
image files of event notification and commercial adver-
tisement via HTTP. The connection of the advertisement
server does not affect launch of application differently
from the connection of the data server. We masquerade as
advertisement server for the MITM attack.
Figure 7 shows the MITM attack progress, which con-
sists of passive attack phase and active attack phase.
For the purpose of the passive attack phase, an adversary
confirms the existence of the advertisement server and
understands communication process between the applica-
tion and the advertisement server. An adversary monitors
the DNS query and response and intercepts the packets
between the application and the advertisement server by
using the compromised AP. He can easily figure out the IP
address and domain name of the advertisement server by
using the extracted html documentations and image files
through Wireshark. Figure 8 shows an example of the
passive attack phase. After receiving a DNS response, the
Android handset 2 immediately requests the HTML doc-
ument to androweb.cafe24.com. This HTML document
contains the URL on the pop-up advertisement.
In the active attack phase, an adversary puts the modi-
fied HTML documents on the specific path which came
Fig. 4 MITM attack patterns in (a) wired and (b) wireless commu- nication environment
Table 3 Number of wireless AP that is located in United State in Sep 2013
Region Total California Texas Ohio New York
Count 40,919,320 5,255,380 3,941,742 2,178,988 2,076,812
Pers Ubiquit Comput (2014) 18:1373–1386 1379
123
Fig. 5 Architecture of our testbed
Table 4 The tools and software used in our demonstrations
Device Installed software Installation purpose
Android handset 1 and Android handset 2 Test Application 1 [35] Attack demonstration
Test Application 2 [36]
Test Application 3 [37]
Test Application 4 [38]
Test Application 5 [39]
Compromised AP Wireshark Packets analysis
Connectify Hotspot Set up to wireless access point
Spoofing server Apache2 HTTP proxy server
Bind DNS spoofing attack
Fig. 6 Abstract operation process of the application which
imports pop-up advertisement
1380 Pers Ubiquit Comput (2014) 18:1373–1386
123
from the previous phase. Then he sets up the DNS con-
figuration to divert the HTTP request messages to spoofing
server. The code in the Fig. 9 is an example of inserted
code in named.conf, that is, configuration file of named
which is a DNS server, part of the BIND9 distribution.
4.3 Man-in-the-middle attack progress
Figure 10 shows the MITM attack process. When target
applications are launched on the Android handset 2, it
checks status of connection to the Internet and tries to
request IP address of the data server. DNS query of the
Android handset 2 is delivered to the spoofing server
passing through the compromised AP. The spoofing server
returns the correct IP address of data server for normally
launching the target application. Next, the Android handset
2 communicates with the data server for application-spe-
cific launching process. Generally, these communications
are protected by SSL. If the target application is launched
successfully, it tries to request IP address of the adver-
tisement server. In this case, however, the spoofing server
returns IP address of itself in order to inject modified
messages. As a result, the target application requests
HTML documents and image files to the spoofing server
and exposes incorrect advertisements that are modified by
an adversary.
Fig. 7 Man-in-the-Middle attack progress
Fig. 8 An example of passive attack phase
Pers Ubiquit Comput (2014) 18:1373–1386 1381
123
4.4 The results of man-in-the-middle attack
As mentioned above, we target top five applications that
are registered in ‘‘Top New Free Games’’ of Google Play.
Figure 11 presents screenshot of the target application’s
pop-up advertisement; the (a) image is a view of normal
case, the (b) image is a view of abnormal case that the target
application imports modified HTML document, and the
(c) image is a screen when the link contained in the modi-
fied HTML document has been executed of target applica-
tion. In many cases, Android applications are used as simple
objects such as WebView for pop-up advertisement. As a
result, an adversary can easily insert link of the other URLs
into modified HTML document. Figure 12 is a part of the
code of original HTML document of target application and
link-embedded HTML document that is made by us.
Figure 13 shows the results of our MITM attack dem-
onstration. We have inserted ‘‘Modified advertisement’’ to
all the images and added the link of the injected HTML
document to the original HTML document. We have suc-
ceeded in exposing modified advertisement page to user
through the all benign applications. And also, the link that
is injected by us is working properly in the all test
applications.
Figure 14 shows the partial code for generating pop-up
advertisement of the Test application 1. WebView is
Android API for simple display online content within
applications [40]. By using loadUrl method of WebView
class, developer can easily handle online content. However,
these objects, such as WebView, are in danger of being
misused as a result of our demonstration. If developer can
to block that execution of embedded link, it is possible to
significantly reduce the threat of these attacks.
A spear phishing is more effective because phishing
messages are customized for victims [34]. Customized
message, which contains trustworthy information such as
victim’s nickname, is easier to be believed. Thus, the threat
of the MITM attack is more critical when it is combined
with the social engineering for customizing injected
advertisement. Who do not click it when the phrase ‘‘Only
Fig. 9 An example of inserted code in named.conf
Fig. 10 An example of the MITM attack process
1382 Pers Ubiquit Comput (2014) 18:1373–1386
123
one chance! Click and Receive Gift’’ is inserted in the pop-
up advertisement of well-known application?
It is necessary to mitigate the MITM attack as follows:
(1) the smartphone user avoids connecting to unknown AP,
and (2) pays attention to pop-up advertisement even if it is
pop-up message of well-known application. (3) The
application developer avoids using vulnerable API, and (4)
must use mutual authentication process and secure protocol
such as SSL [33] when an application communicates with
external devices.
5 Conclusions
We describe the roles and potentiality of smartphone in
the UbiComp environments. The smartphone has done a
remarkable development enough to satisfy core require-
ments of UbiComp: context-aware computing, ambient
and ubiquitous intelligence, and recording, tracking and
monitoring environments. However, the growth of the
smartphones is sufficient to attract the attention of
adversaries. Moreover, the security model of the Android
Fig. 11 Captured images of the target application’s pop-up advertisement
Fig. 12 An example code of the (a) original HTML document and (b) link-embedded HTML document
Pers Ubiquit Comput (2014) 18:1373–1386 1383
123
Fig. 13 The results of demonstration of the test application 1–4
Fig. 14 The partial code for generating pop-up advertisement by using WebView class
1384 Pers Ubiquit Comput (2014) 18:1373–1386
123
platform has security vulnerabilities such as the follow-
ing: (1) Android OS will be left a big responsibility to
ignorant user about security, (2) permission-based secu-
rity model is vulnerable about privilege escalation
attacks, and (3) permission-based security model is not
able to cover application-level vulnerability. In this
paper, we reveal the risk of the using unknown APs by
using demonstration. The testbed is composed to five
devices: two android handsets, one laptop, one desktop,
and one wireless AP. The android handsets are used for
running application. The laptop plays the role of com-
promised AP; we change its DNS information. The
desktop is used for DNS spoofing and web server. We
can intercept and inject packets of passes through the
laptop. We divert some packets to the desktop by using
DNS spoofing. As a result, test applications that are
launched on the handset 2 display abnormal advertise-
ments. We shows that benign application, which is
running on uncompromised devices, can be exploited just
connecting to the compromised AP. To mitigate this
MITM attack, developer must use mutual authentication
process when an application communicates with external
devices.
In future work, we will continue to research about the
MITM attack for attack-protected sessions such as SSL/
TLS. Many user applications depute security function to
SSL APIs. However, vulnerabilities about these applica-
tions have been reported in research of Georgiev et al. [32].
For the development of smartphone security, we continu-
ously study for finding out the vulnerability of smartphone
platform and resolving these threats.
References
1. Weiser M (1991) The computer for the 21st century. Sci Am
265(3):94–104
2. Mattern F (2001) The vision and technical foundations of ubiq-
uitous computing. Upgrade 2(5):3–6
3. Rogers Y (2005) Moving on from Weiser’s vision of calm
computing: engaging UbiComp experiences. In: proceedings of
UbiComp 2005. Springer, NY, pp 404–421
4. Leem CS, Jeon NJ, Choi JH, Shin HG (2005) A business model
(BM) development methodology in ubiquitous computing envi-
ronments. In: proceeding of ICCSA 2005. LNCS 3483:86–95
5. Kang BH (2007) Ubiquitous computing environment threats and
defensive measures. IJMUE 2(1):47–60
6. Poslad S (2009) Ubiquitous computing: smart devices, environ-
ments and interactions. Wiley, New York, pp 3–73
7. Baldauf M, Dustdar S, Rosenberg F (2007) A survey on context-
aware system. Int J Ad Hoc Ubiquit Comput 2(4):263–277
8. Android Official Blog. Google play hits 25 billion downloads.
http://officialandroid.blogspot.kr/2012/09/google-play-hits-25-
billion-downloads.html
9. Barkuus L, Polichar VE (2011) Empowerment through seam-
fulness: smart phones in everyday life. Pers Ubiquit Comput
15(6):629–639
10. Bell G, Dourish P (2007) Yesterday’s tomorrows: notes on
ubiquitous computing’s dominant vision. Pers Ubiquit Comput
11(2):133–143
11. Campbell A, Choudhury T (2012) From smart to cognitive
phones. IEEE Pervasive Comput 11(3):7–11
12. Grønli T, Chinea G, Younas M (2013) Context-aware and auto-
matic configuration of mobile devices in cloud-enabled ubiqui-
tous computing. Pers Ubiquit Comput
13. Ballagas R, Borchers J, Rohs M, Sheridan JG (2006) The smart
phone: a ubiquitous input device. IEEE Pervasive Comput 5(1):
70–77
14. Roussos G, Marsh AJ, Maglavera S (2005) Enabling pervasive
computing with smart phones. IEEE Pervasive Comput 4(2):
20–27
15. Orthacker C, Teufl P, Kraxberger S, Lackner G, Gissing M,
Marsalek A, Leibetseder J, Prevenhueber O (2012) Android
security permissions—can we trust them? In: proceeding of
MOBISEC 2011. LNICST 94:40–51
16. Felt AP, Chin E, Hanna S, Song D, Wagner D (2011) Android
permissions demystified. In: proceeding of CCS’11, pp 627–638
17. Felt AP, Ha E, Egelman S, Haney A, Chin E, Wagner D (2012)
Android permissions: user attention, comprehension, and behav-
ior. In: proceeding of SOUPS 2012
18. Nauman M, Khan S, Zhang X (2010) Apex: extending android
permission model and enforcement with user-defined runtime
constraints. In: proceeding of ASIACCS’10, pp 328–332
19. Barrera D, Kayacik H (2010) A methodology for empirical
analysis of permission-based security models and its application
to android. In: proceeding of CCS’10, pp 73–84
20. Zhongyang Y, Xin Z, Mao B, Xie L (2013) DroidAlarm: an all-
sided static analysis tool for android privilege-escalation mal-
ware. In: proceeding of ASIACCS’13, pp 353–358
21. Bugiel S, Davi L, Dmitrienko A, Fischer T, Sadeghi A, Shastry B
(2012) Towards taming privilege-escalation attacks on android.
In: proceeding of NDSS 2012
22. Chin E, Felt AP, Greenwood K, Wanger D (2011) Analyzing
inter-application communication in android. In: proceeding of
MobiSys’11, pp 239–252
23. Wireless Geographic Logging Engine. http://wigle.net/gpsopen/
gps/GPSDB/, Sep 2013
24. Gruteser M, Grunwald D (2004) A methodological assessment of
location privacy risks in wireless hotspot network. In: proceeding
of SPC 2003. LNCS 2802:10–24
25. Callegati F, Cerroni W, Ramilli M (2009) Man-in-the-middle
attack to the HTTPS protocol. IEEE Secur Priv 7(1):78–81
26. Ariyapperuma S, Mitchell CJ (2007) Security vulnerabilities in
DNS and DNSSEC. In: proceeding of ARES’07
27. Zafft A, Agu E (2012) Malicious WiFi networks: a first look. In:
proceeding of SICK 2012 pp 1038–1043
28. Aime MD, Calandriello G, Lioy A, Torino PD (2012) Depend-
ability in wireless networks: can we rely on WiFi? IEEE Secur
Priv 5(1):23–29
29. Godber A, Dasgupta P (2003) Countering rogues in wireless
networks. In: proceeding of ICPPW’03
30. Nikbakhsh S, Manaf ABA, Zamani M, Jangeglou M (2012) A
nobel approach for rogue access point detection on the client-
side. In: proceeding of WAINA’12, pp 684–687
31. Hwang H, Jung G, Sohn K, Park S (2008) A study on MITM
(Man in the Middle) vulnerability in wireless network using
802.1X and EAP. In: proceeding of ICISS’08, pp 164–170
32. Georgiev M, Lyengar S, Jana S (2012) The most dangerous code
in the world: validating SSL certificates in non-browser software.
In: proceeding of CCS’12
33. Lee DH, Kim JG (2013) IKEv2 authentication exchange model
and performance analysis in mobile IPv6 networks. Pers Ubiquit
Comput
Pers Ubiquit Comput (2014) 18:1373–1386 1385
123
34. Wang J, Herath T, Chen R, Vishwanath A, Rao HR (2012)
Phishing susceptibility: an investigation into the processing of a
targeted spear phishing Email. IEEE Tran Prof Commun
55(4):345–362
35. Test application 1, https://play.google.com/store/apps/details?id=
com.andromedagames.schoolrun
36. Test application 2. https://play.google.com/store/apps/details?id=
air.com.cjenm.mpang.gp
37. Test application 3. https://play.google.com/store/apps/details?id=
com.marvel.runjumpsmashforkakaotalk_goo
38. Test application 4. https://play.google.com/store/apps/details?id=
com.pnixgames.sports
39. Test application 5. https://play.google.com/store/apps/details?id=
com.cjenm.monster
40. WebView. http://developer.android.com/reference/android/
webkit/WebView.html
1386 Pers Ubiquit Comput (2014) 18:1373–1386
123
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
- c.779_2013_Article_739.pdf
- Dangerous Wi-Fi access point: attacks to benign smartphone applications
- Abstract
- Introduction
- Smartphone in ubiquitous computing
- Definition of ubiquitous computing
- Core requirements of ubiquitous computing
- Smartphone in ubiquitous computing
- Threats of the compromised access points
- Security model of smartphone
- Threats of the compromised access points
- Demonstrations
- Testbed for the MITM attack
- Preliminaries
- Man-in-the-middle attack progress
- The results of man-in-the-middle attack
- Conclusions
- References
Sources/Digital Evidence Discovery of Networked Multimedia Devices.pdf
Digital evidence discovery of networked multimedia smart devices based on social networking activities
Hai-Cheng Chu & Szu-Wei Yang & Ching-Hsien Hsu & Jong Hyuk Park
Published online: 13 March 2013 # Springer Science+Business Media New York 2013
Abstract Unquestionably, networked multimedia smart devices are commonly adopted in contemporary ubiquitous wireless computing era with unprecedented evolving pace in terms of mobility, portability, and pervasiveness. Regrettably, those technology-oriented gadgets are phenomenally exploited by cyber criminals or get involved in computer-related incidents unknowingly. Substantively, the detection, prevention, and the related digital forensics of the above scenarios are becoming tremendously urgent both in public and private sectors. Therefore, in this research, we investigate the scenario when state-of-the-art wireless communication technologies are integrated with the networked smart devices where digital evidences may exist and they could be disclosed when appropriate standard operating procedures are suitably applied. Accordingly, in this paper, a PDA with the built-in GPS navigation functionality via the ubiquitous Wi-Fi connection to a popular social networking platform (facebook) is cross examined concerning the related digital evidence collecting and discovering in terms of revealing previous facebook user accounts on the mobile device without shutting off the power. The research provides a generic framework for the digital forensics specialists to contemplate when the networked smart devices are involved in the
Multimed Tools Appl (2014) 71:219–234 DOI 10.1007/s11042-012-1349-9
H.-C. Chu Department of International Business, National Taichung University of Education, 140 Min-Shen Road, Taichung 40306 Taiwan, Republic of China e-mail: [email protected]
S.-W. Yang Department of Education, National Taichung University of Education, 140 Min-Shen Road, Taichung 40306 Taiwan, Republic of China e-mail: [email protected]
C.-H. Hsu Department of Computer Science and Information Engineering, Chung Hua University, 707, Sec. 2, WuFu Road, Hsinchu, Taiwan, Republic of China e-mail: [email protected]
J. H. Park (*) Department of Computer Science and Engineering, Seoul National University of Science and Technology, 172 Gongneung-dong 2, Nowon-gu 139743, Korea e-mail: [email protected]
related criminal investigation cases especially when omnipresent social networking plat- forms are becoming the new avenue for the escalating, stringent, and heinous cybercrimes.
Keywords Digital forensics . Mobile social network . Location-based social networking .
Networked smart devices . Volatile memory acquisition
1 Introduction
Demonstrably, as networked mobile computing devices (PDA, smart phones, GPS naviga- tion devices, and Tablet PCs, etc.) are becoming cost competitive and the prevalence of ubiquitous computing infrastructures, more and more mobile users deposit even more precious information in the mobile computing devices than that of desktop PCs [2, 7, 10, 16]. In the meanwhile, the soaring cybercrimes are occurring at an unparalleled pace in respect of wireless communication technologies. Substantively, contemporary mobile com- munication apparatus holds some kind of decisive digital trails once they have been utilized. In other words, digital evidences could be disclosed in a systematic manner, which could be extraordinarily critical in cracking down some cybercrime-related incidents. Unarguably, some heinous cybercrime syndicates gradually exploit networked smart devices as unsuspect- ing media to achieve lucrative intentions. All the aforementioned digital trails are unwarily concealed within those gadgets. Consequently, we provide a generic framework of digital evidence collection, analysis, and data mining in case upon receiving a PDA with embedded GPS and Wi-Fi functions. The research discloses the potential pervious GPS routes that indicate the current user might have physically presented at those geographic locations. In addition, previous facebook users could be revealed through the preceding Wi-Fi connection.
As Digital Forensics (DF) technology reaches its maturity [3–5, 21], for a spotted PDA with GPS navigation application program shut down and facebook session logout, we still might be able to unveil some digital trails to indicate the routes that the user had actually travelled and the facebook user account(s) on the distinct PDA before the battery drains. Due to the nature of the volatile memory of the networked smart device, the digital content of the Random Access Memory (RAM) would be permanently vanished once the power is off [29]. The paper provides the paradigm as references for practitioners in both public and private sectors to contemplate when similar cases occur especially under extreme time constraint.
By the virtue of the unparalleled innovation in mobile computing technologies, the networked smart devices are flourishing on a weekly basis and they globally foster the Mobile Social Network Services (MSNS) [6], which become the new media for hundreds of millions cyber folks. Proverbially, the closeness of one’s social networking profile is heavily relied on MSNS for some distinct cyber communities. Astonishingly, Location Based Service (LBS) is becoming one of the significant application branches of Geographic Information System (GIS), which is composed of hardware, software, and computerized procedures to facilitate the modeling, representation, manipulation, and management of geo- referenced data in contemporary MSNS [12, 14, 23, 26, 28].
As the mobile computing infrastructures become more pervasive, ubiquitous, reliable, and robust, networked smart devices convey much more flexibility, functionality, portability, and mobility than ever. The embedded GPS module within the networked smart devices can receive the navigation data from the communication satellites and the users of the current devices can reveal the accurate physical geographic locations accordingly on MSNS. From the related literatures, the LBS is an extremely important facet of MSNS because it enables the acceleration of the migration from SNS (Social Networking Service) to MSNS [24]. The
220 Multimed Tools Appl (2014) 71:219–234
accurate and up-to-date location of an individual can be spotted via MSNS instead of placing a phone call, which facilitates the interaction of relationships among friends or family members in a traditional manner. Accordingly, the application of DF in the contemporary cybercrimes is an imminent and imperative necessity to tackle the stringent challenges concerning the metamorphic cybercrimes with compelling digital evidences in a scientific and systematic manner.
In this research work, we carry out a complete evaluation of our proof-of-concept steps via the real case review. The rest of the paper is organized as follows. In section 2.1, we conduct comprehensive literature reviews that have been done in the associate DF research field. In section 2.2, we illustrate the contribution of this innovative research work. In section 3, we present the case review concerning the DF of a typical GPS navigation period and a generic facebook session in a step-by-step approach. In section 4, we summarize and review the corresponding DF results based on the digital evidences that have been collected, analyzed, and preserved in a systematical manner based on the proposed methodology. Finally, in section 5, we make the conclusion of this challenging research work.
2 Preliminary
2.1 Related works
Modern networked smart devices are commonly embedded with location acquisition tech- nologies, such as GPS and GSM networking capability, which facilitate mobile computing mechanism and bring the closeness to human social lives. The GPS generated trajectories, which could be instantly shared via the ubiquitous wireless networks with uploading to SNS platforms that stimulates the exponential growth of Location Based Social Networking (LBSN) [15, 17, 20, 27, 30]. Indeed, the social skills have been unknowingly migrated from traditional face-to-face interactions to cyber space and technology intensive activities. Notwithstanding the above SNS overwhelms the future trend of social networking, more cyber crime incidents are exploited through those new channels. In some cyber criminal cases, the networked smart devices contain critical digital evidences that are substantial in cracking down the incidents. However, those precious breadcrumb digital trails might be vanished forever once the battery drains. Therefore, collecting those digital evidences could be proceeded via the volatile memory acquisition of the RAM. The obtained image file of the RAM could be the probative evidence in a court of law.
Recently, DF has been extensively applied to investigate computer related criminal cases. For networked mobile computing devices, the physical memory is volatile in its nature [18, 19]. Unquestionably, all the valuable and unperceivable information within the volatile memory will be evaporated forever once the mobile computing device is no longer sup- ported via the battery. Since the RAM of the computing device can’t permanently store date, the collection of those precious data would need additional handling because some operation procedures on those digital trails are irreversible. Consequently, the DF specialists have to capture the image of the physical memory to perpetually preserve the digital evidences.
Nowadays, facebook is considered to be one of the predominant SNS platforms. Most networked smart devices are capable of accessing facebook via ubiquitous network con- nections. Under such circumstances, the urgent necessity of DF for mobile networked communication devices is relatively challenging [1, 8, 9, 11, 24, 25, 31]. Taking PDA forensics for instance, without loss of generality, physical acquisition and logical acquisition are the representative ways for acquiring the image of the RAM. For physical acquisition, a
Multimed Tools Appl (2014) 71:219–234 221
DF specialist conducts a bit-stream copy of entire RAM. For logical acquisition, a DF expert obtains a bit-stream copy of the file directory and files. Evidently, the acquisition of the internal memory could be the most challenging task during the investigation procedures in some cases, which encompasses the imaging of the ROM, RAM, and flash memory.
Fig. 2 The registration code of the GPS navigation suite, 63627541, was disclosed
Fig. 1 The DF team tried to obtain the image file of the RAM of the current PDA
222 Multimed Tools Appl (2014) 71:219–234
Especially the RAM, which is volatile in its nature, stores the executing processes and the user related data in a way that they could be permanently vanished once the power loses.
Location Based Social Networks (LBSNs) allow users to visualize the geographic location of their friends. The recent enhancements regarding interoperability, scalability, extensibility, and availability of open mobile platforms, such as Apple iPhones and Google Android smart phones, make LBSNs much more pervasive to global smart phones users. In order to investigate the actual routes that the users had really travelled, we could collect digital traces from the current mobile device and analyze those digital trails as the probative evidences in a court of law if necessary.
The DF concerning MSNS is still in its infant stage, more sophisticated researches should be done in this newly emerged scientific arena from information security point of view. Digital evidences could be disclosed and provided in a court of law to justify a suspect to be inculpatory or exculpatory as cybercrimes have become substantive and characteristic in the unprecedented MSNS era.
2.2 Our contributions
Evidently, networked smart devices are the mainstream of wireless communication gadgets. Unsurprisingly, mobility, flexibility, and portability could be integrated into one moving entity. More and more civilians are utilizing these state-of-the-art mobile communication
Multimed Tools Appl (2014) 71:219–234 223
Fig. 3 The 1st route shown on Google Map with the starting and arriving latitudes, longitudes, and the time stamps
devices under ubiquitous networking infrastructures. From the positive angle to evaluate the above trend of contemporary communication technologies, people get connected whenever they wish to as long as the wireless networks sustain. Unfortunately, from the negative viewpoint, some crime syndicates are exploiting the above technologies as the new avenue to commit cybercrimes or computer-related crimes. Consequently, appropriately disclosing and accurately analyzing the digital evidences within those networked smart devices is one of the most challenging and demanding tasks in the arena of digital forensics of mobile computing.
Hence, in this paper, we provide a generic framework for the DF specialists to ponder when they face the similar cases. We are capable of digging out the previous GPS recorded routes that the user has been actually traveled with the latitude, longitude, and the associate time stamps. Those disclosed digital evidence could be the probative digital evidences in a court of law. Live data acquisition is extremely important especially for the volatile data that are critical in cracking some criminal cases.
Currently, facebook has been an irreplaceable SNS application program for innumerable global civilians from leisure-motivated purposes to business-oriented operations. Unquestion- ably, it plays an extremely inimitable role for plentiful people in the daily social networking activities. Unarguably, if some criminal case has highly suspicious connection to facebook regarding a certain networked smart devices, the DF of a generic facebook session could be the critical and decisive element with regard to the collection of all possible digital evidences.
Regrettably, few researches have illustrated the DF of facebook in terms of crime investigations. Proverbially, facebook utilizes a unique e-mail address during the registration processes as the irreplaceable identifier for a distinct user. The research is capable of revealing the previous facebook accounts (e-mail address) that were logging on the
Fig. 5 The 1st route shown on Google Map indicating the latitudes, longitude, and the time stamp of the arriving point
Fig. 4 The 1st route shown on Google Map indicating the latitude, longitude, and the time stamp of the starting point
224 Multimed Tools Appl (2014) 71:219–234
networked smart device in order to identify the possible previous facebook users that the DF specialists could focus and then target within a short period of time.
Lately, innumerable and mushrooming attentions have been focused on the volatile memory acquisition, which plays an essential role in mobile networked computing devices especially on the crime scene. Strictly speaking, the volatile digital trails would be extinct forever once the power of the computing device is no longer sustainable. Consequently, obtaining the probative
Fig. 7 The 2nd route shown on Google Map indicating the latitude, longitude, and the time stamp of the starting point
Fig. 6 The 2nd route shown on Google Map with the starting and arriving latitudes, longitudes, and the time stamps
Multimed Tools Appl (2014) 71:219–234 225
digital evidences before evaporating is an imminent and challenging task for the DF staffs to instantaneously proceed on the crime scene in respect of those networked smart devices. In this paper, similar procedures are illustrated for the associate DF specialists to apply as references when networked smart devices are involved in a GPS and facebook session.
3 Volatile memory acquisition of a networked smart device and the corresponding digital forensics - a case review
In this research, the experiment is conducted based on the premise that there is a PDA with a Bluetooth GPS receiver accompanied with an embedded navigation software package. The popular gadget contains lots of digital evidences, which play an essential role in some specific
Fig. 9 The 3rd route shown on Google Map with the starting and arriving latitudes, longitudes, and the time stamps shown on Google Map
Fig. 8 The 2nd route shown on Google Map indicating the latitude, longitude, and the time stamp of the arriving point
226 Multimed Tools Appl (2014) 71:219–234
crime case. In this scenario, the Papago, Ver. G10 [22], which is a popular satellite navigation application program in Taiwan is being utilized. Based on historical digital records and several digital breadcrumb evidences, the DF specialists are capable of disclosing the digital trails, which could be the key evidence in cracking some criminal cases. Hence, the DF team can conduct digital evidence collection procedures with respect to those mobile computing devices that were equipped with some popular GPS navigation software. In this scenario, the PDAwas taken into custody without shutting off the networked mobile device.
3.1 Phase 1
The DF team applied Paraben’s PDA Seizure Ver. 3.0.3.93 and Microsoft ActiveSync Ver. 4.5 to obtain the image file of the RAM of the current PDA as Fig. 1 shown.
From Fig. 1, the team retrieved the registration code of the GPS navigation suite, Papago Ver. G10, 63627541, as Fig. 2 indicated. The team confirmed that the code is the unique official authorization code owned by the corporate and no other GPS navigation software packages are installed on the current PDA.
3.2 Phase 2
The team found the PDA has automatically kept records of the navigation routes. Hence, the team saved the records into a file, 092701.TR7, transforming it into an
Fig. 11 The 3rd route shown on Google Map indicating the latitude, longitude, and the time stamp of the arriving point
Fig. 10 The 3rd route shown on Google Map indicating the latitude, longitude, and the time stamp of the starting point
Multimed Tools Appl (2014) 71:219–234 227
importable file for Google Map via the conversion web site [13]. The web site is capable of converting *.TR7 files to *.KMZ and *.GPX files that can be recognizable in Google Earth and Google Map.
3.3 Phase 3
The team inspected the transformed the *.GPX file and found the latitude, longitude, and the associate time stamps for some journeys. After scrutinizing the digital data, the DF team can initially conclude that the driver had been travelling via three distinct routes. Meanwhile, the DF team uploaded the transformed KMZ file to Google Earth and obtained the corresponding expected results, which means that there are three different routes, which the driver had actually taken. The 1st route on Google Map and the digital records as indicated in Figs. 3, 4, and 5, respectively. Fig. 3 demonstrated that the driver started as the arrow pointed based on latitude (24.18351), longitude (120.613515), and the time stamp (2010-09-24 04:44:57 UTC). Further- more, the driver arrived as the arrow pointed based on latitude (24.081678), longitude (120.542058), and the time stamp (2010-09-24 05:24:57 UTC). Figures 4 and 5 support the above digital evidence interpretation. Similarly, the 2nd route on Google Map and the digital records as indicated in Figs. 6, 7, and 8, correspondingly. Alternatively, the 3rd route on Google Map and the digital records as indicated in Figs. 9, 10, and 11, accordingly.
Fig. 13 Via applying the search keyword, m[1].com, the previous facebook user, [email protected] was disclosed as the arrow pointed
Fig. 12 The most recent facebook user account, [email protected] via applying the search keyword, guest@facebook
228 Multimed Tools Appl (2014) 71:219–234
3.4 Phase 4
As facebook is one of the most popular mobile social networking platforms, the networked smart devices are often utilized to participate in the cyber social network- ing activities from leisure purposes to business operations. Most cyber folks are unaware of the fact that confidential information might accidentally reveal through this most popular social network channel nowadays. Therefore, the DF staff decides to disclose previous facebook users on this current PDA for the purpose of digging out any breadcrumb digital trails.
