MIMO-based Jamming Resilient Communication in Wireless Networks

Transcription

1 MIMO-based Jamming Resilient Communication in Wireless Networks Qiben Yan Huaceng Zeng Tingting Jiang Ming Li Wenjing Lou Y. Tomas Hou Virginia Polytecnic Institute and State University, Blacksburg, VA, USA Uta State University, Logan, UT, USA Abstract Reactive jamming is considered te most powerful jamming attack as te attack efficiency is maximized wile te risk of being detected is minimized. Currently, tere are no effective anti-jamming solutions to secure OFDM wireless communications under reactive jamming attack. On te oter and, MIMO as emerged as a tecnology of great researc interest in recent years mostly due to its capacity gain. In tis paper, we explore te use of MIMO tecnology for jamming resilient OFDM communication, especially its capability to communicate against te powerful reactive jammer. We first investigate te jamming strategies and teir impacts on te OFDM-MIMO receivers. We ten present a MIMO-based anti-jamming sceme tat exploits interference cancellation and transmit precoding capabilities of MIMO tecnology to turn a jammed non-connectivity scenario into an operational network. Our testbed evaluation sows te destructive power of reactive jamming attack, and also validates te efficacy and efficiency of our defense mecanisms. I. INTRODUCTION Ortogonal frequency-division multiplexing (OFDM) as developed into a popular sceme for broadband wireless communications. Modern wireless communication systems, suc as WLAN, digital TV systems and cellular communication systems, all adopt OFDM as one of te primary tecnologies. Wile OFDM systems are robust against multipat fading and ave te ability to cope wit severe interference and noise, tey are not ideal for environments were adversaries try to intentionally jam communications. Jamming as been a major denial-of-service attack to wireless communications [], [2]. By intentionally emitting jamming signals, adversaries can disturb network communications, resulting in trougput degradation, network partition, or a complete zero connectivity scenario. Reactive jamming is one of te most effective jamming attacks. A reactive jammer continuously listens for te cannel activities, and emits jamming signals wenever it detects activities, oterwise it stays quiet wen te sender is idle. Reactive jamming is regarded as one of te most effective, stealty, and energyefficient jamming strategies [3], [4]. Te recent advance in te igly programmable software defined radio as made suc sopisticated but powerful jamming attacks very realistic [5], [6] demonstrated tat a reactive jammer is readily implementable and te jamming results devastating. Te increasingly severe ostile environments wit advanced jamming treats prompt te development of security extensions to te OFDM systems. Some recent works investigate Tis work was supported in part by NSF under grants CNS , CNS-24783, CNS-5638, and CNS-563, and by ONR under grant N /4/$3. c 24 IEEE and attempt to alleviate te impacts of jamming attacks to te OFDM systems. Han et al. [7] proposed a jammed pilot detection and excision algoritm for OFDM systems to counteract narrow-band jammer tat jams te pilot tones. Clancy et al. [8] furter introduced pilot nulling attack tat minimizes te received pilot energy to be more destructive, and provided mitigation scemes by randomizing te location and value of pilot tones. However, tey bot specifically focus on te adversaries jamming pilot tones, wo require knowing te pilot locations and also demand very tigt syncronization. Moreover, teir defense mecanisms will fail to recover signals wen all te OFDM subcarriers including te pilots are jammed as in te case of reactive jamming attack. On te oter and, multi-input multi-output (MIMO) as emerged as a key tecnology for wireless networks mostly due to its potential capacity gain. New wireless devices are equipped wit a growing number of antennas. MIMO can be exploited to obtain diversity and spatial multiplexing gains, and lead to an increase in te network capacity. More importantly, recent advance in MIMO interference cancellation (IC) tecnique [9] [] as greatly enanced MIMO communication capability under multiple concurrent transmissions. Tis inspires us to ponder: weter it is possible to exploit IC tecnique in MIMO to mitigate jamming attacks targeting OFDM systems, in particular, software radio based reactive jamming attacks. In tis paper, we try to answer tis question by first examining te jammer s capability in disrupting OFDM-MIMO communications, and ten devising MIMObased defense mecanisms by utilizing MIMO tecnology coupled wit IC and transmit precoding tecniques. We sow tat our design is able to restore admissible OFDM communication in te presence of reactive jammers. Te similarity between interference cancellation and jamming resistance is obvious bot te interferer and te jammer lead te desired signals to be non-decodable at te receiver side. Tey are also different jamming signals are sent by malicious jammers deliberately, wo can intentionally alter te jamming signals for best jamming effect or to evade antijamming tecnique, wile te interferer introduces interference inadvertently. Hence, jamming signals tat can be purposefully and rapidly altered are muc arder to track and remove tan conventional interference. Consequently, designing te effective defense mecanism faces several key callenges. First, since different jammers emit different types of jamming signals, te receiver needs to cancel tem regardless of teir signal structures. Second, an effective defense mecanism sould be able to track te jammers purposeful adaptation. Finally, te defense mecanism sould be robust against sopisticated jammers attempting to /4/$3. 24 IEEE 2697

