Literature Review

profileDonTheTutor
sources.zip

Sources/A Conceptual Model of Security Context.pdf

Int. J. Inf. Secur. (2014) 13:571–581 DOI 10.1007/s10207-014-0229-x

R E G U L A R C O N T R I B U T I O N

A conceptual model of security context

Vladimir Jovanovikj · Dušan Gabrijelčič · Tomaž Klobučar

Published online: 8 March 2014 © Springer-Verlag Berlin Heidelberg 2014

Abstract Ubiquitous environments which embrace the trends of enterprise mobility and the consumerization of IT have an increasing social importance. In these envi- ronments, the same device and applications are simultane- ously used for both personal and professional purposes. Such usage blurs the boundaries between personal and profes- sional domains and presents many challenges for information security. Context-aware security has been proposed as a solu- tion for many of them. We argue that the existing approaches are limited and mainly deal with targeted use cases. They do not provide a clear and complete understanding of the context relevant for security, and use contextual information with an arbitrary level of abstraction. In order to address these issues, we propose a conceptual model of security context. The model identifies important concepts of security context and takes related social aspects into account. It represents the security context through a set of concepts at the appropriate level of abstraction. We show that our model is suitable to analyze various situations from the perspective of security and compare them with the existing approaches. The model promises to facilitate the specification and management of security policies containing contextual information as well.

Keywords Security · Context · Ubiquitous computing

1 Introduction

Ubiquitous computing is an intelligent coalition of the physi- cal and virtual world, integrated for the purpose to assist peo- ple in their everyday life [60]. Contemporary mobile devices

V. Jovanovikj (B) · D. Gabrijelčič · T. Klobučar Laboratory for Open Systems and Networks, Jožef Stefan Institute, Jamova cesta 39, 1000 Ljubljana, Slovenia e-mail: [email protected]

are bringing us closer to this vision as a single device capa- ble of supporting multiple functionalities of it [52]. Indeed, it has been shown that a mobile device can facilitate the interaction between people and objects and helps the user to access ubiquitous services [44]. Today, people are already extensively using mobile devices for communication, edu- cation, and entertainment, and enterprises are incorporating them into their practices to increase the efficiency, effective- ness, and convenience of their business processes [7, 8]. As people became attached to their own mobile devices, they insist using them, together with their familiar services, in their professional life as well. Initial positive experiences in the form of lower costs and increased employee productivity and satisfaction have recently caused this to develop into a modern enterprise trend known as the consumerization of IT [15, 18, 29, 42].

The ubiquitous environments encompassing the trends of enterprise mobility and the consumerization of IT has an increasing social importance. It means a user-owned mobile device is used to perform both personal and professional activities, anywhere and anytime. Many of these activities are often performed simultaneously, usually with the same consumer-oriented applications, and this blurs the bound- aries between the domains of personal and professional life. As people increasingly work for more than one organization and in complex collaboration patterns [30], these environ- ments will span over many administrative domains. We refer to these environments as ubiquitous social systems.

Ubiquitous social systems present three main challenges for information security. First, the enforcement of corporate security policies becomes difficult because enterprises have less control over the devices and applications used in their business processes. Since employees are the owners of the devices, enterprises cannot demand they use the strongest security outside the enterprise domain and do not install

123

572 V. Jovanovikj et al.

various applications on their devices. Second, the protection of resources becomes complicated as users make increased interactions with their devices. These interactions are often ad hoc, unplanned and with possible leakages of implicit information due to the modern forms of communication [13, 45, 47]. Finally, the security provision should understand the trade-off between security, performance, and efficiency in order to better utilize the limited hardware resources of mobile devices and operate with minimal human involve- ment [28, 45, 50, 58].

Many researchers have proposed context-aware secu- rity provisioning as a possible solution to overcome the challenges of ubiquitous social systems. However, their approaches provide only limited solutions. They deal only with targeted use cases (e.g., smart spaces: home [16], work- place [3], or hospital [2, 17, 37], mobile workers [23, 34, 59], or network communication [6, 36]) and mainly provide a sin- gle security service (e.g., access control [2, 16, 17, 23, 34, 37, 59], authentication [25, 46], secure channel communication [36, 48], or identity management [24, 56]). The consequences from this are twofold.

First, the existing context-aware security approaches are not based on a clear and complete understanding of the con- text relevant to security. They usually consider it identical to the context in general (e.g., [2, 4, 16, 23, 27, 36, 37, 59]), although it arises from activities relevant to security and is thus specific to the security domain. At the same time, they rarely specify what contextual information they take into consideration. Because of the variety of possible con- textual information, it is difficult to understand what they are aware of and adapt to. In addition, the existing approaches (e.g., [2, 4, 16, 34, 36, 41, 54, 59]) utilize only part of the avail- able contextual information and omit important contextual information, for example the social context.

Second, the existing context-aware security approaches (e.g., [4, 6, 16, 34, 46]) adapt to an arbitrary level of abstrac- tion of contextual information. This can be cumbersome, error-prone and can jeopardize the validity of the security service. Since there is a vast amount of information which can be used as the context, researchers have pointed out that it is more sophisticated for context-aware systems to adapt to contextual information with a higher level of abstraction [10, 19, 61]. These information meaningfully interpret raw sensor data through the process of context reasoning. They better represent the human perception of reality and are more stable than sensor data which can be uncertain and change frequently.

As a solution for ubiquitous social systems, we envision a security system with the following capabilities. Such sys- tem should manage various security mechanisms in order to provide several security services (e.g., access control, data confidentiality and integrity, auditing). It should support dif- ferent levels of security and multiple security mechanisms

for a single security service. Moreover, it should adapt these security levels and mechanisms depending on the domain in which the mobile device is used, and the surroundings. Sev- eral tasks are challenging in the designing and developing of such a security system, and in this paper, we point out the specification of the context relevant for security. A concep- tual model of the security context is required as prerequisite for this task.

This paper addresses the above issues and helps towards a better understanding of the security context. We propose a definition and conceptual model of the security context. The model identifies important concepts of the security con- text, at different levels of abstraction. It introduces several concepts which take into account the socially related aspect. The model represents the security context as a set of con- cepts which we consider to be at the appropriate level of abstraction. We evaluate the flexibility and sufficiency of the model using two methods. First, we use the model to ana- lyze the diverse use cases of ubiquitous social systems. Then, we compare it with the existing approaches, especially with their understanding of the security context. In addition, we point out several gaps in the existing approaches that elicited from the comparison. Our model promises to facilitate the specification of the security context in context-aware secu- rity systems that are applicable for ubiquitous social systems as a whole.

The paper is structured as follows. First, we describe a motivation scenario to illustrate ubiquitous social systems, in Sect. 2. Next, in Sect. 3, we make an overview of related works defining and describing the security context. After- ward, we give our working definition of the security context in Sect. 4. Then, we present our conceptual model of the secu- rity context in Sect. 5. This is followed by a discussion about the applicability of the model and the security requirements of the security context in Sect. 6. We evaluate the model with two methods, and for one of them, we use the scenario from Sect. 2. Finally, we conclude the paper in Sect. 7.

2 Motivation scenario

We present a typical scenario for ubiquitous social systems. It concentrates mainly on activities performed within the pro- fessional domain, since they are the more attractive targets for attacks and thus more challenging for security. However, its translation to the personal and other domains is quite straight- forward. The scenario includes general and simple use cases originating from the area of enterprise mobility. Similar use cases have been described in several works [7, 26, 57] and encountered in common practice. The use cases are further enriched with the characteristics of the IT consumerization, which are a major influence for security. In addition, they take

123

A conceptual model of security context 573

into account the security guidelines for enterprise mobility as presented in standardized security documents [32].

The scenario centers around Alice, a researcher working for the ACME company. Alice is allowed to use her personal mobile device for professional purposes, as well as various consumer applications that she finds productive. She is sat- isfied with this—her favorite file manager and office appli- cations are on the company’s list of allowed applications. However, she feels work to be a bit more difficult without the help from her favorite intelligent personal assistant.

The ACME company requires relevant parts of its secu- rity policy to be implemented on Alice’s device, although it is aware that it does not have full control over the device. In particular, it is interested in using appropriate security mechanisms and having control over its resources that are accessed through the device. Mobile malware is on the rise lately, and applications routinely require extensive permis- sions during installation [38]. Therefore, the company wishes to limit certain functionalities of some applications, such as access to data, sensors, and networks, while completely for- bidding applications whose core functionality is a threat to its resources. For example, intelligent personal assistant appli- cations are forbidden because they send audio recordings to remote servers and can potentially leak confidential company conversations.

Alice is currently participating in several research projects, in which the company collaborates with other partner orga- nizations. For one of them, a meeting is scheduled during a larger conference event hosted by the company. Alice is supposed to present her work at this meeting. The rest of the scenario centers around that particular conference day.

Scene 1: At Alice’s home: Alice is making the final revi- sion of her slides for the presentation. She is using her favorite office app on her mobile device for this purpose. While edit- ing, Alice opens a personal document with the same app. The app should be allowed to only read this document, but not edit it. This prevents it from transferring company data into the personal document. Alice leaves her apartment, while both documents remain open. The presentation slides should be closed automatically.

Scene 2: Coffee break at the hall: Alice and her colleague Bob are reviewing the slides for the meeting on their mobile devices. Alice sends Bob the latest version of the slides over a wireless channel, with her favorite file manager app. Usu- ally, the transmission of unencrypted company documents between colleagues is allowed in company premises, as long as there are only company employees around. However, at that moment, many visitors to the event are present in the hall. Some of them may be from a competitive company, trying to capture an unencrypted communication between ACME employees. Therefore, a secure channel between Alice’s and Bob’s mobile device must be established prior to the trans- mission.

Scene 3: Project meeting at a conference room: Alice is about to present her slides to the project members, using her mobile device. She activates the slideshow from the office app, and this activates the transmission to the projector. As outside the conference room there are people who are not members of this project, a secure channel with the projector is established first. During the presentation, the janitor suddenly enters the conference room. Since he is not a project member, he is not allowed to see the confidential project data on the screen. Therefore, the presentation should be automatically terminated.

Scene 4: On the way home: Alice leaves the company’s premises. According to the company’s security policy, log- ging is mandatory during work. Since Alice has finished work, this should be turned off automatically. Also, all open company documents and intranet pages should be closed. Alice starts her intelligent personal assistant app and requests it to start playing her favorite song. While walking home, she receives a call from her colleague. Prior to taking the call, the assistant app should be terminated and the logging should be turned on again. In addition, Alice should be warned to be careful as she is making a confidential conversation in insecure environment and somebody might listen to it.

3 Related work

The notion of context has been widely discussed during the past years by many researchers from various disciplines, such as computer science, linguistics, and psychology [9]. Although their understanding of context strongly depends on their specific domains, some characteristics of context appear to be common. Context acts as a set of information that influences the behavior of a system, such as the sys- tem’s description, the system’s users, and the environment in which the system operates. However, it arises from activity and includes only those items that are relevant to the partic- ular activity at hand [1, 20].

Only a few works have explicitly defined security context. Johnson [35] combined acknowledged definitions of context and security, and defined the security context as any infor- mation that characterizes the situation of an entity and has security implications. As an entity, she considers the user, the user’s computing device, and the surrounding environment. Kouadri-Mostefaoui [41] defines the security context as a set of information from the user’s and application’s environ- ments that are relevant for the security process. She further describes it as the state of these environments requiring secu- rity interventions. In addition, Bandinelli et al. [6] are con- cerned only with contextual information which originates from the communication between entities and is useful for providing end-to-end security.

123

574 V. Jovanovikj et al.

Existing definitions of the security context are incom- plete and do not represent the full nature of the context. They specify only information about part of the relevant enti- ties, namely the user and the particular device that hosts the context-aware system. This is insufficient for ubiqui- tous social systems, for which contextual information about other surrounding entities (people and devices) need to be also taken into consideration. Moreover, current definitions describe only the static nature of the context, omitting the notion of activities which guide the creation of the security context.

Furthermore, a few works also tried to more precisely describe the security context with taxonomies. Johnson [35] classifies the security context along two dimensions—the rel- evant entity and the affected security objective—and provides simple guidelines to identify the relevant security context. Evesti and Pantsar-Syväniemi [22] define important concepts for the security context and classify them into three groups: (i) the situation context, which contains concepts describing the usage of applications, (ii) the digital context, which con- tains concepts describing the surrounding environment, and (iii) the physical context, which contains concepts describ- ing the execution platform. Cuppens and Cuppens-Boulahia [17] recognize several types of security context in their tax- onomy: the temporal, the spatial, the user-declared, which is related to the user’s intention, and the prerequisite and the provisional contexts, which are related to the preconditions and obligations of activities. In addition, Bandinelli et al. [6] divide the possible security context into several categories: user, device, communication, and application, depending on their origin.

Current taxonomies do not seem very helpful for con- text specification. Although their category types are related to important concepts of the security context, they are still mostly useful only to describe the security context. More- over, they rarely take into account the related social aspect. Only a few of them, [17, 22], try to use social concepts, such as the role of the user and environment and the objective of the user. However, this is done only arbitrarily, without any attempt to define these concepts in a consistent manner.

4 Definition of security context

Our definition of security context combines the notions of security and context. It is based on one of the widely accepted definitions of context given by Day et al. [1]. It further empha- sizes the dynamic nature of context and the role of activities. For clarity, we do not include any explicit definition of secu- rity in it. We refer to security as the protection of resources in order to attain the objectives of confidentiality, integrity, and availability [11, 55]. Our definition of the security context is given below.

Security context is a set of contextual information consid- ered relevant for the process of security, regarding a partic- ular task or activity.

Contextual information is any information that can be used to characterize the situation of an entity. An entity can be a person or a device, which can be seen as a composition of its resources.

Analogously to systems in general [14], security systems can utilize the security context in two ways. Systems that can only present information about the security situation of the resources of interest, depending on the current security context, can be referred to as passive context-aware security systems. On the other hand, systems that automatically adapt their behavior during runtime in accordance with the discov- ered security context, in order to provide a more relevant service, are called active context-aware security systems. In the rest of the paper, the usage of the term context-aware security systems refers to the active ones.

5 Conceptual model of security context

We propose a conceptual model of security context in order to define its notion more precisely. The conceptual model iden- tifies important concepts that constitute the security context and the relations between them (Fig. 1). Many of these con- cepts elicit directly from the motivation scenario in Sect. 2. For example, there are persons (e.g., Alice and Bob) who use devices (e.g., their mobile devices) and perform various

Fig. 1 Conceptual model of security context

123

A conceptual model of security context 575

activities (e.g., share work documents) which are more pre- cisely described with the persons’ intention, social relation, and surrounding environment (e.g., sharing work documents with a colleague at a public event while working). We sepa- rate the identified concepts into three layers: entity, activity, and situation (Fig. 1). Each of them has a different level of abstraction from the perspective of a context-aware system— concepts from a lower layer are used to derive concepts from a higher layer and thus need to be determined beforehand. In fact, this represents how a system becomes aware of the context in which it operates, through the process of context reasoning.

5.1 Entity

An entity performs an activity and thus is the subject whose situation needs to be characterized. Our model centers around two types of entities—a person and a device. A person is a human individual that operates with devices, whereas a device is an object with computing and communication capa- bilities. We denote the set of entities, E = P ∪ Dev, as a union of the set of persons P and the set of devices Dev. Two entities are of particular importance for our discussion: the device that hosts the context-aware security system—the host, h ∈ Dev, and the person operating this device—the user, u ∈ P .

A device can be seen as a composition of three types of resources: data, channel, and method [40]. The data represent an information in a form understandable to devices or per- sons. It can be kept as a file, read from a sensor, or received from another entity. A channel represents a pathway through which the user or any other device communicates with the host. Examples of such pathways are sockets and named pipes. A method represents a software component that imple- ments a certain functionality, which can be executed through its interface (API). Methods are usually combined in applica- tions, which enable achievement of more complex function- alities. We recognize security mechanisms as methods in our model We denote the set of resources as Res = D ∪ M ∪ C , where D is the set of data, M is the set of methods, and C is the set of all active channels that a device, for example h, has.

Entities can be described with various contextual infor- mation that can be acquired from physical and virtual sen- sors. Physical sensors are hardware components, such as GPS, camera, microphone, accelerometer, and many oth- ers which can be already present in contemporary mobile devices, whereas virtual sensors are software components providing contextual information taken from various sources [5], such as applications, protocols, social networks. Contex- tual information can be acquired either from sensors on the host or from an external context provider. Table 1 shows

Table 1 Examples of contextual information, associated with entities

Entity Contextual information

Person Age, gender, relations, religion

Device OS information, owner, location, time

Resource Data value, protocol, sec. mech. strength

examples of contextual information, associated with the rep- resenting entities.

5.2 Activity

An activity is the process in which an entity executes orga- nized operations while trying to accomplish certain goals. It is performed either explicitly by the user while interact- ing with the host or implicitly by the host itself. An activity whose goals are related to the protection of resources is called security activity.

Generally, activities are performed with an application by executing a specific method over resources. Some activities are more complex than other and comprise several activities that are consecutively performed. We represent an activity in our model as a tuple of tuples (app, op, ob j ), where app ⊆ M is the application used for performing the activity, op ∈ M is the method that implements the operation of the activity, and ob j ⊆ Res are the resources upon which the activity is performed, i.e., objects of an activity. We denote the set of all activities as A. For clarity reasons, in the rest of the paper, we represent activities with their description in words. For example, an activity described as “o f f app reads data d1” is represented as a tuple (o f f app, r ead − dat a, d1).

As an example of complex activity, consider an activity described as “o f f app presents data d1”, which comprises several other activities: “o f f app reads data d1”, “o f f app opens channel c1”, and “o f f app shares screen through chan- nel c1”. Similarly, a complex security activity is “app1 estab- lishes confidential channel c1”, which is comprised of several (security) activities that are executed during the SSL protocol handshake.

5.3 Situation

A situation better interprets an activity and gives more mean- ing to it. It describes the state of the relevant entities and the relationship among them [10, 19]. We define several concepts suitable for representing situation. We separate them in two groups—social concepts and properties.

5.3.1 Social concepts

Social scientists have observed that during their life, people do not act simply as individuals in an undefined manner, but

123

576 V. Jovanovikj et al.

take part of various social groups (communities) in order to achieve their goals more easily [21, 43]. The common goals and interests of these groups shape the activities performed within them. Group members divide these activities among themselves according to the qualifications needed to accom- plish them successfully, and this is represented as roles in the social group. The roles and the distribution of activities make social groups highly organized. Depending on these goals and roles, social groups can be categorized into social domains. Examples of social domains include family, friends, workplace, education, health care, research department, city, country, while examples of social groups include their par- ticular realization. A research department social domain, for example, is defined by roles such as the head of the depart- ment, researcher, student or developer, and common goals such as solving scientific challenging problems, proving the feasibility of proposed solutions.

Devices and data can also be associated with social groups. Some devices perform important activities in ubiquitous social systems and are useful for a number of people, not just for a single person. Therefore, they can be consid- ered as members of social groups and can have assigned roles that stem directly from the purpose of their use. Such devices are for example: printers, network access points, pay- ment terminals, access control devices, attendance devices, information devices. On the other hand, a data can have assigned a social group according to the meaning of its content, which is especially important for protection of its confidentiality.

Since people (and devices) are often part of a single social group from a social domain, in the rest of the paper, we will refer to social groups by their social domains, to make things as clear as possible. For example, instead of referring to a particular family as a social group, we will refer to it as a family group, from the perspective of the user. Moreover, we will consider that by default all entities are part of a general social group called public social group.

We refer to an entity which can be a member of a social group as a social entity, se ∈ S E , S E = P ∪ S Dev, where S Dev ⊆ Dev. Let G be a set of possible goals that can result from activities and Rol be a set of possible roles that can represent qualifications needed to successfully accom- plish activities. A social domain sd ∈ S D is defined as a tuple, sd = (gls, r ls), of specific goals gls ⊆ G whose achievement is a reason for social entities to organize in a social group, and a set of specific roles r ls ⊆ Rol accord- ing to which activities that result in goals gls are divided between those entities. A social group, sg ⊆ S E × Rol, is an implementation of a social domain and is defined as a set of tuples (se, r ol) of social entities se and their assigned role r ol, such that all roles are part of a single social domain sd. We represent the set of all social groups as SG.

Based on the notion of social groups, we define three social concepts: focus, association, and setting.

Focus People often consecutively perform activities from different social domains in ubiquitous social systems. Some activities and their related goals are more important than oth- ers at a given moment and are thus considered as primary. For example, while working, a person can quickly do something related to other social domains (e.g., call a friend or read personal email), but their work activities and goals remain primary. The focus describes the primary intention and ori- entation of the user and motivates their behavior at a given moment. We define focus, f ocus ∈ SG as a primary social group for the user at a given moment.

Association Except the user, other entities can also be involved in an activity as participants. We denote the set of participants of an activity a as para ⊆ S E \{u}. It is imprac- tical to represent the participants individually as their number can be large for some activities. Instead, a social group com- mon for all of them describes them better. Let seg ⊆ SG represents the set of social groups that a social entity se is part of. Also, let common : 2S E → 2SG be a function that maps an arbitrary set of social entities B ⊆ S E to an inter- section of social groups they are all part of, common(B) = {sg ∈ SG | ∀se ∈ B(sg ∈ seg )}. Then, we define associa- tion of an activity a, assoca ∈ SG, as a common social group of the user and a non-empty set of participants in that activity, assoca ∈ common({u} ∪ para ), para �= ∅. In case there is a single common social group, association is uniquely deter- mined. However, in case of more than one common social groups between participants, focus can be of help in deter- mining association. If f ocus ∈ common({u} ∪ para ), then assoca = f ocus, else assoca = publi c, since all entities are members of the public social group by default. In addi- tion, if there are no participants in an activity, the association for it is null, assoca = ∅.

Setting Activities are performed in various environments, which can change dynamically in ubiquitous social sys- tems. Except the participants, these environments can com- prise many other social entities, referred to as observers. An observer of an activity is an entity that is near the user or is part of a channel used in that activity. We denote the set of observers of an activity a as obsa ⊆ S E \{u}. In a same way as participants, observers are better described with their common social group than individually. We define setting of an activity a, set ta ∈ SG, as a common social group of the user and a non-empty set of observers of that activ- ity set ta ∈ common({u} ∪ obsa ), obsa �= ∅. Same as for association, focus can be of help in determining setting. If f ocus ∈ common({u} ∪ obsa ), then set ta = f ocus, else

123

A conceptual model of security context 577

set ta = publi c. In addition, if there are no observers for an activity, the setting for it is null, set ta = ∅. 5.3.2 Property

A property is a quality that describes a resource or its usage. We define a property pr as a function that maps a resource r ∈ Res to a certain value. In its simplest form, it is a func- tion pr : Res → {0, 1}. In this case, a value pr (r ) = 1 denotes that the property of the resource is achieved, whereas pr (r ) = 0 denotes the opposite. We denote the set of all properties as P R.

From all properties, security properties of resources are of special importance for our discussion. Generally recog- nized security properties are confidentiality, c, integrity, i , and availability, a [11]. We emphasize that evaluation of security properties of resources should not be seen as ver- ification that security services, or their implementation, pro- vide the particular security properties. Except as contex- tual information, security properties of resources are often used as an indicator of the security system operation. For an activity a, the current values of security properties of all resources that are of interest and are involved in a comprise a tuple, s pr opa = ( pr1(r1), pr1(r2), . . . , prn (rm )), where pri ∈ P R and r j ∈ Res.

5.4 Summary

To sum up, the security context for a particular activity a is a tuple, SecC on = (a, f ocus, assoca , set ta , s pr opa ), con- sisted of the activity itself, the focus of the user, f ocus, the social concepts that characterize a—association, assoca , and setting, set ta , and the current values of the security properties of resources that are currently involved in a. For a continuous activity, the security context is dynamically updated as other activities are performed.

6 Discussion

We show the applicability of our model in an empirical man- ner. First, we use it to analyze the motivation scenario from Sect. 2. During this analysis, we describe a possible operation of a context-aware security system (CASS) that utilizes our model. Then, we compare it with the existing approaches, especially their understanding of the security context. Apart from showing the ability of our model in representing the security context, this comparison is also an evaluation of the understanding and specification of the security context in the existing approaches. Finally, we present the security require- ments of the security context.

6.1 Model application in example scenario

We analyze two scenes from the motivation scenario into more detail. For our analysis, we assume that Alice is the user u and her mobile device is the host h of the context-aware security system that uses our model of secu- rity context. Alice is a member of four social groups: (i) the ACME company, wor k = { Ali ce, Bob}, in which she has a role of researcher, (ii) the particular research project, pr oj ect = { Ali ce, . . .}, in which she also has a role of researcher, (iii) her particular home, home = { Ali ce}, in which she has a role of inhabitant, and (iv) the particular city, publi c = { Ali ce, Bob, j ani t or, . . .}, in which she has a role of citizen. We denote this as u g = {wor k, pr oj ect, home, publi c}. In addition, we assume that Alice’s mobile device will keep information about the structure of the social groups she is member, i.e., about the members and their roles.

Scene 1 Alice registers to the company’s time tracking soft- ware before she starts working. Based on this activity, the CASS changes her focus to her work social group, f ocus = wor k. In order to start reviewing her presentation slides d1, she initiates an activity a1: “o f f app edits data d1”, where o f f app denotes the office application. The CASS needs to examine the security context for this activity before allow- ing or denying it. One can imagine that this is done in the following way. Based on the facts that her focus is the work group and that d1 is assigned for her project group, the CASS changes her focus to the project group, f ocus = pr oj ect . For activity a1, there are no other participants except Alice. Thus, the association for this activity is null. Setting is deter- mined after the CASS scans the environment for wireless signals. Based on the recognized Alice’s access point and TV, which are members of her home social group, as well as a previous activity of arriving home, setting for this activity is set to be Alice’s home group, set ta1 = home. The office app is authorized to edit project data during project focus in home setting. Therefore, CASS allows a1 to be executed. After a1 is started, confidentiality of d1 is set in s pr opa1 as achieved. Furthermore, Alice tries to read the home docu- ment with the office app. After examining the security context in similar manner, the CASS deduces that focus and setting remain the same. The office app has only permissions to read data from other groups during project focus, in order data leakage to be prevented. Thus, the CASS allows this activity too. Finally, Alice leaves her apartment with the documents remained opened. The CASS changes her focus to her public social group, f ocus = publi c. Since it is not allowed for the office app to edit project data in public focus, the con- fidentiality of d1 is deprived. In response, the CASS closes this document.

123

578 V. Jovanovikj et al.

Scene 3 Imagine that Alice uses her mobile device to authen- ticate at the conference room entrance. The project meet- ing is about to begin, so Alice’s calendar notifies about the event start. Based on these two activities, the CASS is able to determine that the Alice’s focus is her project social group, f ocus = pr oj ect . The CASS recognizes that Alice is ini- tiating a complex activity with the office application over the presentation slides, a1: “o f f app presents data d1”. As described in Sect. 5.2, several activities precede this, dur- ing which a channel c1 is established with a projector p1. In order to decide whether to allow or deny a1 (in fact the last initiated activity that led to its recognition), the CASS consults the security context for this activity. Association for a1 can be determined based on information received from the conference room access control system (as a con- text provider) and the structure of Alice’s social groups. As only people from partner institutions are currently present in the room, association for a1 is set to be the project social group, assoca1 = pr oj ect , which is their only common social group. Similarly, setting for a1 can be derived based on various captured wireless signals. Except for the projector p1, which is a member of the work social group p1 ∈ wor k, the signals mainly come from unknown attendants outside the conference room. As a result, the setting for a1 is set to be the public social group, set ta1 = publi c. Presentation of project data in front of project association during project focus and in public setting is allowed only if confidential- ity and integrity of the channel c1 are achieved in advance. Security properties can be derived from previous activities. Since c1 is unprotected, confidentiality and integrity of c1 are not currently achieved. In order a1 to be allowed, the CASS needs to adapt and establishes a secure channel over c1, for example by using the SSL protocol. After the pre- sentation is started, confidentiality of data d1 is set to be achieved in s pr opa1 . Furthermore, when the janitor enters the room, the conference door access control system notifies the CASS. As a result, the security context for a1 is updated. The association for a1 now becomes the public social group, assoca1 = publi c. Since it is not allowed to present project data in front of public association, confidentiality of d1 is deprived. In order to protect confidentiality of d1, the CASS reacts by turning off the screen sharing with the projector.

6.2 Model comparison with existing approaches

We compare our model with various approaches of context- aware and adaptable security. In their characteristics and goals, they are very similar; the differences are mainly in their emphasis—the former are more concerned with the diversity of context and how to utilize it, whereas the latter mainly deal with the adaptation of their behavior. In particular, we map the security context that the existing approaches take into consideration, to our model. Moreover, we specify their

adaptable behavior, which is in fact the security service these approaches provide. The results are presented in Table 2.

The comparison elicited several additional gaps in the existing approaches.

– The existing approaches seriously lack a context specifi- cation. Because of the variety of possible contextual infor- mation, it is difficult to understand what these systems can be aware of and adapt to. As a result, their applicability can become unclear.

– The existing approaches mainly adapt to low-level contex- tual information, acquired directly from sensors. On the one hand, this makes the definition of policies cumber- some and error-prone, because of the granularity, uncer- tainty, and the frequent change of this information. On the other hand, it gives an additional burden to policy evalu- ation and can compromise its performance, as it leads to performing context reasoning during this process.

– The existing approaches rarely use complex activities as contextual information, especially security activities. The creation of their security context is mainly guided by sim- ple activities, which is a poor characteristic.

– Only few approaches [17, 22, 24, 27, 37, 56] take contex- tual information from the social domain into considera- tion. They mainly use the concept of social relation. How- ever, this is done only arbitrarily, without any attempt to define this concept in a consistent manner. Moreover, these approaches mainly use social contextual information to support and describe only activities, despite other possi- ble applications.

– The existing approaches are mainly concerned only with the security properties they can achieve. They evaluate security properties on the basis of the characteristics of the security mechanisms that provide these properties, such as their strength or performance. An exception of this is [54], which tries to evaluate what specific security properties does a set of security activities achieve.

– The existing approaches mainly implicitly try to bal- ance the trade-offs between security and other properties. Except for [46, 48, 51], none of the approaches track other properties more precisely.

6.3 Security requirements of security context

The correct operation of any context-aware system depends on how accurately the contextual information represents real- ity [12, 39]. Since the contextual information directly influ- ence the integrity of context-aware systems, their manipu- lation is an attractive attack vector for these systems. This applies especially to context-aware security systems, whose application is critical and can have rather severe conse- quences for its users. Any incorrect operation of these sys-

123

A conceptual model of security context 579

Table 2 Security context in context-aware security systems

References Name Context Adaptable behavior

Entity Activity Social Property

Person Device Resource Simple Complex Focus Assoc Setting SP OP

Covington et al. [16] Env. roles � � � � AC Al-Muhtadi et al. [3] Cerberus � � � � � A, AC Johnson et al. [34] Shrink-wrap. sec. � � � AC Toninelli et al. [59] Proteus � � � � AC Hachem et al. [27] Mob. Soc. ecosys. � � � � AC Riva et al. [46] Progressive auth. � � � � � � A Evesti and Pantsar-Syväniemi [22] Smart Space Arc. � � � � � � � � Sev.Serv. Spanoudakis et al. [54] Serenity � � � � � � Sev.Serv. Ksiezopolski and Kotulski [36] Adapt. PKI � � � SC Bandinelli et al. [6] CASec for NGN � � � � SC Rocha et al. [48] Adapt. protocols � � � � � SC Kulkarni and Tripathi [37] CA-RBAC � � � � AC Bai et al. [4] ConUCON � � � � AC Strimpakou et al. [56] Daidalos � � � � � IM Frank et al. [24] Persist � � � � � � IM Ahmed and Zhang [2] CRAAC � � � AC Cuppens and

Cuppens-Boulahia [17]

OrBAC � � � � � � AC

Ganger [25] Auth. Confidence � � � A Hulsebosch et al. [31] CS Adapt. Auth. � � � � A Saxena et al. [51] Auto. Sec. FW � � � � � � � A, AC, SC Kouadri-Mostefaoui [41] CoDiS � � � � Sev.Serv. Feth and Jung [23] Data UCON � � � � AC Zhang et al. [62] RelBAC � � � � � AC Sabzevar et al. [49] Chameleon � � � � � AC

A checkmark (�) denotes that the system takes into consideration this type of contextual information. Please note that a mark in the device column denotes that the system takes into consideration contextual information about the device as a whole Assoc association, SP security property, OP other property, AC access control, A authentication, SC security channel, IM identity management, Sev.Serv. several services

tems can compromise them and cause an (easier) exploitation of resources of interest they are protecting.

Contextual information needs to be appropriately secured and verified prior to its use in context-aware security sys- tems, in the same manner as data in general. In particular, three integrity properties of data need to be assured [53]: (i) data integrity, which is the property that the value contained in the data have not been changed in an unauthorized man- ner, (ii) source integrity, which is the property of the data to be trustworthy, based on its source, and (iii) correctness integrity, which is the property that the underlying informa- tion represented by the data is accurate and consistent. For this purpose, standard security mechanisms for data security can be used [33]. In addition, the confidence in correctness

of contextual information can be built on the basis of their quality, usually represented through accompanying quality parameters [12, 39].

7 Conclusion

Ubiquitous social systems require context-aware security provisioning. However, the existing approaches are not applicable as they do not have a clear and complete under- standing of the security context and use contextual infor- mation with an arbitrary level of abstraction. We proposed a conceptual model of the security context to address these issues. The model identified the important concepts of the

123

580 V. Jovanovikj et al.

security context, introducing several social concepts defined in a consistent manner. We demonstrated the flexibility and sufficiency of our model with two methods. First, we applied it to analyze a typical ubiquitous social system scenario from the perspective of security. Then, we compared it with the existing approaches, especially regarding their understand- ing of the security context. We observed several additional issues of existing systems from this comparison. Addition- ally, we discussed the security requirements of the security context.

Our conceptual model of the security context brings sev- eral benefits. It may facilitate the specification, management, and reuse of security policies for ubiquitous social systems, as it introduces meaningful concepts with a higher level of abstraction. At the same time, it may improve the process of policy evaluation, as it promotes the decoupling of this process from the context reasoning. As a result, our model promises to improve the design and development of context- aware security systems that overcome many of the security challenges of ubiquitous social systems.

Acknowledgments This work was supported by the Slovenian Research Agency (ARRS).

References

1. Abowd, G.D., Dey, A.K., Brown, P.J., Davies, N., Smith, M., Steggles, P.: Towards a better understanding of context and context- awareness. In: Gellersen, H.W. (ed.) Handheld and Ubiquitous Computing. Lecture Notes in Computer Science, vol. 1707, pp. 304–307. Springer, Berlin (1999)

2. Ahmed, A., Zhang, N.: Towards the realisation of context-risk- aware access control in pervasive computing. Telecommun. Syst. 45(2–3), 127–137 (2010)

3. Al-Muhtadi, J., Ranganathan, A., Campbell, R., Mickunas, M.D.: Cerberus: a context-aware security scheme for smart spaces. In: Proceedings of the IEEE International Conference on Pervasive Computing and Communications, PerCom ’03, pp. 489–496. IEEE Computer Society (2003)

4. Bai, G., Gu, L., Feng, T., Guo, Y., Chen, X.: Context-aware usage control for android. In: Jajodia, S., Zhou, J. (eds.) Security and Pri- vacy in Communication Networks, Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunica- tions Engineering, vol. 50, pp. 326–343. Springer, Berlin (2010)

5. Baldauf, M., Dustdar, S., Rosenberg, F.: A survey on context-aware systems. Int. J. Ad Hoc Ubiquitous Comput. 2(4), 263–277 (2007)

6. Bandinelli, M., Paganelli, F., Vannuccini, G., Giuli, D.: A context- aware security framework for next generation mobile networks. In: Schmidt, A., Lian, S. (eds.) Security and Privacy in Mobile Information and Communication Systems. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecom- munications Engineering, vol. 17, pp. 134–147. Springer, Berlin (2009)

7. Basole, R.C.: The value and impact of mobile information and com- munication technologies. In: Proceedings of the IFAC Symposium on Analysis, Modeling & Evaluation of Human-Machine Systems, pp. 1–7 (2004)

8. Basole, R.C.: The emergence of the mobile enterprise: a value- driven perspective. In: International Conference on the Manage- ment of Mobile Business, ICMB 2007, pp. 41–41. IEEE (2007)

9. Bazire, M., Brézillon, P.: Understanding context before using it. In: Dey, A., Kokinov, B., Leake, D., Turner, R. (eds.) Modeling and Using Context. Lecture Notes in Computer Science, vol. 3554, pp. 29–40. Springer, Berlin (2005)

10. Bettini, C., Brdiczka, O., Henricksen, K., Indulska, J., Nicklas, D., Ranganathan, A., Riboni, D.: A survey of context modelling and reasoning techniques. Pervasive Mob. Comput. 6(2), 161–180 (2010)

11. Bishop, M.A.: The Art and Science of Computer Security. Addison- Wesley, Boston (2002)

12. Buchholz, T., Schiffers, M.: Quality of context: What it is and why we need it. In: Proceedings of the 10th Workshop of the OpenView University Association: OVUA’03 (2003)

13. Campbell, R., Al-Muhtadi, J., Naldurg, P., Sampemane, G., Mick- unas, M.D.: Towards security and privacy for pervasive computing. In: Okada, M., Pierce, B., Scedrov, A., Tokuda, H., Yonezawa, A. (eds.) Software Security : Theories and Systems. Lecture Notes in Computer Science, vol. 2609, pp. 1–15. Springer, Berlin (2003)

14. Chen, G., Kotz, D.: A survey of context-aware mobile comput- ing research. Technical report, Department of Computer Science, Dartmouth College (2000)

15. Clarke, J., Hidalgo, M.G., Lioy, A., Petkovic, M., Vishik, C., Ward, J.: Consumerization of IT: top risks and opportunities. Techni- cal report, European Network and Information Security Agency (ENISA) (2012)

16. Covington, M.J., Long, W., Srinivasan, S., Dev, A.K., Ahamad, M., Abowd, G.D.: Securing context-aware applications using environ- ment roles. In: Proceedings of the ACM Symposium on Access Control Models and Technologies, SACMAT ’01, pp. 10–20. ACM (2001)

17. Cuppens, F., Cuppens-Boulahia, N.: Modeling contextual security policies. Int. J. Inf. Secur. 7(4), 285–305 (2008)

18. D’Arcy, P.: CIO strategies for consumerization: the future of enter- prise mobile computing (2011)

19. Dey, A.K.: Understanding and using context. Pers. Ubiquitous Comput. 5(1), 4–7 (2001)

20. Dourish, P.: What we talk about when we talk about context. Pers. Ubiquitous Comput. 8(1), 19–30 (2004)

21. Engeström, Y., et al.: Activity theory and individual and social transformation. Perspectives on activity theory, pp. 19–38 (1999)

22. Evesti, A., Pantsar-Syväniemi, S.: Towards micro architecture for security adaptation. In: Proceedings of the European Conference on Software Architecture: Companion Volume, ECSA ’10, pp. 181– 188. ACM (2010)

23. Feth, D., Jung, C.: Context-aware, data-driven policy enforcement for smart mobile devices in business environments. In: Schmidt, A., Russello, G., Krontiris, I., Lian, S. (eds.) Security and Pri- vacy in Mobile Information and Communication Systems. Lec- ture Notes of the Institute for Computer Sciences, Social Infor- matics and Telecommunications Engineering, vol. 107, pp. 69–80. Springer, Berlin (2012)

24. Frank, K., Kalatzis, N., Roussaki, I., Liampotis, N.: Challenges for context management systems imposed by context inference. In: Proceedings of the International Workshop on Managing Ubiqui- tous Communications and Services, MUCS ’09, pp. 27–34. ACM (2009)

25. Ganger, G.R.: Authentication confidences. In: Proceedings of the Workshop on Hot Topics in Operating Systems, HOTOS ’01, p. 169. IEEE Computer Society (2001)

26. Giessmann, A., Stanoevska-Slabeva, K., De Visser, B.: Mobile enterprise applications: current state and future directions. In: Pro- ceedings of the 45th Hawaii International Conference on System Science, HICSS 2012, pp. 1363–1372. IEEE (2012)

27. Hachem, S., Toninelli, A., Pathak, A., Issarny, V.: Policy-based access control in mobile social ecosystems. In: Proceedings of the IEEE International Symposium on Policies for Distributed Systems

123

A conceptual model of security context 581

and Networks, POLICY ’11, pp. 57–64. IEEE Computer Society (2011)

28. Haque, M., Ahamed, S.I.: Security in pervasive computing: current status and open issues. Int. J. Netw. Secur. 3(3), 203–214 (2006)

29. Harris, J., Ives, B., Junglas, I.: IT consumerization: when gadgets turn into enterprise IT tools. MIS Q. Exec. 11(3), 99–111 (2012)

30. Hines, A., Carbone, C.: The future of knowledge work. Employ. Relat. Today 40(1), 1–17 (2013)

31. Hulsebosch, R., Bargh, M., Lenzini, G., Ebben, P., Iacob, S.: Con- text sensitive adaptive authentication. In: Kortuem, G., Finney, J., Lea, R., Sundramoorthy, V. (eds.) Smart Sensing and Context. Lec- ture Notes in Computer Science, vol. 4793, pp. 93–109. Springer, Berlin (2007)

32. ISO/IEC: ISO/IEC 27002:2005: Information technology— Security techniques—Code of practice for information security management. Technical Report 27002:2005, ISO/IEC (2005)

33. ITU-T: Security architecture for open systems interconnection for CCITT applications. Technical Report. Recommendation X.800, International Telecommunications Union (ITU) (1991)

34. Johnson, G., Shakarian, P., Gupta, N., Agrawala, A.: Towards shrink-wrapped security: practically incorporating context into security services. Procedia Comput. Sci. 5, 782–787 (2011)

35. Johnson, G.M.: Towards shrink-wrapped security: a taxonomy of security-relevant context. In: Proceedings of the IEEE International Conference on Pervasive Computing and Communications, Per- Com ’09, pp. 1–2. IEEE Computer Society (2009)

36. Ksiezopolski, B., Kotulski, Z.: Adaptable security mechanism for dynamic environments. Comput. Secur. 26(3), 246–255 (2007)

37. Kulkarni, D., Tripathi, A.: Context-aware role-based access con- trol in pervasive computing systems. In: Proceedings of the ACM Symposium on Access Control Models and Technologies, SAC- MAT ’08, pp. 113–122. ACM (2008)

38. La Polla, M., Martinelli, F., Sgandurra, D.: A survey on security for mobile devices. Commun. Surv. Tutor. IEEE 15(1), 446–471 (2013)

39. Lacoste, M., Privat, G., Ramparany, F.: Evaluating confidence in context for context-aware security. In: Ambient Intelligence, pp. 211–229. Springer (2007)

40. Manadhata, P.K., Wing, J.M.: An attack surface metric. IEEE Trans. Softw. Eng. 37(3), 371–386 (2011)

41. Kouadri-Mostefaoui, G.: Towards a conceptual and software framework for integrating context-based security in pervasive envi- ronments. Ph.D. thesis, University of Fribourg (2004)

42. Niehaves, B., Köffer, S., Ortbach, K.: IT consumerization: a the- ory and practice review. In: Americas Conference on Information Systems, AMCIS 2012 (2012)

43. Nissenbaum, H.F.: Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford Law & Politics (2010)

44. Papadopoulou, E., Gallacher, S., Taylor, N.K., Williams, M.H.: A personal smart space approach to realising ambient ecologies. Pervasive Mob. Comput. 8(4), 485–499 (2012)

45. Ramakrishna, V., Eustice, K., Schnaider, M.: Approaches for ensur- ing security and privacy in unplanned ubiquitous computing inter- actions. In: Reiher, P., Makki, K., Pissinou, N., Makki, S., Makki, S. (eds.) Mob. Wirel. Netw. Secur. Priv., pp. 167–189. Springer, US (2007)

46. Riva, O., Qin, C., Strauss, K., Lymberopoulos, D.: Progressive authentication: deciding when to authenticate on mobile phones. In: Proceedings of the USENIX Security Symposium, Security ’12, pp. 15–15. USENIX Association (2012)

47. Robinson, P., Beigl, M.: Trust context spaces: an infrastructure for pervasive security in context-aware environments. In: Hutter, D., Müller, G., Stephan, W., Ullmann, M. (eds.) Security in Pervasive Computing. Lecture Notes in Computer Science, vol. 2802, pp. 157–172. Springer, Berlin (2004)

48. Rocha, B.P., Costa, D.N., Moreira, R.A., Rezende, C.G., Loureiro, A.A., Boukerche, A.: Adaptive security protocol selection for mobile computing. J. Netw. Comput. Appl. 33(5), 569–587 (2010)

49. Sabzevar, A., Sousa, J.: Chameleon: a model of identification, authorization and accountability for ubicomp. In: Hsu, C.H., Yang, L., Ma, J., Zhu, C. (eds.) Ubiquitous Intelligence and Comput- ing. Lecture Notes in Computer Science, vol. 6905, pp. 326–339. Springer, Berlin (2011)

50. Sandhu, R.: Good-enough security. Internet Comput. 7(1), 66–68 (2003)

51. Saxena, A., Lacoste, M., Jarboui, T., Lücking, U., Steinke, B.: A software framework for autonomic security in pervasive envi- ronments. In: McDaniel, P., Gupta, S. (eds.) Information Systems Security. Lecture Notes in Computer Science, vol. 4812, pp. 91– 109. Springer, Berlin (2007)

52. Schmidt, A., Pfleging, B., Alt, F., Sahami, A., Fitzpatrick, G.: Inter- acting with 21st-century computers. Pervasive Comput. 11(1), 22– 31 (2012)

53. Shirey, R.W: Internet security glossary, version 2. Technical Report RFC: 4949, The Internet Engineering Task Force (IETF) (2007)

54. Spanoudakis, G., Kokolakis, S., Gomez, A.M.: Security and Dependability for Ambient Intelligence. Springer, Berlin (2009)

55. Stallings, W., Brown, L.V.: Computer Security: Principles and prac- tice. Prentice-Hall, New Jersey (2008)

56. Strimpakou, M., Roussaki, I., Pils, C., Angermann, M., Robert- son, P., Anagnostou, M.: Context modelling and management in ambient-aware pervasive environments. In: Strang, T., Linnhoff- Popien, C. (eds.) Location- and Context-Awareness. Lecture Notes in Computer Science, vol. 3479, pp. 83–94. Springer, Berlin (2005)

57. The Australian Signals Directorate: Risk management of enter- prise mobility including bring your own device. Technical report, Australian Governament, Department of Defence, Intelligence and Security (2013)

58. Thomas, R.K., Sandhu, R.: Models, protocols, and architectures for secure pervasive computing: challenges and research directions. In: Proceedings of the IEEE Conference on Pervasive Computing and Communications, PerCom ’04, pp. 164–168. IEEE Computer Society (2004)

59. Toninelli, A., Montanari, R., Kagal, L., Lassila, O.: Proteus: a semantic context-aware adaptive policy model. In: Proceedings of the IEEE International Symposium on Policies for Distributed Sys- tems and Networks, POLICY ’07, pp. 129–140. IEEE Computer Society (2007)

60. Weiser, M.: The computer for the 21st century. Sci. Am. 265(3), 94–104 (1991)

61. Ye, J., Dobson, S., McKeever, S.: Situation identification tech- niques in pervasive computing: a review. Pervasive Mob. Comput. 8(1), 36–66 (2012)

62. Zhang, R., Giunchiglia, F., Crispo, B., Song, L.: Relation-based access control: an access control model for context-aware comput- ing environment. Wirel. Pers. Commun. 55(1), 5–17 (2010)

123

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

  • c.10207_2014_Article_229.pdf
    • A conceptual model of security context
      • Abstract
      • 1 Introduction
      • 2 Motivation scenario
      • 3 Related work
      • 4 Definition of security context
      • 5 Conceptual model of security context
        • 5.1 Entity
        • 5.2 Activity
        • 5.3 Situation
          • 5.3.1 Social concepts
          • 5.3.2 Property
        • 5.4 Summary
      • 6 Discussion
        • 6.1 Model application in example scenario
        • 6.2 Model comparison with existing approaches
        • 6.3 Security requirements of security context
      • 7 Conclusion
      • Acknowledgments
      • References

Sources/A Snapshot of Trusted Personal Devices.pdf

O R I G I N A L A R T I C L E

A snapshot of trusted personal devices applicable to transaction processing

David Moreland Æ Surya Nepal Æ Hon Hwang Æ John Zic

Received: 29 February 2008 / Accepted: 9 March 2009 / Published online: 19 April 2009

� Springer-Verlag London Limited 2009

Abstract In recent years, a clear trend has emerged

where businesses need to provide flexible access to its

services so as to increase their usage by a much wider

cross-section of users operating over public infrastructures

but still within a trusted environment. This trusted envi-

ronment must be established between all participating users

and service provider entities before any transactions are

carried out. To meet the challenge of enabling mobile users

to work within a trusted environment on any untrusted

machine, the notion of a trusted personal device (TPD) has

emerged. This paper provides a survey giving a snapshot of

the growing body of work ongoing in the area of TPDs and

the services they support.

