1 / 19

PHY-Level Security Protection

Date: 2017-04-20. PHY-Level Security Protection. Authors:. Previously, we identified a threat model with two types of adversaries: Type A 1ms response time Type B 1us response time In this submission, we present a scheme to detect and suppress Type B adversary attacks at PHY level.

bbirney
Download Presentation

PHY-Level Security Protection

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Date: 2017-04-20 PHY-Level Security Protection Authors:

  2. Previously, we identified a threat model with two types of adversaries: • Type A 1ms response time • Type B 1us response time • In this submission, we present a scheme to detect and suppress Type B adversary attacks at PHY level Abstract

  3. PHY-level technique to protect measurement symbols: • Prevention of wrong sense of distance through detection of adversary attack: • Discarding contaminated measurements ensures security • Suppression of adversary attack: • Suppressing adversary attacks enhances robustness Outline

  4. Some applications require high security • Door lock, PC lock, ATM • Spoofed measurement should be discarded to prevent property loss Needs for High Security

  5. L-STF & L-LTF give the timing reference to the VHT-LTF, which could be spoofed by the adversary HW Impersonation/Data Integrity – How to Spoof Legacy Sounding RSTA (AP) Transmission

  6. Although transmissions of time stamps i.e. t1, t2, t3, t4 can be encrypted, the measurements of t2 and t4 themselves are still vulnerable MAC protection is insufficient Adversary STA AP t1 t2 Spoofed 1st tap arrives before the true one t3 t4' RTT is perceived smaller because t4'-t1 < t4-t1 t4

  7. Detecting adversary attack ensures security • Once adversary attack is detected, spoofed measurement can be discarded and further damage is prevented • Suppressing attack signals enhances resilience • Processing gain of random sounding sequence suppresses spoofing signal Goals

  8. Conduct two sounding measurements within channel coherence time Shift 2nd sounding symbols (i.e. HE-LTF or VHT-LTF) by a random CSD unknown to spoofer Check consistency across two channel measurements Adversary Detection CSD e.g. 170 ns applied to HE-LTF DL NDP 2 TF 2 UL NPD 2 DL NDP 1 TF 1 UL NPD 1 NDP-A 2 NDP-A 1 Channel measurement 1 Channel measurement 2

  9. Transmitter: • Transmit two sounding signals within channel coherence time e.g. 1ms • Apply CSD to 2nd sounding signal, where CSD value is known to the receiver over encrypted message so that spoofer can’t adapt to the CSD • Receiver: • Remove the CSD from each measurement, and compare the channel estimates of two adjacent measurements • Channel estimates should be consistent unless spoofing occurred Procedures Channel estimates from 1st measurement Channel estimates from 2nd measurement Inconsistent Due to spoofer Due to user

  10. Spoofing detection by CSD requires almost no implementation changes • CSD is currently used in legacy transmitter and receiver. For example, CSD is compensated before channel interpolation in 11n/ac/ax • Adversary attack can be detected but can’t be suppressed by random CSD Discussions

  11. Replace existing sounding signal (i.e. LTF binary sequence) by a random binary sequence unknown to spoofer • Sequence generation key is exchanged and encrypted before measurement Suppression of Adversary Attack— Random sounding symbols L-STF, L-LTF, L-SIG, RL-SIG, HE-SIG-A Random BPSK sequence HE-STF +1, -1,+1, +1, +1, -1, -1, …

  12. Suppressed Spoofing Impact True 1st tap With Legacy LTF symbols Spoofed 1st tap Noise level Concentrated, high power spoofed taps True 1st tap With random sounding symbols Noise level Spread, low power spoofed taps

  13. Suppress spoofed 1st tap by about 20 dB for 80 MHz sounding 20 dB Suppression True 1st tap Spoofed 1st tap

  14. MAC protection is insufficient for preventing Type B spoofing and PHY protection is needed Type B spoofing can be detected by using CSD unknown to spoofer Type B spoofing can be suppressed by using randomized sounding signal Summary

  15. Backup

  16. Instead of 1x LTF symbol duration, 4x LTF symbol duration may be used • 6 dB processing gain • Instead of 1 OFDM symbol, the random sounding signal may spread over 8 OFDM symbols • 9 dB processing gain Additional Suppression to Adversary

  17. Do you agree that the scheme of slide 8 (CSD) is sufficient to detect Type B adversary? • Yes • No • Abstain Straw poll 1

  18. Do you agree that the scheme of slide 11 (processing gain) is useful to suppress Type B adversary? • Yes • No • Abstain Straw poll 2

  19. Do you agree that the scheme of slide 8 (CSD) is useful to detect Type B adversary? • Yes • No • Abstain Straw poll 3

More Related