1. 4/26/2019
Project: IEEE P Working Group for Wireless Personal Area Networks (WPANs)
Submission Title: [Secure Ranging]
Date Submitted: [19 September 2005]
Source: [Zafer Sahinoglu, Philip Orlik, Andy Molisch] Company [Mitsubishi Electric]
Voice:[ ],
Abstract: [Secure Ranging Proposal]
Purpose: [Assist the group to find methods to secure ranging]
Notice: This document has been prepared to assist the IEEE P It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein.
Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P
Zafer Sahinoglu (MERL)

2. 4/26/2019
Objective
To provide security in ranging signaling exchanges such that malicious devices will neither be able to acquire nor jam/manipulate the ranging information
Zafer Sahinoglu (MERL)

3. I want to find where my “thing” is
4/26/2019
Perfect World
No malicious devices in the network
The originator initiates a TW-TOA signaling, and figures out the range to a target device
Perfect World
The
thing
ranging signal
OHH, it is 10 meters away
I want to find where my “thing” is
The
thing
ranging signal
10 meters
Zafer Sahinoglu (MERL)

4. Real World: Snooper Attack-1
4/26/2019
Real World: Snooper Attack-1
A snooper device observes or listens to the signals in the air in secret to obtain information
Real World-I
The
thing
I want to find where my “thing” is
ranging signal
The
thing
ranging signal
OHH, it is 10 meters away
ranging signal
10 meters
ranging signal
Hmm, I learned this and that
The ugly
snooper
The ugly
snooper
Zafer Sahinoglu (MERL)

5. Real World: Impostor Attack-1
4/26/2019
Real World: Impostor Attack-1
An impostor device engages in deception under an assumed name or identity
Lesson: make sure whom you are talking to is an authentic device
Never talk
to strangers
Real World-II
The
thing
ranging signal
Hmm, there is a thing 26 meters away
ranging signal
26 meters
The ugly
impostor
Zafer Sahinoglu (MERL)

6. Real World: Impostor Attack-2
4/26/2019
Real World: Impostor Attack-2
An impostor device engages in deception under an assumed name or identity
Lesson: Don’t believe everything you hear
OHH, it is 24 meters away
The
thing
Ranging signal
Don’t believe
everything
you hear
Ranging
signal
I will tell you where your thing is.
The ugly
impostor
Real World-III
Zafer Sahinoglu (MERL)

7. Real World: Jamming Attack
4/26/2019
Real World: Jamming Attack
A jamming device interferes with or prevent the clear reception of desired signals
Identify existence of a jammer, and back-off for a while
With advanced signal processing techniques, remove the interference from the received signal
OHH, it is 24 meters away
The
thing
Ranging signal
Jamming device
Real World-IV
Zafer Sahinoglu (MERL)

8. Let’s get technical now !!!
4/26/2019
Let’s get technical now !!!
There are three types of ranging signaling
Unsecure fast
Secure (Option-I)
Secure (Option-II)
Zafer Sahinoglu (MERL)

9. 4/26/2019
Unsecure Fast
PHY layers respond to messages without higher layer involvement
Timing imperfections and processing times at higher layers avoided, turn around time is minimized (FAST)
Ranging preamble is unprotected
Target does not know whom it is replying to
Zafer Sahinoglu (MERL)

10. Secure Option – I Involve MAC layer for authentication
4/26/2019
Secure Option – I
Involve MAC layer for authentication
Target device dithers the turn-around time
Target device reports the dither duration in a separate packet
May be still vulnerable to replay attacks even if the dither is randomized
Target is forced to perform ranging on every received packet
We should tell him when to do ranging
Range Packet
Range Packet (ACK)
Timestamp packet
Ranging
notification
ACK
Range notification packet
Zafer Sahinoglu (MERL)

11. Secure Option-II Virtually two-step ranging: Notification and Ranging
4/26/2019
Secure Option-II
Virtually two-step ranging: Notification and Ranging
Notification packet carries ranging parameter settings (e.g., which Ternary sequence to use) , and can be also used for authentication
Ranging packet structure is conventional (preamble + header + payload)
Better solution to replay attacks, because for each ranging process underlying Ternary sequence will be different (sequence space is 6)
Range Packet
Range Packet (ACK)
Timestamp packet
Ranging
notification
ACK
Range notification packet
Zafer Sahinoglu (MERL)

12. 4/26/2019
Option-I vs. Option-II
Both have the same number of messages in the air
Option-II has additional merits
Ranging direction can be stated in the notification packet
A: I want you to know the range between us
A: I want to know the range between us
Notification
packet
Notification
packet
Ranging packet
Ranging packet
Ranging packet
Ranging packet A B A B
“B knows the range”
“A knows the range”
Zafer Sahinoglu (MERL)

13. Option-I vs. Option-II (cont’d)
4/26/2019
Option-I vs. Option-II (cont’d)
Notification packet can be used to do ranging with a sub-set of neighbor nodes (multicast ranging) or all (broadcast ranging)
Message efficiency
Option-I: N*2 messages
Option-II: N+1 messages B B A A 3 2 1 5 C C 1 1 2 3 1 D D 4 6 1 4 S S
Option-II allows multicasting
like ranging, still using TW-TOA
Option-I requires two-way packet exchanges with every ranging neighbor using TW-TOA
- Numbers indicate the index of messages in the air -
Zafer Sahinoglu (MERL)

14. 4/26/2019
Notification Packet
Conventional authentication + ranging waveform settings are conveyed to the target in the encrypted payload of the authentication packet
Preamble
Header
Payload (encrypted)
Code sequence index
Resp.ID-1
ID-1 Start Time (ms)
Range Direction
Reserved
Zafer Sahinoglu (MERL)

15. Requirements A range notification packet that contains
4/26/2019
Requirements
A range notification packet that contains
Index for code identification (which code to use)
Transmission schedules of prospective responders (in ms)
ID of the prospective responders
Ranging direction
Dithering of the turn around time by the responders
Reporting of timestamps and dithers by the responders in a separate packet
Zafer Sahinoglu (MERL)

16. Suggestions Mandatory ranging mode: Optional ranging mode: 4/26/2019
notification
No range notification packet
No dithering of the turn-around time
Reporting of timestamps in a separate packet
A range notification packet that contains
Index for code identification (which code to use)
Transmission schedules of prospective responders (in ms)
ID of the prospective responders
Ranging direction
Dithering of the turn around time by the responders
Reporting of timestamps and dithers by the responders in a separate packet
Zafer Sahinoglu (MERL)

17. 4/26/2019
Thank You
Zafer Sahinoglu (MERL)