Keywords Trusted personal device � Untrusted host � Transaction processing

1 Introduction

Traditionally, people who work within enterprises have

been constrained to operate within carefully managed

infrastructures for reasons of minimizing security risks and

guaranteeing quality of service requirements. However, in

recent years a clear trend has emerged where the business

community needs to provide on-demand access to its ser-

vices in order to make them accessible to a wide cross-

section of users operating over public infrastructures (i.e.,

beyond the administration boundaries of securely-managed

enterprise domains), but still within a secure, private and

trusted context. This business model, which is underpinned

by the progressive utilization of service oriented architec-

ture (SOA) [1] and Web Services technologies [2], has

motivated research in the area of dynamic collaborations

and virtual organizations [3–7] with the key objective of

being able to support a growing number of service appli-

cations within various domains (i.e., eCommerce, eHealth,

eGovernment, etc.), so that these services can be accessible

to users from anywhere at anytime [8]. This business model

fundamentally relies on the provision and support of a

trustworthy environment within which users operate. This

environment must be established between user and service

provider entities before they can proceed with exchanging

information with each other with the understanding that

this environment meets the mutually agreed business

requirements of security, trust and privacy. This presents a

significant challenge to mobile users who need to conduct

business from untrusted host machines.

To meet the challenge of enabling mobile users to work

within a trusted environment on any untrusted machine, the

notion of a trusted personal device (TPD) has emerged.

Essentially this is a device (a fuller explanation of which is

given later on) that constitutes a link in a chain-of-trust

which extends from the trusted environment, established by

the TPD, and within which a client works, to a networked

service provider. A variety of specialized attestation pro-

tocols are used to establish a trusted environment for the

clients and the resources offered by the service provider

before any transactions occur between these entities. The

role of the TPD in this system is to provide the end-point

assurance in the chain-of-trust which enables clients (TPD

users) and service providers (TPD certifiers) to operate

with greater confidence.

D. Moreland (&) � S. Nepal � H. Hwang � J. Zic Networking Technologies Laboratory, CSIRO ICT Centre,

Corner of Vimiera and Pembroke Roads, Marsfield,

NSW 2122, Australia

e-mail: [email protected]

123

Pers Ubiquit Comput (2010) 14:347–361

DOI 10.1007/s00779-009-0235-6

The focus of this paper is to survey the emerging classes

of TPDs that satisfy these requirements. To pull this survey

together, we draw from the referenced sources of a number

of significant commercial and research initiatives covering

a range of device types with associated protocols/mecha-

nisms that enable users to ‘‘connect’’ with the service

provider community such that the confidentiality, integrity

and authenticity of transactions can be certified as being

trustworthy.

The aim of this survey is to provide a snapshot of a

growing body of work ongoing in the area of TPDs and the

services they support. The TPDs included in this review are

small, tamper proof artifacts that are both portable and

mobile. Their portability enables the user to change access

points as they move from one location to another. Their

mobility offers a user the ability to maintain the same

identity irrespective of the terminal used and the point of

network attachment. Depending on the type of personal

device and its scenario of use, a device will be supported

by fit-for-purpose protocols and technologies [e.g., Trusted

Platform Module (TPM), virtual machines] that may be

embedded in the device itself, the host to which the device

is attached or the service provider entity that the device

communicates with.

One obvious class of device that falls within the ambit

of this survey is the ubiquitous smart card in its various

forms. However, since smart cards have already been well

covered in the literature [9], we only consider the more

recent network derivate [10, 11] since it more closely

aligns with the type of TPDs we have in mind for this

survey. We also report on the emerging classes of TPD that

have built-in functionality to facilitate trust as an integral

part of their design. Other well established devices, such as

mobile phones and PDAs, which are considered to be a

type of TPD, are also included in this survey, but more

from a research perspective to explore specific trust issues

in novel scenarios of use.

1.1 Motivational areas

The main motivations for TPD transactional processing are

as follows:

• Collaboration: Flexible and dynamic ways of working are becoming more common place. This is evidenced

by the proliferation of initiatives for collaborative

working over public/private infrastructures [12, 13].

One scenario is where a set of privileged user groups

need to form temporary alliances with each other (e.g.,

the creation of a virtual company) to collectively

benefit from mutually agreeable transient business

opportunities that arise within a dynamic market space

[3, 14]. This way of working however raises trust

management issues (i.e., access control, key manage-

ment, third party mediation, policy conflict resolution)

between disparate user groups who may normally be

competitors, or at least not fully trusted parties, but who

need to work together by sharing each others digital

assets and resources. Trusted devices with appropriate

protocols, of the type addressed in this paper, are

required for collaborative environments to ensure

access to sensitive information but only by trusted

entities.

• eServices: Services are seen to be increasingly present- ing new business opportunities. Underpinning the

adoption of service based systems are the use of SOAs

in their design, and then their implementation using

Web services technologies. However, in order to

substantially increase the scope of trusted applications

and the enabling of new deployment scenarios for

eServices, trust management functionality must be an

integral part of the whole services architecture [15, 16].

This is particularly true within the client domain, which

is where TPDs play their part in addressing trust issues

relating to the environment within which the end user

operates. Expanding on this point, application scenarios

abound where end users need to use untrusted machines

in the public domain with the assurance that their

privacy will not be compromised, e.g., working from

public access points (kiosks/terminals [17–19]) to

securely access remote personal computing resources.

As such there is a real need to address the issue of the

chain-of-trust as it relates to the bigger picture of end-

to-end security. The first weak link in this chain is the

untrusted host machine that end users interface to via a

TPD.

These motivational areas, amongst others, present a

number of significant trust management challenges. How-

ever, this paper focuses on TPDs with associated protocols/

mechanisms for the establishment of trust relationships for

transactional processing between host machines and ser-

vice provider resources located somewhere in the Internet.

The devices covered in this survey encompass a broad class

of research ideas and commercial products, applicable to a

diverse range of applications. We address various facets of

trust that constitute the trustworthiness of transactions,

between users and service providers, namely confidential-

ity, integrity, authentication, non-repudiation, etc.

Our paper is structured as follows. In Sect. 2, we define

trust and TPDs and describe various categories of TPD.

Section 3 gives a brief overview of the network smart card

as a type of TPD. Section 4 gives an overview of three

types of emerging TPDs. Section 5 focuses on research that

enhances PDAs and cell phones for use as TPDs; three

examples are given. We conclude our survey in Sect. 6.

348 Pers Ubiquit Comput (2010) 14:347–361

123

2 Trusted personal devices

2.1 A definition of trust

A common mantra frequently heard today is that, secu-

rity mechanisms and technologies alone are not enough;

the reason being is that they can be and often are

breached by determined attackers. Apart from security,

privacy issues are rapidly coming to the fore as users

wish to maintain their anonymity and control over the

use and dissemination of their personal information in

the face of malicious threats such as identity theft. Fur-

ther, assuring trust, security and privacy of any system

that we operate within must by definition include both

the technological and human socio-legal methods and

support systems.

Complementary to security and privacy is the notion of

trust which may be considered as a means of instilling a

greater measure of confidence in a system by implementing

robust confidentiality, authentication and integrity mecha-

nisms. In this sense, trust augments the overall security and

privacy of a system. Although the following definition of

trust may vary, we regard trust as the expectation that a

device or system will faithfully behave in a particular

manner to fulfill its intended purpose, e.g., a computer is

trustworthy if its software and hardware can be depended

on to perform as expected such that its services are still

available today, unaltered, and behave in exactly the same

way as they did yesterday [20].

2.2 What is a trusted personal device?

One definition of a TPD, proposed by the Integrated secure

platform for interactive Trusted Personal Devices

(InspireD) project [21, 22], is, ‘‘A TPD is a small device

belonging to a single person to enable trusted operations

with other entities in an Information Technology & Com-

munication infrastructure.’’ According to this definition, a

TPD encompasses a wide range of future products opti-

mized for a combination of portability, identification,

security, privacy, and personal data storage. At the time of

writing, a trusted device is typically embodied as a SIM

card, which is utilized in different form factors (i.e., bank

cards, mobile phones, PDAs, etc.). However, InspireD

embraces a common vision of the smart card industry on

how the success of the smart card can be extended dra-

matically from today’s smart card technology through a

major technological evolution. The result of this evolution

is envisaged to be the TPD, where the term TPD does not

define a product in itself but an architectural concept and a

set of technologies applicable to a wide range of future

products with similar or related features. As such the TPD

will be much more than what we understand today’s smart

cards to be. According to InspireD, TPDs will aim to meet

the strong demands for trust, privacy, and security of

sensitive and valuable data in an Ambient Intelligence

Environment (AmI) of ubiquitous computing. This vision

implies a much closer integration of devices with the IT

infrastructure (i.e., they essentially become part of it) for

the purpose of providing full Internet connectivity, which is

also the intention of network smart cards. According to

InspireD, the TPD therefore fulfils the following

requirements:

• Trusted: Strong cryptography supported by dedicated hardware to provide integrated security from the

hardware level through to the application level.

• Personal: A TPD is meant to be a personal belonging, which is convenient to use, provides individual access

control and supports biometrics.

• Device: The TPD is deployed as a device within existing and future networked IT infrastructures. Key

features of the TPD are, amongst others, high-band-

width communication facilities, support of standard

network protocols (TCP/IP), and Web server

functionality.

Again the InspireD project views these requirements as

being embodied in a TPD which is, ‘‘a secure, portable,

personal Web server with optional near field communica-

tion and support of biometric authentication’’. TPDs with

this functionality are already beginning to appear in the

market place. An example of this type of TPD is the net-

work smart card [10, 11]. Furthermore, research is

exploring the utilization of the virtualization for virtual

machines [23] and TPM [24], for advanced access control

and the facilitating of trust management within untrusted

environments of host computers. This research is a catalyst

for investigating various combinations these technologies

for developing new TPDs that can be tailored to specific

application scenarios. With this in mind, we survey

emerging TPDs and the research motivating the next gen-

eration of these devices.

But first we present a classification scheme for the TPDs

that we use to structure the survey of TPDs.

2.3 Classification of trusted personal devices

We classify the TPDs surveyed into the broad categories

depicted in Fig. 1. Our classification scheme is based the

observation that TPDs can fall into either a smart card

branch (as they are currently understood), along with a

branch for the ‘‘super’’ smart cards that represent the

newer, emerging breed of TPDs. These ‘‘super’’ smart

cards move beyond the capabilities and uses of current

devices (largely for authentication and authorization) by

offering increased processing power, high degree of

Pers Ubiquit Comput (2010) 14:347–361 349

123

flexibility that allows the development of multiple novel

applications, possibly co-existing on the same TPD.

2.3.1 Smart cards

Smart cards have been around for decades, and represent a

mature, stable and well understood technology that is used

for a wide range of transaction processing applications,

including mobile communications, bank transactions,

physical and logical access control, network access control,

transportation and digital identity [9]. The privacy and

security aspects of smart cards, for the growing number of

applications in which they are used, are becoming

increasingly important in order to counter malicious

behavior such as identity theft and fraud. However, smart

cards use a different protocol from the ones computers use

to communicate with each other over a network. Because

of these protocol differences, a smart card when ‘‘con-

nected’’ to a computer cannot talk directly to a remote

machine using the network protocols. The computer must

use middleware to do protocol translation so that the two

protocols (i.e., card/computer and computer/network) can

understand each other. This arrangement is required for

example if a smart card needs to communicate with a

remote server on the Internet; middleware is required either

on the host computer or on both the host machine and a

remote server. Furthermore, a smart card needs a card

reader and associated drivers in order to connect with a

computer, but unfortunately most computers do not have

built-in card readers. Therefore, implementing a smart card

solution requires a supporting infrastructure including card

reader, device drivers and middleware for protocol trans-

lation. These technical constraints provided the stimulus

for research into a new generation of smart card known as

the network smart card [11], which talks directly to a

remote service provider via a host machine’s Internet

connection; i.e., sessions are handled by the network smart

card itself with the host machine providing a network

bridge to the remote server. A detailed survey of smart

cards is given in ref. [9] but we only consider the network

smart card in Sect. 3 as one type of TPD.

2.3.2 Emerging breed of TPD

The justification for network smart cards, as outlined in the

following section, is clear. However, in the face of the

increasing number of security and privacy threats leveled at

the smart card space, due to the lucrative potential afforded

by fraud, identify theft and all that this entails, a smart card

must also embody trust technology if it is to be truly

considered a TPD. This implies that the dependency of

smart cards on the perceived trustworthiness of public host

machines, to which they interface, should be eliminated

and that security, based only on cryptography and SSL/

TLS technology, needs to be augmented with trust tech-

nologies and protocols. To satisfy these requirements an

alternative breed of TPD is emerging that specifically

addresses the problem of creating a trusted environment on

an untrusted host using a combination of TPM, to establish

a root of trust, and virtualization technology supporting

virtual machines to provide isolation. As network smart

cards and TPDs evolve, utilizing similar technologies and

form factors (e.g., USB token), the technical distinction

between them will become increasingly blurred. As such

the dominant distinguishing factor between these two

classes of device will no doubt be the application scenarios

of use.

Newer types of TPD, examples of which are described

later on, fall into two broad categories when it comes to

establishing trust. The first provides trust by loading a

trusted environment at boot-time, while the second pro-

vides trust by loading a trusted environment at run-time.

Each category has its own advantages and disadvantages

with regards to usability and security. For example, for the

TPD Classifications

Emerging Breed of TPD

Traditional Smart Card - communication via card reader and middleware

infrastructure

Smart Cards

Network Smart Card - communication via

Internet TCP/IP software stack

Trust establishment at boot-time

Trust establishment at run-time

Fig. 1 TPD classifications

350 Pers Ubiquit Comput (2010) 14:347–361

123

boot-time category of TPDs, a user’s workflow is inter-

rupted as the use of this system requires a reboot of their

computer to load the trusted environment, in some

instances at the exclusion of the user’s normal operating

environment. This means that (1) the user has to interrupt

their work and load the trusted environment and (2) if the

trusted environment does not contain the appropriate soft-

ware, then the user cannot access the required functionality

to resume normal workflows. However, with regard to

security, by rebooting from a ‘‘closed’’ and trusted oper-

ating environment there is more confidence that the

established environment is more trustworthy. A significant

assumption here is made for correct operation of the sys-

tem. This assumption is that the boot sequence of a com-

puter has not been interfered with during the normal,

untrusted operation of the computer (for example, by the

introduction of a rootkit). If this assumption is valid, then

this category of TPD is more trustworthy since it has no

interaction with the native operating system (OS) of the

host machine.

As for the trust establishment of the run-time category of

TPD, the full richness of the host software is available to

the user at all times, so will not impact on normal work

practices and enhances the usability of this additional,

trusted environment for the user. However, the guest

software (OS and applications) is vulnerable to a variety of

well-known attacks from within the host OS [25, 26], and a

critical risk/benefit analysis is required before the system is

deployed and distributed to users. We consider both cate-

gories of TPD in this paper.

3 Network smart card

The network smart card, also known as a network card

[27], Internet smart card [28, 29], WebCard [30], TCP/IP

smart card and IP smart card [31], has two major benefits

over the traditional more well-known smart card, which

are, (1) a significant reduction in costs due to the

elimination of middleware and card reader development,

maintenance and deployment, and (2) the elimination of

the card reader infrastructure barrier, which opens up

opportunities to a much richer space for transactional

processing services over an increasingly pervasive Internet

due to the transparent and secure download and activation

of new card services via USB ports. The technology

choices, shown in Fig. 2 [10], are indicative of how far

network smart card technology has progressed in recent

years. We do not intend to survey all these technologies but

pick out one path (shown by the shaded boxes in Fig. 2)

which is a promising candidate for the network smart card

as a TPD of the future.

Potential TPD devices on this path exhibit some com-

pelling features at various layers:

• Physical layer: Network smart cards may be embodied in the form factor of a USB token, since USB ports

have a number of advantages: (1) they are ubiquitous in

personal computing platforms, (2) many electronic

devices, currently operate at a speed of 480 Mbits/s

(USB 2.0) and will operate at 2.4 Gbits/s for USB 3.0,

which is on the horizon. Also network smart cards

require no card reader or middleware. Although

network smart cards have recently been prototyped

[32], the USB hardware for these cards is yet to mature.

However, the issues hampering USB hardware support

should gradually diminish due to technological

advances. It is therefore quite likely that the USB

token will be the preferred technology of choice for

network smart cards, subject of course to the respective

organizational and enterprise policies.

• Link layer: There are two standards [33] that allow USB devices to be connected together at the link local

level while also offering connectivity to the wider

Internet through allowing the USB protocol to tunnel

Ethernet Frames. These two standards are the USB

Ethernet Networking Control Model (USB-ECM) and

the USB Ethernet Emulation Model (USB-EEM).

However, because USB-EEM is simpler, more

Fig. 2 Technology choices for network smart cards

Pers Ubiquit Comput (2010) 14:347–361 351

123

efficient, has good OS vendor support and has the

flexibility allow multiple USB network devices to

connect to one host, USB-EEM is regarded as the

standard of choice for implementing network smart

cards. For example, Gemalto [32] have recently

released a USB network smart cards that uses the

USB-EEM standard.

• Network/transport layer: Implementing TCP/IP inside a smart card [32] provides connectivity to the Internet for

these devices. Network smart cards still need drivers

but do not require middleware support on the host

machine because they communicate using the same

network protocol stack as do other computers con-

nected to the Internet. As such, TCP/IP smart cards are

essentially network nodes where the hosting computer

performs IP routing for the smart card to send or

receive messages to/from the remote machine.

• Device drivers: Interfacing between the communication hardware and the OS’s communication stack requires

specialized software device drivers. In the case of the

network smart card, the device driver is responsible for

taking Ethernet frames and associated protocols from

the OS and converting it into protocols and message

formats of the USB hardware. USB-EEM has been

endorsed in principle by major vendors (Microsoft,

Apple), and have indicated that they plan to include

USB-EEM drivers [34] in future releases of their OS. In

the mean time, commercially available drivers are

available [35] to allow network smart cards to be used

with current releases of the popular OS.

It is envisaged that future generations of network smart

cards will incorporate virtualization and virtual machine

technology with TPM to enable attestable trusted transac-

tions across the network. This technology, coupled with

full speed USB communication hardware, EEM drivers for

carrying Ethernet frames, TCP/IP and SSL/TLS on card,

will enable the realization of new use case scenarios that

require only a USB token device for trusted and secure

communications. Such a device raises a number of inter-

esting challenges. One of which is, instead of carrying

around a pocket full of USBs, i.e., one per application, as is

the case for current smart card technology (e.g., one per

financial institution) how can a single device be made to

service many applications spanning different enterprises?

This raises some interesting questions regarding device

management such as, who issues this ‘‘universal’’ device (a

central agency on behalf of an enterprise collective?), how

can applications be kept isolated from each other so that

there is no leakage of information between applications

(Type I/II/hybrid VMs?) and how are devices revoked if

lost/stolen? As hinted at above, virtualization, VM and

TPM technologies will play a significant part in answering

some of these, and other, questions and will consequently

motivate research into appropriate mechanisms for the

management of multi-application devices. The combina-

tion of these powerful technologies bodes well for future

generations of network smart card.

4 An emerging breed of TPD

To convey what we mean by this category, we give an

overview of three representative devices. Apart from the

objective of creating a trusted environment on an untrusted

machine, each device surveyed has a network connection

enabling the download of information from anywhere. The

first device, known as trust extension device (TED), is

covered in more detail since we have first hand experience

of it [36, 37]. The other two devices reviewed are Digital

Online Registration and Identification System (DORIS)

with Dynamic Isolation of Virtualized Applications

(DIVA) [38, 39] and Encryptakey [40]. The three devices

surveyed demonstrate the technologies and applications of

use for these new TPDs. We are also aware of other

devices, such as SoulPad [41], which is a portable (USB)

artifact carrying a software stack (guest applications and

OS, encrypted VM, VMM and auto-configuring host OS),

that allows a user to resume a personal computing session,

on an untrusted machine, that was suspended on another

machine. SoulPad is conceptually similar to Internet Sus-

pend and Resume [42] and is self-contained in that it does

not need to connect to the network to download informa-

tion from a remote entity. This is in contrast to the concept

behind the reviewed devices, where TED, Encryptakey and

DORIS/DIVA, enable end users to connect to remote

entities. Categorizing the devices surveyed in accordance

with the classifications outlined above, the current imple-

mentation of TED and DORIS/DIVA establish trust at run-

time whereas Encryptakey and SoulPad establish trust at

boot-time.

4.1 Trust extension device

Within the enterprise environment a common method of

establishing trust between a client and a remote entity is to

use certificates. A remote entity issues a certificate to a

client, which the client then uses to establish a trust rela-

tionship between the local machine on which the client is

working and the remote (certificate issuing) authority.

However we have identified two main shortcomings with

issuing digital certificates, which are:

• Lack of trustworthiness: Certificates are vulnerable to software attacks and as a consequence so is the

information guarded by them.

352 Pers Ubiquit Comput (2010) 14:347–361

123

• Mobility and portability: Digital certificates can be used on any computer to bind an identity to a computer’s

pair of electronic keys which are used to encrypt and

sign digital information. Unless a certificate can be

bound to a machine of use then there is no way of

authenticating the trustworthiness of the machine as a

valid source.

In order to address the first problem, the Trusted Com-

puting Group (TCG) has proposed a hardware-based trus-

ted system. Trusted systems that are specified, for example

in accordance with the TCG [24], are often assumed to be

used in well managed and controlled computing and net-

working elements of an infrastructure typically belonging

to a single enterprise. If however the certificate is bound to

a machine, for example using TPM, then clients must use

this particular machine to establish a trust relationship with

the remote host. This constrains the certificate to a partic-

ular machine. Furthermore, this managed infrastructure and

its elements are assumed to have a completely controlled,

uniform operational environment, including standard set of

applications, OS, hardware platforms and facilities for

issuing, revoking and maintaining encryption keys and

authorization certificates (such as PKI [43]). Because these

assumptions do not hold in situations where there are either

mobile or heterogeneous, unmanaged Internet connected

elements, deployment and uptake of trusted secure systems

based on TPM has not been as successful has been very

limited. The approach with TED for overcoming these

limitations is based on the realization that the issuing

enterprise typically will have complete control of a small,

limited range of functions and applications available to the

users through a standardized operational environment. This

operational environment (hardware platform, drivers, OS

and applications) is completely defined and controlled by

the issuer of the TED when the device is created, and user

based changes are not possible. This allows the deployment

of portable, trusted and secure systems on heterogeneous

computing and networking infrastructure.

Trust extension device was invented to address these

two shortcomings; the first was addressed by using trusted

computing technologies, namely TPM in the TED and the

second by using virtualization technologies. Virtualization

technologies enable the implementation of a virtual

machine [23] (with associated memory, input/output and

network resources) which runs as an application of the host

OS. The key features of TED include:

• Incorporation of trusted computing technologies into a portable device.

• Use of these trusted computing technologies to estab- lish trust.

• The needs for TED to be physically close to, and connected to, an untrusted host that provides the

underlying resources (i.e., computer peripherals and

network connections).

• Use of virtual machine technology in combination with trusted computing technologies to create a trusted

environment on untrusted host machines. The virtual

machine technology creates an operating environment

and the remote attestation technology uses the TPM

microcontroller in the portable device to establish trust.

4.1.1 Context of use

Physically, TED is a ‘‘closed-box’’ system (i.e., tamper

resistant) that can be conveniently carried in the pocket.

TED launches its own OS and a combination of precon-

figured applications and other software service modules

that are loaded by service providers in accordance with the

attestation protocol described in Fig. 3. The central com-

ponent of the attestation procedure is the TED manager,

which issues TEDs offline and verifies their run-time

integrity. The TED manager also acts as a centralized

certifying authority on behalf of multiple third party service

operators. In this arrangement it is possible for a TED to

host service modules (i.e., service applications) from

multiple service providers, with the burden of attestation

for each service provider handled by the TED manager.

The interactions shown in Fig. 3, between a TED, TED

manager and third party service providers, are briefly

described as follows [5]:

• Steps 1 and 2: For the TED manager to act as the certifying authority and trust attester, all service

providers must register themselves and update their

service module signatures with the TED manager.

• Step 3: When a user subscribes to a particular service, the TED sends a request to the service provider to

acquire the appropriate service module.

• Step 4: On receiving the request, the service provider sends a challenge to the TED.

• Steps 5 and 6: On receiving the challenge, the TED’s TPM generates a session key which in turn is used to

digitally sign the ‘‘integrity measurement’’ of the TED.

• Step 7: The Platform Configuration Register stores the integrity measurement, including all existing service

modules (i.e., sm0 … smi), which is sent to the TED manager for verification.

• Step 8: On receipt of the integrity measurement, the TED manager attests its trustworthiness against the

TPM credentials and the service module signatures.

Note that these signatures were previously uploaded by

the service providers in point 2.

• Step 9: After successfully verifying the integrity measurement, the TED manager issues a signed service

credential which is sent back to the TED.

Pers Ubiquit Comput (2010) 14:347–361 353

123

• Step 10: The TED, on receiving and verifying the service credential, sends it in a challenge response to

the service provider.

• Steps 11 and 12: Upon receipt of the challenge response and verification of the service credential (signed by the

TED manager), the service provider issues the

requested service module to the TED.

This protocol shows the applicability of trust attestation

for TED wherever it is plugged into an untrusted envi-

ronment. Also we envisage that a single TED can suffice

for running different applications supported by various

service providers, instead of having a TED per service

provider. To ensure integrity of the whole collaboration

life-cycle all transactions between a TED and a service

provider are mutually attested using procedures similar to

those described in ref. [44].

We believe that the combination of trust portability,

application specificity and service provider independence

coupled with TPM and virtual machine technology distin-

guishes the TED from other TPDs in the same class.

4.1.2 TED emulation

To demonstrate aspects of trust portability, on a simplified

testbed, a software-emulated TED was developed with

associated trust attestation protocols. The emulated TED

fulfils the following criteria:

• The compelling physical attributes of TED, namely, self-contained, powered by the host and portability, are

preserved.

• No special software is required in the host computer to support TED operations.

• There is no need to reboot the host. • The accommodation of a guest OS within a virtual

machine to resemble the self-contained trusted envi-

ronment of an envisaged hardware implementation.

• The primary functionality of TED shall be trust attestable.

A first implementation of an emulated TED was a USB

memory stick preloaded with a number of software pack-

ages. Referring to Fig. 4, the guest OS (Ubuntu v 6.06 [45])

was supported by QEMU virtualization software (v 0.8.2

[46]) to achieve isolation between the guest and host OS.

The QEMU product was selected because its operation

does not require the installation of special drivers in a host

machine. To emulate the TPM function the software-based

TPM Emulator v 0.4 [47] was used which runs on top of

the Ubuntu guest OS.

A simple demonstration of TED portability is shown in

Fig. 5, using an online banking application. Here the TED

manager and the third party service provider are combined

in a single entity. The network was preconfigured for three

laptops where two laptops acted as untrusted hosts and the

third as the TED manager/service provider. The USB was

TPM

TED

3rd party service

provider

TED manager

1. register service provider

2. update all service module signatures

sm0

3. service request

4. challenge

7. pass integrity measurement to the TED manager

smi

9. service credential (certificate signed by the TED manager)

10. challenge response(service cred)

12. challenge success(smj)

5. generate session key

6. generate integrity measurement with the session key

8. verify integrity measurement and generate service credential

11. verify service credential signed by TED manager

Fig. 3 Trust attestation procedures for issuing a service

module to a TED

PC Hardware

Host Operating System

Host ApplicationsVirtualisation Software

Guest Operating System

Secure Applications

TPM

Untrusted Host

Emulated TED

Fig. 4 Functional components of emulated TED

354 Pers Ubiquit Comput (2010) 14:347–361

123

preloaded with the Ubuntu, QEMU and TPM software

packages plus an online banking application. On plugging

the TED into an untrusted host, the QEMU virtual machine

is first launched and once running, the Ubuntu guest OS is

then launched. Again, when the guest OS is running, the

banking client is invoked and automatically attested by the

service provider once the client logs in.

Each transaction in this implementation of the TED

requires that it successfully completes the trust attestation

protocol. For example, client record with account details

are transferred to the TED (see Fig. 6) only once the trust

attestation successfully completes. To demonstrate trust

portability of TED, the USB memory stick upon which it

was implemented was unplugged and inserted into another

untrusted, and as before the online banking application

launched and was trust attested. This arrangement was

successfully demonstrated to and well received by the

members of a commercially based Enterprise Focus Group

[48] in May 2007. Figure 6 shows a demonstration screen

snapshot of the user interface, i.e., the emulated TED

operating within the host environment. Within the QEMU

virtualization window, the Ubuntu guest OS runs the online

banking application to retrieve a customer’s record. A

logging window (used for debugging) shows the operation

of the trust attestation protocol, i.e., a session key is suc-

cessfully attested by the TED manager of the service

provider.

TED Manager and 3rd Party

Service Provider

Untrusted Host #1

Untrusted Host #2

Emulated TED

online banking

application

attestation protocol

Fig. 5 Simplified demonstration of TED portability

Fig. 6 Screen snapshot of the emulated TED demonstrating an

online banking application

Pers Ubiquit Comput (2010) 14:347–361 355

123

4.2 DORIS/DIVA

4.2.1 DORIS

As part of its ‘‘Securing the Intelligent Nation’’ initiative the

Singaporean Ministry of Home Affairs [38] has introduced

a standardized nationwide security smart token called

DORIS which is a ‘‘security innovation driving Singapore’s

nationwide proliferation of personal security devices’’ [39].

This token offers all Singaporean companies and citizens a

single security-certified solution that allows, for example,

corporate PC logon, contractor visitor management, canteen

payment, and biometric entry access. Used as a form of

‘‘mobile identity’’ with multiple factor authentication,

DORIS is also implemented in a USB sized memory stick,

but with the addition of a secure microcontroller, flash-

based, some wireless communications chips and a small

antenna, along side the usual memory. The device com-

municates with a transceiver through a wireless interface

that supports electronic identity and online/offline authen-

tication. DORIS generally supports existing PC applications

because they can leverage off the many encryption and key

management features supported by companies like Micro-

soft and Adobe to ensure information integrity and confi-

dentiality [49]. DORIS is based on the Smart Visa for

Identification with Passport (VIP) [50] and supports virtual

smart cards [51] where a user can have a virtual card for

each organization. One implementation of virtual smart

cards is where DORIS is used in conjunction with digital

identity applications such as Microsoft’s CardSpace [52].

Microsoft CardSpace is an identity selector for Windows

that enables users to provide their digital identity online in a

more simple and secure way. The DORIS token further

enhances its security by providing strong multifactor cre-

dentials for authenticating the Microsoft Security Token

Service [53] when using CardSpace.

However, when plugged into a host machine, DORIS

needs to download the appropriate driver for the virtual

smart card utilized. This presents a number of non-trivial

operational issues, which are addressed by a subsequent

development known as DIVA, as explained in the follow-

ing section.

4.2.2 DIVA

To overcome the limitations of DORIS a software

enhancement was developed called DIVA, which acts as a

user’s own trusted software execution space to provide

secure access to a wide variety of applications. A core

function of the DIVA software is also to authenticate the

identity of a user in an electronic transaction.

When plugged into a PC, DIVA creates an isolated

command window which allows a user to run any

applications within it; at the same time applications con-

tinue to run on the local PC environment but isolated from

the DIVA created command window. By way of example,

when an application runs on the local PC, such as Internet

Explorer (IE), DIVA creates a separate copy of IE and runs

it isolated from the host environment in the command

window; this is what the developers of DIVA call a virtual

application (see Fig. 7). Furthermore, the user interacts

with the virtual application via a virtual keyboard to mit-

igate the risk of key stroke logging attacks. A virtual

application never interacts with a remote entity (e.g., bank

server) directly but rather indirectly via the Web Server

within DIVA. The DIVA Web Server talks to the remote

entity in a peer-to-peer fashion, which provides a safeguard

to help evade many possible attacks.

With DIVA, mobile users’ no longer need to take a PDA

or notebook with them. Instead they can simply plug a USB

device into someone else’s PC (at a Kiosk, hotel/airport,

client’s office, etc.) start DIVA and then work securely in

an isolated and trusted environment. And, when DIVA is

disconnected from the hosting machine no trace of trans-

acted activity remains on the machine.

4.3 Encryptakey

Encryptakey is a small portable (USB form factor) device

that allows mobile users access to their remote data at

anytime, from anywhere using any platform (e.g., Win-

dows, Mac, Linux) such that the data accessed is com-

pletely secure [40]. Encryptakey is a biometrically

authenticated device which offers multiple levels of

authentication and comprises of a specialized microcon-

troller, memory, RFID capability and Bluetooth interface.

One scenario of use for Encryptakey is when a tax agent,

working on behalf of a government tax office, needs to

audit clients’ tax records at the clients’ premises. The agent

plugs Encryptakey into any client PC to create a trusted

environment in which to work when connecting to a remote

machine (e.g., tax office server). The key to creating a

trusted environment on an untrusted host is that En-

cryptakey, when plugged into a local computer, unloads the

native OS of the host machine and downloads its own OS

which it works with exclusively. In doing so Encryptakey

is shielded from any form of malware (e.g., viruses, key

loggers, screen scrapers) that may reside on the OS of the

host machine. Furthermore, the Encryptakey OS is

embedded in its microchip such that it cannot be written to

and hence nothing can be saved. As such the Encryptakey

environment is completely isolated from the untrusted host

machine’s environment. On loading the Encryptakey OS,

the appropriate encryption algorithm is selected and a VPN

tunnel is created providing direct login to a remote

machine for secure download of applications.

356 Pers Ubiquit Comput (2010) 14:347–361

123

Encryptakey embodies the same principle of isolation

for creating a trusted environment on an untrusted host

machine similar to TED and DORIS/DIVA, albeit using a

different technical approach. One significant difference

however between TED and Encryptakey is that TED does

not unload the native OS to install its own OS as En-

cryptakey does, but loads a guest OS atop of the host OS.

5 Enhanced PDAs and cell phones

Trust is recognized to be a significant issue in the suc-

cessful deployment and uptake of specialized, secure

applications. These applications are frequently driven by

the daily demands of commonplace activities like on-line

shopping and remote access to personal computers from

ubiquitous public domain computing terminals. In addition

to network smart cards and the emerging breed of TPD

cited above, recent research [54–56] has demonstrated how

general purpose PDAs and cell phones may be enhanced to

function as TPDs. But before moving on, we need to clarify

that although PDAs and cell phones are already recognized

as being personal trusted devices, in the sense that they are

tamper proof entities operating within a ‘‘closed’’ appli-

cation framework, such as GSM/UTMS or 3 G, they still

require enhancement in order to authenticate the identify

and integrity of credentials prior to the transacting of

sensitive information between local and remote entities in

the context of interfacing to untrusted public machines.

These enhancements strengthen the trust element of

transaction processing for PDAs and cell phones, in the

sense that trust adds to the overall security of the ‘‘closed’’

systems within which these devices operate. Following are

a number of representative examples, each of which is a

very thorough and comprehensive piece of research, of the

type of work ongoing in this area. The first two examples

consider two distinct problems in on-line shopping: pro-

viding non-repudiable proof of transactions, and the second

to prevent illicit capture of sensitive personal information.

The final example shows how the integrity, and hence

trustworthiness, of a publicly accessible information kiosk

can be maintained.

1. Resolving credit card disputes when dealing with on-

line shops remains an issue. For example, the current

resolution mechanisms are not particularly attractive,

with the vendor (or in some circumstances, the issuing

bank) responsible for refunding disputed transaction.

For example, should the customer refute the purchase

of an item from an on-line vendor, the bank must

charge the vendor in order to recover the costs to

reimburse the customer. Usually, the primary cause of

such disputes arises from the fact that there is no

requirement for a strong, non-repudiable signature to

be associated with every electronic credit card trans-

action. The use of on-line certificates and signatures

USB device containing DIVA

DIVA isolated command window running virtual application

Host machine

PC application copied to DIVA command window

Virtual keyboard

Another instance of a command window running a different virtual application

Fig. 7 Dynamic isolation of virtualized applications with

virtual keyboard

Pers Ubiquit Comput (2010) 14:347–361 357

123

from the customer’s computer to provide the non-

repudiable signature is fraught with the usual trust

problems caused by the fact that the customer’s

computer is in an unknown, and possibly malicious,

state and there are no guarantees about the integrity of

the certificates or keys used to sign a transaction. The

solution proposed in ref. [54] is based on the use of a

device such as a Smartphone or GSM connected PDA.

This device comprises of several components:

a. A tamper proof component such as a smart card,

containing information (the customer’s private

key, and a non-repudiation PIN entered by the

customer) that allows the customer to generate the

signed transaction authorization.

b. A small, trusted payment application accessible to

the user.

c. The SIM Application Toolkit (STK) [55] for GSM

systems (or USIM Application Toolkit for 3G

systems) allowing access to value added services

from their handset.

d. A set of security services for subscriber identifi-

cation and protection of the air interface through

STK communication. These services together with

appropriately managed digital signatures, provide

customer authentication and proof of receipt,

assure that messages are delivered without inter-

ference or modification and be used to detect

anomalous behaviors (such those caused by man-

in-the-middle attacks).

This represents a closely controlled application devel-

opment environment and platform, and allows the devel-

opment of tailored security solutions in this prototype TPD.

In order to overcome the credit card dispute problem

pointed out earlier, the TPD prototype is meant to be used as

follows. First, the customer negotiates the purchase through

the use of the Internet connected untrusted computer. When

complete and final payment is required, the smartcard/PDA

uses a combination of the above components and a separate

message authorization channel—the GSM network—from

that of the purchase negotiation—the Internet—is used to

provide the non-repudiable authorization and signatures for

that transaction. This authorization channel (and associated

components and environment) is trusted. The negotiation

channel (i.e., the customer’s computer and Internet connec-

tion) is assumed to be untrusted. By separating out the

transaction to rely on these channels, clearly partitioning the

system into trusted and untrusted components, and applying

the correct protocols allows each on-line credit card trans-

action to have a non-repudiable authorization.

2. The second example [56] is based on using a PDA to

provide user defined access controlled information and

offer a known trusted environment, including a

physically alternate keyboard and secondary display.

This minimizes the risks on any transactions that are

initiated from the PDA: key loggers, screen scrapers

and memory attacks are defeated since the keyboard,

display and memory space (holding sensitive informa-

tion, keys and certificates) are completely separate

from the untrusted computer that the device plugs into.

The intended use is that this modified PDA plugs into

some local, untrusted computer to provide access to

the user’s (remote) home computer. The PDA provides

a secured keyboard and mouse access that is ‘‘invis-

ible’’ to the untrusted local computer, and allows for

portions of the user’s home computer information to be

securely accessed and displayed through the local

untrusted machine and onto the PDA. The user,

through the use of the modified PDA, specifies what

is accessible in their home computer or system, and

authenticates all input events (mouse and keyboard)

against their home computing environment through an

encrypted SSL connection. The PDA never exposes

the authentication credentials used to encrypt the input

events to the untrusted terminal, making it difficult for

the untrusted terminal to issue its own input events.

Furthermore, the PDA also issues and updates time

limited credentials to the untrusted terminal. These

credentials are used to display selected components of

the home computer through the use of a virtual desktop

application executing on the PDA. Upon session

completion and termination, or unplugging of the

PDA from the local untrusted computer, the last issued

credential expires and leaves the local computer

unable to access the user’s remote home computer.

This combination of the PDA features, and allowing

controlled, read only access by the untrusted local

computer assures the user of secure transaction with

their home computer system.

3. Publicly accessible computers are commonly available

at Internet cafés and airport terminals and configured

as kiosks. But although these offer the benefits of free

or low cost publicly accessible Internet connected

computers, little can be assumed about their integrity

or trustworthiness due to the pervasiveness of malware

(e.g., keystroke logging, screen scraping and memory

attacks). In some circumstances, users need to be

assured that transactions and exchange of sensitive

information are secure and the kiosk operates in a

trusted manner. The research presented in ref. [19]

addresses this issue by using a mobile device that

connects to the kiosk to provide the assurance that the

kiosk is running only trustworthy software. This is

done through the use of an attestation protocol to

358 Pers Ubiquit Comput (2010) 14:347–361

123

verify the identity and integrity of the software running

on a kiosk.

It is assumed in the article that each kiosk has a TPM

cryptographic microcontroller built in, and this is used

within an Integrity Measurement Architecture (IMA) [57]

incorporating the mobile device. The mobile device runs an

IMA verifier client, with the kiosk running an IMA server.

The verifier client has access to the expected hash values of

all software components loaded on a kiosk. The kiosk

calculates, through the use of the TPM, the current set of

hash values and (as per the TPM 1.2 specification) signs

them. These two items are then compared, and if the

attestation protocol completes successfully (i.e., the

expected hash values agree with the received IMA mea-

surement list and signed TPM quote), the mobile device

then informs the user that that the kiosk is trustworthy. The

user may then proceed to reveal personal information via

the kiosk. A prototype of this device is described in ref.

[19]. A minor extension of this scenario supports the case

where the user wishes to run their personal applications on

a kiosk. In this case, the trust establishment protocol out-

lined above is modified so as to verify that a kiosk is

running a trustworthy hypervisor environment. Once con-

firmed, the user is then allowed to run a virtual machine

which then executes the user’s personal applications on the

kiosk.

6 Conclusions

Such is the momentum that is building in the area of trust

that it is now timely to take a snapshot, as we have done

within this paper, of an array of representative portable

TPDs, both commercial and research, that enable mobile

users to safely work from anywhere using untrusted host

machines. Although the TPDs surveyed use current tech-

nologies in an innovative way to achieve their desired

objectives, we believe that virtualization, as it becomes

more ubiquitous, will be the dominant technology influ-

encing future generations of TPD. To support this claim,

the TCG [24], have instigated a new work group on vir-

tualized computing platforms. The TCG defines a trusted

virtualized computing platform as ‘‘a platform with an

interface to virtualized hardware, that publishes evidence

about the trustworthiness of the interface and the entity that

implements the interface’’. The charter for this work group

is to create specifications to enable users and third parties

to trust virtualized trusted computing platforms, incorpo-

rating mainstream commercial products like hypervisors

and virtual machines, which are embedded in PC clients,

servers and mobile phones; and also we believe TPDs.

Furthermore, the utilization of virtualized platforms for

different use case scenarios will raise many issues that will

undoubtedly impact the shaping of future of TPDs.

Although smart cards continue to make advances [58], we

believe there will be an increasing overlap with the

emerging breed of TPD brought about by the unifying

influence of virtualization, VMs and TPM.

