· ~4 min read
A motion and comfort sensor app, with replay protection
A team project for an IoT security course: recognising posture and falls from an accelerometer, a heat-index comfort reading, and a nonce against replayed messages.
Goal
For the Secure Applications for the Internet of Things course of my MSc, a classmate and I built a small sensor application as a two-person team project. A sensor reports acceleration, temperature and humidity, and the application turns those raw numbers into two things a person cares about: what the wearer is doing (sitting, walking, lying down, falling) and whether the room is comfortable. Because it is a security course, the messages also had to resist a simple replay attack.
What the application shows
| View | What it is built from |
|---|---|
| Comfort | Live temperature and humidity graphs, plus a heat-index graph |
| Activity | Sitting, walking, lying on the side, lying face down, falling |
| Statistics | Time spent in each activity, average temperature, humidity and heat index, and a pie chart of the activities |
Comfort: the heat index
Temperature alone says little about comfort; 30 °C in dry air feels very different from 30 °C at 80% humidity. We used the heat index, the standard regression (Rothfusz) in its Celsius form, where T is the temperature in °C and RH the relative humidity in %:
HI = c1 + c2*T + c3*RH + c4*T*RH + c5*T^2 + c6*RH^2
+ c7*T^2*RH + c8*T*RH^2 + c9*T^2*RH^2
c1 = -8.78469475556 c2 = 1.61139411 c3 = 2.33854883889
c4 = -0.14611605 c5 = -0.012308094 c6 = -0.0164248277778
c7 = 0.002211732 c8 = 0.00072546 c9 = -0.000003582The title of the comfort graph also says whether conditions are comfortable, using simple thresholds on temperature and humidity.
Activity: reading the acceleration vector
At rest, the accelerometer measures gravity, so the axis that carries most of the vector tells you how the sensor is oriented. Movement shows up as changes in the size of the vector. The rules were deliberately simple:
| Activity | Rule |
|---|---|
| Sitting | The y component of the acceleration is larger than x and z |
| Lying on the side | The x component is the largest |
| Lying face down | The z component is the largest |
| Walking | The magnitude of the vector is above a threshold |
| Falling | A large, sudden change in acceleration, or a magnitude above a higher threshold |
At the end of a run, the application prints how long each activity lasted and the averages, and draws the pie chart.
Replay protection
Without protection, anyone who can capture a message can send it again later, and the receiver cannot tell the copy from the original. A recorded "all normal" reading could be replayed to hide a real fall. Our defence was to send a nonce, a value used only once, with every message.
What I learned
Looking back, there are three things I would change.
- A nonce only stops replays if the receiver checks it. The receiver has to remember the nonces it has accepted (or require a counter that only goes up) and reject repeats. The nonce must also be covered by a message authentication code, such as an HMAC over the nonce and the payload; otherwise an attacker simply replaces the nonce in the captured message. In our slides I also described the nonce as making the data harder to understand. That is confidentiality, which needs encryption; replay protection and confidentiality are separate properties.
- The heat-index regression is only valid in hot conditions. It was fitted for roughly 27 °C and above with humidity of 40% or more. Below that, the simpler formula (or just the temperature) is the honest answer.
- Threshold rules need smoothing. Walking and falling both look at the magnitude, so their thresholds compete, and a single noisy sample can flip the label. A short moving window, a low-pass filter for the gravity direction, and a "still lying after the impact" check would cut most of the false falls.
A team course project for the MSc in Cybersecurity & Data Science at the University of Piraeus.
Want the configs or code from this lab, or have a question? Email me at kostaspapas1023@gmail.com