L. Xiao, L. Greenstein, N. Mandayam, W. Trappe WINLAB, Dept. ECE, Rutgers University ICC 2008 This work is supported in part by NSF grant CNS A Physical-Layer Technique to Enhance Authentication for Mobile Terminals

Outline Channel-based authentication Challenge: Terminal mobility Enhanced channel-based authentication Inter-burst authentication Intra-burst authentication Simulation results Conclusion 2/15/2016 2

PHY-based Security Techniques 3

Benefits of Multipath Fading CDMA: Rake processing that transforms multipath into a diversity-enhancing benefit MIMO: Transforms scatter-induced Rayleigh fading into a capacity-enhancing benefit Fingerprints in the Ether: Distinguishes channel responses of different paths to enhance authentication 2/15/2016 4

Fingerprints in the Ether Fingerprints in the Ether: In typical indoor environments, the wireless channel decorrelates rapidly in space The channel response is hard to predict and to spoof 5 Top View of Alcatel-Lucent’s Crawford Hill Laboratory, Holmdel, NJ

Channel-Based Authentication Wireless networks are vulnerable to various identity-based attacks, like spoofing attacks System overhead can be large if every message is protected by upper-layer authentication/encryption Channel-based authentication: Detect attacks for each message, significantly reducing the number of calls for upper-layer authentication Works well under time-invariant channels and stationary terminals in spoofing detection 2/15/2016 6

System Model Multicarrier systems, e.g., OFDM Also applies to single-carrier systems Each burst contains multiple frames Each frame (with duration of T) contains pilot symbols at M subbands Reuse the existing channel estimation mechanism 2/15/ Data transmission

Alice sent the first message If Alice is silent, Eve may spoof her by using her identity (e.g., MAC address) in the second message Bob measures, stores and compares channel vectors in consecutive messages, “Who is the current transmitter, Alice or Eve?” Spatial variability of multipath propagation: H A H E (with high probability) Time-invariant channel: Constant H A Alice-Bob-Eve Model 2/15/ HAHA Eve Alice Bob HEHE

Challenge: What If Alice Moves? Channel response, H A, changes quickly as Alice moves Alice may be mistakenly regarded as Eve Larger false alarm rate Larger channel variation, for larger r (displacement of Alice during one frame) Performance worsened by large intervals between data bursts 9 HAHA Alice Bob H’ A r Alice

Inter-Burst Authentication 2/15/ To solve the problem of large channel time variations due to long inter-burst intervals Authentication of the first frames in data bursts Key generation at Alice Based on the channel response at a specified frame in the previous data burst Feedback from the receiver Channel measurement in the TDD system

Intra-Burst Authentication Authentication of the following frames in data bursts Based on channel vectors (each with M elements) from channel estimation at M tones in consecutive frames H A (k-1), H A (k-2), … (Alice) H t (k) (Maybe Alice, maybe Eve) Channel model Receiver thermal noise, AWGN Phase measurement drifts 2/15/

Intra-Burst Authentication -2 Hypothesis testing: H 0 : H 1 : Test statistic: Rejection region of H 0 : False alarm rate, Miss rate, 2/15/ No Spoofing Spoofing!!!

Intra-Burst Authentication -3 Neyman-Pearson test-based scheme: Given, Eve has much larger uncertainty of the channel response than Alice, at time k Test statistic: Recursive least-squares (RLS) adaptive filters-based scheme: M parallel independent RLS filters for channel estimation Eve usually leads to larger RLS estimation error than Alice Test statistic: Larger system overhead: Ensure the previous 3L frames all came from Alice 13

Simulation Scenario Transmitter mobility in wireless Indoor environment Frequency response at 4.75, 5.0, and 5.25 GHz, for any T-R path, as FT of the impulse response, obtained using the Alcatel-Lucent ray-tracing tool WiSE Consider N E =1000 locations of Eve, N A =50 traces of Alice, each with N x =100 frames. In each scenario, N n =5 i.i.d. complex Gaussian thermal noise is generated. 2/15/

Simulation Results 2/15/2016 NP-based statistic has good performance if r<5 mm, corresponding to transmitter velocity of 1.43 mps, with frame duration of 3.5 ms Adaptive filter-based statistic is less robust than NP-based scheme to terminal mobility NP-based RLS-based 15 Alice moves faster

We proposed an enhanced PHY-layer authentication scheme Inter-burst authentication: Channel response in previous burst is used as the key for the authentication of the first frame in the data burst Intra-burst authentication: NP-based test vs. RLS adaptive filter based scheme Verified using a ray-tracing tool (WiSE) for indoor environments NP-based test is more robust against terminal mobility, and more efficient in terms of system overhead and implementation complexity It correctly detects 96% of spoofing attacks, while reduces unnecessary calls of upper-layer authentications by 94%, with transmitters moving at a typical pedestrian speed (1.43 mps), and frame duration of 3.5 ms. Conclusion 2/15/