The focus on TPDs so far has been driven mainly by

technology. However, one important aspect of TPDs that

has not been adequately addressed is their usability. The

usability of the TPDs has two important aspects: the

environment within which they operate and the form factor

of the device. With regard to the form factor, we believe

that the ubiquity and capacity of the USB memory stick

will be a popular choice for TPDs. However, further

analysis is required to ascertain what form factor is likely

to dominate in a particular environment, i.e., USB device,

smart card, mobile phone, etc. The other usability aspect of

TPDs is the environments within which they will operate.

For example, how easy is the TPD to program (software

downloads), how secure are they in untrusted environs,

how well do they perform, can one TPD be used for

multiple organizations? These questions, and others, need

to be rigorously tested and evaluated in ‘‘stretching’’ sce-

narios of use. We believe that there is much further work to

be done in the areas of usability, just outlined, from the

users experience perspective.

References

1. Erl T (2005) Service-oriented architecture (SOA): concepts,

technology and design. Prentice Hall, Upper Saddle River

2. W3C Web Services Activity. http://www.w3.org/2002/ws

3. Chan J, Rogers G, Agahari D, Moreland D, Zic J (2006) Enter-

prise collaborative contexts and their provisioning for secure

managed extranets. In: Proceedings of the 15th IEEE interna-

tional workshops on enabling technologies: infrastructure for

collaborative enterprises (WETICE’06), Manchester, pp 313–318

4. Camarinha-Matos L, Afsarmanesh H (2005) Collaborative net-

works: a new scientific discipline. J Intell Manuf 16:439–452

5. Chan J, Nepal S, Moreland D, Hwang H, Chen S, Zic J (2007)

User-controlled collaborations in the context of trust extended

environments. In: Proceedings of the 16th international work-

shops on enabling technologies: infrastructure for collaborative

enterprises (WETICE’07), Paris, pp 389–394

6. Camarinha-Matos L, Afsarmanesh H, Ollus M (2005) Virtual

organizations: systems and practices. Springer, Boston

7. Plisson J, Ljubic P, Mozetic I, Lavrac N (2007) An ontology for

virtual organization breeding environments. IEEE Trans Syst

Man Cybern C 37(6):1327–1341

8. Henkel M, Perjons E, Zdravkovic J (2007) Towards guidelines

for the evolution of e-service environments. Int J Public Inf Syst

3:183–200

9. Rankl W, Effing W (2004) Smart card handbook. Wiley, New

York

10. Lu H (2007) Network smart card review and analysis. J Comput

Netw 51(9):2234–2248

Pers Ubiquit Comput (2010) 14:347–361 359

123

11. Aussel J (2007) Smart cards and digital security. In: Proceedings

of the 4th international conference on mathematical methods,

models and architectures for computer network security (MMM-

ACNS), St Petersburg, pp 42–56

12. Prinz W, Loh H, Pallot M, Schaffers H, Skarmeta A, Decker S

(2006) ECOSPACE—towards an integrated collaboration space

for eProfessionals. In: The 2nd international conference on col-

laborative computing: networking, applications and worksharing

(CollaborateCom’06), Atlanta, pp 1–7

13. Wilson M, Arenas A, Schubert L (2007) IST-FP6 TrustCoM

framework for trust, security and contract management V4.

http://www.eu-trustcom.com

14. Bobba R, Gavrila S, Gligor V, Khurana H, Koleva (2005)

Administering access control in dynamic coalitions. In: Pro-

ceedings of the 19th large installation system administration

conference (LISA’05), San Diego, pp 249–261

15. Seamons K, Chan T, Child E, Halcrow M et al (2003) Trust-

Builder: negotiating trust in dynamic coalitions. In: Proceeding of

the DARPA information survivability conference and exposition,

vol 2, Washington, pp 49–51

16. Ajayi O, Sinnott R, Stell A (2007) Trust realisation in multi-

domain collaborative environments. In: Proceedings of the 6th

IEEE/ACIS international conference on computer and informa-

tion science (ICIC’07), Melbourne, pp 906–911

17. Asokan N, Debar H, Steiner M, Waidner M (1999) Authenti-

cating public terminals. J Comput Netw 31:861–870

18. Surie A, Perrig A, Satyanarayanan M, Farber D (2006) Rapid

trust establishment for transient use of unmanaged hardware. In:

Technical Report CMU-CS-06-176

19. Garriss S, Caceres R, Berger S, Sailer R, Van Doorn L, Zhang X

(2007) Towards trustworthy Kiosk computing. In: Proceedings of

the 8th IEEE workshop on mobile computing systems and

applications (HotMobile’07), Tucson, pp 41–45

20. Lin C, Varadharajan V (2006) Trust enhanced security—a new

philosophy for secure collaboration of mobile agents. In: Col-

laborative computing: networking, applications and worksharing

(CollaborateCom’06), Atlanta, pp 1–8

21. Bormann F, Manteau L, Linke A (2005) European research

project ‘‘InspireD’’ (http://www.inspiredproject.com)—the future

of smart cards. In: SIT Smart Card Workshop, Darmstadt

22. Bormann F, Manteau L, Linke A, Pailles J, Dijk J (2006) Concept

for trusted personal devices in a mobile and networked envi-

ronment. In: 15th IST mobile and wireless communication

summit, Myconos

23. Smith J, Nair R (2005) Virtual machines: versatile platforms for

systems and processes. Morgan Kaufmann, San Francisco

24. Trusted Computing Group. http://www.trustedcomputinggroup.

org

25. Ormandy T (2007) An empirical study into the security exposure

to hosts of hostile virtualized environments. In: The 8th annual

CanSecWest conference, Vancouver

26. Ferrie P (2006) Attacks on virtual machine emulators. In: The 9th

annual association of antivirus Asia researchers international

conference (AVAR’06), Auckland

27. Montgomery M, Ali A, Lu H (2004) Secure network card—imple-

mentation of a standard network stack in a smart card. In: Proceedings

of the 6th international conference on smart card research and

advanced application (Cardis’04), Toulouse, pp 193–208

28. Giesecke & Devrient Internet Smart Card Technology (2006)

http://www.gi-de.com/portal/page?_pageid=42,54860&_dad=

portal&_schema=PORTAL

29. Urien P (2000) Internet card, a smartcard as a true Internet node. J

Comput Commun 23(17):1655–1666

30. Rees J, Honeyman P (2000) Webcard: a Java card web server. In:

Proceedings of the 4th working conference on smart card research

and advanced application (Cardis’00), Bristol, pp 197–208

31. Zouari B, Afifi H, Hecker A, Labiod H, Pujolle G, Urien P (2003)

A novel authentication model based on secured IP smart cards.

In: Proceedings of the IEEE International Conference on Com-

munications (ICC ‘03), vol 2, Anchorage, pp 809–813

32. Gemalto (formerly Axalto and Gemplus). http://www.gemalto.

com

33. USB Implementers Forum. http://www.usb.org/

34. Remote NDIS (RNDIS) and Windows (2004). http://www.

microsoft.com/whdc/device/network/NDIS/rmNDIS.mspx

35. Belcarra Technologies Extends USBLAN Support for Microsoft

Windows TM

to Include Ethernet Emulation Model (2006).

http://www.belcarra.com/pdf/usb-otg-eem_announce_1.0.pdf

36. Nepal S, Zic J, Hwang H, Moreland D (2007) Trust extension

device: providing mobility and portability of trust in cooperative

information systems. In: Proceedings of the 15th international

conference on cooperative information systems (CoopIS’07),

LNCS 4803, Vilamoura, pp 253–271

37. Nepal S, Zic J (2006) A portable trusted device. In: Provisional

Australian Patent

38. Ministry of Home Affairs Singapore (2006) In: The 15th annual

governmentware securing intelligent enterprises (GovWare’06),

Singapore

39. Gratzer V, Naccache D (2007) Trust on a nationwide scale. IEEE

Secur Priv Mag 5(5):69–71

40. Encryptakey. http://www.encryptakey.com

41. Caceres R, Carter C, Narayanaswami C, Raghunath M (2005)

Reincarnating PCs with portable SoulPads. In: Proceedings of

the 3rd international conference on mobile systems, applica-

tions, and services (MobiSys’05), ACM Press, New York, pp

65–78

42. Kozuch M, Satyanarayanan M, Bressoud T, Helfrich C, Sinna-

mohideen S (2004) Seamless mobile computing on fixed infra-

structure. IEEE Comput 37(7):65–72

43. Adams C, Lloyd S (2002) Understanding PKI: concepts, standards,

and deployment considerations. Pearson Education, London

44. Nepal S, Zic J, Kraehenbuehl G, Jaccard F (2007) A trusted

system for sharing patient electronic records in autonomous

distributed healthcare systems. Int J Healthc Inf Syst Informat

2(1):14–34

45. Ubuntu. http://www.ubuntu.com

46. QEMU. http://fabrice.bellard.free.fr/qemu

47. TPM. http://developer.berlios.de/projects/tpm-emulator

48. CeNTIE Enterprise Systems Focus Group. http://www.ict.csiro.

au/page.php?did=14#enterprise

49. Tan L (2007) Personal security gets DIVA treatment. In: Busi-

nessWeek. http://www.businessweek.com/globalbiz/content/

sep2007/gb20070926_102683.htm?chan=top?news_top?news?

index_global?business

50. Ong A (2004) Smart VIP (smart visa for identification with pass-

port). http://www.ida.gov.sg/Technology/20061002195651.aspx

51. Forget G, Stervinou A (2007) The virtual smart card. Card

Technol Today 19(7–8):12

52. Microsoft Development Network (MSDN) CardSpace. http://

msdn2.microsoft.com/en-au/netframework/aa663320.aspx

53. Microsoft Live Labs Security Token Service (2006) http://sts.

labs.live.com/

54. Bottoni A, Dini G (2007) Improving authentication of remote

card transactions with mobile personal trusted devices. J Comput

Commun 30(8):1697–1712

55. European Telecommunications Standards Institute (ETSI) Digital

cellular telecommunications system (Phase 2?); specification of

the SIM application toolkit for the subscriber identity module—

mobile equipment (SIM–ME) interface. ETSI TS 101 267 (GSM

11.14)

56. Oprea A, Balfanz D, Durfee G, Smetters D (2004) Securing a

remote terminal application with a mobile trusted device. In:

360 Pers Ubiquit Comput (2010) 14:347–361

123

Proceedings of the 20th annual computer security applications

conference (ACSAC’04), Tucson, pp 438–447

57. Sailer R, Zhang X, Jaeger T, Van Doorn L (2004) Design and

implementation of a TCG-based integrity measurement

architecture. In: Proceedings of the 13th USENIX security sym-

posium, San Diego, pp 223–238

58. Mayes K, Markantonakis K (2008) Smart cards, tokens, security

and applications. Springer, New York

Pers Ubiquit Comput (2010) 14:347–361 361

123

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

  • c.779_2009_Article_235.pdf
    • A snapshot of trusted personal devices applicable to transaction processing
      • Abstract
      • Introduction
        • Motivational areas
      • Trusted personal devices
        • A definition of trust
        • What is a trusted personal device?
        • Classification of trusted personal devices
          • Smart cards
          • Emerging breed of TPD
      • Network smart card
      • An emerging breed of TPD
        • Trust extension device
          • Context of use
          • TED emulation
        • DORIS/DIVA
          • DORIS
          • DIVA
        • Encryptakey
      • Enhanced PDAs and cell phones
      • Conclusions
      • References

Sources/Dangerous WiFi AP.pdf

O R I G I N A L A R T I C L E

Dangerous Wi-Fi access point: attacks to benign smartphone applications

Min-Woo Park • Young-Hyun Choi •

Jung-Ho Eom • Tai-Myoung Chung

Received: 2 July 2013 / Accepted: 26 September 2013 / Published online: 29 October 2013

� Springer-Verlag London 2013

Abstract Personalization by means of third party appli-

cation is one of the greatest advantages of smartphones. For

example, when a user looks for a path to destination, he can

download and install a navigation application with ease

from official online market such as Google Play and

Appstore. Such applications require an access to the

Internet, and most users prefer Wi-Fi networks which are

free to use, to mobile networks which cost a fee. For this

reason, when they have no access to free Wi-Fi networks,

most smartphone users choose to try to use unknown Wi-Fi

access points (AP). However, this can be highly dangerous,

because such unknown APs are sometimes installed by an

adversary with malicious intentions such as stealing

information or session hijacking. Today, smartphones

contains all kinds of personal information of the users

including e-mail address, passwords, schedules, business

document, personal photographs, etc., making them an

easy target for malicious users. If an adversary takes

smartphone, he will get all of information of the users. For

this reason, smartphone security has become very impor-

tant today. In wireless environments, malicious users can

easily eavesdrop on and intervene in communication

between an end-user and the internet service providers,

meaning more vulnerability to man-in-the-middle attacks.

In this paper, we try to reveal the risk of using unknown

APs by presenting demonstration results. The testbed is

composed of two smartphones, two APs, and one server.

The compromised AP forwards messages of victim

smartphone to the fake server by using domain name sys-

tem spoofing. Thus, the application that is running on the

victim smartphone transfers HTTP request to the fake

server. As a result, this application displays the abnormal

pop-up advertisement, which contains malicious codes and

links. Our demonstration shows that merely connecting to

compromise APs can make a malicious behavior even the

applications are benign.

Keywords Security of smartphone application � Wireless security � Man-in-the-middle attack � Smartphone and ubiquitous computing

1 Introduction

The technology of mobile phones has advanced dramati-

cally over the last decade, in both hardware and software.

The performance of its hardware is now almost comparable

with portable computers. For example, the Samsung Gal-

axy S3 manufactured in 2012 contains in it a 1.5 GHz dual-

core processor and a 2-GB RAM, along with various high-

end sensor gadgets such as GPS, gyroscope, and acceler-

ometer. With these technological advancements in hard-

ware, smartphones are now able to perform numerous

intelligent functions like, for example, automatically

M.-W. Park � Y.-H. Choi Department of Electrical and Computer Engineering,

Sungkyunkwan University, 300 Cheoncheon-dong, Jangan-gu,

Suwon-si, Gyeonggi-do, Korea

e-mail: [email protected]

Y.-H. Choi

e-mail: [email protected]

J.-H. Eom

Military Studies, Taejeon University, 62 Daehakro, Dong-Gu,

Daejeon, Korea

e-mail: [email protected]

T.-M. Chung (&) Department of Software, Sungkyunkwan University, 300

Cheoncheon-dong, Jangan-gu, Suwon-si, Gyeonggi-do, Korea

e-mail: [email protected]

123

Pers Ubiquit Comput (2014) 18:1373–1386

DOI 10.1007/s00779-013-0739-y

adjusting the brightness of display according to illumina-

tion value. A great technological advancement was also

made in software. The main role for this was played by

major OS manufacturers such as Google, Apple, and

Symbian, which have released the open SDK and created

official markets for smartphone applications. With the

creation and subsequent growth of such application mar-

kets, many developers now spend their time and money to

invent new smartphone applications, bringing ever more

intelligent applications to smartphone users. Thanks to all

these technological advancements in hardware and soft-

ware, mobile phones have now evolved into smart phones.

However, some types of these intelligent applications

require internet connections to identify users and store their

information in web storage. Some other types of applica-

tions also need internet connections for downloading real-

time information like real-time traffic information. In

gaining such internet connections, many users avoid using

mobile networks because they cost them money, and

instead use free Wi-Fi, sometimes even if the access points

for Wi-Fi are unknown.

But, it can be very dangerous connecting their smart-

phones to unknown access points, because wireless com-

munication, which transmits information on air, is more

vulnerable to external intervention than wired communi-

cation, which transmits information through cables. This

signifies malicious users can more easily eavesdrop on

conversations or intercept messages by installing rogue

access points.

Today, a smartphone has become a necessity for many

of us: we need it to wake up in the morning, check

schedules or emails, save memos, and communicate with

colleagues through social applications. Because of these

broad uses for everyday life, many smartphone users

knowingly and unknowingly save in their phone much of

their personal information such as e-mail passwords,

schedules, business documents, and personal photographs

in their smartphones, making them an easy target for those

with malicious intentions. The security of smartphones is

now in more danger than ever before, although most people

remain unaware of the danger.

In this paper, we seek to show the risk of using unknown

Wi-Fi access points. To this end, we demonstrate the

MITM attacks, and we show that the benign application

can import and display injected HTML documents. For

understanding, we describe briefly security model of the

smartphone. However, smartphone OSs are not the same.

So we would focus on the Android OS because we believe

it is more open and thus more vulnerable. The security

model of the Android OS has three security holes in this

model; (1) Android OS will be left a big responsibility to

ignorant user about security (2) permission-based security

model is vulnerable about privilege escalation attacks, and

(3) permission-based security model is not able to cover

application-level vulnerability.

The rest of this paper is organized as follows. Section 2

describes the role of the smartphone in ubiquitous com-

puting environment. We can easily associate the smart

devices like smartphone and tablet PC when we imagine

the vision of the ubiquitous computing. Section 3 gives the

security model of the Android OS and vulnerability of this.

And, Sect. 4 shows results of MITM attack demonstration.

Finally, Sect. 5 concludes the work.

2 Smartphone in ubiquitous computing

The smartphones have become very important devices in

ubiquitous computing. In this section, we describe defini-

tion, core requirements of ubiquitous computing, and roles

of the smartphone in ubiquitous computing.

2.1 Definition of ubiquitous computing

The word ‘‘ubiquitous’’ derives from the Latin word ubi-

que, which means ‘‘present everywhere at the same time.’’

Ubiquitous computing (UbiComp) indicates the environ-

ments where people have access at anytime and anywhere

to information and communication technology (ICT) sys-

tem. In other words, a ubiquitous system allows people to

surround themselves with computing devices that under-

stand and support their life cycles. The term ubiquitous

computing, first used in 1991 by Mark Weiser in his journal

[1], has been redefined by various researchers and institutes

[1–5]. Mark Weiser first defined UbiComp as actualization

of the ‘‘virtual reality’’ by using invisible computing.

Friedemann Mattern [2] now redefines it as comprehensive

computerization and interconnection of everyday objects.

Yvonne Rogers [3] proposes a new definition of the term:

changing roles of the users from calming people to

engaging people in UbiComp environment.

The Mark Weiser’s vision of UbiComp is composed of

three devices, as described in Table 1. The devices are

Table 1 The smart device: tab, pad, and board

Devices Functionalities

Tab Tab is a window that is extended from user’s computer

screen

It can display what is displayed on user’s computer screen

Pad Pad is interface for transmitting commands to the

UbiComp

It can handle all devices that make up the UbiComp

Board Board is the biggest device that has a yard-size display

It is used for the sharing of information between people

mainly

1374 Pers Ubiquit Comput (2014) 18:1373–1386

123

classified according to the size of their display. A tab,

which is about the size of an ID card, is the smallest device,

and a board, which is about a yard size, is the biggest one,

with the pad between them. The tab is designed for

wearable devices, and this is mainly used for personal

functions such as calendar and diary. The pad is a hand-

hold device, and it is intended to replace paper. Users can

easily read, write, and scrap information using pads. And

also the pad is a main interface for handling UbiComp.

Boards are used for playing video or sharing information

between co-workers.

Nowadays, we can easily associate the smartphone and

tablet PC when we imagine a tab and a pad. It means that

UbiComp has already been partly realized, and the rest

may be fulfilled soon.

2.2 Core requirements of ubiquitous computing

The following are core requirements of UbiComp distinct

from distributed computing: context-aware computing,

ambient and ubiquitous intelligence, and recording, track-

ing and monitoring [3, 6, 7]. The most important charac-

teristic of UbiComp is context-aware computing. Service

provider expects that UbiComp can provide suitable ser-

vices to a suitable person at a proper moment without user

intervention. For this service, computing ability to under-

stand context information about personal and environ-

mental context is required in UbiComp. In order to collect

context information, sensor devices which can collect

information and transfer collected information to base

station are deployed in UbiComp field. We call this com-

puting environment context-aware computing. Context-

aware computing is used to infer situation and decide next

operation. This process is important because if the infer-

ence result does not match up with the actual user’s

expectations, UbiComp will lose trust from the user. This is

a difficult part of research about context-aware computing.

Second core requirement is related to ambient and

ubiquitous intelligence. Sometimes, more accurate inter-

face is necessary in UbiComp. For example, when the user

wants to adjust the volume of the audio or change the TV

channel, he needs accurate interfaces for communication

with the UbiComp system. Generally, speech recognition

and gesture recognition technology are often used in this

area. However, the error rate is still high, and therefore,

technical research is needed to enhance accuracy.

The rest of the requirements are recording, tracking and

monitoring. These requirements are adopted to develop

human-assistive applications through sensing and alerting

[3]. UbiComp has sufficient information for tracking and

monitoring human resources because sensor devices of

context-aware computing periodically report personal and

environmental contexts to it. If UbiComp tracks and

monitors the vulnerable people such as the elderly, the

physically and mentally disabled, UbiComp can respond to

emergency situations. However, it has the following

problems. First, it is difficult to record, track, and monitor

all of the transactions that occur in UbiComp because of

the massive amounts of transactions. UbiComp is com-

posed of a lot of sensor devices that collect context infor-

mation or wait user input. Thus, the massive amounts of

transactions occur in short time. Second, recording, track-

ing, and monitoring personal information are conflicted

with the protection of personal information.

2.3 Smartphone in ubiquitous computing

Over the last decade, a mobile phone has made remarkable

advancements in both hardware and software. The mobile

phone, also called smartphone, is equipped with a high-

speed multi-core processor and enough gigabytes storage

incomparable with those of the past feature phone. Fur-

thermore, the smartphone has various built-in sensor gad-

gets such as GPS, an accelerometer, and a gyroscope. As a

result, the smartphone has become so intelligent and more

user-friendly as to support our life, just like the vision of

UbiComp envisioned. Table 2 shows the specification of

Samsung Galaxy S3.

And also, there have been great advancements in soft-

ware technology. Smartphone OS manufacturers like Go-

ogle, Apple and Symbian, release the SDK for developing

smartphone applications. And also, they create official

markets for application deployment. With the growth of

markets, many developers are now motivated to invent new

smartphone applications, producing a large number of

useful applications reactive to context by means of multiple

sensors built in the smartphone. According to the Android

official blog, the Google Play has reached 25 billion

downloads and 675,000 total apps [8].

Evolution of the smartphone has greatly changed our

lifestyle. From a morning call service to a remote control

vehicle service, the smartphone offers various services to

the user [9]. The smartphone already plays the roles similar

to the tab and the pad as envisioned by Weiser. People at

anytime and everywhere carry their smartphones like

wearable devices. And the smartphone performs most of

Table 2 The specification of Samsung Galaxy S3

Segments Specifications

Processor 1.5 GHz dual-core processor

Memory 32 gigabytes of storage and 2 gigabytes of RAM

Connectivity Bluetooth, Wi-Fi, NFC, etc.

Built-in

sensors

Accelerometer, gyroscope, proximity, compass, and

barometer

Pers Ubiquit Comput (2014) 18:1373–1386 1375

123

the personal tasks such as scheduling, checking e-mail, and

sharing files. It is similar to the tab in the vision of Weiser.

And also, the size of smartphone is similar to that of the

pad. Moreover, the user writes notes on and clips infor-

mation to his smartphone. All these technological advances

are realization of Weiser’s vision [10].

Furthermore, we expect the smartphone to become the

most important equipment in UbiComp. The smartphone

can be used for satisfying the core requirements of Ubi-

Comp. The smartphone can collect context information and

transfer collected information to the base station through

wireless communication. And also, the smartphone can be

used for human interfaces. Lastly, the smartphone can be

utilized as an identification of its owner by using universal

subscriber identity module (USIM) information.

The smartphone can play the role of deployed sensor

devices in context-aware computing. Context-aware sys-

tem needs wireless sensor networks for collecting context

information. Thus, large numbers of sensor devices are

deployed in UbiComp to continuously collect context

information such as personal and environmental context

and transfer it to the base station. However, it is highly

costly to construct these sensor networks. Moreover, these

sensor devices have energy limitation. So, sensor devices

cannot perform permanently. However, most of these

problems can be solved by using the smartphone. People

always carry their smartphone with them, which contains

various built-in sensors. And all smartphones have wireless

network interfaces. Thus, the smartphone can easily

transfer messages to the base station. Since the smartphone

is fully charged on a daily basis, so users can be free of the

fear of energy shortage. As a result, the smartphone can

play a role of deployed sensor devices in UbiComp field.

Andrew et al. [11] and Tor-Morten et al. [12] show several

examples of sensing applications for cognitive phones.

Next topic is the suitability of smartphones for Human–

Computer interfaces. The smartphone has various inter-

faces for interactive functions such as camera, touch panel,

gyroscope, and up-down buttons. Various technologies

already have been used for interaction between human and

devices in smartphone. For examples, the smartphone can

adjust the brightness of the screen automatically by rec-

ognizing the user’s eye, and the scroll of web browser is

controlled by just tilting the device. Rafael et al. [13]

and George et al. [14] suggest a possibility of smartphone

usable as an input device in UbiComp. Following them, we

expect interaction between humans and UbiComp using the

smartphone is possible.

The last core requirements of UbiComp are recording,

tracking and monitoring the people. It can reduce the cost

spent identifying and tracking the user by using the

smartphone. Generally, the smartphone has a USIM card

with unique serial numbers, which is issued by mobile

network providers for identification of the owner. Thus, if

UbiComp can read USIM information, it will be able to

easily track and monitor human resources.

Figure 1 illustrates the abstract roles of the smartphone

and its interactions with UbiComp environment. The

smartphone has resources such as privacy information

(e.g., schedule, contact, etc.), built-in sensor devices (e.g.,

GPS module, gyroscope, accelerometer, etc.), and appli-

cations for UbiComp that are optionally installed with the

permission of the user. The solid line points to interaction

between the human and the computer and the dotted line

machine-to-machine interaction. The Context-aware

Computing component demands context information of

personal and environmental context. So, this component

communicates with optional applications to receive per-

sonal context. Every component of UbiComp interacts with

built-in sensors of the smartphone to collect context

information. The Context-aware Computing component

and Ambient and Ubiquitous computing component have

direction access to sensor devices. These components

receive raw data from the smartphone and process them

according to their function. On the other hand, the

Recording, Tracking and Monitoring component commu-

nicates with optional applications because this component

requires refined data.

3 Threats of the compromised access points

In this section, we describe the security model of the

smartphone through the Android platform and critical

security threats posed by the MITM attack, which can

occur from compromised AP connections.

3.1 Security model of smartphone

The smartphone has a dual- or quad-core processor and a

gigabyte memory and storage. Whenever and wherever

users desire, they can gain connections to the Internet using

mobile networks or Wi-Fi networks. And, it can access

user information stored in the device or on the web.

Although functional aspects of the smartphone have grown

significantly, the security technology of the smartphone

still falls short of expectations of many. Smartphone OSs

are slightly different from each other, and we will focus on

the Android OS, because it is more open and thus more

vulnerable to external invasion. In this subsection, we

describe security flaws of the Android OS.

Basically, all applications run within their own sandbox,

and no application can escape this sandbox. However,

these restrictions are so strong as to cut off most of the

functionality of smartphone application. So, the Android

platform allows use of the API depending on application

1376 Pers Ubiquit Comput (2014) 18:1373–1386

123

permissions as approved by the user [15]. Every Android

application has permission information that is approved

during the install time in its own AndroidManifest.xml file.

This permission never changes until the application is re-

installed. Figure 2 shows an example code of the Adn-

roidManifest.xml file of the Test Application 1 [34]. The

permissions are defined separately for each API that has a

risk of being exploited. The permission ‘‘INTERNET,’’

that is in the Fig. 2, is necessary for connection with

Internet. Android OS verifies permission just when the user

application calls the API that has a risk of being exploited.

In other words, if some application does not call API, that

is, related socket, the Android OS will never check the

permission ‘‘INTERNET.’’

The permission-based security model of Android OS has

the following security holes. First, Android OS will be left

a big responsibility to ignorant user about security [16–19].

Most users do not understand about the risk of approving

the permission to applications. Furthermore, the user has

only the two choices giving an approval or not. As a result,

Fig. 1 The abstract roles of Smartphone and interactions

with UbiComp environments

Fig. 2 An example code of permissions that is stored in AndroidManifest.xml file

Pers Ubiquit Comput (2014) 18:1373–1386 1377

123

the user thinks less of permission authorizing process

because of this permission policy. Second, the permission-

based security model is vulnerable to privilege escalation

attacks [20, 21]. Multiple applications share the role for

achieving their purpose. For an example, malicious appli-

cation A has permission for accessing to sensitive internal

data such as the contact, but it does not have permission for

sending message through the Internet. Malicious applica-

tion B does not have permission for accessing to sensitive

internal data, but it has permission about the Internet. In

this case, malicious application A is to transmit the contact

to malicious application B by using internal communica-

tion path and malicious application B flows out the contact

through the Internet [22]. Last, the permission base security

model is only able to cover low-level behaviors that are

related to API call. If android application has application-

level vulnerability, the Android OS will not be able to

protect itself. We focus on this security hole. In the next

section, we demonstrate the MITM attack by using this

application-level vulnerability.

3.2 Threats of the compromised access points

According to growth of wireless networks, wireless network

interface becomes the most basic parts of a portable com-

puting device. Some research predicts that wireless com-

munications will exceed wired communications by 2015.

Like this, wireless communication technology has become

the most important communication means for connecting the

smart device. The growth of wireless communication con-

tributes to realize UbiComp and popularizes smartphone.

However, security threats exist in the hidden side of the

rapidly growth of wireless communication.

We can easily see that wireless APs are installed in a

narrow area more than needs. Figure 3 shows the map that

presents the density of APs in Chicago. We obtain this map

from wireless geographic logging engine (WIGLE) project

which is a dataset for collecting the wireless hotspots

around the world [23, 24]. Wireless APs are distributed in

Chicago more difficult to read the map. According to

WIGLE project, about 5 million APs exist in California

that is a region where the AP is installed most in the United

States. Density of the wireless AP is very high considering

that the each AP can support a range of up to 150 feet

indoors and 300 feet outdoors. Table 3 shows regions and

the number of wireless APs. We are surrounded by many

wireless APs. It is look like a spider web that is configured

in a wireless network. In fact, all of the AP that is searched

by our devices is not a benign. When you indiscriminately

try to connect to unknown AP, you and your device will be

in danger.

In the wired network, the MITM attacks are very diffi-

cult attack technique [25]. It is impossible that an adversary

physically break into an end-user and the ISP. Thus, an

adversary uses domain name system (DNS) cache poi-

soning for changing the direction of traffic flows [26] in

Fig. 4a. However, in the wireless network, an adversary

can easily break into an end-user and the ISP [27–31] in

Fig. 4b because the messages are transmitted on air in

wireless network. Thus, wireless network is more vulner-

able than wired networks.

Generally, the smartphone user wants his smartphone is

always connected to the Internet because applications that

are installed in his smartphone usually requires the Internet

connection for uploading or downloading the real-time

information. Thus, the smartphone user often searches open

wireless networks. Therefore, if an adversary installs open

AP, he can easily connect to victims. The way to install the

AP for the MITM attack can be divided into two major

types. First, an adversary installs the compromised AP on

the public places such as airport, bank, and coffee shop

[31]. An adversary can easily catch victims in these places,

because the probability of using the smartphone is

increased when the people stay a long time in one place.

Second method is use rogue AP [27, 28]. Rogue AP is

installed outside range of benign AP and masquerade as

this benign AP. An end-user is easily cheated because

rogue AP use the SSID of the benign AP.

In particular, the smartphone users are required more

attention about this unknown APs because the smart-

phone has became the critical point of user’s information

security. Generally, all information is included in his

smartphone from privacy photographs to business docu-

ments. Thus, if the smartphone is compromised by an

adversary, the user will suffer socially or financially

irreparable damage.

Fig. 3 The map of wireless APs in Chicago

1378 Pers Ubiquit Comput (2014) 18:1373–1386

123

4 Demonstrations

To indicate the risk of unknown AP, we demonstrate the

MITM attack by using compromised AP. We show that an

adversary can easily intercept your message and inject

modified message into communication between your

handset and the service provider. In this section, we

describe our demonstration environments and progresses.

After then, we explain the results of our penetration test.

4.1 Testbed for the MITM attack

We use five devices for demonstration; two Samsung

Galaxy S3s are Android handsets for running applica-

tions; a laptop serves as the compromised AP; an Iptimes

N40006R is benign wireless AP; and a server for MITM

attack. The basic architecture of our testbed is shown in

Fig. 5. Two Android handsets connect to each AP through

Wireless Local Area Network based on IEEE 802.11. The

Android handset 1 is connected to the benign AP, and the

other handset is connected to compromise AP. Each AP

and the spoofing server which serves as the DNS spoofing

server and web proxy server connect to the Internet

through same gateway. We set DNS configuration of

compromised AP to the spoofing server for DNS spoof-

ing. An adversary is able to catch every packets pass

through these compromised AP and divert some packets

by using DNS spoofing.

Table 4 shows the tools and software used in our dem-

onstrations. We use top five applications that are registered

in ‘‘Top New Free Games’’ of Google Play. These appli-

cations import pop-up advertisements of event notification

and commercial advertisement from their web servers.

Wireshark and Connectify Hotspot are installed on the

laptop. Wireshark is used to analyze packets to find vul-

nerability of communication process. Connectify Hotspot

is used to set up the laptop as Wi-Fi AP. Apache2 and Bind

is installed on the desktop. Apache2 is used to reply HTTP

requests, and Bind is used to deceive Android handset 2.

4.2 Preliminaries

We obtained abstract operations of android applications by

analyzing the traffic of applications, as following Fig. 6.

Generally, applications communicate with more than one

server. First one is a data server. The data server checks

application suitability such as user authentication, appli-

cation version and integrity, and so on. If application fails

to test the suitability or access to the date server, then this

application is immediately terminated. The second server is

an advertisement server, and this server is an optional

object. The advertisement server provides html files and

image files of event notification and commercial adver-

tisement via HTTP. The connection of the advertisement

server does not affect launch of application differently

from the connection of the data server. We masquerade as

advertisement server for the MITM attack.

Figure 7 shows the MITM attack progress, which con-

sists of passive attack phase and active attack phase.

For the purpose of the passive attack phase, an adversary

confirms the existence of the advertisement server and

understands communication process between the applica-

tion and the advertisement server. An adversary monitors

the DNS query and response and intercepts the packets

between the application and the advertisement server by

using the compromised AP. He can easily figure out the IP

address and domain name of the advertisement server by

using the extracted html documentations and image files

through Wireshark. Figure 8 shows an example of the

passive attack phase. After receiving a DNS response, the

Android handset 2 immediately requests the HTML doc-

ument to androweb.cafe24.com. This HTML document

contains the URL on the pop-up advertisement.

In the active attack phase, an adversary puts the modi-

fied HTML documents on the specific path which came

Fig. 4 MITM attack patterns in (a) wired and (b) wireless commu- nication environment

Table 3 Number of wireless AP that is located in United State in Sep 2013

Region Total California Texas Ohio New York

Count 40,919,320 5,255,380 3,941,742 2,178,988 2,076,812

Pers Ubiquit Comput (2014) 18:1373–1386 1379

123

Fig. 5 Architecture of our testbed

Table 4 The tools and software used in our demonstrations

Device Installed software Installation purpose

Android handset 1 and Android handset 2 Test Application 1 [35] Attack demonstration

Test Application 2 [36]

Test Application 3 [37]

Test Application 4 [38]

Test Application 5 [39]

Compromised AP Wireshark Packets analysis

Connectify Hotspot Set up to wireless access point

Spoofing server Apache2 HTTP proxy server

Bind DNS spoofing attack

Fig. 6 Abstract operation process of the application which

imports pop-up advertisement

1380 Pers Ubiquit Comput (2014) 18:1373–1386

123

from the previous phase. Then he sets up the DNS con-

figuration to divert the HTTP request messages to spoofing

server. The code in the Fig. 9 is an example of inserted

code in named.conf, that is, configuration file of named

which is a DNS server, part of the BIND9 distribution.

4.3 Man-in-the-middle attack progress

Figure 10 shows the MITM attack process. When target

applications are launched on the Android handset 2, it

checks status of connection to the Internet and tries to

request IP address of the data server. DNS query of the

Android handset 2 is delivered to the spoofing server

passing through the compromised AP. The spoofing server

returns the correct IP address of data server for normally

launching the target application. Next, the Android handset

2 communicates with the data server for application-spe-

cific launching process. Generally, these communications

are protected by SSL. If the target application is launched

successfully, it tries to request IP address of the adver-

tisement server. In this case, however, the spoofing server

returns IP address of itself in order to inject modified

messages. As a result, the target application requests

HTML documents and image files to the spoofing server

and exposes incorrect advertisements that are modified by

an adversary.

Fig. 7 Man-in-the-Middle attack progress

Fig. 8 An example of passive attack phase

Pers Ubiquit Comput (2014) 18:1373–1386 1381

123

4.4 The results of man-in-the-middle attack

As mentioned above, we target top five applications that

are registered in ‘‘Top New Free Games’’ of Google Play.

Figure 11 presents screenshot of the target application’s

pop-up advertisement; the (a) image is a view of normal

case, the (b) image is a view of abnormal case that the target

application imports modified HTML document, and the

(c) image is a screen when the link contained in the modi-

fied HTML document has been executed of target applica-

tion. In many cases, Android applications are used as simple

objects such as WebView for pop-up advertisement. As a

result, an adversary can easily insert link of the other URLs

into modified HTML document. Figure 12 is a part of the

code of original HTML document of target application and

link-embedded HTML document that is made by us.

Figure 13 shows the results of our MITM attack dem-

onstration. We have inserted ‘‘Modified advertisement’’ to

all the images and added the link of the injected HTML

document to the original HTML document. We have suc-

ceeded in exposing modified advertisement page to user

through the all benign applications. And also, the link that

is injected by us is working properly in the all test

applications.

Figure 14 shows the partial code for generating pop-up

advertisement of the Test application 1. WebView is

Android API for simple display online content within

applications [40]. By using loadUrl method of WebView

class, developer can easily handle online content. However,

these objects, such as WebView, are in danger of being

misused as a result of our demonstration. If developer can

to block that execution of embedded link, it is possible to

significantly reduce the threat of these attacks.

A spear phishing is more effective because phishing

messages are customized for victims [34]. Customized

message, which contains trustworthy information such as

victim’s nickname, is easier to be believed. Thus, the threat

of the MITM attack is more critical when it is combined

with the social engineering for customizing injected

advertisement. Who do not click it when the phrase ‘‘Only

Fig. 9 An example of inserted code in named.conf

Fig. 10 An example of the MITM attack process

1382 Pers Ubiquit Comput (2014) 18:1373–1386

123

one chance! Click and Receive Gift’’ is inserted in the pop-

up advertisement of well-known application?

It is necessary to mitigate the MITM attack as follows:

(1) the smartphone user avoids connecting to unknown AP,

and (2) pays attention to pop-up advertisement even if it is

pop-up message of well-known application. (3) The

application developer avoids using vulnerable API, and (4)

must use mutual authentication process and secure protocol

such as SSL [33] when an application communicates with

external devices.

5 Conclusions

We describe the roles and potentiality of smartphone in

the UbiComp environments. The smartphone has done a

remarkable development enough to satisfy core require-

ments of UbiComp: context-aware computing, ambient

and ubiquitous intelligence, and recording, tracking and

monitoring environments. However, the growth of the

smartphones is sufficient to attract the attention of

adversaries. Moreover, the security model of the Android

Fig. 11 Captured images of the target application’s pop-up advertisement

Fig. 12 An example code of the (a) original HTML document and (b) link-embedded HTML document

Pers Ubiquit Comput (2014) 18:1373–1386 1383

123

Fig. 13 The results of demonstration of the test application 1–4

Fig. 14 The partial code for generating pop-up advertisement by using WebView class

1384 Pers Ubiquit Comput (2014) 18:1373–1386

123

platform has security vulnerabilities such as the follow-

ing: (1) Android OS will be left a big responsibility to

ignorant user about security, (2) permission-based secu-

rity model is vulnerable about privilege escalation

attacks, and (3) permission-based security model is not

able to cover application-level vulnerability. In this

paper, we reveal the risk of the using unknown APs by

using demonstration. The testbed is composed to five

devices: two android handsets, one laptop, one desktop,

and one wireless AP. The android handsets are used for

running application. The laptop plays the role of com-

promised AP; we change its DNS information. The

desktop is used for DNS spoofing and web server. We

can intercept and inject packets of passes through the

laptop. We divert some packets to the desktop by using

DNS spoofing. As a result, test applications that are

launched on the handset 2 display abnormal advertise-

ments. We shows that benign application, which is

running on uncompromised devices, can be exploited just

connecting to the compromised AP. To mitigate this

MITM attack, developer must use mutual authentication

process when an application communicates with external

devices.

In future work, we will continue to research about the

MITM attack for attack-protected sessions such as SSL/

TLS. Many user applications depute security function to

SSL APIs. However, vulnerabilities about these applica-

tions have been reported in research of Georgiev et al. [32].

For the development of smartphone security, we continu-

ously study for finding out the vulnerability of smartphone

platform and resolving these threats.

References

1. Weiser M (1991) The computer for the 21st century. Sci Am

265(3):94–104

2. Mattern F (2001) The vision and technical foundations of ubiq-

uitous computing. Upgrade 2(5):3–6

3. Rogers Y (2005) Moving on from Weiser’s vision of calm

computing: engaging UbiComp experiences. In: proceedings of

UbiComp 2005. Springer, NY, pp 404–421

4. Leem CS, Jeon NJ, Choi JH, Shin HG (2005) A business model

(BM) development methodology in ubiquitous computing envi-

ronments. In: proceeding of ICCSA 2005. LNCS 3483:86–95

5. Kang BH (2007) Ubiquitous computing environment threats and

defensive measures. IJMUE 2(1):47–60

6. Poslad S (2009) Ubiquitous computing: smart devices, environ-

ments and interactions. Wiley, New York, pp 3–73

7. Baldauf M, Dustdar S, Rosenberg F (2007) A survey on context-

aware system. Int J Ad Hoc Ubiquit Comput 2(4):263–277

8. Android Official Blog. Google play hits 25 billion downloads.

http://officialandroid.blogspot.kr/2012/09/google-play-hits-25-

billion-downloads.html

9. Barkuus L, Polichar VE (2011) Empowerment through seam-

fulness: smart phones in everyday life. Pers Ubiquit Comput

15(6):629–639

10. Bell G, Dourish P (2007) Yesterday’s tomorrows: notes on

ubiquitous computing’s dominant vision. Pers Ubiquit Comput

11(2):133–143

11. Campbell A, Choudhury T (2012) From smart to cognitive

phones. IEEE Pervasive Comput 11(3):7–11

12. Grønli T, Chinea G, Younas M (2013) Context-aware and auto-

matic configuration of mobile devices in cloud-enabled ubiqui-

tous computing. Pers Ubiquit Comput

13. Ballagas R, Borchers J, Rohs M, Sheridan JG (2006) The smart

phone: a ubiquitous input device. IEEE Pervasive Comput 5(1):

70–77

14. Roussos G, Marsh AJ, Maglavera S (2005) Enabling pervasive

computing with smart phones. IEEE Pervasive Comput 4(2):

20–27

15. Orthacker C, Teufl P, Kraxberger S, Lackner G, Gissing M,

Marsalek A, Leibetseder J, Prevenhueber O (2012) Android

security permissions—can we trust them? In: proceeding of

MOBISEC 2011. LNICST 94:40–51

16. Felt AP, Chin E, Hanna S, Song D, Wagner D (2011) Android

permissions demystified. In: proceeding of CCS’11, pp 627–638

17. Felt AP, Ha E, Egelman S, Haney A, Chin E, Wagner D (2012)

Android permissions: user attention, comprehension, and behav-

ior. In: proceeding of SOUPS 2012

18. Nauman M, Khan S, Zhang X (2010) Apex: extending android

permission model and enforcement with user-defined runtime

constraints. In: proceeding of ASIACCS’10, pp 328–332

19. Barrera D, Kayacik H (2010) A methodology for empirical

analysis of permission-based security models and its application

to android. In: proceeding of CCS’10, pp 73–84

20. Zhongyang Y, Xin Z, Mao B, Xie L (2013) DroidAlarm: an all-

sided static analysis tool for android privilege-escalation mal-

ware. In: proceeding of ASIACCS’13, pp 353–358

21. Bugiel S, Davi L, Dmitrienko A, Fischer T, Sadeghi A, Shastry B

(2012) Towards taming privilege-escalation attacks on android.

In: proceeding of NDSS 2012

22. Chin E, Felt AP, Greenwood K, Wanger D (2011) Analyzing

inter-application communication in android. In: proceeding of

MobiSys’11, pp 239–252

23. Wireless Geographic Logging Engine. http://wigle.net/gpsopen/

gps/GPSDB/, Sep 2013

24. Gruteser M, Grunwald D (2004) A methodological assessment of

location privacy risks in wireless hotspot network. In: proceeding

of SPC 2003. LNCS 2802:10–24

25. Callegati F, Cerroni W, Ramilli M (2009) Man-in-the-middle

attack to the HTTPS protocol. IEEE Secur Priv 7(1):78–81

26. Ariyapperuma S, Mitchell CJ (2007) Security vulnerabilities in

DNS and DNSSEC. In: proceeding of ARES’07

27. Zafft A, Agu E (2012) Malicious WiFi networks: a first look. In:

proceeding of SICK 2012 pp 1038–1043

28. Aime MD, Calandriello G, Lioy A, Torino PD (2012) Depend-

ability in wireless networks: can we rely on WiFi? IEEE Secur

Priv 5(1):23–29

29. Godber A, Dasgupta P (2003) Countering rogues in wireless

networks. In: proceeding of ICPPW’03

30. Nikbakhsh S, Manaf ABA, Zamani M, Jangeglou M (2012) A

nobel approach for rogue access point detection on the client-

side. In: proceeding of WAINA’12, pp 684–687

31. Hwang H, Jung G, Sohn K, Park S (2008) A study on MITM

(Man in the Middle) vulnerability in wireless network using

802.1X and EAP. In: proceeding of ICISS’08, pp 164–170

32. Georgiev M, Lyengar S, Jana S (2012) The most dangerous code

in the world: validating SSL certificates in non-browser software.

