Effectiveness of distance-decreasing attacks against impulse radio ranging

Abstract

We expose the vulnerability of an emerging wireless ranging technology, impulse radio ultra-wide band (IR-UWB), to distance-decreasing attacks on the physical communication layer (PHY). These attacks violate the security of secure ranging protocols that allow two wireless devices to securely estimate the distance between them, with the guarantee that the estimate is an upper-bound on the actual distance. Such protocols serve as crucial building blocks in security-sensitive applications such as location tracking, physical access control, or localization.Prior works show the theoretical possibility of PHY attacks bypassing cryptographic mechanisms used by secure ranging protocols. They also demonstrates that for physical layers used in ISO 14443 RFID and wireless sensor networks, some PHY attacks are indeed feasible. IR-UWB was proposed as a possible solution, but we show that the de facto standard for IR-UWB, IEEE 802.15.4a, does not automatically provide security against such attacks. We find that with the mandatory modes of the standard an external attacker can decrease the measured distance by as much as 140 meters with a high probability (above 99%).

Distance Bounding with IEEE 802.15.4a: Attacks and Countermeasures

“…The effectiveness of these attacks against concrete PHYs is studied in [14] (ISO 14443 RFID and wireless sensor networks) and [4] (IEEE 802.15.4a).…”

“…A detailed discussion of these delays can be found in [4]. In short, it should be feasible to keep these delays in the order of 10-30ns (below 10m).…”

“…For the energy detector against energy detector setting, a detailed performance evaluation of the ED and LC components, as well as of their combination in the case of the relay attack, was already presented in our previous paper [4] as well as in [26]. For a detailed discussion of the results, as well as alternative energy-detection receivers (which show similar performance), we therefore refer the reader there.…”

“…This is exactly the problem we address in this paper: We evaluate the effectiveness of distancedecreasing PHY attacks against the IEEE 802.15.4a standard. We extend our previous work [4] by considering different types of receivers, and malicious prover attacks (internal) in addition to distance-decreasing relay attacks (external). We also examine countermeasures that can mitigate PHY attacks, while minimally degrading the benign-case performance.…”

“…It allows the adversary to decrease the distance more substantially than the attacks in [4], or to mount an undetectable (hence unpreventable) attack with a more modest, but still substantial distance-decrease. The anomaly can be patched with a small modification to IEEE 802.…”