Zero Pre-shared Secret Key Establishment in the presence of Jammers

Transcription

1 Zero Pre-shared Secret Key Establishmet i the presece of Jammers Paper #56975 Abstract We cosider the problem of key establishmet over a wireless radio chael i the presece of a commuicatio jammer, iitially itroduced i [7]. The commuicatig odes are ot assumed to pre-share ay secret. The established key ca later be used by a covetioal spread-spectrum commuicatio system. Our approach is based o the ovel cocepts of itractable forward-decodig ad efficiet backward-decodig. Decodig uder our mechaism requires at most twice the computatio cost of the covetioal SS decodig ad oe packet worth of sigal storage. We itroduce techiques that applies key schedule to packet spreadig ad develop a provably optimal key schedule to miimize the bit-despreadig cost. We also use efficiet FFT-based algorithms for packet detectio. We evaluate our techiques ad show that they are very efficiet both i terms of resiliecy agaist jammers ad computatioally. Fially, our techique has additioal desirable features such as the iability to detect packet trasmissio by osource odes util the last few bits are beig trasmitted, ad the destiatio-specific trasmissios. To the best of our kowledge, this is the first solutio that is optimal i terms of commuicatio eergy cost with little storage ad computatio overhead. Itroductio Radio-Frequecy wireless commuicatio occurs through the propagatio of electro-magetic waves over a broadcast medium. Such broadcast medium is ot oly shared betwee the commuicatig odes but is also exposed to adversaries. The resiliecy to malicious behavior is obviously of sigificat importace for military commuicatio i a battle-field. It is also rapidely gaiig sigificace i civilia ad commercial applicatios due to the icreased reliace o wireless etworks for coectivity to the cyber-ifrastructure, ad applicatios that will moitor our physical ifrastructure such as tuels, bridges, ladmarks, ad buildigs. Jammig ad ati-jammig techiques for the physical layer of wireless systems supportig mostly voice commuicatio have bee extesively studied for several decades [5]. However, it is oly recetly that the popularity of multi-hop data etworks with more sophisticated medium sharig, codig, ad applicatio protocols opeed the door for more sophisticated attacks ad resulted i the exploratio of ew resiliece mechaisms. Emergig attacks iclude ultra low-power crosslayer attacks that aim at disturbig the operatio of etworks by targetig cotrol-mechaisms such as packet routig, commuicatio beacos or pilots, carrier sesig mechaism, collisio avoidace expoetial backoff mechaism, etwork topology, size of the cogestio cotrol widow, etc. For example, by trasmittig a few pulses at the right frequecy, right time ad right locatio, a tremedously eergy/computatio efficiet attack ca be implemeted with off-the-shelf hardware [4, 5, 2, 3, 9, 2].. Motivatio Spread Spectrum (SS) is oe of the most efficiet ad used mechaisms for buildig jammig-resiliet commuicatio systems. I [7], Strasser et al. recogized that the cotrol mechaism of the uderlyig SS ca be targeted. SS requires the commuicatig odes to pre-share a secret key that is used to geerate a cryptographicallystrog pseudo-oise (PN) spreadig sequece. I may scearios (e.g., large umber of dyamically associatig/diassociatig odes) this shared key has to be established over a ope chael. A adversary ca therefore focus its jammig o the key establishmet protocol. This problem was itroduced as the ati-jammig/key establishmet circular depedecy problem [7]. Strasser et al. also propose a ew mechaism called Ucoordiated Frequecy Hoppig (UFH) to break this circular depedecy, however, at a high commuicatio cost. I this paper, we propose a ovel approach for breakig the ati-jammig/key establishmet circular depedecy with sigificat eergy efficiecy advatages over UFH. Our mechaism relies o two mai properties: () itractable forward-decodig (prevetig a adversary from detectig or decodig a o-goig commuicatio), (2) efficiet backward-decodig (allowig ay receiver to decode the time-reversed sigals). Note, that although, the adversary ca also decode the time-reversed sigal (ad fid out which radom spreadig sequece

2 was used), it is too late for him to jam by the time it retrieves the PN-sequece (See Figure ). The basic idea behid our scheme is that the seder spreads the packet with a cryptographically-strog PN-sequece. The PNsequece is derived from a radom key whose etropy decreases as we get closer to the ed of the message trasmissio (See Figure 4). Decodig the time-reversed versio of the packet oly requires the receiver to guess oe bit of the key at each stage of the decodig process. Forward-decodig the packet requires guessig the whole key iitially, which is ifeasible for the jammer to do (by brute force) i time to jam the packet before the ed of the packet trasmissio. As commuicatio progresses, the etropy of the spreadig sequece decreases, however, our scheme esures that at each istat the time it takes for a ode to brute-force the PN sequece plus the TX/RX tur-aroud time is larger tha the time it takes for the seder to sed the remaiig bits of the message. This makes forward-decodig itractable. The mai advatage of our solutio, i compariso with UFH [7], is that it does ot require more eergy for trasmittig packets. It is i fact as eergy efficiet as the covetioal spread spectrum commuicatio where the commuicatig odes pre-share a secret key. UFH, o the other had, requires o average times more eergy the traditioal spread spectrum, where is the spreadig factor i the order of hudreds. We achieve this commuicatio-eergy efficiecy by slightly icreasig the receiver computatio ad storage cost. We show that the computatio/decodig cost is at most twice the computatio cost of covetioal SS (See Theorem 3) ad the storage required is of oe packet legth. A secodary advatage of our techique is delayed commuicatio detectio, which makes it practically impossible for a adversary to sese a o-goig commuicatio util it is almost over. This stealthiess forces a adversary to be a eergy iefficiet chael-oblivious jammer [2]..2 Related Work Ati-jammig techiques were extesively studied for decades [5]. Most of the earlier mechaisms focussed o physical layer protectio ad made use