In: proceeding of CCS’12

33. Lee DH, Kim JG (2013) IKEv2 authentication exchange model

and performance analysis in mobile IPv6 networks. Pers Ubiquit

Comput

Pers Ubiquit Comput (2014) 18:1373–1386 1385

123

34. Wang J, Herath T, Chen R, Vishwanath A, Rao HR (2012)

Phishing susceptibility: an investigation into the processing of a

targeted spear phishing Email. IEEE Tran Prof Commun

55(4):345–362

35. Test application 1, https://play.google.com/store/apps/details?id=

com.andromedagames.schoolrun

36. Test application 2. https://play.google.com/store/apps/details?id=

air.com.cjenm.mpang.gp

37. Test application 3. https://play.google.com/store/apps/details?id=

com.marvel.runjumpsmashforkakaotalk_goo

38. Test application 4. https://play.google.com/store/apps/details?id=

com.pnixgames.sports

39. Test application 5. https://play.google.com/store/apps/details?id=

com.cjenm.monster

40. WebView. http://developer.android.com/reference/android/

webkit/WebView.html

1386 Pers Ubiquit Comput (2014) 18:1373–1386

123

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

  • c.779_2013_Article_739.pdf
    • Dangerous Wi-Fi access point: attacks to benign smartphone applications
      • Abstract
      • Introduction
      • Smartphone in ubiquitous computing
        • Definition of ubiquitous computing
        • Core requirements of ubiquitous computing
        • Smartphone in ubiquitous computing
      • Threats of the compromised access points
        • Security model of smartphone
        • Threats of the compromised access points
      • Demonstrations
        • Testbed for the MITM attack
        • Preliminaries
        • Man-in-the-middle attack progress
        • The results of man-in-the-middle attack
      • Conclusions
      • References

Sources/Digital Evidence Discovery of Networked Multimedia Devices.pdf

Digital evidence discovery of networked multimedia smart devices based on social networking activities

Hai-Cheng Chu & Szu-Wei Yang & Ching-Hsien Hsu & Jong Hyuk Park

Published online: 13 March 2013 # Springer Science+Business Media New York 2013

Abstract Unquestionably, networked multimedia smart devices are commonly adopted in contemporary ubiquitous wireless computing era with unprecedented evolving pace in terms of mobility, portability, and pervasiveness. Regrettably, those technology-oriented gadgets are phenomenally exploited by cyber criminals or get involved in computer-related incidents unknowingly. Substantively, the detection, prevention, and the related digital forensics of the above scenarios are becoming tremendously urgent both in public and private sectors. Therefore, in this research, we investigate the scenario when state-of-the-art wireless communication technologies are integrated with the networked smart devices where digital evidences may exist and they could be disclosed when appropriate standard operating procedures are suitably applied. Accordingly, in this paper, a PDA with the built-in GPS navigation functionality via the ubiquitous Wi-Fi connection to a popular social networking platform (facebook) is cross examined concerning the related digital evidence collecting and discovering in terms of revealing previous facebook user accounts on the mobile device without shutting off the power. The research provides a generic framework for the digital forensics specialists to contemplate when the networked smart devices are involved in the

Multimed Tools Appl (2014) 71:219–234 DOI 10.1007/s11042-012-1349-9

H.-C. Chu Department of International Business, National Taichung University of Education, 140 Min-Shen Road, Taichung 40306 Taiwan, Republic of China e-mail: [email protected]

S.-W. Yang Department of Education, National Taichung University of Education, 140 Min-Shen Road, Taichung 40306 Taiwan, Republic of China e-mail: [email protected]

C.-H. Hsu Department of Computer Science and Information Engineering, Chung Hua University, 707, Sec. 2, WuFu Road, Hsinchu, Taiwan, Republic of China e-mail: [email protected]

J. H. Park (*) Department of Computer Science and Engineering, Seoul National University of Science and Technology, 172 Gongneung-dong 2, Nowon-gu 139743, Korea e-mail: [email protected]

related criminal investigation cases especially when omnipresent social networking plat- forms are becoming the new avenue for the escalating, stringent, and heinous cybercrimes.

Keywords Digital forensics . Mobile social network . Location-based social networking .

Networked smart devices . Volatile memory acquisition

1 Introduction

Demonstrably, as networked mobile computing devices (PDA, smart phones, GPS naviga- tion devices, and Tablet PCs, etc.) are becoming cost competitive and the prevalence of ubiquitous computing infrastructures, more and more mobile users deposit even more precious information in the mobile computing devices than that of desktop PCs [2, 7, 10, 16]. In the meanwhile, the soaring cybercrimes are occurring at an unparalleled pace in respect of wireless communication technologies. Substantively, contemporary mobile com- munication apparatus holds some kind of decisive digital trails once they have been utilized. In other words, digital evidences could be disclosed in a systematic manner, which could be extraordinarily critical in cracking down some cybercrime-related incidents. Unarguably, some heinous cybercrime syndicates gradually exploit networked smart devices as unsuspect- ing media to achieve lucrative intentions. All the aforementioned digital trails are unwarily concealed within those gadgets. Consequently, we provide a generic framework of digital evidence collection, analysis, and data mining in case upon receiving a PDA with embedded GPS and Wi-Fi functions. The research discloses the potential pervious GPS routes that indicate the current user might have physically presented at those geographic locations. In addition, previous facebook users could be revealed through the preceding Wi-Fi connection.

As Digital Forensics (DF) technology reaches its maturity [3–5, 21], for a spotted PDA with GPS navigation application program shut down and facebook session logout, we still might be able to unveil some digital trails to indicate the routes that the user had actually travelled and the facebook user account(s) on the distinct PDA before the battery drains. Due to the nature of the volatile memory of the networked smart device, the digital content of the Random Access Memory (RAM) would be permanently vanished once the power is off [29]. The paper provides the paradigm as references for practitioners in both public and private sectors to contemplate when similar cases occur especially under extreme time constraint.

By the virtue of the unparalleled innovation in mobile computing technologies, the networked smart devices are flourishing on a weekly basis and they globally foster the Mobile Social Network Services (MSNS) [6], which become the new media for hundreds of millions cyber folks. Proverbially, the closeness of one’s social networking profile is heavily relied on MSNS for some distinct cyber communities. Astonishingly, Location Based Service (LBS) is becoming one of the significant application branches of Geographic Information System (GIS), which is composed of hardware, software, and computerized procedures to facilitate the modeling, representation, manipulation, and management of geo- referenced data in contemporary MSNS [12, 14, 23, 26, 28].

As the mobile computing infrastructures become more pervasive, ubiquitous, reliable, and robust, networked smart devices convey much more flexibility, functionality, portability, and mobility than ever. The embedded GPS module within the networked smart devices can receive the navigation data from the communication satellites and the users of the current devices can reveal the accurate physical geographic locations accordingly on MSNS. From the related literatures, the LBS is an extremely important facet of MSNS because it enables the acceleration of the migration from SNS (Social Networking Service) to MSNS [24]. The

220 Multimed Tools Appl (2014) 71:219–234

accurate and up-to-date location of an individual can be spotted via MSNS instead of placing a phone call, which facilitates the interaction of relationships among friends or family members in a traditional manner. Accordingly, the application of DF in the contemporary cybercrimes is an imminent and imperative necessity to tackle the stringent challenges concerning the metamorphic cybercrimes with compelling digital evidences in a scientific and systematic manner.

In this research work, we carry out a complete evaluation of our proof-of-concept steps via the real case review. The rest of the paper is organized as follows. In section 2.1, we conduct comprehensive literature reviews that have been done in the associate DF research field. In section 2.2, we illustrate the contribution of this innovative research work. In section 3, we present the case review concerning the DF of a typical GPS navigation period and a generic facebook session in a step-by-step approach. In section 4, we summarize and review the corresponding DF results based on the digital evidences that have been collected, analyzed, and preserved in a systematical manner based on the proposed methodology. Finally, in section 5, we make the conclusion of this challenging research work.

2 Preliminary

2.1 Related works

Modern networked smart devices are commonly embedded with location acquisition tech- nologies, such as GPS and GSM networking capability, which facilitate mobile computing mechanism and bring the closeness to human social lives. The GPS generated trajectories, which could be instantly shared via the ubiquitous wireless networks with uploading to SNS platforms that stimulates the exponential growth of Location Based Social Networking (LBSN) [15, 17, 20, 27, 30]. Indeed, the social skills have been unknowingly migrated from traditional face-to-face interactions to cyber space and technology intensive activities. Notwithstanding the above SNS overwhelms the future trend of social networking, more cyber crime incidents are exploited through those new channels. In some cyber criminal cases, the networked smart devices contain critical digital evidences that are substantial in cracking down the incidents. However, those precious breadcrumb digital trails might be vanished forever once the battery drains. Therefore, collecting those digital evidences could be proceeded via the volatile memory acquisition of the RAM. The obtained image file of the RAM could be the probative evidence in a court of law.

Recently, DF has been extensively applied to investigate computer related criminal cases. For networked mobile computing devices, the physical memory is volatile in its nature [18, 19]. Unquestionably, all the valuable and unperceivable information within the volatile memory will be evaporated forever once the mobile computing device is no longer sup- ported via the battery. Since the RAM of the computing device can’t permanently store date, the collection of those precious data would need additional handling because some operation procedures on those digital trails are irreversible. Consequently, the DF specialists have to capture the image of the physical memory to perpetually preserve the digital evidences.

Nowadays, facebook is considered to be one of the predominant SNS platforms. Most networked smart devices are capable of accessing facebook via ubiquitous network con- nections. Under such circumstances, the urgent necessity of DF for mobile networked communication devices is relatively challenging [1, 8, 9, 11, 24, 25, 31]. Taking PDA forensics for instance, without loss of generality, physical acquisition and logical acquisition are the representative ways for acquiring the image of the RAM. For physical acquisition, a

Multimed Tools Appl (2014) 71:219–234 221

DF specialist conducts a bit-stream copy of entire RAM. For logical acquisition, a DF expert obtains a bit-stream copy of the file directory and files. Evidently, the acquisition of the internal memory could be the most challenging task during the investigation procedures in some cases, which encompasses the imaging of the ROM, RAM, and flash memory.

Fig. 2 The registration code of the GPS navigation suite, 63627541, was disclosed

Fig. 1 The DF team tried to obtain the image file of the RAM of the current PDA

222 Multimed Tools Appl (2014) 71:219–234

Especially the RAM, which is volatile in its nature, stores the executing processes and the user related data in a way that they could be permanently vanished once the power loses.

Location Based Social Networks (LBSNs) allow users to visualize the geographic location of their friends. The recent enhancements regarding interoperability, scalability, extensibility, and availability of open mobile platforms, such as Apple iPhones and Google Android smart phones, make LBSNs much more pervasive to global smart phones users. In order to investigate the actual routes that the users had really travelled, we could collect digital traces from the current mobile device and analyze those digital trails as the probative evidences in a court of law if necessary.

The DF concerning MSNS is still in its infant stage, more sophisticated researches should be done in this newly emerged scientific arena from information security point of view. Digital evidences could be disclosed and provided in a court of law to justify a suspect to be inculpatory or exculpatory as cybercrimes have become substantive and characteristic in the unprecedented MSNS era.

2.2 Our contributions

Evidently, networked smart devices are the mainstream of wireless communication gadgets. Unsurprisingly, mobility, flexibility, and portability could be integrated into one moving entity. More and more civilians are utilizing these state-of-the-art mobile communication

Multimed Tools Appl (2014) 71:219–234 223

Fig. 3 The 1st route shown on Google Map with the starting and arriving latitudes, longitudes, and the time stamps

devices under ubiquitous networking infrastructures. From the positive angle to evaluate the above trend of contemporary communication technologies, people get connected whenever they wish to as long as the wireless networks sustain. Unfortunately, from the negative viewpoint, some crime syndicates are exploiting the above technologies as the new avenue to commit cybercrimes or computer-related crimes. Consequently, appropriately disclosing and accurately analyzing the digital evidences within those networked smart devices is one of the most challenging and demanding tasks in the arena of digital forensics of mobile computing.

Hence, in this paper, we provide a generic framework for the DF specialists to ponder when they face the similar cases. We are capable of digging out the previous GPS recorded routes that the user has been actually traveled with the latitude, longitude, and the associate time stamps. Those disclosed digital evidence could be the probative digital evidences in a court of law. Live data acquisition is extremely important especially for the volatile data that are critical in cracking some criminal cases.

Currently, facebook has been an irreplaceable SNS application program for innumerable global civilians from leisure-motivated purposes to business-oriented operations. Unquestion- ably, it plays an extremely inimitable role for plentiful people in the daily social networking activities. Unarguably, if some criminal case has highly suspicious connection to facebook regarding a certain networked smart devices, the DF of a generic facebook session could be the critical and decisive element with regard to the collection of all possible digital evidences.

Regrettably, few researches have illustrated the DF of facebook in terms of crime investigations. Proverbially, facebook utilizes a unique e-mail address during the registration processes as the irreplaceable identifier for a distinct user. The research is capable of revealing the previous facebook accounts (e-mail address) that were logging on the

Fig. 5 The 1st route shown on Google Map indicating the latitudes, longitude, and the time stamp of the arriving point

Fig. 4 The 1st route shown on Google Map indicating the latitude, longitude, and the time stamp of the starting point

224 Multimed Tools Appl (2014) 71:219–234

networked smart device in order to identify the possible previous facebook users that the DF specialists could focus and then target within a short period of time.

Lately, innumerable and mushrooming attentions have been focused on the volatile memory acquisition, which plays an essential role in mobile networked computing devices especially on the crime scene. Strictly speaking, the volatile digital trails would be extinct forever once the power of the computing device is no longer sustainable. Consequently, obtaining the probative

Fig. 7 The 2nd route shown on Google Map indicating the latitude, longitude, and the time stamp of the starting point

Fig. 6 The 2nd route shown on Google Map with the starting and arriving latitudes, longitudes, and the time stamps

Multimed Tools Appl (2014) 71:219–234 225

digital evidences before evaporating is an imminent and challenging task for the DF staffs to instantaneously proceed on the crime scene in respect of those networked smart devices. In this paper, similar procedures are illustrated for the associate DF specialists to apply as references when networked smart devices are involved in a GPS and facebook session.

3 Volatile memory acquisition of a networked smart device and the corresponding digital forensics - a case review

In this research, the experiment is conducted based on the premise that there is a PDA with a Bluetooth GPS receiver accompanied with an embedded navigation software package. The popular gadget contains lots of digital evidences, which play an essential role in some specific

Fig. 9 The 3rd route shown on Google Map with the starting and arriving latitudes, longitudes, and the time stamps shown on Google Map

Fig. 8 The 2nd route shown on Google Map indicating the latitude, longitude, and the time stamp of the arriving point

226 Multimed Tools Appl (2014) 71:219–234

crime case. In this scenario, the Papago, Ver. G10 [22], which is a popular satellite navigation application program in Taiwan is being utilized. Based on historical digital records and several digital breadcrumb evidences, the DF specialists are capable of disclosing the digital trails, which could be the key evidence in cracking some criminal cases. Hence, the DF team can conduct digital evidence collection procedures with respect to those mobile computing devices that were equipped with some popular GPS navigation software. In this scenario, the PDAwas taken into custody without shutting off the networked mobile device.

3.1 Phase 1

The DF team applied Paraben’s PDA Seizure Ver. 3.0.3.93 and Microsoft ActiveSync Ver. 4.5 to obtain the image file of the RAM of the current PDA as Fig. 1 shown.

From Fig. 1, the team retrieved the registration code of the GPS navigation suite, Papago Ver. G10, 63627541, as Fig. 2 indicated. The team confirmed that the code is the unique official authorization code owned by the corporate and no other GPS navigation software packages are installed on the current PDA.

3.2 Phase 2

The team found the PDA has automatically kept records of the navigation routes. Hence, the team saved the records into a file, 092701.TR7, transforming it into an

Fig. 11 The 3rd route shown on Google Map indicating the latitude, longitude, and the time stamp of the arriving point

Fig. 10 The 3rd route shown on Google Map indicating the latitude, longitude, and the time stamp of the starting point

Multimed Tools Appl (2014) 71:219–234 227

importable file for Google Map via the conversion web site [13]. The web site is capable of converting *.TR7 files to *.KMZ and *.GPX files that can be recognizable in Google Earth and Google Map.

3.3 Phase 3

The team inspected the transformed the *.GPX file and found the latitude, longitude, and the associate time stamps for some journeys. After scrutinizing the digital data, the DF team can initially conclude that the driver had been travelling via three distinct routes. Meanwhile, the DF team uploaded the transformed KMZ file to Google Earth and obtained the corresponding expected results, which means that there are three different routes, which the driver had actually taken. The 1st route on Google Map and the digital records as indicated in Figs. 3, 4, and 5, respectively. Fig. 3 demonstrated that the driver started as the arrow pointed based on latitude (24.18351), longitude (120.613515), and the time stamp (2010-09-24 04:44:57 UTC). Further- more, the driver arrived as the arrow pointed based on latitude (24.081678), longitude (120.542058), and the time stamp (2010-09-24 05:24:57 UTC). Figures 4 and 5 support the above digital evidence interpretation. Similarly, the 2nd route on Google Map and the digital records as indicated in Figs. 6, 7, and 8, correspondingly. Alternatively, the 3rd route on Google Map and the digital records as indicated in Figs. 9, 10, and 11, accordingly.

Fig. 13 Via applying the search keyword, m[1].com, the previous facebook user, [email protected] was disclosed as the arrow pointed

Fig. 12 The most recent facebook user account, [email protected] via applying the search keyword, guest@facebook

228 Multimed Tools Appl (2014) 71:219–234

3.4 Phase 4

As facebook is one of the most popular mobile social networking platforms, the networked smart devices are often utilized to participate in the cyber social network- ing activities from leisure purposes to business operations. Most cyber folks are unaware of the fact that confidential information might accidentally reveal through this most popular social network channel nowadays. Therefore, the DF staff decides to disclose previous facebook users on this current PDA for the purpose of digging out any breadcrumb digital trails.

3.5 Phase 5

Moreover, the DF team applied the search keyword, guest@facebook, targeting on the image file of the RAM of the PDA and obtained the most recent facebook user account, [email protected], on the current mobile communication device as Fig. 12. demonstrated.

Fig. 14 After applying the search keyword, m[1].com, the previous facebook user, [email protected] was disclosed as the arrow indicated

Multimed Tools Appl (2014) 71:219–234 229

Fig. 15 By means of applying the search keyword, m[1].com, the previous facebook user, [email protected] was disclosed as the arrow showed

3.6 Phase 6

Additionally, the team employed the search keyword, m[1].com, for the purpose of disclosing the possible other previous facebook users on this PDA. As Figs. 13, 14, 15, and 16 illustrated, there were other four previous facebook users logon on the PDA. The CISO (Chief Information Security Officer) can utilize the obtained face- book accounts to explore the social network activities via the methodology presented above to discover previous facebook social network activities, which would not be the focus of this research paper.

4 Summary and review of the corresponding digital forensics results

Based on the digital trails being collected, analyzed, and reported, the digital forensics team summarizes the above digital trails as Fig. 17 depicted, which would be the essence of the paper concerning the data mining of the digital breadcrumb trails.

Fig. 17 Summary of the collected digital evidences and the corresponding discovery

Fig. 16 In respect of applying the search keyword, m[1].com, the previous facebook user, [email protected] was disclosed as the arrow demonstrated

230 Multimed Tools Appl (2014) 71:219–234

5 Conclusion

Unwarily, the digital content within the volatile memory of a networked smart device may be vanished forever once the battery drains. Thus, precious digital evidences need to be systemat- ically collected in time for the purpose of avoiding irreversible operation procedures, which might result in probative digital evidences permanently disappearing. In this paper, the volatile memory of a generic PDA is crossed examined via the image of the RAM of the mobile computing device. Additionally, the digital track file, *.TR7, was transformed to *.GPX file, which can be diagnosed concerning latitudes, longitudes, and the time stamps for the distinct trips. Furthermore, the Google Map specifically reveals the individual trips that the current user had physically pre- sented. Besides, we also demonstrate the disclosure of the most recent and previous facebook user (e-mail account) for the purposes of illustrating the associated digital evidences in order to facilitate the investigation of cybercrimes, which are relatively related to MSNS.

Acknowledgments The author would like to acknowledge the funding support of NSC (National Science Council) of Taiwan concerning the grant of Project NSC 101-2221-E-142-009. This research was partially supported by Basic Science Research Program through the National Research Foundation of Korea(NRF) funded by the Ministry of Education, Science and Technology (2012-0008296).

References

1. Acquisti A, Gross R (2006) Imagined communities: awareness, information sharing and privacy on the facebook. Lect Notes Comput Sci 4258:36–58

2. Andrew MW (2007) Defining a process model for forensic analysis of digital evidence devices and storage media. In: Proceedings of the Second International Workshop on Systematic Approaches to Digital Forensic Engineering. IEEE, SADFE 2007

3. Asher C, Aumasson JP, Phan RC-W (2009) Security and privacy preservation in human-involved networks, iNetSec. IFIP AICT 309:139–148

4. Brown R, Pham B, DeVel O (2005) Design of a digital forensics image mining system. KES 2005. Lect Notes Comput Sci 3683:395–404

5. Chen H, Chung W, Xu J, Wang G, Qin Y, Chau M (2004) Crime data mining: a general framework and some examples. IEEE Comput 37(4):50–56

6. Counts S, Fisher KE (2008) Mobile social networking: an information grounds perspective. Proceedings of the 41st Hawaii International Conference on System Sciences (HICSS). IEEE Publication, Waikoloa, Big Island, HI, pp 1–10

7. Deng C, Lin Y, Ma L, Cao Y (2011) Towards a practical and scalable trusted software dissemination system. J Converg 2(1):53–60

8. Dominguez-Sal D, Perez-Casany M, Larriba-Pey JL (2010) Cooperative cache analysis for distributed search engines. Int J Inf Technol Commun Converg 1(1):41–65

9. Dwyer C, Hiltz S, Passerini K (2007) Trust and privacy concern within social networking sites: a comparison of Facebook and Myspace. In: Proceedings of the Thirteenth Americas Conference on Information Systems, AMCIS

10. El-Khatib K, Zhang ZE, Hadibi N, Bochmann GV (2004) Personal and service mobility in ubiquitous computing environments. Wirel Commun Mob Comput 4(6):595–607

11. Ellison N, Steinfield C, Lampe C (2007) The benefits of facebook “friends:” social capital and college students use of online social network sites. J Comput Mediat Commun 12:1143–1168

12. Fengyu D, Xuerong G (2009) An Advanced Location Based Service (A-LBS) on Mobile Social Network. Proc. IEEE International Conference on Broadband Network and Multimedia Technology, ICBNMT 09. IEEE Press, pp. 740-743, October 2009

13. GPS visualizer. http://www.gpsvisualizer.com 14. Iqbal MU, Samsung L (2008) Legal and ethical implications of GPS vulnerabilities. J Int Commer Law

Technol 3(3):178–187 15. Joore P (2008) Social aspects of location-monitoring systems: the case of Guide Me and of My-SOS. Soc

Sci Inf 47:253–274 16. Keenan T (2008) On the internet, things never go away completely. IFIP Int Fed Inf Process 262:37–50

Multimed Tools Appl (2014) 71:219–234 231

17. Kryvinska N, Thanh DV, Strauss C (2010) Integrated management platform for seamless services provisioning in converged network. Int J Inf Technol Commun Converg 1(1):77–91

18. Lee S, Kim H, Lee S, Lim J (2005) Digital evidence collection process in integrity and memory information gathering. In: Proceedings of Systematic Approaches to Digital Forensic Engineering. First International Work-shop. Proc. IEEE, pp. 236–247

19. Simon M, Slay J (2010) Recovery of skype application activity data from physical memory. Proceedings of the 5th international conference on availability, reliability and security. IEEE Publication, Krakow, Poland, pp 283–288

20. Nan L, Guanling C (2009) Analysis of a location-based social network. Int Conf Comput Sci Eng 4:263– 270, August 2009, Vancouver, Canada

21. Nance K, Hay B, Bishop M (2009) Digital forensics: defining a research agenda. In: Proceedings of the 42nd Hawaii International Conference on System Sciences. IEEE Press, Waikoloa, HI, USA, Jan 2009

22. PAPAGO. http://www.mactiontech.com 23. Schapsis C (2010) Location based social networks links: a list of location based social networks, [online].

http://bdnooz.com/lbsnlocation-based-social-networking-links/ 24. Skeels MM, Grudin J (2009) When social networks cross boundaries: a case study of workplace use of

facebook and linkedin. In: Proceedings of the ACM 2009 international conference on Supporting group work, Sanibel Island, Florida

25. Sohn H, Ro YM, Plataniotis KN (2009) Content sharing based on personal information in virtually secured space. Lect Notes Comput Sci 5450:388–400

26. Strawn C (2009) Expanding the potential for GPS evidence acquisition. Small Scale Digit Device Forensic J 3(1):1–12

27. Troshynski E, Lee C, Dourish P (2008) Accountabilities of presence: reframing location-based systems. In: Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, Florence, Italy

28. Tsai JY, Kelley P (2009) Who’s viewed you?: the impact of feedback in a mobile location-sharing application. In: Proceedings of the 27th international conference on Human factors in computing systems, Boston, MA

29. Walters A, Petroni N (2007) Volatools: integrating volatile memory forensics into the digital investigation process. Blackhat Federal, Washington, DC

30. Wang JL, Loui M (2009) Privacy and ethical issues in location-based tracking systems. In: Proceedings of the IEEE Symposium on Technology and Society, Phoenix, Arizona

31. Xiong L, Tan Q (2011) A configurable approach to toleration of soft errors via partial software protection. J Converg 2(1):31–38

Dr. HaiCheng Eric Chu received his Ph.D. degree in System Science and Industrial Engineering in 1996 and Master of Computer Science in 1992 from SUNYat Binghamton respectively. He was a senior software engineer at Cheyenne Software, New York, U.S.A. in 1996. Dr. Chu was lecturing at University of Northern British Columbia (UNBC) in Canada. Currently, Dr. Chu is an associate professor at the Department of International Business of National Taichung University of Education, Taiwan. He has been devoting himself to e-Commerce over the past decade both in academic and industrial arenas. Dr. Chu attended Harvard Business School for PCMPCLV program in 2007. He has authored several textbooks respecting Management Information System, e- Commerce, Global Logistics Management, Commercial Automation, System Analysis and Design. Currently, Dr. Chu focuses on the research concerning cyber terrorism and digital forensics of mobile computing devices. Dr. Chu is an Associate Editor of Security and Communication Networks (ISSN: 1939-0122).

232 Multimed Tools Appl (2014) 71:219–234

Dr. Szu-Wei Yang received his Ph.D. degree from Japan Tokyo University. Currently, Dr. Yang is the President of National Taichung University of Education focusing on the reformation of global higher education systems. Dr. Yang received the honor as top 5 university educators from the Ministry of Education of Taiwan in year 2010. Dr. Yang strongly encourages all faculties to relentless pursuit state-of-the-art technologies and integrates them into education arena and industry cooperation.

Dr. Ching-Hsien (Robert) Hsu is currently a professor of the department of Computer Science and Information Engineering at Chung Hua University, Taiwan. His research interest is primarily in parallel and distributed computing, cloud and grid computing, P2P computing, RFID, services computing and smart homes. He has published more than 150 academic papers in journals, books and conference proceedings. He was awarded 4 times annual outstanding research award in 2005, 2006, 2007 and 2010, respectively and a distinguished award in 2008 for excellence in research from Chung Hua University. Dr. Hsu is serving in a number of journal editorial boards. He has edited more than 20 international journal special issues as a guest editor and severed many international conferences as various chairs and committee members. Dr. Hsu is currently an IEEE senior member; serve as an executive committee of IEEE Technical Committee on Scalable Computing (TCSC).

Multimed Tools Appl (2014) 71:219–234 233

Dr. Jong Hyuk Park received his Ph.D. degree in Graduate School of Information Security from Korea University, Korea. From December, 2002 to July, 2007, Dr. Park had been a research scientist of R&D Institute, Hanwha S&C Co., Ltd., Korea. From September, 2007 to August, 2009, He had been a professor at the Department of Computer Science and Engineering, Kyungnam University, Korea. He is now a professor at the Department of Computer Science and Engineering, Seoul National University of Science and Technology (SeoulTech), Korea. Dr. Park has published about 100 research papers in international journals and confer- ences. He has been serving as chairs, program committee, or organizing committee chair for many interna- tional conferences and workshops. He is a president of the Future Technology Research Association International (FTRA) and Korea Information Technology Convergence Society (KITCS). He is editor-in- chief of International Journal of Information Technology, Communications and Convergence (IJITCC), InderScience. and Journal of Convergence (JoC), FTRA Publishing. He is Associate Editor / Editor of 14 international journals including 8 journals indexed by SCI(E). In addition, he has been serving as a Guest Editor for international journals by some publishers: Springer, Elsevier, John Wiley, Oxford Univ. press, Hindawi, Emerald, Inderscience. His research interests include security and digital forensics, ubiquitous and pervasive computing, context awareness, multimedia services, etc. He got the best paper award in ISA-08 conference and the outstanding leadership awards from IEEE HPCC-09 and ICA3PP-10. Dr. Park’ s research interests include Digital Forensics, Security, Ubiquitous and Pervasive Computing, Context Awareness, Multimedia Service, etc. He is a member of the IEEE, IEEE Computer Society, KIPS, KICS, KIISC, KMMS, KDFS and KIIT.

234 Multimed Tools Appl (2014) 71:219–234

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

  • c.11042_2012_Article_1349.pdf
    • Digital evidence discovery of networked multimedia smart devices based on social networking activities
      • Abstract
      • Introduction
      • Preliminary
        • Related works
        • Our contributions
      • Volatile memory acquisition of a networked smart device and the corresponding digital forensics - a case review
        • Phase 1
        • Phase 2
        • Phase 3
        • Phase 4
        • Phase 5
        • Phase 6
      • Summary and review of the corresponding digital forensics results
      • Conclusion
      • References

Sources/Do Business Students Practive Smartphone Security.pdf

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

DO BUSINESS STUDENTS PRACTICE SMARTPHONE SECURITY? Jones, Beth H;Heinrichs, Lynn R The Journal of Computer Information Systems; Winter 2012; 53, 2; Computing Database pg. 22

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Sources/Only Play in Your Comfort Zone.pdf

ORIGINAL ARTICLE

Only play in your comfort zone: interaction methods for improving security awareness on mobile devices

Peter Riedl • Rene Mayrhofer • Andreas Möller •

Matthias Kranz • Florian Lettner •

Clemens Holzmann • Marion Koelle

Received: 14 June 2014 / Accepted: 29 January 2015 / Published online: 27 March 2015

� Springer-Verlag London 2015

Abstract In this paper, we study the concept of security

zones as an intermediate layer of compartmentalization on

mobile devices. Each of these security zones is isolated

against the other zones and holds a different set of appli-

cations and associated user data and may apply different

security policies. From a user point of view, they represent

different contexts of use for the device, e.g., to distinguish

between gaming (private context), payment transactions

(secure context), and company-related email (enterprise

context). We propose multiple visualization methods for

conveying the current security zone information to the user,

and interaction methods for switching between zones.

Based on an online and a laboratory user study, we

evaluated these concepts from a usability point of view.

One important result is that in the tension field between

security and usability, additional hardware can support the

user’s awareness toward their zone context.

Keywords Mobile security � Security zones � Sandboxing � Separation � Compartmentalization

1 Introduction

Current mobile devices are becoming the primary means of

accessing information services for a significant part of the

world population 1 , and many of the services are or will

become security-critical. In addition to mobile payment,

ticketing, and physical access control applications, we ex-

pect virtual identity documents (passports, driving licenses,

etc.), personal medical data processing, and industrial

control to move toward integration into mobile devices

such as smartphones or smart wrist watches. There are two

direct implications of these trends for future mobile device

usage: (1) Many users will use their mobile phone as their

only device for performing security-relevant tasks without

any form of prior training or exposure to more traditional

computing systems, and the services and applications will

therefore need to be intuitively usable. (2) At the same

time, these application scenarios will require higher secu-

rity than currently available on mobile device platforms.

Besides, the trade-off between usability and security is

aggravated because of the highly different requirements

between applications running on the same device and the

P. Riedl

JRC u’smile, University of Applied Sciences Upper Austria,

Softwarepark 11, 4232 Hagenberg, Austria

e-mail: [email protected]

R. Mayrhofer

JRC u’smile and Institute of Networks and Security, Johannes

Kepler Universität, Altenbergerstraße 69, 4040 Linz, Austria

e-mail: [email protected]

A. Möller

Metaio GmbH, Hackerbrücke 6, 80335 Munich, Germany

e-mail: [email protected]

M. Kranz (&) � M. Koelle Embedded Interactive Systems Lab, Universität Passau,

Innstraße 43, 94032 Passau, Germany

e-mail: [email protected]

M. Koelle

e-mail: [email protected]

F. Lettner � C. Holzmann Department of Mobile Computing, University of Applied

Sciences Upper Austria, Softwarepark 11, 4232 Hagenberg,

Austria

e-mail: [email protected]

1 By the end of 2013, the number of mobile-connected devices is

expected to exceed the number of people on earth [9].

123

Pers Ubiquit Comput (2015) 19:941–954

DOI 10.1007/s00779-015-0840-5

intrinsic context dependency: using a device within one’s

own office requires a different trade-off than using it while

crossing a busy road. Current approaches of using appli-

cation-level compartmentalization and permissions for ac-

cess control do not seem to provide a reasonable trade-off

because of their low granularity of compartmentalizing a

mobile device [15].

We hence suggest to add an intermediate layer between

the physical device platform on the lower and applications

on the upper end of the stack to provide users with a small

number of well-defined and understandable security zones.

Each zone holds a different set of applications and asso-

ciated user data, and can apply different—potentially

context-aware—security policies (such as authentication or

networking restrictions). As motivating examples for ap-

plications with different security/usability requirements,

we use mobile banking, accessing sensitive company

email, and mobile gaming. These scenarios also cover the

typical issue of bring-your-own-device (BYOD) initiatives,

which describes the problem of using a personal device

(untrusted from the organization point of view) for com-

pany purposes (e.g., reading email), and the sharing of

otherwise personal devices with friends or family [20]

(mostly in the gaming/entertainment context). Our ap-

proach addresses the ‘‘malicious app’’ threat, opposed to

the ‘‘malicious user’’ threat, which is not scope of this

work.

This concept of security zones raises research questions

in terms of secure implementation [25] and concerning

usability. From a user point of view, interacting with such

zones requires both that users are aware of which zone they

are interacting with at any time—a visualization method of

the active zone—and to actively change between zones—a

switching mechanism. Even though recent research [30]

suggests that automatic, context-based switching would be

desirable, we claim that the user should also have a way to

manually override the automatically chosen zone (e.g., if

users want to check business emails while they are not at

their workplace). Therefore, our concept of proactive se-

curity zone switching can complement context-based ap-

proaches. In this paper, we focus only on usability and

compare multiple visualization and interaction mechanisms

in terms of zone distinguishability, error rate, cognitive

overhead, satisfaction, and time spent in the context of our

motivating examples. We implemented four different vi-

sualization methods (three in software, one with additional

hardware) and four different interaction methods (two

different gesture-based approaches, selection via lock

screen, and hardware switch) and present the results of

three iterative user studies. Under the assumption that the

concept of security zones is improving the security/us-

ability trade-off (backed by products such as Blackberry

Balance and Samsung Knox), our main contribution is to

present an approach for interacting with such zones that is

intuitive, exhibits a low error rate, and seems preferable to

end users.

2 Related work

Smartphones are often shared devices. Karlson et al. [20]

found that when users share their phones with family,

friends, and colleagues, different permission levels are

applied. Voicemail, text messages, and notes were seen

more critical than sharing the device for e.g., watching a

video or making a call. Interviewees highly welcomed

security models that restrict device access, backing our

assumption that users care about security and privacy as

long as it does not cause additional burden.

To increase security awareness, different visualizations

have been proposed. Dynamic Security Skins [12] try to

prevent phishing attacks by dynamically skinning secure

UI elements which are hard to predict by attackers (i.e., the

approach is a sort of visual hash). Sesame [32] is an ex-

tension of the desktop metaphor, where the desktop can be

rotated to view security-related information ‘‘behind the

scenes.’’ This should inform security decisions of the user,

e.g., whether to allow an application to access the Internet.

However, with current state of the art in mobile plat-

forms, we have to assume all devices to be insecure: even if

sandboxing techniques are used to compartmentalize ap-

plications from each other and protect the operating sys-

tems from applications (cf. [8] for proposed improvements

to the standard Android sandbox), the overall complexity

of the whole stack leads to security-relevant issues, either

in the form of exploitable bugs [10, 17] or conceptual

problems in the sandbox restrictions [14]. Egners

et al. [13] provide a classification of threats to mobile

services into owner threats, platform threats, threats to

other users, and mobile network operator threats. As an

example for current threats to mobile device users and their

installed applications, the lack of awareness for security

updates has been identified as problematic in large-scale

app store-based studies [21, 26]. In our focus on visual-

ization and interaction, we are mostly concerned with

owner threats, and suggest to use the notion of security

zones [28] as one way to reduce their impact.

Security zones are an established concept. Stajano

et al. [31] suggest a multi-user operating system with

multiple sessions, allowing individual rights for each user,

plus one public session with applications and content non-

critical for privacy. From both a usability and implemen-

tation point of view, Feske and Helmuth [16] present an

extension to the X windowing system to indicate which

security context an application window belongs to. How-

ever, mobile devices require different approaches to

942 Pers Ubiquit Comput (2015) 19:941–954

123

visualization because window managers and the resulting

window decorations are rarely available, and running ap-

plications often use full-screen modes. TreasurePhone [30]

emphasizes the dynamic character of privacy by multiple

spheres, which represent privacy requirements in a specific

context, and which can overlap. Spheres can e.g., represent

home or work contexts, but also location. From a technical

implementation point of view, security zones can be im-

plemented by virtualization [7, 19, 28].

For explicitly switching between zones, e.g., gestures

can be used. Bragdon et al. [6] analyzed touch screen

gesture designs under different conditions. According to

them, gestures do not perform worse than soft buttons,

even ‘‘on the go.’’ However, free-form gestures resulted in

a worse performance than simpler bezel gestures. Research

suggests that also the device hardware itself can be inte-

grated in the interaction. Wolf et al. [34] investigated on-

device gestures and found that e.g., drag and lift gestures

can easily be executed one-handed when using the phone.

De Luca et al. [11] suggested back-of-device interaction

for authentication patterns as unlock alternative less prone

to shoulder-surfing attacks.

3 Conceptual background and context

3.1 Security concepts

3.1.1 Motivation for employing security concepts

As Becher et al. [3] state, ‘‘with increased processing

power and memory, increased data transmission capa-

bilities of the mobile phone networks, and with open and

third-party extensible operating systems, phones become

an interesting target for attackers.’’ Security is, to many

users, a rather abstract and vague conceptual entity. Huang

et al. [18] note that in this context, ‘‘people seldom ques-

tion the benefits of using computers and Internet for

communication and doing business.’’ Among many cate-

gories of threats identified in their study, they name espe-

cially ‘‘deliberate software attacks’’ by viruses, worms, or

Trojan horses. We explicitly try to raise awareness in users

to recognize (not to prevent) this attack type. Given the

developments and spread of mobile systems and their

ubiquitous use, it is very important to investigate usable

concepts that help to ensure information security, that is the

protection of information and the systems and hardware

that use, store and transmit that information [27]. Despite

that, so far, there has not been any major attack with large-

scale implications for a large number of mobile device

users, we feel the need to raise both awareness of the users

on security issues and, at the same time, aim at providing a

usable and effective solution in everyday contexts.

Increasing the users’ responsibility in ensuring infor-

mation security demands not only knowledge on and

awareness toward security issues, but requires to increase

the value of the role of the user. This requires, according to

Albrechtsen et al. [2], motivational aspects to account for

security and a security solution that is functional and does

not demand large additional efforts. This is especially

important in situations where the user’s primary goal of

achieving a task conflicts with security. This means, e.g.,

that the user’s desire to acquire information, such as bank

account balance, might lead her to not check if the server

certificate is trustworthy. We explicitly try keeping the

needed mental load as low as possible.

We provide a selective discussion on security concepts

limited to personal mobile devices, which are mainly used

by a single user. We explicitly do not consider multi-user

device usage, e.g., as recently introduced in the Android

operating system. For these scenarios, our approach would

be implemented for every user. Related concepts, such as

safety and privacy, are not investigated within this work, as

our primary focus is on visualization and interaction

concepts.

3.1.2 Zones

The concept of zones, as we use it in this work, is that of

disjunct spheres of concerns. The zones are intended to

allow for and provide a clear separation between things

(applications, data, …) that should be kept distinct. One implementation in a mobile enterprise context, for two

zones, is the so-called ‘‘BlackBerry Balance,’’ enabling

users to keep both personal data and business data

separated from each other. This e.g., ensures that business

emails are always accessed only from the business mail

application. This concept has also been pursued in a high-

security governmental context, but also only limited to the

two zones ‘‘open’’ and ‘‘secure 2 ’’. While this distinction is

sufficient from a corporate point of view, it is not for an

individual. Being in their private zone, users might still

have different security demands, e.g., for mobile banking

or playing a web-based game.

Strictly separating the zones implies that apps might

exist multiple times—one time for each zone. An example

for this multiplicity would be an email application. The

same app will be present in each of the zones, but always

use different data, not allowing to access business data in a

private context.

During initial discussions with end users and by

evaluating existing concepts, we identified three distinctive

types of zones that can be used as a basis to separate

2 http://www.telekom.com/media/enterprise-solutions/200664, last

visited 09/09/2013.

Pers Ubiquit Comput (2015) 19:941–954 943

123

concerns on single-user mobile devices. Our concept al-

lows for the introduction of additional zones, depending on

the personal context of the mobile user (e.g., multiple

business zones instead of one if the user had multiple jobs).

A limiting factor will be though the interaction concepts

used for switching between them. We will elaborate on this

in the section on the potential mechanisms for changing

from one zone to another. The three most important types

of zones, to us, are:

• Open zone This zone is unrestricted (full network access, all apps can be installed and started at any

time). This zone could, e.g., be used when playing

games, such as ‘‘Angry Birds.’’ The purpose of this

zone is to provide all functionalities and freedom users

are currently used to. Therefore, it also faces the same

security concerns (e.g., malware infection by third party

application stores).

• Secure zone This zone is partially restricted, that is, only secure apps can be installed and executed that do

fulfill certain criteria, e.g., certain trusted applications

that come with a valid issuer certificate. This zone

could be used for applications with a higher security

demand, e.g., when confidential personal data or pay-

ment information is involved, such as mobile banking.

This zone is fully controlled by the user, in contrast to

the remotely ‘‘managed zone.’’

• Managed zone This zone is managed by an enterprise, meaning that the users cannot control themselves which

apps can be installed or which networks the device

connects to when being in this zone. The remote

administration contributes both to a high level of

security and comfort for the user. An example would be

corporate Intranet access or corporate email.

3.1.3 Security on platform level (software and hardware)

Common software-level concepts for security include ac-

cess control, e.g., on application level (only a certain user

might execute apps) or on file system or user level (only a

certain user might have access). These concepts are too

limited in several ways. It would, e.g., require the user to

have a dedicated app for each email context. This, we ar-

gue, will result in confusion (due to an additional cognitive

load upon the user to memorize which context an email app

belongs to) and maybe in a threat toward the security goals.

3.2 Interaction and visualization concepts

We have chosen Google’s Android mobile OS as basis for

our implementation, as Android allowed us more modifi-

cations at a lower system level, e.g., to substitute the lock

screen, define additional gestures, or include external

hardware. While other mobile platforms have different

overall user interface concepts, most individual interaction

concepts, such as device unlocking or touch gestures, re-

semble each other. We hence argue that an adoption and

implementation of the concepts with the iOS platform

would have yielded comparable results.

3.2.1 Interaction concepts for switching zones

Given the rich sensing and input modalities offered by

current mobile devices, different interactions for zone

switching are possible. Below we discuss the concepts on a

general level. The specific details (including figures) are

described together with the prototype. All switching

mechanisms are, from an interaction point of view, known

to the user (e.g., swiping). Thus, familiarity and thereby

educated feedback from the users should be possible, de-

spite the novel security context.

As discussed, usability of security is a key factor for

user acceptance. Therefore, the switching methods have to

be simple to perform, easy to memorize, quickly accessi-

ble, but at the same time do not have to interfere with

existing input actions.

We have presented examples discussing the usability of

both touch screen- and hardware-based mobile interaction

in the Related Work section [6, 11, 34]. We have chosen to

investigate two touch screen-based switching mechanisms

(swiping, gestures), a combination of touch screen-based

and physical input (lock screen) and hardware-based

switching mechanism (using a physical switch on the

added casing of the device).

3.2.2 Visualization concepts for zone awareness

In this part, we discuss the selected concepts for making

the user aware of the current security zone. Besides simply

using the zone names for identifying zones, colors can be a

means for unobtrusive and easily perceptible awareness of

which zone the user is currently in.

The idea of visualizing the security status of a Web site

by the use of colored browser themes has e.g., been used

by Maurer et al. [24]. They change the color of the whole

browser theme to indicate the validity of a server’s SSL

certificate and thereby the information security of the

user’s data on this page. They used a greenish theme for an

extended validation of the certificate, blue for a standard

SSL certificate and a reddish color for unencrypted page

content.

Colors for coding information have, besides many ad-

vantages, also significant shortcomings. There are cultural

differences in the interpretation and perception of colors [5,

29], though there are also indications that some asso-

ciations seem to be common in their perception [1]. In

944 Pers Ubiquit Comput (2015) 19:941–954

123

addition, there exist different types of color blindness [33].

