ProxiMate : Proximity Based Secure Pairing using Ambient Wireless Signals

Size: px

Start display at page:

Download "ProxiMate : Proximity Based Secure Pairing using Ambient Wireless Signals"

Esther Hart
5 years ago
Views:

1 ProxiMate : Proximity Based Secure Pairing using Ambient Wireless Signals Suhas Mathur AT&T Security Research Group Rob Miller, Alex Varshavsky, Wade Trappe, Narayan Madayam Suhas Mathur (AT&T) firstname AT att.com ACM Mobisys, 30 June 2011

2 Overview 1 The Secure Pairing problem 2 How wireless channels can help 3 ProxiMate in detail Suhas Mathur (AT&T) firstname AT att.com ACM Mobisys, 30 June 2011

3 The Secure Pairing problem

4 Alice & Bob have no prior trust relationship Alice Bob

5 Alice & Bob have no prior trust relationship They d like to exchange a secret message. Alice Bob

6 Alice & Bob have no prior trust relationship They d like to exchange a secret message. Alice Bob Eve

7 But they don t share a key Alice Bob Eve

8 Alice? Bob Eve

9 Alice Diffie Hellman key exchange Bob Eve

10 Alice Diffie Hellman key exchange Bob Eve Computational Secrecy (Computationally bounded Eve) k = key, Y = Eve s observations It is computationally infeasible to compute k from Y.

11 Alice Diffie Hellman key exchange Bob Eve But how does Alice know that she is talking to Bob? Easy to spoof identity on the wireless channel, when there is no prior trust relationship.

12 How can Wireless Channels help?

13 What is a Wireless Channel?

14 What is a Wireless Channel? It is the distortion h(t) produced by environment between transmitter and receiver = a randomly varying complex number (= a + j.b)

15 What is a Wireless Channel? It is the distortion h(t) produced by environment between transmitter and receiver = a randomly varying complex number (= a + j.b)

16 What is a Wireless Channel? It is the distortion h(t) produced by environment between transmitter and receiver = a randomly varying complex number (= a + j.b) h(t) decorrelates in space and time: Space: Over distances of λ/2 (= GHz) Time: Over one coherence time T c ( 100s of 2.4 GHz)

17 ProxiMate: Use a public RF source for secure pairing

18 ProxiMate: Use a public RF source for secure pairing

19 ProxiMate: Use a public RF source for secure pairing Assumption: Alice-Bob closer to each other than to Eve

20 Provides Alice & Bob (but not Eve) with a continuous, private source of randomness

21 Provides Alice & Bob (but not Eve) with a continuous, private source of randomness ProxiMate: 1 Use this source to generate a secret key at Alice and Bob

22 Provides Alice & Bob (but not Eve) with a continuous, private source of randomness ProxiMate: 1 Use this source to generate a secret key at Alice and Bob 2 If K alice = K Bob, then Alice & Bob know they are in proximity

23 Provides Alice & Bob (but not Eve) with a continuous, private source of randomness ProxiMate: 1 Use this source to generate a secret key at Alice and Bob 2 If K alice = K Bob, then Alice & Bob know they are in proximity 3 Use the key for encrypting all further communication.

24 ProxiMate in detail

25 Example trace 6 5 x 10 4 Alice Bob Amplitude Time (Sec) Peter-to-Alice and Peter-to-Bob channels FM radio, 88.7 MHz Alice and Bob are 34 cm = wavelength 10 apart.

26 A & B locally compute quantizer threshold (e.g. median) 6 5 x 10 4 Alice Bob Amplitude Time (Sec) Peter-to-Alice and Peter-to-Bob channels FM radio, 88.7 MHz Alice and Bob are 34 cm = wavelength 10 apart.

27 Quantize at intervals > Coherence time 6 5 x 10 4 Alice Bob Amplitude Time (Sec) Bits obtained by Alice and Bob: A s Bits: = w. B s Bits: = w

28 A & B want identical keys, of which Eve knows nothing

29 A & B want identical keys, of which Eve knows nothing A s Bits: = w. B s Bits: = w

30 A & B want identical keys, of which Eve knows nothing A s Bits: = w. B s Bits: = w 1 A sends B code-offset P of w wrt a codeword c 1 in known code C.

31 A & B want identical keys, of which Eve knows nothing A s Bits: = w. B s Bits: = w 1 A sends B code-offset P of w wrt a codeword c 1 in known code C. 2 B uses P along with w to determine w.

32 A & B want identical keys, of which Eve knows nothing A s Bits: = w. B s Bits: = w 1 A sends B code-offset P of w wrt a codeword c 1 in known code C. 2 B uses P along with w to determine w. 3 Eliminate information leaked out to Eve via P by discarding H(P) bits.

