4/26/2019 Project: IEEE P802.15 Working Group for Wireless Personal Area Networks (WPANs) Submission Title: [Secure Ranging] Date Submitted: [19 September 2005] Source: [Zafer Sahinoglu, Philip Orlik, Andy Molisch] Company [Mitsubishi Electric] Voice:[+1 617 621 7588], E-Mail: [zafer@merl.com] Abstract: [Secure Ranging Proposal] Purpose: [Assist the group to find methods to secure ranging] Notice: This document has been prepared to assist the IEEE P802.15. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P802.15. Zafer Sahinoglu (MERL)

4/26/2019 Objective To provide security in ranging signaling exchanges such that malicious devices will neither be able to acquire nor jam/manipulate the ranging information Zafer Sahinoglu (MERL)

I want to find where my “thing” is 4/26/2019 Perfect World No malicious devices in the network The originator initiates a TW-TOA signaling, and figures out the range to a target device Perfect World The thing ranging signal OHH, it is 10 meters away I want to find where my “thing” is The thing ranging signal 10 meters Zafer Sahinoglu (MERL)

Real World: Snooper Attack-1 4/26/2019 Real World: Snooper Attack-1 A snooper device observes or listens to the signals in the air in secret to obtain information Real World-I The thing I want to find where my “thing” is ranging signal The thing ranging signal OHH, it is 10 meters away ranging signal 10 meters ranging signal Hmm, I learned this and that The ugly snooper The ugly snooper Zafer Sahinoglu (MERL)

Real World: Impostor Attack-1 4/26/2019 Real World: Impostor Attack-1 An impostor device engages in deception under an assumed name or identity Lesson: make sure whom you are talking to is an authentic device Never talk to strangers Real World-II The thing ranging signal Hmm, there is a thing 26 meters away ranging signal 26 meters The ugly impostor Zafer Sahinoglu (MERL)

Real World: Impostor Attack-2 4/26/2019 Real World: Impostor Attack-2 An impostor device engages in deception under an assumed name or identity Lesson: Don’t believe everything you hear OHH, it is 24 meters away The thing Ranging signal Don’t believe everything you hear Ranging signal I will tell you where your thing is. The ugly impostor Real World-III Zafer Sahinoglu (MERL)

Real World: Jamming Attack 4/26/2019 Real World: Jamming Attack A jamming device interferes with or prevent the clear reception of desired signals Identify existence of a jammer, and back-off for a while With advanced signal processing techniques, remove the interference from the received signal OHH, it is 24 meters away The thing Ranging signal Jamming device Real World-IV Zafer Sahinoglu (MERL)

Let’s get technical now !!! 4/26/2019 Let’s get technical now !!! There are three types of ranging signaling Unsecure fast Secure (Option-I) Secure (Option-II) Zafer Sahinoglu (MERL)

4/26/2019 Unsecure Fast PHY layers respond to messages without higher layer involvement Timing imperfections and processing times at higher layers avoided, turn around time is minimized (FAST) Ranging preamble is unprotected Target does not know whom it is replying to Zafer Sahinoglu (MERL)

Secure Option – I Involve MAC layer for authentication 4/26/2019 Secure Option – I Involve MAC layer for authentication Target device dithers the turn-around time Target device reports the dither duration in a separate packet May be still vulnerable to replay attacks even if the dither is randomized Target is forced to perform ranging on every received packet We should tell him when to do ranging Range Packet Range Packet (ACK) Timestamp packet Ranging notification ACK Range notification packet Zafer Sahinoglu (MERL)

Secure Option-II Virtually two-step ranging: Notification and Ranging 4/26/2019 Secure Option-II Virtually two-step ranging: Notification and Ranging Notification packet carries ranging parameter settings (e.g., which Ternary sequence to use) , and can be also used for authentication Ranging packet structure is conventional (preamble + header + payload) Better solution to replay attacks, because for each ranging process underlying Ternary sequence will be different (sequence space is 6) Range Packet Range Packet (ACK) Timestamp packet Ranging notification ACK Range notification packet Zafer Sahinoglu (MERL)

4/26/2019 Option-I vs. Option-II Both have the same number of messages in the air Option-II has additional merits Ranging direction can be stated in the notification packet A: I want you to know the range between us A: I want to know the range between us Notification packet Notification packet Ranging packet Ranging packet Ranging packet Ranging packet A B A B “B knows the range” “A knows the range” Zafer Sahinoglu (MERL)

Option-I vs. Option-II (cont’d) 4/26/2019 Option-I vs. Option-II (cont’d) Notification packet can be used to do ranging with a sub-set of neighbor nodes (multicast ranging) or all (broadcast ranging) Message efficiency Option-I: N*2 messages Option-II: N+1 messages B B A A 3 2 1 5 C C 1 1 2 3 1 D D 4 6 1 4 S S Option-II allows multicasting like ranging, still using TW-TOA Option-I requires two-way packet exchanges with every ranging neighbor using TW-TOA - Numbers indicate the index of messages in the air - Zafer Sahinoglu (MERL)

4/26/2019 Notification Packet Conventional authentication + ranging waveform settings are conveyed to the target in the encrypted payload of the authentication packet Preamble Header Payload (encrypted) Code sequence index Resp.ID-1 ID-1 Start Time (ms) Range Direction Reserved Zafer Sahinoglu (MERL)

Requirements A range notification packet that contains 4/26/2019 Requirements A range notification packet that contains Index for code identification (which code to use) Transmission schedules of prospective responders (in ms) ID of the prospective responders Ranging direction Dithering of the turn around time by the responders Reporting of timestamps and dithers by the responders in a separate packet Zafer Sahinoglu (MERL)

Suggestions Mandatory ranging mode: Optional ranging mode: 4/26/2019 notification No range notification packet No dithering of the turn-around time Reporting of timestamps in a separate packet A range notification packet that contains Index for code identification (which code to use) Transmission schedules of prospective responders (in ms) ID of the prospective responders Ranging direction Dithering of the turn around time by the responders Reporting of timestamps and dithers by the responders in a separate packet Zafer Sahinoglu (MERL)

4/26/2019 Thank You Zafer Sahinoglu (MERL)