83
BackDoor: Sensing Out-of-band Sounds through Channel Nonlinearity Nirupam Roy ECE-420 Guest Lecture - 30 th October 2017 University of Illinois at Urbana-Champaign
| Date post: | 06-May-2018 |
| Category: |
Documents |
| Upload: | truongkhuong |
| View: | 218 times |
| Download: | 4 times |
BackDoor: Sensing Out-of-band Sounds through Channel Nonlinearity
Nirupam Roy
ECE-420 Guest Lecture - 30th October 2017 University of Illinois at Urbana-Champaign
Microphones are everywhere
Microphones are everywhere
Speaker
Audible sound
Microphones record audible sounds
I hear that
I record that
Inaudible, but recordable !
Speaker
Inaudible, but recordable !
Speaker
I can’t hear that
I record that
Speaker
Works with unmodified devices
Camera Smartwatch
Laptop Hearing Aid
Near-ultrasound
It’s not “near-ultrasound”
50k40k10k
Amplitu
de
Frequency20k 30k
chirp.io
lisnr.com
ApneaApp MobiSys’15
AAMouse MobiSys’15
Spartacus MobiSys’13
DopLink UbiComp’13 AirLink
UbiComp’14
Pseudo-ranging SenSys’12
Crowd-counting SenSys’12
SoundWave CHI’12
Microphone hardware
Exploiting fundamental nonlinearity
50k40k10k
Amplitu
de
20k 30k Frequency
What can we do with it?
Opportunities: Acoustic jammer
Application: Acoustic communication
Jamming hearing aids
Threat: Acoustic DOS attack
Jamming hearing aids
Threat: Acoustic DOS attack
Blocking 911 calls
Threats: Inaudible voice attack
Talk outline
Microphone Overview 1
System Design 2
Challenges 3
Evaluation 4
Talk outline
Microphone Overview 1
System Design 2
Challenges 3
Evaluation 4
Microphone working principle
Amplifier Filter ADCDiaphragm
Microphone working principle
Diaphragm Amplifier Filter ADC
Microphone working principle
Amplifier Filter ADC
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Diaphragm
Microphone working principle
Amplifier Filter ADC
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Diaphragm
Microphone working principle
Amplifier Filter ADC
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Diaphragm
Microphone working principle
Amplifier Filter ADC
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Diaphragm
Microphone working principle
Amplifier Filter ADC
Microphonefilter
Diaphragm
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Amplitu
de
Diaphragm
Microphone working principle
Amplifier Filter ADC
Microphonefilter
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphone working principle
Input
Out
put
Vin
Vout
Vout = a1Vin
Input Out
put
Vout = a1Vin+ a2Vin2+ a3Vin
3+…
Amplifier
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphone working principle
Input
Out
put
Vin
Vout
Vout = a1Vin 10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
Input Out
put
Vout = a1Vin+ a2Vin2
Amplifier
Microphone working principle
Input
Out
put
Vin
Vout
Vout = a1Vin 10k
Frequency20k 30k 40k 50k 60k 70k 80k 90k 100k
Input Out
put
Amplifier
Vout = a1Vin+ a2Vin2
Talk outline
Microphone Overview 1
System Design 2
Challenges 3
Evaluation 4
Exploiting amplifier non-linearity Am
plitu
de
Microphonefilter
F1= 50kHz F2= 40kHz
F1 F2
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Vout = a1Vin+ a2Vin2
Exploiting amplifier non-linearity Am
plitu
de
Microphonefilter
F1= 50kHz F2= 40kHz
( sin F1 + sin F2 )2 = cos 2F1 + cos 2F2 + cos (F1+F2) + cos (F1- F2)
F1 F2
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Vout = a1Vin+ a2Vin2
Exploiting amplifier non-linearity Am
plitu
de
Microphonefilter
F1= 50kHz F2= 40kHz
F1 F2
( sin F1 + sin F2 )2 = cos 2F1 + cos 2F2 + cos (F1+F2) + cos (F1- F2)
2F2 (F1+F2) 2F1
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
2F2 (F1+F2) 2F1
Vout = a1Vin+ a2Vin2
Exploiting amplifier non-linearity Am
plitu
de
F1 F2
( sin F1 + sin F2 )2 = cos 2F1 + cos 2F2 + cos (F1+F2) + cos (F1- F2)
F1= 50kHz F2= 40kHz
Microphonefilter
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
2F2 (F1+F2) 2F1
Vout = a1Vin+ a2Vin2
Exploiting amplifier non-linearity Am
plitu
de
F1 F2
( sin F1 + sin F2 )2 = cos 2F1 + cos 2F2 + cos (F1+F2) + cos (F1- F2)
F1= 50kHz F2= 40kHz
Microphonefilter
(F1-F2)
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Exploiting amplifier non-linearity Am
plitu
de
F1 F2
F1= 50kHz F2= 40kHz
Microphonefilter
