Thursday, October 17, 2013

Serval recognised in International Red Cross/Crescent World Disasters Report

It is very pleasing to see our partnership with New Zealand Red Cross to enable communications during disasters has been recognised in the International Federation of the Red Cross/Crescent (IFRC) World Disasters Report.

"This collaboration between the New Zealand Red Cross, DeLorme and Serval has created a communications system with many benefits from the complementary capabilities of the three technologies, including the smarts and sensors of the smartphone; the global reach of Iridium; resilient communications due to path diversity and the store and forward mechanism; the value for money of commercial off-the-shelf components; and a familiar interface that can be used before, during and after the disaster."

The full report can be downloaded here:

Improved 3D printable case for mesh extender

In recent blog posts I have been talking about the 3D printable cases for the mesh extender prototypes.  We had a little problem with the first prototype not fitting the USB memory sticks that we had, so Musti kindly tweaked the design to make more room, as can be seen in this shot:

 With the lid on it looks like this:

The ABS plastic just has a nicer finish than the other plastic we used on the first test unit.  With this change it is just about right, except that it ended up bring a little too short for some reason, perhaps an issue with our 3D printer, as you can see by the little gap behind the lid here:

We will just print the case 1mm longer, and all should be well.

The next step from here is to adapt it for the MR3040 router which has a small rechargeable battery, and means that we can have a single-piece Mesh Extender with at least a few hours of battery life before adding an external battery.

Sunday, October 13, 2013

Mesh Extender custom case fitting

As mentioned in the last post we now have a 3D printable case for the MR3020-based Mesh Extender prototypes.  Until today we had only seen the images of the one that Musti printed in Slovenia.  But now thanks to the technical staff here in the department, we got one printed up this morning while I was teaching to see how it looks, and if it fit the components we were using here.

First, here is the unit after we put all the parts in, in fashionable Flourescent Yellow, almost verging on the appropriate International Standard Yellow-Green:

We did, however, hit a little snag: The USB memory sticks we are using here, while very small, are slightly larger than the ones that Musti was measuring against.  Similarly, the USB connector itself had a taller flange than anticipated.  The end result was the case is about 2.5mm too narrow, and about 1mm to low around the USB connector:

This we remedied with a bit of filing to make a slot to accept the USB memory stick until we can tweak the design.  I filed off some of the stylistic curves on the memory stick as well to make this easier.  Then it all fit:
Musti has done a great job making it all slot together, and feel really firm and stable in terms of the positions of the components.

Now to build an updated servald binary including all our recent changes and bug fixes...

Saturday, October 12, 2013

Custom case for MR3020 based Mesh Extender prototypes

With the help of the very capable Musti from WLAN Slovenija and some of our crowd funding campaign funds (thank you again to everyone who contributed!) we now have a nice 3D-printable case for the MR3020-based Mesh Extender prototypes.

The following images are supplied by Musti, as we are yet to print some of these out ourselves in the lab.  You can be sure we will be doing this as soon as possible next week.

Having our own case is one of those little things that makes a big difference to the end usability, and also feasibility of manufacturing these units in small quantities.  No odd parts poking out. No lids that won't close properly. All little things that make a big difference.

Musti has made the case so that the PCB and radio just slide in, and with a little extra PCB all the connections can be made without having to solder anything -- a very nice time-saving trick.

We will be putting the CAD files up on as soon as we get the chance.

Next we are looking at doing the same for the MR3040, which is much the same as the MR3020, but has an internal rechargeable battery -- that would give us a one-piece complete Mesh Extender, which is very appealing. Also, the MR3040 is much easier to open to get the PCB out in the first place compared with the MR3020 whose lid is cemented and clipped shut, and generally Un-Fun to open by the dozen.

Thursday, October 10, 2013

Arduino Yun as a possible Mesh Extender Platform

Regular readers of this blog will know that we have been looking at a variety of hardware options for the Serval Mesh Extender.

The Serval Mesh Extender is a device that combines ad-hoc WiFi meshing with long-range license-free UHF packet radio to allow the easy formation of mesh networks spanning useful distances. Typically the UHF packet radio has a range about ten times greater than WiFi. This means that in ordinary suburban and urban areas we get a range of a block or two, and in open rural areas the range can be in the kilometres.