We, though, have chosen to use color-based information

mediation of the current security zone as we feel that the

potential individual shortcomings can all be addressed and

thus counterbalanced. The display of the current zone with

the associated color might give an attacker some infor-

mation, but we feel that shoulder surfing for gaining per-

sonal data is a bigger risk toward information security than

displaying the zone information [23]. The possibility of

personalization is important regarding acceptance of ser-

vices and systems. The lack thereof might give the user a

feeling of lack of control. By adding the option to per-

sonalize the color scheme, including color values, hue, and

saturation, toward ones own preferences, we would not

only support the normal user, but also allow a color-blind

person to select distinguishable colors. We are aware that

using colors for indicating the security zones might lead to

scalability issues: on the one hand, memorizing a larger

number of color–zone associations would put a mental load

on the user; on the other hand, the number of easily dis-

tinctive colors is limited.

In our implementation, we have chosen red, green, and

blue as colors for visualizing the zones. While the colors

were mainly chosen with focus on distinctiveness, we

opted against yellow, as it could have implied a ‘‘middle

secure/dangerous’’ zone (incorrect association with traffic

lights).

The association between colors and zones was, for our

cultural context, chosen as follows:

• Red standard/open zone; red implying potential risks • Green private/secure zone; green implying safety • Blue business/managed zone; blue as distinctive 3rd

color

The color scheme can be combined with different visual-

ization elements as described in the following.

We, in the following, only used the coloring as de-

scribed below. It can be assumed that repeating the indi-

vidual color in other user interface elements will

additionally contribute to the user’s awareness. This is,

though, not part of the current work.

3.3 Motivation for software and hardware prototypes

While several alternatives could potentially be investigated

with a pure questionnaire approach or using a Wizard-of-

Oz approach with relation to the implementation, there

exists the possibility to miss a ‘‘good’’ combination of vi-

sualization and switching mechanism due to this study

setup. To be able to investigate the potential of the different

visualization and switching approaches, we designed a

three-step study setup. By this process, described in detail

below, we aimed at reducing the number of options

(number of visualizations � number of switching mechanisms) to an amount that can be handled in a hands-

on laboratory study.

4 Visualizations

In this section, we describe our proposed visualizations for

the currently active security zone and elaborate on ad-

vantages and disadvantages thereof. A summary of ad-

vantages and disadvantages of all visualizations is given in

Table 1.

4.1 Colored border visualization (CBV)

The CBV (see Fig. 1) consists of a colored border around

the entire visible screen. The intent of this visualization is

to constantly inform the user about the currently active

zone unobtrusively. Neither the notification bar nor the

displayed soft buttons are enclosed within this border. The

reason for this is that depending on the hardware (mobile

device), the soft buttons may be visible or not. The noti-

fication bar is also not visible all the time, so in order to

keep a consistent user experience, we decided to exclude

this area. One advantage of this approach is that regardless

of the running application, the user is continuously aware

of the currently active security zone. A disadvantage of this

visualization is that the border inevitably reduces the dis-

play space available for applications to a certain extent,

depending on the pixel width of the border.

4.2 Colored notification bar visualization (CNV)

The CNV (see Fig. 1) uses the notification bar to visualize

the currently active security zone. The background color of

the notification bar is set to the color of the active zone

according to the color scheme. The advantage of this vi-

sualization is that the user is informed about the currently

active security zone in an ambient manner whenever the

notification bar is visible. This is also a disadvantage of this

approach: whenever the notification bar is not visible

(e.g., when using full-screen applications), the user is not

reminded about the security zone. Another potential

Table 1 Advantages and disadvantages of the presented visualizations

Visualization Advantages Disadvantages

CBV Continuity Reduced screen size

CNV Ambient Incontinuity, theme interference

CTV Low cognitive

load

Attention shift, incontinuity, theme

interference, space requirements

HWV Continuity Additional hardware

Pers Ubiquit Comput (2015) 19:941–954 945

123

problem is customized operating system themes which

could interfere with a colored notification bar.

4.3 Colored text visualization (CTV)

The CTV (see Fig. 1), like CNV, uses the notification bar to

visualize the currently active zone. This is done by dis-

playing the name of the currently active zone in its re-

spective color according to the color scheme presented in

the Concept section. One clear advantage of this visual-

ization is the low cognitive load for the user—even if users

do not remember the color scheme, they can simply read the

name of the zone. One disadvantage is that it is not easily

possible to inform the user about the currently active zone in

an ambient manner. Users explicitly have to shift attention,

away from their current task, to the notification bar in order

to read the name of the zone. Besides this fact, it suffers

from the same disadvantages as CNV when the notification

bar is not visible or when custom themes are used.

4.4 Hardware visualization (HWV)

Unlike all previously mentioned visualizations, the HWV

(see Fig. 1) combines software and hardware to visualize the

currently active zone. We used transparent resin to cast a

case for the device which enables us to place a micropro-

cessor board in the case and multi color light emitting diodes

(LEDs) around the device. The LEDs are used to illuminate

the case in the color of the respective zone according to the

color scheme. An advantage of this visualization is that—

regardless of the displayed information on the device (e.g.,

home screen, full-screen application, etc.)—the security

zone is conveyed to the user. A disadvantage of this solution

is the need for additional hardware that is as of now not

available on off-the-shelf mobile devices.

5 Switching mechanisms

In this section, we explain all proposed switching

mechanisms and their respective advantages and disad-

vantages. A summary thereof is given in Table 2.

5.1 Gesture switching mechanism (GSM)

The GSM (see Fig. 2) leverages gestures to switch between

the different security zones. The gesture to switch to the

desired zone is the first letter of the zone name according to

the one stroke alphabet [4]. This alphabet uses gestures that

closely resemble well-known Arabic letters that can still be

drawn in a single stroke. We chose this approach to

minimize the learning effort and cognitive load for the

user. An advantage of GSM is that the desired zone can be

directly accessed, which could reduce the task time for

experienced users. Disadvantages are that the user has to

remember all zone names and that recognition—especially

of more complex gestures—is error-prone.

5.2 Lock screen switching mechanism (LSM)

The LSM enhances the lock screen with the functionality to

switch between security zones. In contrast to all other

switching mechanisms presented here, LSM requires switch-

ing to the lock screen to perform a zone change. The full

description of the switching process is depicted in Fig. 3.

With LSM, the user can directly access the desired zone

without having to navigate through other zones. To perform a

switch with LSM, the user has to perform more actions than

with the other switching mechanisms. Because the names of

all available zones are displayed on the lock screen, there is no

need to remember the order of zones (as e.g., necessary for

SSM), or which zones are available. Another advantage of

LSM is the increased awareness about the zone switch.

Fig. 1 Security zone visualizations from left to right:

HWV hardware visualization,

CBV colored border

visualization, CNV colored

notification bar visualization,

CTV colored text visualization

Table 2 Comparative discussion of the four switching mechanisms in terms of selected properties

Switching Advantages Disadvantages

GSM Direct access Cognitive load, error-prone

LSM Direct access,

awareness

Multiple steps, time-consuming

SSM Simple, well-

known

Error-prone, no direct access, in-

app gesture interference

HSM Simple, awareness,

haptic feedback

No direct access, additional

hardware, limited number of

zones

946 Pers Ubiquit Comput (2015) 19:941–954

123

5.3 Swipe switching mechanism (SSM)

The SSM (see Fig. 4) utilizes a horizontal three-finger

swipe gesture to switch between security zones. One

common application for that interaction method is

e.g., browsing through a picture gallery. We adopted this

technique to browse through security zones in a circular

manner. This means, consecutive swipes in the same di-

rection (left or right) will switch through all available zones

until the initial zone is reached again eventually. One ad-

vantage of this approach is simplicity.

This might include the potential for unintentional zone

changes. A disadvantage of SSM is that the desired zone

cannot be accessed directly—it may happen that the user

has to swipe through several zones to reach the desired one.

5.4 Hardware switching mechanism (HSM)

In order to switch between zones using the HSM (see

Fig. 5), we again leverage the custom-built transparent

resin case. Besides LEDs, we mounted a three-state (left,

center, right) slide switch on the top of the case. The state

of the switch directly determines the selected security zone.

We intentionally did not place the switch on the sides of

the case to avoid accidental zone switches and to enforce

explicit user interaction to raise awareness about the cur-

rently active security zone.

One disadvantage of this approach is the need for ad-

ditional hardware. Another disadvantage is that if the

current zone is the one associated with the left position and

users want to switch to the zone associated with the right

position, they inevitably have to go through the zone at the

center position. The HSM also limits the number of secu-

rity zones to the number of available states.

6 Evaluation

6.1 Scenarios

The scenario the participants were presented was inspired

by a typical workday. The daily routine of getting up,

performing tasks at work, and relaxing in the evening was

imitated. The story associated with the scenario started

with the user getting up in the morning and checking the

private bank account. This is a typical example for the use

of the Secure zone. The second task was to check business

emails—in the Managed zone. Finally, after the workday,

the task was to relax playing a game, to be performed in the

Open zone.

6.2 Questionnaire

To gain user feedback on the zone visualizations and

switching mechanisms, we used a questionnaire both in the

online and the laboratory study. Subjects rated the look and

effectiveness of visualizations, and the memorability and

simplicity of switching mechanisms. While the ratings

Fig. 2 The gesture switching mechanism (GSM) allows to directly switch to the desired zone by drawing the starting letter of the zone

name. Note The border color indicates the zone that will be switched

to after the gesture

Fig. 3 The lock screen switching mechanism (LSM)

allows to change zones on the

lock screen. For the depicted

switching method, the colored

border visualization (CBV) has

been used in this example

Pers Ubiquit Comput (2015) 19:941–954 947

123

were based on video demonstrations in the online study,

they were based on a real prototype in the laboratory study.

In addition, we collected in the online study, in a second

part of the questionnaire, information on mobile device

usage. These questions covered in particular the number

and purpose of used devices, their operating systems,

separation between work and private devices and tasks

associated with these devices. Goal of these questions was

to obtain an impression of current device usage and

awareness for potential security risks associated with this

usage behavior.

If not stated otherwise, questionnaire items were an-

swered on a five-step Likert scale, where one corresponds

to ‘‘strongly disagree’’ and five to ‘‘strongly agree.’’ When

reporting the results, we use a for significance levels and r for standard deviations.

6.3 Pilot study

We conducted a pilot study to test the questionnaire, the

implementations of the prototype and the logging

mechanism, and to identify potential problems. The pilot

was run with 30 participants (four female, 26 male, avg.

age 29, r = 4.3) who answered the questionnaire and evaluated the visualizations and switching mechanisms.

The pilot revealed some interesting findings on what could

be improved for the next iteration of the prototype. The

initial zone names Standard, Private, and Business were

changed to Open, Secure, and Managed, since especially

Private was frequently misconceived as the leisure zone,

instead of the privacy-preserving zone. Further, we im-

proved the gesture recognition, as some participants had

problems drawing the zone name in the GSM method.

Likewise, some wordings in the questionnaire were

improved.

6.4 Online study

6.4.1 Participants

One hundred and fifty participants took part in the survey

(36 female, 114 male); the average age was 27 years (r = 5.8). They were recruited via social network cross-posting

(second-tier network context) so that the initiator was un-

known, which suggests unbiasedness in participation. Most

subjects originated from Central Europe and the UK, but

also from Asia and India.

6.4.2 Task and measurements

Participants answered an online questionnaire consisting of

two parts. In the first part, we asked about the usage be-

havior of mobile devices, especially with relation to mul-

tiple devices and security-related aspects. We hoped to

gather indicators on potential security problems, motivat-

ing our zone concept.

In the second part, the zone concept presented above

was introduced to subjects. After a textual description of

the concept, videos of three zone visualizations and three

switching mechanisms were shown and subsequently

evaluated by the subjects. The presented visualizations of

the current zone were CNV, CBV, and CTV (cf. Sect. 4).

The presented switching mechanisms were SSM, GSM, and

LSM. The order of the presentation of visualization and

switching mechanisms in the questionnaire was random-

ized between participants to avoid learning effects.

Fig. 4 The swipe switching mechanism allows to switch

between zones with a three-

finger swipe gesture

Fig. 5 The hardware switching mechanism utilizes the sliding switch mounted on the custom-built case to switch between zones

948 Pers Ubiquit Comput (2015) 19:941–954

123

6.5 Online study results

6.5.1 Device usage

Sixty-one percentage of subjects own more than one mo-

bile device; 10 % have even four or more. The most

common device type were phones, followed by tablets,

and, significantly less, media consumption devices (music

players, ebook readers), and sports devices (fitness track-

ers, etc.). The most common platforms in our sample were

Android (57 %) and iOS (19 %).

If subjects have multiple devices, they are also using

them regularly. Forty-one percentage use their primary

device everyday. For secondary devices, daily usage was

reported by 57 % of subjects, for tertiary devices by 71 %,

and for quaternary devices by even 87 %. At first sight, this

looks as if primary devices are used less frequently than

non-primary devices. However, the rising quotas for sec-

ondary to quaternary devices reflect the fact that the per-

centage values for the n-th device include subjects that only

have n devices in total.

This means the more devices people have, the more they

tend to use all of them—potentially in different

environments.

In particular, we were interested in what those devices

are used for (e.g., shared work and private usage on one

device), which would justify the proposed zone concept.

The amount of business-related usage rises from primary to

quaternary devices, probably because non-primary devices

are often dedicated work phones or tablets. While 20 % use

their primary device for business purposes, the amount of

work usage is 33 % for the secondary, 31 % for tertiary,

and 67 % for quaternary devices. However, we found that

work usage is not exclusive: 17 % use their primary device,

29 % the secondary, 28 % the tertiary, and 53 % the

quaternary device for both private and work applications.

Only 66 % of subjects indicated to separate devices by task

(e.g., using their work device only for office tasks and their

private device only for private tasks). Even less (28 %)

separate by location (e.g., using their work device only in

the secure enterprise network). This implicitly tells about

the security awareness of subjects. For example, some

subjects stated to read business mails on private devices (or

the other way round), to use their business phones to do

payments (e.g., banking), and to use social network apps.

6.5.2 Zone visualizations

Subjects rated the look (‘‘The look of the visualization was

appealing’’) and effectiveness (‘‘The different zones were

distinguishable with the visualization’’) of each of the three

visualizations. Friedman rank sum tests revealed a

significant effect of visualizations on look (v2 = 47.92, p \ 0.001) and effectiveness (v2 = 9.11, p = 0.01). Post hoc Wilcoxon tests with Bonferroni correction showed that the

look of CNV was rated significantly better than that of the

other visualizations (p \ 0.001), and that the effectiveness of CNV was significantly better than of CBV (p = 0.008).

There were no significant differences in look or effective-

ness between CBV and CTV. The results are visualized in

Fig. 6a.

Subjects presumably found the color in the notification

bar easier to perceive than at the screen border. Addition-

ally, some criticized the loss of screen real estate with the

border visualization. In the free-text comments in the

questionnaires, participants mentioned general drawbacks

both for text and color representations. Color (both for

CNV and CBV) requires the memorization of the mapping

to the respective zones, which is not a problem of CTV.

However, CTV takes up precious space in the notification

bar. Another raised issue is the usage of color-only repre-

sentation for color-blind users. However, in Sect. 3, we

presented an idea on how to resolve this by custom color

schemes.

6.5.3 Switching mechanisms

Subjects rated each switching mechanism in the dimen-

sions memorability (‘‘The switching mechanism can easily

be memorized’’), and simplicity of execution (‘‘The

switching mechanism can be applied easily’’). In all di-

mensions, LSM was evaluated best; second-best was SSM,

followed by GSM. Friedman rank sum tests showed a

significant effect of switching mechanisms on under-

standability (v2 = 28.65, p \ 0.001), memorability (v2 = 84.38, p \ 0.001), and simplicity (v2 = 88.79, p \ 0.001). Post hoc Bonferroni-corrected Wilcoxon tests showed differences between all mechanisms to be sig-

nificant, with p \ 0.002 for understandability and p \ 0.001 for memorability and simplicity. The results are shown in Fig. 6b.

Results suggest that GSM was seen as too complicated,

which was confirmed by free-text answers in the ques-

tionnaire. It requires, firstly, a high cognitive effort to re-

member the first letter of the desired zone, and secondly,

the drawing skill to fulfill the gesture. SSM was easier to

understand and perform, but has a higher risk of accidental

switches and of a confusion with multi-finger swipes that

are mapped to other functions within applications. Like-

wise, the ‘‘position’’ of each zone must be memorized to

know whether to swipe left or right. LSM does not require

to remember a mapping between the desired zone, and it is

unlikely to be performed erroneously. However, in its

present form, it is applicable only for a limited number of

Pers Ubiquit Comput (2015) 19:941–954 949

123

zones (fitting around the unlock circle). In order to scale for

significantly more zones, a recursive pie selection

mechanism could be applied, similar to e.g., the contextual

menu in Android 4.3’s stock camera app.

6.6 Laboratory study

6.6.1 Motivation

With the online study, we gained first usability results of

our initial choice of visualizations and switching mechan-

isms. It helped us to define a manageable subset for a

laboratory study, in which the methods could now be

evaluated based on hands-on experiments. We excluded

GSM, as this was the significantly worst rated switching

mechanism. Instead, we introduced HSM as new condition

(which was not part of the previous study since it would

have been difficult to evaluate online). For visualizations,

we added HWV and instead dropped CBV. First, CBV re-

ceived a rather poor rating and, second, HWV shares the

idea of continuity (going around the whole screen) with

CBV, so that we considered HWV as improved replacement

of CBV, using the feedback from the pilot study.

6.6.2 Participants

Thirty volunteers took part in the study. Nine were female,

21 male; the average age was 33 years (r = 10.3). All participants except one were right handed. A multitude of

professions was covered by the participants (e.g., gardener,

researcher...). However, the minority of them were familiar

with compartmentalization concepts like BlackBerry Zone

(1/30) or Android multi-user functionality (3/30). This also

accounts for unbiasedness toward the presented experiment.

Fig. 6 Evaluations of zone visualizations and switching

mechanisms in the online study.

a Online study: evaluation of zone visualizations, b Online study: evaluation of switching

mechanisms

950 Pers Ubiquit Comput (2015) 19:941–954

123

6.6.3 Task and measurements

Subjects performed a task according to the scenario de-

scribed in the beginning of the Evaluation section. The task

consisted in launching three applications, each in a dif-

ferent zone (the business email app in the Managed zone,

the home banking app in the Secure zone, and a game in

the Open zone). It was up to participants to decide which

was the right zone for each task. Each participant per-

formed the task three times, each time with a different of

the following switching mechanisms: Swiping with three

fingers (SSM), using a hardware switch (HSM), and se-

lecting the zone from the unlock mechanism on the lock

screen (LSM). The order of switching mechanisms was

randomized to avoid learning effects.

The zone visualizations were varied in a between-sub-

jects design. Each group used one of the following visu-

alizations for all tasks: CNV, CTV, or HWV. After each

task, subjects evaluated their experience in a questionnaire.

All interactions (touch events, the currently visible

screen, etc.) on the device were logged with the method-

ology as described by Lettner et al. [22]. This did not only

allow us to capture the exact time needed to complete the

task, but also to detect whether subjects made errors (every

deviation from the optimal path to navigate to the desired

zone was considered an error).

6.7 Laboratory study results

6.7.1 Zone visualizations

Similar to the online study, the three visualizations were

rated by the dimensions look and effectiveness. A Fried-

man test showed a significant effect of visualizations on

look (v2 = 9.92, p = 0.007) and on effectiveness (v2 = 7.19, p = 0.03). Post hoc Wilcoxon tests with Bonferroni cor-

rection showed that the look of CNV was rated significantly

better than of the other visualizations (p \ 0.05); there was no significant difference between HWV and CTV. Further,

CNV was significantly more effective than CTV

(p \ 0.005). The results are visualized in Fig. 7a. CNV and HWV can thus be both considered as best

options with relation to ‘‘effectiveness.’’ However, HWV

performs worse in the ‘‘appeal of look’’ category, which

may have two reasons. First, the case is in early prototypic

state and does not yet look as smooth as a final product.

Second, some participants noted that they do not want

nearby persons to see in which zone they currently are.

This privacy problem could be addressed by a customiz-

able matching of colors and zones. A certain color would

then only have a meaning to the owner of the device and

not provide any information to others.

6.7.2 Switching mechanisms

Subjects rated each switching mechanism in the dimen-

sions memorability and simplicity of execution. There was

a significant effect of switching mechanisms on memora-

bility (v2 = 14.56, p \ 0.001) and simplicity (v2 = 10.05, p \ 0.007). Post hoc Wilcoxon tests with Bonferroni cor- rection showed that HSM was easier to memorize and

simpler to perform than LSM (p \ 0.05). There were no significant differences between the other methods. All an-

swers can be seen in Fig. 7b.

Interestingly, this result differs from the online study,

where LSM was evaluated to be significantly simpler. This

could be due to the drawback of LSM that the user must

switch off and on the device to change zones. This addi-

tional step was probably less noticeable in the online study.

The higher number of steps presumably were responsible

for the fact that LSM received an even weaker memora-

bility rating than SSM, although SSM requires actually

more memorization (of each zone’s position), which LSM

does not.

6.7.3 Zone switching performance

Subjects performed the zone switching task with HSM in

averagely 38.27 s (r = 16.87 s). The average time needed with SSM was 44.30 s (r = 23.88 s), and with LSM it was 53.87 s (r = 29.18 s). With one-way repeated-measure ANOVA, we found a significant effect of the switching

mechanism on task time (F(2,58) = 5.123, p \ 0.01, partial g2 = 0.07). Post hoc t-tests (with Bonferroni correction) revealed the significant difference between HSM and LSM

(p \ 0.05). The results are visualized in Fig. 8a. The error rate was lowest with LSM with averagely 0.77

errors (r = 1.10), followed by HSM with averagely 1.10 errors (r = 0.99), and by SSM with averagely 2.07 errors (r = 1.91). A one-way repeated-measure ANOVA showed a

significant effect of the switching mechanism on errors

(F(2,58) = 3.194, p \ 0.01, partial g2 = 0.14). Post hoc t- tests (with Bonferroni correction) revealed that the error

number was significantly higher in SSM than in HSM

(p \ 0.05) and LSM (p \ 0.001). The results are shown in Fig. 8b.

The measurements show a clear advantage for HSM, in

comparison with software-based methods regarding the

switching time. While LSM showed similarly little errors

compared to HSM, it was clearly the slowest method, as the

display always had to be switched off and on again to get

into the lock screen. The greatest drawback of SSM was its

high error rate, which supports our proposition that a

hardware-based solution is the best alternative both in

terms of speed and errors.

Pers Ubiquit Comput (2015) 19:941–954 951

123

7 Discussion

Objective and subjective measurements showed that dif-

ferent visualizations and switching mechanisms yield sig-

nificant usability differences. In line with our

argumentation that security concepts must be usable to be

accepted and applied by users, we intend to give recom-

mendations toward achieving this goal with our findings. In

the following, we summarize and discuss the most sig-

nificant lessons learned.

Color (CTV and HWV) was more popular than text

(CTV) to visualize the current zone, suggesting that the

attention shift required for CTV was problematic. Thus, we

suggest to use (at least an additional) color-coding for vi-

sualizing the zone. A hardware solution has, in addition,

the advantage that it is harder to manipulate and also

visible for full-screen apps.

For switching between zones, complex gestures (GSM)

turned out to be too complicated. While multi-finger

swiping (SSM) was easier, the risk of interference with

other gestures was still given. The lock screen mechanism

(LSM) was an all-discipline ‘‘winner’’ in theory (i.e., in the

online study), but turned out as the slowest method in the

laboratory study. A clear favorite was the hardware switch

(HSM), which was both intuitive and fast. It is, however,

only applicable for a small number of zones. While we

argued that for most cases such a small number will suffice,

this could still be a drawback for more complex scenarios.

The software-based switching mechanisms support

(through adaptation) more zones.

For multi-user device sharing, a future challenge will be

how to switch between user accounts and zones (e.g., the

question whether selecting the user or the zone first). A

possible solution could be to implement user switching via

Fig. 7 Evaluations of zone visualizations and switching

mechanisms in the laboratory

study. a Laboratory study: evaluation of zone

visualizations, b laboratory study: evaluation of switching

mechanisms

952 Pers Ubiquit Comput (2015) 19:941–954

123

the lock screen (as, e.g., in current Android versions) and

combine this with a hardware switch for the zones.

8 Conclusion

The presented work discusses the concept of security zones

in terms of zone visualization and inter-zone switching.

Security zones allow to introduce an intermediate layer of

compartmentalization to mobile interaction which allows

the user to act within distinct semantic contexts in order to

account for different security and privacy needs. As two

key requirements, we identify the induction of the users’

awareness of which zone they are currently acting in, and

the provision of a mechanism that enables to actively

switch among zones.

We presented an evaluation of four visualization types

and four switching mechanisms staged into pilot, online,

and laboratory study. Our results imply that additional

hardware can provide usable zone awareness and switch-

ing, and is thus a promising candidate for further

investigations.

Future work could include refinements of the presented

concepts above, and adapting them to more scenarios. One

challenge is the integration of security zones with multiple

user accounts and a thorough investigation of related

questions (e.g., if then several open zones would exist).

Furthermore, as we have argued for the benefits of hard-

ware modifications, we plan to combine the presented

hardware-based switching mechanisms and visualizations

with hardware-level security (e.g., TPM). We will also

investigate the effectiveness of zone visualizations with

relation to attacks, i.e., how well users can detect when

frauds try to mislead them by mimicking a different zone.

Acknowledgments Part of this work has been carried out within the scope of u’smile, the Josef Ressel Center for User-Friendly Secure

Mobile Environments. We gratefully acknowledge funding and sup-

port by the Christian Doppler Gesellschaft, A1 Telekom Austria AG,

Drei-Banken-EDV GmbH, LG Nexera Business Solutions AG, and

NXP Semiconductors Austria GmbH. Part of this work has been

carried out within the project ‘‘AUToMAte – Automatic Usability

Testing of Mobile Applications’’ funded by the Austrian Research

Promotion Agency (FFG) under Contract Number 839094.

References

1. Adams FM, Osgood CE (1973) A cross-cultural study of the

affective meanings of color. Cross-Cultural Psychol 135–156.

doi:10.1177/002202217300400201. http://jcc.sagepub.com/con

tent/4/2/135.abstract

2. Albrechtsen E (2007) A qualitative study of users’ view on in-

formation security. Comput Secur 276–289. doi:10.1016/j.cose.

2006.11.004. http://www.sciencedirect.com/science/article/pii/

S0167404806002033

3. Becher M, Freiling F, Hoffmann J, Holz T, Uellenbeck S, Wolf C

(2011) Mobile security catching up? Revealing the nuts and bolts

of the security of mobile devices. In: IEEE symposium on se-

curity and privacy, pp 96–111. doi:10.1109/SP.2011.29

4. Blickenstorfer CH (1995) Graffiti: Wow!. Pen Comput Mag

1:30–31

5. Bornstein MH (1973) Color vision and color naming: a psy-

chophysiological hypothesis of cultural difference. Psychol Bull

257–285. http://www.biomedsearch.com/nih/Color-vision-color-

naming-psychophysiological/4742311.html

6. Bragdon A, Nelson E, Li Y, Hinckley K (2011) Experimental

analysis of touch-screen gesture designs in mobile environments.

In: Proceedings of the CHI. ACM, pp 403–412. doi:10.1145/

1978942.1979000

7. Brakensiek J, Dröge A, Botteck M, Härtig H, Lackorzynski A

(2008) Virtualization as an enabler for security in mobile devices.

In: Proceedings of the IIES. ACM, pp 17–22. doi:10.1145/

1435458.1435462

8. Bugiel S, Davi L, Dmitrienko A, Heuser S, Sadeghi AR, Shastry

B (2011) Practical and lightweight domain isolation on android.

In: Proceedings of the SPSM’11. ACM, pp 51–62. doi:10.1145/

2046614.2046624

9. Cisco (2013) Visual Networking Index: Global Mobile Data

Traffic Forecast Update, 2012–2017. Tech. rep

10. Davi L, Dmitrienko A, Sadeghi AR, Winandy M (2011) Privilege

escalation attacks on android. In: Proceedings of the ICS.

Springer, pp 346–360. http://dl.acm.org/citation.cfm?id=

1949317.1949356

11. De Luca A, von Zezschwitz E, Nguyen NDH, Maurer ME,

Rubegni E, Scipioni MP, Langheinrich M (2013) Back-of-device

authentication on smartphones. In: Proceedings of the CHI.

ACM, pp 2389–2398. doi:10.1145/2470654.2481330

Fig. 8 Measurements of task completion time and errors for

the zone switching task,

Comparing Hardware (HSM),

Swipe (SSM), and Lock screen

(LSM) switching mechanisms.

The error bars indicate the

standard error. a Task completion times, b task errors

Pers Ubiquit Comput (2015) 19:941–954 953

123

12. Dhamija R, Tygar JD (2005) The battle against phishing: dy-

namic security skins. In: Proceedings of the SOUPS. ACM,

pp 77–88. doi:10.1145/1073001.1073009

13. Egners A, Marschollek B, Meyer U (2012) Hackers in your

pocket: a survey of smartphone security across platforms. Tech.

rep. http://itsec.rwth-aachen.de/publications/ae_hacker_in_your_

pocket.pdf

14. Egners A, Meyer U, Marschollek B (2012) Messing with an-

droid’s permission model. In: Proceedings of the TrustCom.

IEEE. 2012, pp 505–514. doi:10.1109/TrustCom.203

15. Felt AP, Ha E, Egelman S, Haney A, Chin E, Wagner D (2012)

Android permissions: user attention, comprehension, and behav-

ior. In: Proceedings of the SOUPS. ACM, pp 3:1–3:14. doi:10.

1145/2335356.2335360

16. Feske N, Helmuth C (2005) A nitpicker’s guide to a minimal-

complexity secure GUI. In: Proceedings of the ACSAC, pp 85–94

17. Höbarth S, Mayrhofer RA (2011) Framework for on-device pri-

vilege escalation exploit execution on android. In: Proceedings of

the IWSSI/SPMU, pp 1–6

18. Huang DL, Rau PL, Salvendy G (2007) A survey of factors in-

fluencing people’s perception of information security. In: Hu-

man–computer interaction: applications and services, LNCS.

Springer, pp 906–915. doi:10.1007/978-3-540-73111-5_100

19. Hwang JY, Suh SB, Heo SK, Park CJ, Ryu JM, Park SY (2008)

Xen on arm: system virtualization using xen hypervisor for

ARM-based secure mobile phones. In: Proceedings of the CCNC.

IEEE, pp 257–261. doi:10.1109/ccnc08.2007.64

20. Karlson AK, Brush AB, Schechter S (2009) Can I borrow your

phone?: Understanding concerns when sharing mobile phones. In:

Proceedings of the CHI. ACM, pp 1647–1650. doi:10.1145/

1518701.1518953

21. Kranz M, Murmann L, Michahelles F (2013) Research in the

large: challenges for large-scale mobile application research—a

case study about NFC adoption using gamification via an App

store. IJMHCI 5(1), 45–61. doi:10.4018/jmhci.2013010103.

http://www.igi-global.com/article/research-large-challenges-large-

scale/76334

22. Lettner F, Holzmann C (2012) Automated and unsupervised user

interaction logging as basis for usability evaluation of mobile

applications. In: Proceedings of the MOMM. ACM, pp 118–127.

doi:10.1145/2428955.2428983

23. Luo XR, Brody R, Seazzu AF, Burd SD (2011) Social engi-

neering: the neglected human factor for information security

management. IRMJ 24(3):1–8. doi:10.4018/irmj.2011070101

24. Maurer ME, De Luca A, Stockinger T (2011) Shining chrome:

using web browser personas to enhance SSL certificate visual-

ization. In: Proceedings of the INTERACT, LNCS. Springer,

pp 44–51. doi:10.1007/978-3-642-23768-3_4

25. Mayrhofer R (2013) When users cannot verify digital signatures:

on the difficulties of securing mobile devices. In: Proceedings of

the TSP. IEEE

26. Möller A, Michahelles F, Diewald S, Roalter L, Kranz M (2012)

Update behavior in app markets and security implications: a case

study in google play. In: Poppinga B (ed) Proceedings of the 3rd

international workshop on research in the large. Held in Con-

junction with Mobile HCI, pp 3–6

27. Polla ML, Martinelli F, Sgandurra D (2013) A survey on security

for mobile devices. IEEE Communications Surveys & Tutorials,

pp 446–471. doi:10.1109/SURV.2012.013012.00028

28. Riedl P, Koller P, Mayrhofer R, Möller A, Koelle M, Kranz M

(2013) Visualizations and switching mechanisms for security

zones. In: Proceedings of international conference on advances in

mobile computing & multimedia, MoMM ’13,

pp 278:278–278:281. ACM, New York. doi:10.1145/2536853.

2536948

29. Segall MH, Campbell DT, Herskovits MJ (1966) The influence of

culture on visual perception. Bobbs-Merrill, New York

30. Seifert J, De Luca A, Conradi B, Hussmann H (2010) Trea-

surePhone: context-sensitive user data protection on mobile

phones. In: Proceeding of the pervasive, LNCS. Springer,

pp 130–137. doi:10.1007/978-3-642-12654-3_8

31. Stajano F (2006) One user, many hats; and, sometimes, no hat:

towards a secure yet usable PDA. In: Proceedings of the SP.

Springer, pp 51–64. doi:10.1007/11861386_6

32. Stoll J, Tashman CS, Edwards WK, Spafford K (2008) Sesame:

informing user security decisions with system visualization. In:

Proceedings of the CHI. ACM, pp 1045–1054. doi:10.1145/

1357054.1357217

33. Wald G, Brown PK (1965) Human color vision and color

blindness. In: Symposium on quantitative biology, vol 30, Cold

Spring Harbor, pp 345–361

34. Wolf K, McGee-Lennon MR, Brewster SA (2012) A study of on-

device gestures. In: Proceedings of the mobile HCI (Companion),

pp 11–16. doi:10.1145/2371664.2371669

954 Pers Ubiquit Comput (2015) 19:941–954

123

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

  • c.779_2015_Article_840.pdf
    • Only play in your comfort zone: interaction methods for improving security awareness on mobile devices
      • Abstract
      • Introduction
      • Related work
      • Conceptual background and context
        • Security concepts
          • Motivation for employing security concepts
          • Zones
          • Security on platform level (software and hardware)
        • Interaction and visualization concepts
          • Interaction concepts for switching zones
          • Visualization concepts for zone awareness
        • Motivation for software and hardware prototypes
      • Visualizations
        • Colored border visualization (CBV)
        • Colored notification bar visualization (CNV)
        • Colored text visualization (CTV)
        • Hardware visualization (HWV)
      • Switching mechanisms
        • Gesture switching mechanism (GSM)
        • Lock screen switching mechanism (LSM)
        • Swipe switching mechanism (SSM)
        • Hardware switching mechanism (HSM)
      • Evaluation
        • Scenarios
        • Questionnaire
        • Pilot study
        • Online study
          • Participants
          • Task and measurements
        • Online study results
          • Device usage
          • Zone visualizations
          • Switching mechanisms
        • Laboratory study
          • Motivation
          • Participants
          • Task and measurements
        • Laboratory study results
          • Zone visualizations
          • Switching mechanisms
          • Zone switching performance
      • Discussion
      • Conclusion
      • Acknowledgments
      • References

Sources/Trust Based Authentication Scheme.pdf

O R I G I N A L A R T I C L E

Trust-based authentication scheme with user rating for low-resource devices in smart environments

Anas El Husseini • Abdallah M’Hamed •

Bachar El Hassan • Mounir Mokhtari

Received: 20 November 2011 / Accepted: 15 March 2012 / Published online: 3 May 2012

� Springer-Verlag London Limited 2012

Abstract In smart environments, pervasive computing

contributes in improving daily life activities for dependent

people by providing personalized services. Nevertheless,

those environments do not guarantee a satisfactory level for

protecting the user privacy and ensuring the trust between

communicating entities. In this study, we propose a trust

evaluation model based on user past and present behavior.

This model is associated with a lightweight authentication

key agreement protocol (Elliptic Curve-based Simple

Authentication Key Agreement). The aim is to enable the

communicating entities to establish a level of trust and then

succeed in a mutual authentication using a scheme suitable

for low-resource devices in smart environments. An inno-

vation in our trust model is that it uses an accurate

approach to calculate trust in different situations and

includes a human-based feature for trust feedback, which is

user rating. Finally, we tested and implemented our scheme

on Android mobile phones in a smart environment dedi-

cated for handicapped people.

Keywords Smart environments � Privacy preservation � Trust evaluation � Authentication � Low-resource devices

1 Introduction

Trust, Anonymity and Privacy preservation are known as

major factors to the acceptance and the success of perva-

sive computing systems. Service Platforms tend to collect

and manage a large amount of personal information about

individuals in order to authenticate users and/or provide

personalized services, therefore threating privacy and

causing a conflict between service providers and personal

information owners. People dislike automatic spread of

personal and identifiable data, especially when it is trans-

ferred to other parties beyond control [1, 2]. The trade-off

between privacy and collecting private data for authenti-

cation poses nowadays a great challenge to security

designers in smart environments.

For disabled and aging users, smart environments are

deployed to facilitate every day life activities and adapt to

their needs. A ubiquitous computing environment entails an

extensive and complex computer architecture deployment,

sophisticated data control and a judicious external interface

facilitating user interaction with the system [3]. The char-

acteristics of ubiquitous systems amplify the concern of

security problems, by promoting spontaneous interactions

between diverse heterogeneous entities [4]. However,

within those environments, the security and confidentiality

of sensitive data have to be guaranteed. Beside that the

anonymity and privacy of the users should be protected,

therefore personal information concerning users like names,

addresses, financial data and medical profile should not be

allowed to flow freely without protection. Therefore, one of

the foundations of the security of users in smart environ-

ments is to protect individuals privacy.

Several researchers [1, 2] have admitted that smart

environments are vulnerable to many security and privacy

threats and that securing pervasive computing present

A. El Husseini (&) � A. M’Hamed � M. Mokhtari Telecom SudParis, Handicom Lab, Evry, France

e-mail: [email protected]

A. El Husseini � B. El Hassan LaSTRe Lab, Azm Center for Scientific Research,

Lebanese University, Tripoli, Lebanon

123

Pers Ubiquit Comput (2013) 17:1013–1023

DOI 10.1007/s00779-012-0548-8

critical challenges at many levels [5–7]. Below, some of

the challenges addressed in [8] are outlined:

1. Privacy Issues: Sensors and actuators distributed in

space expose a great danger to user privacy since the

information collected can be disclosed to intruders,

malicious insiders and tracking systems.

2. User Interaction Issues: The access control mecha-

nisms in pervasive environments should allow users to

interact easily with devices while ensuring an appro-

priate authentication.

3. Security Policies: Smart environments should have a

convenient method to define and manage security

policies with dynamicity and flexibility, with respect to

the behavior of entities in their systems.

4. Two new security challenges, introduced by Tentori

and Favela [9], are to be added: Quality of Privacy

(QoP) and Trustworthy Authentication. The second is

combination of trust and authentication in one scheme.

In this paper, we design a trust model and implement it

associated with an authentication protocol. The aim is to

introduce an intermediate phase that evaluates the trust-

worthiness of communicating entities before the phase of

service provision. Our scheme will preserve and protect

user privacy since it will use non-sensitive information in

the evaluation process of the trust. What makes trust

evaluation models really needed in smart environments is

that they create a secure yet more flexible environments

that what security policies alone cannot do. That is because

the strictness of static policies may limit the freedom of

normal users while it is potentially vulnerable to malicious

users; on the other hand, trust systems are very adaptive to

the user needs, actions and behaviors. In our enhanced trust

model, we also integrated two new ideas. The first is

Questions of Trust that aims to enhance the model immu-

nity against malicious manipulation of trust values, as well

as dealing more efficiently with situations where there are

only new neighbors. The other innovation is User Rating

that allows users to give feedback about the quality of

service they received, which will accordingly affect how

much they trust the service provider in the future.

The remainder of this paper is organized as follows. In

Sect. 2, we present several researches in literature con-

cerning trust and repuation models. In Sect. 3, we describe

our proposed trust model featuring its advantages, pointing

out the two new features: Questions of Trust and User

Rating. Section 4 describes the features of the Elliptic

Curve-based Simple Authentication Key Agreement (EC-

SAKA) protocol, designed for low-resource mobile devi-

ces. In Sect. 5, we show some simulations concerning the

trust model metrics and discuss the results. Section 6 shows

the implementation of our trust-based authentication

scheme. Finally, Sect. 7 concludes our work.

2 Related work

Several researches and studies were carried out regarding

trust models for different purposes and in different envi-

ronments. Among those, we choose several prominent ones

to discuss their strong and weak points, and build our

model accordingly.

In their work, Mihaela et al. [10] propose a new trust

model for DEs which has several innovative features. The

model is based on the concept of social networks and

addresses trust at different levels: user, data, service and

node. The model allows fast bootstrapping of trust by

importing existing trust relationships from outside DE

systems and by relying on certificates issued by trusted

authorities external to the DE. Furthermore, trust can be

measured in a variety of contexts by using user-defined

tags â folksonomy . The model abstracts from specific

reputation algorithms by providing necessary interfaces for

plugging-in those on one’s own choice.

Yan Lindsay et al. [11] present in their paper an infor-

mation theoretic framework to quantitatively measure trust

and model trust propagation in ad hoc networks. In the

proposed framework, trust is a measure of uncertainty with

its value represented by entropy. They develop four Axi-

oms that address the basic understanding of trust and the

rules for trust propagation. Based on these Axioms, they

present two trust models: entropy-based model and prob-

ability-based model, which satisfy all the Axioms. Tech-

niques of trust establishment and trust update are presented

to obtain trust values from observation. The proposed trust

evaluation method and trust models are employed in ad hoc

networks for secure ad hoc routing and malicious node

detection. A distributed scheme is designed to acquire,

maintain and update trust records associated with the

behaviors of nodes forwarding packets and the behaviors of

making recommendations about other nodes. Simulations

show that the proposed trust evaluation system can sig-

nificantly improve the network throughput as well as

effectively detect malicious behaviors in ad hoc networks.

With the growing popularity of wireless mobile ad hoc

networks (MANETs), many security concerns have arisen

from MANETs especially in that misbehaving nodes pose a

major threat during the construction of a trusted network. A

reputation-based trust system can track the behavior of

nodes and thereby proceed by rewarding well-behaving

nodes and punishing misbehaving ones. However, existing

techniques are usually either energy-consuming or com-

plicated since the relevant reputation information is prop-

agated throughout the network. In their paper, Yonglin et al.

[12] propose a novel trust computation and management

system, called TOMS, which not only establishes the new

concepts of trust and community but also includes both the

trust computation model and trust management mechanism.

1014 Pers Ubiquit Comput (2013) 17:1013–1023

123

In order to obtain more suitable trust evaluation in

MANETs, Junhai et al. [13] suggest that the measurement

and computation of trust to secure interactions between

mobile nodes is crucial for the development of trust

mechanisms. The calculation and measurement of trust in

unsupervised ad-hoc environment involves complex

aspects such as credibility rating for opinions delivered by

a node, the honesty of recommendations provided by a

mobile node, or the assessment of past experiences with the

node one wishes to interact with. The deployment of

suitable algorithms and models imitating fuzzy logic can

help to solve these problems. In this paper, RFSTrust, a

trust model based on fuzzy recommendation similarity, is

proposed to quantify and to evaluate the trustworthiness of

nodes, which includes five types of fuzzy trust recom-

mendation relationships based on the fuzzy relation theory

and a mathematical description for MANETs. Fuzzy logic

provides a natural framework to deal with uncertainty and

the tolerance of imprecise data inputs for the subjective

tasks of trust evaluation, packet forwarding review and

credibility adjustment. Theoretical analysis and experi-

mental results show that RFSTrust is still robust under

more general conditions where selfish nodes cooperate in

an attempt to deliberately subvert the system, end-to-end

packet delivery ratio more quickly and decreases the

average energy consumes more effectively. The effect of

node rating data’s sparsity can be greatly reduced and show

the excellent performance on typical data set.

According to Masthoff [14], Trust is a popular and much

disputed topic in various research communities. In his

paper, he attempts to integrate existing knowledge on trust

into a simple computational model. The model incorpo-

rates the impact of direct experiences, reputation, stereo-

types, empathy and user characteristics on trust. He also

presents the results of two exploratory experiments testing

and improving aspects of the model.

Felix Gomez Marmol et al. [15] describe in their review

the different scenarios where trust evaluation is threatened

by different attacks of malicious users. Examples of those

attacks are attacks of individual malicious users, attacks of

collective malicious users, attacks of malicious collective

with camouflage, malicious spies, sybil attacks, man in the

middle attacks, malicious pre-trusted peers, partially

malicious users, etc. The paper also explains how affecting

with peer’s reputation can also become a security threat,

such as driving down the reputation of a good user. Finally,

the paper discusses how some of the known trust models

deal with those trust evaluation threats. The trust models

mentioned in that section were as follows: EigenTrust,

PeerTrust, BTRM-WSN and PowerTrust. Finally, it con-

cludes with a table summarizing the vulnerabilities and

resiliencies of those trust and reputation models against the

mentioned attacks.

3 Our proposed trust model

Before an authentication takes place, each of the commu-

nicating parties needs to trust the others, hence the need of

a trust evaluation model. Many trust models for smart

environments have been proposed in the last decade, some

of them presented context awareness-based security [17],

while others concentrated on the quick convergence of

updated trust values [18–20], addressing the different sit-

uations with similar approaches. In our model, we tried to

work on the points that are missed or lacking in the pre-

viously mentioned trust models, such as the guarantee of

the accuracy of trust values, the rapid convergence of trust

values during estimation, the compatibility with low-

resource devices and the adaptivity to the needs and abil-

ities of dependent people.

Our proposed model has the following properties:

1. an enhanced compatibility with low-resource devices,

since it uses the memory-efficient elliptic curve

cryptography and a bandwidth-efficient trust evalua-

tion model;

2. useful features like service-dependent trust, mentioned

in [21];

3. a lightweight security monitoring to prevent malicious

attackers that attempt to forge trust data or alter it in

any way;

4. imitation of human rational thinking in evaluating the

judgment ability of recommending entities. That

means whenever an entity is asked to recommend

another, we take a look on how much that entity know

the others, which will give a metric representing the

judgment ability of this entity, before taking its

recommendations as granted;

5. ability to deal with situations which it has no prior

experience dealing with, using Questions of Trust;

6. a user rating system that allows to take feedback from

users and integrate it in the trust evaluation process.