10kFrequency
20k 30k 40k 50k 60k 70k 80k 100k90k
(F1-F2)
Exploiting amplifier non-linearity Am
plitu
de
F1 F2
F1= 50kHz F2= 40kHz
Microphonefilter
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
(F1-F2)
Talk outline
Microphone Overview 1
System Design 2
Challenges 3
Evaluation 4
Challenges F1 F2
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
F1 F2 2F2 F1+F2 2F1 F1-F2
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphone’s nonlinearity
Speaker’s nonlinearity
Challenges
F1
F2 2F2 F1+F2 2F1 F1-F2
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Amplitu
de
F1 F2 2F2 F1+F2 2F1 F1-F2
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphone’s nonlinearity
Speaker’s nonlinearity
Challenges
Amplitu
de
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
F1 F2 2F2 F1+F2 2F1 F1-F2
Amplitu
de
F1 F2 2F2 F1+F2 2F1 F1-F2
10kFrequency
20k 30k 40k 50k 60k 70k 80k 90k 100k
Microphone’s nonlinearity
Challenges
Ultrasonic speaker
Amplitude modulation
Challenges
Ultrasonic speaker
Frequencymodulation
• Signal self-demodulation
• Piezoelectric ringing effect
• Carrier intermixing
• Spectrum inversion
• Carrier power allocation
Challenges
Talk outline
Microphone Overview 1
System Design 2
Challenges 3
Evaluation 4
Threats: Inaudible voice attack
Live Demo: Attacking Amazon Echo though inaudible sound
Hardware generalizability
40 kHz
50 kHz
Hearing Aid
Camera iPhone Android phone
Smartwatch Laptop
Hearingaids
Camera
iPho
ne
Androidph
one
Smart-watch
Laptop
BackDo
orSignal(dB
)
Devices
60
40
20
0
Implementation
Communication prototype
Jammer prototype
Communication performance
FM data packets
4kbps up to 1 meter
More power can increase the distance
Jamming performance
BackDoor jammer
Spy microphone
Jamming performance
BackDoor jammer
Spy microphone
Jamming performance
BackDoor jammer
Spy microphone
Jamming performance
BackDoor jammer
Spy microphone
Jamming performance
BackDoor jammer
Spy microphone
Jamming performance
BackDoor jammer
Jammed recording
2000 spoken words
Jamming performance
BackDoor jammer
Jammed recording
Human listener
Speech recognition
2000 spoken words
Jamming performance
BackDoor jammer
Jammed recording
Human listener
Speech recognition
% of legible words
2000 spoken words
Jamming performance 100
80
60
40
20
0
Jamming distance
Legi
bilit
y of
wor
ds (%
) Human users
Automatic speech recognition
Jamming performance
Takeaways
Specially designed inaudible sound can be recorded with unmodified microphone 1
It can make acoustic jammer possible and also can be a communication channel 2
It also uncovers threats like acoustic Denial-of-Service attacks 3
Ripple: Communication through Physical Vibration
Short range communication: a new need of this decade
Short range communication: a new need of this decade
Emerging technologies for short range
Driving forces of short range communication research
Capacity !
Emerging technologies for short range
Emerging technologies for short range
Security / Privacy !
Driving forces of short range communication research
Capacity !
Emerging technologies for short range
Security / Privacy !
Convenience!
Energy!
Driving forces of short range communication research
Capacity !
Availability!
Health !
Emerging technologies for short range
Visible Light Communication ! Acoustic NFC!
Physical vibration: a new mode of communication
70
Vibration MotorAccelerometer
71
Vibration MotorAccelerometer
Vibration MotorAccelerometer
72
On
Off
On On
Morse Code Key
Modulated vibration
73
Applications: Mobile Money Transfer
Applications: Mobile Money Transfer
RECEIVE
74
75
Applications: Authentication with Ring
EnterPasscode
76
Applications: Authentication with Ring
VibratoryPasscodeDetected
77
Applications: Authentication with Ring
78
Applications: Body-Area Network
79
Or…may be you can come up with a better one
Ripple: Communicating through Physical Vibrations
32K Ripple - II
9.6K
106K
1.0K 0.3K
NFC
Infrared
Visible Light
Ultrasound
0.2K Ripple - I
Ripple data-rate
(bits-per-second, entry level versions)
Ripple-II: Faster Communication through Physical Vibration
Thank You
Website: http://nroy8.web.engr.illinois.edu
SyNRG group website: http://synrg.csl.illinois.edu