of spreadspectrum techiques, directioal ateas, ad codig schemes. At the time, most wireless commuicatio was ot packetized, or etworked. Furthermore, the small size of the etworks the (mostly military), ad the way they were deployed allowed for pre-cofiguratio with shared secret keys to be possible. Reliable commuicatio i the presece of adversaries regaied sigificat iterest i the last few years. New attacks ad thus, eeds for more complex applicatios ad deploymet eviromets have emerged. Several specifically crafted attacks ad couter-attacks were proposed for: packetized wireless data etworks [2, 3], multiple access resolutio i the presece of adversaries [ 3], multi-hop etworks [2, 2, 2], broadcast commuicatio [5, 6, 8], cross-layer attacks [3], ad avigatio iformatio broadcast [4]. While may recetly proposed coutermeasure techiques ca (ad are assumed to) be layered o a SS physical layer, it is usually take for grated that the commuicatig odes pre-share a secret key. Strasser et al. recogized this as a sigificat impedimet to the use of SS, eve whe the commuicatig odes possess public keys ad certificates that potetially allow them to setup a shared secret key [7]. They ame this pheomeo as the ati-jammig/key establishmet circular depedecy problem. Strasser et al. proposed UFH, a techique for establishig a symmetric secret key i the presece of adversaries. I UFH, the sedig ode hops at a relatively fast rate (e.g., 6 hops per secod) over chaels. It repeatedly seds fragmets of the mutual autheticatio ad key establishmet protocol. The receiver hops at a sigificatly slower rate. Although, the receiver does ot kow the seder s hoppig sequece, statistically, it ca receive / of the set packets. The authors show that a adversary has a very low probability of jammig these packets. They build upo this basic mechaism to costruct a jammig-resiliet mutual autheticatio ad key establishmet protocol. Their paper itroduced the first reliable key establishmet protocol for SS without a pre-shared secret. However, ulike SS systems with preshared keys, the proposed mechaism icurs a eergy icrease by a factor of due to the required redudacy i packet trasmissios (retrasmissios of message fragmets that are ot received). This is the closest work related to our paper. Our mechaisms retai the mai beefits of the origial SS commuicatio i terms of commuicatio eergy (all trasmitted eergy is used i the packet decodig process). It does icur a higher computatio cost, which we show later is o more tha twice the cost of the traditioal SS with pre-shared secret. Other coutermeasure techiques discard the possibility of usig SS because of the arrow RF bads available to ad hoc etworks, or because of the absece of a preshared key [, 8]. These techiques are much less eergy efficiet the SS. Note that SS ca still be used i arrow bad if the sigal is spread i time at o additioal eergy cost. The catch here is that the data rate is reduced by the spreadig factor. The data rate reductio is ot ecessarily a limitatio as two odes ca have multiple simultaeous commuicatios as i Code Divisio Multiple Access systems. Thus, this mechaism has the potetial of achievig a overall higher etwork throughput (see [7] for the theoretical derivatio of the capacity regio of CDMA systems). Our goal i this paper is to eable SS eve i the absece of a pre-shared key..3 Cotributios The cotributios of this paper are both coceptual ad algorithmic: Zero commuicatio-eergy overhead key establishmet of a shared key without pre-agreed kowledge (i compariso with covetioal SS with pre-

3 shared keys): a ovel approach based o itractable forward-decodig ad efficiet backward-decodig. Udetectable commuicatio util ed of trasmissio (delayed detectio). This forces the jammer to become a eergy-iefficiet chael-oblivious jammers [2]. A destiatio-orieted scheme that prevets efficiet simultaeous-attacks of multiple receivers. Computatioally efficiet ed of the message detectio (a FFT-based techique), ad message extractio (a key-schedulig algorithm requirig at most twice the cost of covetioal spread spectrum decodig to guess the key ad despread the packet). 2 Setup Model I this sectio, we describe the basic commuicatio model ad the adversary model cosidered i our study. 2. System Model We cosider a wireless commuicatio etwork where several odes are tryig to establish pairwise-shared secret keys that would eable SS commuicatio. Our model ad the problem formulatio is very similar to [7]. We focus o a pair of commuicatig odes alog with a jammer, all sharig oe radio-frequecy chael. The jammer s objective is to prevet the establishmet of a secret key betwee the commuicatig odes, because oce this key is established, the commuicatig odes ca use covetioal SS makig them resiliet to jammig. Our mai objective is to devise a jammer-resiliet message-delivery mechaism with o pre-shared iformatio. This mechaism will be used, by a Mutual Autheticatio ad Key Agreemet Protocol (MAKAP), to deliver few messages ad establish a key for future SS commuicatio. We cosider the same MAKAP as [7], amely Elliptic Curve Diffie Hellma (ECDH), because of the small umber of messages exchaged (i.e., 2) ad their short legth. Our method uses Direct-Sequece SS (DSSS), but it easily geeralizes to Frequecy-Hopig SS (FHSS). Assumptio: We assume that there exists a trusted Certificate Authority (CA) that issues digital certificates attestig each user s public key. Aythig that is kow to the receiver about the protocol ad the seder is kow to the jammer. 