Consideration on Wake-Up Receiver Security

1. Consideration on Wake-Up Receiver Security Date:2017-06-10 Authors:

2. Introduction • An encryption operation for keeping privacy information safe is generally implemented in high layer (such as, application layer) of OSI model • The critical requirements of cost, implement complexity and power-consuming probably determine that higher layer above MAC shall not be put into the consideration how to make a wake-up receiver (WUR) • Nevertheless, malicious attacks for draining battery and collecting privacy information are threatening its massive deployment

3. Motivation • Care about energy safety of IoT network • So far, finding a reliable energy alternative replacing battery as a power-supply unit for IoT device is still a thorny problem for most proposed application scenarios • Thousands of hostile wake-up bursts from one or multiple illegitimate APs definitely influence service lives of batteries so that jeopardize daily running management of whole IoT network • Care about information safety of things • For the sake of well-monitoring, it’s essential periodically to waken main radio of IoT device equipped with wake-up receiver to report in time status information of stored / transported goods like name, size, temperature, destination etc • A transparent wake-up packet increases the risk of privacy information leakage

4. Typical Scenarios Requiring to Consider Communication Security of Wake-up Receiver Case. 1 Case. 2 AP (Attacker) AP AP AP AP (Attacker) A truck moves into the coverage of an attacker between adjacent APs deployed along a high way , where (broadcast) wake-up packets are continuously transmitted in order to collect more valuable information about transported goods as soon as possible. An attacker around a warehouse is trying to wake up all main radios of IoT devices, aiming to consume more battery power and interfere normal management of network

5. Proposal • Encrypt information bits of wake-up message in PHY layer using a negotiated sequence (key) • Propose to implement a simple and qualified scheme different from sophisticated encryption processing in high layer to block attacks in PHY layer, e.g. scrambling (i.e. ‘XOR’ operation) on all or parts of WUR packet including WUR preamble and data payload. • Undermine the intention to eavesdrop privacy information in a wake-up packet, such as MAC address, AID, or the like which is helpful for a fake AP to actively waken a STA • Not cause a wake-up receiver to trigger a corresponding mechanism to waken main radio of equipment • If acquiring nothing about negotiated sequence, a fake AP only transmits a wake-up packet encrypted with a self-defined sequence. • Therefore, a wake-up receiver will possibly discard decrypted wake-up messages (or, check bits indicate that it’s an error packet) as a result of the difference between the fake AP self-defined and negotiated sequences

6. Proposal (Cont.) • Possible secure key exchange procedure • AP delivers a secure key to a target STA in a WLAN packet • Or, a target STA delivers a secure key to AP in a WLAN packet • Or, AP delivers a secure key to a target STA in a wake-up packet • Not securer than the first and second options

7. Conclusion • Energy and information safety should be paid more attention especially when constructing a commercial IoT network • In this contribution, we proposed to consider a simple and qualified operation in PHY layer as the first gate to guarantee energy and information safety of IoT devices with wake-up receiver

8. Straw Poll • Do you agree to consider the protection of WUR packet in PHY layer?