3.5 Phase 5
Moreover, the DF team applied the search keyword, guest@facebook, targeting on the image file of the RAM of the PDA and obtained the most recent facebook user account, [email protected], on the current mobile communication device as Fig. 12. demonstrated.
Fig. 14 After applying the search keyword, m[1].com, the previous facebook user, [email protected] was disclosed as the arrow indicated
Multimed Tools Appl (2014) 71:219–234 229
Fig. 15 By means of applying the search keyword, m[1].com, the previous facebook user, [email protected] was disclosed as the arrow showed
3.6 Phase 6
Additionally, the team employed the search keyword, m[1].com, for the purpose of disclosing the possible other previous facebook users on this PDA. As Figs. 13, 14, 15, and 16 illustrated, there were other four previous facebook users logon on the PDA. The CISO (Chief Information Security Officer) can utilize the obtained face- book accounts to explore the social network activities via the methodology presented above to discover previous facebook social network activities, which would not be the focus of this research paper.
4 Summary and review of the corresponding digital forensics results
Based on the digital trails being collected, analyzed, and reported, the digital forensics team summarizes the above digital trails as Fig. 17 depicted, which would be the essence of the paper concerning the data mining of the digital breadcrumb trails.
Fig. 17 Summary of the collected digital evidences and the corresponding discovery
Fig. 16 In respect of applying the search keyword, m[1].com, the previous facebook user, [email protected] was disclosed as the arrow demonstrated
230 Multimed Tools Appl (2014) 71:219–234
5 Conclusion
Unwarily, the digital content within the volatile memory of a networked smart device may be vanished forever once the battery drains. Thus, precious digital evidences need to be systemat- ically collected in time for the purpose of avoiding irreversible operation procedures, which might result in probative digital evidences permanently disappearing. In this paper, the volatile memory of a generic PDA is crossed examined via the image of the RAM of the mobile computing device. Additionally, the digital track file, *.TR7, was transformed to *.GPX file, which can be diagnosed concerning latitudes, longitudes, and the time stamps for the distinct trips. Furthermore, the Google Map specifically reveals the individual trips that the current user had physically pre- sented. Besides, we also demonstrate the disclosure of the most recent and previous facebook user (e-mail account) for the purposes of illustrating the associated digital evidences in order to facilitate the investigation of cybercrimes, which are relatively related to MSNS.
Acknowledgments The author would like to acknowledge the funding support of NSC (National Science Council) of Taiwan concerning the grant of Project NSC 101-2221-E-142-009. This research was partially supported by Basic Science Research Program through the National Research Foundation of Korea(NRF) funded by the Ministry of Education, Science and Technology (2012-0008296).
References
1. Acquisti A, Gross R (2006) Imagined communities: awareness, information sharing and privacy on the facebook. Lect Notes Comput Sci 4258:36–58
2. Andrew MW (2007) Defining a process model for forensic analysis of digital evidence devices and storage media. In: Proceedings of the Second International Workshop on Systematic Approaches to Digital Forensic Engineering. IEEE, SADFE 2007
3. Asher C, Aumasson JP, Phan RC-W (2009) Security and privacy preservation in human-involved networks, iNetSec. IFIP AICT 309:139–148
4. Brown R, Pham B, DeVel O (2005) Design of a digital forensics image mining system. KES 2005. Lect Notes Comput Sci 3683:395–404
5. Chen H, Chung W, Xu J, Wang G, Qin Y, Chau M (2004) Crime data mining: a general framework and some examples. IEEE Comput 37(4):50–56
6. Counts S, Fisher KE (2008) Mobile social networking: an information grounds perspective. Proceedings of the 41st Hawaii International Conference on System Sciences (HICSS). IEEE Publication, Waikoloa, Big Island, HI, pp 1–10
7. Deng C, Lin Y, Ma L, Cao Y (2011) Towards a practical and scalable trusted software dissemination system. J Converg 2(1):53–60
8. Dominguez-Sal D, Perez-Casany M, Larriba-Pey JL (2010) Cooperative cache analysis for distributed search engines. Int J Inf Technol Commun Converg 1(1):41–65
9. Dwyer C, Hiltz S, Passerini K (2007) Trust and privacy concern within social networking sites: a comparison of Facebook and Myspace. In: Proceedings of the Thirteenth Americas Conference on Information Systems, AMCIS
10. El-Khatib K, Zhang ZE, Hadibi N, Bochmann GV (2004) Personal and service mobility in ubiquitous computing environments. Wirel Commun Mob Comput 4(6):595–607
11. Ellison N, Steinfield C, Lampe C (2007) The benefits of facebook “friends:” social capital and college students use of online social network sites. J Comput Mediat Commun 12:1143–1168
12. Fengyu D, Xuerong G (2009) An Advanced Location Based Service (A-LBS) on Mobile Social Network. Proc. IEEE International Conference on Broadband Network and Multimedia Technology, ICBNMT 09. IEEE Press, pp. 740-743, October 2009
13. GPS visualizer. http://www.gpsvisualizer.com 14. Iqbal MU, Samsung L (2008) Legal and ethical implications of GPS vulnerabilities. J Int Commer Law
Technol 3(3):178–187 15. Joore P (2008) Social aspects of location-monitoring systems: the case of Guide Me and of My-SOS. Soc
Sci Inf 47:253–274 16. Keenan T (2008) On the internet, things never go away completely. IFIP Int Fed Inf Process 262:37–50
Multimed Tools Appl (2014) 71:219–234 231
17. Kryvinska N, Thanh DV, Strauss C (2010) Integrated management platform for seamless services provisioning in converged network. Int J Inf Technol Commun Converg 1(1):77–91
18. Lee S, Kim H, Lee S, Lim J (2005) Digital evidence collection process in integrity and memory information gathering. In: Proceedings of Systematic Approaches to Digital Forensic Engineering. First International Work-shop. Proc. IEEE, pp. 236–247
19. Simon M, Slay J (2010) Recovery of skype application activity data from physical memory. Proceedings of the 5th international conference on availability, reliability and security. IEEE Publication, Krakow, Poland, pp 283–288
20. Nan L, Guanling C (2009) Analysis of a location-based social network. Int Conf Comput Sci Eng 4:263– 270, August 2009, Vancouver, Canada
21. Nance K, Hay B, Bishop M (2009) Digital forensics: defining a research agenda. In: Proceedings of the 42nd Hawaii International Conference on System Sciences. IEEE Press, Waikoloa, HI, USA, Jan 2009
22. PAPAGO. http://www.mactiontech.com 23. Schapsis C (2010) Location based social networks links: a list of location based social networks, [online].
http://bdnooz.com/lbsnlocation-based-social-networking-links/ 24. Skeels MM, Grudin J (2009) When social networks cross boundaries: a case study of workplace use of
facebook and linkedin. In: Proceedings of the ACM 2009 international conference on Supporting group work, Sanibel Island, Florida
25. Sohn H, Ro YM, Plataniotis KN (2009) Content sharing based on personal information in virtually secured space. Lect Notes Comput Sci 5450:388–400
26. Strawn C (2009) Expanding the potential for GPS evidence acquisition. Small Scale Digit Device Forensic J 3(1):1–12
27. Troshynski E, Lee C, Dourish P (2008) Accountabilities of presence: reframing location-based systems. In: Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, Florence, Italy
28. Tsai JY, Kelley P (2009) Who’s viewed you?: the impact of feedback in a mobile location-sharing application. In: Proceedings of the 27th international conference on Human factors in computing systems, Boston, MA
29. Walters A, Petroni N (2007) Volatools: integrating volatile memory forensics into the digital investigation process. Blackhat Federal, Washington, DC
30. Wang JL, Loui M (2009) Privacy and ethical issues in location-based tracking systems. In: Proceedings of the IEEE Symposium on Technology and Society, Phoenix, Arizona
31. Xiong L, Tan Q (2011) A configurable approach to toleration of soft errors via partial software protection. J Converg 2(1):31–38
Dr. HaiCheng Eric Chu received his Ph.D. degree in System Science and Industrial Engineering in 1996 and Master of Computer Science in 1992 from SUNYat Binghamton respectively. He was a senior software engineer at Cheyenne Software, New York, U.S.A. in 1996. Dr. Chu was lecturing at University of Northern British Columbia (UNBC) in Canada. Currently, Dr. Chu is an associate professor at the Department of International Business of National Taichung University of Education, Taiwan. He has been devoting himself to e-Commerce over the past decade both in academic and industrial arenas. Dr. Chu attended Harvard Business School for PCMPCLV program in 2007. He has authored several textbooks respecting Management Information System, e- Commerce, Global Logistics Management, Commercial Automation, System Analysis and Design. Currently, Dr. Chu focuses on the research concerning cyber terrorism and digital forensics of mobile computing devices. Dr. Chu is an Associate Editor of Security and Communication Networks (ISSN: 1939-0122).
232 Multimed Tools Appl (2014) 71:219–234
Dr. Szu-Wei Yang received his Ph.D. degree from Japan Tokyo University. Currently, Dr. Yang is the President of National Taichung University of Education focusing on the reformation of global higher education systems. Dr. Yang received the honor as top 5 university educators from the Ministry of Education of Taiwan in year 2010. Dr. Yang strongly encourages all faculties to relentless pursuit state-of-the-art technologies and integrates them into education arena and industry cooperation.
Dr. Ching-Hsien (Robert) Hsu is currently a professor of the department of Computer Science and Information Engineering at Chung Hua University, Taiwan. His research interest is primarily in parallel and distributed computing, cloud and grid computing, P2P computing, RFID, services computing and smart homes. He has published more than 150 academic papers in journals, books and conference proceedings. He was awarded 4 times annual outstanding research award in 2005, 2006, 2007 and 2010, respectively and a distinguished award in 2008 for excellence in research from Chung Hua University. Dr. Hsu is serving in a number of journal editorial boards. He has edited more than 20 international journal special issues as a guest editor and severed many international conferences as various chairs and committee members. Dr. Hsu is currently an IEEE senior member; serve as an executive committee of IEEE Technical Committee on Scalable Computing (TCSC).
Multimed Tools Appl (2014) 71:219–234 233
Dr. Jong Hyuk Park received his Ph.D. degree in Graduate School of Information Security from Korea University, Korea. From December, 2002 to July, 2007, Dr. Park had been a research scientist of R&D Institute, Hanwha S&C Co., Ltd., Korea. From September, 2007 to August, 2009, He had been a professor at the Department of Computer Science and Engineering, Kyungnam University, Korea. He is now a professor at the Department of Computer Science and Engineering, Seoul National University of Science and Technology (SeoulTech), Korea. Dr. Park has published about 100 research papers in international journals and confer- ences. He has been serving as chairs, program committee, or organizing committee chair for many interna- tional conferences and workshops. He is a president of the Future Technology Research Association International (FTRA) and Korea Information Technology Convergence Society (KITCS). He is editor-in- chief of International Journal of Information Technology, Communications and Convergence (IJITCC), InderScience. and Journal of Convergence (JoC), FTRA Publishing. He is Associate Editor / Editor of 14 international journals including 8 journals indexed by SCI(E). In addition, he has been serving as a Guest Editor for international journals by some publishers: Springer, Elsevier, John Wiley, Oxford Univ. press, Hindawi, Emerald, Inderscience. His research interests include security and digital forensics, ubiquitous and pervasive computing, context awareness, multimedia services, etc. He got the best paper award in ISA-08 conference and the outstanding leadership awards from IEEE HPCC-09 and ICA3PP-10. Dr. Park’ s research interests include Digital Forensics, Security, Ubiquitous and Pervasive Computing, Context Awareness, Multimedia Service, etc. He is a member of the IEEE, IEEE Computer Society, KIPS, KICS, KIISC, KMMS, KDFS and KIIT.
234 Multimed Tools Appl (2014) 71:219–234
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
- c.11042_2012_Article_1349.pdf
- Digital evidence discovery of networked multimedia smart devices based on social networking activities
- Abstract
- Introduction
- Preliminary
- Related works
- Our contributions
- Volatile memory acquisition of a networked smart device and the corresponding digital forensics - a case review
- Phase 1
- Phase 2
- Phase 3
- Phase 4
- Phase 5
- Phase 6
- Summary and review of the corresponding digital forensics results
- Conclusion
- References
Sources/Do Business Students Practive Smartphone Security.pdf
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
DO BUSINESS STUDENTS PRACTICE SMARTPHONE SECURITY? Jones, Beth H;Heinrichs, Lynn R The Journal of Computer Information Systems; Winter 2012; 53, 2; Computing Database pg. 22
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Sources/Only Play in Your Comfort Zone.pdf
ORIGINAL ARTICLE
Only play in your comfort zone: interaction methods for improving security awareness on mobile devices
Peter Riedl • Rene Mayrhofer • Andreas Möller •
Matthias Kranz • Florian Lettner •
Clemens Holzmann • Marion Koelle
Received: 14 June 2014 / Accepted: 29 January 2015 / Published online: 27 March 2015
� Springer-Verlag London 2015
Abstract In this paper, we study the concept of security
zones as an intermediate layer of compartmentalization on
mobile devices. Each of these security zones is isolated
against the other zones and holds a different set of appli-
cations and associated user data and may apply different
security policies. From a user point of view, they represent
different contexts of use for the device, e.g., to distinguish
between gaming (private context), payment transactions
(secure context), and company-related email (enterprise
context). We propose multiple visualization methods for
conveying the current security zone information to the user,
and interaction methods for switching between zones.
Based on an online and a laboratory user study, we
evaluated these concepts from a usability point of view.
One important result is that in the tension field between
security and usability, additional hardware can support the
user’s awareness toward their zone context.
Keywords Mobile security � Security zones � Sandboxing � Separation � Compartmentalization
1 Introduction
Current mobile devices are becoming the primary means of
accessing information services for a significant part of the
world population 1 , and many of the services are or will
become security-critical. In addition to mobile payment,
ticketing, and physical access control applications, we ex-
pect virtual identity documents (passports, driving licenses,
etc.), personal medical data processing, and industrial
control to move toward integration into mobile devices
such as smartphones or smart wrist watches. There are two
direct implications of these trends for future mobile device
usage: (1) Many users will use their mobile phone as their
only device for performing security-relevant tasks without
any form of prior training or exposure to more traditional
computing systems, and the services and applications will
therefore need to be intuitively usable. (2) At the same
time, these application scenarios will require higher secu-
rity than currently available on mobile device platforms.
Besides, the trade-off between usability and security is
aggravated because of the highly different requirements
between applications running on the same device and the
P. Riedl
JRC u’smile, University of Applied Sciences Upper Austria,
Softwarepark 11, 4232 Hagenberg, Austria
e-mail: [email protected]
R. Mayrhofer
JRC u’smile and Institute of Networks and Security, Johannes
Kepler Universität, Altenbergerstraße 69, 4040 Linz, Austria
e-mail: [email protected]
A. Möller
Metaio GmbH, Hackerbrücke 6, 80335 Munich, Germany
e-mail: [email protected]
M. Kranz (&) � M. Koelle Embedded Interactive Systems Lab, Universität Passau,
Innstraße 43, 94032 Passau, Germany
e-mail: [email protected]
M. Koelle
e-mail: [email protected]
F. Lettner � C. Holzmann Department of Mobile Computing, University of Applied
Sciences Upper Austria, Softwarepark 11, 4232 Hagenberg,
Austria
e-mail: [email protected]
1 By the end of 2013, the number of mobile-connected devices is
expected to exceed the number of people on earth [9].
123
Pers Ubiquit Comput (2015) 19:941–954
DOI 10.1007/s00779-015-0840-5
intrinsic context dependency: using a device within one’s
own office requires a different trade-off than using it while
crossing a busy road. Current approaches of using appli-
cation-level compartmentalization and permissions for ac-
cess control do not seem to provide a reasonable trade-off
because of their low granularity of compartmentalizing a
mobile device [15].
We hence suggest to add an intermediate layer between
the physical device platform on the lower and applications
on the upper end of the stack to provide users with a small
number of well-defined and understandable security zones.
Each zone holds a different set of applications and asso-
ciated user data, and can apply different—potentially
context-aware—security policies (such as authentication or
networking restrictions). As motivating examples for ap-
plications with different security/usability requirements,
we use mobile banking, accessing sensitive company
email, and mobile gaming. These scenarios also cover the
typical issue of bring-your-own-device (BYOD) initiatives,
which describes the problem of using a personal device
(untrusted from the organization point of view) for com-
pany purposes (e.g., reading email), and the sharing of
otherwise personal devices with friends or family [20]
(mostly in the gaming/entertainment context). Our ap-
proach addresses the ‘‘malicious app’’ threat, opposed to
the ‘‘malicious user’’ threat, which is not scope of this
work.
This concept of security zones raises research questions
in terms of secure implementation [25] and concerning
usability. From a user point of view, interacting with such
zones requires both that users are aware of which zone they
are interacting with at any time—a visualization method of
the active zone—and to actively change between zones—a
switching mechanism. Even though recent research [30]
suggests that automatic, context-based switching would be
desirable, we claim that the user should also have a way to
manually override the automatically chosen zone (e.g., if
users want to check business emails while they are not at
their workplace). Therefore, our concept of proactive se-
curity zone switching can complement context-based ap-
proaches. In this paper, we focus only on usability and
compare multiple visualization and interaction mechanisms
in terms of zone distinguishability, error rate, cognitive
overhead, satisfaction, and time spent in the context of our
motivating examples. We implemented four different vi-
sualization methods (three in software, one with additional
hardware) and four different interaction methods (two
different gesture-based approaches, selection via lock
screen, and hardware switch) and present the results of
three iterative user studies. Under the assumption that the
concept of security zones is improving the security/us-
ability trade-off (backed by products such as Blackberry
Balance and Samsung Knox), our main contribution is to
present an approach for interacting with such zones that is
intuitive, exhibits a low error rate, and seems preferable to
end users.
2 Related work
Smartphones are often shared devices. Karlson et al. [20]
found that when users share their phones with family,
friends, and colleagues, different permission levels are
applied. Voicemail, text messages, and notes were seen
more critical than sharing the device for e.g., watching a
video or making a call. Interviewees highly welcomed
security models that restrict device access, backing our
assumption that users care about security and privacy as
long as it does not cause additional burden.
To increase security awareness, different visualizations
have been proposed. Dynamic Security Skins [12] try to
prevent phishing attacks by dynamically skinning secure
UI elements which are hard to predict by attackers (i.e., the
approach is a sort of visual hash). Sesame [32] is an ex-
tension of the desktop metaphor, where the desktop can be
rotated to view security-related information ‘‘behind the
scenes.’’ This should inform security decisions of the user,
e.g., whether to allow an application to access the Internet.
However, with current state of the art in mobile plat-
forms, we have to assume all devices to be insecure: even if
sandboxing techniques are used to compartmentalize ap-
plications from each other and protect the operating sys-
tems from applications (cf. [8] for proposed improvements
to the standard Android sandbox), the overall complexity
of the whole stack leads to security-relevant issues, either
in the form of exploitable bugs [10, 17] or conceptual
problems in the sandbox restrictions [14]. Egners
et al. [13] provide a classification of threats to mobile
services into owner threats, platform threats, threats to
other users, and mobile network operator threats. As an
example for current threats to mobile device users and their
installed applications, the lack of awareness for security
updates has been identified as problematic in large-scale
app store-based studies [21, 26]. In our focus on visual-
ization and interaction, we are mostly concerned with
owner threats, and suggest to use the notion of security
zones [28] as one way to reduce their impact.
Security zones are an established concept. Stajano
et al. [31] suggest a multi-user operating system with
multiple sessions, allowing individual rights for each user,
plus one public session with applications and content non-
critical for privacy. From both a usability and implemen-
tation point of view, Feske and Helmuth [16] present an
extension to the X windowing system to indicate which
security context an application window belongs to. How-
ever, mobile devices require different approaches to
942 Pers Ubiquit Comput (2015) 19:941–954
123
visualization because window managers and the resulting
window decorations are rarely available, and running ap-
plications often use full-screen modes. TreasurePhone [30]
emphasizes the dynamic character of privacy by multiple
spheres, which represent privacy requirements in a specific
context, and which can overlap. Spheres can e.g., represent
home or work contexts, but also location. From a technical
implementation point of view, security zones can be im-
plemented by virtualization [7, 19, 28].
For explicitly switching between zones, e.g., gestures
can be used. Bragdon et al. [6] analyzed touch screen
gesture designs under different conditions. According to
them, gestures do not perform worse than soft buttons,
even ‘‘on the go.’’ However, free-form gestures resulted in
a worse performance than simpler bezel gestures. Research
suggests that also the device hardware itself can be inte-
grated in the interaction. Wolf et al. [34] investigated on-
device gestures and found that e.g., drag and lift gestures
can easily be executed one-handed when using the phone.
De Luca et al. [11] suggested back-of-device interaction
for authentication patterns as unlock alternative less prone
to shoulder-surfing attacks.
3 Conceptual background and context
3.1 Security concepts
3.1.1 Motivation for employing security concepts
As Becher et al. [3] state, ‘‘with increased processing
power and memory, increased data transmission capa-
bilities of the mobile phone networks, and with open and
third-party extensible operating systems, phones become
an interesting target for attackers.’’ Security is, to many
users, a rather abstract and vague conceptual entity. Huang
et al. [18] note that in this context, ‘‘people seldom ques-
tion the benefits of using computers and Internet for
communication and doing business.’’ Among many cate-
gories of threats identified in their study, they name espe-
cially ‘‘deliberate software attacks’’ by viruses, worms, or
Trojan horses. We explicitly try to raise awareness in users
to recognize (not to prevent) this attack type. Given the
developments and spread of mobile systems and their
ubiquitous use, it is very important to investigate usable
concepts that help to ensure information security, that is the
protection of information and the systems and hardware
that use, store and transmit that information [27]. Despite
that, so far, there has not been any major attack with large-
scale implications for a large number of mobile device
users, we feel the need to raise both awareness of the users
on security issues and, at the same time, aim at providing a
usable and effective solution in everyday contexts.
Increasing the users’ responsibility in ensuring infor-
mation security demands not only knowledge on and
awareness toward security issues, but requires to increase
the value of the role of the user. This requires, according to
Albrechtsen et al. [2], motivational aspects to account for
security and a security solution that is functional and does
not demand large additional efforts. This is especially
important in situations where the user’s primary goal of
achieving a task conflicts with security. This means, e.g.,
that the user’s desire to acquire information, such as bank
account balance, might lead her to not check if the server
certificate is trustworthy. We explicitly try keeping the
needed mental load as low as possible.
We provide a selective discussion on security concepts
limited to personal mobile devices, which are mainly used
by a single user. We explicitly do not consider multi-user
device usage, e.g., as recently introduced in the Android
operating system. For these scenarios, our approach would
be implemented for every user. Related concepts, such as
safety and privacy, are not investigated within this work, as
our primary focus is on visualization and interaction
concepts.
3.1.2 Zones
The concept of zones, as we use it in this work, is that of
disjunct spheres of concerns. The zones are intended to
allow for and provide a clear separation between things
(applications, data, …) that should be kept distinct. One implementation in a mobile enterprise context, for two
zones, is the so-called ‘‘BlackBerry Balance,’’ enabling
users to keep both personal data and business data
separated from each other. This e.g., ensures that business
emails are always accessed only from the business mail
application. This concept has also been pursued in a high-
security governmental context, but also only limited to the
two zones ‘‘open’’ and ‘‘secure 2 ’’. While this distinction is
sufficient from a corporate point of view, it is not for an
individual. Being in their private zone, users might still
have different security demands, e.g., for mobile banking
or playing a web-based game.
Strictly separating the zones implies that apps might
exist multiple times—one time for each zone. An example
for this multiplicity would be an email application. The
same app will be present in each of the zones, but always
use different data, not allowing to access business data in a
private context.
During initial discussions with end users and by
evaluating existing concepts, we identified three distinctive
types of zones that can be used as a basis to separate
2 http://www.telekom.com/media/enterprise-solutions/200664, last
visited 09/09/2013.
Pers Ubiquit Comput (2015) 19:941–954 943
123
concerns on single-user mobile devices. Our concept al-
lows for the introduction of additional zones, depending on
the personal context of the mobile user (e.g., multiple
business zones instead of one if the user had multiple jobs).
A limiting factor will be though the interaction concepts
used for switching between them. We will elaborate on this
in the section on the potential mechanisms for changing
from one zone to another. The three most important types
of zones, to us, are:
• Open zone This zone is unrestricted (full network access, all apps can be installed and started at any
time). This zone could, e.g., be used when playing
games, such as ‘‘Angry Birds.’’ The purpose of this
zone is to provide all functionalities and freedom users
are currently used to. Therefore, it also faces the same
security concerns (e.g., malware infection by third party
application stores).
• Secure zone This zone is partially restricted, that is, only secure apps can be installed and executed that do
fulfill certain criteria, e.g., certain trusted applications
that come with a valid issuer certificate. This zone
could be used for applications with a higher security
demand, e.g., when confidential personal data or pay-
ment information is involved, such as mobile banking.
This zone is fully controlled by the user, in contrast to
the remotely ‘‘managed zone.’’
• Managed zone This zone is managed by an enterprise, meaning that the users cannot control themselves which
apps can be installed or which networks the device
connects to when being in this zone. The remote
administration contributes both to a high level of
security and comfort for the user. An example would be
corporate Intranet access or corporate email.
3.1.3 Security on platform level (software and hardware)
Common software-level concepts for security include ac-
cess control, e.g., on application level (only a certain user
might execute apps) or on file system or user level (only a
certain user might have access). These concepts are too
limited in several ways. It would, e.g., require the user to
have a dedicated app for each email context. This, we ar-
gue, will result in confusion (due to an additional cognitive
load upon the user to memorize which context an email app
belongs to) and maybe in a threat toward the security goals.
3.2 Interaction and visualization concepts
We have chosen Google’s Android mobile OS as basis for
our implementation, as Android allowed us more modifi-
cations at a lower system level, e.g., to substitute the lock
screen, define additional gestures, or include external
hardware. While other mobile platforms have different
overall user interface concepts, most individual interaction
concepts, such as device unlocking or touch gestures, re-
semble each other. We hence argue that an adoption and
implementation of the concepts with the iOS platform
would have yielded comparable results.
3.2.1 Interaction concepts for switching zones
Given the rich sensing and input modalities offered by
current mobile devices, different interactions for zone
switching are possible. Below we discuss the concepts on a
general level. The specific details (including figures) are
described together with the prototype. All switching
mechanisms are, from an interaction point of view, known
to the user (e.g., swiping). Thus, familiarity and thereby
educated feedback from the users should be possible, de-
spite the novel security context.
As discussed, usability of security is a key factor for
user acceptance. Therefore, the switching methods have to
be simple to perform, easy to memorize, quickly accessi-
ble, but at the same time do not have to interfere with
existing input actions.
We have presented examples discussing the usability of
both touch screen- and hardware-based mobile interaction
in the Related Work section [6, 11, 34]. We have chosen to
investigate two touch screen-based switching mechanisms
(swiping, gestures), a combination of touch screen-based
and physical input (lock screen) and hardware-based
switching mechanism (using a physical switch on the
added casing of the device).
3.2.2 Visualization concepts for zone awareness
In this part, we discuss the selected concepts for making
the user aware of the current security zone. Besides simply
using the zone names for identifying zones, colors can be a
means for unobtrusive and easily perceptible awareness of
which zone the user is currently in.
The idea of visualizing the security status of a Web site
by the use of colored browser themes has e.g., been used
by Maurer et al. [24]. They change the color of the whole
browser theme to indicate the validity of a server’s SSL
certificate and thereby the information security of the
user’s data on this page. They used a greenish theme for an
extended validation of the certificate, blue for a standard
SSL certificate and a reddish color for unencrypted page
content.
Colors for coding information have, besides many ad-
vantages, also significant shortcomings. There are cultural
differences in the interpretation and perception of colors [5,
29], though there are also indications that some asso-
ciations seem to be common in their perception [1]. In
944 Pers Ubiquit Comput (2015) 19:941–954
123
addition, there exist different types of color blindness [33].
We, though, have chosen to use color-based information
mediation of the current security zone as we feel that the
potential individual shortcomings can all be addressed and
thus counterbalanced. The display of the current zone with
the associated color might give an attacker some infor-
mation, but we feel that shoulder surfing for gaining per-
sonal data is a bigger risk toward information security than
displaying the zone information [23]. The possibility of
personalization is important regarding acceptance of ser-
vices and systems. The lack thereof might give the user a
feeling of lack of control. By adding the option to per-
sonalize the color scheme, including color values, hue, and
saturation, toward ones own preferences, we would not
only support the normal user, but also allow a color-blind
person to select distinguishable colors. We are aware that
using colors for indicating the security zones might lead to
scalability issues: on the one hand, memorizing a larger
number of color–zone associations would put a mental load
on the user; on the other hand, the number of easily dis-
tinctive colors is limited.
In our implementation, we have chosen red, green, and
blue as colors for visualizing the zones. While the colors
were mainly chosen with focus on distinctiveness, we
opted against yellow, as it could have implied a ‘‘middle
secure/dangerous’’ zone (incorrect association with traffic
lights).
The association between colors and zones was, for our
cultural context, chosen as follows:
• Red standard/open zone; red implying potential risks • Green private/secure zone; green implying safety • Blue business/managed zone; blue as distinctive 3rd
color
The color scheme can be combined with different visual-
ization elements as described in the following.
We, in the following, only used the coloring as de-
scribed below. It can be assumed that repeating the indi-
vidual color in other user interface elements will
additionally contribute to the user’s awareness. This is,
though, not part of the current work.
3.3 Motivation for software and hardware prototypes
While several alternatives could potentially be investigated
with a pure questionnaire approach or using a Wizard-of-
Oz approach with relation to the implementation, there
exists the possibility to miss a ‘‘good’’ combination of vi-
sualization and switching mechanism due to this study
setup. To be able to investigate the potential of the different
visualization and switching approaches, we designed a
three-step study setup. By this process, described in detail
below, we aimed at reducing the number of options
(number of visualizations � number of switching mechanisms) to an amount that can be handled in a hands-
on laboratory study.
4 Visualizations
In this section, we describe our proposed visualizations for
the currently active security zone and elaborate on ad-
vantages and disadvantages thereof. A summary of ad-
vantages and disadvantages of all visualizations is given in
Table 1.