2.2 Adversary Model We cosider a adversary that is co-located with the seder ad the receiver, that ca jam, replay previously collected messages, isert fake messages or modify bits of the message. The primary goal of the adversary is to Note, that give the eergy, computatio, ad storage efficiecy of our techiques, if o certificatio authority is available, we ca cosider usig our scheme to trasmit all packet without ever establishig a key. prevet successful receptio of the seder s message by the receiver. However, i a attempt to do so, a jammer may simply icrease the delay of the message extractio process or cause deial of service (DoS) attack o the receiver side. So, it s secodary goal may very well be to icrease the computatio ad eergy cost of the receiver while miimizig its ow jammig cost. We defie jammer s performace as the trade-off fuctio relatig the packet loss rate with the total jammig cost. Our classificatio of the adversary attacks is ispired by the active attack categorizatio of [6] ad the attacker model of [7]. However, the specific attacker strategies we desiged ad implemeted for evaluatio of our scheme are protocol-specific. I Sectio 5, we also preset the empirical optimal jammer strategy ad show that it is cost iefficiet uder TREKS. Assumptio We igore potetial gais of cofigurig the physical layer parameters such as physical distace, atea gais, ad codig schemes. These parameters ca be idepedetly optimized. Our model does ot cosider the case where the jammer ca block the propagatio of the radio sigal. We assume that the adversary caot tuel the chael sigals for remote brute-forcig before the ed of the packet trasmissio (few millisecods). Taxoomy of the Attacks. Jammig: The attacker ca jam the commuicatio lik i various ways, such as sedig a high-power pulse either at periodic itervals, cotiuously, or i a memoryless fashio [2]. The goal is to distort packets or cause failure of packet decodig. 2. Replay Attack: The attacker ca replay previously captured commuicatio messages. The goal is to icrease the computatio cost of () packet decodig, ad (2) sigature verificatio. 3. Targeted Modificatio: The attacker ca modify some bits of the message by focusig the jammig eergy o some portio of the message. This attack is ulikely i a determiistic way, sice it is ifeasible for a jammer to detect o-goig commuicatio uder our mechaism util last few bits of the message are set. 4. Deial of Service: The attacker iserts partial or complete messages to overwhelm the receiver s () packet decodig, ad (2) sigature verificatio processes. Note that this is a stroger jammer the the replay jammer. I Sectio 5, we will dicuss ad aalyze the impact of specific jammers tailored for our approach.

4 3 Time-Reversed Message Extractio ad Key Schedulig (TREKS) i DSSS TREKS is a commuicatio approach based o zero pre-shared key spread spectrum(zpks), specifically DSSS i this paper. We will first preset the core idea of zero pre-shared key DSSS ad its efficiecy agai jammig. The we propose a ovel key schedulig scheme, which eables efficiet backward-decodig, ad thus makig TREKS optimal i terms of both commuicatio eergy cost ad computatio ad storage cost. 3. Zero pre-shared key DSSS Seder S, receiver R, ad jammer J all share the same chael. Let M deote the message that S wats to trasfer to R, l the legth of M i bits. Prior to the start of trasmissio, S radomly geerates a secret key K of k bits. Ulike covetioal DSSS, K is ot kow to ayoe but S whe commuicatio occurs. S uses K to geerate a cryptographically strog PN-sequece ad uses it to spread M. Although, PN-sequece cryptographically geerated from keys (e.g., seedig a symmetric ecryptio algorithm such as AES or DES) are ot optimal i terms or orthogoality, they have a very satisfactory performace ad have bee used i may military spread spectrum commuicatios system [5]. I covetioal DSSS, S ad R pre-share the secret key. R keeps attemptig to despread icomig sigals with pre-shared key util she detects the begiig of the message, the she starts forward-decodig the whole message. I zero pre-shared key DSSS, R eeds to first idetify the key K chose by S. Without kowig K, R does ot eve kow whe such DSSS commuicatio occurs, so she eeds to brute force all possible keys o each chip of the icomig sigal util she fids a key that could properly decode the icomig sigal. Give key size as k bit, the complexity (brute force) of explorig the key space is O(2 k ). Obviously, this is impractical for real-time commuicatio whe o iformatio is available about the start of a packet. I Sectio 3.3, we show how backward-decodig with a key schedule makes our approach efficiet for real-time commuicatio. 3.2 Jammig resiliecy We first demostrate the fudametal stregths of the proposed approach from the eergy efficiecy agaist jammers ad key recovery itractability Commuicatio eergy efficiecy We preset the way the packet data bits are spread ad how the total eergy per packet is preserved. We also show that the cost for the jammer to couter the effect of spreadig requires a eergy icrease by a factor of. Let us first itroduce some termiology: d {+, }: data bit beig set, both ad are equally probable, otherwise the data ca be compressed ad might also be used by the adversary. dˆ {+, }: estimated data bit o receiver side. : Spreadig factor. p i {,...,} {,+}: i th chip of cryptographically desiged spreadig sequece ukow to the adversary. E b : eergy per trasmitted bit (w.l.o.g, assume that we are sedig oe bit per uit of time). u i = d Eb p i: chip sigals trasmitted by seder. Note that the eergy 2 per bit remais equal to E b. We cosider a Biary Phase Shift Keyig modulatio, but the results geeralize to other modulatios. J: jammer eergy per uit of time. I i {,...,} : adversary s trasmitted sigals idexed at the chip level. The mea square of I i is J which correspods to J amout of eergy per bit. v i : received sigals idexed at chip level. BER(E b,j,m): Bit Error Rate at receiver side whe seder is usig E b Joules per bit, adversary J Joules per bit, ad trasmitter spreadig by factor m. THEOREM. Spreadig a sigal by a factor allows, the commuicatig odes to couter a -times stroger jammer at o extra-eergy cost for the seder: PROOF. Sice, we are oly iterested i the impact of jammig, we ormalize the path loss ad atea gais to. For simplicity, we igore thermal (white) oise. The same result still holds i the geeral case. Let v i deote the received sigal idexed at the chip level: v i = u i + I i Eb J = d p i + r i where r i is the jammig chip with uit mea square. Cosider the followig decodig techique 3 : d ˆ = iff v i p i > i= The Bit Error Rate of the despread sigal, BER(E b,j,) = Pr[ ˆ d = ad d = ] + Pr[ ˆ d = ad d = ] = 2 Pr[ v i p i > ad d = ] i= Eb J = 2 Pr[d p i p i + i= r i p i > ad d = ] i= Eb J = 2 Pr[ p i p i + i= r i p i > ad d = ] i= = 2 Pr[ J E b + r i p i > ] Pr[d = ] i= Eb = Pr[ r i p i > i= J ] 2 Eergy is equal to the sigal mea square. 3 Note that we are assumig that the receiver kows the bit sychroizatio. This is a commo assumptio i aalyzig SS systems. We will see i Sectio 4 how this is achieved.

