Establishing and maintaining secure communications in the Internet of Things (IoT) is vital to protect smart devices. Zero-interaction pairing (ZIP) and zero-interaction authentication (ZIA) enable IoT devices to establish and maintain secure communications without user interaction by utilizing devices' ambient context, e.g., audio. For autonomous operation, ZIP and ZIA require the context to have enough entropy to resist attacks and complete in a timely manner. Despite the low-entropy context being the norm, like inside an unoccupied room, the research community has yet to come up with ZIP and ZIA schemes operating under such conditions. We propose HardZiPA, a novel approach that turns commodity IoT actuators into injecting devices, generating high-entropy context. Here, we combine the capability of IoT actuators to impact the environment, e.g., emitting a sound, with a pseudorandom number generator (PRNG) featured by many actuators to craft hard-to-predict context stimuli. To demonstrate the feasibility of HardZiPA, we implement it on off-the-shelf IoT actuators, i.e., smart speakers, lights, and humidifiers. We comprehensively evaluate HardZiPA, collecting over 80 hours of various context data in real-world scenarios. Our results show that HardZiPA is able to thwart advanced active attacks on ZIP and ZIA schemes, while doubling the amount of context entropy in many cases, which allows two times faster pairing and authentication.

翻译：在物联网（IoT）中建立并维护安全通信对于保护智能设备至关重要。零交互配对（ZIP）和零交互认证（ZIA）通过利用设备的周围环境（例如音频）实现无需用户交互的IoT设备安全通信建立与维护。为实现自主运行，ZIP和ZIA要求环境具有足够的熵值以抵抗攻击并按时完成操作。尽管低熵环境（如无人房间内部）是常态，但研究界尚未提出在此类条件下运行的ZIP和ZIA方案。我们提出HardZiPA这一新方法，将商用IoT执行器转变为注入设备，生成高熵环境。该方法结合了IoT执行器影响环境的能力（如发出声音）与众多执行器配备的伪随机数发生器（PRNG），以构造难以预测的环境刺激。为验证HardZiPA的可行性，我们在智能音箱、灯光和加湿器等现成IoT执行器上进行了实现。通过采集80多小时真实场景下的多种环境数据进行全面评估，结果表明，HardZiPA能有效抵御针对ZIP和ZIA方案的高级主动攻击，同时在多数情况下将环境熵值翻倍，从而使配对和认证速度提升两倍。