Figure 1 illustrates the architecture of our proposed trust

model with its different modules, showing the steps of the

trust evaluation process. The trust updates take into con-

sideration the feedback obtained by user ratings. Judgment

is calculated based on the reports of experience messages.

Indirect trust is obtained by a multiplicative relation

between judgments and recommendation values given by

recommendation messages. Direct trust is calculated

through a risk assessment based on number of positive and

negative actions of the node in question (also provided by

experience messages). Finally, the net trust is a linear

combination of the direct and indirect trusts. The trust

updates occur only on demand or when the trust values

have expired. We will explain those modules in more

details in the following paragraphs. Next, we are going to

Pers Ubiquit Comput (2013) 17:1013–1023 1015

123

present the properties of our trust model and discuss the

novel attributes introduced in it.

3.1 Minimization of resource usage

Our proposed trust model aims to serve smart environments

where the hardware equipment have small processors and

limited memories. Some trust models such as in [21] used a

mesh-like approach in calculating trust values. That is each

node of the network has always an updated trust table of all

nodes in the network. That means that resources are wasted

on calculating trust values that may expire before being

used. Our proposed model evades this issue by evaluating

the trust values only on demand and expiry.

Our proposed model tries also to use as minimal mem-

ory resources as possible. Essentially, each node in the

network, independently of its nature, will need two matri-

ces. The node will store trust values of nodes communi-

cating with it only. Because of the memory limitation, the

node will get rid of trust data related to nodes that had left

the neighborhood or went dead in the network.

3.2 Trustworthiness

Trustworthiness is a factor that recommenders have to

consider in the selection of reliable peers for collaboration.

Most approaches in this regard estimates trust based on

global user profile similarity or history of exchanged

opinions [22]. Trustworthiness is used in this paper to refer

to the level of trust of an entity B in respect to a separate

entity A. The net trustworthiness is obtained by calculation

of two values: direct trust and indirect trust. Direct trust is

what is commonly called ‘‘Risk Assessment’’. It is used for

dealing with newcomers, which the entity has not yet any

records of trust evaluation. In case where trust is service-

dependent, we added a multiplicative factor, called the

Security Action Coefficient (SAC), to the number of neg-

ative actions. This coefficient refers to the security level of

a service. If the application possesses a high security level,

the associated SAC should be high (e.g. 10). On the other

hand, if the service did not need any security, such as a

weather broadcasting service, SAC can be as low as 1.

Direct trust is obtained using the following equation:

DT ¼ RPAi

RPAi þ SAC � RNAi : ð1Þ

where PAi represents the number of positive actions done by

the node in question and noticed by node i. NAi refers to the

number of negative actions, and SAC is the Security Action

Coefficient related to the security level of the service.

The indirect trust, representing the recommendations of

other nodes, is

IT ¼ RTwi � Ji

n : ð2Þ

where Twi and Ji are the trustworthiness and judgment

values corresponding to the node i.

The value of the net trustworthiness is a combination of

direct and indirect trust:

Tw ¼ aDT � DT þ aIT � IT: ð3Þ

where aIT the indirect trust coefficient is

aIT ¼ TSself

TSself þ R TSinrecomm �

RJi ntot

: ð4Þ

and aDT the direct trust coefficient is

aDT ¼ 1 � aIT: ð5Þ

where TS self refers to the timestamp of the trust value of

the node itself, while TSi denotes the timestamp of the trust

value of the node i. ntot is the total number of nodes in the

subnetwork, whereas nrecomm is the number of nodes that

responded with recommendations.

3.3 Judgment

Judgment is one of the new features introduced that aims to

imitate the human behavior in a technical approach. The

judgment ability is represented by the overall experience of

dealing with the node in question. That experience includes

both the total number of control messages exchanged and

the total number of actions whether positive or negative.

The judgment related to the number of actions is equal to

the total number of actions RAi over the maximum number of actions Maximum A, as follows:

JA ¼ RAi

max A ; if JA [ 1 then JA ¼ 1: ð6Þ

Similarly, the judgment related to the number of

messages exchanged is

JM ¼ R messagesi

max messages ; if JA [ 1 then JA ¼ 1: ð7Þ

At last, the overall judgment value isFig. 1 Our proposed trust model with its basic parts

1016 Pers Ubiquit Comput (2013) 17:1013–1023

123

J ¼ JA � JM: ð8Þ

3.4 Control messages

In order to control the aspect of trust evaluation and share

the trust data, short control messages are used for that

purpose. Most of these messages are trigger-based type,

except for consistency and hello messages. Those messages

are as follows:

1. Recommendation messages: used as request for trust

recommendations. The addressed nodes will reply, if

possible, with a recommendation reply containing the

trustworthiness value requested.

2. Experience messages: used to retrieve information

about statistical behavior. The reply contains informa-

tion about messages exchanged and positive and

negative actions, used later in the calculation of

judgment and direct trust.

3. Hello messages: periodic messages that are issued to

inform the neighbors about self-existence.

4. Consistency messages: periodic messages that aim to

test the consistency behavior of a certain node in order

to prevent any suspicious behavior trying to affect the

trust evaluation.

5. Knowledge migration messages: issued only when a

node is about to pass out or leave the network. The

message is a notification of the availability of trust data

that is going to be lost. Interested nodes will respond

by asking for recommendations and experience data.

3.5 Questions of trust

Our basic trust model described in [23] is suitable to deal

with calculating indirect trust based on recommendations

of neighbors. However, it may not be efficient enough in

case there are several malicious nodes giving false rec-

ommendations in order to earn the user’s trust. To prevent

that the user can carry out a procedure called ‘‘Questions

of Trust’’ before asking for recommendations. The pro-

cedure is about sending questions to the targeted nodes

and comparing the answers upon receiving them, either

with each other or with a set of previously known

answers. The questions can be service-related. For

example, if the service provided is weather-casting, the

questions can be regarding the weather table at a certain

geographic location at a certain period of time. Alterna-

tively, the questions can be about the trust tables them-

selves; and by comparison with trust tables of other

neighbors, a contradictory or non-consistent trust values

can be detected. With this, the user can be wary of nodes

trying to deceive him and thus he will not ask for their

services nor their recommendations.

This procedure can be repeated several times to increase

the odds of detecting suspicious behaviors. The questions

can be also sent directly to targets, or indirectly through

other nodes as proxies for masking the identity of the

original sender. Questions of Trust are also very handy if

the user is entering the network for the first time or is

dealing with neighbors he has no prior experience with.

This metric, like all other metrics mentioned in this

paper, can generally target a large audience of users,

independently of their individual capabilities. When we are

targeting dependent people in particular for our system, the

same mathematical model still applies, but what differs is

the type of feedback taken from the users which will

become an input for our model. Depending on the type of

disability of the user, this feedback can be either vocal or

physical (movement of fingers on touchpad or keypad).

3.6 User rating

So far, all the indicators in our trust model are machine-

based; but since trust is a concept initially borrowed from

humans, we decided to add a human-based indicator in our

model. User ratings were used before, as in [24, 25], for

evaluating trust in social networks, e-shopping websites,

etc. They indicate how much customers are satisfied by the

quality of service provided by sellers, or how much a social

network user trust another based on real-life activities.

However, user rating were not used for trust models in

smart environments before, although the user satisfaction/

dissatisfaction after using a service from a certain provider

may be quite a good indicator of the accuracy of trust-

worthiness calculated by machine-based indicators. In fact,

the quality of service value estimated by the user rating is

closely related to the trustworthiness of the service pro-

vider, since untrustworthy service providers are not

expected to provide a good level of service all the time.

Many advantages can be gained from adding user rating to

the trust model. First, the machine-based trust models do

not take into consideration the human satisfaction/dis-

satisfaction of a certain service, which is generally a good

indicator whether the service is real or fake, and whether

there is an encouraging reason for a new user to try this

service with this particular service provider. Second, user

ratings, unlike trust recommendations, last much more

longer and therefore presents a good alternative in case of

the absence of the latter. Therefore, we can consider the

user rating as a human recommendation and integrates it in

our formula to calculate trust. Similarly to how we defined

the weights of direct and indirect trusts, the amount of

participation of human recommendation in the final value

of trust (also referred as Human-Machine Trust) will

depend on the numbers of users that have rated the target,

and how many times they used the service in question

Pers Ubiquit Comput (2013) 17:1013–1023 1017

123

provided by the target. This can be elaborated by the fol-

lowing formulas:

aH ¼ 1

NR � RQi if Ri�NR ð9Þ

or

aH ¼ RQi if Ri [ NR ð10Þ

Qi ¼ Ui

Umax but if Qi [ 1 then Qi ¼ 1 ð11Þ

aM ¼ 1 � aH ð12Þ THM ¼ aH � HH þ aM � HM ð13Þ

where THM is Human–Machine Trust. TH and TM are,

respectively, Human Trust and Machine Trust, and aH and aM are their respective weights. Ri is the total of nodes that rated the service. NR is a constant for normalizing the

number of nodes that have rated the target (typically

NR = 10). Ui is the number representing how many times

the node i used the service from that provider, and Umax is

the normalizing value (typically Umax = 100). Qi is the

normalized ratio of the number of utilizations of the service

done by node i.

Our user rating mechanism is designed in a way that

ensures the fair usage of this feature. Since we cannot

expect all users to be rational in their ratings, we tried at

least to integrate our own approach to fight against abuse of

rating, coming from either users or service providers. In

our scheme, the interacting parties are the user, the service

provider, the Rating Authority and the Abuse Control

Authority. The role of the Rating Authority is only to

update and sign rating tables and verify the signatures. So it

only stores public keys used for the verification of digital

signatures, and it does not store any rating data, as to

preserve the decentralized nature of the network. Each

service provider will store his own rating table(s) (one

rating table per service provided), and since the table(s) is

digitally signed by the Rating Authority, it will prevent any

party from modifying the ratings. Another positive point

about the User Rating feature is that they are permanent

even if the user who did the rating leaves the network,

since the service provider always carry the rating tables

along; whereas trust tables depend on the presence of the

node, who is going to recommend, in the neighborhood.

The Abuse Control Authority is an optional entity that aims

to prevent abuse coming from either users or service pro-

viders. If the service provider abstain from giving the user

his rating table after service provision (i.e. preventing the

user from rating him), the user can report him to the Abuse

Control Authority using the service receipt he obtains at the

beginning of service provision. On the other hand, if the

user abuses his right of rating, repetitively, he’ll be

detected by the rating investigation carried out by the

Abuse Control Authority. The abuse control mechanism,

like spam filtering, can be an automated task based on

pattern recognition in abuse behaviors.

To begin with, we assume that we already have a key

management scheme enabled and working in the network.

The process of the user rating goes as it is shown in Fig. 2.

First, the user get a copy of the service provider’s public

key from the Rating Authority. Next, the user will request

the service from the service provider. The service provider

will send him a service receipt digitally signed and the

service will be executed. After the service provision is

complete, the service provider will take the Rating

Authority’s digitally signed copy of his rating table, sign it

with his private key, and send the double-signed copy to

the user. The user will verify the signatures, add his sig-

nature to the rating table, rate and sign his own rating, and

send his rating and the rating table to the Rating Authority.

The authority will verify all signatures, and if they are valid

it will update the rating table based on the new user rating,

and send the updated rating table back to the service pro-

vider after signing it. To defend against replay attacks, all

digitally signed exchanged data implicitly include a time-

stamp and/or a nonce.

Figure 3 shows two possible cases of rating abuse. In the

first case, the abuse is coming from the service provider,

where the server abstains from giving the rating table to the

Fig. 2 Diagram showing actions performed between user, service provider and rating authority

1018 Pers Ubiquit Comput (2013) 17:1013–1023

123

user, thus blocking away the user’s right of rating. As a

deterrent for such situations, we allow the user to file a

complaint by reporting to the Abuse Control Authority

what happened, using his service receipt as proof of his

right to rate. In the second case, in the illustration, the

abuse is coming from the user where he is giving untruthful

ratings to increase/decrease the reputation of a certain

service provider. In both abuses, the Abuse Control

Authority registers the abuse either by received a justified

report or by detecting using abuse pattern recognition. The

algorithm describing the mechanism of the Abuse Control

Authority is out of the scope of this article.

4 EC-SAKA authentication protocol

Elliptic Curve-based Secure Authenticated Key Agreement

protocol (EC-SAKA) was proposed by [16] in order to suit

the needs for low-resource mobile devices that face diffi-

culties when dealing with large-sized cryptographic keys.

This protocol benefits from the power of elliptic curve

discrete logarithm problem that is even more powerful than

traditional discrete logarithm problems. It is based on an

asymmetric Diffie-Hellman scheme to generate a common

secret key without exposing it to eavesdroppers. Indeed,

the asymmetry in this approach is to prevent malicious

attacks that try to impersonate both of the entities com-

municating and forward one’s data to the other aiming to

expose their generated key in the process. EC-SAKA

scheme also prevents impersonation attacks. In addition to

key agreement, this protocol provides identity verification

through El Gamal Signature scheme (ECEGS). This way, it

provides identity verification and common key generation

at the same time. Figure 4 illustrates the three passes of

EC-SAKA protocol.

In Fig. 4, P and Q represent two public points on the

elliptic curve chosen. n is large public number chosen by

Bob and Alice, used to define the elliptic curve. a and

b represent two secret values, each known only by its

respective owner, Alice and Bob. A and B are the respec-

tive public keys for Alice and Bob generated from a and

b. H () is a hashing function, and n is sufficiently large

number. K is the common secret key that Alice and Bob

will be able to generate at the end of this 3-way

authentication.

The EC-SAKA protocol will be used in our scheme in

order to authenticate entities and make them confirm each

other identities. The authentication phase comes after a

level of trust is already established between the entities. If

the result of the trust phase is higher than a specific

threshold, which is either dependent of the service or

globally set by the administrator, the application will pro-

ceed to the authentication phase. Otherwise, the application

would not pass to the authentication phase and the service

would not be provided, because one of the communicating

party appears untrustworthy to the other. The process of

trust evaluation is performed using the trust model that was

already detailed in the previous section.

Fig. 3 Two cases involving rating abuse and Abuse Control Authority Fig. 4 The three passes of EC-SAKA protocol

Pers Ubiquit Comput (2013) 17:1013–1023 1019

123

5 Simulation and discussion

The object of the judgment value is to increase the accu-

racy of the trust calculation. Not only that the judgment

value helps making the net trust evaluation converge

quickly. Unlike the trust evaluation techniques [13, 17–21]

where the trust metrics oscillate before reaching a stable

value, we made a simulation that demonstrates how the net

trust in our model instantaneously reflects the variation in

the trust metrics.

The reason that the trust values in our trust model

converges rapidly and do not oscillate like in the others is

the fact that we are already depending on an always-ready

judgement database. This database consists of two ele-

ments: the experience gathered by monitoring and report-

ing the negative actions performed by other nodes during

any communication, and the user feedback through their

rating which will enrich this database and makes the trust

evaluation easier and faster.

Figures 5 and 6 show the graphs of two simulations: the

first one represents the variations of net trust and judgment

when the positive actions are increasing, while the second

shows the trust variations when the negative actions are

increasing. The judgment value increases linearly with the

number of actions, positive or negative, that is, because the

judgment represents the experience which is directly rela-

ted to the number of actions. On the other hand, the net

trust increases/decreases faster when the number of actions

increases. The reason is that the grown experience

increases the weight of indirect trust (recommendations)

and accelerates the variations of net trust. The trustwor-

thiness in our model directly reflects the behavior of the

nodes, while in other trust models, it takes some time

oscillating before converging to an accurate value [21].

In comparison with other trust models, our proposed

model is using metrics that directly reflect the present and

the past line of actions committed by an entity in the net-

work. In addition to that, our trust model tends to decrease

the overall power consumption since it triggers trust

updates only on demand or expiration. Furthermore, the

security monitoring part of the model protects the entities

from potential malicious attacks. Questions of Trust also

assist in preventing malicious manipulations that affect

trust values. Finally, the user rating adds a human-based

feature that allows human users to assist in trust decisions

based on the satisfaction obtained from using services.

Further simulations on real scenarios are taking place by

testing the model on dependent users in a special residence

in the aim of validation and confirmation of the proprieties

of the model.

6 Implementation

In order to validate the proposed scheme composed of an

authentication module and a trust module, we have

implemented it using Java language and Eclipse IDE

platform. A server in our architecture is the device that

provides the service to other nodes. It can be a computer,

an RFID reader, or even a sensor. The server part of the

implementation contains no graphical interface, since it

only calculates different data and communicates them to

other nodes. On the other hand, the client part includes a

graphical interface and can run on almost any mobile

device that supports Java. We chose to test our imple-

mentation on Android mobile phones using Android SDK

tools in Java. The code itself is implementable on simpler

platforms than Android phones, such as active RFID tags

and sensors. Android systems remain easier to work on Fig. 5 The variation of net trust and judgment with respect to positive actions

Fig. 6 The variation of net trust and judgment with respect to negative actions

1020 Pers Ubiquit Comput (2013) 17:1013–1023

123

since the implementation will only take place software-

wisely.

For the authentication module, it has the responsibility

to establish secret key generation and identity confirmation

using the EC-SAKA protocol. The implementation of this

module was done through 4 Java classes. The first two

ECCPoint and ECCurve take care of all mathematical

definitions and calculations related to Elliptic Curves,

which are the base of the EC-SAKA protocol. The other

two classes, Requester and Provider, are used by the

authenticating parties to exchange the messages needed for

the establishment of the authentication. Since EC-SAKA

uses a 3-way asymmetric scheme, the messages sent

received by one authenticating party are not alike to those

sent and received by the other party, thus the need of two

different classes for the two parties. Figure 7 shows the

class diagram of the authentication module.

The other module implemented, the trust module, uses

two Java classes. The first class is for exchanging control

messages. The other class uses the information provided by

recommendation and experience messages to calculate

direct trust, indirect trust and judgment. This class also

calculates the trust weights, described in the previous

section, in order to evaluate the net trust.

Our implementation of this scheme takes part in a pro-

ject called ‘‘Cohabit’’, a smart environment project for

dependent people. The project takes place in a particular

residence for disabled people called ADEP. The services

provided in that smart environment are daily services

needed by dependent people, such as opening the door,

turning on/off the light, closing the curtains. The security

modules we have developed evaluate the trust between the

users and their environment before giving them access to

use those services. Figures 8, 9 and 10 shows several

snapshots the client application on the Android phone

listing the existing services spotted in the environment.

When the user of the Android phone chooses a service,

he will be directed to another window that lists the security

steps needed to activate that service. As it appears in

Fig. 7 The different classes used in the implementation of the authentication module

Fig. 8 Snapshot of the service provision in the Android app

Fig. 9 Snapshot of the Trust action matrix in the Android app

Fig. 10 Snapshot of the trust-authentication scheme in the Android app

Pers Ubiquit Comput (2013) 17:1013–1023 1021

123

Fig. 10, when clicking on ‘Evaluate Trust’ button, the

trustworthiness value of the service provider will be cal-

culated, as described in Sect. 3, and the threshold value set

by the administrator will be displayed. For more flexibility,

the procedure was divided to several steps, to allow the

user to use services on his own risk—if he wishes to—

when the trustworthiness value is less than the threshold.

The next button uses the EC-SAKA protocol to generate a

secret shared key and enable the two nodes to verify each

other’s identities. If the user sees two checkmarks next to

the two buttons, he can now execute the service he has

chosen.

Some services might not need trust evaluation and

authentications, such as date and time and weather-forecast

services. In this case, the corresponding buttons for trust

and authentication will be disabled and only the service

execution button will be enabled. Nevertheless, the actions

of non-authenticated services will be recorded in the action

matrices.

7 Conclusion

After emphasizing on the necessity and importance of

security, privacy and trust in smart environments, we have

demonstrated the effectiveness of Elliptic Curve Cryptog-

raphy as new candidate in publickey cryptosystems. We

have adopted a lightweight authentication protocol called

Elliptic Curve Secure Authenticated Key Agreement (EC-

SAKA) protocol in our scheme. That authentication pro-

tocol uses a 3-pass scheme to generate a common secret

key, in addition to an elliptic curve-based digital signature.

Next, we have proposed a new trust model that respects

the limitation of tiny mobile devices in terms of resources

and bandwidth. Our trust model contain two new features

that enhance the process of trust evaluation. The first one is

a new trust metric introduced called the ability of judg-

ment. This value tends to imitate the human rational

thinking in trust and recommendation acceptance. The

second feature is a lightweight security monitoring ability

within the trust model to defend against security threats.

Furthermore, we introduced two new features in our

enhanced trust model. One is Questions of Trust that enable

users to ask service-related questions to the service pro-

vider prior to service execution, in order to detect any fraud

or fake services. The other is User Rating that gives the

model a more humanistic side by integrating human feed-

back in the trust evaluation process.

Finally, we have implemented our scheme into inde-

pendent modules using Java language. Our trust-based

authentication scheme will be embedded on Android

smartphones to be used by dependent people in their resi-

dential areas.

References

1. Langheinrich M (2001) Privacy by design-principles of privacy-

aware ubiquitous systems. In: Proceeding of the 3rd international

conference on ubiquitous computing (UbiComp 2001), Springer

LNCS 2201. pp 273–291

2. Stajano F (2002) Security for ubiquitous computing. Halsted

Press, New York

3. Modahl M, Agarwalla B, Saponas TS, Abowd G, Ramachandran

U (2006) UbiqStack: a taxonomy for a ubiquitous computing

software stack. Personal Ubiquitous Comput J 10(1):21–27

4. English C, Terzis S, Nixon P (2005) Towards self-protecting

ubiquitous systems: monitoring trust-based interactions. Personal

Ubiquitous Comput J 10(1):50–54

5. Yin S, Ray I (2006) A trust model for pervasive computing

environments. In: International conference on collaborative

computing: networking, applications and worksharing

6. Taherian M, Jalili R, Amini M (2008) PTO: a trust ontology for

pervasive environments. In: 22nd international conference on

advanced information networking and applications—workshops,

IEEE

7. Cheng HS, Zhang D, Tan JG (2005) Protection of privacy in

pervasive computing environments. In: Proceedings of the

international conference on information technology: coding and

computing (ITCC’05)

8. Campbell R, Al-Muhtadi J (2002) Towards security and privacy

for pervasive computing. In: Proceedings of ISSS, Tokyo, Japan,

2002, pp 1–15

9. Tentori M, Favela J (2005) Supporting quality of privacy (QOP) in

pervasive computing. In: Proceeding of the sixth Mexican inter-

national conference on computer science. ACM Press, pp 58–67

10. Mihaela I, Andrea D, Hristo K, Luigi T (2007) A peer-to-peer

multidimensional trust model for digital ecosystems. Computer

Science Department, University of Malaga, Spain

11. Sun YL, Yu W, Han Z, Liu KJR (2004) Information theoretic

framework of trust modeling and evaluation for ad hoc networks

12. Ren Y , Boukerche A (2008) Modeling and managing the trust for

wireless and mobile ad hoc networks. In: ICC 2008 proceedings

13. Luo J, Liu X, Fan M (2009) A trust model based on fuzzy rec-

ommendation for mobile ad-hoc networks. Comput Netw

53:2396–2407

14. Masthoff J (2007) Computationally modelling trust: an explora-

tion. University of Aberdeen, Aberdeen, Scotland, UK

15. Felix Gomez M, Martinez Perez G (2009) Security threats sce-

narios in trust and reputation models for distributed systems.

Comput Security 28:545–556

16. Abi-Char P, Mhamed A., El Hassan B (2007) A fast and secure

elliptic curve based authenticated key agreement protocol for low

power mobile communications. In: The international conference

on next generation mobile applications, services and technologies

(NGMAST 2007)

17. Moloney M, Weber S (2005) A context-aware trust-based secu-

rity system for ad hoc networks. In: Workshop of the 1st inter-

national conference on security and privacy for emerging areas in

communication networks, 2005

18. Surie A, Perrig A, Farber David J (2007) Rapid trust establish-

ment for pervasive personal computing. IEEE Pervasive Comput

6(4):24–30

19. Lagesse B, Kumar M, Paluska JM, Wright M (2009) DTT: a

distributed trust toolkit for pervasive systems. In: IEEE confer-

ences, 2009

20. Ahamed SI, Sharmin M, Ahmed S (2008) A risk-aware trust

based secure resource discovery (RTSRD) model for pervasive

computing. In: Sixth annual IEEE international conference on

pervasive computing and communications. IEEE, 2008

1022 Pers Ubiquit Comput (2013) 17:1013–1023

123

21. Ghorbel M, Mhamed A, Mokhtari M (2009) Secured and trusted

service provision in pervasive environment. In: IEEE interna-

tional conference on wireless and mobile computing, networking

and communications, 2009

22. Godoy D , Amandi A (2011) Enabling topic-level trust for col-

laborative information sharing. Personal Ubiquitous Comput J,

OnlineFirst, 6 Aug 2011

23. El Husseini A, Mhamed A, El Hassan B, Mokhtari M (2011) A

novel trust-based authentication scheme for low-resource devices

in smart environments. In: The second international conference

on ambient systems, networks and technologies (ANT-2011)

24. Borzymek P, Sydow M, Wierzbicki A (2009) Enriching trust

prediction model in social network with user rating similarity. In:

International conference on computational aspects of social net-

works, 2009. CASON ’09, pp 40–47

25. Yamasaki S (2011) A trust rating method for information pro-

viders over the social web service: a pragmatic protocol for trust

among information explorers and information providers. In: 11th

international symposium on applications and the internet

(SAINT), 2011 IEEE/IPSJ, pp 578–582

Pers Ubiquit Comput (2013) 17:1013–1023 1023

123

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

  • c.779_2012_Article_548.pdf
    • Trust-based authentication scheme with user rating for low-resource devices in smart environments
      • Abstract
      • Introduction
      • Related work
      • Our proposed trust model
        • Minimization of resource usage
        • Trustworthiness
        • Judgment
        • Control messages
        • Questions of trust
        • User rating
      • EC-SAKA authentication protocol
      • Simulation and discussion
      • Implementation
      • Conclusion
      • References

Sources/User perceptions of anthropomorphic robots as monitoring devices.pdf

O R I G I N A L A R T I C L E

User perceptions of anthropomorphic robots as monitoring devices

Stuart Moran • Khaled Bachour • Toyoaki Nishida

Received: 15 February 2012 / Accepted: 16 September 2013 / Published online: 20 October 2013

� Springer-Verlag London 2013

Abstract The principle behind anthropomorphic robots is

that the appearance and behaviours enable the pre-defined

social skills that people use with each other each day to be

used as a means of interaction. One of the problems with

this approach is that there are many attributes of such a

robot which can influence a user’s behaviour, potentially

causing undesirable effects. This paper aims to identify and

discuss a series of the most salient behaviour influencing

factors in the literature, related to a number of robot

attributes. A particularly novel aspect of this work is the

study of robots as monitoring or data collection devices,

one of several behaviour influencing factors which has

received insufficient attention. As a first step towards this,

the PSA matrix is produced, which visualises the rela-

tionships between system attributes and user perceptions,

grounded in empirical evidence in the literature. This

matrix highlights gaps in the literature, brings together a

series of salient behaviour influencing factors for the first

time and gives a clear view of the state of the art.

Keywords Anthropomorphic � Data collection � Matrix � Monitoring � Pervasive � Robotics � Ubiquitous

1 Introduction

With continuous advancements in artificial intelligence and

reduction in costs of hardware, the reality of a world where

humans coexist with robots approaches ever closer.

Through ongoing social research, most major computer

technologies have a clear set of design principles and

methods for introducing technology successfully into the

user market. In the case of robots, one direction being

explored is the approach of a humanlike appearance.

Anthropomorphic robots attempt to make the use of the

well-defined social abilities that people use with one

another day-to-day as a means of interaction. The benefits

of this are that there is ideally very little learning time

required to interact with the technology, through a familiar

and intuitive interface. There are many different attributes

of a robot which can help increase the perceptions of

anthropomorphism, including facial features, physical

expressiveness, emotions and personality. One of the

problems with these attributes is that slight variations can

cause a change in the way a robot is perceived and inter-

acted with, including feelings of discomfort [e.g. uncanny

valley (Mori 1970)]. Such variations are not limited to

human–robot interaction (HRI), but can also been found in

other computer systems. For example, many such parallels

exist in monitoring systems, such as CCTV and wearable

computing.

We argue that anthropomorphic robots, by design, are

inherently monitoring (or data collection) devices, but

unlike typical monitoring systems, they have a unique

embodiment and physical presence. In human–human

relationships there is evidence that shows how being

observed can change behaviours, consider social facilita-

tion effects (Woods et al. 2005a), or the infamous, but

often contested, Hawthorne effect (Wickstrom and Bendix

S. Moran (&) � K. Bachour Mixed Reality Lab, University Nottingham, Nottingham, UK

e-mail: [email protected]

K. Bachour

e-mail: [email protected]

T. Nishida

Nishida Lab, Department of Intelligence Science and

Technology, Graduate School of Informatics, Kyoto University,

Kyoto, Japan

e-mail: [email protected]

123

AI & Soc (2015) 30:1–21

DOI 10.1007/s00146-013-0515-6

2000). When we consider the ways in which robots can be

anthropomorphised, questions start to emerge as to how

their humanoid form might lead to similar data collection-

based behavioural effects. Hence, the beginnings of an

intriguing point of intersection starts to emerge between the

fields of humanoid robotics and monitoring systems.

The aim of this paper is to propose, explore and

stimulate discussion on the novel thread of research on

anthropomorphic robots as monitoring systems. Viewing

anthropomorphic robots through a ‘monitoring lens’ may

lead to new understandings, perspectives and questions

regarding their relationship with users. To do this, we

must first understand the state of the art in both fields

individually, and then examine what exists at the point of

their intersection. In particular, we are interested in how

these attributes may change and influence behaviour

(along the lines of Hawthorne). Research in social

robotics has shown a tendency to explore how different

characteristics or attributes of a robot can influence users

through their differing perceptions and attitudes. Through

a survey of the monitoring and robotics literature, a series

of key robot characteristics emerged which can influence

the user during interaction, which frames the discussion.

Similarly, there are a number of key attributes associated

with monitoring systems (Moran and Nakata 2010), and

these were used as a coding scheme when exploring the

literature. We observed a number of established and

hypothesised causal inter-relationships between design

characteristics and user perceptions of both anthropo-

morphic robot and monitoring systems. Building on these

relationships, we constructed a matrix to help visually

portray the relationships between characteristics within

the area. Using this matrix, we are able to uncover how

these two fields intersect and also identify various current

trends and patterns. A benefit of this is the effective

capture and ‘mapping’ of existing research, in addition to

the identification of gaps and future potential directions of

research. Following this, we present a series of challenges

to help guide and frame future research exploring robots

as a monitoring systems.

2 Background

The following sections discuss both anthropomorphic

robots and monitoring systems, with the aim of providing

evidence to support the motivation of this paper.

2.1 Anthropomorphic robots

A humanoid form provides a natural means of interaction

between human and social-based robots (Heerink et al.

2006). Humanoid robots are effective at affording

(suggesting) how they should be controlled, used and

responded to (Dautenhahn 2002), easing the burden on

learning curves for users. It is this affordance which fun-

damentally differentiates the interaction between humans

and robots compared to other technologies in daily use.

This difference stems from the change in a users perception

of a robot from simply being a technology to being a social

actor (Heerink et al. 2010a). This change can be attributed,

in part, to the robot’s appearance, the fact robots will

actively share spaces with people, and the robots display of

intelligence and interest with the user and its surroundings

(Young et al. 2009). While there are many benefits to a

humanoid appearance, there comes a cost to this unique

interaction in the form of undesirable/unexpected effects

on users such as discomfort (Koay et al. 2006) or misplaced

expectations (Dautenhahn 2004). The ‘uncanny valley’ was

proposed by Mori (1970), which describes the different

degrees of anthropomorphism as experienced by the user.

The trough of the ‘valley’ represents the point of human

rejection, while the peaks represent acceptance. Like other

researchers (Bartneck et al. 2007), we take the view that the

‘valley’ should rather be considered a ‘cliff’, as users are

unlikely to knowingly appeal to a machine which demon-

strates increasingly ‘perfect’ anthropomorphism.

There are a number of other factors that may influence

user perceptions and feelings towards a robot (Young et al.

2009), for example existing research has established that a

robots appearance and actions can affect human behav-

iours, including a willingness to comply with robot

instructions or advice (Goetz et al. 2003; Powers and

Kiesler 2006), communication avoidance (Nomura et al.

2006) and the time spent with the robot and whether a user

is prepared to have physical contact (Nomura et al. 2008).

This influence is not limited to physical attributes, but can

also include effects caused by social attributes [e.g. per-

sonality (Takayama and Pantofaru 2009)] or more func-

tional attributes such as its purpose or application (Goetz

et al. 2003). While any influence is likely to always be

carefully considered, some of the human behaviours caused

by human–robot interaction (HRI) can be undesirable. This

may be avoidable through a rigorous identification and

understanding of all robots attributes which may influence

people (Siegel et al. 2009; Kuo et al. 2009). However,

many of these attributes still remain unidentified, unex-

plored or simply remain, as of yet, disjointed and unrelated

in the literature. More work is needed to identify, study

and/or bring together these salient factors and their inter-

relationships, including their associations with new, pre-

viously unconsidered factors (Heerink et al. 2009a). For

example, there is a fundamental aspect of HRI which to

date has received insufficient direct attention; an aspect

which stands to have a significant effect on the user when

robots are introduced into the ‘real world’.

2 AI & Soc (2015) 30:1–21

123

2.2 Data collection

To effectively interact with a user and achieve its intended

purpose/service, a robot must be ‘aware’ of the user, col-

lecting and processing significant amounts of data (Syrdal

et al. 2007b; Glas et al. 2009). Robots must be able to track

and recognise the location, identity and behaviour of

humans for any meaningful social interaction to take place

(Michalowski et al. 2006). Data collection is not unique to

HRI and is adopted in many (if not all) interactive tech-

nologies in some way. As mentioned earlier, HRI differs

heavily from existing technologies, mainly in terms of the

degree of interaction. Existing monitoring technologies,

such as closed-circuit television (CCTV) or radio fre-

quency identification (RFID), collect data and information

in a one-way interaction, restricted to certain areas, space

and data types (Syrdal et al. 2007b). This means that the

technology only collects data about the user, with little

reaction or response. In contrast, robots adopt a two-way

interaction (e.g. request and response) and also have the

opportunity, and capability, to collect larger amounts of

(personal) data than other technologies in private use

(Syrdal et al. 2007b).

One of the problems associated with monitoring of any

kind is that, like robot appearance and actions, it has been

shown to affect the behaviour of the person being observed

(Rosenthal and Jacobson 1968; Larson and Callahan 1990)

and even cause discomfort (Scholtz and Consolvo 2004;

Lyytinen et al. 2004). If the act of monitoring is affecting

the behaviour of the user, arguable their response is no

longer natural. This makes the data collected inaccurate,

potentially leading to a sub-optimal or inappropriate

response from the robot (or any interactive technology).

Moran and Nakata (2010) have conducted work where they

clearly identified a series of salient monitoring system

attributes that influence the interaction with users including

awareness, control, boundaries, trust, intrusion, justifica-

tion and context. It is our view that these are directly

applicable to a robot and may be part of the cause of

behavioural or interactional change, e.g. its placement in

relation to the users or the size of the sensors. For example,

consider a humanoid robot which has eyes and ears. These

are properties similar to a human which afford certain

capabilities, e.g. see and hear in specific directions. There

are likely to be discrepancies between these perceived/

afforded abilities and the actual, where a robot may have

eyes at its front, but may be able to see all around it. The

affordances may also run deeper, whereby humans per-

ceive the robot to have the same perceptibility and judge-

ment as humans, generating Hawthorne effects (Wickstrom

and Bendix 2000). There is also the potential to create

Panoptic effects (Jonsson 2006), whereby humans cannot

know when a robot is, or is not, collecting data about them

and so must assume data are collected constantly. When

this is considered alongside the Hawthorne effect, the types

of problems related to behaviours and coverage that can

occur become highlighted.

Robots can also be used in conjunction with other

technologies, such as RFID tags and floor sensors (Nohara

et al. 2008), sharing information as a part of a wider sys-

tem, leading to augmentation of the robots capabilities

(Koide et al. 2004; Dragone et al. 2010). Through this

augmentation, the coverage of the robots data collection is

increased, and with this increase, the undesirable effects on

users are anticipated to become amplified and more

numerous (Moran and Nakata 2010). When all this is

considered alongside the unique and private way humans

interact with robots, it becomes clear that designers of

these systems should carefully consider the issues of

monitoring robots with social intelligence (Kahn et al.

2006). This is important given the area of ubiquitous

human–robot interaction remains largely unexplored

(Dragone et al. 2010). A user’s response to a system is

predominately based on their perception of reality and not

the reality itself. Their perceptions of the attributes of the

system are more meaningful to them, and hence their

behaviours, than the objective facts (Young et al. 2009). As

such, the relationship between robot attributes and user

perceptions should be explored together, to provide a more

holistic understanding of the effects of the robot/monitor-

ing systems. For example, some researchers have already

established which precise physical attributes of a robot

head can be intentionally varied to effectively control how

humanlike it is perceived by the user (DiSalvo et al. 2002).

Much like the inter-relationships between physical and

social factors, there are a number of directly corresponding

perceptions, but there are also perceptions which comprise

a number of different physical and social factors. It is

through empirically measuring and understanding the

relationship between a robots attributes and a users per-

ceptions of said attributes that researchers will eventually

be able to intentionally encourage or prevent specific

behavioural responses (Nomura et al. 2007).

The research literature on HRI, behavioural change and

perceptions was comprehensively explored in order to

identify a series of salient and recurring factors which

influence user behavioural responses to robots, a similar

approach to Fong et al. (2003). In order to capture as many

different influencing attributes of a robot as possible, the

review explores both relevant hypotheses and empirical

studies, and the impacts of robots of different types (though

a general leaning towards anthropomorphic), in different

contexts and with different types of users. This provides a

holistic view of robotics and the possible areas of influence

in HRI. This is beneficial as it may capture information

which could be overlooked with a narrower search. The

AI & Soc (2015) 30:1–21 3

123

factors identified in the literature are categorised in terms

of physical and social attributes. Physical attributes con-

cern the tangible aspects of a robot, while the social attri-

butes are related to the application and interaction with

humans at a social level. Depending on the user, the

behavioural influence may be stronger in one of these

levels than the other. For example, users may be more

interested in the functional aspects of the robot (e.g. shape

and things which influence physical task) than aspects such

as colour or contour which influence human-likeness.

Equally, a user may be more interested in the way the robot

behaves and talks than what tasks it can carry out and its

physical form. A secondary objective of this study of the

literature is to explore the monitoring aspects of HRI in

terms of the factors identified by Moran and Nakata (2010),

where each factor was used as a part of a coding scheme

during the review.

3 Monitoring attributes

We now consider a series of attributes related to monitor-

ing systems that are relevant in the context of social

robotics as data collecting devices, namely privacy and

invasiveness, control, user understanding and ownership/

trust.

3.1 Privacy and invasiveness

The first set of attributes that have been studied in the

context of monitoring robots deal with privacy and the

physical, social and perceived invasiveness of robots.

3.1.1 Border crossings

Perceived natural border crossing (PNBC) is defined as

the degree to which a person feels that any natural borders

have been crossed, based on Marx (2001). Marx (2001)

talks about natural borders, where physical objects create

borders which help define physical areas of privacy (e.g. a

home is defined by its walls). When information crosses

these borders, privacy is perceived to have been invaded.

However, a user must initially perceive the physical bor-

ders to have been crossed before perceptions of privacy

invasion arise. Another form of natural border crossing is

when a robot physically invades a user’s personal space,

even in the absence of a physical border. When a robot was

closer than 3 m users felt discomfort (Koay et al. 2006;

Dautenhahn 2007), and the further away the robot, the

more comfortable they felt (Pacchierotti et al. 2006). If

robots must be closer than 3 m to achieve their task, then

there are several ways to avoid discomfort including: giv-

ing users control over the robot (Walters et al. 2009a),

reducing its size (Hiroi and Ito 2008) and/or ensuring that

the user feels minimal levels of anxiety (Nomura et al.

2007). Designers should carefully consider the robots they

are introducing into social environments and attempt to

prevent users feeling spatial discomfort (Syrdal et al.

2008). Understanding the relationships between systems

characteristics and perceptions is the first step towards

achieving this.

Perceived social border crossing (PSBC) is defined as

the degree to which a person feels that a social border has

been crossed, based on Marx (2001). Social borders refer to

the borders defined by a person’s expectations of confi-

dentiality in social roles and relationships (Marx 2001).

They are heavily related to natural borders, in that infor-

mation can be shared across them (made available to oth-

ers), resulting in perceptions of privacy invasion. In some

cases, people do not want their information to be shared

with certain social groups (e.g. colleagues at work). How

robots (accidently, or intentionally) store and share data

with a third party is a concern actively voiced by people

who have experienced HRI (Vargas et al. 2009; Syrdal

et al. 2007b). When robots are used to capture data in

public spaces, it is important that the reason for this is

made explicitly clear to all those who directly, and indi-

rectly, interact with it (Syrdal et al. 2007b).

3.1.2 Frequency of data collection and border crossings

Perceived frequency of border crossings (PFBC) is defined

as a person’s understanding of how frequently borders are

crossed, based on Moran and Nakata (2010). In keeping

with the idea that interaction with a robot involves border

crossings (social and natural), user perception of the reg-

ularity of these crossings may influence their behaviour

(Nomura et al. 2008). Furthermore, when determining the

level of social skills of a robot, the nature and frequency of

interaction need to be analysed (Dautenhahn 2007).

Frequency of data collection is defined as the regularity

with which data can be collected by the robot, based on

Moran and Nakata (2010). Robots have the potential to

continuously collect data about users and an environment

(Syrdal et al. 2007b) and repeated experiences with a robot

can change the behaviour of the human involved (Nomura

et al. 2007). A common assumption is that HRI is co-

located and synchronous; however, a user may interact

with the robot at different times (delayed responses) and

even in different places (through use of internet) (Yanco

and Drury 2004). For this reason, it is necessary to consider

not only the time spent within a robot’s coverage, but also

the frequency with which they engage with the robot and

hence the area being monitored. This aspect of HRI

becomes significant when we consider the mobility of a

robot.

4 AI & Soc (2015) 30:1–21

123

3.1.3 Robot obtrusion (physical presence)

Robot obtrusion (RO) is defined as the obtrusiveness of the

robot in terms of its physical presence, based on Moran and

Nakata (2010). RO captures the physical obtrusiveness of a

robot in terms of its position in relation to a user and the

effect of its complete overall appearance. While obtru-

siveness might be considered a subjective phenomena, we

argue that there are likely to be thresholds of physical

obtrusiveness that are consistent across users. Furthermore,

there are attributes and perceptions of a robot that are

discussed later in the paper that capture the more social

aspects related to obtrusiveness. RO is closely related to

PNBC in that robots can have an invasive physical pre-

sence (Young et al. 2009; Kidd and Breazeal 2004) when

crossing the natural border into a user’s personal space

leading to perceptions of anxiety (Hiroi and Ito 2008;

Kanda et al. 2002) or spatial discomfort (Syrdal et al.

2008), particularly when placed within the 3 m range

(Koay et al. 2006; Dautenhahn 2007). However, the mere

knowledge of the presence of a robot collecting data about

a user may increase the risk of perceiving their personal

space to have been invaded, causing discomfort (Scholtz

and Consolvo 2004; Lyytinen et al. 2004).

3.1.4 Perceived privacy invasion

Perceived privacy invasion (PPI) is defined as the degree to

which a person feels that the robot is invasive of their

privacy, based on Moran and Nakata (2010). Privacy

invasion is one of the most important user perceptions to

consider, as it could be the most significant cause of

undesirable behaviours. Dryer et al. (1999) describe pri-

vacy as a function of the type of information users must

give up to attain value from the application and how widely

available this information is disseminated. The nature of a

robot means it interacts with a human in a personal way

that no other technology does, but how does the increased

level of data capture of personal data in this context affect a

person’s privacy (Kahn et al. 2006)? It has been shown that

people may not feel comfortable about the collection of

personal data by a robot (Syrdal et al. 2007b). Another

privacy consideration raised with regard to data collected

by a robot is its long-term storage (Vargas et al. 2009). A

robot’s ability to ‘forget’ certain information may be a way

for a user to control the robot, effectively reducing the

perceptions of privacy invasion by regulating the type and

amount of data stored (Vargas et al. 2009).

Depending on the context and purpose of the technol-

ogy, users may not expect total privacy (e.g. hospital robot)

and accept this fact when making choices in light of its

application (Nguyen et al. 2008). Perceptions of a system’s

capabilities appear to significantly influence PPI (Vallejo

et al. 2008), and the greater the PPI, the less willing a user

will be to accept the technology (Zweig and Webster

2003). Contrary to the above, some research suggests that

privacy is less important in determining acceptance of a

technology than is currently believed (Spiekermann 2008).

According to Spiekermann (2008), this may be due to the

users focus on the delivery of a service, rather than on

tracking a person.

3.1.5 Coverage and data integration

Robot coverage is defined as the physical range within

which a robot is able to collect data or interact with its

users, based on Moran and Nakata (2010). Each type of

sensory device used in a robotic system has a different

range or coverage compared to another. This range is

defined as the distance, or area, within which the robot is

able to collect data. Many sensors are susceptible to

physical objects such as walls and doors limiting their

range, even the most powerful devices can be affected by

such limitations. An interesting consideration is that

physical constraints are unlikely to be an issue should a

robot be a part of a pervasive sensor network, which will

increase its coverage (Moran and Nakata 2010). The ability

for a robot to move will also dramatically increase its

coverage, even if the sensors it uses are relatively weak.