5 where p i is a radom variable idepedet from the adversary s r i choices. Therefore, i= r ip i is the sum of radom variables of equal probability takig values {, +}. The distributio of the sum ca be derived from the Biomial distributio. For, this distributio ca be approximated by a Normal distributio of zero mea ad variace : N(,). Thus, BER(E b,j,) = = Eb J Eb J e x2 2π 2 dx e x2 dx () 2π 2 Eq. () idicates that whe the spreadig factor is icreased by a factor c, the adversary eeds to scale its jammig eergy J by a factor c to maitai the same BER. O the trasmitter side, sice the eergy per bit is kept costat, trasmitter still speds the same amout of eergy while beig resiliet to c times more jammig Computatioal ifeasibility for jammer I order to jam, i a cost efficiet way, the adversary eeds to idetify the spreadig key. As show above, the complexity of fidig the key is O(2 k ). If k is desiged such that idetifyig the key takes sigificatly more time the the packet trasmissio, eve if the jammer evetually fids the key, he missed the chace to jam the trasmissio. We call this itractable forward-decodig, which is illustrated i Figure Limitatios Itractable forward-decodig is based o the fact of zero pre-shared secret, which also applies to the messagedecodig process at the receiver. Sice the receiver eeds to try 2 k possibilities for spreadig key o each icomig chip sigal, it causes a cosiderably high computatio overhead. This is a major limitatio of the basic zero pre-shared key DSSS (ZPKS) scheme. I the followig sectio, we itroduce a ovel spreadig key schedulig scheme, which builds upo ZPKS ad eables both itractable forward-decodig ad efficiet backward-decodig. This drastically reduces the computatio overhead for the receiver from O(2 k ) to O(2k) while the jammig resiliecy remais the same. 3.3 Key scheduled reverse-time decodig 3.3. Key Size vs. jammig resiliecy Before delvig ito the details of our key schedulig scheme, we first show how the key-etropy is reduced as the trasmissio gets closer to the ed but still requires the same effort from a adversary to idetify the key. THEOREM 2. Let T tras (l) deote the trasmissio time of l bits, T s (k) the time required to brute force all possible k bit keys. Give a message M ad key size k, if it is secure to spread M with a k bits key, it is secure to spread the last M 2 i bits with k i bit key, where i log 2 ( M ). PROOF. We first show that it is secure to spread the secod half of M with k bit key Sice it is secure to Figure. Message delivered before key is brute forced by adversary. spread M with a k bits key, we have T tras ( M ) T s (k) T tras ( M 2 ) = 2 T tras( M ) 2 T s(k) = T s (k ) (2) Eq. (2) shows that it is secure to ecode M 2 bits with k bit key. Therefore, eve if we use a -bit weaker key to ecode the secod-half of M, we ca guaratee that the whole message ca still be delivered before the jammer brute forces all possible keys. By iductio, it is easy to get that T tras ( M 2 i ) T s (k i). Thus, it is secure to spread the last M 2 i bits with k i bit key. The ituitio behid Theorem 2 is that as trasmissio goes o, less time is left for jammer to fid out the key, so it is safe to use a slightly weaker key to ecode the rest of the message Spread key schedulig Based o Theorem 2, we itroduce a key schedulig scheme to TREKS. As show i figure 2, istead of spreadig the complete the message with a fixed key, we partitio the message ito k segmets (ote that the segmets are trasmitted i a cotiuous way), where k is the key size. We call each segmet schedule. The size of ith segmet M i is M 2 i. At the start of spreadig process, we use full legth key to spread M. Every time whe we fiish ecodig oe segmet, we set the most sigificat bit of the key to a kow value ad resumes ecodig the ext segmet with this -bit weaker key. We repeat this process util the last schedule, which is ecoded with oly bit key. Here it is easy to see that the message legth l has to be at least 2 k so that the key size k could be decreased to bit as schedule goes o. For simplicity of presetatio, we assume that l = 2 k at this momet. We will show how to loose this costrait i later sectio. Algorithm outlies the message segmetatio ad key schedulig scheme. 4 Additioal measures ca be take to prevet overlap betwee weakeed key spaces.