33 Experimental evaluation

34 Experimental evaluation

35 Experimental evaluation 1 USRP/GNUradio - bridges the physical & software worlds.

36 Experimental evaluation 1 USRP/GNUradio - bridges the physical & software worlds. 2 TV channels ( 600 MHz) and FM channels ( 100 MHz)

37 Experimental evaluation 1 USRP/GNUradio - bridges the physical & software worlds. 2 TV channels ( 600 MHz) and FM channels ( 100 MHz) 3 Metrics of interest:

38 Experimental evaluation 1 USRP/GNUradio - bridges the physical & software worlds. 2 TV channels ( 600 MHz) and FM channels ( 100 MHz) 3 Metrics of interest: Rate (secret bits per sec)

39 Experimental evaluation 1 USRP/GNUradio - bridges the physical & software worlds. 2 TV channels ( 600 MHz) and FM channels ( 100 MHz) 3 Metrics of interest: Rate (secret bits per sec) Bit-error-rate (fraction of bits that differ at A & B)

$2 TV channels ( 600 MHz) and FM channels ( 100 MHz) 3 Metrics of interest: Rate (secret bits per sec) Bit-error-rate (fraction of bits that differ at A$

40 Experimental evaluation 1 USRP/GNUradio - bridges the physical & software worlds. 2 TV channels ( 600 MHz) and FM channels ( 100 MHz) 3 Metrics of interest: Rate (secret bits per sec) Bit-error-rate (fraction of bits that differ at A & B) Mutual Information: Statistical dependence between two quantities

41 Bit-error-rate Vs. distance between two receivers Fraction of bits that differ (ε) TV FM Distance between receivers (in λ)

42 Shaking devices helps Rate

43 Shaking devices helps Rate 1 Coherence time T c 1/Rate estimated using level crossing rate.

44 Shaking devices helps Rate 1 Coherence time T c 1/Rate estimated using level crossing rate. 2 T c can be increased if Alice and Bob physically shaken together.

45 Shaking devices helps Rate 1 Coherence time T c 1/Rate estimated using level crossing rate. 2 T c can be increased if Alice and Bob physically shaken together. Coherence time estimates Time (sec) Stationary moving slowly moving fast Time (Sec) Stationary moving slowly moving fast TV FM

46 Shaking devices helps Rate 1 Coherence time T c 1/Rate estimated using level crossing rate. 2 T c can be increased if Alice and Bob physically shaken together. Coherence time estimates Time (sec) Stationary moving slowly moving fast Time (Sec) Stationary moving slowly moving fast TV FM 2x in rate by shaking.

47 Shaking devices helps Rate 1 Coherence time T c 1/Rate estimated using level crossing rate. 2 T c can be increased if Alice and Bob physically shaken together. Coherence time estimates Time (sec) Stationary moving slowly moving fast Time (Sec) Stationary moving slowly moving fast TV FM 2x in rate by shaking. Shaking also provides resistance to passive attackers within λ/2!

48 Monitoring multiple sources

49 Monitoring multiple sources

50 Monitoring multiple sources

51 Monitoring multiple sources Rate # of Independent sources of randomness.

52 Number of seconds needed for a 128-bit key with 10 sources Stationary Moving slow Moving fast TV FM Prob(Key mismatch) 10 4

53 What if Eve controls the transmitter? (i.e. Eve = Peter)

54 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 Eve free to vary the transmit signal however she wants

55 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 Eve free to vary the transmit signal however she wants 2 Can Alice & Bob extract bits about which Eve has no information?

56 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 Eve free to vary the transmit signal however she wants 2 Can Alice & Bob extract bits about which Eve has no information? 3 Using Magnitude: No!

57 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 Eve free to vary the transmit signal however she wants 2 Can Alice & Bob extract bits about which Eve has no information? 3 Using Magnitude: No!

58 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 Eve free to vary the transmit signal however she wants 2 Can Alice & Bob extract bits about which Eve has no information? 3 Using Magnitude: No! 4 Using Phase: Yes! Because phase wraps around after 2π

59 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 But Local Alice and Bob are not synchronized. Thus, only change in phase at A & B will be similar in value.

60 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 But Local Alice and Bob are not synchronized. Thus, only change in phase at A & B will be similar in value. 2 Approach: We use differential phase across T c

61 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 But Local Alice and Bob are not synchronized. Thus, only change in phase at A & B will be similar in value. 2 Approach: We use differential phase across T c 3 To test, we let Eve transmit a recorded FM signal

62 What if Eve controls the transmitter? (i.e. Eve = Peter) 1 But Local Alice and Bob are not synchronized. Thus, only change in phase at A & B will be similar in value. 2 Approach: We use differential phase across T c 3 To test, we let Eve transmit a recorded FM signal 4 Eve knows almost nothing about diff-phase at Alice & Bob.

63 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity.

64 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity. 2 Secure against even a computationally unbounded adversary.

65 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity. 2 Secure against even a computationally unbounded adversary. 3 Prob. of key mismatch can be driven to 0.