2 2698 disrupt te receiver s cancellation sceme. To address tese callenges, we propose a novel defense mecanism for jamming resilient OFDM communication based on MIMO IC tecnique, wic tracks te jamming signal s direction in real-time before canceling it out. We devise an iterative cannel tracking mecanism using multiple pilots to estimate te sender and jammer s cannels alternately and iteratively in a timely fasion. More importantly, we introduce an enanced defense mecanism leveraging signal enancing rotation and message feedback tecniques, wic strategically enances te projected sender signal strengt via signal rotation, resulting in an improved anti-jamming performance. A tactical IC sceme is designed not only to protect te forwarding frame transmission, but also to guard te feedback messages against jamming. Te goal of tis paper is to sustain operational OFDM communications under reactive jamming attack. Te contributions of tis paper are two-fold: () we exploit te MIMO IC and transmit precoding tecniques to counteract reactive jamming attacks for securing OFDM wireless communications. We propose two novel mecanisms: iterative cannel tracking and signal enancing rotation to effectively sustain acceptable trougput under reactive jamming attack; (2) we implement te jamming attack and defense mecanisms using USRP radios, and conduct extensive experiments to evaluate te performance in terms of packet delivery rate. Te experimental results sow tat in te presence of a reactive jammer, te packet delivery rate improves significantly using our enanced defense mecanism wit signal rotation. II. PROBLEM FORMULATION In tis section, we present te system model, define te attack model and lay out preliminary knowledge of OFDM- MIMO networks. A. System Model We consider an adverse wireless environment wit a jammer targeting at te communication link establised by a sender and a receiver. We consider te jammer as a common singleantenna device, wo is capable of taking any attack strategy to be most destructive. Te frames in OFDM wireless communications ave signal structures as sown in Fig.. A preamble is transmitted aead of te data, wic is used for signal acquisition, time syncronization and initial cannel estimation. We assume te sender transmits wen te jammer is not jamming, eiter by taking a random backoff between transmissions or by sensing jamming activity [2]. We assume every sender and te intended receiver sare a secret key tat is unknown to te jammer. Let P SR and P JR be te received signal powers from S and J respectively. Te signal-to-jamming ratio (SJR) at receiver R can be expressed as P SR /P JR, wic determines te decoding performance. We do not consider te noise and interference, since tey are negligible wen compared to te jamming power. B. Attack Model Tere are tree typical jamming attack models: ) constant jammer continuously transmits jamming signals to corrupt Fig. : Reactive jammer starts jamming after certain reaction time packet transmission. He/Se as te capability of covering te wole frame structure, wereas is/er energy consumption is extremely ig, rendering imself/erself easily discoverable; 2) random jammer is more energy-efficient, as e/se emits jamming signals at random time for a random duration. However, is/er jamming capability is limited due to te randomized jamming beavior; 3) reactive jammer is more effective, energy-efficient and stealtier [3], wic is te main focus of tis paper. Te key feature of reactive jammer is sensing-beforejamming. Te jamming reaction time denotes te time difference between te arrival of te original signal and te jamming signal at te receiver. It takes a reactive jammer a minimum reaction time to perform cannel sensing and jamming initialization before sending out jamming signals, during wic te preamble of te frame could be transmitted witout being jammed [5], [2], as sown in Fig.. In our experiment, a preamble takes only one OFDM symbol, wic lasts 28µs wit M Hz bandwidt. On te oter and, te jammer, wo is agnostic to te implementation details of te network (e.g., te transmission protocol and preamble symbols), can only carry out energy detection [3], wic requires more tan ms to detect te signal for a.6 detection probability and dbm signal strengt, wen implemented in a fully parallel pipelined FPGA [4]. Even te advanced software radio based reactive jammer, wo is aware of te implementation details of te network, still incurs a considerable reaction delay to process te incoming signal and to make a jamming decision, during wic te preamble of a frame is successfully delivered to te receiver witout being disturbed [5], [6]. In addition, te jammer can transmit arbitrary signals wit/witout any signal structures. Te jammer is also capable of jamming te wole spectrum, invalidating te traditional spread spectrum anti-jamming metods [2], [5]. However, we assume te jammer cannot perform full-duplex communications, wic essentially disallows te jammer to sense and jam simultaneously. C. MIMO Interference Cancellation and OFDM Basics In a MIMO network, te spatial multiplexing gain can be represented by a concept called Degrees-of-Freedom (DoF), wic is defined as te dimension of received signal space over wic concurrent communications can take place [6]. DoF indicates te number of concurrently transmitted streams tat can be reliably distinguised at a MIMO receiver. Consider a 2 MIMO communication between sender S and receiver R as sown in Fig. 2, te signals ( xs x j ) from te sender and jammer respectively are transmitted concurrently troug te cannel H, and te received signals can be written as: ( y y 2 ) = ( s s )x s +( j j)x j, ()