4.1 Colored border visualization (CBV)
The CBV (see Fig. 1) consists of a colored border around
the entire visible screen. The intent of this visualization is
to constantly inform the user about the currently active
zone unobtrusively. Neither the notification bar nor the
displayed soft buttons are enclosed within this border. The
reason for this is that depending on the hardware (mobile
device), the soft buttons may be visible or not. The noti-
fication bar is also not visible all the time, so in order to
keep a consistent user experience, we decided to exclude
this area. One advantage of this approach is that regardless
of the running application, the user is continuously aware
of the currently active security zone. A disadvantage of this
visualization is that the border inevitably reduces the dis-
play space available for applications to a certain extent,
depending on the pixel width of the border.
4.2 Colored notification bar visualization (CNV)
The CNV (see Fig. 1) uses the notification bar to visualize
the currently active security zone. The background color of
the notification bar is set to the color of the active zone
according to the color scheme. The advantage of this vi-
sualization is that the user is informed about the currently
active security zone in an ambient manner whenever the
notification bar is visible. This is also a disadvantage of this
approach: whenever the notification bar is not visible
(e.g., when using full-screen applications), the user is not
reminded about the security zone. Another potential
Table 1 Advantages and disadvantages of the presented visualizations
Visualization Advantages Disadvantages
CBV Continuity Reduced screen size
CNV Ambient Incontinuity, theme interference
CTV Low cognitive
load
Attention shift, incontinuity, theme
interference, space requirements
HWV Continuity Additional hardware
Pers Ubiquit Comput (2015) 19:941–954 945
123
problem is customized operating system themes which
could interfere with a colored notification bar.
4.3 Colored text visualization (CTV)
The CTV (see Fig. 1), like CNV, uses the notification bar to
visualize the currently active zone. This is done by dis-
playing the name of the currently active zone in its re-
spective color according to the color scheme presented in
the Concept section. One clear advantage of this visual-
ization is the low cognitive load for the user—even if users
do not remember the color scheme, they can simply read the
name of the zone. One disadvantage is that it is not easily
possible to inform the user about the currently active zone in
an ambient manner. Users explicitly have to shift attention,
away from their current task, to the notification bar in order
to read the name of the zone. Besides this fact, it suffers
from the same disadvantages as CNV when the notification
bar is not visible or when custom themes are used.
4.4 Hardware visualization (HWV)
Unlike all previously mentioned visualizations, the HWV
(see Fig. 1) combines software and hardware to visualize the
currently active zone. We used transparent resin to cast a
case for the device which enables us to place a micropro-
cessor board in the case and multi color light emitting diodes
(LEDs) around the device. The LEDs are used to illuminate
the case in the color of the respective zone according to the
color scheme. An advantage of this visualization is that—
regardless of the displayed information on the device (e.g.,
home screen, full-screen application, etc.)—the security
zone is conveyed to the user. A disadvantage of this solution
is the need for additional hardware that is as of now not
available on off-the-shelf mobile devices.
5 Switching mechanisms
In this section, we explain all proposed switching
mechanisms and their respective advantages and disad-
vantages. A summary thereof is given in Table 2.
5.1 Gesture switching mechanism (GSM)
The GSM (see Fig. 2) leverages gestures to switch between
the different security zones. The gesture to switch to the
desired zone is the first letter of the zone name according to
the one stroke alphabet [4]. This alphabet uses gestures that
closely resemble well-known Arabic letters that can still be
drawn in a single stroke. We chose this approach to
minimize the learning effort and cognitive load for the
user. An advantage of GSM is that the desired zone can be
directly accessed, which could reduce the task time for
experienced users. Disadvantages are that the user has to
remember all zone names and that recognition—especially
of more complex gestures—is error-prone.
5.2 Lock screen switching mechanism (LSM)
The LSM enhances the lock screen with the functionality to
switch between security zones. In contrast to all other
switching mechanisms presented here, LSM requires switch-
ing to the lock screen to perform a zone change. The full
description of the switching process is depicted in Fig. 3.
With LSM, the user can directly access the desired zone
without having to navigate through other zones. To perform a
switch with LSM, the user has to perform more actions than
with the other switching mechanisms. Because the names of
all available zones are displayed on the lock screen, there is no
need to remember the order of zones (as e.g., necessary for
SSM), or which zones are available. Another advantage of
LSM is the increased awareness about the zone switch.
Fig. 1 Security zone visualizations from left to right:
HWV hardware visualization,
CBV colored border
visualization, CNV colored
notification bar visualization,
CTV colored text visualization
Table 2 Comparative discussion of the four switching mechanisms in terms of selected properties
Switching Advantages Disadvantages
GSM Direct access Cognitive load, error-prone
LSM Direct access,
awareness
Multiple steps, time-consuming
SSM Simple, well-
known
Error-prone, no direct access, in-
app gesture interference
HSM Simple, awareness,
haptic feedback
No direct access, additional
hardware, limited number of
zones
946 Pers Ubiquit Comput (2015) 19:941–954
123
5.3 Swipe switching mechanism (SSM)
The SSM (see Fig. 4) utilizes a horizontal three-finger
swipe gesture to switch between security zones. One
common application for that interaction method is
e.g., browsing through a picture gallery. We adopted this
technique to browse through security zones in a circular
manner. This means, consecutive swipes in the same di-
rection (left or right) will switch through all available zones
until the initial zone is reached again eventually. One ad-
vantage of this approach is simplicity.
This might include the potential for unintentional zone
changes. A disadvantage of SSM is that the desired zone
cannot be accessed directly—it may happen that the user
has to swipe through several zones to reach the desired one.
5.4 Hardware switching mechanism (HSM)
In order to switch between zones using the HSM (see
Fig. 5), we again leverage the custom-built transparent
resin case. Besides LEDs, we mounted a three-state (left,
center, right) slide switch on the top of the case. The state
of the switch directly determines the selected security zone.
We intentionally did not place the switch on the sides of
the case to avoid accidental zone switches and to enforce
explicit user interaction to raise awareness about the cur-
rently active security zone.
One disadvantage of this approach is the need for ad-
ditional hardware. Another disadvantage is that if the
current zone is the one associated with the left position and
users want to switch to the zone associated with the right
position, they inevitably have to go through the zone at the
center position. The HSM also limits the number of secu-
rity zones to the number of available states.
6 Evaluation
6.1 Scenarios
The scenario the participants were presented was inspired
by a typical workday. The daily routine of getting up,
performing tasks at work, and relaxing in the evening was
imitated. The story associated with the scenario started
with the user getting up in the morning and checking the
private bank account. This is a typical example for the use
of the Secure zone. The second task was to check business
emails—in the Managed zone. Finally, after the workday,
the task was to relax playing a game, to be performed in the
Open zone.
6.2 Questionnaire
To gain user feedback on the zone visualizations and
switching mechanisms, we used a questionnaire both in the
online and the laboratory study. Subjects rated the look and
effectiveness of visualizations, and the memorability and
simplicity of switching mechanisms. While the ratings
Fig. 2 The gesture switching mechanism (GSM) allows to directly switch to the desired zone by drawing the starting letter of the zone
name. Note The border color indicates the zone that will be switched
to after the gesture
Fig. 3 The lock screen switching mechanism (LSM)
allows to change zones on the
lock screen. For the depicted
switching method, the colored
border visualization (CBV) has
been used in this example
Pers Ubiquit Comput (2015) 19:941–954 947
123
were based on video demonstrations in the online study,
they were based on a real prototype in the laboratory study.
In addition, we collected in the online study, in a second
part of the questionnaire, information on mobile device
usage. These questions covered in particular the number
and purpose of used devices, their operating systems,
separation between work and private devices and tasks
associated with these devices. Goal of these questions was
to obtain an impression of current device usage and
awareness for potential security risks associated with this
usage behavior.
If not stated otherwise, questionnaire items were an-
swered on a five-step Likert scale, where one corresponds
to ‘‘strongly disagree’’ and five to ‘‘strongly agree.’’ When
reporting the results, we use a for significance levels and r for standard deviations.
6.3 Pilot study
We conducted a pilot study to test the questionnaire, the
implementations of the prototype and the logging
mechanism, and to identify potential problems. The pilot
was run with 30 participants (four female, 26 male, avg.
age 29, r = 4.3) who answered the questionnaire and evaluated the visualizations and switching mechanisms.
The pilot revealed some interesting findings on what could
be improved for the next iteration of the prototype. The
initial zone names Standard, Private, and Business were
changed to Open, Secure, and Managed, since especially
Private was frequently misconceived as the leisure zone,
instead of the privacy-preserving zone. Further, we im-
proved the gesture recognition, as some participants had
problems drawing the zone name in the GSM method.
Likewise, some wordings in the questionnaire were
improved.
6.4 Online study
6.4.1 Participants
One hundred and fifty participants took part in the survey
(36 female, 114 male); the average age was 27 years (r = 5.8). They were recruited via social network cross-posting
(second-tier network context) so that the initiator was un-
known, which suggests unbiasedness in participation. Most
subjects originated from Central Europe and the UK, but
also from Asia and India.
6.4.2 Task and measurements
Participants answered an online questionnaire consisting of
two parts. In the first part, we asked about the usage be-
havior of mobile devices, especially with relation to mul-
tiple devices and security-related aspects. We hoped to
gather indicators on potential security problems, motivat-
ing our zone concept.
In the second part, the zone concept presented above
was introduced to subjects. After a textual description of
the concept, videos of three zone visualizations and three
switching mechanisms were shown and subsequently
evaluated by the subjects. The presented visualizations of
the current zone were CNV, CBV, and CTV (cf. Sect. 4).
The presented switching mechanisms were SSM, GSM, and
LSM. The order of the presentation of visualization and
switching mechanisms in the questionnaire was random-
ized between participants to avoid learning effects.
Fig. 4 The swipe switching mechanism allows to switch
between zones with a three-
finger swipe gesture
Fig. 5 The hardware switching mechanism utilizes the sliding switch mounted on the custom-built case to switch between zones
948 Pers Ubiquit Comput (2015) 19:941–954
123
6.5 Online study results
6.5.1 Device usage
Sixty-one percentage of subjects own more than one mo-
bile device; 10 % have even four or more. The most
common device type were phones, followed by tablets,
and, significantly less, media consumption devices (music
players, ebook readers), and sports devices (fitness track-
ers, etc.). The most common platforms in our sample were
Android (57 %) and iOS (19 %).
If subjects have multiple devices, they are also using
them regularly. Forty-one percentage use their primary
device everyday. For secondary devices, daily usage was
reported by 57 % of subjects, for tertiary devices by 71 %,
and for quaternary devices by even 87 %. At first sight, this
looks as if primary devices are used less frequently than
non-primary devices. However, the rising quotas for sec-
ondary to quaternary devices reflect the fact that the per-
centage values for the n-th device include subjects that only
have n devices in total.
This means the more devices people have, the more they
tend to use all of them—potentially in different
environments.
In particular, we were interested in what those devices
are used for (e.g., shared work and private usage on one
device), which would justify the proposed zone concept.
The amount of business-related usage rises from primary to
quaternary devices, probably because non-primary devices
are often dedicated work phones or tablets. While 20 % use
their primary device for business purposes, the amount of
work usage is 33 % for the secondary, 31 % for tertiary,
and 67 % for quaternary devices. However, we found that
work usage is not exclusive: 17 % use their primary device,
29 % the secondary, 28 % the tertiary, and 53 % the
quaternary device for both private and work applications.
Only 66 % of subjects indicated to separate devices by task
(e.g., using their work device only for office tasks and their
private device only for private tasks). Even less (28 %)
separate by location (e.g., using their work device only in
the secure enterprise network). This implicitly tells about
the security awareness of subjects. For example, some
subjects stated to read business mails on private devices (or
the other way round), to use their business phones to do
payments (e.g., banking), and to use social network apps.
6.5.2 Zone visualizations
Subjects rated the look (‘‘The look of the visualization was
appealing’’) and effectiveness (‘‘The different zones were
distinguishable with the visualization’’) of each of the three
visualizations. Friedman rank sum tests revealed a
significant effect of visualizations on look (v2 = 47.92, p \ 0.001) and effectiveness (v2 = 9.11, p = 0.01). Post hoc Wilcoxon tests with Bonferroni correction showed that the
look of CNV was rated significantly better than that of the
other visualizations (p \ 0.001), and that the effectiveness of CNV was significantly better than of CBV (p = 0.008).
There were no significant differences in look or effective-
ness between CBV and CTV. The results are visualized in
Fig. 6a.
Subjects presumably found the color in the notification
bar easier to perceive than at the screen border. Addition-
ally, some criticized the loss of screen real estate with the
border visualization. In the free-text comments in the
questionnaires, participants mentioned general drawbacks
both for text and color representations. Color (both for
CNV and CBV) requires the memorization of the mapping
to the respective zones, which is not a problem of CTV.
However, CTV takes up precious space in the notification
bar. Another raised issue is the usage of color-only repre-
sentation for color-blind users. However, in Sect. 3, we
presented an idea on how to resolve this by custom color
schemes.
6.5.3 Switching mechanisms
Subjects rated each switching mechanism in the dimen-
sions memorability (‘‘The switching mechanism can easily
be memorized’’), and simplicity of execution (‘‘The
switching mechanism can be applied easily’’). In all di-
mensions, LSM was evaluated best; second-best was SSM,
followed by GSM. Friedman rank sum tests showed a
significant effect of switching mechanisms on under-
standability (v2 = 28.65, p \ 0.001), memorability (v2 = 84.38, p \ 0.001), and simplicity (v2 = 88.79, p \ 0.001). Post hoc Bonferroni-corrected Wilcoxon tests showed differences between all mechanisms to be sig-
nificant, with p \ 0.002 for understandability and p \ 0.001 for memorability and simplicity. The results are shown in Fig. 6b.
Results suggest that GSM was seen as too complicated,
which was confirmed by free-text answers in the ques-
tionnaire. It requires, firstly, a high cognitive effort to re-
member the first letter of the desired zone, and secondly,
the drawing skill to fulfill the gesture. SSM was easier to
understand and perform, but has a higher risk of accidental
switches and of a confusion with multi-finger swipes that
are mapped to other functions within applications. Like-
wise, the ‘‘position’’ of each zone must be memorized to
know whether to swipe left or right. LSM does not require
to remember a mapping between the desired zone, and it is
unlikely to be performed erroneously. However, in its
present form, it is applicable only for a limited number of
Pers Ubiquit Comput (2015) 19:941–954 949
123
zones (fitting around the unlock circle). In order to scale for
significantly more zones, a recursive pie selection
mechanism could be applied, similar to e.g., the contextual
menu in Android 4.3’s stock camera app.
6.6 Laboratory study
6.6.1 Motivation
With the online study, we gained first usability results of
our initial choice of visualizations and switching mechan-
isms. It helped us to define a manageable subset for a
laboratory study, in which the methods could now be
evaluated based on hands-on experiments. We excluded
GSM, as this was the significantly worst rated switching
mechanism. Instead, we introduced HSM as new condition
(which was not part of the previous study since it would
have been difficult to evaluate online). For visualizations,
we added HWV and instead dropped CBV. First, CBV re-
ceived a rather poor rating and, second, HWV shares the
idea of continuity (going around the whole screen) with
CBV, so that we considered HWV as improved replacement
of CBV, using the feedback from the pilot study.
6.6.2 Participants
Thirty volunteers took part in the study. Nine were female,
21 male; the average age was 33 years (r = 10.3). All participants except one were right handed. A multitude of
professions was covered by the participants (e.g., gardener,
researcher...). However, the minority of them were familiar
with compartmentalization concepts like BlackBerry Zone
(1/30) or Android multi-user functionality (3/30). This also
accounts for unbiasedness toward the presented experiment.
Fig. 6 Evaluations of zone visualizations and switching
mechanisms in the online study.
a Online study: evaluation of zone visualizations, b Online study: evaluation of switching
mechanisms
950 Pers Ubiquit Comput (2015) 19:941–954
123
6.6.3 Task and measurements
Subjects performed a task according to the scenario de-
scribed in the beginning of the Evaluation section. The task
consisted in launching three applications, each in a dif-
ferent zone (the business email app in the Managed zone,
the home banking app in the Secure zone, and a game in
the Open zone). It was up to participants to decide which
was the right zone for each task. Each participant per-
formed the task three times, each time with a different of
the following switching mechanisms: Swiping with three
fingers (SSM), using a hardware switch (HSM), and se-
lecting the zone from the unlock mechanism on the lock
screen (LSM). The order of switching mechanisms was
randomized to avoid learning effects.
The zone visualizations were varied in a between-sub-
jects design. Each group used one of the following visu-
alizations for all tasks: CNV, CTV, or HWV. After each
task, subjects evaluated their experience in a questionnaire.
All interactions (touch events, the currently visible
screen, etc.) on the device were logged with the method-
ology as described by Lettner et al. [22]. This did not only
allow us to capture the exact time needed to complete the
task, but also to detect whether subjects made errors (every
deviation from the optimal path to navigate to the desired
zone was considered an error).
6.7 Laboratory study results
6.7.1 Zone visualizations
Similar to the online study, the three visualizations were
rated by the dimensions look and effectiveness. A Fried-
man test showed a significant effect of visualizations on
look (v2 = 9.92, p = 0.007) and on effectiveness (v2 = 7.19, p = 0.03). Post hoc Wilcoxon tests with Bonferroni cor-
rection showed that the look of CNV was rated significantly
better than of the other visualizations (p \ 0.05); there was no significant difference between HWV and CTV. Further,
CNV was significantly more effective than CTV
(p \ 0.005). The results are visualized in Fig. 7a. CNV and HWV can thus be both considered as best
options with relation to ‘‘effectiveness.’’ However, HWV
performs worse in the ‘‘appeal of look’’ category, which
may have two reasons. First, the case is in early prototypic
state and does not yet look as smooth as a final product.
Second, some participants noted that they do not want
nearby persons to see in which zone they currently are.
This privacy problem could be addressed by a customiz-
able matching of colors and zones. A certain color would
then only have a meaning to the owner of the device and
not provide any information to others.
6.7.2 Switching mechanisms
Subjects rated each switching mechanism in the dimen-
sions memorability and simplicity of execution. There was
a significant effect of switching mechanisms on memora-
bility (v2 = 14.56, p \ 0.001) and simplicity (v2 = 10.05, p \ 0.007). Post hoc Wilcoxon tests with Bonferroni cor- rection showed that HSM was easier to memorize and
simpler to perform than LSM (p \ 0.05). There were no significant differences between the other methods. All an-
swers can be seen in Fig. 7b.
Interestingly, this result differs from the online study,
where LSM was evaluated to be significantly simpler. This
could be due to the drawback of LSM that the user must
switch off and on the device to change zones. This addi-
tional step was probably less noticeable in the online study.
The higher number of steps presumably were responsible
for the fact that LSM received an even weaker memora-
bility rating than SSM, although SSM requires actually
more memorization (of each zone’s position), which LSM
does not.
6.7.3 Zone switching performance
Subjects performed the zone switching task with HSM in
averagely 38.27 s (r = 16.87 s). The average time needed with SSM was 44.30 s (r = 23.88 s), and with LSM it was 53.87 s (r = 29.18 s). With one-way repeated-measure ANOVA, we found a significant effect of the switching
mechanism on task time (F(2,58) = 5.123, p \ 0.01, partial g2 = 0.07). Post hoc t-tests (with Bonferroni correction) revealed the significant difference between HSM and LSM
(p \ 0.05). The results are visualized in Fig. 8a. The error rate was lowest with LSM with averagely 0.77
errors (r = 1.10), followed by HSM with averagely 1.10 errors (r = 0.99), and by SSM with averagely 2.07 errors (r = 1.91). A one-way repeated-measure ANOVA showed a
significant effect of the switching mechanism on errors
(F(2,58) = 3.194, p \ 0.01, partial g2 = 0.14). Post hoc t- tests (with Bonferroni correction) revealed that the error
number was significantly higher in SSM than in HSM
(p \ 0.05) and LSM (p \ 0.001). The results are shown in Fig. 8b.
The measurements show a clear advantage for HSM, in
comparison with software-based methods regarding the
switching time. While LSM showed similarly little errors
compared to HSM, it was clearly the slowest method, as the
display always had to be switched off and on again to get
into the lock screen. The greatest drawback of SSM was its
high error rate, which supports our proposition that a
hardware-based solution is the best alternative both in
terms of speed and errors.
Pers Ubiquit Comput (2015) 19:941–954 951
123
7 Discussion
Objective and subjective measurements showed that dif-
ferent visualizations and switching mechanisms yield sig-
nificant usability differences. In line with our
argumentation that security concepts must be usable to be
accepted and applied by users, we intend to give recom-
mendations toward achieving this goal with our findings. In
the following, we summarize and discuss the most sig-
nificant lessons learned.
Color (CTV and HWV) was more popular than text
(CTV) to visualize the current zone, suggesting that the
attention shift required for CTV was problematic. Thus, we
suggest to use (at least an additional) color-coding for vi-
sualizing the zone. A hardware solution has, in addition,
the advantage that it is harder to manipulate and also
visible for full-screen apps.
For switching between zones, complex gestures (GSM)
turned out to be too complicated. While multi-finger
swiping (SSM) was easier, the risk of interference with
other gestures was still given. The lock screen mechanism
(LSM) was an all-discipline ‘‘winner’’ in theory (i.e., in the
online study), but turned out as the slowest method in the
laboratory study. A clear favorite was the hardware switch
(HSM), which was both intuitive and fast. It is, however,
only applicable for a small number of zones. While we
argued that for most cases such a small number will suffice,
this could still be a drawback for more complex scenarios.
The software-based switching mechanisms support
(through adaptation) more zones.
For multi-user device sharing, a future challenge will be
how to switch between user accounts and zones (e.g., the
question whether selecting the user or the zone first). A
possible solution could be to implement user switching via
Fig. 7 Evaluations of zone visualizations and switching
mechanisms in the laboratory
study. a Laboratory study: evaluation of zone
visualizations, b laboratory study: evaluation of switching
mechanisms
952 Pers Ubiquit Comput (2015) 19:941–954
123
the lock screen (as, e.g., in current Android versions) and
combine this with a hardware switch for the zones.
8 Conclusion
The presented work discusses the concept of security zones
in terms of zone visualization and inter-zone switching.
Security zones allow to introduce an intermediate layer of
compartmentalization to mobile interaction which allows
the user to act within distinct semantic contexts in order to
account for different security and privacy needs. As two
key requirements, we identify the induction of the users’
awareness of which zone they are currently acting in, and
the provision of a mechanism that enables to actively
switch among zones.
We presented an evaluation of four visualization types
and four switching mechanisms staged into pilot, online,
and laboratory study. Our results imply that additional
hardware can provide usable zone awareness and switch-
ing, and is thus a promising candidate for further
investigations.
Future work could include refinements of the presented
concepts above, and adapting them to more scenarios. One
challenge is the integration of security zones with multiple
user accounts and a thorough investigation of related
questions (e.g., if then several open zones would exist).
Furthermore, as we have argued for the benefits of hard-
ware modifications, we plan to combine the presented
hardware-based switching mechanisms and visualizations
with hardware-level security (e.g., TPM). We will also
investigate the effectiveness of zone visualizations with
relation to attacks, i.e., how well users can detect when
frauds try to mislead them by mimicking a different zone.
Acknowledgments Part of this work has been carried out within the scope of u’smile, the Josef Ressel Center for User-Friendly Secure
Mobile Environments. We gratefully acknowledge funding and sup-
port by the Christian Doppler Gesellschaft, A1 Telekom Austria AG,
Drei-Banken-EDV GmbH, LG Nexera Business Solutions AG, and
NXP Semiconductors Austria GmbH. Part of this work has been
carried out within the project ‘‘AUToMAte – Automatic Usability
Testing of Mobile Applications’’ funded by the Austrian Research
Promotion Agency (FFG) under Contract Number 839094.
References
1. Adams FM, Osgood CE (1973) A cross-cultural study of the
affective meanings of color. Cross-Cultural Psychol 135–156.
doi:10.1177/002202217300400201. http://jcc.sagepub.com/con
tent/4/2/135.abstract
2. Albrechtsen E (2007) A qualitative study of users’ view on in-
formation security. Comput Secur 276–289. doi:10.1016/j.cose.
2006.11.004. http://www.sciencedirect.com/science/article/pii/
S0167404806002033
3. Becher M, Freiling F, Hoffmann J, Holz T, Uellenbeck S, Wolf C
(2011) Mobile security catching up? Revealing the nuts and bolts
of the security of mobile devices. In: IEEE symposium on se-
curity and privacy, pp 96–111. doi:10.1109/SP.2011.29
4. Blickenstorfer CH (1995) Graffiti: Wow!. Pen Comput Mag
1:30–31
5. Bornstein MH (1973) Color vision and color naming: a psy-
chophysiological hypothesis of cultural difference. Psychol Bull
257–285. http://www.biomedsearch.com/nih/Color-vision-color-
naming-psychophysiological/4742311.html
6. Bragdon A, Nelson E, Li Y, Hinckley K (2011) Experimental
analysis of touch-screen gesture designs in mobile environments.
In: Proceedings of the CHI. ACM, pp 403–412. doi:10.1145/
1978942.1979000
7. Brakensiek J, Dröge A, Botteck M, Härtig H, Lackorzynski A
(2008) Virtualization as an enabler for security in mobile devices.
In: Proceedings of the IIES. ACM, pp 17–22. doi:10.1145/
1435458.1435462
8. Bugiel S, Davi L, Dmitrienko A, Heuser S, Sadeghi AR, Shastry
B (2011) Practical and lightweight domain isolation on android.
In: Proceedings of the SPSM’11. ACM, pp 51–62. doi:10.1145/
2046614.2046624
9. Cisco (2013) Visual Networking Index: Global Mobile Data
Traffic Forecast Update, 2012–2017. Tech. rep
10. Davi L, Dmitrienko A, Sadeghi AR, Winandy M (2011) Privilege
escalation attacks on android. In: Proceedings of the ICS.
Springer, pp 346–360. http://dl.acm.org/citation.cfm?id=
1949317.1949356
11. De Luca A, von Zezschwitz E, Nguyen NDH, Maurer ME,
Rubegni E, Scipioni MP, Langheinrich M (2013) Back-of-device
authentication on smartphones. In: Proceedings of the CHI.
ACM, pp 2389–2398. doi:10.1145/2470654.2481330
Fig. 8 Measurements of task completion time and errors for
the zone switching task,
Comparing Hardware (HSM),
Swipe (SSM), and Lock screen
(LSM) switching mechanisms.
The error bars indicate the
standard error. a Task completion times, b task errors
Pers Ubiquit Comput (2015) 19:941–954 953
123
12. Dhamija R, Tygar JD (2005) The battle against phishing: dy-
namic security skins. In: Proceedings of the SOUPS. ACM,
pp 77–88. doi:10.1145/1073001.1073009
13. Egners A, Marschollek B, Meyer U (2012) Hackers in your
pocket: a survey of smartphone security across platforms. Tech.
rep. http://itsec.rwth-aachen.de/publications/ae_hacker_in_your_
pocket.pdf
14. Egners A, Meyer U, Marschollek B (2012) Messing with an-
droid’s permission model. In: Proceedings of the TrustCom.
IEEE. 2012, pp 505–514. doi:10.1109/TrustCom.203
15. Felt AP, Ha E, Egelman S, Haney A, Chin E, Wagner D (2012)
Android permissions: user attention, comprehension, and behav-
ior. In: Proceedings of the SOUPS. ACM, pp 3:1–3:14. doi:10.
1145/2335356.2335360
16. Feske N, Helmuth C (2005) A nitpicker’s guide to a minimal-
complexity secure GUI. In: Proceedings of the ACSAC, pp 85–94
17. Höbarth S, Mayrhofer RA (2011) Framework for on-device pri-
vilege escalation exploit execution on android. In: Proceedings of
the IWSSI/SPMU, pp 1–6
18. Huang DL, Rau PL, Salvendy G (2007) A survey of factors in-
fluencing people’s perception of information security. In: Hu-
man–computer interaction: applications and services, LNCS.
Springer, pp 906–915. doi:10.1007/978-3-540-73111-5_100
19. Hwang JY, Suh SB, Heo SK, Park CJ, Ryu JM, Park SY (2008)
Xen on arm: system virtualization using xen hypervisor for
ARM-based secure mobile phones. In: Proceedings of the CCNC.
IEEE, pp 257–261. doi:10.1109/ccnc08.2007.64
20. Karlson AK, Brush AB, Schechter S (2009) Can I borrow your
phone?: Understanding concerns when sharing mobile phones. In:
Proceedings of the CHI. ACM, pp 1647–1650. doi:10.1145/
1518701.1518953
21. Kranz M, Murmann L, Michahelles F (2013) Research in the
large: challenges for large-scale mobile application research—a
case study about NFC adoption using gamification via an App
store. IJMHCI 5(1), 45–61. doi:10.4018/jmhci.2013010103.
http://www.igi-global.com/article/research-large-challenges-large-
scale/76334
22. Lettner F, Holzmann C (2012) Automated and unsupervised user
interaction logging as basis for usability evaluation of mobile
applications. In: Proceedings of the MOMM. ACM, pp 118–127.
doi:10.1145/2428955.2428983
23. Luo XR, Brody R, Seazzu AF, Burd SD (2011) Social engi-
neering: the neglected human factor for information security
management. IRMJ 24(3):1–8. doi:10.4018/irmj.2011070101
24. Maurer ME, De Luca A, Stockinger T (2011) Shining chrome:
using web browser personas to enhance SSL certificate visual-
ization. In: Proceedings of the INTERACT, LNCS. Springer,
pp 44–51. doi:10.1007/978-3-642-23768-3_4
25. Mayrhofer R (2013) When users cannot verify digital signatures:
on the difficulties of securing mobile devices. In: Proceedings of
the TSP. IEEE
26. Möller A, Michahelles F, Diewald S, Roalter L, Kranz M (2012)
Update behavior in app markets and security implications: a case
study in google play. In: Poppinga B (ed) Proceedings of the 3rd
international workshop on research in the large. Held in Con-
junction with Mobile HCI, pp 3–6
27. Polla ML, Martinelli F, Sgandurra D (2013) A survey on security
for mobile devices. IEEE Communications Surveys & Tutorials,
pp 446–471. doi:10.1109/SURV.2012.013012.00028
28. Riedl P, Koller P, Mayrhofer R, Möller A, Koelle M, Kranz M
(2013) Visualizations and switching mechanisms for security
zones. In: Proceedings of international conference on advances in
mobile computing & multimedia, MoMM ’13,
pp 278:278–278:281. ACM, New York. doi:10.1145/2536853.
