Over the past decade, the adoption of Internet of Things (IoT) devices has greatly revolutionized the retail and commerce industries. However, these devices are vulnerable to attacks, such as theft, which raises significant security and privacy concerns for business assets. Securing such business-owned devices is challenging, particularly due to the business contexts that require not only authenticating the devices but also verifying the environment in which the devices are located. In this study, we present a zero-effort authentication approach based on acoustic fingerprints, namely AcousticAuth. AcousticAuth enables a “verifier” device to authenticate and verify the work environment of multiple “prover” devices (e.g., kiosks) by extracting their acoustic fingerprints and direction information. Additionally, we adopt a novel method based on beamforming to expand the fingerprint space of the provers. We implemented a prototype of AcousticAuth using real-world IoT devices, and the evaluation of the prototype indicates that AcousticAuth is highly effective and achieves high sensitivity when authenticating different devices across environments. Our results demonstrate that AcousticAuth can accurately distinguish between different devices and the same model devices with the error rate of 0.03%, significantly enhancing the security of IoT devices in retail settings. AcousticAuth also distinguishes between the different environments with an error rate of 0.00%. Lastly, the system shows robustness against various acoustic interference scenarios, making it a practical solution for dynamic business environments. We not only introduce a novel security mechanism that pushes the limit of fingerprint-based authentication by expanding the fingerprint pool but also provide comprehensive insights into its implementation and performance, paving the way for more secure IoT deployments in the commercial sector.

中文翻译：

---

店内独家提供：固定式商业设备的声学位置认证


在过去十年中，物联网 （IoT） 设备的采用极大地改变了零售和商业行业。但是，这些设备容易受到盗窃等攻击，这会给企业资产带来重大的安全和隐私问题。保护此类企业拥有的设备具有挑战性，特别是因为业务环境不仅需要对设备进行身份验证，还需要验证设备所在的环境。在这项研究中，我们提出了一种基于声学指纹的零工作量身份验证方法，即 AcousticAuth。AcousticAuth 使“验证器”设备能够通过提取多个“验证器”设备（例如信息亭）的声学指纹和方向信息来验证和验证其工作环境。此外，我们采用一种基于波束成形的新方法来扩展验证器的指纹空间。我们使用真实的 IoT 设备实现了 AcousticAuth 的原型，对原型的评估表明，AcousticAuth 非常有效，并且在跨环境验证不同设备时实现了高灵敏度。我们的结果表明，AcousticAuth 可以准确区分不同设备和相同型号的设备，错误率为 0.03%，显着增强了零售环境中物联网设备的安全性。AcousticAuth 还以 0.00% 的错误率区分不同的环境。最后，该系统对各种声学干扰场景表现出稳健性，使其成为动态业务环境的实用解决方案。 我们不仅引入了一种新颖的安全机制，通过扩展指纹池来突破基于指纹的身份验证的极限，而且还提供了对其实施和性能的全面见解，为商业领域更安全的物联网部署铺平了道路。