3 2699 Fig. 2: 2 OFDM-MIMO link attacked by a Jammer wic live in a two-dimensional vector space corresponding to two receive antennas. In order to decode x s, te IC tecnique is utilized to remove te interference from x j by projecting te received signals onto te subspace ortogonal to x j (see Fig. 2), i.e., [ j, j], yielding te projected signal as: y proj = jy j y 2 = ( j s j s)x s. (2) After tat, te projected signal can be decoded using any standard decoder. Tis IC tecnique is also called Zero-Forcing (ZF). Note tat, estimating jammer s signal direction is te core of ZF decoder. A loss of original signal amplitude after projection is observed from Fig. 2. OFDM divides te spectrum into multiple narrow subbands called subcarriers. Te receiver operates on eac subcarrier, and applies FFT to te received signal for demodulation. Tis allows many narrowband signals to be multiplexed in te frequency domain, wic greatly simplifies te cannel estimation and equalization. In tis paper, te sender and receiver establis OFDM communications wit te signals of interest as OFDM-modulated signals. Note tat Eq. () assumes a narrowband cannel, were (suc as s, j, etc) appears simply as a complex number. However, for wideband cannels, te signals at different frequencies will experience different cannels, bringing so called multi-pat effects. As a result, will become a complex vector indexed by different frequency responses. Yet, Eq. () still olds for eac OFDM subcarrier in te OFDM communications, suc tat MIMO IC is carried out over eac subcarrier. III. IMPACT OF REACTIVE JAMMING ATTACK TO OFDM-MIMO COMMUNICATIONS In tis section, we caracterize te impact of reactive jammer to te OFDM-MIMO communications. Witout loss of generality, we explain te jamming strategy in te context of a two-antenna receiver decoding a single transmission from te sender in Fig. 2. Te sender and receiver form a 2 MIMO link of two DoF wit one DoF consumed by te jammer. According to Eq. (), te received frequency-domain signals for eac OFDM subcarrier i are sown below: y i = ji x ji + si x si, (3) y 2i = jix ji + six si, (4) were ji, ji, si and si are frequency version of cannels at subcarrier i, and x ji and x si are frequency-domain signals Signal direction is determined by te received signal vector induced on te receive antenna array by te transmitted signal [6], wic is defined in te antenna-spatial domain and not te I-Q domain. (a) Overlap Signals (b) Ortogonal (c) Small angle Fig. 3: Different two-dimensional received signal spaces from te jammer and sender. Note tat te jamming signals need not be OFDM-modulated narrowband signals, and x ji simply represents te narrowband portion of jamming signals on i-t OFDM subband. As mentioned in Section II-C, te MIMO IC tecnique is carried out over eac subcarrier to recover te legitimate signal, wic is deemed as te key to te data recovery process. Naturally, te MIMO IC tecnique becomes te target of te jammer. We reformulate Eqs. (3), (4) as follows (in te following, we omit te subscript notation i for i-t subcarrier): ( y y 2 ) = H( )x j + H( )x s, (5) j s were H = [ ] = [ j, s ] is te 2 2 cannel matrix. Te j s received signals are te sum of two vectors J r = H[ ] T x j and S r = H[ ] T x s, as sown in Fig. 2. We find tat te angle 2 between J r and S r, determined by j and s, can be exploited by te jammer to launc effective attack. Attacking MIMO Interference Cancellation. In order to understand te attack strategy, we inspect tree special scenarios in Fig. 3 wit different received signal spaces. Undoubtedly, te most severe attack is depicted in Fig. 3(a), in wic J r oversadows S r in te received signal space, preventing S r from being recovered. On te contrary, te least powerful attack emits a jamming signal tat is ortogonal to te legitimate signal as sown in Fig. 3(b), in wic te projected signal is equivalent to te original signal, yielding te igest projected signal amplitude. Fig. 3(c) sows a case in between te above two extreme cases, were te angle between two received signals takes a small value. Terefore, by manipulating te jamming signal direction, te jammer as te potential of affecting te effectiveness of MIMO IC mecanism. Correspondingly, te jammer s attack strategy is to srink te angle between te jamming signal and te intended signal by moving towards te vicinity of te sender. As a matter of fact, te difference between s and j deviates according to te distance between S and J [7]. More specifically, if te spacing between two antennas is narrower tan a alf wavelengt, te cannels from tese two antennas will become igly correlated [6], wic renders two received signal directions similar. In order to demonstrate te effectiveness of suc attack strategy, we perform an experiment on a 2 MIMO link of Fig. 2 by varying te distance between te jammer and sender s antennas. Fig. 4 sows te packet delivery rate (PDR) performance, in wic sender s PDR drops to zero wen te antenna distance decreases below 6cm. 2 Te angle between two received signal vectors is equal to te angle between two cannel vectors, computed by cosθ = H j s. Te angle s j s range is [, π 2 ].