We run our award winning Serval Mesh software over the top, providing an easy to use communications system that lets you use your cell phone without cellular coverage, for example, during a disaster, or when you and your friends are near one another outside of the range of your native network. For example, if you are at an international gathering and don't want to pay $4 a minute for the privilege of calling someone a few hundred metres away.

The challenge with the Mesh Extender design is that we haven't had the budget to design our own device from the ground up. As a result we have been using existing hardware platforms, and trying to adapt them to accept the excellent RFD900 UHF packet radios we source from RFDesign (their link margin is probably about 10dB better than competing radios that we are aware of).

This means that we have been doing things like modifying TP-LINK MR3020 wireless routers to build prototypes. While it works, the process is far from satisfactory, and the physical steps take a couple of hours per unit, which makes the effective unit price very high, despite the low cost of the MR3020 unit itself.

This is where the Arduino Yun is very exciting for us. It has all of the functionality of the MR3020 in the form of the mesh-friendly Atheros processor and WiFi system-on-a-chip running Linux, and of course being an Arduino it has plenty of connectivity options for us to connect to the RFD900, which just uses RS232 serial. As an added bonus the Yun has a microsd slot, so we don't need to use a USB memory stick for mass storage, which actually makes a noticable impact on power consumption. The larger flash on the Yun is also welcome, as the 4MB flash on the MR3020 is, frankly, a pain to work with.

While we are still working on the integration, the prospect is there for the Yun to save us a lot of time, and hence cost, in making future prototypes, and the Yun board itself could be the basis for a customised PCB that exactly meets our needs, and allows us to just plug the radio module directly onto the PCB.  Here you can see the Yun connected to an RFD900 radio ready for integration testing:

In short, the Yun is opening a new opportunity for us to innovate faster, more affordably, and with a better result.

Lets use Thingometrics instead of Biometrics

One of these pebbles could be your next password, and this is a much better idea than using your fingerprint as a password.  Sound crazy? Then read on.

Image in the public domain
It is entirely possible that a hundred people have thought of this before, and if so, my apologies.

Much ado is made of biometrics from time to time,  most recently on the latest iPhone.

Most of the attention focuses on how wonderful it is to be able to use your thumb, eye-ball or some other body part to identify yourself.

Many companies are formed based on the assumption that biometrics are secure, and are generally speaking A Good Idea.

However, as we have been reminded by the Chaos Computer Club (CCC) in Germany breaking the biometric authentication on the iPhone in less than two days using common household ingredients and just a photo of the fingerprint.

The CCC sum up many of the major problems with biometrics in their post:

"We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can´t change and that you leave everywhere every day as a security token", said Frank Rieger, spokesperson of the CCC. "The public should no longer be fooled by the biometrics industry with false security claims. Biometrics is fundamentally a technology designed for oppression and control, not for securing everyday device access." Fingerprint biometrics in passports has been introduced in many countries despite the fact that by this global roll-out no security gain can be shown.

There are a few salient points in the above that are so important that they require repeating, as well as some important consequences. Please excuse the all caps, but these are really important points that need to be made again and again, because industry, government and individuals continue to be badly deluded as to the value and sensibility of biometrics as an authentication or access control.

1. You leave your fingerprint EVERYWHERE.  Despite the fact that we tell people to keep their passwords secret, the biometrics movement encourages people to use a password that is IMPOSSIBLE to keep secret.

2. Because you leave your fingerprint "password" everywhere, you don't know when someone has captured and compromised your password.  So you continue to acting like your fingerprint is secure, and so does your phone, your passport and everything else that depends on it.

3. If you do discover that someone is doing something naughty with your supposedly secret fingerprint password, YOU CANT CHANGE YOUR FINGERPRINTS.

4. Because of all of the above your fingerprint is of more value to naughty people who want to defraud you than it is to you.  

5. All of this is bad, because it creates economic incentives for bad people to STEAL YOUR FINGERPRINT, or worse STEAL YOUR RETINA.

6. In case you think that practically perfect fingerprint cloning on real fingers is impossible consider the following: It is well known that bricklayers often abrade their fingerprints completely, showing that making a "blank finger" is trivial.  All that remains is to engrave the blank finger with the target's finger print, e.g., using laser micro-surgery techniques.  I'm not saying that this would be trivial, but it is hopefully apparent that there are major problems facing fingerprint based identification, even if it advances to actually requiring a live person attached to the finger print.