With such increases in coverage and information avail-

ability, it may be difficult for users to find places that they

perceive to be unmonitored (Punie 2003).

Perceived coverage (PC) is defined as the degree to

which person understands the area covered by the robots

sensors, based on Moran and Nakata (2010). Different

users will have a different understanding of the capabilities

of certain robots, brought about in part by the assumptions

they draw from the anthropomorphic form of the robot. As

such users will have different perceptions of the coverage

of the robots sensors, and the effects of the monitoring will

be different. Several hundred, or as few as one or two,

different robots may be needed to interact with users,

collecting data. The number of robots will affect the

interaction with the user (Yanco and Drury 2004). How-

ever, this area is still relatively unexplored and the question

remains: how does the presence of a number of robots

influence the interaction between users (Severinson-Ekl-

undh et al. 2003)?

Data integration is defined as the process of combining

data from different local and/or global sources, based on

Moran and Nakata (2010). With the potential for many

robots and many sensors to be collecting different types of

data at different times, a problem arises when trying to

understand and make use of all the information collected.

Data integration is therefore a necessary step in the sense-

making process. By combining data from different sources,

AI & Soc (2015) 30:1–21 5

123

a bigger picture can be built about those being observed

and more accurate inferences made. This data might be

stored in ‘the cloud’ and be hidden from the user, with the

robot itself potentially acting as a gateway to this infor-

mation alongside being the means by which it is collected.

The question remains whether or not humans would even

want to see/have access to this information. As the

potential for inference about users activities increases, their

perceptions and attitudes towards the robot are anticipated

to change. Participants in one study showed concerns

regarding the ability of the robot to infer meaningful

information about them (Lee et al. 2011). One suggested

way of avoiding this is by having a robot effectively

communicate its data integration/collection abilities, and

how it constructs knowledge about the user (Lee et al.

2011).

3.2 Control

The second set of data monitoring attributes of robots relate

to the extent to which the user has control, or perceives

having control, over the robot itself, the data it collects, and

the way in which this data is used.

3.2.1 Robot control

Robot control is defined as a user’s ability to physically

prevent or allow a robot from performing an action, e.g.

specific movements or data collection, based on Moran and

Nakata (2010). Physical control of a robot can take many

forms: in one experiment, users were given control of

robots movement, so they could signal to stop it when the

felt it came too close (Hiroi and Ito 2008); this is a form of

gesture based or physical control. A related study showed

that users felt ‘in control’ when the robot was fully visible

and approaching from a frontal direction (Dautenhahn et al.

2006). Control could be in a simpler form, where users may

have an option to simply deactivate the robot using an ‘off’

switch. In many cases, users are likely to be required to

forego their control over a robot, for example, a medical

robot may need to frequently touch a human to administer

drugs. Equally, providing a user with too much control may

be overwhelming and intrusive, increasing the complexity

of interaction.

Perceived robot control (PRC) is defined as the degree

to which a person feels they have direct control over the

robot itself, based on Moran and Nakata (2010). Control

can vary with different robots, and depending on users’

knowledge and understanding of the robot, they may per-

ceive themselves to have different levels of robot control.

Additional factors such as both the users and robots per-

sonality must be considered, as these have been shown to

affect user perceptions of control (Syrdal et al. 2006;

Meerbeek et al. 2008). For example, it has been shown that

if a human perceives the robot to be a living entity (extreme

anthropomorphism), they may show reluctance to switch it

off (Bartneck et al. 2009b). Thus, overly high levels of

anthropomorphism may actually cause users to feel some

control has been removed from them.

3.2.2 Data and application control

Data access is defined as the degree to which the data

collected is made available to individuals, groups and/or

the public, based on Moran and Nakata (2010), while data

sharing is defined as the process of distributing information

across different robotic systems, based on Moran and

Nakata (2010). Due to the nature of interaction with a robot

and the number of potential users, the disclosure of data is

an important consideration (Syrdal et al. 2007b). Take for

example a workplace, it may be possible for a robot to

share personal work-related information (e.g. the length

and number of breaks) with your employer, potentially

becoming a tool of surveillance (Kahn et al. 2006). This

has led to people showing concerns about how their data

are shared by robots (Vargas et al. 2009) and how they can

control this information (Enz et al. 2011). An interesting

situation is where an individual in a public space is inter-

acting with the robot, but due to its sensory range, the robot

is also passively, or indirectly, interacting with all those

secondary users around it (i.e. recording data about

bystanders). An important question in HRI is how do we

give those who are not directly interacting with the robot

control over it? In some cases, such as for public security

or safety, the designer of the robot may not want any users

to have control over it.

Application control is defined as the users’ ability to

manage how and by whom their data is used, based on

Dryer et al. (1999). What differs between application

control and robot control is that the data have been col-

lected, and now the control is aimed at the use and avail-

ability of the data. Users want robots to be controllable, but

some autonomy will always be required as few people want

to carry out constant supervision or intervention (Dau-

tenhahn et al. 2005; Yanco and Drury 2004; Enz et al.

2011). Under what situations is a user able and willing to

give up control (Enz et al. 2011; Meerbeek et al. 2008)? If

the right balance is not met, then issues related to mis-

placed trust may occur (Desai et al. 2009).

Perceived data control (PDaC) is defined as the degree

to which a person feels they have control over the use of,

and access to, the data collected by the robot, based on

Theofanos and Scholtz (2005). Depending on how well the

users are informed or how much experience they have with

a robot, their perceptions of how much control they have

over data access and use may differ. Their perceptions of

6 AI & Soc (2015) 30:1–21

123

robot control may also influence their overall perceptions

of data control.

Privacy invasion in robotics research is related to the

sensitivity of the information collected (Syrdal et al.

2007b). In one study, a robot storing information related to

a users personality and other psychological characteristics

was shown to make them feel uncomfortable (Syrdal et al.

2007b). People have also shown concerns regarding what

data were being stored by the robots and for how long

(Vargas et al. 2009). One suggested approach to mitigate

some of these concerns is for a robot to have the ability to

‘forget’ the data it has collected (Vargas et al. 2009). As

new sensors are developed capable of collecting new types

of data and robots are connected to networks of such

sensors, the data, information and knowledge a robot has

access to become an important consideration to both users

and designers.

3.3 User understanding

Next, we describe attributes relating to the user’s under-

standing of how and why the robot functions, whether this

understanding is accurate or not.

3.3.1 Informedness and assumptions

User informedness is defined as the degree to which a user

is informed as to the workings or purpose of the robot,

based on Moran and Nakata (2010). This is partially related

to the concept of awareness in HRI, which is an under-

standing of the location and status of the robot (Drury et al.

2003). As is the case with many current robot systems,

there may be a legal, ethical and/or social requirement for

owners or designers to ensure that the observed are made

aware of the inner workings and purpose of the robot. This

may require the use of large signs detailing the information

in simplistic, easy to understand terms, or in the small print

of a complex terms and agreement document (Nguyen and

Mynatt 2002). Users should be informed of the types of

data the robot is collecting, particularly as privacy invasion

is related to the sensitivity of the information collected

(Syrdal et al. 2007b).

Application assumptions (AA) is defined as the degree

to which a person understands the purpose and workings of

the robot, including what inferences can be drawn about

them, based on Dryer et al. (1999). This is strongly linked

to user informedness, but deals more specifically with the

users understanding of the system. There are two main

ways users can understand the purpose and workings of the

robot: through directly (or indirectly, i.e. affordance) being

informed by people or other media (e.g. forms, signs,

presentations) or through their own personal assumptions

based on previous experiences. Depending on how well

users understand the robot, their perceptions of the purpose

and workings of the system will change. The attributes of

the system, such as the distribution and frequency of

interaction with the robot, are likely to influence their

perceptions of what inferences can be drawn about them

from the data it collects. Their assumptions about the

application of the robot may also influence their level of

trust they have in the robot (Desai et al. 2009). Perceived

anthropomorphism is an indirect form of information

sharing and can lead to assumptions regarding the abilities

to a robot. These assumptions can lead to expectations

which cannot be fulfilled (Dautenhahn 2002; Bartneck

et al. 2009a) and result in a break down in the interaction

(Dautenhahn et al. 2005). Users with negative reactions

towards a robot can affect their assumptions about its

capabilities (Nomura et al. 2006), and assumptions about

capabilities can in turn influence attitudes (Nomura et al.

2005). Without an understanding of the monitoring capa-

bilities of the robot, e.g. inability to comprehend robot

sensors (Lee et al. 2011), users are not capable of under-

standing the privacy trade-offs they are making in their part

in its use (Nguyen et al. 2008).

Perceived benefit (PB) is defined as the degree to which a

person feels the robot is of benefit to themselves, others or the

observer, based on Moran and Nakata (2010). A users will-

ingness to adopt any new technology is dependent on their

perceptions of its capabilities and functions (Vallejo et al.

2008; Beckwith 2003), and acceptance of robotic systems is

no different (Heerink et al. 2008a, 2009b). Ultimately, the

data collected by a robot should be fully justified (Syrdal

et al. 2007b; Kidd and Breazeal 2005); and if perceived as

sufficiently beneficial by the user, then any negativity

towards the robot will be tolerated and regarded as a ‘nec-

essary evil’ (Syrdal et al. 2007b). There may also be a suf-

ficient ‘reward’ that outweighs the ‘damage’ potentially

caused by disclosing specific information from the user. In

some cases, simply understanding and being aware of a robot

may remove concerns regarding invasion (Lee et al. 2011).

3.3.2 Affordance

Perceived affordance (PA) is defined as a person’s

understanding of the capabilities of the robot based on its

appearance, based on Moran and Nakata (2010). Affor-

dance is a term originally coined by James Gibson (1977),

and the term (perceived) affordance was popularised in

human–computer interaction by Don Norman (1988).

Norman’s affordance has been further extended to the verb

‘afford’, which means ‘to suggest’. The appearance of a

robot acts as an important means of sharing information

about its abilities and functionality with its users (Salvini

et al. 2010; Dautenhahn 1999; Austermann et al. 2010;

Goetz et al. 2003; Dautenhahn 2002).

AI & Soc (2015) 30:1–21 7

123

For example, a robot with human features will lead to

expectations of humanlike capabilities (Weiss et al. 2009;

Austermann et al. 2010), e.g. facial features such as eyes

can lead to perceptions of the ability to see (Blow et al.

2006a). However, information collected by other data

collection devices in a system may be shared with the

humanoid robot, augmenting its capabilities beyond what

can be perceived (Koide et al. 2004; Dragone et al. 2010).

This presents a dilemma for users, who perceive the robot

as humanoid, with humanlike capabilities, but the robot

actually has capabilities that are not afforded by its phys-

ical appearance (Dragone et al. 2010). In this sense, it is

interesting to explore what monitoring abilities the robot

affords. The more humanlike it is viewed, then the more its

capabilities will be seen as humanlike. For example, a user

assumes that as a human cannot see through a wall, or see

through the back of its head then a robot with eyes cannot

either (Lee et al. 2011). Consider a robot which is con-

nected to additional sensors and may be able to see or know

things beyond what it affords. A user may walk behind the

robot, but the robot can still ‘see’ the user because of

additional sensors. When the true capabilities of an

anthropomorphic robot are experienced, and they are

beyond what a human is capable of, then it is anticipated

that perceptions of anthropomorphism will decrease.

3.4 Ownership/trust

The following two attributes are closely related as they deal

with user’s perception of whether or not they own the robot

and whether or not they can trust it.

3.4.1 Perceived ownership

Perceived ownership is defined as the degree to which the

user perceives that they have ownership of the robot. One

of the benefits of perceived ownership, or the perception

that the robot is a consumer item, is that the robot will be

viewed as non-threatening and under the users control

(Blow et al. 2006b). This control could be in the form of a

choice in using the device, or the user’s ability to tailor

aspects of a robot, such as appearance and behaviour, in

accordance with their own preferences (Dautenhahn 2007).

It is also interesting to consider this from the point of view

of data collection; if the user perceives ownership of the

robot, then their control, in principle, extends beyond the

robot itself to the data it collects. All issues related to the

monitoring aspects of a robot may be reduced if the user

perceives ownership of the robot and therefore any data

collected. Another view of ownership could be in terms of

a robot’s direct owner with an independent user interacting

with it. For example, consider a medical robot, the patient

does not own it, but still has to share sensitive information

with it, information which the owner of the robot may have

access to. The interplay and dynamics between the three

stake holders: robot(s), robot owner(s) and user(s) will be

an important consideration in how the factors identified in

this paper influence the behaviour of the users. This three-

way interaction is more akin to the relationship between a

human observer and an observed human, facilitated by a

humanoid robot which may be perceived as another

human—a complex but interesting scenario.

3.4.2 Perceived trustworthiness

Perceived trustworthiness (PT) is defined as the degree to

which a person feels the robot, or observer, is trustworthy,

based on Moran and Nakata (2010). For a robot to be

successful in its implementation, users must have trust in it

and its operation (Looije et al. 2006; Heerink et al. 2009b).

A users placement of trust in the robot can be influenced by

the robot’s gender (Siegel et al. 2009), physical and social

presence (Bainbridge et al. 2008), behaviour, autonomy

and adaptability (Desai et al. 2009). The less humanlike the

robot’s appearance and voice, the less trustworthy it will be

perceived (Tamagawa et al. 2011); however, it has also

been claimed that the more humanlike, the less trustworthy

robots become (Schermerhorn et al. 2008). Like the

uncanny valley, there may be a ‘peak of trust’ in a robot,

where there is a threshold of anthropomorphism which

achieves the maximum possible trust. The users own

characteristics will also influence their trust in the robot,

including user personality (Severinson-Eklundh et al.

2003), gender (Siegel et al. 2009), cultural background (Li

et al. 2010), application assumptions (Desai et al. 2009)

and how informed they are about the robot (Desai et al.

2009). The more a user trusts a robot, then the more it will

be perceived as a sociable entity (Heerink et al. 2009b,

2010b).

Robots are not always autonomous and can often be

controlled by a human. This means that perceived trust can

be expanded to include the human observer, whether this is

the controller or simply a user who has access to the

information collected. The observer can be considered

trustworthy if they collect and use a person’s personal data

(as collected by the robot) honestly, responsibly and with

no intent to cause harm (Scholtz and Consolvo 2004).

According to Theofanos and Scholtz (2005), the concept of

trust can be measured in terms of a user’s understanding of:

what data are recorded and what inferences are made about

them (awareness); the user’s ability to manage how and by

whom their data are used (control); what type of infor-

mation they must give up to receive the service and how

widely available the information collected is to other users

(privacy). A balance of trust must be found between the

observed/user and the observer/robot, as too much trust can

8 AI & Soc (2015) 30:1–21

123

be just as problematic as too little (Desai et al. 2009). It

should be noted that insufficient research has investigated

the issue of trust in robotics (Desai et al. 2009; Kidd and

Breazeal 2005).

4 Anthropomorphic attributes

We now move on to consider a series of attributes related to

anthropomorphic robots that are relevant in the context of

behavioural change, namely intelligence, autonomy and

adaptability, anthropomorphism and user-centric attributes.

4.1 Intelligence, autonomy and adaptability

The first set of anthropomorphic properties deal with the

level of autonomy the robots have as well as its ability to

reason within and adapt to the context it is placed in.

4.1.1 Intelligence

Robot intelligence is defined as the level of intelligence

potential of the robot. The intelligence of a robot will play

an important part in its interaction with users, ranging from

socially acceptable movement around a space to under-

standing and communicating socially through use of nat-

ural language (Beer et al. 2011). Robot intelligence may

not yet be at a sufficiently effective level, but there are

ways to emulate intelligence, through animacy and

appearance; though this effect is not retained over time

(Bartneck et al. 2009b).

Perceived intelligence is defined as the degree to which

a robot is seen as a knowledgeable and competent agent

[based on Bartneck et al. (2008)]. In many ways, the per-

ceived intelligence of the robot will be the predominant

determinant of its ability to be perceived as anthropomor-

phic. Existing research has established that perceptions of

intelligence are influenced by the adaptability (Austermann

et al. 2010), anthropomorphism (Walters et al. 2009b) and

animacy (Bartneck et al. 2009b) of a robot.

4.1.2 Autonomy

Robot autonomy is defined as the robots ability to function

independently of human control or intervention. The ability

for a robot to function without constant supervision from

users is critical to their adoption ‘in the wild’. There will of

course need to be constraints on the robots autonomy, as

users may begin to perceive they have reduced control over

the robot, potentially leading to perceptions of anxiety. A

balance should be found between the autonomous func-

tioning of a robot, and a user’s ability to intervene, when

they so choose.

Perceived autonomy is defined as the degree to which a

robot is perceived to demonstrate an ability to function

independently without the need for human intervention or

supervision. In many ways, this is one of the fundamental

principles of a robot and is often an assumption in many

instances of HRI. Different degrees of perceived autonomy

have been found to influence the social presence of a robot

(Syrdal et al. 2008).

4.1.3 Adaptability

Robot adaptability is defined as the robots ability to adapt

and respond to a variety of situations. A robot will be

presented with many scenarios where it will need to adapt,

perhaps dynamically changing attributes such as person-

ality and behaviour. A robot must know how to act in a

socially acceptable way, particularly as the social situation

changes, e.g. moving from formal to informal environ-

ments or showing authority when a person is not acting

correctly (e.g. damaging something).

Perceived adaptability is defined as the degree to which

a robot is perceived as adapting to the needs and situation

of its users (Heerink et al. 2008a). This has been shown to

affect user attitudes towards a robot (Torrey et al. 2006)

and ultimately affect their acceptance of the robot (Heerink

et al. 2009b; Broadbent et al. 2009). Other aspects of a

robot, such as its social presence (Syrdal et al. 2008),

intelligence (Austermann et al. 2010) and perceived use-

fulness (Heerink et al. 2008a, 2009b, 2010b), have been

established as determinants of perceived adaptability.

4.2 Anthropomorphism

The next set of properties relate to the robot’s humanlike

physical appearance, its expressiveness, behaviour and

personality and how they all affect how the robot is viewed

as anthropomorphic as well as how this affects user

expectation and interaction.

4.2.1 Anthropomorphic form

Robot form is defined as the complete physical appear-

ance of a robot, ranging from purely functional to

humanlike characteristics. A humanlike physical form

exhibited by a robot has been linked to a host of different

effects. These effects are created by the user’s tendency to

anthropomorphise a humanlike robot. A first step to

achieving this is to emulate the structure of a human,

including a torso, a head, arms, legs, and even fingers and

toes (Beer et al. 2011); as opposed to the physical

structure of an animal (e.g. zoomorphic (Yanco and Drury

2004)). The details of these components are important, for

example, the dimensions, specific features and total

AI & Soc (2015) 30:1–21 9

123

number of features of a robot face (Blow et al. 2006b;

DiSalvo et al. 2002; Broadbent et al. 2009) have been

shown to influence perceptions of human-likeness, robot

sociability, capabilities and even knowledge (Powers and

Kiesler 2006; DiSalvo et al. 2002; Blow et al. 2006a).

Together these attributes, and their size, can determine the

physical presence a robot holds in an environment.

Variations in size and presence can be quite problematic

for an interaction, so much so that in one experiment,

researchers consciously reduced the size of their robot to

less than the height of an adult male so that it would not

be perceived as threatening (Hiroi and Ito 2008). This

change in size demonstrates the ways in which designers

can control the way a robot is perceived. One of the

problems with giving a robot a too strong human-likeness

is that it may give false expectations about the robots

abilities (Dautenhahn 2004). If these are not met, then

there may be a break down in the interaction (Dautenhahn

et al. 2005; Velonaki 2010). To compensate for this, it

may be possible to dynamically change the appearance of

a robot to coincide with user expectations in a specific

context or scenario (Siegel et al. 2009). For example,

changing a property such as gender has been shown to

affect acceptance (Broadbent et al. 2009; Beer et al.

2011). The form of a humanoid robot, as would be

expected, influences a significant number of perceptions

including likeability (Bartneck 2008), familiarity (Dau-

tenhahn 2002), empathy (Riek et al. 2009), emotional

experience (Zhang et al. 2010), anthropomorphism

(Bartneck 2008; Austermann et al. 2010), trustworthiness

(Bainbridge et al. 2008), invasiveness, (Young et al. 2009;

Kidd and Breazeal 2004; Walters et al. 2005; Kanda et al.

2008), anxiety (Kanda et al. 2002), expectations (Dau-

tenhahn 2004) and human-likeness, robot sociability,

capabilities and even knowledge (Powers and Kiesler

2006; DiSalvo et al. 2002; Blow et al. 2006a).

Perceived anthropomorphism (PA) is defined as the

degree of robot human-likeness based on both physical

appearance and user interaction experience (Zhang et al.

2010). The different degrees of anthropomorphism arise

from a users perceptions of humanoid appearance, form

and skills (Bartneck 2008; Beer et al. 2011). This includes

attributes such as a robots vocal and facial characteristics

(DiSalvo et al. 2002; Powers and Kiesler 2006), animacy

(Goetz et al. 2003; Severinson-Eklundh et al. 2003; Di-

Salvo et al. 2002), communication (DiSalvo et al. 2002),

behaviour and emotions (DiSalvo et al. 2002; Sabanovic

et al. 2006; Bartneck et al. 2009a), and gender (Scher-

merhorn et al. 2008), in addition to the number of these

features (Hegel et al. 2009). The more, or less, a robot is

perceived as anthropomorphic will likely affect other per-

ceptions a user holds about the robot (Lee 2010). For

example, an anthropomorphic robot would not afford the

ability to see through objects, which is another area users

may be misled (Lee et al. 2011). It also affects how users

interact with the robot; for example, research has shown

that when robots are viewed as more humanlike, users are

likely to be less truthful (Schermerhorn et al. 2008). Like

robot form, perceived anthropomorphism has been estab-

lished as an indicator of perceived robot intelligence

(Walters et al. 2009b), ease of use (Hegel et al. 2009),

social presence (Schermerhorn et al. 2008), personality

(Goetz et al. 2003), ability (Goetz et al. 2003) and trust-

worthiness (Tamagawa et al. 2011).

4.2.2 Personality

Robot personality is defined as the humanlike persona

displayed by the robot. Syrdal et al. (Syrdal et al. 2007a)

make use of the Big Five Personality Factors which consist

of Emotional Stability, Extraversion, Agreeableness, Con-

scientiousness and Intellect. These personality factors can

define personality types such as friendly, shy, aggressive or

bossy (Woods et al. 2005b). Perceptions of trustworthiness

(Severinson-Eklundh et al. 2003), anthropomorphism

(Fussell et al. 2008) and level of control (Meerbeek et al.

2008) are influenced by decisions regarding robot

personality.

Perceived personality is defined as the degree to which

the robot is perceived to display humanlike personality

traits. A robot’s perceived personality type has been

shown as an anchor point upon which many other per-

ceptions are based (Powers et al. 2005). Robot form can

lead to marked differences in perceived robot personali-

ties. Perceptions of robot personality will shape a user’s

expectations and social responses and will influence their

perceptions of control and trustworthiness. It has also

been suggested that a user will anthropomorphise a polite

robot more than an impolite one (Fussell et al. 2008).

Some research has attempted to control perceptions of

personality through designed personality (i.e. controlled

system attributes), but their experiments showed little

change in perceived personality through variations in the

designed personality (Meerbeek et al. 2008). This sug-

gests that controlling for personality alone is insufficient

and that variations in other factors such as appearance,

which influence perceptions of personality, may be

required. A robot’s form (Meerbeek et al. 2006; Walters

et al. 2008a; Severinson-Eklundh et al. 2003) and ani-

macy/mobility (Severinson-Eklundh et al. 2003) have

been observed to influence user perception of personality.

In turn, this perception can influence a user’s expectations

and social responses (Goetz et al. 2003), control (Meer-

beek et al. 2006), trustworthiness (Desai et al. 2009;

Severinson-Eklundh et al. 2003) and anthropomorphism

(Fussell et al. 2008).

10 AI & Soc (2015) 30:1–21

123

4.2.3 Robot expression

Robot physical expression is defined as the ability for the

robot to use physical actions in order to communicate

through expression. Physical expression, in the form of

animated gestures, is important when establishing com-

munication between robots and humans (Kanda et al.

2002). Having the ability to express and interact with

humans in a more natural way has been shown to affect

user acceptance and perceptions of a robot (Broadbent

et al. 2009; Blow et al. 2006b). Another aspect of physical

expression is the animacy of the robot, defined as the

method and manner by which the robot moves. A robot

may move in a ‘natural’ and fluid way, or it may move in a

rigid and mechanical fashion which can affect its

Humanlike Appearance (DiSalvo et al. 2002) and Per-

ceived robot intelligence (Bartneck et al. 2009b).

Robot Social Expression is defined as the ability for a

robot to express itself socially through communication and

emotion. Humans have shown a preference to communicate

with robots in a humanlike manner, with speech being a

key natural means of interaction (Dautenhahn et al. 2005;

Sabanovic et al. 2006). Specific features of speech, such as

accent and pitch, can also directly influence trustworthiness

(Tamagawa et al. 2011). Emotion is another tool for a

robots social expression (Beer et al. 2011) and affects

perceptions of robot dominance (Kim et al. 2011), human-

likeness (DiSalvo et al. 2002; Sabanovic et al. 2006),

knowledge and sociability (Powers and Kiesler 2006),

obtrusiveness (Walters et al. 2008b), comfort (Nomura and

Kanda 2003), personality (Woods et al. 2005b) and trust-

worthiness (Tamagawa et al. 2011).

Perceived robot social expression is defined as the

degree to which a robot is perceived to display an ability to

express itself through verbal communication and emotions.

While many would consider personality as a form of social

expression, in this research it is viewed as a separate factor

due to its relative complexity, though perceived personality

and perceived robot social expression are anticipated to be

closely related. The task, or purpose, of a robot effectively

determines the need for social expressiveness. For exam-

ple, a factory-based robot does not necessarily need to

express itself in order to function correctly, while a

humanoid robot placed in a service role (e.g. assistant,

guide) needs social expression in order to interact with

users in a natural way, to also create a sense of social

presence (Heerink et al. 2008b, 2009b, 2010b) and inter-

action enjoyment (Heerink et al. 2009b, 2010b).

4.2.4 Social presence

Perceived social presence is defined as the degree to which

a user feels that they are in the presence of a socially

interactive entity. Furthermore, a consistency between

robot voice and personality has been empirically demon-

strated to positively affect perceived social presence (Lee

and Nass 2003), and without such positive reinforcement,

perceptions of social presence are expected to decrease

over time (Leite et al. 2009). Factors which can affect

perception of social presence include robot Mobility

(Syrdal et al. 2008), anthropomorphism (Schermerhorn

et al. 2008), adaptability (Syrdal et al. 2008), physical

presence (Kidd and Breazeal 2004; Bainbridge et al. 2008)

and social expressiveness (Heerink et al. 2008b). Social

presence is an important consideration as it influences a

number of different perceptions including: engagement

(Leite et al. 2009), enjoyment (Heerink et al. 2009a, b,

2010b, 2008b), social expressiveness (Heerink et al. 2010a)

and boundaries (Walters et al. 2005).

4.2.5 Mobility

Robot mobility is defined as the means and functionality of

robot locomotion. The movement speed and approach

direction of a robot have been shown to increase percep-

tions of anxiety (Hiroi and Ito 2008; Nomura et al. 2007)

and threat. The distance a robot is able to travel and how

quickly is also a point of consideration and may be a factor

which actually leads to a reduction in perceptions of

anthropomorphism. Its mobility may also, in certain situa-

tions, be considered obtrusive or intrusive, such as inter-

acting with a robot in a tight corridor (Nakauchi and

Simmons 2002) or crossing/blocking a users path (Dau-

tenhahn 2007). It can also affect anxiety (Hiroi and Ito

2008; Nomura et al. 2007) and perceptions of feeling

threatened (Dautenhahn et al. 2006). Additional locomo-

tive functions of robot mobility are likely to influence

perceptions, for example if the robot can swim/fly.

Perceived mobility is defined as the degree to which

users perceive the robots ability to transport itself freely.

Depending on how the robot is perceived to be mobile,

perceptions of personality, anthropomorphism (Severinson-

Eklundh et al. 2003) and social presence (Syrdal et al.

2008) will change.

4.2.6 Behaviour

Robot behaviour is defined as the manner with which the

robot acts during interaction. Design choices made about

the behaviour of a robot will affect how people perceive it

(Young et al. 2009; Zia-ul-Haque et al. 2007). For exam-

ple, users prefer a robot which is considerate, polite, and

which demonstrates a passive behaviour (Dautenhahn et al.

2005). Even if a robot is perceived as useful, it will only be

adopted if socially acceptable behaviour is displayed

(Walters et al. 2007), which is context and culturally

AI & Soc (2015) 30:1–21 11

123

specific. The way a robot acts can also affect perceptions of

its capabilities (Goetz et al. 2003; Lohse 2009) and its

anthropomorphism (DiSalvo et al. 2002; Sabanovic et al.

2006).

Perceived robot behaviour (PRB) is defined as the

degree to which a user perceives the manner with which a

robot acts as natural and socially acceptable. A robots

appearance will likely play an important part in influencing

a users perceptions of robot behaviour (Walters et al.

2007). Perceptions of anthropomorphism are determined,

in part, by a robots behaviour (DiSalvo et al. 2002) and

therefore also arguably determined by the way a user

perceives that behaviour. If there is a discrepancy between

human form and human behaviour, then negative user

responses are likely (Dautenhahn et al. 2005; Walters et al.

2007; Velonaki 2010). The behaviour of the robot will also

affect users expectations (Lohse 2009), where the behav-

iour is an effective way of communicating information to

users such as the robots intentions (Salvini et al. 2010).

There is still more work to be conducted exploring how

variations in the behaviour of a robot affects a users

responses (Goetz et al. 2003), particularly their emotional

and cognitive responses (Broadbent et al. 2007). The

influence of behaviour on HRI is also difficult to isolate

from the effects of the robot appearance (DiSalvo et al.

2002; Walters et al. 2007; Minato et al. 2004), but has been

found to affect user expectations (Lohse 2009).

4.3 User-centred

The last set of attributes relate to the user’s experience of

interacting with the robot, rather than the intrinsic prop-

erties of the robot itself.

4.3.1 Enjoyment

Perceived likeability/enjoyment is defined as the degree to

which a user perceives the robot to be likeable and the

interaction enjoyable (Bartneck et al. 2008). Likeability

(enjoyment) has also been shown to influence acceptance

of a robot (Heerink et al. 2008b, 2009b), but in contrast,

some research has found no evidence for the importance of

hedonic factors in robot acceptance (Klamer and Ben

Allouch 2010). Factors such as social presence (Heerink

et al. 2008b), appearance (Bartneck 2008) and acceptance

(Heerink et al. 2008b, 2009b) should be considered when

designing for likeability.

4.3.2 Ease of engagement

Perceived engagement is defined as the degree to which a

person perceives the robot to have drawn them into an

interaction and to successfully negotiate that interaction,

based on Kidd and Breazeal (2005). To function as inten-

ded, a robot must be engaging, encouraging users to will-

ingly have regular interactions (Kidd and Breazeal 2005).

Without this engagement, the robot is unlikely to retain

high degrees of social presence (Leite et al. 2009).

4.3.3 Anxiety

Perceived anxiety is defined as the degree to which a user

feels a sense of anxiety towards interacting with the robot.

A sense of familiarity, generated through previous expe-

riences, may also reduce the anxiety felt by certain users

(Bartneck 2008). Perceived anxiety has also been shown to

change with time (Nomura et al. 2007) and incite com-

munication avoidance (Nomura et al. 2006) and reduce

perceptions of usefulness (Heerink et al. 2009b, 2010b). To

prevent this, aspects of mobility (Hiroi and Ito 2008),

boundaries (Nomura et al. 2007), approach direction

(Dautenhahn et al. 2006) and familiarity (Bartneck 2008)

could be controlled.

4.3.4 Safety

Perceived safety is defined as the user’s perception of the

level of danger, or threat, when interacting with a robot

(Bartneck et al. 2008). It has been suggested that when a

robot is highly obtrusive (perhaps due to its size), the users

will perceive themselves to be secure (Dautenhahn et al.

2006), which in turn can lead to acceptance of the tech-

nology (Bartneck et al. 2008). Perceptions of safety may

also be created through the purpose of the robot, e.g. a

robot which collects physiological data about a person who

has a life-threatening illness may give the person a sense of

safety. However, if the purpose of the robot is to observe a

visitor as they simply walk around a hospital, the user may

feel there is a reason to perceive the situation as unsafe.

Previous experience with a robot (Blow et al. 2006b) and

its size (Hiroi and Ito 2008; Bartneck et al. 2008) can affect

the perceived safety of a user during their interaction with

the robot.

5 Perceptions of system attributes matrix

The research literature on HRI and monitoring was com-

prehensively explored in order to identify a series of salient

and recurring factors which are important to the interaction

and influence user behavioural responses to robots. In order

to capture as many different influencing attributes of a

robot as possible, the review explores both relevant

hypotheses and empirical studies, and the impacts of robots

of different types (though a general leaning towards

anthropomorphic), in different contexts and with different

12 AI & Soc (2015) 30:1–21

123

types of users. This provides a holistic view of robotics and

the possible areas of influence in HRI. This is beneficial as

it may capture information which could be overlooked with

a narrower search. While research from other fields is

likely to be of interest, for example software agents and

autonomous systems, the survey was limited to monitoring

and HRI in order to explicitly highlight the ways in which

these two fields specifically intersect.

It is difficult to get a sense of all of the relationships

identified above, and so the most effective way of repre-

senting and analysing the inter-relationships between the

different themes is through use of a matrix, as shown in Fig. 1.

The aim of this matrix is to clearly visualise the state of the art,

and identify areas where more research is needed. The high-

level groupings of factors are used for the columns and rows,

with references to the literature exploring that relationship.

Anthropomorphic Data Collection

Intelligence Anthropomorphism User Centr. Invasiveness Control Understanding Ownership

A nt

hr op

om or

ph ic

In te

ll ig

en ce

(Syrdal et al. 2008) (Heerink et al. 2010a;

Syrdal et al. 2008;) (Desai et al. 2009)

A n

th ro

p om

or p

h is

h m

(Bainbridge et al. 2008; Bartneck et al. 2009b;)

(Bartneck 2008; Bartneck et al. 2009a; Beer et al. 2011; Desai et

al. 2009; Fussell et al. 2008; Goetz et al. 2003; Hegel et al.

2009; Kim et al. 2011; DiSalvo et al. 2002; Meerbeek et al. 2006;

Powers and Kiesler 2006; Sabanovic et al. 2006;

Schermerhorn et al. 2008; Severinson-Eklundh et al. 2003; Syrdal et al. 2008; Walters et al.

2007; Walters et al. 2008a; Woods et al. 2005; Heerink et al.

2008; Heerink et al. 2009a; Heerink et al. 2009b; Heerink et

al. 2010a;)

(Bartneck et al. 2008; Bartneck 2008; Dautenhahn

et al. 2006; Hiroi and Ito 2008; Kanda et al. 2002; Li et al. 2010; Nomura et al. 2007; Nomura and Kanda

2003; Heerink et al. 2009b; Heerink et al. 2010a; Heerink

et al. 2010b; Walters et al. 2005;)

(Bainbridge et al. 2008; Dautenhahn 2007; Hiroi and Ito 2008; Kanda et al. 2008;

Kidd and Breazeal 2004; Nakauchi and Simmons

2002; Schermerhorn et al. 2008; Tamagawa et al. 2011; Walters et al. 2005; Walters

et al. 2008b; Young et al. 2009;)

(Meerbeek et al. 2006; Meerbeek et al. 2008;

Syrdal et al. 2006;)

(Austermann et al. 2010; Bartneck et al. 2008; Bartneck et al. 2009a;

Dautenhahn 2002; Dautenhahn 2004; Goetz et al. 2003; Lohse 2009;

Walters et al. 2007; )

(Bainbridge et al. 2008; Fussell et al. 2008; Goetz et al. 2003; Lohse 2009;

Meerbeek et al. 2006; Severinson-Eklundh et al. 2003; Tamagawa et al. 2011; Desai et al.

2009)

U se

r C

en te

re d

(Dautenhahn et al. 2006; Nomura et al. 2007;)

(Heerink et al. 2009b; Heerink et al. 2010a)

(Leite et al. 2009)

“Y” Influences…

“X ”

In fl

ue nc

ed b

y …

D at

a C

ol le

ct io

n

In va

si ve

n es

s

(Hiroi and Ito 2008; Kanda et al. 2002; Syrdal et al. 2008;)

(Dautenhahn 2007; Koay et al. 2006; Pacchierotti et al.

2008;)

(Bainbridge et al. 2008;Dautenhahn et al. 2006;Kidd and Breazeal

2004; Syrdal et al. 2008;Young et al. 2009;)

(Dautenhahn et al. 2006; Zweig 2005);

(Bohn et al. 2007; Marx 2001; Mancini et al. 2010 ;Punie 2003 ;)

C on

tr ol

(Hiroi and Ito 2008; Syrdal et al. 2007; Walters et al. 2009;)

(Desai et al. 2009)

U n

d er

st a.

(Desai et al. 2009; Melenhorst et al. 2004; Stanton 2000; Syrdal et al. 2007; Vallejo et al. 2008; Zweig and Webster 2002;)

(Desai et al. 2009; Zweig 2005;)

O w

n .

(Blow et al. 2006) (Melenhorst et al. 2004;

Zweig 2005;) (Blow et al. 2006; Dautenhahn 2007;)

Fig. 1 Relation-based matrix for anthropomorphic and data collection factors

AI & Soc (2015) 30:1–21 13

123

Moving horizontally in the matrix examines the factor

that influences the others, while moving vertically top to

bottom, examine what influences the factor (horizontal:

influences, vertical: influenced by). Initially, we will

explore the matrix factor by factor, considering both the

influence it has on other factors (horizontal) and the

influence of other factors on it (vertical).

Starting at the top left and looking from left to right, we

see that robot intelligence shows a small number of

established influences, only research related to ownership

and user-centred factors. Examining the first column, we

see that only anthropomorphism (as an external factor) has

influence on perceptions of robot intelligence. The gaps in

the matrix may be attributed to the fact that robot intelli-

gence is an inherently difficult aspect of robotics to study

effectively. This is likely due to the level of progress in the

field towards truly convincing and adaptable artificial

intelligence; while strides are being made towards a suit-

able level, the work still remains limited in the convinc-

ingness of the AI appropriate to anthropomorphic robotics.

One technique that can help with studies of the missing

relationships, particularly in relation to monitoring sys-

tems, is Wizard of Oz (Woz). This approach introduces a

human into the loop and suggests to the user that the

machine is artificially responding to them, when in fact it is

a human in control. Assuming the interaction is believable

and convincing, users are unlikely to question the efficacy

of the interaction, nor consider that they are being

deceived.

The next horizontal row shows that anthropomorphism

has the most established influence/relationships with all the

anthropomorphic and data collection factors. This suggests

that it is a well-studied aspect of social robotics and re-

affirms the clear intersection of research between social

robotics and monitoring systems. However, when looking

at anthropomorphism vertically, we see that only inva-

siveness has been identified as a point of influence. This

raises questions as to the impact of the other factors on

perceived anthropomorphism; for example, can different

degrees of control or understanding or the robots ability to

collect data impact user perceptions of its anthropomor-

phism? How might knowledge that a robot can only see

through cameras (analogous to eyes) influence the way it is

perceived? Evidence in the literature suggests that people

anthropomorphise computers in their possession and it

would be interesting to consider how this might expand to

ownership of a social robot. Related to this is also the users

emotional attachment to an object, how might this influ-

ence the way they anthropomorphise it?

Research on the influence of user-centred attributes

appears to be limited to relationships within the data col-

lection attributes. Interestingly, little work has explored the

influence of these on anthropomorphic factors. This may be

related to the fact that a user has to experience the system

to have an emotional response to it, and so detaching the

emotional response from this experience is difficult.

Examining the user-centred attributes column, we see a

different picture of the literature, where a number of the

factors have explored the ways in which user-centred

attributes are influenced by the other factors. This may be

due to the fact that users can be easily exposed to a char-

acteristic such as a robot with a large torso and have their

emotional response measured. However, to have a user in a

specific emotional state prior to this interaction is more

difficult and an understudied area.

Invasiveness appears to be the most studied in the

matrix both in terms of its influence on other factors and

what it is influenced by (horizontal and vertical). It is one

of the predominant data collection-based factors to have

been studied within the context of social robotics. When

considering the personal and intimate ways in which

social robots will be used in the future, it becomes clear

why this factor is important in terms of physical space

and privacy issues. Research examining the effect of

control on other factors is one of the most limited in the

matrix, with a focus on user-centred attributes and

ownership. This raises interesting questions on how

control might influence perceptions of intelligence

(including autonomy) and anthropomorphism: does being

able to control a robot impact the illusion of anthropo-

morphism by breaking the social norm of ‘not control-

ling’ a human? From the column of control, we can see

that a number of factors influence perception of it,

including the obvious component of control, but most

interestingly invasiveness and anthropomorphism.

Like control, the impact of understanding on other

factors is limited, with a focus on invasiveness and

ownership. These factors are predominately related to

data collection, which promotes the need for exploring

these factors in terms of humanoid robotics. Alternately,

understanding is influenced by anthropomorphism and

user-centred emotions factors, however, does not influ-

ence data attributes generally, this again suggests that the

technology is not in a sufficient state of deployment that

we can deploy it to users who can then experience it and

understand it, then informing their views of the other

factors. Ownership also has limited studies, showing

influence on invasiveness, control and user-centred attri-

butes. Even though the influence of ownership has yet to

be explored, again likely due to lack of ownership of

robots in the real world, it is interesting to note that all

the other factors have been found to influence sense of

ownership in some way.

While using the high-level groupings for factors and

their relationships in Fig. 1 helps more easily visualise the

state-of-the-art, much of the detail is lost. For this reason,

14 AI & Soc (2015) 30:1–21

123

we also include a more detailed matrix in Fig. 2, which

identifies specific relationships and the associated litera-

ture, categorised in terms of physical and social attributes.

Physical attributes concern the objective, tangible and

physical aspects of a robot/monitoring system, while the

social attributes are related to the application and interac-

tion with humans at a social level. For example, users may

be more interested in the functional aspects of the robot

(e.g. shape and things which influence physical task) than

aspects such as colour or contour which influence human-

likeness. Equally, a user may be more interested in the way

the robot behaves and talks, than what tasks it can carry out

and its physical form. Each highlighted co-ordinate/square

in the matrix represents a relationship which has either

been empirically tested or hypothesised in the literature.

Those squares which are highlighted in black represent a

relationship supported by evidence in the literature, with

the white number corresponding to a cell in Table 1.

Squares which contain the letter M are relationships which

are hypothesised or tested related to Moran and Nakata’s

(2010) work on monitoring technology. Those squares with

a ‘H’ have been hypothesised as a part of this research, and

those which are have a diagonal line or highlighted grey

represent relationships which are not logically possible.

The far left hand column of the matrix shows the physical

attributes, social attributes and user perceptions as identi-

fied in previous sections. Each is categorised into

humanoid robot aspects (HR, lighter colour), and data

collection aspects (DC, darker colour).

6 Contributions

The main contribution of this paper is in promoting dis-

cussion around anthropomorphic robots as monitoring

devices as a new thread of research. As a part of this, the

most salient attributes of a humanoid robot have been

identified, both purely in terms of robotics and also in

terms of monitoring systems which were identified through

a substantial literature review. Using this review, we con-

structed a matrix which allows us to easily visualise the

state of the art, which also helps us identify trends and

patterns for future directions for research.

7 Future work

Based on the discussions and ideas presented in this

paper, we propose a number of areas for future work.

For example, context is a critical consideration when

understanding behavioural change in robotics. A change

in context can significantly influence the perceptions of

users about a robot and its tracking abilities (Lee et al.

2011). Hence, one consideration for future research

R F

R P

E

R M

O B

R C

O N

R C

O V

R O

B

N O

R

R S

E

R P

E R

R B

E H

R IN

T

R A

D A

R A

U T

F O

D C

D I

U I

D T

A C

O N

D A

C C

D S

H A

P A

N T

P IN

T

P A

D A

P A

U T

P E

O E

P S

P

P R

B

P P

E R

P R

S E

P O

W N

P A

N X

P S

A F

P E

N J

P M

O B

A A

P N

B C

P S

B C

P F

B C

P P

I

P B

E N

P T

R U

P A

F F

P C

O V

P D

C

P R

C

Robot Form RF H H 1 H H 2 H 3 4 5 6 7 8 9 Robot Physical Expresion RPE 4131211101 H H H H

Robot Mobility RMOB H H 15 16 H Robot Control RCON M M 17 M

Robot Coverage RCOV M M Robot Obtrusion ROB 18 19 20 21 M

Number of Robots NOR MMMM Robot Social Expression RSE 22 H 23 H 24 25 26

Robot Personality RPER 27 H 28 29 30 Robot Behaviour RBEH 31 H 32

Robot Intelligence RINT H H Robot Adaptability RADA HH

Robot Autonomy RAUT H Frequency of Data Collection FODC M M

Data Integration DI M User Informedness UI M M 33 34

Data Types DT 6353 Application Control ACON M M M M 37 M

Data Access DACC M 38 M Data Sharing DSHA M

Percieved Anthropormorphism PANT 54443424140493 Percieved Intelligence PINT H

Percieved Adaptability PADA 847464 Percieved Autonomy PAUT H 49 H 50

Percieved Ease of Engagement PEOE H 51 Persieved Social Presence PSP 52 53 54 55 56

Perceived Robot Behaviour PRB 57 58 Percieved Personality PPER 59 HH 60 61 62

Percieved Robot Social Expression PRSE 4636 Perseived Ownership POWN 86766656

Percieved Anxiety PANX 69 70 Perceived Saftey PSAF

Perceived Likeability/Enjoyment PENJ Percieved Mobility PMOB 71 72 73

Application Assumptions AA 74 75 M M M Percieved Natural Border Crossings PNBC H 76 77 M 78 79 80

Percieved Social Border Crossings PSBC M M Percieved Frequency of Border Crossings PFBC M M

Percieved Privacy Invasion PPI M Perceived Benefit/Justification PBEN M 81 82 83

Percieved Trustwrothiness PTRU 84 85 Percieved Affordance PAFF M M M M

Percieved Coverage PCOV MMM Perceived Data Control PDC MMMMH

Perceived Robot Control PRC M M M 654321

F

set u

birtt A

lai c o

S s

n o it

pecre P

res U

P h

y si

ca l

A tt

ri b

u te

s H R

D C

H R

D C

H R

D C

A

B

C

D

E

snoitpecrePresUsetubirttAlaicoSsetubirttAlacisyhP

CDRHCDRHCDRH

Fig. 2 The PSA matrix displays the relationships and inter-relationships between system characteristics and user perceptions

AI & Soc (2015) 30:1–21 15

123

T a

b le

1 R

e se

a rc

h w

h ic

h c o

rr e sp

o n

d s

to th

e n

u m

b e r

c o

o rd

in a te

s in

th e

P S

A m

a tr

ix (F

ig .