2536948
29. Segall MH, Campbell DT, Herskovits MJ (1966) The influence of
culture on visual perception. Bobbs-Merrill, New York
30. Seifert J, De Luca A, Conradi B, Hussmann H (2010) Trea-
surePhone: context-sensitive user data protection on mobile
phones. In: Proceeding of the pervasive, LNCS. Springer,
pp 130–137. doi:10.1007/978-3-642-12654-3_8
31. Stajano F (2006) One user, many hats; and, sometimes, no hat:
towards a secure yet usable PDA. In: Proceedings of the SP.
Springer, pp 51–64. doi:10.1007/11861386_6
32. Stoll J, Tashman CS, Edwards WK, Spafford K (2008) Sesame:
informing user security decisions with system visualization. In:
Proceedings of the CHI. ACM, pp 1045–1054. doi:10.1145/
1357054.1357217
33. Wald G, Brown PK (1965) Human color vision and color
blindness. In: Symposium on quantitative biology, vol 30, Cold
Spring Harbor, pp 345–361
34. Wolf K, McGee-Lennon MR, Brewster SA (2012) A study of on-
device gestures. In: Proceedings of the mobile HCI (Companion),
pp 11–16. doi:10.1145/2371664.2371669
954 Pers Ubiquit Comput (2015) 19:941–954
123
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
- c.779_2015_Article_840.pdf
- Only play in your comfort zone: interaction methods for improving security awareness on mobile devices
- Abstract
- Introduction
- Related work
- Conceptual background and context
- Security concepts
- Motivation for employing security concepts
- Zones
- Security on platform level (software and hardware)
- Interaction and visualization concepts
- Interaction concepts for switching zones
- Visualization concepts for zone awareness
- Motivation for software and hardware prototypes
- Visualizations
- Colored border visualization (CBV)
- Colored notification bar visualization (CNV)
- Colored text visualization (CTV)
- Hardware visualization (HWV)
- Switching mechanisms
- Gesture switching mechanism (GSM)
- Lock screen switching mechanism (LSM)
- Swipe switching mechanism (SSM)
- Hardware switching mechanism (HSM)
- Evaluation
- Scenarios
- Questionnaire
- Pilot study
- Online study
- Participants
- Task and measurements
- Online study results
- Device usage
- Zone visualizations
- Switching mechanisms
- Laboratory study
- Motivation
- Participants
- Task and measurements
- Laboratory study results
- Zone visualizations
- Switching mechanisms
- Zone switching performance
- Discussion
- Conclusion
- Acknowledgments
- References
Sources/Trust Based Authentication Scheme.pdf
O R I G I N A L A R T I C L E
Trust-based authentication scheme with user rating for low-resource devices in smart environments
Anas El Husseini • Abdallah M’Hamed •
Bachar El Hassan • Mounir Mokhtari
Received: 20 November 2011 / Accepted: 15 March 2012 / Published online: 3 May 2012
� Springer-Verlag London Limited 2012
Abstract In smart environments, pervasive computing
contributes in improving daily life activities for dependent
people by providing personalized services. Nevertheless,
those environments do not guarantee a satisfactory level for
protecting the user privacy and ensuring the trust between
communicating entities. In this study, we propose a trust
evaluation model based on user past and present behavior.
This model is associated with a lightweight authentication
key agreement protocol (Elliptic Curve-based Simple
Authentication Key Agreement). The aim is to enable the
communicating entities to establish a level of trust and then
succeed in a mutual authentication using a scheme suitable
for low-resource devices in smart environments. An inno-
vation in our trust model is that it uses an accurate
approach to calculate trust in different situations and
includes a human-based feature for trust feedback, which is
user rating. Finally, we tested and implemented our scheme
on Android mobile phones in a smart environment dedi-
cated for handicapped people.
Keywords Smart environments � Privacy preservation � Trust evaluation � Authentication � Low-resource devices
1 Introduction
Trust, Anonymity and Privacy preservation are known as
major factors to the acceptance and the success of perva-
sive computing systems. Service Platforms tend to collect
and manage a large amount of personal information about
individuals in order to authenticate users and/or provide
personalized services, therefore threating privacy and
causing a conflict between service providers and personal
information owners. People dislike automatic spread of
personal and identifiable data, especially when it is trans-
ferred to other parties beyond control [1, 2]. The trade-off
between privacy and collecting private data for authenti-
cation poses nowadays a great challenge to security
designers in smart environments.
For disabled and aging users, smart environments are
deployed to facilitate every day life activities and adapt to
their needs. A ubiquitous computing environment entails an
extensive and complex computer architecture deployment,
sophisticated data control and a judicious external interface
facilitating user interaction with the system [3]. The char-
acteristics of ubiquitous systems amplify the concern of
security problems, by promoting spontaneous interactions
between diverse heterogeneous entities [4]. However,
within those environments, the security and confidentiality
of sensitive data have to be guaranteed. Beside that the
anonymity and privacy of the users should be protected,
therefore personal information concerning users like names,
addresses, financial data and medical profile should not be
allowed to flow freely without protection. Therefore, one of
the foundations of the security of users in smart environ-
ments is to protect individuals privacy.
Several researchers [1, 2] have admitted that smart
environments are vulnerable to many security and privacy
threats and that securing pervasive computing present
A. El Husseini (&) � A. M’Hamed � M. Mokhtari Telecom SudParis, Handicom Lab, Evry, France
e-mail: [email protected]
A. El Husseini � B. El Hassan LaSTRe Lab, Azm Center for Scientific Research,
Lebanese University, Tripoli, Lebanon
123
Pers Ubiquit Comput (2013) 17:1013–1023
DOI 10.1007/s00779-012-0548-8
critical challenges at many levels [5–7]. Below, some of
the challenges addressed in [8] are outlined:
1. Privacy Issues: Sensors and actuators distributed in
space expose a great danger to user privacy since the
information collected can be disclosed to intruders,
malicious insiders and tracking systems.
2. User Interaction Issues: The access control mecha-
nisms in pervasive environments should allow users to
interact easily with devices while ensuring an appro-
priate authentication.
3. Security Policies: Smart environments should have a
convenient method to define and manage security
policies with dynamicity and flexibility, with respect to
the behavior of entities in their systems.
4. Two new security challenges, introduced by Tentori
and Favela [9], are to be added: Quality of Privacy
(QoP) and Trustworthy Authentication. The second is
combination of trust and authentication in one scheme.
In this paper, we design a trust model and implement it
associated with an authentication protocol. The aim is to
introduce an intermediate phase that evaluates the trust-
worthiness of communicating entities before the phase of
service provision. Our scheme will preserve and protect
user privacy since it will use non-sensitive information in
the evaluation process of the trust. What makes trust
evaluation models really needed in smart environments is
that they create a secure yet more flexible environments
that what security policies alone cannot do. That is because
the strictness of static policies may limit the freedom of
normal users while it is potentially vulnerable to malicious
users; on the other hand, trust systems are very adaptive to
the user needs, actions and behaviors. In our enhanced trust
model, we also integrated two new ideas. The first is
Questions of Trust that aims to enhance the model immu-
nity against malicious manipulation of trust values, as well
as dealing more efficiently with situations where there are
only new neighbors. The other innovation is User Rating
that allows users to give feedback about the quality of
service they received, which will accordingly affect how
much they trust the service provider in the future.
The remainder of this paper is organized as follows. In
Sect. 2, we present several researches in literature con-
cerning trust and repuation models. In Sect. 3, we describe
our proposed trust model featuring its advantages, pointing
out the two new features: Questions of Trust and User
Rating. Section 4 describes the features of the Elliptic
Curve-based Simple Authentication Key Agreement (EC-
SAKA) protocol, designed for low-resource mobile devi-
ces. In Sect. 5, we show some simulations concerning the
trust model metrics and discuss the results. Section 6 shows
the implementation of our trust-based authentication
scheme. Finally, Sect. 7 concludes our work.
2 Related work
Several researches and studies were carried out regarding
trust models for different purposes and in different envi-
ronments. Among those, we choose several prominent ones
to discuss their strong and weak points, and build our
model accordingly.
In their work, Mihaela et al. [10] propose a new trust
model for DEs which has several innovative features. The
model is based on the concept of social networks and
addresses trust at different levels: user, data, service and
node. The model allows fast bootstrapping of trust by
importing existing trust relationships from outside DE
systems and by relying on certificates issued by trusted
authorities external to the DE. Furthermore, trust can be
measured in a variety of contexts by using user-defined
tags â folksonomy . The model abstracts from specific
reputation algorithms by providing necessary interfaces for
plugging-in those on one’s own choice.
Yan Lindsay et al. [11] present in their paper an infor-
mation theoretic framework to quantitatively measure trust
and model trust propagation in ad hoc networks. In the
proposed framework, trust is a measure of uncertainty with
its value represented by entropy. They develop four Axi-
oms that address the basic understanding of trust and the
rules for trust propagation. Based on these Axioms, they
present two trust models: entropy-based model and prob-
ability-based model, which satisfy all the Axioms. Tech-
niques of trust establishment and trust update are presented
to obtain trust values from observation. The proposed trust
evaluation method and trust models are employed in ad hoc
networks for secure ad hoc routing and malicious node
detection. A distributed scheme is designed to acquire,
maintain and update trust records associated with the
behaviors of nodes forwarding packets and the behaviors of
making recommendations about other nodes. Simulations
show that the proposed trust evaluation system can sig-
nificantly improve the network throughput as well as
effectively detect malicious behaviors in ad hoc networks.
With the growing popularity of wireless mobile ad hoc
networks (MANETs), many security concerns have arisen
from MANETs especially in that misbehaving nodes pose a
major threat during the construction of a trusted network. A
reputation-based trust system can track the behavior of
nodes and thereby proceed by rewarding well-behaving
nodes and punishing misbehaving ones. However, existing
techniques are usually either energy-consuming or com-
plicated since the relevant reputation information is prop-
agated throughout the network. In their paper, Yonglin et al.
[12] propose a novel trust computation and management
system, called TOMS, which not only establishes the new
concepts of trust and community but also includes both the
trust computation model and trust management mechanism.
1014 Pers Ubiquit Comput (2013) 17:1013–1023
123
In order to obtain more suitable trust evaluation in
MANETs, Junhai et al. [13] suggest that the measurement
and computation of trust to secure interactions between
mobile nodes is crucial for the development of trust
mechanisms. The calculation and measurement of trust in
unsupervised ad-hoc environment involves complex
aspects such as credibility rating for opinions delivered by
a node, the honesty of recommendations provided by a
mobile node, or the assessment of past experiences with the
node one wishes to interact with. The deployment of
suitable algorithms and models imitating fuzzy logic can
help to solve these problems. In this paper, RFSTrust, a
trust model based on fuzzy recommendation similarity, is
proposed to quantify and to evaluate the trustworthiness of
nodes, which includes five types of fuzzy trust recom-
mendation relationships based on the fuzzy relation theory
and a mathematical description for MANETs. Fuzzy logic
provides a natural framework to deal with uncertainty and
the tolerance of imprecise data inputs for the subjective
tasks of trust evaluation, packet forwarding review and
credibility adjustment. Theoretical analysis and experi-
mental results show that RFSTrust is still robust under
more general conditions where selfish nodes cooperate in
an attempt to deliberately subvert the system, end-to-end
packet delivery ratio more quickly and decreases the
average energy consumes more effectively. The effect of
node rating data’s sparsity can be greatly reduced and show
the excellent performance on typical data set.
According to Masthoff [14], Trust is a popular and much
disputed topic in various research communities. In his
paper, he attempts to integrate existing knowledge on trust
into a simple computational model. The model incorpo-
rates the impact of direct experiences, reputation, stereo-
types, empathy and user characteristics on trust. He also
presents the results of two exploratory experiments testing
and improving aspects of the model.
Felix Gomez Marmol et al. [15] describe in their review
the different scenarios where trust evaluation is threatened
by different attacks of malicious users. Examples of those
attacks are attacks of individual malicious users, attacks of
collective malicious users, attacks of malicious collective
with camouflage, malicious spies, sybil attacks, man in the
middle attacks, malicious pre-trusted peers, partially
malicious users, etc. The paper also explains how affecting
with peer’s reputation can also become a security threat,
such as driving down the reputation of a good user. Finally,
the paper discusses how some of the known trust models
deal with those trust evaluation threats. The trust models
mentioned in that section were as follows: EigenTrust,
PeerTrust, BTRM-WSN and PowerTrust. Finally, it con-
cludes with a table summarizing the vulnerabilities and
resiliencies of those trust and reputation models against the
mentioned attacks.
3 Our proposed trust model
Before an authentication takes place, each of the commu-
nicating parties needs to trust the others, hence the need of
a trust evaluation model. Many trust models for smart
environments have been proposed in the last decade, some
of them presented context awareness-based security [17],
while others concentrated on the quick convergence of
updated trust values [18–20], addressing the different sit-
uations with similar approaches. In our model, we tried to
work on the points that are missed or lacking in the pre-
viously mentioned trust models, such as the guarantee of
the accuracy of trust values, the rapid convergence of trust
values during estimation, the compatibility with low-
resource devices and the adaptivity to the needs and abil-
ities of dependent people.
Our proposed model has the following properties:
1. an enhanced compatibility with low-resource devices,
since it uses the memory-efficient elliptic curve
cryptography and a bandwidth-efficient trust evalua-
tion model;
2. useful features like service-dependent trust, mentioned
in [21];
3. a lightweight security monitoring to prevent malicious
attackers that attempt to forge trust data or alter it in
any way;
4. imitation of human rational thinking in evaluating the
judgment ability of recommending entities. That
means whenever an entity is asked to recommend
another, we take a look on how much that entity know
the others, which will give a metric representing the
judgment ability of this entity, before taking its
recommendations as granted;
5. ability to deal with situations which it has no prior
experience dealing with, using Questions of Trust;
6. a user rating system that allows to take feedback from
users and integrate it in the trust evaluation process.
Figure 1 illustrates the architecture of our proposed trust
model with its different modules, showing the steps of the
trust evaluation process. The trust updates take into con-
sideration the feedback obtained by user ratings. Judgment
is calculated based on the reports of experience messages.
Indirect trust is obtained by a multiplicative relation
between judgments and recommendation values given by
recommendation messages. Direct trust is calculated
through a risk assessment based on number of positive and
negative actions of the node in question (also provided by
experience messages). Finally, the net trust is a linear
combination of the direct and indirect trusts. The trust
updates occur only on demand or when the trust values
have expired. We will explain those modules in more
details in the following paragraphs. Next, we are going to
Pers Ubiquit Comput (2013) 17:1013–1023 1015
123
present the properties of our trust model and discuss the
novel attributes introduced in it.
3.1 Minimization of resource usage
Our proposed trust model aims to serve smart environments
where the hardware equipment have small processors and
limited memories. Some trust models such as in [21] used a
mesh-like approach in calculating trust values. That is each
node of the network has always an updated trust table of all
nodes in the network. That means that resources are wasted
on calculating trust values that may expire before being
used. Our proposed model evades this issue by evaluating
the trust values only on demand and expiry.
Our proposed model tries also to use as minimal mem-
ory resources as possible. Essentially, each node in the
network, independently of its nature, will need two matri-
ces. The node will store trust values of nodes communi-
cating with it only. Because of the memory limitation, the
node will get rid of trust data related to nodes that had left
the neighborhood or went dead in the network.
3.2 Trustworthiness
Trustworthiness is a factor that recommenders have to
consider in the selection of reliable peers for collaboration.
Most approaches in this regard estimates trust based on
global user profile similarity or history of exchanged
opinions [22]. Trustworthiness is used in this paper to refer
to the level of trust of an entity B in respect to a separate
entity A. The net trustworthiness is obtained by calculation
of two values: direct trust and indirect trust. Direct trust is
what is commonly called ‘‘Risk Assessment’’. It is used for
dealing with newcomers, which the entity has not yet any
records of trust evaluation. In case where trust is service-
dependent, we added a multiplicative factor, called the
Security Action Coefficient (SAC), to the number of neg-
ative actions. This coefficient refers to the security level of
a service. If the application possesses a high security level,
the associated SAC should be high (e.g. 10). On the other
hand, if the service did not need any security, such as a
weather broadcasting service, SAC can be as low as 1.
Direct trust is obtained using the following equation:
DT ¼ RPAi
RPAi þ SAC � RNAi : ð1Þ
where PAi represents the number of positive actions done by
the node in question and noticed by node i. NAi refers to the
number of negative actions, and SAC is the Security Action
Coefficient related to the security level of the service.
The indirect trust, representing the recommendations of
other nodes, is
IT ¼ RTwi � Ji
n : ð2Þ
where Twi and Ji are the trustworthiness and judgment
values corresponding to the node i.
The value of the net trustworthiness is a combination of
direct and indirect trust:
Tw ¼ aDT � DT þ aIT � IT: ð3Þ
where aIT the indirect trust coefficient is
aIT ¼ TSself
TSself þ R TSinrecomm �
RJi ntot
: ð4Þ
and aDT the direct trust coefficient is
aDT ¼ 1 � aIT: ð5Þ
where TS self refers to the timestamp of the trust value of
the node itself, while TSi denotes the timestamp of the trust
value of the node i. ntot is the total number of nodes in the
subnetwork, whereas nrecomm is the number of nodes that
responded with recommendations.
3.3 Judgment
Judgment is one of the new features introduced that aims to
imitate the human behavior in a technical approach. The
judgment ability is represented by the overall experience of
dealing with the node in question. That experience includes
both the total number of control messages exchanged and
the total number of actions whether positive or negative.
The judgment related to the number of actions is equal to
the total number of actions RAi over the maximum number of actions Maximum A, as follows:
JA ¼ RAi
max A ; if JA [ 1 then JA ¼ 1: ð6Þ
Similarly, the judgment related to the number of
messages exchanged is
JM ¼ R messagesi
max messages ; if JA [ 1 then JA ¼ 1: ð7Þ
At last, the overall judgment value isFig. 1 Our proposed trust model with its basic parts
1016 Pers Ubiquit Comput (2013) 17:1013–1023
123
J ¼ JA � JM: ð8Þ
3.4 Control messages
In order to control the aspect of trust evaluation and share
the trust data, short control messages are used for that
purpose. Most of these messages are trigger-based type,
except for consistency and hello messages. Those messages
are as follows:
1. Recommendation messages: used as request for trust
recommendations. The addressed nodes will reply, if
possible, with a recommendation reply containing the
trustworthiness value requested.
2. Experience messages: used to retrieve information
about statistical behavior. The reply contains informa-
tion about messages exchanged and positive and
negative actions, used later in the calculation of
judgment and direct trust.
3. Hello messages: periodic messages that are issued to
inform the neighbors about self-existence.
4. Consistency messages: periodic messages that aim to
test the consistency behavior of a certain node in order
to prevent any suspicious behavior trying to affect the
trust evaluation.
5. Knowledge migration messages: issued only when a
node is about to pass out or leave the network. The
message is a notification of the availability of trust data
that is going to be lost. Interested nodes will respond
by asking for recommendations and experience data.
3.5 Questions of trust
Our basic trust model described in [23] is suitable to deal
with calculating indirect trust based on recommendations
of neighbors. However, it may not be efficient enough in
case there are several malicious nodes giving false rec-
ommendations in order to earn the user’s trust. To prevent
that the user can carry out a procedure called ‘‘Questions
of Trust’’ before asking for recommendations. The pro-
cedure is about sending questions to the targeted nodes
and comparing the answers upon receiving them, either
with each other or with a set of previously known
answers. The questions can be service-related. For
example, if the service provided is weather-casting, the
questions can be regarding the weather table at a certain
geographic location at a certain period of time. Alterna-
tively, the questions can be about the trust tables them-
selves; and by comparison with trust tables of other
neighbors, a contradictory or non-consistent trust values
can be detected. With this, the user can be wary of nodes
trying to deceive him and thus he will not ask for their
services nor their recommendations.
This procedure can be repeated several times to increase
the odds of detecting suspicious behaviors. The questions
can be also sent directly to targets, or indirectly through
other nodes as proxies for masking the identity of the
original sender. Questions of Trust are also very handy if
the user is entering the network for the first time or is
dealing with neighbors he has no prior experience with.
This metric, like all other metrics mentioned in this
paper, can generally target a large audience of users,
independently of their individual capabilities. When we are
targeting dependent people in particular for our system, the
same mathematical model still applies, but what differs is
the type of feedback taken from the users which will
become an input for our model. Depending on the type of
disability of the user, this feedback can be either vocal or
physical (movement of fingers on touchpad or keypad).
3.6 User rating
So far, all the indicators in our trust model are machine-
based; but since trust is a concept initially borrowed from
humans, we decided to add a human-based indicator in our
model. User ratings were used before, as in [24, 25], for
evaluating trust in social networks, e-shopping websites,
etc. They indicate how much customers are satisfied by the
quality of service provided by sellers, or how much a social
network user trust another based on real-life activities.
However, user rating were not used for trust models in
smart environments before, although the user satisfaction/
dissatisfaction after using a service from a certain provider
may be quite a good indicator of the accuracy of trust-
worthiness calculated by machine-based indicators. In fact,
the quality of service value estimated by the user rating is
closely related to the trustworthiness of the service pro-
vider, since untrustworthy service providers are not
expected to provide a good level of service all the time.
Many advantages can be gained from adding user rating to
the trust model. First, the machine-based trust models do
not take into consideration the human satisfaction/dis-
satisfaction of a certain service, which is generally a good
indicator whether the service is real or fake, and whether
there is an encouraging reason for a new user to try this
service with this particular service provider. Second, user
ratings, unlike trust recommendations, last much more
longer and therefore presents a good alternative in case of
the absence of the latter. Therefore, we can consider the
user rating as a human recommendation and integrates it in
our formula to calculate trust. Similarly to how we defined
the weights of direct and indirect trusts, the amount of
participation of human recommendation in the final value
of trust (also referred as Human-Machine Trust) will
depend on the numbers of users that have rated the target,
and how many times they used the service in question
Pers Ubiquit Comput (2013) 17:1013–1023 1017
123
provided by the target. This can be elaborated by the fol-
lowing formulas:
aH ¼ 1
NR � RQi if Ri�NR ð9Þ
or
aH ¼ RQi if Ri [ NR ð10Þ
Qi ¼ Ui
Umax but if Qi [ 1 then Qi ¼ 1 ð11Þ
aM ¼ 1 � aH ð12Þ THM ¼ aH � HH þ aM � HM ð13Þ
where THM is Human–Machine Trust. TH and TM are,
respectively, Human Trust and Machine Trust, and aH and aM are their respective weights. Ri is the total of nodes that rated the service. NR is a constant for normalizing the
number of nodes that have rated the target (typically
NR = 10). Ui is the number representing how many times
the node i used the service from that provider, and Umax is
the normalizing value (typically Umax = 100). Qi is the
normalized ratio of the number of utilizations of the service
done by node i.
Our user rating mechanism is designed in a way that
ensures the fair usage of this feature. Since we cannot
expect all users to be rational in their ratings, we tried at
least to integrate our own approach to fight against abuse of
rating, coming from either users or service providers. In
our scheme, the interacting parties are the user, the service
provider, the Rating Authority and the Abuse Control
Authority. The role of the Rating Authority is only to
update and sign rating tables and verify the signatures. So it
only stores public keys used for the verification of digital
signatures, and it does not store any rating data, as to
preserve the decentralized nature of the network. Each
service provider will store his own rating table(s) (one
rating table per service provided), and since the table(s) is
digitally signed by the Rating Authority, it will prevent any
party from modifying the ratings. Another positive point
about the User Rating feature is that they are permanent
even if the user who did the rating leaves the network,
since the service provider always carry the rating tables
along; whereas trust tables depend on the presence of the
node, who is going to recommend, in the neighborhood.
The Abuse Control Authority is an optional entity that aims
to prevent abuse coming from either users or service pro-
viders. If the service provider abstain from giving the user
his rating table after service provision (i.e. preventing the
user from rating him), the user can report him to the Abuse
Control Authority using the service receipt he obtains at the
beginning of service provision. On the other hand, if the
user abuses his right of rating, repetitively, he’ll be
detected by the rating investigation carried out by the
Abuse Control Authority. The abuse control mechanism,
like spam filtering, can be an automated task based on
pattern recognition in abuse behaviors.
To begin with, we assume that we already have a key
management scheme enabled and working in the network.
The process of the user rating goes as it is shown in Fig. 2.
First, the user get a copy of the service provider’s public
key from the Rating Authority. Next, the user will request
the service from the service provider. The service provider
will send him a service receipt digitally signed and the
service will be executed. After the service provision is
complete, the service provider will take the Rating
Authority’s digitally signed copy of his rating table, sign it
with his private key, and send the double-signed copy to
the user. The user will verify the signatures, add his sig-
nature to the rating table, rate and sign his own rating, and
send his rating and the rating table to the Rating Authority.
The authority will verify all signatures, and if they are valid
it will update the rating table based on the new user rating,
and send the updated rating table back to the service pro-
vider after signing it. To defend against replay attacks, all
digitally signed exchanged data implicitly include a time-
stamp and/or a nonce.
Figure 3 shows two possible cases of rating abuse. In the
first case, the abuse is coming from the service provider,
where the server abstains from giving the rating table to the
Fig. 2 Diagram showing actions performed between user, service provider and rating authority
1018 Pers Ubiquit Comput (2013) 17:1013–1023
123
user, thus blocking away the user’s right of rating. As a
deterrent for such situations, we allow the user to file a
complaint by reporting to the Abuse Control Authority
what happened, using his service receipt as proof of his
right to rate. In the second case, in the illustration, the
abuse is coming from the user where he is giving untruthful
ratings to increase/decrease the reputation of a certain
service provider. In both abuses, the Abuse Control
Authority registers the abuse either by received a justified
report or by detecting using abuse pattern recognition. The
algorithm describing the mechanism of the Abuse Control
Authority is out of the scope of this article.
4 EC-SAKA authentication protocol
Elliptic Curve-based Secure Authenticated Key Agreement
protocol (EC-SAKA) was proposed by [16] in order to suit
the needs for low-resource mobile devices that face diffi-
culties when dealing with large-sized cryptographic keys.
This protocol benefits from the power of elliptic curve
discrete logarithm problem that is even more powerful than
traditional discrete logarithm problems. It is based on an
asymmetric Diffie-Hellman scheme to generate a common
secret key without exposing it to eavesdroppers. Indeed,
the asymmetry in this approach is to prevent malicious
attacks that try to impersonate both of the entities com-
municating and forward one’s data to the other aiming to
expose their generated key in the process. EC-SAKA
scheme also prevents impersonation attacks. In addition to
key agreement, this protocol provides identity verification
through El Gamal Signature scheme (ECEGS). This way, it
provides identity verification and common key generation
at the same time. Figure 4 illustrates the three passes of
EC-SAKA protocol.
In Fig. 4, P and Q represent two public points on the
elliptic curve chosen. n is large public number chosen by
Bob and Alice, used to define the elliptic curve. a and
b represent two secret values, each known only by its
respective owner, Alice and Bob. A and B are the respec-
tive public keys for Alice and Bob generated from a and
b. H () is a hashing function, and n is sufficiently large
number. K is the common secret key that Alice and Bob
will be able to generate at the end of this 3-way
authentication.
The EC-SAKA protocol will be used in our scheme in
order to authenticate entities and make them confirm each
other identities. The authentication phase comes after a
level of trust is already established between the entities. If
the result of the trust phase is higher than a specific
threshold, which is either dependent of the service or
globally set by the administrator, the application will pro-
ceed to the authentication phase. Otherwise, the application
would not pass to the authentication phase and the service
would not be provided, because one of the communicating
party appears untrustworthy to the other. The process of
trust evaluation is performed using the trust model that was
already detailed in the previous section.
Fig. 3 Two cases involving rating abuse and Abuse Control Authority Fig. 4 The three passes of EC-SAKA protocol
Pers Ubiquit Comput (2013) 17:1013–1023 1019
123
5 Simulation and discussion
The object of the judgment value is to increase the accu-
racy of the trust calculation. Not only that the judgment
value helps making the net trust evaluation converge
quickly. Unlike the trust evaluation techniques [13, 17–21]
where the trust metrics oscillate before reaching a stable
value, we made a simulation that demonstrates how the net
trust in our model instantaneously reflects the variation in
the trust metrics.
The reason that the trust values in our trust model
converges rapidly and do not oscillate like in the others is
the fact that we are already depending on an always-ready
judgement database. This database consists of two ele-
ments: the experience gathered by monitoring and report-
ing the negative actions performed by other nodes during
any communication, and the user feedback through their
rating which will enrich this database and makes the trust
evaluation easier and faster.
Figures 5 and 6 show the graphs of two simulations: the
first one represents the variations of net trust and judgment
when the positive actions are increasing, while the second
shows the trust variations when the negative actions are
increasing. The judgment value increases linearly with the
number of actions, positive or negative, that is, because the
judgment represents the experience which is directly rela-
ted to the number of actions. On the other hand, the net
trust increases/decreases faster when the number of actions
increases. The reason is that the grown experience
increases the weight of indirect trust (recommendations)
and accelerates the variations of net trust. The trustwor-
thiness in our model directly reflects the behavior of the
nodes, while in other trust models, it takes some time
oscillating before converging to an accurate value [21].
In comparison with other trust models, our proposed
model is using metrics that directly reflect the present and
the past line of actions committed by an entity in the net-
work. In addition to that, our trust model tends to decrease
the overall power consumption since it triggers trust
updates only on demand or expiration. Furthermore, the
security monitoring part of the model protects the entities
from potential malicious attacks. Questions of Trust also
assist in preventing malicious manipulations that affect
trust values. Finally, the user rating adds a human-based
feature that allows human users to assist in trust decisions
based on the satisfaction obtained from using services.
Further simulations on real scenarios are taking place by
testing the model on dependent users in a special residence
in the aim of validation and confirmation of the proprieties
of the model.
6 Implementation
In order to validate the proposed scheme composed of an
authentication module and a trust module, we have
implemented it using Java language and Eclipse IDE
platform. A server in our architecture is the device that
provides the service to other nodes. It can be a computer,
an RFID reader, or even a sensor. The server part of the
implementation contains no graphical interface, since it
only calculates different data and communicates them to
other nodes. On the other hand, the client part includes a
graphical interface and can run on almost any mobile
device that supports Java. We chose to test our imple-
mentation on Android mobile phones using Android SDK
tools in Java. The code itself is implementable on simpler
platforms than Android phones, such as active RFID tags
and sensors. Android systems remain easier to work on Fig. 5 The variation of net trust and judgment with respect to positive actions
Fig. 6 The variation of net trust and judgment with respect to negative actions
1020 Pers Ubiquit Comput (2013) 17:1013–1023
123
since the implementation will only take place software-
wisely.