66 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity. 2 Secure against even a computationally unbounded adversary. 3 Prob. of key mismatch can be driven to 0. 4 Rate at which a common key is generated:

67 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity. 2 Secure against even a computationally unbounded adversary. 3 Prob. of key mismatch can be driven to 0. 4 Rate at which a common key is generated: # of sources monitored

68 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity. 2 Secure against even a computationally unbounded adversary. 3 Prob. of key mismatch can be driven to 0. 4 Rate at which a common key is generated: # of sources monitored frequency monitored

69 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity. 2 Secure against even a computationally unbounded adversary. 3 Prob. of key mismatch can be driven to 0. 4 Rate at which a common key is generated: # of sources monitored frequency monitored E.g.: 4-digit PIN in 0.34 sec with 10 TV sources.

70 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity. 2 Secure against even a computationally unbounded adversary. 3 Prob. of key mismatch can be driven to 0. 4 Rate at which a common key is generated: # of sources monitored frequency monitored E.g.: 4-digit PIN in 0.34 sec with 10 TV sources. 5 ProxiMate s complexity is O(n) while Diffie-Hellman is O(n 3 ).

71 Summary 1 ProxiMate: secure pairing of wireless devices based on just proximity. 2 Secure against even a computationally unbounded adversary. 3 Prob. of key mismatch can be driven to 0. 4 Rate at which a common key is generated: # of sources monitored frequency monitored E.g.: 4-digit PIN in 0.34 sec with 10 TV sources. 5 ProxiMate s complexity is O(n) while Diffie-Hellman is O(n 3 ). 6 ProxiMate can generate a secret key even if RF source is adversarial.

72 Questions/Comments

73 Backup Slides

74 Related work 1 Low power communications not secure: Susceptible to eavesdropping using a high gain directional antenna Bluetooth can be sniffed from over a mile away [Wright06] NFC is convenient but not secure by itself [Haselsteine06] 2 Existing approaches are cumbersome Human intervention (cables, entering PINs) Faraday cage [Perrig07] 3 Ambient wireless signals like WiFi can help establish proximity [AMIGO-Varshavsky07]

75 Where does the randomness and the spatial & temporal de-correlation come from?

76 Synchronizing Alice & Bob 1 Alice and Bob demodulate their signals 2 Alice sends Bob a snippet of the demodulated signal to indicate t = 0

77 How many secret bits / second? 1 Suppose Alice & Bob generate R bits/sec that differ with prob. ɛ

78 How many secret bits / second? 1 Suppose Alice & Bob generate R bits/sec that differ with prob. ɛ BSC with crossover prob. = ɛ (capacity = 1 Hb (ɛ))

79 How many secret bits / second? 1 Suppose Alice & Bob generate R bits/sec that differ with prob. ɛ BSC with crossover prob. = ɛ (capacity = 1 Hb (ɛ)) 2 For high ɛ, long codes are needed for reasonable rate Long delay.

80 How many secret bits / second? 1 Suppose Alice & Bob generate R bits/sec that differ with prob. ɛ BSC with crossover prob. = ɛ (capacity = 1 Hb (ɛ)) 2 For high ɛ, long codes are needed for reasonable rate Long delay. Fraction of bits that differ (ε) Theoretical curve Rate 1/4 LDPC code, n = 1008 P e = 3.5 * Distance (in units of λ)

81 How many secret bits / second? 1 Suppose Alice & Bob generate R bits/sec that differ with prob. ɛ BSC with crossover prob. = ɛ (capacity = 1 Hb (ɛ)) 2 For high ɛ, long codes are needed for reasonable rate Long delay. Fraction of bits that differ (ε) Theoretical curve Rate 1/4 LDPC code, n = 1008 P e = 3.5 * Distance (in units of λ) 3 Can we do better overall by ɛ at the cost of a lower R?

82 How many secret bits / second? 1 Suppose Alice & Bob generate R bits/sec that differ with prob. ɛ BSC with crossover prob. = ɛ (capacity = 1 Hb (ɛ)) 2 For high ɛ, long codes are needed for reasonable rate Long delay. Fraction of bits that differ (ε) Theoretical curve Rate 1/4 LDPC code, n = 1008 P e = 3.5 * Distance (in units of λ) 3 Can we do better overall by ɛ at the cost of a lower R? 4 We can trade R for ɛ. Let effective rate: R = R (1 H b (ɛ)) bits per sec

83 Copyrights disclaimer The Tux logo, the Adium duck and the BSD devil may be trademarks of their respective owners. They are used in this presentation only for illustrative purposes. No personal financial gain was made from this presentation.

Secret Key Extraction in MIMO like Sensor Networks Using Wireless Signal Strength

Secret Key Extraction in MIMO like Sensor Networks Using Wireless Signal Strength Sriram Nandha Premnath Academic Advisors: Sneha K. Kasera, Neal Patwari nandha@cs.utah.edu, kasera@cs.utah.edu, npatwari@ece.utah.edu