6 Symbol M K l k K[m...] M[m...] K i M i N i Defiitio message to be trasferred secret key legth of message i bits size of secret key i bits part of the K from m th bit to th bit part of the M from m th bit to th bit key used i schedule i message segmet belogig to schedule i size of rest of message at the start of schedule i Table. Summary of the otatios. Figure 3. MAC-masked key schedulig. Algorithm : Seder ecodig message with key schedule.. N M 2. for i =...k do K i K[i...k] M i N i [... N i 2 ] cryptographically geerate PN i from K i ecode M i with PN i N i+ N i [ M i +... N i ] Itractable forward-decodig: Based o theorem 2, the key size at each schedule is large eough for the size of correspodig message segmet. Thus, the property of itractable forward-decodig is maitaied. Efficiet backward-decodig: Due to the decreasig key etropy, it becomes easier for the receiver to idetify the key as the trasmissio is closer to the ed. Specifically, i order to detect the last message segmet, the receiver just eeds to attempt two keys. Oce the receiver detects the potetial ed of message, he starts guessig the keys for previously received sigals followig the key schedulig scheme i reverse time. I order to guess the key for each previous schedule, receiver oly eeds to try two keys, because the bit differece for two adjacet schedules is oly bit. So the receiver eeds to try up to 2 k keys to fid out all the k key bits, which is sigificatly lower the the O(2 k ) guesses of the basic scheme. 3.4 Further improvemets ad discussio 3.4. MAC-masked key schedulig I the key schedulig scheme preseted above, the last scheduled key K k is always either or for ay seder/receiver pair. Hece, the jammer could jam with a PN-sequece geerated by or key, which is likely to compromise the last message fragmet. Oce the ed of the message is jammed ad the receiver is ot able to detect it, the reverse decodig caot start. I order to tackle this issue, we take the receiver s MAC address to mask the key at each schedule. The revised key schedulig strategy is illustrated i figure 3. The key K i used to ecode M i is geerated by replacig the most sigificat Figure 2. TREKS with key schedulig. Figure 4. Key schedulig with liear tail. i bits of the receiver s MAC address with the most sigificat i bits of K. It is easy to see that the hardess of the key iferrig remais the same. Whereas, the last scheduled key is differet across differet receivers. Thus, the jammer ca oly target oe receiver at a time. The potetial jammig attack metioed earlier becomes a destiatio-orieted attack Key schedulig with liear tail Cosider a key size of k = 2, the jammer eeds to explore 2 2 keys. Eve for a chip rate of Mcps (s chip duratio), it is ifeasible for a field deployed device to brute force the key trasmissio of few millisecods (e.g., ms for bits spread with = ). However, as metioed at the ed of 3.3.2, we assumed that l = 2 k so that key size ca be decreased dow to bit by k th schedule, ad the total message legth l for k = 2 would be M bits. Obviously this is too large for a message size. We also observed that If T tras ( M ) T δ, where T δ is the radio tur aroud time of the jammer, it is impossible for the jammer to jam M. I this case, whe the jammer detects the trasmissio ad switches to a trasmit mode, the message has already bee delivered. Take 82. as a example, the radio tur aroud time is us. Cosider a spreadig factor =, chip rate of Mcps, the we have T tras () = us. So for the last bits of the message, the seder ca weake the key at a liear rate of key bit per packet bit. Therefore, oly the first bits of the key eed to be scheduled. Thus, the message size becomes + 9 i= 2i = 33 bits, which is a reasoable size. Note that if T δ allowed for oly the trasmissio of a smaller umber of bits, we ca liearly weake the key by more the oe key-bit per trasmitted bit. This slightly icreases the computatio cost of key iferrig but oly o a small umber of bits. The revised key schedulig algorithm is illustrated i Figure 4. Next, we preset the efficiet backward decodig algorithm, its computatio complexity ad briefly discuss

7 process a batch of l chips at oce durig FFT computatio ulike covetioal SS systems that process chips (spread of a bit) at a time. As illustrated i Algo- Figure 5. Workflow of TREKS Message Decodig the key establishmet protocol uder TREKS. 4 Efficiet Backward-Decodig 4. Overview of TREKSDecodig MAC-masked TREKS eables efficiet backwarddecodig. The backward-decodig is best described as a two-phase pheomeo [See Figure 5]: Phase-I: Fidig Ed of the Message(EoM) by computig the cross-correlatio betwee received spread sigal ad the PN-sequece geerated with receiver s MAC address. Phase-II: Iferrig the key i time-reversed fashio, which is used to despread the message. Symbol Defiitio m message set by the seder, as z segmets Seg[i] Segmets of a message, where i z K[i] Key used to geerate spread PN-sequece, i z Ki Possible set of keys, Ki 2, that receiver tries to despread Seg[i] with. S[i] Real-time Sigal that is sampled at the receiver side. PEoM[i] Array of possible EoM idices. M[i] Array of extracted complete messages. GetBu f f er(.) Gets the ext l chips from the sigal stream for samplig. DotProd(.) Dot product of two