Using Channel State Information for Tamper Detection in the Internet of Things

ABSTRACT

The Internet of Things (IoT) is increasingly used for critical applications and securing the IoT has become a major concern. Among other issues it is important to ensure that tampering with IoT devices is detected. Many IoT devices use WiFi for communication and Channel State Information (CSI) based tamper detection is a valid option. Each 802.11n WiFi frame contains a preamble which allows a receiver to estimate the impact of the wireless channel, the transmitter and the receiver on the signal. The estimation result - the CSI - is used by a receiver to extract the transmitted information. However, as the CSI depends on the communication environment and the transmitter hardware, it can be used as well for security purposes. If an attacker tampers with a transmitter it will have an effect on the CSI measured at a receiver. Unfortunately not only tamper events lead to CSI fluctuations; movement of people in the communication environment has an impact too. We propose to analyse CSI values of a transmission simultaneously at multiple receivers to improve distinction of tamper and movement events. A moving person is expected to have an impact on some but not all communication links between transmitter and the receivers. A tamper event impacts on all links between transmitter and the receivers. The paper describes the necessary algorithms for the proposed tamper detection method. In particular we analyse the tamper detection capability in practical deployments with varying intensity of people movement. In our experiments the proposed system deployed in a busy office environment was capable to detect 53% of tamper events (TPR = 53%) while creating zero false alarms (FPR = 0%).

References

1. I. E. Bagci, U. Roedig, M. Schulz, and M. Hollick. Short Paper: Gathering Tamper Evidence in Wi-fi Networks Based on Channel State Information. In Proc. Wisec'14, 2014.
2. M. Bor, A. King, and U. Roedig. Lifetime bounds of Wi-Fi Enabled Sensor Nodes. In Proc. IUPT'15, 2015.
3. V. Brik, S. Banerjee, M. Gruteser, and S. Oh. Wireless Device Identification with Radiometric Signatures. In Proc. MobiCom'08, 2008.
4. B. Danev and S. Capkun. Transient-based Identification of Wireless Sensor Nodes. In Proc. IPSN'09, 2009.
5. B. Danev, T. S. Heydt-Benjamin, and S. Capkun. Physical-layer Identification of RFID Devices. In Proc. USENIX'09, 2009.
6. B. Danev, D. Zanetti, and S. Capkun. On Physical-layer Identification of Wireless Devices. ACM Comput. Surv., 45(1):6, 2012.
7. D. B. Faria and D. R. Cheriton. Detecting identity-based attacks in wireless networks using signalprints. In Proc. WiSe'06, 2006.
8. D. Halperin, W. Hu, A. Sheth, and D. Wetherall. Tool Release: Gathering 802.11n Traces with Channel State Information. ACM SIGCOMM CCR, 41(1):53, 2011.
9. IEEE 802.11 Working Group. IEEE 802.11n-2009. IEEE Std, 802:1--51, 2010.
10. Z. Jiang, J. Zhao, X.-Y. Li, J. Han, and W. Xi. Rejecting the Attack: Source Authentication for Wi-Fi Management Frames using CSI Information. In Proc. INFOCOM'13, 2013.
11. Z. Li, W. Xu, R. Miller, and W. Trappe. Securing wireless systems via lower layer enforcements. In Proc. WiSe'06, 2006.
12. P. C. Mahalanobis. On the generalized distance in statistics. Proceedings of the National Institute of Sciences (Calcutta), 2:49--55, 1936.
13. N. Patwari and S. K. Kasera. Robust location distinction using temporal link signatures. In Proc. MobiCom'07, 2007.
14. Y. Rubner, C. Tomasi, and L. J. Guibas. The earth mover's distance as a metric for image retrieval. International journal of computer vision, 40(2):99--121, 2000.
15. O. Ureten and N. Serinken. Wireless security through RF fingerprinting. Electrical and Computer Engineering, Canadian Journal of, 32(1):27--33, 2007.
16. J. Xiong and K. Jamieson. SecureArray: Improving Wifi Security with Fine-grained Physical-layer Information. In Proc. MobiCom'13, 2013.
17. J. Zhang, M. H. Firooz, N. Patwari, and S. K. Kasera. Advancing Wireless Link Signatures for Location Distinction. In Proc. MobiCom'08, 2008.

Index Terms

• Networks

  • Network services

    • Network monitoring