2/24/2019 Project: IEEE P802.15 Working Group for Wireless Personal Area Networks (WPANs) Submission Title: [Secure Ranging] Date Submitted: [15 August 2005] Source: [Zafer Sahinoglu, Philip Orlik, Andy Molisch] Company [Mitsubishi Electric] Voice:[+1 617 621 7588], E-Mail: [zafer@merl.com] Abstract: [Secure Ranging Proposal] Purpose: [Assist the group to find methods to secure ranging] Notice: This document has been prepared to assist the IEEE P802.15. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P802.15. Zafer Sahinoglu (MERL)

2/24/2019 Objective To provide security in ranging signaling exchanges such that malicious devices will neither be able to acquire nor jam/manipulate the ranging information Zafer Sahinoglu (MERL)

I want to find where my “thing” is 2/24/2019 Perfect World No malicious devices in the network The originator initiates a TW-TOA signaling, and figures out the range to a target device Perfect World The thing ranging signal OHH, it is 10 meters away I want to find where my “thing” is The thing ranging signal 10 meters Zafer Sahinoglu (MERL)

Real World: Snooper Attack-1 2/24/2019 Real World: Snooper Attack-1 A snooper device observes or listens to the signals in the air in secret to obtain information Real World-I The thing I want to find where my “thing” is ranging signal The thing ranging signal OHH, it is 10 meters away ranging signal 10 meters ranging signal Hmm, I learned this and that The ugly snooper The ugly snooper Zafer Sahinoglu (MERL)

Real World: Impostor Attack-1 2/24/2019 Real World: Impostor Attack-1 An impostor device engages in deception under an assumed name or identity Lesson: make sure whom you are talking to is an authentic device Never talk to strangers Real World-II The thing ranging signal Hmm, there is a thing 26 meters away ranging signal 26 meters The ugly impostor Zafer Sahinoglu (MERL)

Real World: Impostor Attack-2 2/24/2019 Real World: Impostor Attack-2 An impostor device engages in deception under an assumed name or identity Lesson: Don’t believe everything you hear OHH, it is 24 meters away The thing Ranging signal Don’t believe everything you hear Ranging signal I will tell you where your thing is. The ugly impostor Real World-III Zafer Sahinoglu (MERL)

Real World: Jamming Attack 2/24/2019 Real World: Jamming Attack A jamming device interferes with or prevent the clear reception of desired signals Identify existence of a jammer, and back-off for a while With advanced signal processing techniques, remove the interference from the received signal OHH, it is 24 meters away The thing Ranging signal Jamming device Real World-IV Zafer Sahinoglu (MERL)

Let’s get technical now !!! 2/24/2019 Let’s get technical now !!! There are three types of ranging signaling Insecure fast Secure slow Secure fast Zafer Sahinoglu (MERL)

2/24/2019 Unsecure Fast PHY layers respond to messages without higher layer involvement Timing imperfections and processing times at higher layers avoided, turn around time is minimized (FAST) Ranging preamble is unprotected Target does not whom it is replying to Zafer Sahinoglu (MERL)

2/24/2019 Secure Slow PHY layer replies after receiving authentication approval from higher layers High turn-around time and timing imperfections would degrade ranging accuracy (SLOW) Ranging preamble is still unprotected An impostor can still deceive the originator Zafer Sahinoglu (MERL)

Secure Fast Two-step ranging: Authentication and Ranging 2/24/2019 Secure Fast Two-step ranging: Authentication and Ranging Turn around time is kept at minimum, or randomly manipulated to add more security Snoopers will receive worthless or no information Impostors will be avoided Zafer Sahinoglu (MERL)

Authentication Step Ranging Step 2/24/2019 Authentication Step Conventional authentication + ranging waveform settings are conveyed to the target in the encrypted payload of the authentication packet Authentication Packet Structure Ranging Step Ranging symbol (modified) is repeated No need for header or payload Ranging Packet Structure Zafer Sahinoglu (MERL)

Ranging Waveforms for Security 2/24/2019 Ranging Waveforms for Security Ternary-IR Time-hopping-IR Zafer Sahinoglu (MERL)

Ternary-IR Perfect periodic correlation Six length-31 such codes exist 2/24/2019 Ternary-IR Perfect periodic correlation Six length-31 such codes exist Circularly shifting a Ternary sequence moves the periodic autocorrelation function as much as the shift Zafer Sahinoglu (MERL)

2/24/2019 Ternary-IR Illustration of correlator outputs with and without circular shifts (S1 circularly shifted by 5) PRI =15ns , k=5 => The autocorrelation peak shifts by 75ns => 25m deviation Zafer Sahinoglu (MERL)

Security Tool with Ternary-IR 2/24/2019 Security Tool with Ternary-IR The originator and the target decide on both a Ternary sequence and the shift amount to use Conveyed within the authentication packet Ranging symbol consists of the repetitions of the shifted symbol waveform Any snooper or impostor may still observe the signal. However, without the knowledge of the shift, they will end up with useless information This effect is equivalent to randomizing the turn-around time Longer turn-around time will hit into clock drift problems Security level vs. ranging accuracy trade-off Zafer Sahinoglu (MERL)

Time-hopping IR Larger family than Ternary-IR (+) 2/24/2019 Time-hopping IR Larger family than Ternary-IR (+) Autocorrelation properties are not as good as Ternary’s (-) Zero correlation zone (ZCZ) around the correlation peak can still be generated by proper code selection If any two TH codes don’t match, the ZCZ gets perturbed Helps against impostors and snoopers who don’t know the exact code Zafer Sahinoglu (MERL)

Time Hopping-IR for Secure Ranging 2/24/2019 Time Hopping-IR for Secure Ranging The originator and the target decide on a TH code within the payload of the authentication packet and use it for ranging It is less likely for a malicious device to track the right TH code TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH1 TH2 Zafer Sahinoglu (MERL)

What is a MUST for Secure Ranging? 2/24/2019 What is a MUST for Secure Ranging? A range authentication packet Should contain information about the range waveform Range waveform should be changed each time a ranging is performed A range packet Header and payload are not necessary. IDs are implicitly represented by the selected ranging waveform Eliminates higher layer involvement Manipulation of turn-around time is another security tool Advanced signal processing at the receiver ends to filter out jamming interference Zafer Sahinoglu (MERL)

2/24/2019 Thank You Zafer Sahinoglu (MERL)