vectors (correlatio fuctio). FFT (.) Fast Fourier Trasform. IFFT (.) Iverse Fast Fourier Trasform. Fast Correlate(.) Calculatig Covolutio betwee a short ad a log sigal. Key I f er(.) Fuctio to ifer the key. Peak Detectio(.) Fuctio to detect peaks at Seg[i], i z Despread(.) Stadard Spread Spectrum fuctio to despread received sigal. Sigature Veri f y(.) Fuctio to verify the seder. Table 2. Additioal otatios 4.2 Fidig the EoM (Phase-I) As show i Figure 5, Phase-I cosists of two steps, (a) samplig ad bufferig, ad (b) FFT EoM detectio. Whe ew sigal samples arrive, the receiver equeues them ito a FIFO. At ay istace, the receiver oly have to keep 2 l chips i his buffer because after fidig the EoM, he will have to traverse at most l legth before he recovers the message. We compute cross-correlatio to achieve bit sychroizatio, a very commo practice i SS systems [5]. However, calculatig cross correlatio is computatioally expesive. We optimize this calculatio (a) by usig FFT, which reduces the cost of computig cross correlatio from 2 2 l to l log(l), ad (b) Algorithm 2: Fidig the Ed of the Message (EoM). Old Buffer = GetBuffer(S); 2. for each buffer of legth ( l) do Curret Buffer = GetBuffer(S); Set k = MAC ADDRESS(Rcvr); Corr[ : l]=fast Correlate(Curret Buffer,k); for each j {,, l} do If Corr[ j] > threshold the push j ito PEoM[]; If PEoM[] is empty Old Buffer = Curret Buffer; Else Buffer = cocat(old Buffer,Curret Buffer); Key Ifer(Buffer,PEoM); Fast Correlate(Buff,key){ Temp Key[:*l] = Zeros; Temp Key[:] = key; Iput = FFT(Buff); Iput2 = FFT(Temp Key); //Pre-computed Corr[:*l] = IFFT(Iput*Iput2 ); retur Corr;} rithm 2, our FFT detectio process iterates over each chip i the buffer to fid the EoM. Oe challege is that there might be more tha oe cadidate for EoM, i.e., multiple values of the correlatio vector may pass the threshold test to produce false positives. Thus, we equeue all possible EoMs ito PEoM[], ad pass it to Phase-II for further processig. We pick threshold value empirically by observig TREKS performace over large umber of simulatio rus, details of which is give i Sectio Message Extractio (Phase-II) Phase-II cosists of Step-3 ad Step-4 as show i Figure 5. I Step-3, we ifer the key by fidig the legitimate EoM out of all PEoM foud i Phase-I. For each PEoM, we begi time-reversed key iferrig. At each stage of the process, we try two possible choices for the key-bit. Algorithm 3 illustrates this process. For a certai guess, if more tha 5% of the total bits are detected i a segmet, the we cofirm the value at the correspodig key bit positio ad move oto the ext. Otherwise, we abort the key iferrig. Hece, we get Theorem 3. THEOREM 3. The computatioal cost of TREKS message despreadig is at most twice the computatioal cost of covetioal SS systems with a pre-shared key. PROOF. For each segmet, the receiver attempts to despread the bits with two potetial keys. Therefore each bits is despread twice. Leadig to a computatioal cost of twice a covetioal spread-spectrum. Note, that this cost ca be reduced by elimiatig oe of the two keys after attemptig oly few bits of a packet. I Phase-II, aother optimizatio we employ is that after we fid the EoM, istead of computig FFT each time to sychroize with the bits of the message, we compute the dot-product betwee chips ad the PN-sequece.

8 The abortio of key iferrig process implies a packet loss otherwise we despread the message usig the key iferred [Step-4]. We discuss the choice of the threshold values used i Algorithm 2 i Sectio 5. Algorithm 3: Message Extractio. Key Ifer(Buffer,PEoM){ for each possible EoM j PEoM do PeakPos = +j; //EoM = Buffer[+j] edidx = PeakPos-; //Ed of Seg[z-] for each p {,,z} do startidx = edidx Seg[z] + ; CtOfSucc = ; for each key cadidate k K z p do succ = Peak Detectio(k,Buffer, startidx, edidx); CtOfSucc = CtOfSucc + succ; If(CtOfSucc==) K[p] = k; Else Abort Key Ifer(Buffer,PEoM); edidx = startidx; m = Despread(Buffer[ j ( l) +, j],k[]); Equeue m ito M[];} 2. Sigature Verify(M[]); Peak Detectio(key, Buf, startidx, edidx) { ExpNumofPeaks = (edidx - startidx)/; CtOfPeaks = ; for each d {,,ExpNumOfPeaks} do P=DotProd(key,Buf[startIdx,startIdx+]); If P > threshold the CtOfPeaks = CtOfPeaks+; startidx = startidx+(d ) ; If CtOfPeaks > 5%*ExpNumOfPeaks succ = ; Else succ = ; retur succ; } Sigature Autheticatio ad Key Establishmet At the ed of Algorithm 3, depedig o the type of jammer ad its strategy, a receiver might ed up recoverig more tha oe message, amely the jammer messages. I that case, the receiver has to verify the seder usig some kid of mutual autheticatio ad idetificatio mechaism. TREKS uses 6 bit Elliptic Curve based Digital Sigature Algorithm (ECDSA) to autheticate the odes ad their data set over the chael. A 6-bit ECC key provides the same level of security as that of a 24-bit RSA key [9], which is sufficietly secure for the purposes of a sessio-based ecrypted message trasmissio of TREKS. The choice of the key establishmet protocol for TREKS eed ot be a specific key establishmet protocol. The choice of the key establishmet protocol is already discussed extesively i [7]. So, we will use the same protocols of [7]. 