We also know that normal passwords are both annoying and also have their own security problems. (Although at least you can give your password to someone and retain binocular vision and the ability to hold cutlery, and then get a new password to replace the old one.)

So, what should we do?

We should try to do something that will not make the biometrics lobby too upset, so that they don't push back with more lies and patently false claims about the security or sensibility of biometrics.

One way of doing this could be coming up with a scheme that can leverage the accurate object and surface imaging technologies that these companies have created, and allow them to rapidly transition focus from the largely counterproductive biometrics field.  In other words, lets leave them room to still make money and be prosperous.

Enter the idea of thingometrics instead of biometrics.

Basically, lets stop scanning body parts, and instead scan simple objects.

Simple objects can be easily chosen that:

1. are hard to clone from a photograph (unlike finger prints),
2. don't leave the means to reproduce them on surfaces everywhere. That is are more rivalous than not, instead of the practically nonrivalous nature of fingerprints.
3. can be given to a forceful attacker without having to hand over any body parts
4. can be easily replaced if ever compromised

Things like sea shells, small pebbles, a crumpled mass of stiff wire, or any other morphically stable robust object would be good candidates.  Attach them to your physical key ring for convenience. You could even use one of your existing physical keys for extra convenience (which always comes at a cost to security).

Need to change your password? Just go outside and find a new rock, or better yet take a monthly work-mandated trip to the beach to find your new password.

It would be quite possible to make a 3D printer to produce a pseudo-random object with a keyring attachment point if you want an more environmentally sensitive source of things to metric.

If you want to be super-paranoid you could reduce the residual risk of someone comprehensively imaging your password object from a distance by making the interior of it the password part.  Again, 3D printers would be your friend here, or if you have a handy supply of geodes would make for a password with street cred among your geologist friends.  If used with dedicated imaging sensors the complex interior need never be visible from the outside at all.

Oh yes, and with thingometrics you can easily implement some helpful security protocols.  For example, you can register anti-passwords, in the form of other objects that when presented cancel the authority of an other thingometric password, analogous to revocation certificates in PKI systems.

You might carry one anti-password with you, and one or more in a safe remote place so that if you lose (or are robbed) of your thingometric passwords anti-passwords you can easily cancel the stolen password (or instruct someone remotely to do so on your behalf).

You can also physically destroy a thingometric password if you are worried about it being captured, and because well chosen thingometric passwords are closer to being rivalous, you can have better confidence that no one else has obtained the password if you still hold the original.

3D printers and the like represent risks, but nothing is perfect, and the risks are much lower than with fingerprint biometrics which as previously noted leave sufficient imprint everywhere for people using relatively easy technologies like those developed by the CCC.

Thingometrics has the extra advantage that it could be implemented using the camera on a smart-phone, without needing to have an extra sensor.  At most, you might want a second camera for stereoscopic vision.   So not only is thingometrics safer for you, and more secure for your data, it can also be cheaper to implement.

It also means that it would be much easier to support in free and open software and operating systems, because there are no more funny closed drivers and firmware than normal.

So let's think about what would be needed to implement thingometrics in practice.

1. Some good image mapping algorithms, that can capture the shape and texture of an object in front of a camera to develop a detailed enough 3D image.

2. Some good image matching algorithms that can detect (or reject) an object being held in front of the camera.

And, er, that's about it really*.

I suspect that suitable technologies exist in part or in full in the academic literature and elsewhere, and that creating a functional system could be implemented fairly readily* by a skilled and dedicated team.

If you go for a dedicated sensor and the inside-out key idea described above, then this becomes much, much, simpler to do. It could probably be implemented in a semester by a good student (any volunteers? I'm happy to supervise. You don't have to be in Australia, either.)

So, here is the challenge: Let's get a bunch of us together to implement thingometrics, and give the world a better alternative to biometrics.  I've registered the domain names.  Now we just need the team.

Paul "I want to keep my thumbs" Gardner-Stephen.

* Which isn't to say that there wouldn't still be quite a bit of work. Everything is relative, after all.