Implementation and evaluation of a secure device pairing protocol

Abstract

In a world full of mobile and smart devices, enabled to communicate with each other over wireless channels, secure pairing of two devices is of prime importance. The main threat is the so-called Man-in-the-Middle (MitM) attack, where an attacker inserts itself into the pairing protocol and impersonates one of the legitimate parties. Different methods have been proposed, which do not rely on a common security infrastructure, but exploit auxiliary channels instead, and typically involve the user in the pairing process. The most common and minimal interface available on a wide variety of devices is a single button. BEDA (Button-Enabled Device Association), a protocol suite for secure pairing of devices with minimal user interfaces, can accommodate pairing scenarios where one (or even both) devices only have a single button as their “user interface”. This thesis provides an implementation of different button based auxiliary channels, as well as demo applications for mobile phones (J2ME) and desktop computers (J2SE). Additionally, these channels are evaluated with respect to ease-of-use in a comparative user study.