5 Performace Evaluatio We evaluate the performace of TREKS i terms of the Packet Loss Rate (PLR) as a fuctio of commuicatio/jammer eergy, computatio cost, ad storage cost. Bit Error Rate (BER).... (a) SNR vs. BER t= t=2.5 No e Sigal to Noise Ratio (SNR) i db Packet Loss Rate (PLR).8 (b) SNR vs. PLR t=2.5 t= No Sigal to Noise Ratio (SNR) i db Figure 6. SNR vs. (a) BER (b) PLR with (Threshold = t*avg, t=, t=2.5) ad without (No) TREKS. Based o Theorem, we ca focus o two commuicatio jammers: () additive white gaussia jammer (whose eergy is reduced by a factor ) evaluated i Sectio 5., ad (2) jammers spreadig a sigal with the destiatio MAC address evaluated i Sectio 5.2. Sice, the adversary does ot kow the begiig of the trasmissio, he is forced to operate as a memoryless jammer with a rate λ. We use MATLAB to simulate the commuicatio, jammig, ad message extractio. Simulatio Setup: All the graphs are based o K simulatio rus of each settig of parameters uder our model. The variables that costitute our simulatio are: Spreadig Factor, Packet Size, l 33 bits Key Size, 9 Jammer Power to Sigal Power Ratio, JSR [..] Normalized Sigal Power dbw Noise Power -2 dbw Table 3. Parameters for Simulatio. 5. TREKS vs. Gaussia Jammers We cosider the case where the seder ad the receiver commuicate uder a white Gaussia jammer. From Theorem this correspods to iterferers ot usig the destiatio MAC address. Their iterferece results i Gaussia oise of eergy reduced by a factor. 5.. Packet Loss Rate (PLR) The PLR uder our model implies oe of the followig: (a) Key Ifer Failure, (b) EoM missig, ad (c) High BER (over 5% [3]). Figure 6 shows the PLR ad the BER i TREKS system as a fuctio of a icreasig SNR ad two detectio thresholds. Note that due to the imperfect sychroizatio ad EoM recovery, we oly obtai a gai of 5 7 db (i.e., 2 to 5 resiliecy gai) False Positives The umber of False Positives (FP) ecoutered durig the FFT EoM detectio process directly impacts the performace of TREKS i terms of computatioal delay. I fact, we use the PLR ad the umber of FPs observed while ruig TREKS at a fixed oise level of db, to choose the peak detectio threshold used i Algorithm-2. We defie the threshold as t avg where avg represets the average of the correlatio vector produced by fuctio fast correlate(.) of Algorithm-2 ad t represets the multiplier. Based o the results from Table 4 ad 5,

9 we chose t to be 2.5 because of the much smaller FP rate eve if we loose about 2dB of jammer resiliecy. SNR (db) t=. t = 2. t = 2.3 t = 2.5 t = 3..79%.48%.94%.58% 2% 5.8%.48%.94%.58% 2%.79%.47%.96%.59% 2% 5.79%.5%.98% % 3%.78%.57%.% 4% 5% Table 4. False Positives (FP) Percetage of FPs Detected (b) FP Detectio Stage Distributio (Threshold 2.5) S S2 S3 S4 S5 S6 S7 S8 S9 Key Iferrig Stages Percetage of FPs Detected (a) FP Detectio Stage Distributio (Threshold ) S S2 S3 S4 S5 S6 S7 S8 S9 Key Iferrig Stages Figure 7. Distributio of the FP detectio stage. SNR (db) t=. t = 2. t = 2.3 t = 2.5 t = % 48.% 49.5% 47.5% 64.5% 5.% %.5%.5% 4.%.%.%.%.%.% Table 5. Packet Loss Rate (PLR). Figure 7 shows that we detect all of the FPs from PEoMs by the first iteratio (stage) of the key i f er() i Algorithm 3 for threshold value of 2.5. Thus FP does ot impact TREKS computatioally by much Computatio Cost Operatio Usig GPU Lab Computer FFT bechmark ms 28ms Key Iferrig - ms Sigature Verificatio - ms Table 6. TREKS Computatio Cost. Table 6 shows the computatio cost of TREKS performed i our lab computer versus usig a GPU NVidia GeForce 88 GTX, we ca accelerate the FFT computatio by 28 times []. The specificatio of our lab computer is a 32-bit Itel(R) Core(TM)2 CPU with 3GB memory. It clearly shows that with appropriate off-the-shelf hardware, TREKS ca operate i real time with its total executio time uder 3ms. We used OPENSSL-.9.8 versio to calculate the bechmark for verifyig 6-bit ECC-DSA [] Storage Cost The storage cost of TREKS accouts for (a) the total umber of messages recovered at the ed of message extractio, ad (b) the size of the FIFO used i bufferig the sigal samples i Algorithm-2. Eve if a jammer ijects j packets, we oly have to store at most ( j +) l/8 bytes, ad the size of curret bu f f er i Algorithm-3 is also l samples (assumig two 6 bits -I, ad Q- values per sample) oly. Hece, the storage cost of TREKS is 4 l + ( j + ) l/8 bytes, clearly withi the realms of possibility with today s computer hardware. 5.2 TREKS vs. o-cotiuous Jammers We cosider a discretized time with timeslots of duratio l chips. We defie two differet kids of jammers that take parameters λ ad JSR. λ represets the probability that a jammer seds a jammig message at a give timeslot (this correspods to discretizatio of a Poisso memoryless jammer to a Beroulli jammer), ad JSR is Packet Loss Rate (PLR) a. PLR as a fuctio of Budget (Radom Jammer) Budget=.8 Budget=5 Budget= Budget=5 Budget= Jammer Power to Sigal Power Ratio(JSR) Packet Loss Rate (PLR) b. PLR as a fuctio of Budget (MAC Jammer) Budget=.8 Budget=5 Budget= Budget=5 Budget= Jammer Power to Sigal Power Ratio(JSR) Figure 8. Jammer performace uder fixed budget. the jammer to sigal power ratio. The cost of the jammer is λ JSR, ad his goal is to maximize the PLR for a give budget. Note that because the adversary does ot kow whe trasmissios are happeig, the cost of the jammer should be further scaled