A Physical-Layer Technique to Enhance Authentication for Mobile Terminals

1. A Physical-Layer Technique to Enhance Authentication for Mobile Terminals L. Xiao, L. Greenstein, N. Mandayam, W. Trappe WINLAB, Dept. ECE, Rutgers University lxiao@winlab.rutgers.edu ICC 2008 This work is supported in part by NSF grant CNS-0626439

2. Outline • Channel-based authentication • Challenge: Terminal mobility • Enhanced channel-based authentication • Inter-burst authentication • Intra-burst authentication • Simulation results • Conclusion

3. PHY-based Security Techniques

4. Benefits of Multipath Fading • CDMA: Rake processing that transforms multipath into a diversity-enhancing benefit • MIMO: Transforms scatter-induced Rayleigh fading into a capacity-enhancing benefit • Fingerprints in the Ether: Distinguishes channel responses of different paths to enhance authentication

5. Fingerprints in the Ether • Fingerprints in the Ether: • In typical indoor environments, the wireless channel decorrelates rapidly in space • The channel response is hard to predict and to spoof Top View of Alcatel-Lucent’s Crawford Hill Laboratory, Holmdel, NJ

6. Channel-Based Authentication • Wireless networks are vulnerable to various identity-based attacks, like spoofing attacks • System overhead can be large if every message is protected by upper-layer authentication/encryption • Channel-based authentication: • Detect attacks for each message, significantly reducing the number of calls for upper-layer authentication • Works well under time-invariant channels and stationary terminals in spoofing detection

7. System Model • Multicarrier systems, e.g., OFDM • Also applies to single-carrier systems • Each burst contains multiple frames • Each frame (with duration of T) contains pilot symbols at M subbands • Reuse the existing channel estimation mechanism Data transmission

8. Alice-Bob-Eve Model Alice HA • Alice sent the first message • If Alice is silent, Eve may spoof her by using her identity (e.g., MAC address) in the second message • Bob measures, stores and compares channel vectors in consecutive messages, “Who is the current transmitter, Alice or Eve?” • Spatial variability of multipath propagation: HA HE (with high probability) • Time-invariant channel: Constant HA Bob HE Eve

9. Challenge: What If Alice Moves? • Channel response, HA, changes quickly as Alice moves • Alice may be mistakenly regarded as Eve • Larger false alarm rate • Larger channel variation, for larger r (displacement of Alice during one frame) • Performance worsened by large intervals between data bursts HA H’A r Bob Alice Alice

10. Inter-Burst Authentication • To solve the problem of large channel time variations due to long inter-burst intervals • Authentication of the first frames in data bursts • Key generation at Alice • Based on the channel response at a specified frame in the previous data burst • Feedback from the receiver • Channel measurement in the TDD system

11. Intra-Burst Authentication • Authentication of the following frames in data bursts • Based on channel vectors (each with Melements) from channel estimation at M tones in consecutive frames • HA (k-1), HA (k-2), … (Alice) • Ht (k) (Maybe Alice, maybe Eve) • Channel model • Receiver thermal noise, AWGN • Phase measurement drifts

12. Intra-Burst Authentication -2 • Hypothesis testing: H0: H1: • Test statistic: • Rejection region of H0 : • False alarm rate, • Miss rate, No Spoofing Spoofing!!!

13. Intra-Burst Authentication -3 • Neyman-Pearson test-based scheme: • Given , Eve has much larger uncertainty of the channel response than Alice, at time k • Test statistic: • Recursive least-squares (RLS) adaptive filters-based scheme: • M parallel independent RLS filters for channel estimation • Eve usually leads to larger RLS estimation error than Alice • Test statistic: • Larger system overhead: Ensure the previous 3L frames all came from Alice

14. Simulation Scenario • Transmitter mobility in wireless Indoor environment • Frequency response at 4.75, 5.0, and 5.25 GHz, for any T-R path, as FT of the impulse response, obtained using the Alcatel-Lucent ray-tracing tool WiSE • Consider NE=1000 locations of Eve, NA=50 traces of Alice, each with Nx=100 frames. In each scenario, Nn=5 i.i.d. complex Gaussian thermal noise is generated.

15. Simulation Results • NP-based statistic has good performance if r<5 mm, corresponding to transmitter velocity of 1.43 mps, with frame duration of 3.5 ms • Adaptive filter-based statistic is less robust than NP-based scheme to terminal mobility Alice moves faster Alice moves faster NP-based RLS-based

16. Conclusion • We proposed an enhanced PHY-layer authentication scheme • Inter-burst authentication: Channel response in previous burst is used as the key for the authentication of the first frame in the data burst • Intra-burst authentication: NP-based test vs. RLS adaptive filter based scheme • Verified using a ray-tracing tool (WiSE) for indoor environments • NP-based test is more robust against terminal mobility, and more efficient in terms of system overhead and implementation complexity • It correctly detects 96% of spoofing attacks, while reduces unnecessary calls of upper-layer authentications by 94%, with transmitters moving at a typical pedestrian speed (1.43 mps), and frame duration of 3.5 ms.