For the authentication module, it has the responsibility
to establish secret key generation and identity confirmation
using the EC-SAKA protocol. The implementation of this
module was done through 4 Java classes. The first two
ECCPoint and ECCurve take care of all mathematical
definitions and calculations related to Elliptic Curves,
which are the base of the EC-SAKA protocol. The other
two classes, Requester and Provider, are used by the
authenticating parties to exchange the messages needed for
the establishment of the authentication. Since EC-SAKA
uses a 3-way asymmetric scheme, the messages sent
received by one authenticating party are not alike to those
sent and received by the other party, thus the need of two
different classes for the two parties. Figure 7 shows the
class diagram of the authentication module.
The other module implemented, the trust module, uses
two Java classes. The first class is for exchanging control
messages. The other class uses the information provided by
recommendation and experience messages to calculate
direct trust, indirect trust and judgment. This class also
calculates the trust weights, described in the previous
section, in order to evaluate the net trust.
Our implementation of this scheme takes part in a pro-
ject called ‘‘Cohabit’’, a smart environment project for
dependent people. The project takes place in a particular
residence for disabled people called ADEP. The services
provided in that smart environment are daily services
needed by dependent people, such as opening the door,
turning on/off the light, closing the curtains. The security
modules we have developed evaluate the trust between the
users and their environment before giving them access to
use those services. Figures 8, 9 and 10 shows several
snapshots the client application on the Android phone
listing the existing services spotted in the environment.
When the user of the Android phone chooses a service,
he will be directed to another window that lists the security
steps needed to activate that service. As it appears in
Fig. 7 The different classes used in the implementation of the authentication module
Fig. 8 Snapshot of the service provision in the Android app
Fig. 9 Snapshot of the Trust action matrix in the Android app
Fig. 10 Snapshot of the trust-authentication scheme in the Android app
Pers Ubiquit Comput (2013) 17:1013–1023 1021
123
Fig. 10, when clicking on ‘Evaluate Trust’ button, the
trustworthiness value of the service provider will be cal-
culated, as described in Sect. 3, and the threshold value set
by the administrator will be displayed. For more flexibility,
the procedure was divided to several steps, to allow the
user to use services on his own risk—if he wishes to—
when the trustworthiness value is less than the threshold.
The next button uses the EC-SAKA protocol to generate a
secret shared key and enable the two nodes to verify each
other’s identities. If the user sees two checkmarks next to
the two buttons, he can now execute the service he has
chosen.
Some services might not need trust evaluation and
authentications, such as date and time and weather-forecast
services. In this case, the corresponding buttons for trust
and authentication will be disabled and only the service
execution button will be enabled. Nevertheless, the actions
of non-authenticated services will be recorded in the action
matrices.
7 Conclusion
After emphasizing on the necessity and importance of
security, privacy and trust in smart environments, we have
demonstrated the effectiveness of Elliptic Curve Cryptog-
raphy as new candidate in publickey cryptosystems. We
have adopted a lightweight authentication protocol called
Elliptic Curve Secure Authenticated Key Agreement (EC-
SAKA) protocol in our scheme. That authentication pro-
tocol uses a 3-pass scheme to generate a common secret
key, in addition to an elliptic curve-based digital signature.
Next, we have proposed a new trust model that respects
the limitation of tiny mobile devices in terms of resources
and bandwidth. Our trust model contain two new features
that enhance the process of trust evaluation. The first one is
a new trust metric introduced called the ability of judg-
ment. This value tends to imitate the human rational
thinking in trust and recommendation acceptance. The
second feature is a lightweight security monitoring ability
within the trust model to defend against security threats.
Furthermore, we introduced two new features in our
enhanced trust model. One is Questions of Trust that enable
users to ask service-related questions to the service pro-
vider prior to service execution, in order to detect any fraud
or fake services. The other is User Rating that gives the
model a more humanistic side by integrating human feed-
back in the trust evaluation process.
Finally, we have implemented our scheme into inde-
pendent modules using Java language. Our trust-based
authentication scheme will be embedded on Android
smartphones to be used by dependent people in their resi-
dential areas.
References
1. Langheinrich M (2001) Privacy by design-principles of privacy-
aware ubiquitous systems. In: Proceeding of the 3rd international
conference on ubiquitous computing (UbiComp 2001), Springer
LNCS 2201. pp 273–291
2. Stajano F (2002) Security for ubiquitous computing. Halsted
Press, New York
3. Modahl M, Agarwalla B, Saponas TS, Abowd G, Ramachandran
U (2006) UbiqStack: a taxonomy for a ubiquitous computing
software stack. Personal Ubiquitous Comput J 10(1):21–27
4. English C, Terzis S, Nixon P (2005) Towards self-protecting
ubiquitous systems: monitoring trust-based interactions. Personal
Ubiquitous Comput J 10(1):50–54
5. Yin S, Ray I (2006) A trust model for pervasive computing
environments. In: International conference on collaborative
computing: networking, applications and worksharing
6. Taherian M, Jalili R, Amini M (2008) PTO: a trust ontology for
pervasive environments. In: 22nd international conference on
advanced information networking and applications—workshops,
IEEE
7. Cheng HS, Zhang D, Tan JG (2005) Protection of privacy in
pervasive computing environments. In: Proceedings of the
international conference on information technology: coding and
computing (ITCC’05)
8. Campbell R, Al-Muhtadi J (2002) Towards security and privacy
for pervasive computing. In: Proceedings of ISSS, Tokyo, Japan,
2002, pp 1–15
9. Tentori M, Favela J (2005) Supporting quality of privacy (QOP) in
pervasive computing. In: Proceeding of the sixth Mexican inter-
national conference on computer science. ACM Press, pp 58–67
10. Mihaela I, Andrea D, Hristo K, Luigi T (2007) A peer-to-peer
multidimensional trust model for digital ecosystems. Computer
Science Department, University of Malaga, Spain
11. Sun YL, Yu W, Han Z, Liu KJR (2004) Information theoretic
framework of trust modeling and evaluation for ad hoc networks
12. Ren Y , Boukerche A (2008) Modeling and managing the trust for
wireless and mobile ad hoc networks. In: ICC 2008 proceedings
13. Luo J, Liu X, Fan M (2009) A trust model based on fuzzy rec-
ommendation for mobile ad-hoc networks. Comput Netw
53:2396–2407
14. Masthoff J (2007) Computationally modelling trust: an explora-
tion. University of Aberdeen, Aberdeen, Scotland, UK
15. Felix Gomez M, Martinez Perez G (2009) Security threats sce-
narios in trust and reputation models for distributed systems.
Comput Security 28:545–556
16. Abi-Char P, Mhamed A., El Hassan B (2007) A fast and secure
elliptic curve based authenticated key agreement protocol for low
power mobile communications. In: The international conference
on next generation mobile applications, services and technologies
(NGMAST 2007)
17. Moloney M, Weber S (2005) A context-aware trust-based secu-
rity system for ad hoc networks. In: Workshop of the 1st inter-
national conference on security and privacy for emerging areas in
communication networks, 2005
18. Surie A, Perrig A, Farber David J (2007) Rapid trust establish-
ment for pervasive personal computing. IEEE Pervasive Comput
6(4):24–30
19. Lagesse B, Kumar M, Paluska JM, Wright M (2009) DTT: a
distributed trust toolkit for pervasive systems. In: IEEE confer-
ences, 2009
20. Ahamed SI, Sharmin M, Ahmed S (2008) A risk-aware trust
based secure resource discovery (RTSRD) model for pervasive
computing. In: Sixth annual IEEE international conference on
pervasive computing and communications. IEEE, 2008
1022 Pers Ubiquit Comput (2013) 17:1013–1023
123
21. Ghorbel M, Mhamed A, Mokhtari M (2009) Secured and trusted
service provision in pervasive environment. In: IEEE interna-
tional conference on wireless and mobile computing, networking
and communications, 2009
22. Godoy D , Amandi A (2011) Enabling topic-level trust for col-
laborative information sharing. Personal Ubiquitous Comput J,
OnlineFirst, 6 Aug 2011
23. El Husseini A, Mhamed A, El Hassan B, Mokhtari M (2011) A
novel trust-based authentication scheme for low-resource devices
in smart environments. In: The second international conference
on ambient systems, networks and technologies (ANT-2011)
24. Borzymek P, Sydow M, Wierzbicki A (2009) Enriching trust
prediction model in social network with user rating similarity. In:
International conference on computational aspects of social net-
works, 2009. CASON ’09, pp 40–47
25. Yamasaki S (2011) A trust rating method for information pro-
viders over the social web service: a pragmatic protocol for trust
among information explorers and information providers. In: 11th
international symposium on applications and the internet
(SAINT), 2011 IEEE/IPSJ, pp 578–582
Pers Ubiquit Comput (2013) 17:1013–1023 1023
123
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
- c.779_2012_Article_548.pdf
- Trust-based authentication scheme with user rating for low-resource devices in smart environments
- Abstract
- Introduction
- Related work
- Our proposed trust model
- Minimization of resource usage
- Trustworthiness
- Judgment
- Control messages
- Questions of trust
- User rating
- EC-SAKA authentication protocol
- Simulation and discussion
- Implementation
- Conclusion
- References
Sources/User perceptions of anthropomorphic robots as monitoring devices.pdf
O R I G I N A L A R T I C L E
User perceptions of anthropomorphic robots as monitoring devices
Stuart Moran • Khaled Bachour • Toyoaki Nishida
Received: 15 February 2012 / Accepted: 16 September 2013 / Published online: 20 October 2013
� Springer-Verlag London 2013
Abstract The principle behind anthropomorphic robots is
that the appearance and behaviours enable the pre-defined
social skills that people use with each other each day to be
used as a means of interaction. One of the problems with
this approach is that there are many attributes of such a
robot which can influence a user’s behaviour, potentially
causing undesirable effects. This paper aims to identify and
discuss a series of the most salient behaviour influencing
factors in the literature, related to a number of robot
attributes. A particularly novel aspect of this work is the
study of robots as monitoring or data collection devices,
one of several behaviour influencing factors which has
received insufficient attention. As a first step towards this,
the PSA matrix is produced, which visualises the rela-
tionships between system attributes and user perceptions,
grounded in empirical evidence in the literature. This
matrix highlights gaps in the literature, brings together a
series of salient behaviour influencing factors for the first
time and gives a clear view of the state of the art.
Keywords Anthropomorphic � Data collection � Matrix � Monitoring � Pervasive � Robotics � Ubiquitous
1 Introduction
With continuous advancements in artificial intelligence and
reduction in costs of hardware, the reality of a world where
humans coexist with robots approaches ever closer.
Through ongoing social research, most major computer
technologies have a clear set of design principles and
methods for introducing technology successfully into the
user market. In the case of robots, one direction being
explored is the approach of a humanlike appearance.
Anthropomorphic robots attempt to make the use of the
well-defined social abilities that people use with one
another day-to-day as a means of interaction. The benefits
of this are that there is ideally very little learning time
required to interact with the technology, through a familiar
and intuitive interface. There are many different attributes
of a robot which can help increase the perceptions of
anthropomorphism, including facial features, physical
expressiveness, emotions and personality. One of the
problems with these attributes is that slight variations can
cause a change in the way a robot is perceived and inter-
acted with, including feelings of discomfort [e.g. uncanny
valley (Mori 1970)]. Such variations are not limited to
human–robot interaction (HRI), but can also been found in
other computer systems. For example, many such parallels
exist in monitoring systems, such as CCTV and wearable
computing.
We argue that anthropomorphic robots, by design, are
inherently monitoring (or data collection) devices, but
unlike typical monitoring systems, they have a unique
embodiment and physical presence. In human–human
relationships there is evidence that shows how being
observed can change behaviours, consider social facilita-
tion effects (Woods et al. 2005a), or the infamous, but
often contested, Hawthorne effect (Wickstrom and Bendix
S. Moran (&) � K. Bachour Mixed Reality Lab, University Nottingham, Nottingham, UK
e-mail: [email protected]
K. Bachour
e-mail: [email protected]
T. Nishida
Nishida Lab, Department of Intelligence Science and
Technology, Graduate School of Informatics, Kyoto University,
Kyoto, Japan
e-mail: [email protected]
123
AI & Soc (2015) 30:1–21
DOI 10.1007/s00146-013-0515-6
2000). When we consider the ways in which robots can be
anthropomorphised, questions start to emerge as to how
their humanoid form might lead to similar data collection-
based behavioural effects. Hence, the beginnings of an
intriguing point of intersection starts to emerge between the
fields of humanoid robotics and monitoring systems.
The aim of this paper is to propose, explore and
stimulate discussion on the novel thread of research on
anthropomorphic robots as monitoring systems. Viewing
anthropomorphic robots through a ‘monitoring lens’ may
lead to new understandings, perspectives and questions
regarding their relationship with users. To do this, we
must first understand the state of the art in both fields
individually, and then examine what exists at the point of
their intersection. In particular, we are interested in how
these attributes may change and influence behaviour
(along the lines of Hawthorne). Research in social
robotics has shown a tendency to explore how different
characteristics or attributes of a robot can influence users
through their differing perceptions and attitudes. Through
a survey of the monitoring and robotics literature, a series
of key robot characteristics emerged which can influence
the user during interaction, which frames the discussion.
Similarly, there are a number of key attributes associated
with monitoring systems (Moran and Nakata 2010), and
these were used as a coding scheme when exploring the
literature. We observed a number of established and
hypothesised causal inter-relationships between design
characteristics and user perceptions of both anthropo-
morphic robot and monitoring systems. Building on these
relationships, we constructed a matrix to help visually
portray the relationships between characteristics within
the area. Using this matrix, we are able to uncover how
these two fields intersect and also identify various current
trends and patterns. A benefit of this is the effective
capture and ‘mapping’ of existing research, in addition to
the identification of gaps and future potential directions of
research. Following this, we present a series of challenges
to help guide and frame future research exploring robots
as a monitoring systems.
2 Background
The following sections discuss both anthropomorphic
robots and monitoring systems, with the aim of providing
evidence to support the motivation of this paper.
2.1 Anthropomorphic robots
A humanoid form provides a natural means of interaction
between human and social-based robots (Heerink et al.
2006). Humanoid robots are effective at affording
(suggesting) how they should be controlled, used and
responded to (Dautenhahn 2002), easing the burden on
learning curves for users. It is this affordance which fun-
damentally differentiates the interaction between humans
and robots compared to other technologies in daily use.
This difference stems from the change in a users perception
of a robot from simply being a technology to being a social
actor (Heerink et al. 2010a). This change can be attributed,
in part, to the robot’s appearance, the fact robots will
actively share spaces with people, and the robots display of
intelligence and interest with the user and its surroundings
(Young et al. 2009). While there are many benefits to a
humanoid appearance, there comes a cost to this unique
interaction in the form of undesirable/unexpected effects
on users such as discomfort (Koay et al. 2006) or misplaced
expectations (Dautenhahn 2004). The ‘uncanny valley’ was
proposed by Mori (1970), which describes the different
degrees of anthropomorphism as experienced by the user.
The trough of the ‘valley’ represents the point of human
rejection, while the peaks represent acceptance. Like other
researchers (Bartneck et al. 2007), we take the view that the
‘valley’ should rather be considered a ‘cliff’, as users are
unlikely to knowingly appeal to a machine which demon-
strates increasingly ‘perfect’ anthropomorphism.
There are a number of other factors that may influence
user perceptions and feelings towards a robot (Young et al.
2009), for example existing research has established that a
robots appearance and actions can affect human behav-
iours, including a willingness to comply with robot
instructions or advice (Goetz et al. 2003; Powers and
Kiesler 2006), communication avoidance (Nomura et al.
2006) and the time spent with the robot and whether a user
is prepared to have physical contact (Nomura et al. 2008).
This influence is not limited to physical attributes, but can
also include effects caused by social attributes [e.g. per-
sonality (Takayama and Pantofaru 2009)] or more func-
tional attributes such as its purpose or application (Goetz
et al. 2003). While any influence is likely to always be
carefully considered, some of the human behaviours caused
by human–robot interaction (HRI) can be undesirable. This
may be avoidable through a rigorous identification and
understanding of all robots attributes which may influence
people (Siegel et al. 2009; Kuo et al. 2009). However,
many of these attributes still remain unidentified, unex-
plored or simply remain, as of yet, disjointed and unrelated
in the literature. More work is needed to identify, study
and/or bring together these salient factors and their inter-
relationships, including their associations with new, pre-
viously unconsidered factors (Heerink et al. 2009a). For
example, there is a fundamental aspect of HRI which to
date has received insufficient direct attention; an aspect
which stands to have a significant effect on the user when
robots are introduced into the ‘real world’.
2 AI & Soc (2015) 30:1–21
123
2.2 Data collection
To effectively interact with a user and achieve its intended
purpose/service, a robot must be ‘aware’ of the user, col-
lecting and processing significant amounts of data (Syrdal
et al. 2007b; Glas et al. 2009). Robots must be able to track
and recognise the location, identity and behaviour of
humans for any meaningful social interaction to take place
(Michalowski et al. 2006). Data collection is not unique to
HRI and is adopted in many (if not all) interactive tech-
nologies in some way. As mentioned earlier, HRI differs
heavily from existing technologies, mainly in terms of the
degree of interaction. Existing monitoring technologies,
such as closed-circuit television (CCTV) or radio fre-
quency identification (RFID), collect data and information
in a one-way interaction, restricted to certain areas, space
and data types (Syrdal et al. 2007b). This means that the
technology only collects data about the user, with little
reaction or response. In contrast, robots adopt a two-way
interaction (e.g. request and response) and also have the
opportunity, and capability, to collect larger amounts of
(personal) data than other technologies in private use
(Syrdal et al. 2007b).
One of the problems associated with monitoring of any
kind is that, like robot appearance and actions, it has been
shown to affect the behaviour of the person being observed
(Rosenthal and Jacobson 1968; Larson and Callahan 1990)
and even cause discomfort (Scholtz and Consolvo 2004;
Lyytinen et al. 2004). If the act of monitoring is affecting
the behaviour of the user, arguable their response is no
longer natural. This makes the data collected inaccurate,
potentially leading to a sub-optimal or inappropriate
response from the robot (or any interactive technology).
Moran and Nakata (2010) have conducted work where they
clearly identified a series of salient monitoring system
attributes that influence the interaction with users including
awareness, control, boundaries, trust, intrusion, justifica-
tion and context. It is our view that these are directly
applicable to a robot and may be part of the cause of
behavioural or interactional change, e.g. its placement in
relation to the users or the size of the sensors. For example,
consider a humanoid robot which has eyes and ears. These
are properties similar to a human which afford certain
capabilities, e.g. see and hear in specific directions. There
are likely to be discrepancies between these perceived/
afforded abilities and the actual, where a robot may have
eyes at its front, but may be able to see all around it. The
affordances may also run deeper, whereby humans per-
ceive the robot to have the same perceptibility and judge-
ment as humans, generating Hawthorne effects (Wickstrom
and Bendix 2000). There is also the potential to create
Panoptic effects (Jonsson 2006), whereby humans cannot
know when a robot is, or is not, collecting data about them
and so must assume data are collected constantly. When
this is considered alongside the Hawthorne effect, the types
of problems related to behaviours and coverage that can
occur become highlighted.
Robots can also be used in conjunction with other
technologies, such as RFID tags and floor sensors (Nohara
et al. 2008), sharing information as a part of a wider sys-
tem, leading to augmentation of the robots capabilities
(Koide et al. 2004; Dragone et al. 2010). Through this
augmentation, the coverage of the robots data collection is
increased, and with this increase, the undesirable effects on
users are anticipated to become amplified and more
numerous (Moran and Nakata 2010). When all this is
considered alongside the unique and private way humans
interact with robots, it becomes clear that designers of
these systems should carefully consider the issues of
monitoring robots with social intelligence (Kahn et al.
2006). This is important given the area of ubiquitous
human–robot interaction remains largely unexplored
(Dragone et al. 2010). A user’s response to a system is
predominately based on their perception of reality and not
the reality itself. Their perceptions of the attributes of the
system are more meaningful to them, and hence their
behaviours, than the objective facts (Young et al. 2009). As
such, the relationship between robot attributes and user
perceptions should be explored together, to provide a more
holistic understanding of the effects of the robot/monitor-
ing systems. For example, some researchers have already
established which precise physical attributes of a robot
head can be intentionally varied to effectively control how
humanlike it is perceived by the user (DiSalvo et al. 2002).
Much like the inter-relationships between physical and
social factors, there are a number of directly corresponding
perceptions, but there are also perceptions which comprise
a number of different physical and social factors. It is
through empirically measuring and understanding the
relationship between a robots attributes and a users per-
ceptions of said attributes that researchers will eventually
be able to intentionally encourage or prevent specific
behavioural responses (Nomura et al. 2007).
The research literature on HRI, behavioural change and
perceptions was comprehensively explored in order to
identify a series of salient and recurring factors which
influence user behavioural responses to robots, a similar
approach to Fong et al. (2003). In order to capture as many
different influencing attributes of a robot as possible, the
review explores both relevant hypotheses and empirical
studies, and the impacts of robots of different types (though
a general leaning towards anthropomorphic), in different
contexts and with different types of users. This provides a
holistic view of robotics and the possible areas of influence
in HRI. This is beneficial as it may capture information
which could be overlooked with a narrower search. The
AI & Soc (2015) 30:1–21 3
123
factors identified in the literature are categorised in terms
of physical and social attributes. Physical attributes con-
cern the tangible aspects of a robot, while the social attri-
butes are related to the application and interaction with
humans at a social level. Depending on the user, the
behavioural influence may be stronger in one of these
levels than the other. For example, users may be more
interested in the functional aspects of the robot (e.g. shape
and things which influence physical task) than aspects such
as colour or contour which influence human-likeness.
Equally, a user may be more interested in the way the robot
behaves and talks than what tasks it can carry out and its
physical form. A secondary objective of this study of the
literature is to explore the monitoring aspects of HRI in
terms of the factors identified by Moran and Nakata (2010),
where each factor was used as a part of a coding scheme
during the review.
3 Monitoring attributes
We now consider a series of attributes related to monitor-
ing systems that are relevant in the context of social
robotics as data collecting devices, namely privacy and
invasiveness, control, user understanding and ownership/
trust.
3.1 Privacy and invasiveness
The first set of attributes that have been studied in the
context of monitoring robots deal with privacy and the
physical, social and perceived invasiveness of robots.
3.1.1 Border crossings
Perceived natural border crossing (PNBC) is defined as
the degree to which a person feels that any natural borders
have been crossed, based on Marx (2001). Marx (2001)
talks about natural borders, where physical objects create
borders which help define physical areas of privacy (e.g. a
home is defined by its walls). When information crosses
these borders, privacy is perceived to have been invaded.
However, a user must initially perceive the physical bor-
ders to have been crossed before perceptions of privacy
invasion arise. Another form of natural border crossing is
when a robot physically invades a user’s personal space,
even in the absence of a physical border. When a robot was
closer than 3 m users felt discomfort (Koay et al. 2006;
Dautenhahn 2007), and the further away the robot, the
more comfortable they felt (Pacchierotti et al. 2006). If
robots must be closer than 3 m to achieve their task, then
there are several ways to avoid discomfort including: giv-
ing users control over the robot (Walters et al. 2009a),
reducing its size (Hiroi and Ito 2008) and/or ensuring that
the user feels minimal levels of anxiety (Nomura et al.
2007). Designers should carefully consider the robots they
are introducing into social environments and attempt to
prevent users feeling spatial discomfort (Syrdal et al.
2008). Understanding the relationships between systems
characteristics and perceptions is the first step towards
achieving this.
Perceived social border crossing (PSBC) is defined as
the degree to which a person feels that a social border has
been crossed, based on Marx (2001). Social borders refer to
the borders defined by a person’s expectations of confi-
dentiality in social roles and relationships (Marx 2001).
They are heavily related to natural borders, in that infor-
mation can be shared across them (made available to oth-
ers), resulting in perceptions of privacy invasion. In some
cases, people do not want their information to be shared
with certain social groups (e.g. colleagues at work). How
robots (accidently, or intentionally) store and share data
with a third party is a concern actively voiced by people
who have experienced HRI (Vargas et al. 2009; Syrdal
et al. 2007b). When robots are used to capture data in
public spaces, it is important that the reason for this is
made explicitly clear to all those who directly, and indi-
rectly, interact with it (Syrdal et al. 2007b).
3.1.2 Frequency of data collection and border crossings
Perceived frequency of border crossings (PFBC) is defined
as a person’s understanding of how frequently borders are
crossed, based on Moran and Nakata (2010). In keeping
with the idea that interaction with a robot involves border
crossings (social and natural), user perception of the reg-
ularity of these crossings may influence their behaviour
(Nomura et al. 2008). Furthermore, when determining the
level of social skills of a robot, the nature and frequency of
interaction need to be analysed (Dautenhahn 2007).
Frequency of data collection is defined as the regularity
with which data can be collected by the robot, based on
Moran and Nakata (2010). Robots have the potential to
continuously collect data about users and an environment
(Syrdal et al. 2007b) and repeated experiences with a robot
can change the behaviour of the human involved (Nomura
et al. 2007). A common assumption is that HRI is co-
located and synchronous; however, a user may interact
with the robot at different times (delayed responses) and
even in different places (through use of internet) (Yanco
and Drury 2004). For this reason, it is necessary to consider
not only the time spent within a robot’s coverage, but also
the frequency with which they engage with the robot and
hence the area being monitored. This aspect of HRI
becomes significant when we consider the mobility of a
robot.
4 AI & Soc (2015) 30:1–21
123
3.1.3 Robot obtrusion (physical presence)
Robot obtrusion (RO) is defined as the obtrusiveness of the
robot in terms of its physical presence, based on Moran and
Nakata (2010). RO captures the physical obtrusiveness of a
robot in terms of its position in relation to a user and the
effect of its complete overall appearance. While obtru-
siveness might be considered a subjective phenomena, we
argue that there are likely to be thresholds of physical
obtrusiveness that are consistent across users. Furthermore,
there are attributes and perceptions of a robot that are
discussed later in the paper that capture the more social
aspects related to obtrusiveness. RO is closely related to
PNBC in that robots can have an invasive physical pre-
sence (Young et al. 2009; Kidd and Breazeal 2004) when
crossing the natural border into a user’s personal space
leading to perceptions of anxiety (Hiroi and Ito 2008;
Kanda et al. 2002) or spatial discomfort (Syrdal et al.
2008), particularly when placed within the 3 m range
(Koay et al. 2006; Dautenhahn 2007). However, the mere
knowledge of the presence of a robot collecting data about
a user may increase the risk of perceiving their personal
space to have been invaded, causing discomfort (Scholtz
and Consolvo 2004; Lyytinen et al. 2004).
3.1.4 Perceived privacy invasion
Perceived privacy invasion (PPI) is defined as the degree to
which a person feels that the robot is invasive of their
privacy, based on Moran and Nakata (2010). Privacy
invasion is one of the most important user perceptions to
consider, as it could be the most significant cause of
undesirable behaviours. Dryer et al. (1999) describe pri-
vacy as a function of the type of information users must
give up to attain value from the application and how widely
available this information is disseminated. The nature of a
robot means it interacts with a human in a personal way
that no other technology does, but how does the increased
level of data capture of personal data in this context affect a
person’s privacy (Kahn et al. 2006)? It has been shown that
people may not feel comfortable about the collection of
personal data by a robot (Syrdal et al. 2007b). Another
privacy consideration raised with regard to data collected
by a robot is its long-term storage (Vargas et al. 2009). A
robot’s ability to ‘forget’ certain information may be a way
for a user to control the robot, effectively reducing the
perceptions of privacy invasion by regulating the type and
amount of data stored (Vargas et al. 2009).
Depending on the context and purpose of the technol-
ogy, users may not expect total privacy (e.g. hospital robot)
and accept this fact when making choices in light of its
application (Nguyen et al. 2008). Perceptions of a system’s
capabilities appear to significantly influence PPI (Vallejo
et al. 2008), and the greater the PPI, the less willing a user
will be to accept the technology (Zweig and Webster
2003). Contrary to the above, some research suggests that
privacy is less important in determining acceptance of a
technology than is currently believed (Spiekermann 2008).
According to Spiekermann (2008), this may be due to the
users focus on the delivery of a service, rather than on
tracking a person.
3.1.5 Coverage and data integration
Robot coverage is defined as the physical range within
which a robot is able to collect data or interact with its
users, based on Moran and Nakata (2010). Each type of
sensory device used in a robotic system has a different
range or coverage compared to another. This range is
defined as the distance, or area, within which the robot is
able to collect data. Many sensors are susceptible to
physical objects such as walls and doors limiting their
range, even the most powerful devices can be affected by
such limitations. An interesting consideration is that
physical constraints are unlikely to be an issue should a
robot be a part of a pervasive sensor network, which will
increase its coverage (Moran and Nakata 2010). The ability
for a robot to move will also dramatically increase its
coverage, even if the sensors it uses are relatively weak.
With such increases in coverage and information avail-
ability, it may be difficult for users to find places that they
perceive to be unmonitored (Punie 2003).
Perceived coverage (PC) is defined as the degree to
which person understands the area covered by the robots
sensors, based on Moran and Nakata (2010). Different
users will have a different understanding of the capabilities
of certain robots, brought about in part by the assumptions
they draw from the anthropomorphic form of the robot. As
such users will have different perceptions of the coverage
of the robots sensors, and the effects of the monitoring will
be different. Several hundred, or as few as one or two,
different robots may be needed to interact with users,
collecting data. The number of robots will affect the
interaction with the user (Yanco and Drury 2004). How-
ever, this area is still relatively unexplored and the question
remains: how does the presence of a number of robots
influence the interaction between users (Severinson-Ekl-
undh et al. 2003)?
Data integration is defined as the process of combining
data from different local and/or global sources, based on
Moran and Nakata (2010). With the potential for many
robots and many sensors to be collecting different types of
data at different times, a problem arises when trying to
understand and make use of all the information collected.
