PHY-Level Security Protection Month Year Doc.: IEEE 802.11-yy/xxxxr0 May 2017 PHY-Level Security Protection Date: 2017-04-20 Authors:

Month Year Doc.: IEEE 802.11-yy/xxxxr0 May 2017 Abstract Previously, we identified a threat model with two types of adversaries: Type A 1ms response time Type B 1us response time In this submission, we present a scheme to detect and suppress Type B adversary attacks at PHY level

Outline PHY-level technique to protect measurement symbols: May 2017 Outline PHY-level technique to protect measurement symbols: Prevention of wrong sense of distance through detection of adversary attack: Discarding contaminated measurements ensures security Suppression of adversary attack: Suppressing adversary attacks enhances robustness

Needs for High Security Month Year Doc.: IEEE 802.11-yy/xxxxr0 May 2017 Needs for High Security Some applications require high security Door lock, PC lock, ATM Spoofed measurement should be discarded to prevent property loss

HW Impersonation/Data Integrity – How to Spoof Legacy Sounding May 2017 HW Impersonation/Data Integrity – How to Spoof Legacy Sounding L-STF & L-LTF give the timing reference to the VHT-LTF, which could be spoofed by the adversary RSTA (AP) Transmission

MAC protection is insufficient May 2017 MAC protection is insufficient Although transmissions of time stamps i.e. t1, t2, t3, t4 can be encrypted, the measurements of t2 and t4 themselves are still vulnerable AP Adversary STA t1 t2 Spoofed 1st tap arrives before the true one t3 t4' RTT is perceived smaller because t4'-t1 < t4-t1 t4

Goals Detecting adversary attack ensures security May 2017 Goals Detecting adversary attack ensures security Once adversary attack is detected, spoofed measurement can be discarded and further damage is prevented Suppressing attack signals enhances resilience Processing gain of random sounding sequence suppresses spoofing signal

May 2017 Adversary Detection Conduct two sounding measurements within channel coherence time Shift 2nd sounding symbols (i.e. HE-LTF or VHT-LTF) by a random CSD unknown to spoofer Check consistency across two channel measurements CSD e.g. 170 ns applied to HE-LTF TF 1 UL NPD 1 NDP-A 1 DL NDP 1 TF 2 UL NPD 2 NDP-A 2 DL NDP 2 Channel measurement 1 Channel measurement 2

Procedures Transmitter: Receiver: May 2017 Transmit two sounding signals within channel coherence time e.g. 1ms Apply CSD to 2nd sounding signal, where CSD value is known to the receiver over encrypted message so that spoofer can’t adapt to the CSD Receiver: Remove the CSD from each measurement, and compare the channel estimates of two adjacent measurements Channel estimates should be consistent unless spoofing occurred Channel estimates from 1st measurement Channel estimates from 2nd measurement Inconsistent Due to spoofer Due to user

May 2017 Discussions Spoofing detection by CSD requires almost no implementation changes CSD is currently used in legacy transmitter and receiver. For example, CSD is compensated before channel interpolation in 11n/ac/ax Adversary attack can be detected but can’t be suppressed by random CSD

Suppression of Adversary Attack — Random sounding symbols May 2017 Suppression of Adversary Attack — Random sounding symbols Replace existing sounding signal (i.e. LTF binary sequence) by a random binary sequence unknown to spoofer Sequence generation key is exchanged and encrypted before measurement L-STF, L-LTF, L-SIG, RL-SIG, HE-SIG-A HE-STF Random BPSK sequence +1, -1,+1, +1, +1, -1, -1, …

Suppressed Spoofing Impact May 2017 Suppressed Spoofing Impact Spoofed 1st tap True 1st tap Noise level With Legacy LTF symbols With random sounding symbols Concentrated, high power spoofed taps Spread, low power spoofed taps

May 2017 20 dB Suppression Suppress spoofed 1st tap by about 20 dB for 80 MHz sounding True 1st tap Spoofed 1st tap

May 2017 Summary MAC protection is insufficient for preventing Type B spoofing and PHY protection is needed Type B spoofing can be detected by using CSD unknown to spoofer Type B spoofing can be suppressed by using randomized sounding signal

May 2017 Backup

Additional Suppression to Adversary May 2017 Additional Suppression to Adversary Instead of 1x LTF symbol duration, 4x LTF symbol duration may be used 6 dB processing gain Instead of 1 OFDM symbol, the random sounding signal may spread over 8 OFDM symbols 9 dB processing gain

May 2017 Straw poll 1 Do you agree that the scheme of slide 8 (CSD) is sufficient to detect Type B adversary? Yes No Abstain

Month Year Doc.: IEEE 802.11-yy/xxxxr0 May 2017 Straw poll 2 Do you agree that the scheme of slide 11 (processing gain) is useful to suppress Type B adversary? Yes No Abstain

May 2017 Straw poll 3 Do you agree that the scheme of slide 8 (CSD) is useful to detect Type B adversary? Yes No Abstain