UWB with Pulse Reordering: Securing Ranging against Relay and Physical Layer Attacks

Singh, Mridula; Leu, P.; Čapkun, Srđjan

doi:10.29007/8v3t

Cited by 45 publications

(30 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…4.4.5 Cryptographic Protection. Prior works on secure ranging systems demonstrated that protecting exchanged data is insufficient, in addition, one needs to protect the measurement exchange [11,53]. As a result, using typical network protection (e.g., WPA3-Personal) is insufficient to fundamentally secure the protocol.…”

Section: Localization Systemsmentioning

confidence: 99%

Here, there, and everywhere

Schepers

Singh

Ranganathan

2021

Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

Self Cite

View full text Add to dashboard Cite

Today, an increasing number of applications rely on location and proximity information to deliver services. With the introduction of Wi-Fi Fine Timing Measurement (FTM) in the IEEE 802.11-2016 standard, Wi-Fi derived location and proximity information will play a key role in many safety-and security-critical applications. For example, Wi-Fi FTM is adopted in Wi-Fi Aware where it enables geo-fencing and mobile identification. In this paper, we perform the first security analysis of Wi-Fi FTM and analyze its security guarantees across the logical and physical layers. We find various weaknesses that enable an attacker to introduce distance reductions and enlargements to any arbitrary attacker-chosen value, requiring commodity hardware only. We perform an evaluation using commercial access points, smartphones, and off-the-shelf Wi-Fi cards, and show that an attacker can manipulate distances with meter-level precision. Furthermore, we highlight the distance manipulation attacks which are independent of any higher-layer cryptographic protection, exposing fundamental limitations to achieving secure distance measurements in the current standard. Finally, we present security recommendations for the design and implementation of Wi-Fi FTM and next-generation positioning protocols. CCS CONCEPTS• Networks → Mobile and wireless security.

show abstract

Section: Localization Systemsmentioning

confidence: 99%

Here, there, and everywhere

Schepers

Singh

Ranganathan

2021

Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

Self Cite

View full text Add to dashboard Cite

show abstract

“…Since UWB is a distance-based protocol, it is vulnerable to physical layer attacks, such as the early detection and late commit (ED/LC) attack described in Singh et al [ 146 ].…”

Section: Security In Iomt Communication Protocolsmentioning

confidence: 99%

“…This aims to mitigate physical-layer attacks that exploit node distancing, while retaining the range and performance of the extended mode. According to Singh et al [ 146 ], UWB with pulse reordering (UWB-PR) is the first modulation technique to prevent ED/LC attacks independently of the communication range offered.…”

Section: Security In Iomt Communication Protocolsmentioning

confidence: 99%

Security in IoMT Communications: A Survey

Koutras

Stergiopoulos

Dasaklis

et al. 2020

Sensors

113

View full text Add to dashboard Cite

The Internet of Medical Things (IoMT) couples IoT technologies with healthcare services in order to support real-time, remote patient monitoring and treatment. However, the interconnectivity of critical medical devices with other systems in various network layers creates new opportunities for remote adversaries. Since most of the communication protocols have not been specifically designed for the needs of connected medical devices, there is a need to classify the available IoT communication technologies in terms of security. In this paper we classify IoT communication protocols, with respect to their application in IoMT. Then we describe the main characteristics of IoT communication protocols used at the perception, network and application layer of medical devices. We examine the inherent security characteristics and limitations of IoMT-specific communication protocols. Based on realistic attacks we identify available mitigation controls that may be applied to secure IoMT communications, as well as existing research and implementation gaps.

show abstract

“…However, several researches show that the range measurement in the current technology is prone to external attacks. Francillon et al [ 15 ] present a relay attack, Taponecco et al [ 16 ] show a delay attack and Singh et al [ 17 ] propose a modulation scheme that secures the distance measurement against relay attack. The EiR project [ 1 ] brings a lot of improvements, including UWB reference pulse shape, preamble symbols revision, addition of scrambled timestamp sequence for secure ranging, an increase in data rate and PHY payload length, and the modification and addition of a new MAC primitive for key management.…”

Section: Literature Reviewmentioning

confidence: 99%

Timestamp Estimation in P802.15.4z Amendment

Domuta

Palade

Puşchiţă

et al. 2020

Sensors

View full text Add to dashboard Cite

Due to the known issue that the ranging in the 802.15.4™-2015 standard is prone to external attacks, the enhanced impulse radio (EiR), a new amendment still under development, advances the secure ranging protocol by encryption of physical layer (PHY) timestamp sequence using the AES-128 encryption algorithm. This new amendment brings many changes and enhancements which affect the impulse-radio ultra-wideband (IR-UWB) ranging procedures. The timestamp detection is the base factor in the accuracy of range estimation and inherently in the localization precision. This paper analyses the key parts of PHY which have a great contribution in timestamp estimation precision, particularly: UWB pulse, channel sounding and timestamp estimation using ciphered sequence and frequency selective fading. Unlike EiR, where the UWB pulse is defined in the time domain, in this article, the UWB pulse is synthesized from the power spectral density mask, and it is shown that the use of the entire allocated spectrum results in a decrease in risetime, an increase in pulse amplitude, and an attenuation of lateral lobes. The paper proposes a random spreading of the scrambled timestamp sequence (STS), resulting in an improvement in timestamp estimation by the attenuation lateral lobes of the correlation. The timestamp estimation in the noisy channels with non-line-of-sight and multipath propagation is achieved by cross-correlation of the received STS with the locally generated replica of STS. The propagation in the UWB channel with frequency selective fading results in small errors in the timestamp detection.

show abstract

UWB with Pulse Reordering: Securing Ranging against Relay and Physical Layer Attacks

Cited by 45 publications

References 7 publications

Here, there, and everywhere

Here, there, and everywhere

Security in IoMT Communications: A Survey

Timestamp Estimation in P802.15.4z Amendment

Contact Info

Product

Resources

About