Data integration is therefore a necessary step in the sense-
making process. By combining data from different sources,
AI & Soc (2015) 30:1–21 5
123
a bigger picture can be built about those being observed
and more accurate inferences made. This data might be
stored in ‘the cloud’ and be hidden from the user, with the
robot itself potentially acting as a gateway to this infor-
mation alongside being the means by which it is collected.
The question remains whether or not humans would even
want to see/have access to this information. As the
potential for inference about users activities increases, their
perceptions and attitudes towards the robot are anticipated
to change. Participants in one study showed concerns
regarding the ability of the robot to infer meaningful
information about them (Lee et al. 2011). One suggested
way of avoiding this is by having a robot effectively
communicate its data integration/collection abilities, and
how it constructs knowledge about the user (Lee et al.
2011).
3.2 Control
The second set of data monitoring attributes of robots relate
to the extent to which the user has control, or perceives
having control, over the robot itself, the data it collects, and
the way in which this data is used.
3.2.1 Robot control
Robot control is defined as a user’s ability to physically
prevent or allow a robot from performing an action, e.g.
specific movements or data collection, based on Moran and
Nakata (2010). Physical control of a robot can take many
forms: in one experiment, users were given control of
robots movement, so they could signal to stop it when the
felt it came too close (Hiroi and Ito 2008); this is a form of
gesture based or physical control. A related study showed
that users felt ‘in control’ when the robot was fully visible
and approaching from a frontal direction (Dautenhahn et al.
2006). Control could be in a simpler form, where users may
have an option to simply deactivate the robot using an ‘off’
switch. In many cases, users are likely to be required to
forego their control over a robot, for example, a medical
robot may need to frequently touch a human to administer
drugs. Equally, providing a user with too much control may
be overwhelming and intrusive, increasing the complexity
of interaction.
Perceived robot control (PRC) is defined as the degree
to which a person feels they have direct control over the
robot itself, based on Moran and Nakata (2010). Control
can vary with different robots, and depending on users’
knowledge and understanding of the robot, they may per-
ceive themselves to have different levels of robot control.
Additional factors such as both the users and robots per-
sonality must be considered, as these have been shown to
affect user perceptions of control (Syrdal et al. 2006;
Meerbeek et al. 2008). For example, it has been shown that
if a human perceives the robot to be a living entity (extreme
anthropomorphism), they may show reluctance to switch it
off (Bartneck et al. 2009b). Thus, overly high levels of
anthropomorphism may actually cause users to feel some
control has been removed from them.
3.2.2 Data and application control
Data access is defined as the degree to which the data
collected is made available to individuals, groups and/or
the public, based on Moran and Nakata (2010), while data
sharing is defined as the process of distributing information
across different robotic systems, based on Moran and
Nakata (2010). Due to the nature of interaction with a robot
and the number of potential users, the disclosure of data is
an important consideration (Syrdal et al. 2007b). Take for
example a workplace, it may be possible for a robot to
share personal work-related information (e.g. the length
and number of breaks) with your employer, potentially
becoming a tool of surveillance (Kahn et al. 2006). This
has led to people showing concerns about how their data
are shared by robots (Vargas et al. 2009) and how they can
control this information (Enz et al. 2011). An interesting
situation is where an individual in a public space is inter-
acting with the robot, but due to its sensory range, the robot
is also passively, or indirectly, interacting with all those
secondary users around it (i.e. recording data about
bystanders). An important question in HRI is how do we
give those who are not directly interacting with the robot
control over it? In some cases, such as for public security
or safety, the designer of the robot may not want any users
to have control over it.
Application control is defined as the users’ ability to
manage how and by whom their data is used, based on
Dryer et al. (1999). What differs between application
control and robot control is that the data have been col-
lected, and now the control is aimed at the use and avail-
ability of the data. Users want robots to be controllable, but
some autonomy will always be required as few people want
to carry out constant supervision or intervention (Dau-
tenhahn et al. 2005; Yanco and Drury 2004; Enz et al.
2011). Under what situations is a user able and willing to
give up control (Enz et al. 2011; Meerbeek et al. 2008)? If
the right balance is not met, then issues related to mis-
placed trust may occur (Desai et al. 2009).
Perceived data control (PDaC) is defined as the degree
to which a person feels they have control over the use of,
and access to, the data collected by the robot, based on
Theofanos and Scholtz (2005). Depending on how well the
users are informed or how much experience they have with
a robot, their perceptions of how much control they have
over data access and use may differ. Their perceptions of
6 AI & Soc (2015) 30:1–21
123
robot control may also influence their overall perceptions
of data control.
Privacy invasion in robotics research is related to the
sensitivity of the information collected (Syrdal et al.
2007b). In one study, a robot storing information related to
a users personality and other psychological characteristics
was shown to make them feel uncomfortable (Syrdal et al.
2007b). People have also shown concerns regarding what
data were being stored by the robots and for how long
(Vargas et al. 2009). One suggested approach to mitigate
some of these concerns is for a robot to have the ability to
‘forget’ the data it has collected (Vargas et al. 2009). As
new sensors are developed capable of collecting new types
of data and robots are connected to networks of such
sensors, the data, information and knowledge a robot has
access to become an important consideration to both users
and designers.
3.3 User understanding
Next, we describe attributes relating to the user’s under-
standing of how and why the robot functions, whether this
understanding is accurate or not.
3.3.1 Informedness and assumptions
User informedness is defined as the degree to which a user
is informed as to the workings or purpose of the robot,
based on Moran and Nakata (2010). This is partially related
to the concept of awareness in HRI, which is an under-
standing of the location and status of the robot (Drury et al.
2003). As is the case with many current robot systems,
there may be a legal, ethical and/or social requirement for
owners or designers to ensure that the observed are made
aware of the inner workings and purpose of the robot. This
may require the use of large signs detailing the information
in simplistic, easy to understand terms, or in the small print
of a complex terms and agreement document (Nguyen and
Mynatt 2002). Users should be informed of the types of
data the robot is collecting, particularly as privacy invasion
is related to the sensitivity of the information collected
(Syrdal et al. 2007b).
Application assumptions (AA) is defined as the degree
to which a person understands the purpose and workings of
the robot, including what inferences can be drawn about
them, based on Dryer et al. (1999). This is strongly linked
to user informedness, but deals more specifically with the
users understanding of the system. There are two main
ways users can understand the purpose and workings of the
robot: through directly (or indirectly, i.e. affordance) being
informed by people or other media (e.g. forms, signs,
presentations) or through their own personal assumptions
based on previous experiences. Depending on how well
users understand the robot, their perceptions of the purpose
and workings of the system will change. The attributes of
the system, such as the distribution and frequency of
interaction with the robot, are likely to influence their
perceptions of what inferences can be drawn about them
from the data it collects. Their assumptions about the
application of the robot may also influence their level of
trust they have in the robot (Desai et al. 2009). Perceived
anthropomorphism is an indirect form of information
sharing and can lead to assumptions regarding the abilities
to a robot. These assumptions can lead to expectations
which cannot be fulfilled (Dautenhahn 2002; Bartneck
et al. 2009a) and result in a break down in the interaction
(Dautenhahn et al. 2005). Users with negative reactions
towards a robot can affect their assumptions about its
capabilities (Nomura et al. 2006), and assumptions about
capabilities can in turn influence attitudes (Nomura et al.
2005). Without an understanding of the monitoring capa-
bilities of the robot, e.g. inability to comprehend robot
sensors (Lee et al. 2011), users are not capable of under-
standing the privacy trade-offs they are making in their part
in its use (Nguyen et al. 2008).
Perceived benefit (PB) is defined as the degree to which a
person feels the robot is of benefit to themselves, others or the
observer, based on Moran and Nakata (2010). A users will-
ingness to adopt any new technology is dependent on their
perceptions of its capabilities and functions (Vallejo et al.
2008; Beckwith 2003), and acceptance of robotic systems is
no different (Heerink et al. 2008a, 2009b). Ultimately, the
data collected by a robot should be fully justified (Syrdal
et al. 2007b; Kidd and Breazeal 2005); and if perceived as
sufficiently beneficial by the user, then any negativity
towards the robot will be tolerated and regarded as a ‘nec-
essary evil’ (Syrdal et al. 2007b). There may also be a suf-
ficient ‘reward’ that outweighs the ‘damage’ potentially
caused by disclosing specific information from the user. In
some cases, simply understanding and being aware of a robot
may remove concerns regarding invasion (Lee et al. 2011).
3.3.2 Affordance
Perceived affordance (PA) is defined as a person’s
understanding of the capabilities of the robot based on its
appearance, based on Moran and Nakata (2010). Affor-
dance is a term originally coined by James Gibson (1977),
and the term (perceived) affordance was popularised in
human–computer interaction by Don Norman (1988).
Norman’s affordance has been further extended to the verb
‘afford’, which means ‘to suggest’. The appearance of a
robot acts as an important means of sharing information
about its abilities and functionality with its users (Salvini
et al. 2010; Dautenhahn 1999; Austermann et al. 2010;
Goetz et al. 2003; Dautenhahn 2002).
AI & Soc (2015) 30:1–21 7
123
For example, a robot with human features will lead to
expectations of humanlike capabilities (Weiss et al. 2009;
Austermann et al. 2010), e.g. facial features such as eyes
can lead to perceptions of the ability to see (Blow et al.
2006a). However, information collected by other data
collection devices in a system may be shared with the
humanoid robot, augmenting its capabilities beyond what
can be perceived (Koide et al. 2004; Dragone et al. 2010).
This presents a dilemma for users, who perceive the robot
as humanoid, with humanlike capabilities, but the robot
actually has capabilities that are not afforded by its phys-
ical appearance (Dragone et al. 2010). In this sense, it is
interesting to explore what monitoring abilities the robot
affords. The more humanlike it is viewed, then the more its
capabilities will be seen as humanlike. For example, a user
assumes that as a human cannot see through a wall, or see
through the back of its head then a robot with eyes cannot
either (Lee et al. 2011). Consider a robot which is con-
nected to additional sensors and may be able to see or know
things beyond what it affords. A user may walk behind the
robot, but the robot can still ‘see’ the user because of
additional sensors. When the true capabilities of an
anthropomorphic robot are experienced, and they are
beyond what a human is capable of, then it is anticipated
that perceptions of anthropomorphism will decrease.
3.4 Ownership/trust
The following two attributes are closely related as they deal
with user’s perception of whether or not they own the robot
and whether or not they can trust it.
3.4.1 Perceived ownership
Perceived ownership is defined as the degree to which the
user perceives that they have ownership of the robot. One
of the benefits of perceived ownership, or the perception
that the robot is a consumer item, is that the robot will be
viewed as non-threatening and under the users control
(Blow et al. 2006b). This control could be in the form of a
choice in using the device, or the user’s ability to tailor
aspects of a robot, such as appearance and behaviour, in
accordance with their own preferences (Dautenhahn 2007).
It is also interesting to consider this from the point of view
of data collection; if the user perceives ownership of the
robot, then their control, in principle, extends beyond the
robot itself to the data it collects. All issues related to the
monitoring aspects of a robot may be reduced if the user
perceives ownership of the robot and therefore any data
collected. Another view of ownership could be in terms of
a robot’s direct owner with an independent user interacting
with it. For example, consider a medical robot, the patient
does not own it, but still has to share sensitive information
with it, information which the owner of the robot may have
access to. The interplay and dynamics between the three
stake holders: robot(s), robot owner(s) and user(s) will be
an important consideration in how the factors identified in
this paper influence the behaviour of the users. This three-
way interaction is more akin to the relationship between a
human observer and an observed human, facilitated by a
humanoid robot which may be perceived as another
human—a complex but interesting scenario.
3.4.2 Perceived trustworthiness
Perceived trustworthiness (PT) is defined as the degree to
which a person feels the robot, or observer, is trustworthy,
based on Moran and Nakata (2010). For a robot to be
successful in its implementation, users must have trust in it
and its operation (Looije et al. 2006; Heerink et al. 2009b).
A users placement of trust in the robot can be influenced by
the robot’s gender (Siegel et al. 2009), physical and social
presence (Bainbridge et al. 2008), behaviour, autonomy
and adaptability (Desai et al. 2009). The less humanlike the
robot’s appearance and voice, the less trustworthy it will be
perceived (Tamagawa et al. 2011); however, it has also
been claimed that the more humanlike, the less trustworthy
robots become (Schermerhorn et al. 2008). Like the
uncanny valley, there may be a ‘peak of trust’ in a robot,
where there is a threshold of anthropomorphism which
achieves the maximum possible trust. The users own
characteristics will also influence their trust in the robot,
including user personality (Severinson-Eklundh et al.
2003), gender (Siegel et al. 2009), cultural background (Li
et al. 2010), application assumptions (Desai et al. 2009)
and how informed they are about the robot (Desai et al.
2009). The more a user trusts a robot, then the more it will
be perceived as a sociable entity (Heerink et al. 2009b,
2010b).
Robots are not always autonomous and can often be
controlled by a human. This means that perceived trust can
be expanded to include the human observer, whether this is
the controller or simply a user who has access to the
information collected. The observer can be considered
trustworthy if they collect and use a person’s personal data
(as collected by the robot) honestly, responsibly and with
no intent to cause harm (Scholtz and Consolvo 2004).
According to Theofanos and Scholtz (2005), the concept of
trust can be measured in terms of a user’s understanding of:
what data are recorded and what inferences are made about
them (awareness); the user’s ability to manage how and by
whom their data are used (control); what type of infor-
mation they must give up to receive the service and how
widely available the information collected is to other users
(privacy). A balance of trust must be found between the
observed/user and the observer/robot, as too much trust can
8 AI & Soc (2015) 30:1–21
123
be just as problematic as too little (Desai et al. 2009). It
should be noted that insufficient research has investigated
the issue of trust in robotics (Desai et al. 2009; Kidd and
Breazeal 2005).
4 Anthropomorphic attributes
We now move on to consider a series of attributes related to
anthropomorphic robots that are relevant in the context of
behavioural change, namely intelligence, autonomy and
adaptability, anthropomorphism and user-centric attributes.
4.1 Intelligence, autonomy and adaptability
The first set of anthropomorphic properties deal with the
level of autonomy the robots have as well as its ability to
reason within and adapt to the context it is placed in.
4.1.1 Intelligence
Robot intelligence is defined as the level of intelligence
potential of the robot. The intelligence of a robot will play
an important part in its interaction with users, ranging from
socially acceptable movement around a space to under-
standing and communicating socially through use of nat-
ural language (Beer et al. 2011). Robot intelligence may
not yet be at a sufficiently effective level, but there are
ways to emulate intelligence, through animacy and
appearance; though this effect is not retained over time
(Bartneck et al. 2009b).
Perceived intelligence is defined as the degree to which
a robot is seen as a knowledgeable and competent agent
[based on Bartneck et al. (2008)]. In many ways, the per-
ceived intelligence of the robot will be the predominant
determinant of its ability to be perceived as anthropomor-
phic. Existing research has established that perceptions of
intelligence are influenced by the adaptability (Austermann
et al. 2010), anthropomorphism (Walters et al. 2009b) and
animacy (Bartneck et al. 2009b) of a robot.
4.1.2 Autonomy
Robot autonomy is defined as the robots ability to function
independently of human control or intervention. The ability
for a robot to function without constant supervision from
users is critical to their adoption ‘in the wild’. There will of
course need to be constraints on the robots autonomy, as
users may begin to perceive they have reduced control over
the robot, potentially leading to perceptions of anxiety. A
balance should be found between the autonomous func-
tioning of a robot, and a user’s ability to intervene, when
they so choose.
Perceived autonomy is defined as the degree to which a
robot is perceived to demonstrate an ability to function
independently without the need for human intervention or
supervision. In many ways, this is one of the fundamental
principles of a robot and is often an assumption in many
instances of HRI. Different degrees of perceived autonomy
have been found to influence the social presence of a robot
(Syrdal et al. 2008).
4.1.3 Adaptability
Robot adaptability is defined as the robots ability to adapt
and respond to a variety of situations. A robot will be
presented with many scenarios where it will need to adapt,
perhaps dynamically changing attributes such as person-
ality and behaviour. A robot must know how to act in a
socially acceptable way, particularly as the social situation
changes, e.g. moving from formal to informal environ-
ments or showing authority when a person is not acting
correctly (e.g. damaging something).
Perceived adaptability is defined as the degree to which
a robot is perceived as adapting to the needs and situation
of its users (Heerink et al. 2008a). This has been shown to
affect user attitudes towards a robot (Torrey et al. 2006)
and ultimately affect their acceptance of the robot (Heerink
et al. 2009b; Broadbent et al. 2009). Other aspects of a
robot, such as its social presence (Syrdal et al. 2008),
intelligence (Austermann et al. 2010) and perceived use-
fulness (Heerink et al. 2008a, 2009b, 2010b), have been
established as determinants of perceived adaptability.
4.2 Anthropomorphism
The next set of properties relate to the robot’s humanlike
physical appearance, its expressiveness, behaviour and
personality and how they all affect how the robot is viewed
as anthropomorphic as well as how this affects user
expectation and interaction.
4.2.1 Anthropomorphic form
Robot form is defined as the complete physical appear-
ance of a robot, ranging from purely functional to
humanlike characteristics. A humanlike physical form
exhibited by a robot has been linked to a host of different
effects. These effects are created by the user’s tendency to
anthropomorphise a humanlike robot. A first step to
achieving this is to emulate the structure of a human,
including a torso, a head, arms, legs, and even fingers and
toes (Beer et al. 2011); as opposed to the physical
structure of an animal (e.g. zoomorphic (Yanco and Drury
2004)). The details of these components are important, for
example, the dimensions, specific features and total
AI & Soc (2015) 30:1–21 9
123
number of features of a robot face (Blow et al. 2006b;
DiSalvo et al. 2002; Broadbent et al. 2009) have been
shown to influence perceptions of human-likeness, robot
sociability, capabilities and even knowledge (Powers and
Kiesler 2006; DiSalvo et al. 2002; Blow et al. 2006a).
Together these attributes, and their size, can determine the
physical presence a robot holds in an environment.
Variations in size and presence can be quite problematic
for an interaction, so much so that in one experiment,
researchers consciously reduced the size of their robot to
less than the height of an adult male so that it would not
be perceived as threatening (Hiroi and Ito 2008). This
change in size demonstrates the ways in which designers
can control the way a robot is perceived. One of the
problems with giving a robot a too strong human-likeness
is that it may give false expectations about the robots
abilities (Dautenhahn 2004). If these are not met, then
there may be a break down in the interaction (Dautenhahn
et al. 2005; Velonaki 2010). To compensate for this, it
may be possible to dynamically change the appearance of
a robot to coincide with user expectations in a specific
context or scenario (Siegel et al. 2009). For example,
changing a property such as gender has been shown to
affect acceptance (Broadbent et al. 2009; Beer et al.
2011). The form of a humanoid robot, as would be
expected, influences a significant number of perceptions
including likeability (Bartneck 2008), familiarity (Dau-
tenhahn 2002), empathy (Riek et al. 2009), emotional
experience (Zhang et al. 2010), anthropomorphism
(Bartneck 2008; Austermann et al. 2010), trustworthiness
(Bainbridge et al. 2008), invasiveness, (Young et al. 2009;
Kidd and Breazeal 2004; Walters et al. 2005; Kanda et al.
2008), anxiety (Kanda et al. 2002), expectations (Dau-
tenhahn 2004) and human-likeness, robot sociability,
capabilities and even knowledge (Powers and Kiesler
2006; DiSalvo et al. 2002; Blow et al. 2006a).
Perceived anthropomorphism (PA) is defined as the
degree of robot human-likeness based on both physical
appearance and user interaction experience (Zhang et al.
2010). The different degrees of anthropomorphism arise
from a users perceptions of humanoid appearance, form
and skills (Bartneck 2008; Beer et al. 2011). This includes
attributes such as a robots vocal and facial characteristics
(DiSalvo et al. 2002; Powers and Kiesler 2006), animacy
(Goetz et al. 2003; Severinson-Eklundh et al. 2003; Di-
Salvo et al. 2002), communication (DiSalvo et al. 2002),
behaviour and emotions (DiSalvo et al. 2002; Sabanovic
et al. 2006; Bartneck et al. 2009a), and gender (Scher-
merhorn et al. 2008), in addition to the number of these
features (Hegel et al. 2009). The more, or less, a robot is
perceived as anthropomorphic will likely affect other per-
ceptions a user holds about the robot (Lee 2010). For
example, an anthropomorphic robot would not afford the
ability to see through objects, which is another area users
may be misled (Lee et al. 2011). It also affects how users
interact with the robot; for example, research has shown
that when robots are viewed as more humanlike, users are
likely to be less truthful (Schermerhorn et al. 2008). Like
robot form, perceived anthropomorphism has been estab-
lished as an indicator of perceived robot intelligence
(Walters et al. 2009b), ease of use (Hegel et al. 2009),
social presence (Schermerhorn et al. 2008), personality
(Goetz et al. 2003), ability (Goetz et al. 2003) and trust-
worthiness (Tamagawa et al. 2011).
4.2.2 Personality
Robot personality is defined as the humanlike persona
displayed by the robot. Syrdal et al. (Syrdal et al. 2007a)
make use of the Big Five Personality Factors which consist
of Emotional Stability, Extraversion, Agreeableness, Con-
scientiousness and Intellect. These personality factors can
define personality types such as friendly, shy, aggressive or
bossy (Woods et al. 2005b). Perceptions of trustworthiness
(Severinson-Eklundh et al. 2003), anthropomorphism
(Fussell et al. 2008) and level of control (Meerbeek et al.
2008) are influenced by decisions regarding robot
personality.
Perceived personality is defined as the degree to which
the robot is perceived to display humanlike personality
traits. A robot’s perceived personality type has been
shown as an anchor point upon which many other per-
ceptions are based (Powers et al. 2005). Robot form can
lead to marked differences in perceived robot personali-
ties. Perceptions of robot personality will shape a user’s
expectations and social responses and will influence their
perceptions of control and trustworthiness. It has also
been suggested that a user will anthropomorphise a polite
robot more than an impolite one (Fussell et al. 2008).
Some research has attempted to control perceptions of
personality through designed personality (i.e. controlled
system attributes), but their experiments showed little
change in perceived personality through variations in the
designed personality (Meerbeek et al. 2008). This sug-
gests that controlling for personality alone is insufficient
and that variations in other factors such as appearance,
which influence perceptions of personality, may be
required. A robot’s form (Meerbeek et al. 2006; Walters
et al. 2008a; Severinson-Eklundh et al. 2003) and ani-
macy/mobility (Severinson-Eklundh et al. 2003) have
been observed to influence user perception of personality.
In turn, this perception can influence a user’s expectations
and social responses (Goetz et al. 2003), control (Meer-
beek et al. 2006), trustworthiness (Desai et al. 2009;
Severinson-Eklundh et al. 2003) and anthropomorphism
(Fussell et al. 2008).
10 AI & Soc (2015) 30:1–21
123
4.2.3 Robot expression
Robot physical expression is defined as the ability for the
robot to use physical actions in order to communicate
through expression. Physical expression, in the form of
animated gestures, is important when establishing com-
munication between robots and humans (Kanda et al.
2002). Having the ability to express and interact with
humans in a more natural way has been shown to affect
user acceptance and perceptions of a robot (Broadbent
et al. 2009; Blow et al. 2006b). Another aspect of physical
expression is the animacy of the robot, defined as the
method and manner by which the robot moves. A robot
may move in a ‘natural’ and fluid way, or it may move in a
rigid and mechanical fashion which can affect its
Humanlike Appearance (DiSalvo et al. 2002) and Per-
ceived robot intelligence (Bartneck et al. 2009b).
Robot Social Expression is defined as the ability for a
robot to express itself socially through communication and
emotion. Humans have shown a preference to communicate
with robots in a humanlike manner, with speech being a
key natural means of interaction (Dautenhahn et al. 2005;
Sabanovic et al. 2006). Specific features of speech, such as
accent and pitch, can also directly influence trustworthiness
(Tamagawa et al. 2011). Emotion is another tool for a
robots social expression (Beer et al. 2011) and affects
perceptions of robot dominance (Kim et al. 2011), human-
likeness (DiSalvo et al. 2002; Sabanovic et al. 2006),
knowledge and sociability (Powers and Kiesler 2006),
obtrusiveness (Walters et al. 2008b), comfort (Nomura and
Kanda 2003), personality (Woods et al. 2005b) and trust-
worthiness (Tamagawa et al. 2011).
Perceived robot social expression is defined as the
degree to which a robot is perceived to display an ability to
express itself through verbal communication and emotions.
While many would consider personality as a form of social
expression, in this research it is viewed as a separate factor
due to its relative complexity, though perceived personality
and perceived robot social expression are anticipated to be
closely related. The task, or purpose, of a robot effectively
determines the need for social expressiveness. For exam-
ple, a factory-based robot does not necessarily need to
express itself in order to function correctly, while a
humanoid robot placed in a service role (e.g. assistant,
guide) needs social expression in order to interact with
users in a natural way, to also create a sense of social
presence (Heerink et al. 2008b, 2009b, 2010b) and inter-
action enjoyment (Heerink et al. 2009b, 2010b).
4.2.4 Social presence
Perceived social presence is defined as the degree to which
a user feels that they are in the presence of a socially
interactive entity. Furthermore, a consistency between
robot voice and personality has been empirically demon-
strated to positively affect perceived social presence (Lee
and Nass 2003), and without such positive reinforcement,
perceptions of social presence are expected to decrease
over time (Leite et al. 2009). Factors which can affect
perception of social presence include robot Mobility
(Syrdal et al. 2008), anthropomorphism (Schermerhorn
et al. 2008), adaptability (Syrdal et al. 2008), physical
presence (Kidd and Breazeal 2004; Bainbridge et al. 2008)
and social expressiveness (Heerink et al. 2008b). Social
presence is an important consideration as it influences a
number of different perceptions including: engagement
(Leite et al. 2009), enjoyment (Heerink et al. 2009a, b,
2010b, 2008b), social expressiveness (Heerink et al. 2010a)
and boundaries (Walters et al. 2005).
4.2.5 Mobility
Robot mobility is defined as the means and functionality of
robot locomotion. The movement speed and approach
direction of a robot have been shown to increase percep-
tions of anxiety (Hiroi and Ito 2008; Nomura et al. 2007)
and threat. The distance a robot is able to travel and how
quickly is also a point of consideration and may be a factor
which actually leads to a reduction in perceptions of
anthropomorphism. Its mobility may also, in certain situa-
tions, be considered obtrusive or intrusive, such as inter-
acting with a robot in a tight corridor (Nakauchi and
Simmons 2002) or crossing/blocking a users path (Dau-
tenhahn 2007). It can also affect anxiety (Hiroi and Ito
2008; Nomura et al. 2007) and perceptions of feeling
threatened (Dautenhahn et al. 2006). Additional locomo-
tive functions of robot mobility are likely to influence
perceptions, for example if the robot can swim/fly.
Perceived mobility is defined as the degree to which
users perceive the robots ability to transport itself freely.
Depending on how the robot is perceived to be mobile,
perceptions of personality, anthropomorphism (Severinson-
Eklundh et al. 2003) and social presence (Syrdal et al.
2008) will change.
4.2.6 Behaviour
Robot behaviour is defined as the manner with which the
robot acts during interaction. Design choices made about
the behaviour of a robot will affect how people perceive it
(Young et al. 2009; Zia-ul-Haque et al. 2007). For exam-
ple, users prefer a robot which is considerate, polite, and
which demonstrates a passive behaviour (Dautenhahn et al.
2005). Even if a robot is perceived as useful, it will only be
adopted if socially acceptable behaviour is displayed
(Walters et al. 2007), which is context and culturally
AI & Soc (2015) 30:1–21 11
123
specific. The way a robot acts can also affect perceptions of
its capabilities (Goetz et al. 2003; Lohse 2009) and its
anthropomorphism (DiSalvo et al. 2002; Sabanovic et al.
2006).
Perceived robot behaviour (PRB) is defined as the
degree to which a user perceives the manner with which a
robot acts as natural and socially acceptable. A robots
appearance will likely play an important part in influencing
a users perceptions of robot behaviour (Walters et al.
2007). Perceptions of anthropomorphism are determined,
in part, by a robots behaviour (DiSalvo et al. 2002) and
therefore also arguably determined by the way a user
perceives that behaviour. If there is a discrepancy between
human form and human behaviour, then negative user
responses are likely (Dautenhahn et al. 2005; Walters et al.
2007; Velonaki 2010). The behaviour of the robot will also
affect users expectations (Lohse 2009), where the behav-
iour is an effective way of communicating information to
users such as the robots intentions (Salvini et al. 2010).
There is still more work to be conducted exploring how
variations in the behaviour of a robot affects a users
responses (Goetz et al. 2003), particularly their emotional
and cognitive responses (Broadbent et al. 2007). The
influence of behaviour on HRI is also difficult to isolate
from the effects of the robot appearance (DiSalvo et al.
2002; Walters et al. 2007; Minato et al. 2004), but has been
found to affect user expectations (Lohse 2009).
4.3 User-centred
The last set of attributes relate to the user’s experience of
interacting with the robot, rather than the intrinsic prop-
erties of the robot itself.
4.3.1 Enjoyment
Perceived likeability/enjoyment is defined as the degree to
which a user perceives the robot to be likeable and the
interaction enjoyable (Bartneck et al. 2008). Likeability
(enjoyment) has also been shown to influence acceptance
of a robot (Heerink et al. 2008b, 2009b), but in contrast,
some research has found no evidence for the importance of
hedonic factors in robot acceptance (Klamer and Ben
Allouch 2010). Factors such as social presence (Heerink
et al. 2008b), appearance (Bartneck 2008) and acceptance
(Heerink et al. 2008b, 2009b) should be considered when
designing for likeability.
4.3.2 Ease of engagement
Perceived engagement is defined as the degree to which a
person perceives the robot to have drawn them into an
interaction and to successfully negotiate that interaction,
based on Kidd and Breazeal (2005). To function as inten-
ded, a robot must be engaging, encouraging users to will-
ingly have regular interactions (Kidd and Breazeal 2005).
Without this engagement, the robot is unlikely to retain
high degrees of social presence (Leite et al. 2009).
4.3.3 Anxiety
Perceived anxiety is defined as the degree to which a user
feels a sense of anxiety towards interacting with the robot.