by a factor µ which correspods to the data trasmissio rate. I the followig we cosider the best case for the jammer where µ =. The jammer could also sed partial messages but this ca be idepedetly addressed with appropriate iterleavig ad codig [3]. Hece, we cosider followig jammers: (Radom) Jammer-: Iserts a l-bit message, each bit spread with a radom PN-sequece. (MAC) Jammer-2: Iserts a l-bit message, each bit spread with the PN-sequece geerated usig the MAC address of the receiver as the seed. Cosider a data message; it radomly overlaps with two cosecutive timeslots (TS). There are four possible scearios based o if the first, secod or both TS are jammed. Sceario-: Oly the first TS is jammed. Impact: Key iferrig. Sceario-2: Oly the secod TS is jammed. Impact: EoM detectio. Sceario-3: Both TS are jammed. Impact: Key iferrig ad EoM detectio. Sceario-4: Noe of the TS are jammed. Note that Sceario-4 implies o packet loss sice there is o overlappig betwee the jammer ad the data packet. Hece, we oly show Scearios-,2, ad 3 i Figure 9(a). I Figure 9(b), we compare Scearios-3 ad 4 ad show that there is o icetive for the jammer to icrease its JSR if its oly objective is to icrease the FPs. For a give λ (jammig rate), the expected PLR is E[PLR] = E λ( λ) + E 2 λ( λ) + E 3 λ 2 + E 4 ( λ) 2

10 Packet Loss Rate (PLR).8 a. PLR due to differet jammers (=) (Radom) Sceario- (Radom) Sceario-2 (Radom) Sceario-3 (MAC) Sceario- (MAC) Sceario-2 (MAC) Sceario Jammer Power to Sigal Power Ratio(JSR) False Positives (FP) b. FP due to differet jammers (=) (Radom) Overlap (Radom) No Overlap (MAC) Overlap (MAC) No Overlap Jammer Power to Sigal Power Ratio(JSR) Figure 9. Jammer performace compariso. where E,E 2,E 3,ad E 4 (= ) are the expected PLR for above defied Scearios-,2,3 ad 4 respectively. Figure 8 shows the expected PLR for Scearios-,2,3 ad 4. Depedig o the budget, the jammer maximizes its impact o the receiver (PLR). We observe that Jammer- ad Jammer-2 attai their optimum approximately whe JSR 5. Eve i the best case for the jammer (µ = ), the jammer eeds to sped times more eergy to reduce the throughput to 3%. For µ =., the jammer would eed to sped more eergy the the commuicatig to reduce the throughput to 3%. 6 Coclusio We itroduce a method for achievig SS ati-jammig without a pre-shared key. Our method has zero eergy overhead i compariso with covetioal SS commuicatio. Our proposal relies o a itractable forwarddecodig ad efficiet backward-decodig mechaism. We propose several algorithms to optimize the decodig ad show that the computatioal cost of despreadig is bouded by twice that of covetioal SS commuicatio. Our method has additioal beefits such as makig the commuicatio udetectable util it is too late for a adversary to act. The proposed method is also destiatio-orieted prevetig smart-jammers from simultaeously impactig multiple receivers. 7 Refereces [] B. Awerbuch, A. Richa, ad C. Scheideler. A jammig-resistat mac protocol for sigle-hop wireless etworks. I ACM PODC, 28. [2] E. Bayraktaroglu, C. Kig, X. Liu, G. Noubir, R. Rajarama, ad B. Thapa. O the performace of ieee 82. uder jammig. I Ifocom, 28. [3] M. A. Beder, M. Farach-Colto, S. He, B. C. Kuszmaul, ad C. E. Leiserso. Adversarial cotetio resolutio for simple chaels. I SPAA, 25. [4] T. Brow, J. James, ad A. Sethi. Jammig ad sesig of ecrypted wireless ad hoc etworks. I ACM MobiHoc, 26. [5] A. Cha, X. Liu, G. Noubir, ad B. Thapa. Cotrol chael jammig: Resiliece ad idetificatio of traitors. I IEEE ISIT, 27. [6] J. Chiag ad Y.-C. Hu. Cross-layer jammig detectio ad mitigatio i wireless broadcast etworks. I MobiCom, 27. [7] T. M. Cover ad J. A. Thomas. Elemets of Iformatio Theory. Wiley, 26. [8] S. Gilbert, R. Guerraoui, ad C. Newport. Of malicious motes ad suspicious sesors: O the efficiecy of malicious iterferece i wireless etworks. I OPODIS, 26. [9] B. Gupta, S. Gupta, ad S. Chag. Performace aalysis of elliptic curve cryptography for ssl. I MobiCom, 22. [] pdemores/gpu/. Gpu bechmarkig. [] Opessl toolkit. [2] M. Li, I. Koutsopoulos, ad R. Poovedra. Optimal jammig attacks ad etwork defese policies i wireless sesor etworks. I INFOCOM, 27. [3] G. Li ad G. Noubir. O lik layer deial of service i data wireless las. Wirel. Commu. Mob. Comput., 25. [4] K. B. Rasmusse, S. Capku, ad M. Cagalj. Secav: secure broadcast localizatio ad time sychroizatio i wireless etworks. I MobiCom, 27. [5] M. K. Simo, J. K. Omura, R. A. Scholtz, ad B. K. Levitt. Spread spectrum commuicatios; vols. -3. Computer Sciece Press, Ic., NY, 986. [6] W. Stalligs. Cryptography ad Network Security. Pretice Hall, Ic., NJ, 26. [7] M. Strasser, C. Popper, S. Capku, ad M. Cagalj. Jammig-resistat key establishmet usig ucoordiated frequecy hoppig. I ISSP, 28. [8] P. Tague, M. Li, ad R. Poovedra. Probabilistic mitigatio of cotrol chael jammig via radom key distributio. I PIMRC, 27. [9] P. Tague, S. Nabar, J. Ritcey, D. Slater, ad R. Poovedra. Throughput optimizatio for multipath uicast routig uder probabilistic jammig. I PIMRC, 28. [2] P. Tague, D. Slater, G. Noubir, ad R. Poovedra. Liear programmig models for jammig attacks o etwork traffic flows. I WiOpt, 28. [2] W. Xu, K. Ma, W. Trappe, ad Y. Zhag. Jammig sesor etworks: attack ad defese strategies. IEEE Network, 26.