370 likes | 498 Views
Where Are You From? Confusing Location Distinction Using Virtual Multipath Camouflage. Song Fang, Yao Liu. Wenbo Shen , Haojin Zhu. Location d istinction. Content. Virtual m ultipath attacks. Defense. Experiment. Summary.
E N D
Where Are You From? Confusing Location Distinction Using Virtual Multipath Camouflage Song Fang, Yao Liu WenboShen, Haojin Zhu
Locationdistinction Content • Virtualmultipathattacks • Defense • Experiment • Summary
Detect a wireless user’s location change, movement or facilitate location-based authentication. Goaloflocation distinction
Applications: • Wirelesssensornetwork:Locationdistinctioncanpreventanunauthorizedpersonfrommovingthesensorsawayfromtheareaofinterest
Wirelesssensornetwork:LocationdistinctioncanpreventanunauthorizedpersonfrommovingthesensorsawayfromtheareaofinterestWirelesssensornetwork:Locationdistinctioncanpreventanunauthorizedpersonfrommovingthesensorsawayfromtheareaofinterest • Sybilattack:Locationdistinctioncandetectidentitiesoriginatedfromthesamelocation Applications:
Example2 (Cont’d): Fromthe samelocation X
Applications: • Wirelesssensornetwork:Locationdistinctioncanpreventanunauthorizedpersonfrommovingthesensorsawayfromtheareaofinterest • Sybilattack:Locationdistinctioncandetectidentitiesoriginatedfromthesamelocation • RFID:Provideawarningandfocus resourcesonmovingobjects (LocationDistinction[MobiCom’07]).
Example3: Move Control
Example3: Move Control
Spatialuncorrelationproperty Existing ways torealizelocation distinction Change Wirelesschannelcharacteristics Locationchange Attack:Generate“arbitrary”characteristic FAIL!!
Multipatheffect • Component response: • Characterizes the distortion that each path has on the multipath component • Multipath components Channel impulse response: The superposition of all component responses Received signal Transmitted signal
Channel impulse response • The channel impulse response changes as the receiver or the transmitter changes location • Calculate the difference Channel impulse responses can be utilized to provide location distinction.
Training sequence based channel estimation Training Sequence x Training Sequence x ChannelEstimation x y x Estimator Channel Impulse response h
Rewrite the received symbols ChannelEstimation (Cont’d) AToeplitzmatrix • Least-square (LS) estimator
Locationdistinction Content • Virtualmultipathattacks • Defense • Experiment • Summary
AttackOverview:delay-and-sumprocess. The attacker’s aims to make Theithdelayedsignalcopy Virtual channel impulse response
Send the aggregatedsignaltotherealmultipathchannel TechnicalChallenge:Obtainingtheweights
Locationdistinction Content • Virtualmultipathattacks • Defense • Experiment • Summary
Defendingagainsttheattack:Addingahelper In this case, the attacker must know the real channel impulse response between herself and the helper.
Defendingagainsttheattack:Addingahelper • ForReceiver: • ForHelper:
Attackerswithhelper To fool both the receiver and the receiver’s helper, the attacker needs to know the real channel impulse responses: Unknown Fail to launch attacks Can be set passively: it doesn’t actively send out wireless signals to channel
Locationdistinction Content • Virtualmultipathattacks • Defense • Experiment • Summary
Experimentfloorplan • Transmitter: RX • Receiver:10locations • Eachnode:aUSRPconnectedwithaPC • Trials: 100perlocation • Multipath:L=5
Randomlychosenchannelimpulseresponse ExampleattacksI Euclidean distance:
Recover another channelimpulseresponseinanotherbuilding(CRAWDADdataset[1]) ExampleattacksII Euclidean distance: [1] SPAN, “Measured channel impulse response data set,” http://span.ece.utah.edu/pmwiki/pmwiki.php?n=Main.MeasuredCIRDataSet.
dest=||estimated CIRunderattacks-chosen CIR || • dreal=||estimated CIR under attacks-real CIR|| Overall attack impact 95% 5% 0.25 0.9 is muchlargerthan withhighprobability
Experimentfloorplan Helper Attacker • Place the attacker andthehelperateachpairofthe10locations:10×9=90pairs.
The Euclidean distance between both estimates: Defensefeasibility evaluation Attacker: Location 2 Receiver Receiver’shelper (Location 8)
Defenseperformance evaluation • Conclusion:Thehelpernodeiseffectivetohelpdetectvirtualmultipathattacks.
Locationdistinction Content • Virtualmultipathattacks • Defense • Experiment • Summary
Weidentifieda new attack against existing location distinction approaches that built on the spatial uncorrelation property of wireless channels. • Weproposed a detection technique that utilizes a helper receiver to identify the existence of virtual channels. Summary