2 )

N o

. R

e se

a rc

h li

te ra

tu re

N o

. R

e se

a rc

h li

te ra

tu re

N o

. R

e se

a rc

h li

te ra

tu re

N o

. R

e se

a rc

h li

te ra

tu re

1 .

B a rt

n e c k

(2 0

0 8

); B

e e r

e t

a l.

2 0

1 1

; D

iS a lv

o e t

a l.

(2 0

0 2

); H

e g

e l

e t

a l.

(2 0

0 9 );

P o

w e rs

a n

d K

ie sl

e r

(2 0

0 6

); S

a b

a n

o v

ic e t

a l.

(2 0

0 6 )

2 4

. N

o m

u ra

a n

d K

a n

d a

(2 0

0 3

) 4

7 .

H e e ri

n k

e t

a l.

(2 0

0 8

a )

7 0

H e e ri

n k

e t

a l.

(2 0

0 9

b ,

2 0

1 0

b )

2 .

W a lt

e rs

e t

a l.

(2 0

0 7

) 2

5 .

W a lt

e rs

e t

a l.

(2 0

0 8

b )

4 8

. H

e e ri

n k

e t

a l.

(2 0

0 9

b ,

2 0

1 0

b );

S y

rd a l

e t

a l.

(2 0

0 8

)

7 1

. S

y rd

a l

e t

a l.

(2 0

0 8

)

3 .

H ir

o i

a n

d It

o (2

0 0

8 );

K a n

d a

e t

a l.

(2 0

0 2

); N

o m

u ra

a n

d K

a n

d a

(2 0

0 3

); N

o m

u ra

e t

a l.

(2 0

0 7

)

2 6

. T

a m

a g

a w

a e t

a l.

(2 0

1 1 )

4 9

. D

e sa

i e t

a l.

(2 0

0 9 )

7 2

. S

e v

e ri

n so

n -E

k lu

n d

h e t

a l.

(2 0

0 3

); S

y rd

a l

e t

a l.

(2 0

0 8

)

4 .

B a rt

n e c k

e t

a l.

(2 0

0 8

); H

ir o

i a n

d It

o (2

0 0

8 )

2 7

. F

u ss

e ll

e t

a l.

(2 0

0 8 )

5 0

. D

e sa

i e t

a l.

(2 0

0 9 )

7 3

. S

e v

e ri

n so

n -E

k lu

n d

h e t

a l.

(2 0

0 3

)

5 .

B a rt

n e c k

(2 0

0 8

); L

i e t

a l.

(2 0

1 0

) 2

8 .

S e v

e ri

n so

n -E

k lu

n d

h e t

a l.

(2 0

0 3

) 5

1 .

L e it

e e t

a l.

(2 0

0 9

) 7

4 .

V a ll

e jo

e t

a l.

(2 0

0 8

)

6 .

D a u

te n

h a h

n (2

0 0

4 );

W a lt

e rs

e t

a l.

(2 0

0 7

) 2

9 .

M e e rb

e e k

e t

a l.

(2 0

0 8

); S

y rd

a l

e t

a l.

(2 0

0 6

) 5

2 .

H e e ri

n k

e t

a l.

( 2 0

1 0

a )

7 5

. D

e sa

i e t

a l.

(2 0

0 9

)

7 .

H ir

o i

a n

d It

o (2

0 0

8 );

K a n

d a

e t

a l.

(2 0

0 8 );

K id

d a n

d

B re

a z e a l

(2 0

0 4 );

W a lt

e rs

e t

a l.

(2 0

0 5

); Y

o u

n g

e t

a l.

(2 0

0 9 )

3 0

. M

e e rb

e e k

e t

a l.

(2 0

0 8

); S

y rd

a l

e t

a l.

(2 0

0 6

) 5

3 .

H e e ri

n k

e t

a l.

(2 0

0 8

b ,

2 0

0 9

a )

7 6

. B

a in

b ri

d g

e e t

a l.

(2 0

0 8

);

K id

d a n

d B

re a z e a l

(2 0

0 4 )

8 .

B a in

b ri

d g

e e t

a l.

(2 0

0 8

); T

a m

a g

a w

a e t

a l.

(2 0

1 1

) 3

1 .

B a rt

n e c k

e t

a l.

(2 0

0 9

a );

D iS

a lv

o e t

a l.

(2 0

0 2

); S

a b

a n

o v

ic

e t

a l.

(2 0

0 6

)

5 4

. H

e e ri

n k

e t

a l.

(2 0

0 9

b ,

2 0

1 0

b );

W a lt

e rs

e t

a l.

(2 0

0 5 )

7 7

. D

a u

te n

h a h

n e t

a l.

(2 0

0 6

)

9 .

D a u

te n

h a h

n (2

0 0

4 );

W a lt

e rs

e t

a l.

(2 0

0 7

) 3

2 .

G o

e tz

e t

a l.

(2 0

0 3

); L

o h

se (2

0 0

9 )a

5 5

. B

a in

b ri

d g

e e t

a l.

(2 0

0 8 )

7 8

. S

y rd

a l

e t

a l.

(2 0

0 8

)

1 0

. D

a u

te n

h a h

n (2

0 0

7 );

N a k

a u

c h

i a n

d S

im m

o n

s (2

0 0

2 )

3 3

. Z

w e ig

a n

d W

e b

st e r

(2 0

0 2

) 5

6 .

D e sa

i e t

a l.

(2 0

0 9 )

7 9

. B

o h

n e t

a l.

(2 0

0 7

); M

a n

c in

i

e t

a l.

(2 0

1 0

); M

a rx

(2 0

0 1

); P

u n

ie (2

0 0

3 )

1 1

. D

iS a lv

o e t

a l.

(2 0

0 2

); G

o e tz

e t

a l.

(2 0

0 3

);

S e v

e ri

n so

n -E

k lu

n d

h e t

a l.

(2 0

0 3

)

3 4

. D

e sa

i e t

a l.

(2 0

0 9

) 5

7 D

iS a lv

o e t

a l.

(2 0

0 2

) 8

0 .

Z w

e ig

(2 0

0 5

)

1 2

. B

a rt

n e c k

e t

a l.

(2 0

0 9

b )

3 5

. S

y rd

a l

e t

a l.

(2 0

0 7

b )

5 8

. F

u ss

e ll

e t

a l.

(2 0

0 8

) 8

1 .

M e le

n h

o rs

t e t

a l.

(2 0

0 4

);

S y

rd a l

e t

a l.

(2 0

0 7

b )

1 3

. B

a in

b ri

d g

e e t

a l.

(2 0

0 8

) 3

6 .

S y

rd a l

e t

a l.

(2 0

0 7

b )

5 9

. D

e sa

i e t

a l.

(2 0

0 9 );

S e v

e ri

n so

n -

E k

lu n

d h

e t

a l.

(2 0

0 3 )

8 2

. S

ta n

to n

(2 0

0 0

)

1 4

. S

e v

e ri

n so

n -E

k lu

n d

h e t

a l.

(2 0

0 3 )

3 7

. D

e sa

i e t

a l.

(2 0

0 9

) 6

0 .

M e e rb

e e k

e t

a l.

(2 0

0 6 )

8 3

. Z

w e ig

(2 0

0 5

)

1 5

. S

e v

e ri

n so

n -E

k lu

n d

h e t

a l.

(2 0

0 3 )

3 8

. V

a rg

a s

e t

a l.

(2 0

0 9 )

6 1

. M

e e rb

e e k

e t

a l.

(2 0

0 6 )

8 4

. Z

w e ig

(2 0

0 5

)

1 6

. D

a u

te n

h a h

n e t

a l.

(2 0

0 6 );

H ir

o i

a n

d It

o (2

0 0

8 );

N o

m u

ra a n

d K

a n

d a

(2 0

0 3

); N

o m

u ra

e t

a l.

(2 0

0 7

)

3 9

. W

a lt

e rs

e t

a l.

(2 0

0 9

b )

6 2

. M

e e rb

e e k

e t

a l.

(2 0

0 6 )

8 5

. M

e le

n h

o rs

t e t

a l.

(2 0

0 4

)

16 AI & Soc (2015) 30:1–21

123

exploring the effects of data collection on users is the

context within in which it takes place. Variations in the

types of contexts studied and explored can only be a

good thing. In relation to the context is the task of a

robot, where it might be able to support users, instruct

them or act autonomously. In fact, the design of a robot

and its use is predominately determined by its task

(Yanco and Drury 2004).

The majority of studies and research examined in this

paper have mainly explored the social aspects of robotics

in experimental conditions. There is a current drive

towards exploring the impact of technology ‘in the wild’,

and understanding how the technology actually influences

people in situ can help improve our understanding.

Researchers need to move beyond the laboratory and begin

to see the technology they develop directly in use; which

will likely reveal rich and unexpected interactions.

One key aspect to HRI which is clearly missing re-

longitudinal studies (Kanda et al. 2004; Walters et al.

2008b), which are important to get past the novelty effect

(Sung et al. 2009). It is important to understand how

longitudinal effects change over time, and this could be in

terms of experimental studies or in situ studies. The idea

that humanoid robots afford certain capabilities in terms of

monitoring characteristics is an understudied area. More

work is needed to understand what people think robots are

capable of perceiving and judging, and the benefits and

disadvantages that come with this. For example, consider

the affordances that derive from a robot with human eyes.

Interestingly, robots can be augmented with other systems

(such as smart homes and surveillance systems) which give

them abilities beyond what is afforded.

How do robots collect data and whom and what do they

share with? What about passersby, where there is a sense

of passive collection of personal data? Environment the

robots are in, what about that? There are many consider-

ations to made regarding robots as a monitoring system.

The existing factors were derived from a survey of the

robotics and monitoring literature, and the areas that they

intersect. This survey was consciously restricted to these

areas so as to not dilute. The list of influential factors is

unlikely to be exhaustive and is expected to change; hence,

one direction is to look to other relevant areas such as

interactions with autonomous and expert systems. It will

expand and develop as progress is made.

The final area is to understand and examine how, and if

progress is made in this area of interest. One proposition is

the development of an online repository along the lines of

the matrix outlined in this paper. This would allow

researchers to identify areas they might contribute towards

and to also keep track of where other contributions. A form

of evaluating the advancement of this area might then be to

observe progress within such a repository.T a

b le

1 c o

n ti

n u

e d

N o

. R

e se

a rc

h li

te ra

tu re

N o

. R

e se

a rc

h li

te ra

tu re

N o

. R

e se

a rc

h li

te ra

tu re

N o

. R

e se

a rc

h li

te ra

tu re

1 7

. H

ir o

i a n

d It

o (2

0 0

8 );

W a lt

e rs

e t

a l.

(2 0

0 9

a )

4 0

. S

c h

e rm

e rh

o rn

e t

a l.

(2 0

0 8

) 6

3 .

H e e ri

n k

e t

a l.

(2 0

0 8

b ,

2 0

0 9

b ,

2 0

1 0

b )

1 8

. D

a u

te n

h a h

n e t

a l.

(2 0

0 6 )

4 1

. G

o e tz

e t

a l.

(2 0

0 3

); M

e e rb

e e k

e t

a l.

(2 0

0 6

);

S c h

e rm

e rh

o rn

e t

a l.

(2 0

0 8

); S

e v

e ri

n so

n -E

k lu

n d

h e t

a l.

(2 0

0 3

); W

a lt

e rs

e t

a l.

(2 0

0 8

a )

6 4

H e e ri

n k

e t

a l.

(2 0

0 9

b ,

2 0

1 0

b )

1 9

. H

ir o

i a n

d It

o (2

0 0

8 );

K a n

d a

e t

a l.

(2 0

0 2

); S

y rd

a l

e t

a l.

(2 0

0 8 )

4 2

. A

u st

e rm

a n

n e t

a l.

(2 0

1 0

); B

a rt

n e c k

e t

a l.

(2 0

0 8

);

B a rt

n e c k

e t

a l.

(2 0

0 9

a );

D a u

te n

h a h

n (2

0 0

2 ,

2 0

0 4

);

G o

e tz

e t

a l.

(2 0

0 3

); W

a lt

e rs

e t

a l.

(2 0

0 7

)

6 5

. B

lo w

e t

a l.

(2 0

0 6

b )

2 0

. D

a u

te n

h a h

n (2

0 0

7 );

K o

a y

e t

a l.

(2 0

0 6

); P

a c c h

ie ro

tt i

e t

a l.

(2 0

0 6 )

4 3

. S

c h

e rm

e rh

o rn

e t

a l.

(2 0

0 8

); T

a m

a g

a w

a e t

a l.

(2 0

1 1 )

6 6

. B

lo w

e t

a l.

(2 0

0 6

b )

2 1

. K

id d

a n

d B

re a z e a l

(2 0

0 4

); Y

o u

n g

e t

a l.

(2 0

0 9

) 4

4 .

G o

e tz

e t

a l.

(2 0

0 3

); L

o h

se (2

0 0

9 )a

6 7

. B

lo w

e t

a l.

(2 0

0 6

b );

D a u

te n

h a h

n (2

0 0

7 )

2 2

. B

a rt

n e c k

e t

a l.

(2 0

0 9

a );

D iS

a lv

o e t

a l.

(2 0

0 2

),

S a b

a n

o v

ic e t

a l.

(2 0

0 6

)

4 5

. A

u st

e rm

a n

n e t

a l.

(2 0

1 0

) 6

8 .

B lo

w e t

a l.

(2 0

0 6

b );

D a u

te n

h a h

n (2

0 0

7 )

2 3

. K

im e t

a l.

(2 0

1 1

); W

o o

d s

e t

a l.

(2 0

0 5

b )

4 6

. S

y rd

a l

e t

a l.

(2 0

0 8

) 6

9 .

D a u

te n

h a h

n e t

a l.

(2 0

0 6 );

N o

m u

ra

e t

a l.

(2 0

0 7

)

AI & Soc (2015) 30:1–21 17

123

8 Conclusions

Humanoid robotics is a branch of robotics which explores

issues related to the development and user experience of

robots with a humanlike appearance and structure.

Research has been conducted which explores how the

characteristics of such a robot influence behaviour, but

remains disjointed, with insufficient research exploring the

monitoring aspects of the technology. The aim of this paper

was to identify the most salient behaviour influencing

factors related to humanoid robots and explore the issues of

robot as monitoring devices. The factors in the PSA-BI

model were used as a coding scheme during a literature

review, in order to demonstrate their relevance to robotics.

This paper successfully identified a series of the salient and

recurring behavioural factors related to humanoid robots

and behaviour and their inter-relationships. In addition, the

factors by Moran and Nakata proved highly relevant to

HRI. The PSA matrix was produced which is a represen-

tation of the research literature, highlighting areas of cur-

rent development and gaps in the literature, and

demonstrates the applicability of Moran and Nakata’s

factors.

Acknowledgments This work was supported by a Japanese Society for the Promotion of Science (JSPS) short-term fellowship and EP-

SRC Grant EP/I011587/1.

References

Austermann A, Yamada S, Funakoshi K, Nakano M (2010) Does the

appearance of a robot affect users’ ways of giving commands

and feedback? In: RO-MAN (ed) IEEE, 13–15 Sept 2010,

pp 234–239

Bainbridge WA, Hart J, Kim ES, Scassellati B (2008) The effect of

presence on human-robot interaction. In: Proceedings of the 17th

IEEE international symposium on robot and human interactive

communication (ROMAN). pp 701–706

Bartneck C (2008) Who like androids more: Japanese or US

Americans? In: Proceedings of the 17th IEEE international

symposium on robot and human interactive communication

(ROMAN). pp 553–557

Bartneck C, Kanda T, Ishiguro H, Hagita N (2007) Is the uncanny

valley an uncanny cliff? In: Proceedings of the 16th IEEE

international symposium on robot and human interactive com-

munication (ROMAN), 26–29 Aug 2007, pp 368–373

Bartneck C, Croft E, Kulic D (2008) Measuring the anthropomor-

phism, animacy, likeability, perceived intelligence and perceived

safety of robots. In: Proceedings of the metrics for human-robot

interaction workshop in affiliation with the 3rd ACM/IEEE

international conference on human-robot interaction (HRI 2008).

pp 37–44

Bartneck C, Kanda T, Ishiguro H, Hagita N (2009a) My robotic

doppelganger—a critical look at the Uncanny Valley. In:

Proceedings of the 18th IEEE international symposium on robot

and human interactive communication (ROMAN), 27 Sept

2009–2 Oct 2009, pp 269–276

Bartneck C, Kanda T, Mubin O, Al Mahmud A (2009b) Does the

design of a robot influence its animacy and perceived intelli-

gence? Int J Soc Robot 1(2):195–204

Beckwith R (2003) Designing for ubiquity: the perception of privacy. In:

Pervasive computing, IEEE vol 2, no 2, pp 40–46

Beer JM, Prakash A, Mitzner TL, Rogers WA (2011) Understanding

robot acceptance. Technical report HFA-TR-1103. Georgia

Institute of Technology. Human Factors and Aging Laboratory

Blow M, Dautenhahn K, Appleby A, Nehaniv CL, Lee D (2006a) The

art of designing robot faces: dimensions for human-robot

interaction. In: proceedings of the 1st ACM SIGCHI/SIGART

conference on human-robot interaction, Salt Lake City, Utah,

USA. ACM, pp 331–332

Blow M, Dautenhahn K, Appleby A, Nehaniv CL, Lee DC (2006b)

Perception of robot smiles and dimensions for human-robot

interaction design. In: proceedings of the 15th IEEE international

symposium on robot and human interactive communication

(ROMAN), 6–8 Sept 2006, pp 469–474

Bohn Ju, Langheinrich M, Mattern F, Rohs M (2007) Living in a

world of smart everyday objects—social, economic and ethical

implications. Hum Ecol Risk Assess 10(5):763–785

Broadbent E, MacDonald B, Jago L, Juergens M, Mazharullah O

(2007) Human reactions to good and bad robots. In: Proceedings

of IEEE/RSJ international conference on intelligent robots and

systems (IROS) 2007. 19 Oct 2007–2 Nov 2007. IEEE,

pp 3703–3708

Broadbent E, Stafford R, MacDonald B (2009) Acceptance of

healthcare robots for the older population: review and future

directions. Int J Soc Robot 1(4):319–330

Dautenhahn K (1999) Robots as social actors: aurora and the case of

autism. In: Proceedings of the third cognitive technology

conference, San Francisco. p 374

Dautenhahn K (2002) Design spaces and niche spaces of believable

social robots. In: Proceedings of the 11th IEEE international

workshop on robot and human interactive communication

(ROMAN). IEEE, pp 192–197

Dautenhahn K (2004) Robots we like to live with?! - a developmental

perspective on a personalized, life-long robot companion. In:

Proceedings of the 13th IEEE international workshop on robot

and human interactive communication (ROMAN). IEEE,

pp 17–22

Dautenhahn K (2007) Socially intelligent robots: dimensions of

human-robot interaction. Philos Trans Roy Soc B: Biol Sci

362(1480):679–704

Dautenhahn K, Woods S, Kaouri C, Walters ML, Kheng Lee K,

Werry I (2005) What is a robot companion—friend, assistant or

butler? In: Proceedings of the IEEE/RSJ international conference

on intelligent robots and systems (IROS) 2–6 Aug 2005. IEEE/

RSJ, pp 1192–1197

Dautenhahn K, Walters M, Woods S, Koay KL, Nehaniv CL, Sisbot

A, Alami R, Simon T (2006) How may I serve you?: a robot

companion approaching a seated person in a helping context. In:

Proceedings of the 1st ACM SIGCHI/SIGART conference on

human-robot interaction, Salt Lake City, Utah, USA. ACM,

pp 172–179

Desai M, Stubbs K, Steinfeld A, Yanco H (2009) Creating trustworthy

robots: lessons and inspirations from automated systems. Paper

presented at the artificial intelligence and simulation of behav-

iour convention: New Frontiers in Human-Robot Interaction

(AISB)

DiSalvo CF, Gemperle F, Forlizzi J, Kiesler S (2002) All robots are

not created equal: the design and perception of humanoid robot

heads. In: Proceedings of the 4th symposium on designing

interactive systems: processes, practices, methods, and tech-

niques, London, England. ACM, pp 321–326

18 AI & Soc (2015) 30:1–21

123

Dragone M, Holz T, Sassu A, O’Hare GMP (2010) Evaluating social

& ubiquitous human-robot interaction. In: Proceedings of the 7th

international conference on ubiquitous robots and ambient

intelligence (URAI 2010), Busan, Korea

Drury JL, Scholtz J, Yanco HA (2003) Awareness in human-robot

interactions. In: Proceedings of the IEEE international confer-

ence on systems, man and cybernetics. IEEE, pp 912–918

Dryer DC, Eisbach C, Ark WS (1999) At what cost pervasive? A

social computing view of mobile computing systems. IBM Syst J

38(4):652–676

Enz S, Diruf M, Spielhagen C, Zoll C, Vargas P (2011) The social

role of robots in the future—explorative measurement of hopes

and fears. Int J Soc Robot 3(3):263–271

Fong T, Nourbakhsh I, Dautenhahn K (2003) A survey of socially

interactive robots. Robot Auton Syst 42:143–166

Fussell SR, Kiesler S, Setlock LD, Yew V (2008) How people

anthropomorphize robots. In: Proceedings of the 3rd ACM/IEEE

international conference on human robot interaction, Amster-

dam, The Netherlands. ACM, pp 145–152

Gibson JJ (1977) The theory of affordances. In: Shaw R, Bransford J

(eds) Perceiving, acting, and knowing. ISBN 0-470-99014-7

Glas DF, Kanda T, Ishiguro H, Hagita N (2009) Simultaneous people

tracking and localization for social robots using external laser

range finders. In: Proceedings of the 2009 IEEE/RSJ interna-

tional conference on intelligent robots and systems (IROS), St.

Louis, MO, USA. IEEE Press, pp 846–853

Goetz J, Kiesler S, Powers A (2003) Matching robot appearance and

behavior to tasks to improve human-robot cooperation. In:

Proceedings of the 12th IEEE international workshop on robot

and human interactive communication (ROMAN), 31 Oct–2 Nov

2003, pp 55–60

Heerink M, Kröse B, Evers V, Wielinga B (2006) The influence of a

robot’s social abilities on acceptance by elderly users. In:

Proceedings of the 15th IEEE international symposium on

robot and human interactive communication (ROMAN).

pp 521–526

Heerink M, Kröse B, Evers V, Wielinga B (2008a) The influence of

perceived adaptiveness of a social agent on acceptance by

elderly users. In: Proceedings of the 6th international conference

of the international society for gerontechnology (ISG). pp 57–61

Heerink M, Kröse B, Wielinga BJ, Evers V (2008b) The influence of

social presence on acceptance of a companion robot by older

people. J Phys Agents 2(2):33–40

Heerink M, Kröse B, Evers V, Wielinga B (2009a) Influence of social

presence on acceptance of an assistive social robot and screen

agent by elderly users. Adv Robot 23(14):1909–1923

Heerink M, Kröse B, Evers V, Wielinga B (2009b) Measuring

acceptance of an assistive social robot: a suggested toolkit. In:

Proceedings of the 18th IEEE international symposium on robot

and human interactive communication (ROMAN), 27 Sept–2

Oct 2009, pp 528–533

Heerink M, Kröse B, Evers V, Wielinga B (2010a) Assessing

acceptance of assistive social agent technology by older adults:

the almere model. Int J Soc Robot 2(4):361–375

Heerink M, Kröse B, Evers V, Wielinga B (2010b) Relating

conversational expressiveness to social presence and acceptance

of an assistive social robot. Virtual Real 14(1):77–84

Hegel F, Lohse M, Wrede B (2009) Effects of visual appearance on

the attribution of applications in social robotics. In: Proceedings

of The 18th IEEE international symposium on robot and human

interactive communication (ROMAN), 27 Sept–2 Oct 2009,

pp 64–71

Hiroi Y, Ito A (2008) Are bigger robots scary? The relationship

between robot size and psychological threat. In: Proceedings of

the IEEE/ASME international conference on advanced intelli-

gent mechatronics, 2–5 July 2008. IEEE, pp 546–551

Jonsson K (2006) The embedded panopticon: visibility issues of

remote diagnostics surveillance. Scand J Inform Syst 18(2):7–28

Kahn PH, Ishiguro H, Friedman B, Kanda T (2006) What is a

Human? - toward psychological benchmarks in the field of

human-robot interaction. In: Proceedings of the 15th IEEE

international symposium on robot and human interactive com-

munication (ROMAN). pp 364–371

Kanda T, Ishiguro H, Ono T, Imai M, Nakatsu R (2002) Development

and evaluation of an interactive humanoid robot ‘‘Robovie’’. In:

Proceedings of the IEEE international conference on robotics

and automation (ICRA). IEEE, pp 1848–1855

Kanda T, Hirano T, Eaton D, Ishiguro H (2004) Interactive robots as

social partners and peer tutors for children: a field trial. Hum

Comput Interact 19(1):61–84

Kanda T, Miyashita T, Osada T, Haikawa Y, Ishiguro H (2008)

Analysis of humanoid appearances in human–robot interaction.

IEEE Trans Robot 24(3):725–735

Kidd CD, Breazeal C (2004) Effect of a robot on user perceptions. In:

Proceedings of the international conference on intelligent robots

and systems (IROS). IEEE, pp 3559–3564

Kidd CD, Breazeal C (2005) Sociable robot systems for real-world

problems. In: Proceedings of the IEEE international workshop

on robot and human interactive communication (ROMAN),

13–15 Aug 2005. pp 353–358

Kim Y, Kwak S, Kim M-s (2011) The impact of robots language form on

people’s perception of robots In: Kurosu M (ed) Human centered

design, vol 6776. Lecture Notes in Computer Science. Springer,

Berlin/Heidelberg, pp 253–261

Klamer T, Ben Allouch S (2010) Acceptance and use of a social robot

by elderly users in a domestic environment. In: Proceedings of

the 4th international conference on pervasive computing tech-

nologies for healthcare (PervasiveHealth), 22–25 March 2010.

IEEE, pp 1–8

Koay KL, Dautenhahn K, Woods SN, Walters ML (2006) Empirical results from using a comfort level device in human-robot

interaction studies. In: Proceedings of the 1st ACM SIGCHI/

SIGART conference on human-robot interaction, Salt Lake City,

Utah, USA. ACM, pp 194–201

Koide Y, Kanda T, Sumi Y, Kogure K, Ishiguro H (2004) An

approach to integrating an interactive guide robot with ubiqui-

tous sensors. In: Proceedings of IEEE/RSJ international confer-

ence on intelligent robots and systems (IROS), 28 Sept–2 Oct

2004. pp 2500–2505

Kuo IH, Rabindran JM, Broadbent E, Lee YI, Kerse N, Stafford

RMQ, MacDonald BA (2009) Age and gender factors in user

acceptance of healthcare robots. In: Proceedings of the 18th

IEEE international symposium on robot and human interactive

communication (ROMAN), 27 Sept–Oct 2 2009. pp 214–219

Larson JR, Callahan C (1990) Performance monitoring: how it affects

work productivity. J Appl Psychol 75(5):530–538

Lee E-J (2010) The more humanlike, the better? How speech type and

users’ cognitive style affect social responses to computers.

Comput Hum Behav 26(4):665–672

Lee KM, Nass C (2003) Designing social presence of social actors in

human computer interaction. In: Proceedings of the SIGCHI

conference on human factors in computing systems (CHI), Ft.

Lauderdale, Florida, USA. ACM 289–296

Lee MK, Tang KP, Forlizzi J, Kiesler S (2011) Understanding users’

perception of privacy in human-robot interaction. In: Proceed-

ings of the 6th international conference on human-robot

interaction, Lausanne, Switzerland. IEEE, pp 181–182

Leite I, Martinho C, Pereira A, Paiva A (2009) As time goes by: long-

term evaluation of social presence in robotic companions. In:

Proceedings of the 18th IEEE international symposium on robot

and human interactive communication (ROMAN), 27 Sept–2

Oct 2009. pp 669–674

AI & Soc (2015) 30:1–21 19

123

Li D, Rau P, Li Y (2010) A cross-cultural study: effect of robot

appearance and task. Int J Soc Robot 2(2):175–186

Lohse M (2009) The role of expectations in HRI. In: Proceedings of

new frontiers in human-robot interaction

Looije R, Cnossen F, Neerinex MA (2006) Incorporating guidelines

for health assistance into a socially intelligent robot. In:

Proceedings of the 15th IEEE international symposium on robot

and human interactive communication (ROMAN), 6–8 Sept

2006. IEEE, pp 515–520

Lyytinen K, Yoo Y, Varshney U, Ackrman MS, Davis G, Avital M,

Robey D, Sawyer S, Sorenson C (2004) Surfing the next wave:

design and implementation challenges of ubiquitous computing

environments. Commun Assoc Inform Syst 13:697–716

Mancini C, Jedrzejczyk L, Thomas K, Price BA, Bandara AK, Rogers

Y, Joinson AN, Nuseibeh B (2010) Predators and prey:

ubiquitous tracking, privacy and the social contract, vol 13.

Department of Computing Faculty of Mathematics, Computing

and Technology The Open University, Milton Keynes

Marx GT (2001) Murky conceptual waters: the public and the private.

Ethics Inf Technol 3(3):157–169

Meerbeek B, Hoonhout J, Bingley P, Terken J (2006) Investigating

the relationship between the personality of a robotic TV assistant

and the level of user control. In: Proceedings of the 15th IEEE

international symposium on robot and human interactive com-

munication (ROMAN). IEEE, pp 404–410

Meerbeek B, Hoonhout J, Bingley P, Terken J (2008) The influence of

robot personality on perceived and preferred level of user

control. In: Dautenhahn K (ed) Human and robot interactive

communication, pp 204–229

Melenhorst AS, Fisk AD, Mynatt ED, Rogers WA (2004) Potential

intrusiveness of aware home technology: perceptions of older

adults. In: Proceedings of the human factors and ergonomics society

annual meeting, New Orleans, Louisiana, USA, 20–24 Sept 2004.

SAGE Publications, pp 266–270

Michalowski MP, Sabanovic S, Simmons R (2006) A spatial model of

engagement for a social robot. In: Proceedings of the 9th IEEE

international advanced motion control. IEEE, pp 762–767

Minato T, Shimada M, Ishiguro H, Itakura S (2004) Development of an

android robot for studying human-robot interaction. In: Proceedings

of the 17th international conference on Innovations in applied

artificial intelligence, Ottawa, Canada. Springer, pp 424–434

Moran S, Nakata K (2010) Analysing the factors affecting users in

intelligent pervasive spaces. In: Intelligent Buildings Interna-

tional: Special Issue on Intelligent Pervasive Spaces for Working

and Living, vol 2, no 1. pp 57–71

Mori M (1970) Bukimi no tani [the uncanny valley] (Originally in

Japanese, K. F. MacDorman & T. Minato, Trans.). Energy

7(4):33–35

Nakauchi Y, Simmons R (2002) A social robot that stands in line.

Auton Robots 12(3):313–324

Nguyen DH, Mynatt ED (2002) Privacy mirrors: understanding and

shaping socio-technical ubiquitous computing systems. Techni-

cal report GIT-GVU-02-16. Georgia Institute of Technology

Nguyen DH, Kobsa A, Hayes GR (2008) An empirical investigation

of concerns of everyday tracking and recording technologies. In:

Proceedings of the 10th international conference on ubiquitous

computing, Seoul, Korea. ACM, pp 182–191

Nohara K, Tajika T, Shiomi M, Kanda T, Ishiguro H, Hagita N (2008)

Integrating passive RFID tag and person tracking for social

interaction in daily life. In: Proceedings of the 17th IEEE

international symposium on robot and human interactive com-

munication (ROMAN), 1–3 Aug 2008. pp 545–552

Nomura T, Kanda T (2003) On proposing the concept of robot anxiety

and considering measurement of it. In: Proceedings of the 12th

IEEE international workshop on robot and human interactive

communication (ROMAN), 31 Oct–2 Nov 2003. pp 373–378

Nomura T, Kanda T, Suzuki T, Kato K (2005) People’s assumptions

about robots: investigation of their relationships with attitudes

and emotions toward robots. In: Proceedings of the IEEE

international workshop on robot and human interactive commu-

nication (ROMAN). pp 125–130

Nomura T, Kanda T, Suzuki T (2006) Experimental investigation into

influence of negative attitudes toward robots on human robot

interaction. AI Soc 20(2):138–150

Nomura T, Shintani T, Fujii K, Hokabe K (2007) Experimental

investigation of relationships between anxiety, negative atti-

tudes, and allowable distance of robots. In: Proceedings of the

2nd IASTED international conference on human computer

interaction, Chamonix, France. ACTA Press, pp 13–18

Nomura T, Kanda T, Suzuki T, Kato K (2008) Prediction of human

behavior in human–robot interaction using psychological scales

for anxiety and negative attitudes toward robots. IEEE Trans

Robot 24(2):442–451

Norman DA (1988) The psychology of everyday things. Basic Books,

New York

Pacchierotti E, Christensen HI, Jensfelt P (2006) Evaluation of

passing distance for social robots. In: Proceedings of the 15th

IEEE international symposium on robot and human interactive

communication, 6–8 Sept 2006. IEEE, pp 315–320

Powers A, Kiesler S (2006) The advisor robot: tracing people’s

mental model from a robot’s physical attributes. In: Proceedings

of the 1st ACM SIGCHI/SIGART conference on human-robot

interaction, Salt Lake City, Utah, USA. ACM, pp 218–225

Powers A, Kramer ADI, Lim S, Kuo J, Sau-lai L, Kiesler S (2005)

Eliciting information from people with a gendered humanoid

robot. In: Proceedings of the IEEE international workshop on

robot and human interactive communication (ROMAN), 13–15

Aug 2005. pp 158–163

Punie Y (2003) A social and technological view of ambient intelligence

in everyday life: what bends the trend? Key deliverable work

package 2, in technical report to the European Media, Technology

and everyday life research network, (EMTEL2). Institute for

Prospective Technological Studies, Seville, Spain

Riek LD, Rabinowitch T-C, Chakrabarti B, Robinson P (2009) How

anthropomorphism affects empathy toward robots. In: Proceed-

ings of the 4th ACM/IEEE international conference on human

robot interaction, La Jolla, California, USA. ACM, pp 245–246

Rosenthal R, Jacobson L (1968) Pygmalion in the classroom: teacher

expectation and pupils’ intellectual development. Irvington

publishers, New York

Sabanovic S, Michalowski MP, Simmons R (2006) Robots in the

wild: observing human-robot social interaction outside the lab.

Paper presented at the 9th IEEE international workshop on

advanced motion control. IEEE, pp 596–601

Salvini P, Laschi C, Dario P (2010) Design for acceptability:

improving robots’ coexistence in human society. Int J Soc Robot

2(4):451–460

Schermerhorn P, Scheutz M, Crowell CR (2008) Robot social

presence and gender: do females view robots differently than

males? In: Proceedings of the 3rd ACM/IEEE international

conference on human robot interaction, Amsterdam, The Neth-

erlands. ACM, pp 263–270

Scholtz J, Consolvo S (2004) Toward a framework for evaluating

ubiquitous computing applications. IEEE Pervasive Comput

3(2):82–88

Severinson-Eklundh K, Green A, Hüttenrauch H (2003) Social and

collaborative aspects of interaction with a service robot. Robot Auton

Syst 42(3–4):223–234

Siegel M, Breazeal C, Norton MI (2009) Persuasive robotics: the

influence of robot gender on human behavior. In: Proceedings of

IEEE/RSJ international conference on intelligent robots and

systems, St. Louis, MO. pp 2563–2568

20 AI & Soc (2015) 30:1–21

123

Spiekermann S (2008) User control in ubiquitous computing: design

alternatives and user acceptance. Shaker, Aachen

Stanton JM (2000) Reactions to employee performance monitoring:

framework, review and research directions. Hum Perform

13(1):85–113

Sung J, Christensen HI, Grinter RE (2009) Robots in the wild:

understanding long-term use. In: Proceedings of the 4th ACM/

IEEE international conference on human robot interaction, La

Jolla, California, USA. ACM, pp 45–52

Syrdal DS, Dautenhahn K, Woods S, Walters ML, Kheng Lee K

(2006) ‘Doing the right thing wrong’—personality and tolerance

to uncomfortable robot approaches. In: Proceedings of the 15th

IEEE international symposium on robot and human interactive

communication (ROMAN), 6–8 Sept 2006, pp 183–188

Syrdal DS, Dautenhahn K, Woods S, Walters M, Koay KL (2007a)

Looking good? Appearance preferences and robot personality

inferences at zero acquaintance. In: Proceedings of the AAAI

spring symposium on multidisciplinary collaboration for socially

assistive robotics

Syrdal DS, Walters ML, Otero N, Koay KL, Dautenhahn K (2007b)

‘‘He knows when you are sleeping’’—Privacy and the personal

robot companion. In: Proceedings of the workshop on human

implications of human-robot interaction, in conjunction with the

association of the advancement of aritificial intelligence, Van-

couver, British Columbia, Canada. AAAI Press, pp 28–33

Syrdal DS, Dautenhahn K, Walters ML, Koay KL (2008) Spaces with

robots in a home scenario—anthropomorphic attributions and

their effects on proxemic expectations and evaluations in a live

HRI trial. In: Proceedings of the AAAI fall symposium on AI in

Eldercare: New Solutiosn to old Problems, 7–9 Nov 2008

Takayama L, Pantofaru C (2009) Influences on proxemic behaviors in

human-robot interaction. In: Proceedings of the 2009 IEEE/RSJ

international conference on intelligent robots and systems

(IROS), St. Louis, MO, USA. IEEE Press, pp 5495–5502

Tamagawa R, Watson C, Kuo I, MacDonald B, Broadbent E (2011)

The effects of synthesized voice accents on user perceptions of

robots. Int J Soc Robot 3(3):253–262

Theofanos M, Scholtz J (2005) A framework for evaluation of

ubicomp applications. In: Proceedings of the first international

workshop on social implications of Ubiquitous computing, CHI,

Portland, OR, USA. pp 1–5

Torrey C, Powers A, Marge M, Fussell SR, Kiesler S (2006) Effects

of adaptive robot dialogue on information exchange and social

relations. In: Proceedings of the 1st ACM SIGCHI/SIGART

conference on human-robot interaction, Salt Lake City, Utah,

USA. ACM, 126–133

Vallejo ILD, Hailes S, Conroy-Dalton R, Penn A (2008) Location

tracking in an office environment: the nationwide case study. In:

Yan L, Zhang Y, Yang LT, Zhang HN (eds) The internet of

things: from RFID to the next-generation pervasive networked

system. Auerbach Publications, pp 233–255

Vargas PA, Ho WC, Lim M, Enz S, Aylett R (2009) Forget or not to

forget: towards a roboethical memory control. In: Proceedings of

the AISB, Killer robots or friendly fridges: the social under-

standing of artificial intelligence, Endinburgh, UK. pp 18–23

Velonaki M (2010) Engagement, trust, intimacy: touch sensing for

human-robot interaction. Second Nat Int J Creative Media

2(1):102

Walters M, Dautenhahn K, Koay K, Kaouri C, Woods S, Nehaniv C,

Lee D, Werry I, Te Boekhorst R (2005) The influence of

subjects’ personality traits on personal spatial zones in a human-

robot interaction experiment. In: Proceedings of the IEEE

international workshop on robot and human interactive commu-

nication (ROMAN). pp 347–352

Walters ML, Dautenhahn K, Te Boekhorst R, Koay KL, Woods SN

(2007) Exploring the design space of robot appearance and

behavior in an attention-seeking ‘living room’ scenario for a

robot companion. In: Proceedings of the IEEE symposium on

artificial life (ALIFE), 1–5 April 2007, pp 341–347

Walters M, Syrdal D, Dautenhahn K, te Boekhorst R, Koay K (2008a)

Avoiding the uncanny valley: robot appearance, personality and

consistency of behavior in an attention-seeking home scenario

for a robot companion. Auton Robots 24(2):159–178

Walters ML, Syrdal DS, Koay KL, Dautenhahn K, te Boekhorst R

(2008b) Human approach distances to a mechanical-looking

robot with different robot voice styles. In: Proceedings of the

17th IEEE international symposium on robot and human

Interactive communication (ROMAN), 1–3 Aug 2008. IEEE,

pp 707–712

Walters ML, Dautenhahn K, Boekhorst RT, Koay KL, Syrdal DS,

Nehaniv CL (2009a) An empirical framework for human-robot

proxemics. In: Proceedings of the new frontiers in human-robot

interaction, Edinburgh. pp 144–149

Walters ML, Koay KL, Syrdal DS, Dautenhahn K, te Boekhorst R

(2009b) Preferences and perceptions of robot appearance and

embodiment in human-robot interaction trials. In: Proceedings of

new frontiers in human-robot interaction, Edinburgh, Scotland

Weiss A, Bernhaupt R, Tscheligi M, Yoshida E (2009) Addressing

user experience and societal impact in a user study with a

humanoid robot. In: Proceedings of the symposium on new

frontiers in human-robot interaction, 8–9 Apr 2009. pp 150–157

Wickstrom G, Bendix T (2000) The ‘‘Hawthorne effect’’—what did

the original Hawthorne studies actually show? Scand J Work

Environ Health 26(4):363–367

Woods S, Dautenhahn K, Kaouri C (2005a) Is someone watching me?

- Consideration of social facilitation effects in human-robot

interaction Experiments. In: Proceedings of the IEEE interna-

tional symposium on computational intelligence in robotics and

automation (CIRA). pp 53–60

Woods S, Dautenhahn K, Schulz J (2005b) The design space of

robots: investigating children’s views. In: Proceedings of the

13th IEEE international workshop on robot and human interac-

tive communication (ROMAN). pp 47–52

Yanco HA, Drury J (2004) Classifying human-robot interaction: an

updated taxonomy. In: Proceedings of the IEEE international

conference on systems, man and cybernetics. pp 2841–2846

Young J, Hawkins R, Sharlin E, Igarashi T (2009) Toward acceptable

domestic robots: applying insights from social psychology. Int J

Soc Robot 1(1):95–108

Zhang T, Kaber D, Zhu B, Swangnetr M, Mosaly P, Hodge L (2010)

Service robot feature design effects on user perceptions and

emotional responses. Intel Serv Robot 3(2):73–88

Zia-ul-Haque QSM, Wang Z, Jadoon NR (2007) Importance of appear-

ance, behaviour and personal features in social robots. Is there really

any uncanny valley? Lect Notes Eng Comput Sci 1:524–529

Zweig D (2005) Beyond privacy and fairness concerns: examining

psychological boundary violations as a consequence of elec-

tronic performance monitoring. In: Weckert J (ed) Electronic

monitoring in the workplace: controversies and solutions. Idea

Group Publishing, Hershey, pp 101–122

Zweig D, Webster J (2002) Where is the line between benign and

invasive? An examination of psychological barriers to the

acceptance of awareness monitoring systems. J Organ Behav

23(5):605–633

Zweig D, Webster J (2003) Personality as a moderator of monitoring

acceptance. Comput Hum Behav 19(4):479–493

AI & Soc (2015) 30:1–21 21

123

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

  • c.146_2013_Article_515.pdf
    • User perceptions of anthropomorphic robots as monitoring devices
      • Abstract
      • Introduction
      • Background
        • Anthropomorphic robots
        • Data collection
      • Monitoring attributes
        • Privacy and invasiveness
          • Border crossings
          • Frequency of data collection and border crossings
          • Robot obtrusion (physical presence)
          • Perceived privacy invasion
          • Coverage and data integration
        • Control
          • Robot control
          • Data and application control
        • User understanding
          • Informedness and assumptions
          • Affordance
        • Ownership/trust
          • Perceived ownership
          • Perceived trustworthiness
      • Anthropomorphic attributes
        • Intelligence, autonomy and adaptability
          • Intelligence
          • Autonomy
          • Adaptability
        • Anthropomorphism
          • Anthropomorphic form
          • Personality
          • Robot expression
          • Social presence
          • Mobility
          • Behaviour
        • User-centred
          • Enjoyment
          • Ease of engagement
          • Anxiety
          • Safety
      • Perceptions of system attributes matrix
      • Contributions
      • Future work
      • Conclusions
      • Acknowledgments
      • References

Sources/USER'S ADOPTION OF FREE THIRD-PARTY SECURITY APPS.pdf

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

USER'S ADOPTION OF FREE THIRD-PARTY SECURITY APPS Han, Bo;Wu, Yu "Andy";Windsor, John The Journal of Computer Information Systems; Spring 2014; 54, 3; Computing Database pg. 77

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Sources/VIABILITY OF FEE-BASED EMAIL SERVICE FOR RETAIL CUSTOMERS.pdf

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

VIABILITY OF FEE-BASED EMAIL SERVICE FOR RETAIL CUSTOMERS Ghosh, Kaushik;Dhumal, Parag;Chawla, Sudhir The Journal of Computer Information Systems; Fall 2011; 52, 1; Computing Database pg. 56

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.