A sense of familiarity, generated through previous expe-
riences, may also reduce the anxiety felt by certain users
(Bartneck 2008). Perceived anxiety has also been shown to
change with time (Nomura et al. 2007) and incite com-
munication avoidance (Nomura et al. 2006) and reduce
perceptions of usefulness (Heerink et al. 2009b, 2010b). To
prevent this, aspects of mobility (Hiroi and Ito 2008),
boundaries (Nomura et al. 2007), approach direction
(Dautenhahn et al. 2006) and familiarity (Bartneck 2008)
could be controlled.
4.3.4 Safety
Perceived safety is defined as the user’s perception of the
level of danger, or threat, when interacting with a robot
(Bartneck et al. 2008). It has been suggested that when a
robot is highly obtrusive (perhaps due to its size), the users
will perceive themselves to be secure (Dautenhahn et al.
2006), which in turn can lead to acceptance of the tech-
nology (Bartneck et al. 2008). Perceptions of safety may
also be created through the purpose of the robot, e.g. a
robot which collects physiological data about a person who
has a life-threatening illness may give the person a sense of
safety. However, if the purpose of the robot is to observe a
visitor as they simply walk around a hospital, the user may
feel there is a reason to perceive the situation as unsafe.
Previous experience with a robot (Blow et al. 2006b) and
its size (Hiroi and Ito 2008; Bartneck et al. 2008) can affect
the perceived safety of a user during their interaction with
the robot.
5 Perceptions of system attributes matrix
The research literature on HRI and monitoring was com-
prehensively explored in order to identify a series of salient
and recurring factors which are important to the interaction
and influence user behavioural responses to robots. In order
to capture as many different influencing attributes of a
robot as possible, the review explores both relevant
hypotheses and empirical studies, and the impacts of robots
of different types (though a general leaning towards
anthropomorphic), in different contexts and with different
12 AI & Soc (2015) 30:1–21
123
types of users. This provides a holistic view of robotics and
the possible areas of influence in HRI. This is beneficial as
it may capture information which could be overlooked with
a narrower search. While research from other fields is
likely to be of interest, for example software agents and
autonomous systems, the survey was limited to monitoring
and HRI in order to explicitly highlight the ways in which
these two fields specifically intersect.
It is difficult to get a sense of all of the relationships
identified above, and so the most effective way of repre-
senting and analysing the inter-relationships between the
different themes is through use of a matrix, as shown in Fig. 1.
The aim of this matrix is to clearly visualise the state of the art,
and identify areas where more research is needed. The high-
level groupings of factors are used for the columns and rows,
with references to the literature exploring that relationship.
Anthropomorphic Data Collection
Intelligence Anthropomorphism User Centr. Invasiveness Control Understanding Ownership
A nt
hr op
om or
ph ic
In te
ll ig
en ce
(Syrdal et al. 2008) (Heerink et al. 2010a;
Syrdal et al. 2008;) (Desai et al. 2009)
A n
th ro
p om
or p
h is
h m
(Bainbridge et al. 2008; Bartneck et al. 2009b;)
(Bartneck 2008; Bartneck et al. 2009a; Beer et al. 2011; Desai et
al. 2009; Fussell et al. 2008; Goetz et al. 2003; Hegel et al.
2009; Kim et al. 2011; DiSalvo et al. 2002; Meerbeek et al. 2006;
Powers and Kiesler 2006; Sabanovic et al. 2006;
Schermerhorn et al. 2008; Severinson-Eklundh et al. 2003; Syrdal et al. 2008; Walters et al.
2007; Walters et al. 2008a; Woods et al. 2005; Heerink et al.
2008; Heerink et al. 2009a; Heerink et al. 2009b; Heerink et
al. 2010a;)
(Bartneck et al. 2008; Bartneck 2008; Dautenhahn
et al. 2006; Hiroi and Ito 2008; Kanda et al. 2002; Li et al. 2010; Nomura et al. 2007; Nomura and Kanda
2003; Heerink et al. 2009b; Heerink et al. 2010a; Heerink
et al. 2010b; Walters et al. 2005;)
(Bainbridge et al. 2008; Dautenhahn 2007; Hiroi and Ito 2008; Kanda et al. 2008;
Kidd and Breazeal 2004; Nakauchi and Simmons
2002; Schermerhorn et al. 2008; Tamagawa et al. 2011; Walters et al. 2005; Walters
et al. 2008b; Young et al. 2009;)
(Meerbeek et al. 2006; Meerbeek et al. 2008;
Syrdal et al. 2006;)
(Austermann et al. 2010; Bartneck et al. 2008; Bartneck et al. 2009a;
Dautenhahn 2002; Dautenhahn 2004; Goetz et al. 2003; Lohse 2009;
Walters et al. 2007; )
(Bainbridge et al. 2008; Fussell et al. 2008; Goetz et al. 2003; Lohse 2009;
Meerbeek et al. 2006; Severinson-Eklundh et al. 2003; Tamagawa et al. 2011; Desai et al.
2009)
U se
r C
en te
re d
(Dautenhahn et al. 2006; Nomura et al. 2007;)
(Heerink et al. 2009b; Heerink et al. 2010a)
(Leite et al. 2009)
“Y” Influences…
“X ”
In fl
ue nc
ed b
y …
D at
a C
ol le
ct io
n
In va
si ve
n es
s
(Hiroi and Ito 2008; Kanda et al. 2002; Syrdal et al. 2008;)
(Dautenhahn 2007; Koay et al. 2006; Pacchierotti et al.
2008;)
(Bainbridge et al. 2008;Dautenhahn et al. 2006;Kidd and Breazeal
2004; Syrdal et al. 2008;Young et al. 2009;)
(Dautenhahn et al. 2006; Zweig 2005);
(Bohn et al. 2007; Marx 2001; Mancini et al. 2010 ;Punie 2003 ;)
C on
tr ol
(Hiroi and Ito 2008; Syrdal et al. 2007; Walters et al. 2009;)
(Desai et al. 2009)
U n
d er
st a.
(Desai et al. 2009; Melenhorst et al. 2004; Stanton 2000; Syrdal et al. 2007; Vallejo et al. 2008; Zweig and Webster 2002;)
(Desai et al. 2009; Zweig 2005;)
O w
n .
(Blow et al. 2006) (Melenhorst et al. 2004;
Zweig 2005;) (Blow et al. 2006; Dautenhahn 2007;)
Fig. 1 Relation-based matrix for anthropomorphic and data collection factors
AI & Soc (2015) 30:1–21 13
123
Moving horizontally in the matrix examines the factor
that influences the others, while moving vertically top to
bottom, examine what influences the factor (horizontal:
influences, vertical: influenced by). Initially, we will
explore the matrix factor by factor, considering both the
influence it has on other factors (horizontal) and the
influence of other factors on it (vertical).
Starting at the top left and looking from left to right, we
see that robot intelligence shows a small number of
established influences, only research related to ownership
and user-centred factors. Examining the first column, we
see that only anthropomorphism (as an external factor) has
influence on perceptions of robot intelligence. The gaps in
the matrix may be attributed to the fact that robot intelli-
gence is an inherently difficult aspect of robotics to study
effectively. This is likely due to the level of progress in the
field towards truly convincing and adaptable artificial
intelligence; while strides are being made towards a suit-
able level, the work still remains limited in the convinc-
ingness of the AI appropriate to anthropomorphic robotics.
One technique that can help with studies of the missing
relationships, particularly in relation to monitoring sys-
tems, is Wizard of Oz (Woz). This approach introduces a
human into the loop and suggests to the user that the
machine is artificially responding to them, when in fact it is
a human in control. Assuming the interaction is believable
and convincing, users are unlikely to question the efficacy
of the interaction, nor consider that they are being
deceived.
The next horizontal row shows that anthropomorphism
has the most established influence/relationships with all the
anthropomorphic and data collection factors. This suggests
that it is a well-studied aspect of social robotics and re-
affirms the clear intersection of research between social
robotics and monitoring systems. However, when looking
at anthropomorphism vertically, we see that only inva-
siveness has been identified as a point of influence. This
raises questions as to the impact of the other factors on
perceived anthropomorphism; for example, can different
degrees of control or understanding or the robots ability to
collect data impact user perceptions of its anthropomor-
phism? How might knowledge that a robot can only see
through cameras (analogous to eyes) influence the way it is
perceived? Evidence in the literature suggests that people
anthropomorphise computers in their possession and it
would be interesting to consider how this might expand to
ownership of a social robot. Related to this is also the users
emotional attachment to an object, how might this influ-
ence the way they anthropomorphise it?
Research on the influence of user-centred attributes
appears to be limited to relationships within the data col-
lection attributes. Interestingly, little work has explored the
influence of these on anthropomorphic factors. This may be
related to the fact that a user has to experience the system
to have an emotional response to it, and so detaching the
emotional response from this experience is difficult.
Examining the user-centred attributes column, we see a
different picture of the literature, where a number of the
factors have explored the ways in which user-centred
attributes are influenced by the other factors. This may be
due to the fact that users can be easily exposed to a char-
acteristic such as a robot with a large torso and have their
emotional response measured. However, to have a user in a
specific emotional state prior to this interaction is more
difficult and an understudied area.
Invasiveness appears to be the most studied in the
matrix both in terms of its influence on other factors and
what it is influenced by (horizontal and vertical). It is one
of the predominant data collection-based factors to have
been studied within the context of social robotics. When
considering the personal and intimate ways in which
social robots will be used in the future, it becomes clear
why this factor is important in terms of physical space
and privacy issues. Research examining the effect of
control on other factors is one of the most limited in the
matrix, with a focus on user-centred attributes and
ownership. This raises interesting questions on how
control might influence perceptions of intelligence
(including autonomy) and anthropomorphism: does being
able to control a robot impact the illusion of anthropo-
morphism by breaking the social norm of ‘not control-
ling’ a human? From the column of control, we can see
that a number of factors influence perception of it,
including the obvious component of control, but most
interestingly invasiveness and anthropomorphism.
Like control, the impact of understanding on other
factors is limited, with a focus on invasiveness and
ownership. These factors are predominately related to
data collection, which promotes the need for exploring
these factors in terms of humanoid robotics. Alternately,
understanding is influenced by anthropomorphism and
user-centred emotions factors, however, does not influ-
ence data attributes generally, this again suggests that the
technology is not in a sufficient state of deployment that
we can deploy it to users who can then experience it and
understand it, then informing their views of the other
factors. Ownership also has limited studies, showing
influence on invasiveness, control and user-centred attri-
butes. Even though the influence of ownership has yet to
be explored, again likely due to lack of ownership of
robots in the real world, it is interesting to note that all
the other factors have been found to influence sense of
ownership in some way.
While using the high-level groupings for factors and
their relationships in Fig. 1 helps more easily visualise the
state-of-the-art, much of the detail is lost. For this reason,
14 AI & Soc (2015) 30:1–21
123
we also include a more detailed matrix in Fig. 2, which
identifies specific relationships and the associated litera-
ture, categorised in terms of physical and social attributes.
Physical attributes concern the objective, tangible and
physical aspects of a robot/monitoring system, while the
social attributes are related to the application and interac-
tion with humans at a social level. For example, users may
be more interested in the functional aspects of the robot
(e.g. shape and things which influence physical task) than
aspects such as colour or contour which influence human-
likeness. Equally, a user may be more interested in the way
the robot behaves and talks, than what tasks it can carry out
and its physical form. Each highlighted co-ordinate/square
in the matrix represents a relationship which has either
been empirically tested or hypothesised in the literature.
Those squares which are highlighted in black represent a
relationship supported by evidence in the literature, with
the white number corresponding to a cell in Table 1.
Squares which contain the letter M are relationships which
are hypothesised or tested related to Moran and Nakata’s
(2010) work on monitoring technology. Those squares with
a ‘H’ have been hypothesised as a part of this research, and
those which are have a diagonal line or highlighted grey
represent relationships which are not logically possible.
The far left hand column of the matrix shows the physical
attributes, social attributes and user perceptions as identi-
fied in previous sections. Each is categorised into
humanoid robot aspects (HR, lighter colour), and data
collection aspects (DC, darker colour).
6 Contributions
The main contribution of this paper is in promoting dis-
cussion around anthropomorphic robots as monitoring
devices as a new thread of research. As a part of this, the
most salient attributes of a humanoid robot have been
identified, both purely in terms of robotics and also in
terms of monitoring systems which were identified through
a substantial literature review. Using this review, we con-
structed a matrix which allows us to easily visualise the
state of the art, which also helps us identify trends and
patterns for future directions for research.
7 Future work
Based on the discussions and ideas presented in this
paper, we propose a number of areas for future work.
For example, context is a critical consideration when
understanding behavioural change in robotics. A change
in context can significantly influence the perceptions of
users about a robot and its tracking abilities (Lee et al.
2011). Hence, one consideration for future research
R F
R P
E
R M
O B
R C
O N
R C
O V
R O
B
N O
R
R S
E
R P
E R
R B
E H
R IN
T
R A
D A
R A
U T
F O
D C
D I
U I
D T
A C
O N
D A
C C
D S
H A
P A
N T
P IN
T
P A
D A
P A
U T
P E
O E
P S
P
P R
B
P P
E R
P R
S E
P O
W N
P A
N X
P S
A F
P E
N J
P M
O B
A A
P N
B C
P S
B C
P F
B C
P P
I
P B
E N
P T
R U
P A
F F
P C
O V
P D
C
P R
C
Robot Form RF H H 1 H H 2 H 3 4 5 6 7 8 9 Robot Physical Expresion RPE 4131211101 H H H H
Robot Mobility RMOB H H 15 16 H Robot Control RCON M M 17 M
Robot Coverage RCOV M M Robot Obtrusion ROB 18 19 20 21 M
Number of Robots NOR MMMM Robot Social Expression RSE 22 H 23 H 24 25 26
Robot Personality RPER 27 H 28 29 30 Robot Behaviour RBEH 31 H 32
Robot Intelligence RINT H H Robot Adaptability RADA HH
Robot Autonomy RAUT H Frequency of Data Collection FODC M M
Data Integration DI M User Informedness UI M M 33 34
Data Types DT 6353 Application Control ACON M M M M 37 M
Data Access DACC M 38 M Data Sharing DSHA M
Percieved Anthropormorphism PANT 54443424140493 Percieved Intelligence PINT H
Percieved Adaptability PADA 847464 Percieved Autonomy PAUT H 49 H 50
Percieved Ease of Engagement PEOE H 51 Persieved Social Presence PSP 52 53 54 55 56
Perceived Robot Behaviour PRB 57 58 Percieved Personality PPER 59 HH 60 61 62
Percieved Robot Social Expression PRSE 4636 Perseived Ownership POWN 86766656
Percieved Anxiety PANX 69 70 Perceived Saftey PSAF
Perceived Likeability/Enjoyment PENJ Percieved Mobility PMOB 71 72 73
Application Assumptions AA 74 75 M M M Percieved Natural Border Crossings PNBC H 76 77 M 78 79 80
Percieved Social Border Crossings PSBC M M Percieved Frequency of Border Crossings PFBC M M
Percieved Privacy Invasion PPI M Perceived Benefit/Justification PBEN M 81 82 83
Percieved Trustwrothiness PTRU 84 85 Percieved Affordance PAFF M M M M
Percieved Coverage PCOV MMM Perceived Data Control PDC MMMMH
Perceived Robot Control PRC M M M 654321
F
set u
birtt A
lai c o
S s
n o it
pecre P
res U
P h
y si
ca l
A tt
ri b
u te
s H R
D C
H R
D C
H R
D C
A
B
C
D
E
snoitpecrePresUsetubirttAlaicoSsetubirttAlacisyhP
CDRHCDRHCDRH
Fig. 2 The PSA matrix displays the relationships and inter-relationships between system characteristics and user perceptions
AI & Soc (2015) 30:1–21 15
123
T a
b le
1 R
e se
a rc
h w
h ic
h c o
rr e sp
o n
d s
to th
e n
u m
b e r
c o
o rd
in a te
s in
th e
P S
A m
a tr
ix (F
ig .
2 )
N o
. R
e se
a rc
h li
te ra
tu re
N o
. R
e se
a rc
h li
te ra
tu re
N o
. R
e se
a rc
h li
te ra
tu re
N o
. R
e se
a rc
h li
te ra
tu re
1 .
B a rt
n e c k
(2 0
0 8
); B
e e r
e t
a l.
2 0
1 1
; D
iS a lv
o e t
a l.
(2 0
0 2
); H
e g
e l
e t
a l.
(2 0
0 9 );
P o
w e rs
a n
d K
ie sl
e r
(2 0
0 6
); S
a b
a n
o v
ic e t
a l.
(2 0
0 6 )
2 4
. N
o m
u ra
a n
d K
a n
d a
(2 0
0 3
) 4
7 .
H e e ri
n k
e t
a l.
(2 0
0 8
a )
7 0
H e e ri
n k
e t
a l.
(2 0
0 9
b ,
2 0
1 0
b )
2 .
W a lt
e rs
e t
a l.
(2 0
0 7
) 2
5 .
W a lt
e rs
e t
a l.
(2 0
0 8
b )
4 8
. H
e e ri
n k
e t
a l.
(2 0
0 9
b ,
2 0
1 0
b );
S y
rd a l
e t
a l.
(2 0
0 8
)
7 1
. S
y rd
a l
e t
a l.
(2 0
0 8
)
3 .
H ir
o i
a n
d It
o (2
0 0
8 );
K a n
d a
e t
a l.
(2 0
0 2
); N
o m
u ra
a n
d K
a n
d a
(2 0
0 3
); N
o m
u ra
e t
a l.
(2 0
0 7
)
2 6
. T
a m
a g
a w
a e t
a l.
(2 0
1 1 )
4 9
. D
e sa
i e t
a l.
(2 0
0 9 )
7 2
. S
e v
e ri
n so
n -E
k lu
n d
h e t
a l.
(2 0
0 3
); S
y rd
a l
e t
a l.
(2 0
0 8
)
4 .
B a rt
n e c k
e t
a l.
(2 0
0 8
); H
ir o
i a n
d It
o (2
0 0
8 )
2 7
. F
u ss
e ll
e t
a l.
(2 0
0 8 )
5 0
. D
e sa
i e t
a l.
(2 0
0 9 )
7 3
. S
e v
e ri
n so
n -E
k lu
n d
h e t
a l.
(2 0
0 3
)
5 .
B a rt
n e c k
(2 0
0 8
); L
i e t
a l.
(2 0
1 0
) 2
8 .
S e v
e ri
n so
n -E
k lu
n d
h e t
a l.
(2 0
0 3
) 5
1 .
L e it
e e t
a l.
(2 0
0 9
) 7
4 .
V a ll
e jo
e t
a l.
(2 0
0 8
)
6 .
D a u
te n
h a h
n (2
0 0
4 );
W a lt
e rs
e t
a l.
(2 0
0 7
) 2
9 .
M e e rb
e e k
e t
a l.
(2 0
0 8
); S
y rd
a l
e t
a l.
(2 0
0 6
) 5
2 .
H e e ri
n k
e t
a l.
( 2 0
1 0
a )
7 5
. D
e sa
i e t
a l.
(2 0
0 9
)
7 .
H ir
o i
a n
d It
o (2
0 0
8 );
K a n
d a
e t
a l.
(2 0
0 8 );
K id
d a n
d
B re
a z e a l
(2 0
0 4 );
W a lt
e rs
e t
a l.
(2 0
0 5
); Y
o u
n g
e t
a l.
(2 0
0 9 )
3 0
. M
e e rb
e e k
e t
a l.
(2 0
0 8
); S
y rd
a l
e t
a l.
(2 0
0 6
) 5
3 .
H e e ri
n k
e t
a l.
(2 0
0 8
b ,
2 0
0 9
a )
7 6
. B
a in
b ri
d g
e e t
a l.
(2 0
0 8
);
K id
d a n
d B
re a z e a l
(2 0
0 4 )
8 .
B a in
b ri
d g
e e t
a l.
(2 0
0 8
); T
a m
a g
a w
a e t
a l.
(2 0
1 1
) 3
1 .
B a rt
n e c k
e t
a l.
(2 0
0 9
a );
D iS
a lv
o e t
a l.
(2 0
0 2
); S
a b
a n
o v
ic
e t
a l.
(2 0
0 6
)
5 4
. H
e e ri
n k
e t
a l.
(2 0
0 9
b ,
2 0
1 0
b );
W a lt
e rs
e t
a l.
(2 0
0 5 )
7 7
. D
a u
te n
h a h
n e t
a l.
(2 0
0 6
)
9 .
D a u
te n
h a h
n (2
0 0
4 );
W a lt
e rs
e t
a l.
(2 0
0 7
) 3
2 .
G o
e tz
e t
a l.
(2 0
0 3
); L
o h
se (2
0 0
9 )a
5 5
. B
a in
b ri
d g
e e t
a l.
(2 0
0 8 )
7 8
. S
y rd
a l
e t
a l.
(2 0
0 8
)
1 0
. D
a u
te n
h a h
n (2
0 0
7 );
N a k
a u
c h
i a n
d S
im m
o n
s (2
0 0
2 )
3 3
. Z
w e ig
a n
d W
e b
st e r
(2 0
0 2
) 5
6 .
D e sa
i e t
a l.
(2 0
0 9 )
7 9
. B
o h
n e t
a l.
(2 0
0 7
); M
a n
c in
i
e t
a l.
(2 0
1 0
); M
a rx
(2 0
0 1
); P
u n
ie (2
0 0
3 )
1 1
. D
iS a lv
o e t
a l.
(2 0
0 2
); G
o e tz
e t
a l.
(2 0
0 3
);
S e v
e ri
n so
n -E
k lu
n d
h e t
a l.
(2 0
0 3
)
3 4
. D
e sa
i e t
a l.
(2 0
0 9
) 5
7 D
iS a lv
o e t
a l.
(2 0
0 2
) 8
0 .
Z w
e ig
(2 0
0 5
)
1 2
. B
a rt
n e c k
e t
a l.
(2 0
0 9
b )
3 5
. S
y rd
a l
e t
a l.
(2 0
0 7
b )
5 8
. F
u ss
e ll
e t
a l.
(2 0
0 8
) 8
1 .
M e le
n h
o rs
t e t
a l.
(2 0
0 4
);
S y
rd a l
e t
a l.
(2 0
0 7
b )
1 3
. B
a in
b ri
d g
e e t
a l.
(2 0
0 8
) 3
6 .
S y
rd a l
e t
a l.
(2 0
0 7
b )
5 9
. D
e sa
i e t
a l.
(2 0
0 9 );
S e v
e ri
n so
n -
E k
lu n
d h
e t
a l.
(2 0
0 3 )
8 2
. S
ta n
to n
(2 0
0 0
)
1 4
. S
e v
e ri
n so
n -E
k lu
n d
h e t
a l.
(2 0
0 3 )
3 7
. D
e sa
i e t
a l.
(2 0
0 9
) 6
0 .
M e e rb
e e k
e t
a l.
(2 0
0 6 )
8 3
. Z
w e ig
(2 0
0 5
)
1 5
. S
e v
e ri
n so
n -E
k lu
n d
h e t
a l.
(2 0
0 3 )
3 8
. V
a rg
a s
e t
a l.
(2 0
0 9 )
6 1
. M
e e rb
e e k
e t
a l.
(2 0
0 6 )
8 4
. Z
w e ig
(2 0
0 5
)
1 6
. D
a u
te n
h a h
n e t
a l.
(2 0
0 6 );
H ir
o i
a n
d It
o (2
0 0
8 );
N o
m u
ra a n
d K
a n
d a
(2 0
0 3
); N
o m
u ra
e t
a l.
(2 0
0 7
)
3 9
. W
a lt
e rs
e t
a l.
(2 0
0 9
b )
6 2
. M
e e rb
e e k
e t
a l.
(2 0
0 6 )
8 5
. M
e le
n h
o rs
t e t
a l.
(2 0
0 4
)
16 AI & Soc (2015) 30:1–21
123
exploring the effects of data collection on users is the
context within in which it takes place. Variations in the
types of contexts studied and explored can only be a
good thing. In relation to the context is the task of a
robot, where it might be able to support users, instruct
them or act autonomously. In fact, the design of a robot
and its use is predominately determined by its task
(Yanco and Drury 2004).
The majority of studies and research examined in this
paper have mainly explored the social aspects of robotics
in experimental conditions. There is a current drive
towards exploring the impact of technology ‘in the wild’,
and understanding how the technology actually influences
people in situ can help improve our understanding.
Researchers need to move beyond the laboratory and begin
to see the technology they develop directly in use; which
will likely reveal rich and unexpected interactions.
One key aspect to HRI which is clearly missing re-
longitudinal studies (Kanda et al. 2004; Walters et al.
2008b), which are important to get past the novelty effect
(Sung et al. 2009). It is important to understand how
longitudinal effects change over time, and this could be in
terms of experimental studies or in situ studies. The idea
that humanoid robots afford certain capabilities in terms of
monitoring characteristics is an understudied area. More
work is needed to understand what people think robots are
capable of perceiving and judging, and the benefits and
disadvantages that come with this. For example, consider
the affordances that derive from a robot with human eyes.
Interestingly, robots can be augmented with other systems
(such as smart homes and surveillance systems) which give
them abilities beyond what is afforded.
How do robots collect data and whom and what do they
share with? What about passersby, where there is a sense
of passive collection of personal data? Environment the
robots are in, what about that? There are many consider-
ations to made regarding robots as a monitoring system.
The existing factors were derived from a survey of the
robotics and monitoring literature, and the areas that they
intersect. This survey was consciously restricted to these
areas so as to not dilute. The list of influential factors is
unlikely to be exhaustive and is expected to change; hence,
one direction is to look to other relevant areas such as
interactions with autonomous and expert systems. It will
expand and develop as progress is made.
The final area is to understand and examine how, and if
progress is made in this area of interest. One proposition is
the development of an online repository along the lines of
the matrix outlined in this paper. This would allow
researchers to identify areas they might contribute towards
and to also keep track of where other contributions. A form
of evaluating the advancement of this area might then be to
observe progress within such a repository.T a
b le
1 c o
n ti
n u
e d
N o
. R
e se
a rc
h li
te ra
tu re
N o
. R
e se
a rc
h li
te ra
tu re
N o
. R
e se
a rc
h li
te ra
tu re
N o
. R
e se
a rc
h li
te ra
tu re
1 7
. H
ir o
i a n
d It
o (2
0 0
8 );
W a lt
e rs
e t
a l.
(2 0
0 9
a )
4 0
. S
c h
e rm
e rh
o rn
e t
a l.
(2 0
0 8
) 6
3 .
H e e ri
n k
e t
a l.
(2 0
0 8
b ,
2 0
0 9
b ,
2 0
1 0
b )
1 8
. D
a u
te n
h a h
n e t
a l.
(2 0
0 6 )
4 1
. G
o e tz
e t
a l.
(2 0
0 3
); M
e e rb
e e k
e t
a l.
(2 0
0 6
);
S c h
e rm
e rh
o rn
e t
a l.
(2 0
0 8
); S
e v
e ri
n so
n -E
k lu
n d
h e t
a l.
(2 0
0 3
); W
a lt
e rs
e t
a l.
(2 0
0 8
a )
6 4
H e e ri
n k
e t
a l.
(2 0
0 9
b ,
2 0
1 0
b )
1 9
. H
ir o
i a n
d It
o (2
0 0
8 );
K a n
d a
e t
a l.
(2 0
0 2
); S
y rd
a l
e t
a l.
(2 0
0 8 )
4 2
. A
u st
e rm
a n
n e t
a l.
(2 0
1 0
); B
a rt
n e c k
e t
a l.
(2 0
0 8
);
B a rt
n e c k
e t
a l.
(2 0
0 9
a );
D a u
te n
h a h
n (2
0 0
2 ,
2 0
0 4
);
G o
e tz
e t
a l.
(2 0
0 3
); W
a lt
e rs
e t
a l.
(2 0
0 7
)
6 5
. B
lo w
e t
a l.
(2 0
0 6
b )
2 0
. D
a u
te n
h a h
n (2
0 0
7 );
K o
a y
e t
a l.
(2 0
0 6
); P
a c c h
ie ro
tt i
e t
a l.
(2 0
0 6 )
4 3
. S
c h
e rm
e rh
o rn
e t
a l.
(2 0
0 8
); T
a m
a g
a w
a e t
a l.
(2 0
1 1 )
6 6
. B
lo w
e t
a l.
(2 0
0 6
b )
2 1
. K
id d
a n
d B
re a z e a l
(2 0
0 4
); Y
o u
n g
e t
a l.
(2 0
0 9
) 4
4 .
G o
e tz
e t
a l.
(2 0
0 3
); L
o h
se (2
0 0
9 )a
6 7
. B
lo w
e t
a l.
(2 0
0 6
b );
D a u
te n
h a h
n (2
0 0
7 )
2 2
. B
a rt
n e c k
e t
a l.
(2 0
0 9
a );
D iS
a lv
o e t
a l.
(2 0
0 2
),
S a b
a n
o v
ic e t
a l.
(2 0
0 6
)
4 5
. A
u st
e rm
a n
n e t
a l.
(2 0
1 0
) 6
8 .
B lo
w e t
a l.
(2 0
0 6
b );
D a u
te n
h a h
n (2
0 0
7 )
2 3
. K
im e t
a l.
(2 0
1 1
); W
o o
d s
e t
a l.
(2 0
0 5
b )
4 6
. S
y rd
a l
e t
a l.
(2 0
0 8
) 6
9 .
D a u
te n
h a h
n e t
a l.
(2 0
0 6 );
N o
m u
ra
e t
a l.
(2 0
0 7
)
AI & Soc (2015) 30:1–21 17
123
8 Conclusions
Humanoid robotics is a branch of robotics which explores
issues related to the development and user experience of
robots with a humanlike appearance and structure.
Research has been conducted which explores how the
characteristics of such a robot influence behaviour, but
remains disjointed, with insufficient research exploring the
monitoring aspects of the technology. The aim of this paper
was to identify the most salient behaviour influencing
factors related to humanoid robots and explore the issues of
robot as monitoring devices. The factors in the PSA-BI
model were used as a coding scheme during a literature
review, in order to demonstrate their relevance to robotics.
This paper successfully identified a series of the salient and
recurring behavioural factors related to humanoid robots
and behaviour and their inter-relationships. In addition, the
factors by Moran and Nakata proved highly relevant to
HRI. The PSA matrix was produced which is a represen-
tation of the research literature, highlighting areas of cur-
rent development and gaps in the literature, and
demonstrates the applicability of Moran and Nakata’s
factors.
