1. 2/24/2019
Project: IEEE P Working Group for Wireless Personal Area Networks (WPANs)
Submission Title: [Secure Ranging]
Date Submitted: [15 August 2005]
Source: [Zafer Sahinoglu, Philip Orlik, Andy Molisch] Company [Mitsubishi Electric]
Voice:[ ],
Abstract: [Secure Ranging Proposal]
Purpose: [Assist the group to find methods to secure ranging]
Notice: This document has been prepared to assist the IEEE P It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein.
Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P
Zafer Sahinoglu (MERL)

2. 2/24/2019
Objective
To provide security in ranging signaling exchanges such that malicious devices will neither be able to acquire nor jam/manipulate the ranging information
Zafer Sahinoglu (MERL)

3. I want to find where my “thing” is
2/24/2019
Perfect World
No malicious devices in the network
The originator initiates a TW-TOA signaling, and figures out the range to a target device
Perfect World
The
thing
ranging signal
OHH, it is 10 meters away
I want to find where my “thing” is
The
thing
ranging signal
10 meters
Zafer Sahinoglu (MERL)

4. Real World: Snooper Attack-1
2/24/2019
Real World: Snooper Attack-1
A snooper device observes or listens to the signals in the air in secret to obtain information
Real World-I
The
thing
I want to find where my “thing” is
ranging signal
The
thing
ranging signal
OHH, it is 10 meters away
ranging signal
10 meters
ranging signal
Hmm, I learned this and that
The ugly
snooper
The ugly
snooper
Zafer Sahinoglu (MERL)

5. Real World: Impostor Attack-1
2/24/2019
Real World: Impostor Attack-1
An impostor device engages in deception under an assumed name or identity
Lesson: make sure whom you are talking to is an authentic device
Never talk
to strangers
Real World-II
The
thing
ranging signal
Hmm, there is a thing 26 meters away
ranging signal
26 meters
The ugly
impostor
Zafer Sahinoglu (MERL)

6. Real World: Impostor Attack-2
2/24/2019
Real World: Impostor Attack-2
An impostor device engages in deception under an assumed name or identity
Lesson: Don’t believe everything you hear
OHH, it is 24 meters away
The
thing
Ranging signal
Don’t believe
everything
you hear
Ranging
signal
I will tell you where your thing is.
The ugly
impostor
Real World-III
Zafer Sahinoglu (MERL)

7. Real World: Jamming Attack
2/24/2019
Real World: Jamming Attack
A jamming device interferes with or prevent the clear reception of desired signals
Identify existence of a jammer, and back-off for a while
With advanced signal processing techniques, remove the interference from the received signal
OHH, it is 24 meters away
The
thing
Ranging signal
Jamming device
Real World-IV
Zafer Sahinoglu (MERL)

8. Let’s get technical now !!!
2/24/2019
Let’s get technical now !!!
There are three types of ranging signaling
Insecure fast
Secure slow
Secure fast
Zafer Sahinoglu (MERL)

9. 2/24/2019
Unsecure Fast
PHY layers respond to messages without higher layer involvement
Timing imperfections and processing times at higher layers avoided, turn around time is minimized (FAST)
Ranging preamble is unprotected
Target does not whom it is replying to
Zafer Sahinoglu (MERL)

10. 2/24/2019
Secure Slow
PHY layer replies after receiving authentication approval from higher layers
High turn-around time and timing imperfections would degrade ranging accuracy (SLOW)
Ranging preamble is still unprotected
An impostor can still deceive the originator
Zafer Sahinoglu (MERL)

11. Secure Fast Two-step ranging: Authentication and Ranging
2/24/2019
Secure Fast
Two-step ranging: Authentication and Ranging
Turn around time is kept at minimum, or randomly manipulated to add more security
Snoopers will receive worthless or no information
Impostors will be avoided
Zafer Sahinoglu (MERL)

12. Authentication Step Ranging Step
2/24/2019
Authentication Step
Conventional authentication + ranging waveform settings are conveyed to the target in the encrypted payload of the authentication packet
Authentication Packet Structure
Ranging Step
Ranging symbol (modified) is repeated
No need for header or payload
Ranging Packet Structure
Zafer Sahinoglu (MERL)

13. Ranging Waveforms for Security
2/24/2019
Ranging Waveforms for Security
Ternary-IR
Time-hopping-IR
Zafer Sahinoglu (MERL)

14. Ternary-IR Perfect periodic correlation Six length-31 such codes exist
2/24/2019
Ternary-IR
Perfect periodic correlation
Six length-31 such codes exist
Circularly shifting a Ternary sequence moves the periodic autocorrelation function as much as the shift
Zafer Sahinoglu (MERL)

15. 2/24/2019
Ternary-IR
Illustration of correlator outputs with and without circular shifts
(S1 circularly shifted by 5)
PRI =15ns , k=5 => The autocorrelation peak shifts by 75ns => 25m deviation
Zafer Sahinoglu (MERL)

16. Security Tool with Ternary-IR
2/24/2019
Security Tool with Ternary-IR
The originator and the target decide on both a Ternary sequence and the shift amount to use
Conveyed within the authentication packet
Ranging symbol consists of the repetitions of the shifted symbol waveform
Any snooper or impostor may still observe the signal. However, without the knowledge of the shift, they will end up with useless information
This effect is equivalent to randomizing the turn-around time
Longer turn-around time will hit into clock drift problems
Security level vs. ranging accuracy trade-off
Zafer Sahinoglu (MERL)

17. Time-hopping IR Larger family than Ternary-IR (+)
2/24/2019
Time-hopping IR
Larger family than Ternary-IR (+)
Autocorrelation properties are not as good as Ternary’s (-)
Zero correlation zone (ZCZ) around the correlation peak can still be generated by proper code selection
If any two TH codes don’t match, the ZCZ gets perturbed
Helps against impostors and snoopers who don’t know the exact code
Zafer Sahinoglu (MERL)

18. Time Hopping-IR for Secure Ranging
2/24/2019
Time Hopping-IR for Secure Ranging
The originator and the target decide on a TH code within the payload of the authentication packet and use it for ranging
It is less likely for a malicious device to track the right TH code
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH1
TH2
Zafer Sahinoglu (MERL)

19. What is a MUST for Secure Ranging?
2/24/2019
What is a MUST for Secure Ranging?
A range authentication packet
Should contain information about the range waveform
Range waveform should be changed each time a ranging is performed
A range packet
Header and payload are not necessary. IDs are implicitly represented by the selected ranging waveform
Eliminates higher layer involvement
Manipulation of turn-around time is another security tool
Advanced signal processing at the receiver ends to filter out jamming interference
Zafer Sahinoglu (MERL)

20. 2/24/2019
Thank You
Zafer Sahinoglu (MERL)