L. Xiao, L. Greenstein, N. Mandayam, W. Trappe WINLAB, Dept. ECE, Rutgers University CISS 2008 This work is supported in part by NSF grant CNS MIMO-Assisted Channel-Based Authentication in Wireless Networks

Outline Fingerprints in the Ether/channel-based authentication How to use the multipath fading to improve security? MIMO-assisted authentication Fingerprints in the Ether + MIMO = ? Simulation results Conclusions 1/10/2016 2

Benefits of Multipath Fading CDMA: Rake processing that transforms multipath into a diversity-enhancing benefit MIMO: Transforms scatter-induced Rayleigh fading into a capacity-enhancing benefit Fingerprints in the Ether: Distinguishes channel responses of different paths to enhance authentication 1/10/2016 3

PHY-based Security Techniques Detections of attacks based on the received signal strength: Identity-based attacks in wireless networks [Faria-Cheriton 06] Sybil attacks in sensor networks [Demirbas-Song 06] Spoofing attacks [Chen-Trappe-Martin 07] Detections of attack based on the multipath channel information: Fingerprints in the Ether: Authentication based on channel frequency response [Xiao-Greenstein-Mandayam-Trappe 07] Location distinction based on channel impulse response [Patawari- Kasera 07] Encryption keys establishment [Wilson-Tse-Scholtz 07] 1/10/2016 4

Fingerprints in the Ether Fingerprints in the Ether: In typical indoor environments, the wireless channel decorrelates rapidly in space The channel response is hard to predict and to spoof 1/10/2016 5

Channel-Based Authentication Wireless networks are vulnerable to various identity-based attacks, like spoofing attacks Huge system overhead if every message is protected by upper- layer authentication/encryption Channel-based authentication: Detect attacks for each message, significantly reducing the number of calls for upper-layer authentication Utilize the existing channel estimation mechanism Low system overhead Performance in single-antenna systems has been verified Here we will show the additional gain in MIMO links 1/10/2016 6

Fingerprints + MIMO =? Eve must use the same number of transmit antennas to spoof Alice Better channel resolution: Additional dimension of channel estimation samples provided by MIMO Less transmit power per antenna: Equal power allocation of pilot symbols over transmit antennas (without a priori CSI) Benefits of MIMO techniques: Diversity gain (tradeoff with Multiplexing gain) Security gain: More accurate detection of attacks, when replacing SISO with MIMO 1/10/2016 7

Alice sent the first message If Alice is silent, Eve may spoof her by using her identity (e.g., MAC address) in the second message Bob measures, stores and compares channel vectors in consecutive messages, “Who is the current transmitter, Alice or Eve?” Spatial variability of multipath propagation: H A H E (with high probability) Time-invariant channel: Constant H A System Model 1/10/ HAHA Eve Alice Bob HEHE

Channel Estimation Channel estimation based on pilot symbols at M tones Channel vectors derived from consecutive messages: H 1 (Alice) and H 2 (May be Alice, may be Eve) In N T x N R MIMO systems, both H 1 and H 2 have MN T N R elements Inaccurate channel estimation: AWGN receiver thermal noise model, Unknown phase measurement drifts 1/10/2016 9

MIMO-Assisted Spoofing Detection Hypothesis testing: H 0 : H 1 = H 2 H 1 : H 1 H 2 Test statistic: Rejection region of H 0 : L > Test threshold, k Performance criteria False alarm rate, : The probability of calling the upper-layer authentication unnecessarily Miss rate, : The probability of missing the detection of Eve 1/10/ No Spoofing Spoofing!!!

Performance Summary Detection Performance System BW, W Noise BW, b (NarrowBand) # of receive antennas, N R # of transmit antennas, N T Depends Transmit power per tone, P T Frequency sample size, M 1/10/

Simulation Scenario Verified in a wireless indoor environment, with 405 spatial samples and half wavelength (3 cm) spacing for antennas Frequency response for any T-R path, as FT of the impulse response, obtained using the Alcatel-Lucent ray-tracing tool WiSE The received SNR per tone ranges from dB to 53.6 dB, with a median value of 16 dB, when P T =0.1 mW, SISO systems. 1/10/ Alice & Eve Bob

Simulation Results -1 The use of more receive antennas is always a benefit, while the impact of transmit antenna depends 1/10/ , # of transmit antennas # of receive antennas

Simulation Results -2 MIMO security gain rises with P T, under small M (e.g., M=1); while decreases with P T, o.w. With high P T and small M, SISO systems have accurate but insufficient channel response samples. With high P T and large M, SISO systems have performance too good to be significantly improved. With low P T, the channel estimation is inaccurate, and thus more data are required for a right decision. 14, frequency sample size

Simulation Results -3 The miss rate decreases with the system bandwidth, W Less-correlated frequency samples=> Better resolution among users 1/10/

Simulation Results -4 The miss rate rises with the measurement noise bandwidth, b, in narrowband systems The noise power in the channel estimation is proportional to b 1/10/

We proposed a MIMO-assisted channel-based authentication scheme, and verified its performance in spoofing detection, using a channel-simulation software Conclusion 1/10/ Detection Performance System BW, W Noise BW, b (NarrowBand) # of receive antennas, N R # of transmit antennas, N T Depends Transmit power per tone, P T Frequency sample size, M

References [FC06] Faria, et al, “Detecting identity-based attacks in wireless networks using signalprints,” WiSE, 2006 [DS06] Demirbas, et al, “An RSSI-based scheme for sybil attack detection in wireless sensor networks,” 2006 [CTM07] Chen, et al, “Detecting and localizing wireless spoofing attacks,” 2007 [WTS07] Wilson, et al, “Channel identification: secret sharing using reciprocity in UWB channels,” 2007 [PK07] Patwari, et al, “ Robust location distinction using temporal link signatures,” 2007 [XGMT07] Xiao, et al, “Fingerprints in the Ether: Using the physical layer for wireless authentication,” ICC, /10/