Acknowledgments This work was supported by a Japanese Society for the Promotion of Science (JSPS) short-term fellowship and EP-
SRC Grant EP/I011587/1.
References
Austermann A, Yamada S, Funakoshi K, Nakano M (2010) Does the
appearance of a robot affect users’ ways of giving commands
and feedback? In: RO-MAN (ed) IEEE, 13–15 Sept 2010,
pp 234–239
Bainbridge WA, Hart J, Kim ES, Scassellati B (2008) The effect of
presence on human-robot interaction. In: Proceedings of the 17th
IEEE international symposium on robot and human interactive
communication (ROMAN). pp 701–706
Bartneck C (2008) Who like androids more: Japanese or US
Americans? In: Proceedings of the 17th IEEE international
symposium on robot and human interactive communication
(ROMAN). pp 553–557
Bartneck C, Kanda T, Ishiguro H, Hagita N (2007) Is the uncanny
valley an uncanny cliff? In: Proceedings of the 16th IEEE
international symposium on robot and human interactive com-
munication (ROMAN), 26–29 Aug 2007, pp 368–373
Bartneck C, Croft E, Kulic D (2008) Measuring the anthropomor-
phism, animacy, likeability, perceived intelligence and perceived
safety of robots. In: Proceedings of the metrics for human-robot
interaction workshop in affiliation with the 3rd ACM/IEEE
international conference on human-robot interaction (HRI 2008).
pp 37–44
Bartneck C, Kanda T, Ishiguro H, Hagita N (2009a) My robotic
doppelganger—a critical look at the Uncanny Valley. In:
Proceedings of the 18th IEEE international symposium on robot
and human interactive communication (ROMAN), 27 Sept
2009–2 Oct 2009, pp 269–276
Bartneck C, Kanda T, Mubin O, Al Mahmud A (2009b) Does the
design of a robot influence its animacy and perceived intelli-
gence? Int J Soc Robot 1(2):195–204
Beckwith R (2003) Designing for ubiquity: the perception of privacy. In:
Pervasive computing, IEEE vol 2, no 2, pp 40–46
Beer JM, Prakash A, Mitzner TL, Rogers WA (2011) Understanding
robot acceptance. Technical report HFA-TR-1103. Georgia
Institute of Technology. Human Factors and Aging Laboratory
Blow M, Dautenhahn K, Appleby A, Nehaniv CL, Lee D (2006a) The
art of designing robot faces: dimensions for human-robot
interaction. In: proceedings of the 1st ACM SIGCHI/SIGART
conference on human-robot interaction, Salt Lake City, Utah,
USA. ACM, pp 331–332
Blow M, Dautenhahn K, Appleby A, Nehaniv CL, Lee DC (2006b)
Perception of robot smiles and dimensions for human-robot
interaction design. In: proceedings of the 15th IEEE international
symposium on robot and human interactive communication
(ROMAN), 6–8 Sept 2006, pp 469–474
Bohn Ju, Langheinrich M, Mattern F, Rohs M (2007) Living in a
world of smart everyday objects—social, economic and ethical
implications. Hum Ecol Risk Assess 10(5):763–785
Broadbent E, MacDonald B, Jago L, Juergens M, Mazharullah O
(2007) Human reactions to good and bad robots. In: Proceedings
of IEEE/RSJ international conference on intelligent robots and
systems (IROS) 2007. 19 Oct 2007–2 Nov 2007. IEEE,
pp 3703–3708
Broadbent E, Stafford R, MacDonald B (2009) Acceptance of
healthcare robots for the older population: review and future
directions. Int J Soc Robot 1(4):319–330
Dautenhahn K (1999) Robots as social actors: aurora and the case of
autism. In: Proceedings of the third cognitive technology
conference, San Francisco. p 374
Dautenhahn K (2002) Design spaces and niche spaces of believable
social robots. In: Proceedings of the 11th IEEE international
workshop on robot and human interactive communication
(ROMAN). IEEE, pp 192–197
Dautenhahn K (2004) Robots we like to live with?! - a developmental
perspective on a personalized, life-long robot companion. In:
Proceedings of the 13th IEEE international workshop on robot
and human interactive communication (ROMAN). IEEE,
pp 17–22
Dautenhahn K (2007) Socially intelligent robots: dimensions of
human-robot interaction. Philos Trans Roy Soc B: Biol Sci
362(1480):679–704
Dautenhahn K, Woods S, Kaouri C, Walters ML, Kheng Lee K,
Werry I (2005) What is a robot companion—friend, assistant or
butler? In: Proceedings of the IEEE/RSJ international conference
on intelligent robots and systems (IROS) 2–6 Aug 2005. IEEE/
RSJ, pp 1192–1197
Dautenhahn K, Walters M, Woods S, Koay KL, Nehaniv CL, Sisbot
A, Alami R, Simon T (2006) How may I serve you?: a robot
companion approaching a seated person in a helping context. In:
Proceedings of the 1st ACM SIGCHI/SIGART conference on
human-robot interaction, Salt Lake City, Utah, USA. ACM,
pp 172–179
Desai M, Stubbs K, Steinfeld A, Yanco H (2009) Creating trustworthy
robots: lessons and inspirations from automated systems. Paper
presented at the artificial intelligence and simulation of behav-
iour convention: New Frontiers in Human-Robot Interaction
(AISB)
DiSalvo CF, Gemperle F, Forlizzi J, Kiesler S (2002) All robots are
not created equal: the design and perception of humanoid robot
heads. In: Proceedings of the 4th symposium on designing
interactive systems: processes, practices, methods, and tech-
niques, London, England. ACM, pp 321–326
18 AI & Soc (2015) 30:1–21
123
Dragone M, Holz T, Sassu A, O’Hare GMP (2010) Evaluating social
& ubiquitous human-robot interaction. In: Proceedings of the 7th
international conference on ubiquitous robots and ambient
intelligence (URAI 2010), Busan, Korea
Drury JL, Scholtz J, Yanco HA (2003) Awareness in human-robot
interactions. In: Proceedings of the IEEE international confer-
ence on systems, man and cybernetics. IEEE, pp 912–918
Dryer DC, Eisbach C, Ark WS (1999) At what cost pervasive? A
social computing view of mobile computing systems. IBM Syst J
38(4):652–676
Enz S, Diruf M, Spielhagen C, Zoll C, Vargas P (2011) The social
role of robots in the future—explorative measurement of hopes
and fears. Int J Soc Robot 3(3):263–271
Fong T, Nourbakhsh I, Dautenhahn K (2003) A survey of socially
interactive robots. Robot Auton Syst 42:143–166
Fussell SR, Kiesler S, Setlock LD, Yew V (2008) How people
anthropomorphize robots. In: Proceedings of the 3rd ACM/IEEE
international conference on human robot interaction, Amster-
dam, The Netherlands. ACM, pp 145–152
Gibson JJ (1977) The theory of affordances. In: Shaw R, Bransford J
(eds) Perceiving, acting, and knowing. ISBN 0-470-99014-7
Glas DF, Kanda T, Ishiguro H, Hagita N (2009) Simultaneous people
tracking and localization for social robots using external laser
range finders. In: Proceedings of the 2009 IEEE/RSJ interna-
tional conference on intelligent robots and systems (IROS), St.
Louis, MO, USA. IEEE Press, pp 846–853
Goetz J, Kiesler S, Powers A (2003) Matching robot appearance and
behavior to tasks to improve human-robot cooperation. In:
Proceedings of the 12th IEEE international workshop on robot
and human interactive communication (ROMAN), 31 Oct–2 Nov
2003, pp 55–60
Heerink M, Kröse B, Evers V, Wielinga B (2006) The influence of a
robot’s social abilities on acceptance by elderly users. In:
Proceedings of the 15th IEEE international symposium on
robot and human interactive communication (ROMAN).
pp 521–526
Heerink M, Kröse B, Evers V, Wielinga B (2008a) The influence of
perceived adaptiveness of a social agent on acceptance by
elderly users. In: Proceedings of the 6th international conference
of the international society for gerontechnology (ISG). pp 57–61
Heerink M, Kröse B, Wielinga BJ, Evers V (2008b) The influence of
social presence on acceptance of a companion robot by older
people. J Phys Agents 2(2):33–40
Heerink M, Kröse B, Evers V, Wielinga B (2009a) Influence of social
presence on acceptance of an assistive social robot and screen
agent by elderly users. Adv Robot 23(14):1909–1923
Heerink M, Kröse B, Evers V, Wielinga B (2009b) Measuring
acceptance of an assistive social robot: a suggested toolkit. In:
Proceedings of the 18th IEEE international symposium on robot
and human interactive communication (ROMAN), 27 Sept–2
Oct 2009, pp 528–533
Heerink M, Kröse B, Evers V, Wielinga B (2010a) Assessing
acceptance of assistive social agent technology by older adults:
the almere model. Int J Soc Robot 2(4):361–375
Heerink M, Kröse B, Evers V, Wielinga B (2010b) Relating
conversational expressiveness to social presence and acceptance
of an assistive social robot. Virtual Real 14(1):77–84
Hegel F, Lohse M, Wrede B (2009) Effects of visual appearance on
the attribution of applications in social robotics. In: Proceedings
of The 18th IEEE international symposium on robot and human
interactive communication (ROMAN), 27 Sept–2 Oct 2009,
pp 64–71
Hiroi Y, Ito A (2008) Are bigger robots scary? The relationship
between robot size and psychological threat. In: Proceedings of
the IEEE/ASME international conference on advanced intelli-
gent mechatronics, 2–5 July 2008. IEEE, pp 546–551
Jonsson K (2006) The embedded panopticon: visibility issues of
remote diagnostics surveillance. Scand J Inform Syst 18(2):7–28
Kahn PH, Ishiguro H, Friedman B, Kanda T (2006) What is a
Human? - toward psychological benchmarks in the field of
human-robot interaction. In: Proceedings of the 15th IEEE
international symposium on robot and human interactive com-
munication (ROMAN). pp 364–371
Kanda T, Ishiguro H, Ono T, Imai M, Nakatsu R (2002) Development
and evaluation of an interactive humanoid robot ‘‘Robovie’’. In:
Proceedings of the IEEE international conference on robotics
and automation (ICRA). IEEE, pp 1848–1855
Kanda T, Hirano T, Eaton D, Ishiguro H (2004) Interactive robots as
social partners and peer tutors for children: a field trial. Hum
Comput Interact 19(1):61–84
Kanda T, Miyashita T, Osada T, Haikawa Y, Ishiguro H (2008)
Analysis of humanoid appearances in human–robot interaction.
IEEE Trans Robot 24(3):725–735
Kidd CD, Breazeal C (2004) Effect of a robot on user perceptions. In:
Proceedings of the international conference on intelligent robots
and systems (IROS). IEEE, pp 3559–3564
Kidd CD, Breazeal C (2005) Sociable robot systems for real-world
problems. In: Proceedings of the IEEE international workshop
on robot and human interactive communication (ROMAN),
13–15 Aug 2005. pp 353–358
Kim Y, Kwak S, Kim M-s (2011) The impact of robots language form on
people’s perception of robots In: Kurosu M (ed) Human centered
design, vol 6776. Lecture Notes in Computer Science. Springer,
Berlin/Heidelberg, pp 253–261
Klamer T, Ben Allouch S (2010) Acceptance and use of a social robot
by elderly users in a domestic environment. In: Proceedings of
the 4th international conference on pervasive computing tech-
nologies for healthcare (PervasiveHealth), 22–25 March 2010.
IEEE, pp 1–8
Koay KL, Dautenhahn K, Woods SN, Walters ML (2006) Empirical results from using a comfort level device in human-robot
interaction studies. In: Proceedings of the 1st ACM SIGCHI/
SIGART conference on human-robot interaction, Salt Lake City,
Utah, USA. ACM, pp 194–201
Koide Y, Kanda T, Sumi Y, Kogure K, Ishiguro H (2004) An
approach to integrating an interactive guide robot with ubiqui-
tous sensors. In: Proceedings of IEEE/RSJ international confer-
ence on intelligent robots and systems (IROS), 28 Sept–2 Oct
2004. pp 2500–2505
Kuo IH, Rabindran JM, Broadbent E, Lee YI, Kerse N, Stafford
RMQ, MacDonald BA (2009) Age and gender factors in user
acceptance of healthcare robots. In: Proceedings of the 18th
IEEE international symposium on robot and human interactive
communication (ROMAN), 27 Sept–Oct 2 2009. pp 214–219
Larson JR, Callahan C (1990) Performance monitoring: how it affects
work productivity. J Appl Psychol 75(5):530–538
Lee E-J (2010) The more humanlike, the better? How speech type and
users’ cognitive style affect social responses to computers.
Comput Hum Behav 26(4):665–672
Lee KM, Nass C (2003) Designing social presence of social actors in
human computer interaction. In: Proceedings of the SIGCHI
conference on human factors in computing systems (CHI), Ft.
Lauderdale, Florida, USA. ACM 289–296
Lee MK, Tang KP, Forlizzi J, Kiesler S (2011) Understanding users’
perception of privacy in human-robot interaction. In: Proceed-
ings of the 6th international conference on human-robot
interaction, Lausanne, Switzerland. IEEE, pp 181–182
Leite I, Martinho C, Pereira A, Paiva A (2009) As time goes by: long-
term evaluation of social presence in robotic companions. In:
Proceedings of the 18th IEEE international symposium on robot
and human interactive communication (ROMAN), 27 Sept–2
Oct 2009. pp 669–674
AI & Soc (2015) 30:1–21 19
123
Li D, Rau P, Li Y (2010) A cross-cultural study: effect of robot
appearance and task. Int J Soc Robot 2(2):175–186
Lohse M (2009) The role of expectations in HRI. In: Proceedings of
new frontiers in human-robot interaction
Looije R, Cnossen F, Neerinex MA (2006) Incorporating guidelines
for health assistance into a socially intelligent robot. In:
Proceedings of the 15th IEEE international symposium on robot
and human interactive communication (ROMAN), 6–8 Sept
2006. IEEE, pp 515–520
Lyytinen K, Yoo Y, Varshney U, Ackrman MS, Davis G, Avital M,
Robey D, Sawyer S, Sorenson C (2004) Surfing the next wave:
design and implementation challenges of ubiquitous computing
environments. Commun Assoc Inform Syst 13:697–716
Mancini C, Jedrzejczyk L, Thomas K, Price BA, Bandara AK, Rogers
Y, Joinson AN, Nuseibeh B (2010) Predators and prey:
ubiquitous tracking, privacy and the social contract, vol 13.
Department of Computing Faculty of Mathematics, Computing
and Technology The Open University, Milton Keynes
Marx GT (2001) Murky conceptual waters: the public and the private.
Ethics Inf Technol 3(3):157–169
Meerbeek B, Hoonhout J, Bingley P, Terken J (2006) Investigating
the relationship between the personality of a robotic TV assistant
and the level of user control. In: Proceedings of the 15th IEEE
international symposium on robot and human interactive com-
munication (ROMAN). IEEE, pp 404–410
Meerbeek B, Hoonhout J, Bingley P, Terken J (2008) The influence of
robot personality on perceived and preferred level of user
control. In: Dautenhahn K (ed) Human and robot interactive
communication, pp 204–229
Melenhorst AS, Fisk AD, Mynatt ED, Rogers WA (2004) Potential
intrusiveness of aware home technology: perceptions of older
adults. In: Proceedings of the human factors and ergonomics society
annual meeting, New Orleans, Louisiana, USA, 20–24 Sept 2004.
SAGE Publications, pp 266–270
Michalowski MP, Sabanovic S, Simmons R (2006) A spatial model of
engagement for a social robot. In: Proceedings of the 9th IEEE
international advanced motion control. IEEE, pp 762–767
Minato T, Shimada M, Ishiguro H, Itakura S (2004) Development of an
android robot for studying human-robot interaction. In: Proceedings
of the 17th international conference on Innovations in applied
artificial intelligence, Ottawa, Canada. Springer, pp 424–434
Moran S, Nakata K (2010) Analysing the factors affecting users in
intelligent pervasive spaces. In: Intelligent Buildings Interna-
tional: Special Issue on Intelligent Pervasive Spaces for Working
and Living, vol 2, no 1. pp 57–71
Mori M (1970) Bukimi no tani [the uncanny valley] (Originally in
Japanese, K. F. MacDorman & T. Minato, Trans.). Energy
7(4):33–35
Nakauchi Y, Simmons R (2002) A social robot that stands in line.
Auton Robots 12(3):313–324
Nguyen DH, Mynatt ED (2002) Privacy mirrors: understanding and
shaping socio-technical ubiquitous computing systems. Techni-
cal report GIT-GVU-02-16. Georgia Institute of Technology
Nguyen DH, Kobsa A, Hayes GR (2008) An empirical investigation
of concerns of everyday tracking and recording technologies. In:
Proceedings of the 10th international conference on ubiquitous
computing, Seoul, Korea. ACM, pp 182–191
Nohara K, Tajika T, Shiomi M, Kanda T, Ishiguro H, Hagita N (2008)
Integrating passive RFID tag and person tracking for social
interaction in daily life. In: Proceedings of the 17th IEEE
international symposium on robot and human interactive com-
munication (ROMAN), 1–3 Aug 2008. pp 545–552
Nomura T, Kanda T (2003) On proposing the concept of robot anxiety
and considering measurement of it. In: Proceedings of the 12th
IEEE international workshop on robot and human interactive
communication (ROMAN), 31 Oct–2 Nov 2003. pp 373–378
Nomura T, Kanda T, Suzuki T, Kato K (2005) People’s assumptions
about robots: investigation of their relationships with attitudes
and emotions toward robots. In: Proceedings of the IEEE
international workshop on robot and human interactive commu-
nication (ROMAN). pp 125–130
Nomura T, Kanda T, Suzuki T (2006) Experimental investigation into
influence of negative attitudes toward robots on human robot
interaction. AI Soc 20(2):138–150
Nomura T, Shintani T, Fujii K, Hokabe K (2007) Experimental
investigation of relationships between anxiety, negative atti-
tudes, and allowable distance of robots. In: Proceedings of the
2nd IASTED international conference on human computer
interaction, Chamonix, France. ACTA Press, pp 13–18
Nomura T, Kanda T, Suzuki T, Kato K (2008) Prediction of human
behavior in human–robot interaction using psychological scales
for anxiety and negative attitudes toward robots. IEEE Trans
Robot 24(2):442–451
Norman DA (1988) The psychology of everyday things. Basic Books,
New York
Pacchierotti E, Christensen HI, Jensfelt P (2006) Evaluation of
passing distance for social robots. In: Proceedings of the 15th
IEEE international symposium on robot and human interactive
communication, 6–8 Sept 2006. IEEE, pp 315–320
Powers A, Kiesler S (2006) The advisor robot: tracing people’s
mental model from a robot’s physical attributes. In: Proceedings
of the 1st ACM SIGCHI/SIGART conference on human-robot
interaction, Salt Lake City, Utah, USA. ACM, pp 218–225
Powers A, Kramer ADI, Lim S, Kuo J, Sau-lai L, Kiesler S (2005)
Eliciting information from people with a gendered humanoid
robot. In: Proceedings of the IEEE international workshop on
robot and human interactive communication (ROMAN), 13–15
Aug 2005. pp 158–163
Punie Y (2003) A social and technological view of ambient intelligence
in everyday life: what bends the trend? Key deliverable work
package 2, in technical report to the European Media, Technology
and everyday life research network, (EMTEL2). Institute for
Prospective Technological Studies, Seville, Spain
Riek LD, Rabinowitch T-C, Chakrabarti B, Robinson P (2009) How
anthropomorphism affects empathy toward robots. In: Proceed-
ings of the 4th ACM/IEEE international conference on human
robot interaction, La Jolla, California, USA. ACM, pp 245–246
Rosenthal R, Jacobson L (1968) Pygmalion in the classroom: teacher
expectation and pupils’ intellectual development. Irvington
publishers, New York
Sabanovic S, Michalowski MP, Simmons R (2006) Robots in the
wild: observing human-robot social interaction outside the lab.
Paper presented at the 9th IEEE international workshop on
advanced motion control. IEEE, pp 596–601
Salvini P, Laschi C, Dario P (2010) Design for acceptability:
improving robots’ coexistence in human society. Int J Soc Robot
2(4):451–460
Schermerhorn P, Scheutz M, Crowell CR (2008) Robot social
presence and gender: do females view robots differently than
males? In: Proceedings of the 3rd ACM/IEEE international
conference on human robot interaction, Amsterdam, The Neth-
erlands. ACM, pp 263–270
Scholtz J, Consolvo S (2004) Toward a framework for evaluating
ubiquitous computing applications. IEEE Pervasive Comput
3(2):82–88
Severinson-Eklundh K, Green A, Hüttenrauch H (2003) Social and
collaborative aspects of interaction with a service robot. Robot Auton
Syst 42(3–4):223–234
Siegel M, Breazeal C, Norton MI (2009) Persuasive robotics: the
influence of robot gender on human behavior. In: Proceedings of
IEEE/RSJ international conference on intelligent robots and
systems, St. Louis, MO. pp 2563–2568
20 AI & Soc (2015) 30:1–21
123
Spiekermann S (2008) User control in ubiquitous computing: design
alternatives and user acceptance. Shaker, Aachen
Stanton JM (2000) Reactions to employee performance monitoring:
framework, review and research directions. Hum Perform
13(1):85–113
Sung J, Christensen HI, Grinter RE (2009) Robots in the wild:
understanding long-term use. In: Proceedings of the 4th ACM/
IEEE international conference on human robot interaction, La
Jolla, California, USA. ACM, pp 45–52
Syrdal DS, Dautenhahn K, Woods S, Walters ML, Kheng Lee K
(2006) ‘Doing the right thing wrong’—personality and tolerance
to uncomfortable robot approaches. In: Proceedings of the 15th
IEEE international symposium on robot and human interactive
communication (ROMAN), 6–8 Sept 2006, pp 183–188
Syrdal DS, Dautenhahn K, Woods S, Walters M, Koay KL (2007a)
Looking good? Appearance preferences and robot personality
inferences at zero acquaintance. In: Proceedings of the AAAI
spring symposium on multidisciplinary collaboration for socially
assistive robotics
Syrdal DS, Walters ML, Otero N, Koay KL, Dautenhahn K (2007b)
‘‘He knows when you are sleeping’’—Privacy and the personal
robot companion. In: Proceedings of the workshop on human
implications of human-robot interaction, in conjunction with the
association of the advancement of aritificial intelligence, Van-
couver, British Columbia, Canada. AAAI Press, pp 28–33
Syrdal DS, Dautenhahn K, Walters ML, Koay KL (2008) Spaces with
robots in a home scenario—anthropomorphic attributions and
their effects on proxemic expectations and evaluations in a live
HRI trial. In: Proceedings of the AAAI fall symposium on AI in
Eldercare: New Solutiosn to old Problems, 7–9 Nov 2008
Takayama L, Pantofaru C (2009) Influences on proxemic behaviors in
human-robot interaction. In: Proceedings of the 2009 IEEE/RSJ
international conference on intelligent robots and systems
(IROS), St. Louis, MO, USA. IEEE Press, pp 5495–5502
Tamagawa R, Watson C, Kuo I, MacDonald B, Broadbent E (2011)
The effects of synthesized voice accents on user perceptions of
robots. Int J Soc Robot 3(3):253–262
Theofanos M, Scholtz J (2005) A framework for evaluation of
ubicomp applications. In: Proceedings of the first international
workshop on social implications of Ubiquitous computing, CHI,
Portland, OR, USA. pp 1–5
Torrey C, Powers A, Marge M, Fussell SR, Kiesler S (2006) Effects
of adaptive robot dialogue on information exchange and social
relations. In: Proceedings of the 1st ACM SIGCHI/SIGART
conference on human-robot interaction, Salt Lake City, Utah,
USA. ACM, 126–133
Vallejo ILD, Hailes S, Conroy-Dalton R, Penn A (2008) Location
tracking in an office environment: the nationwide case study. In:
Yan L, Zhang Y, Yang LT, Zhang HN (eds) The internet of
things: from RFID to the next-generation pervasive networked
system. Auerbach Publications, pp 233–255
Vargas PA, Ho WC, Lim M, Enz S, Aylett R (2009) Forget or not to
forget: towards a roboethical memory control. In: Proceedings of
the AISB, Killer robots or friendly fridges: the social under-
standing of artificial intelligence, Endinburgh, UK. pp 18–23
Velonaki M (2010) Engagement, trust, intimacy: touch sensing for
human-robot interaction. Second Nat Int J Creative Media
2(1):102
Walters M, Dautenhahn K, Koay K, Kaouri C, Woods S, Nehaniv C,
Lee D, Werry I, Te Boekhorst R (2005) The influence of
subjects’ personality traits on personal spatial zones in a human-
robot interaction experiment. In: Proceedings of the IEEE
international workshop on robot and human interactive commu-
nication (ROMAN). pp 347–352
Walters ML, Dautenhahn K, Te Boekhorst R, Koay KL, Woods SN
(2007) Exploring the design space of robot appearance and
behavior in an attention-seeking ‘living room’ scenario for a
robot companion. In: Proceedings of the IEEE symposium on
artificial life (ALIFE), 1–5 April 2007, pp 341–347
Walters M, Syrdal D, Dautenhahn K, te Boekhorst R, Koay K (2008a)
Avoiding the uncanny valley: robot appearance, personality and
consistency of behavior in an attention-seeking home scenario
for a robot companion. Auton Robots 24(2):159–178
Walters ML, Syrdal DS, Koay KL, Dautenhahn K, te Boekhorst R
(2008b) Human approach distances to a mechanical-looking
robot with different robot voice styles. In: Proceedings of the
17th IEEE international symposium on robot and human
Interactive communication (ROMAN), 1–3 Aug 2008. IEEE,
pp 707–712
Walters ML, Dautenhahn K, Boekhorst RT, Koay KL, Syrdal DS,
Nehaniv CL (2009a) An empirical framework for human-robot
proxemics. In: Proceedings of the new frontiers in human-robot
interaction, Edinburgh. pp 144–149
Walters ML, Koay KL, Syrdal DS, Dautenhahn K, te Boekhorst R
(2009b) Preferences and perceptions of robot appearance and
embodiment in human-robot interaction trials. In: Proceedings of
new frontiers in human-robot interaction, Edinburgh, Scotland
Weiss A, Bernhaupt R, Tscheligi M, Yoshida E (2009) Addressing
user experience and societal impact in a user study with a
humanoid robot. In: Proceedings of the symposium on new
frontiers in human-robot interaction, 8–9 Apr 2009. pp 150–157
Wickstrom G, Bendix T (2000) The ‘‘Hawthorne effect’’—what did
the original Hawthorne studies actually show? Scand J Work
Environ Health 26(4):363–367
Woods S, Dautenhahn K, Kaouri C (2005a) Is someone watching me?
- Consideration of social facilitation effects in human-robot
interaction Experiments. In: Proceedings of the IEEE interna-
tional symposium on computational intelligence in robotics and
automation (CIRA). pp 53–60
Woods S, Dautenhahn K, Schulz J (2005b) The design space of
robots: investigating children’s views. In: Proceedings of the
13th IEEE international workshop on robot and human interac-
tive communication (ROMAN). pp 47–52
Yanco HA, Drury J (2004) Classifying human-robot interaction: an
updated taxonomy. In: Proceedings of the IEEE international
conference on systems, man and cybernetics. pp 2841–2846
Young J, Hawkins R, Sharlin E, Igarashi T (2009) Toward acceptable
domestic robots: applying insights from social psychology. Int J
Soc Robot 1(1):95–108
Zhang T, Kaber D, Zhu B, Swangnetr M, Mosaly P, Hodge L (2010)
Service robot feature design effects on user perceptions and
emotional responses. Intel Serv Robot 3(2):73–88
Zia-ul-Haque QSM, Wang Z, Jadoon NR (2007) Importance of appear-
ance, behaviour and personal features in social robots. Is there really
any uncanny valley? Lect Notes Eng Comput Sci 1:524–529
Zweig D (2005) Beyond privacy and fairness concerns: examining
psychological boundary violations as a consequence of elec-
tronic performance monitoring. In: Weckert J (ed) Electronic
monitoring in the workplace: controversies and solutions. Idea
Group Publishing, Hershey, pp 101–122
Zweig D, Webster J (2002) Where is the line between benign and
invasive? An examination of psychological barriers to the
acceptance of awareness monitoring systems. J Organ Behav
23(5):605–633
Zweig D, Webster J (2003) Personality as a moderator of monitoring
acceptance. Comput Hum Behav 19(4):479–493
AI & Soc (2015) 30:1–21 21
123
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
- c.146_2013_Article_515.pdf
- User perceptions of anthropomorphic robots as monitoring devices
- Abstract
- Introduction
- Background
- Anthropomorphic robots
- Data collection
- Monitoring attributes
- Privacy and invasiveness
- Border crossings
- Frequency of data collection and border crossings
- Robot obtrusion (physical presence)
- Perceived privacy invasion
- Coverage and data integration
- Control
- Robot control
- Data and application control
- User understanding
- Informedness and assumptions
- Affordance
- Ownership/trust
- Perceived ownership
- Perceived trustworthiness
- Anthropomorphic attributes
- Intelligence, autonomy and adaptability
- Intelligence
- Autonomy
- Adaptability
- Anthropomorphism
- Anthropomorphic form
- Personality
- Robot expression
- Social presence
- Mobility
- Behaviour
- User-centred
- Enjoyment
- Ease of engagement
- Anxiety
- Safety
- Perceptions of system attributes matrix
- Contributions
- Future work
- Conclusions
- Acknowledgments
- References
Sources/USER'S ADOPTION OF FREE THIRD-PARTY SECURITY APPS.pdf
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
USER'S ADOPTION OF FREE THIRD-PARTY SECURITY APPS Han, Bo;Wu, Yu "Andy";Windsor, John The Journal of Computer Information Systems; Spring 2014; 54, 3; Computing Database pg. 77
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Sources/VIABILITY OF FEE-BASED EMAIL SERVICE FOR RETAIL CUSTOMERS.pdf
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
VIABILITY OF FEE-BASED EMAIL SERVICE FOR RETAIL CUSTOMERS Ghosh, Kaushik;Dhumal, Parag;Chawla, Sudhir The Journal of Computer Information Systems; Fall 2011; 52, 1; Computing Database pg. 56
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.
Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.