1. Consideration on Wake-Up Receiver Security
doc.: IEEE yy/XXXXr0
Month Year
Consideration on Wake-Up Receiver Security
Date:
Authors:
Name
Affiliation
Address
Wei Ning
ZTE Corp.
Kaiying Lv

2. Introduction
An encryption operation for keeping privacy information safe is generally implemented in high layer (such as, application layer) of OSI model
The critical requirements of cost, implement complexity and power-consuming probably determine that higher layer above MAC shall not be put into the consideration how to make a wake-up receiver (WUR)
Nevertheless, malicious attacks for draining battery and collecting privacy information are threatening its massive deployment

3. Motivation Care about energy safety of IoT network
So far, finding a reliable energy alternative replacing battery as a power-supply unit for IoT device is still a thorny problem for most proposed application scenarios
Thousands of hostile wake-up bursts from one or multiple illegitimate APs definitely influence service lives of batteries so that jeopardize daily running management of whole IoT network
Care about information safety of things
For the sake of well-monitoring, it’s essential periodically to waken main radio of IoT device equipped with wake-up receiver to report in time status information of stored / transported goods like name, size, temperature, destination etc
A transparent wake-up packet increases the risk of privacy information leakage

4. Typical Scenarios Requiring to Consider Communication Security of Wake-up Receiver
Case. 1
Case. 2
AP (Attacker) AP
(Attacker)
A truck moves into the coverage of an attacker between adjacent APs deployed along a high way , where (broadcast) wake-up packets are continuously transmitted in order to collect more valuable information about transported goods as soon as possible.
An attacker around a warehouse is trying to wake up all main radios of IoT devices, aiming to consume more battery power and interfere normal management of network

5. Proposal
Encrypt information bits of wake-up message in PHY layer using a negotiated sequence (key)
Propose to implement a simple and qualified scheme different from sophisticated encryption processing in high layer to block attacks in PHY layer, e.g. scrambling (i.e. ‘XOR’ operation) on all or parts of WUR packet including WUR preamble and data payload.
Undermine the intention to eavesdrop privacy information in a wake-up packet, such as MAC address, AID, or the like which is helpful for a fake AP to actively waken a STA
Not cause a wake-up receiver to trigger a corresponding mechanism to waken main radio of equipment
If acquiring nothing about negotiated sequence, a fake AP only transmits a wake-up packet encrypted with a self-defined sequence.
Therefore, a wake-up receiver will possibly discard decrypted wake-up messages (or, check bits indicate that it’s an error packet) as a result of the difference between the fake AP self-defined and negotiated sequences

6. Proposal (Cont.) Possible secure key exchange procedure
AP delivers a secure key to a target STA in a WLAN packet
Or, a target STA delivers a secure key to AP in a WLAN packet
Or, AP delivers a secure key to a target STA in a wake-up packet
Not securer than the first and second options

7. Conclusion
Energy and information safety should be paid more attention especially when constructing a commercial IoT network
In this contribution, we proposed to consider a simple and qualified operation in PHY layer as the first gate to guarantee energy and information safety of IoT devices with wake-up receiver

8. Straw Poll
Do you agree to consider the protection of WUR packet in PHY layer?