4 Fig. 5: Extended frame structure Distance Between Two Antennas (cm) Fig. 4: Jamming attack performance by approacing te sender s location (in tis experiment, te device works on 2.45GHz central frequency wit a alf wavelengt λ 2 = c 2f 6.2cm) IV. DEFENSE MECHANISMS AGAINST REACTIVE JAMMING ATTACK In tis section, we propose effective MIMO-based defense mecanisms to counteract reactive jamming attack based on IC tecnique. We first develop an iterative cannel tracking mecanism to cancel arbitrary jamming signals by keeping track of te jamming signal direction. Ten, we build an enanced defense mecanism by incorporating signal enancing rotation to enable a more robust OFDM communication. As opposed to te attack strategy to srink te angle between two arrival signals, te defense mecanism attempts to expand te angle. We address two major issues in tis section: ) ow to decode te signals of interest in te presence of arbitrary jamming signals; 2) ow to strengten te robustness of OFDM communications against adaptive and reactive jammer. A. Defense Mecanism Overview We offer an overview of proposed defense mecanisms in tis section. Te defense mecanism mainly includes angle expansion, signal decoding (Section IV-B), cannel tracking (Section IV-B) and jamming detection (Section IV-C) modules. Angle expansion module aims at expanding te angle of arrival signals to make intended signals decodable. As long as te jammer fails to approac te sender, te cannels s and j will be uncorrelated, resulting in a random angle between S r and J r, and tus a ig decoding rate. To prevent te jammer from getting close is straigtforward, te sender can move randomly inside te receiver s reception range to avoid being approaced. Alternatively, spatial retreat [8] tecnique can be utilized to strategically move away from te jammer. Ten, signal decoding is implemented using MIMO IC tecnique after cannel estimation. Meanwile, jamming detection module intends to instantly identify te beginning and end of a jamming attack to trigger te defending process. Enanced defense mecanism (Section IV-D) involves signal enancing rotation module, for rotating te transmitted signal to improve sender signal decodability. It also incorporates a feedback mecanism to reliably guide te sender s rotation process. B. Decoding te Signal of Interest According to Eqs. (2), (5), te estimation of te sender s and jammer s cannels is te most crucial task in jammingresistant solution based on MIMO IC tecnique. Initial estimation of sender s cannel s can be derived via analyzing te undisturbed preamble. However, since initial cannel estimation is only valid witin te cannel coerence time, updating te cannel estimation over time becomes a necessity. Inspired by ZigZag decoding tecnique [9], we devise an iterative cannel tracking mecanism by jointly keeping track of bot te sender and jammer s cannel conditions in a timely manner. In te following, we first exibit jammer cannel estimation metod, and ten present te iterative mecanism for updating bot cannels iteratively. Jammer Cannel Estimation. Witout pre-known preambles in te jamming signals, it is difficult to carry out jammer cannel estimation. Fortunately, te most recent advance [] sows tat te complete knowledge of j = [ j, j ]T is not necessary for decoding x s. Due to te nice scale invariance property of signal direction, i.e., te direction of [ j, j ]T is equivalent to tat of [ j,] T, te j only information required about jamming signal for IC to work is te signal direction, i.e. jammer s cannel ratio j. j Note tat te received signal is a mixed signal J r +S r. If we can extract jammer s signal J r = ( j j)x j, we can derive te jammer s cannel ratio by computing te ratio of received jamming signals on two receiving antennas, as j j = xj j x j j Based on tis derivation, We propose te following metod to enable te extraction of te jamming signal J r so tat te cannel ratio can be computed. As sown in Fig. 5, te basic idea of extracting te received jamming signal J r is to insert known symbols (i.e. pilots) in te original data frame, and ten subtract tem from te received mixed signal. Te location of te inserted pilots sould remain secret between te sender and intended receiver, because if te jammer learns te locations of te pilots, e/se can intentionally stop jamming during tese pilot periods to avoid being tracked. Moreover, te pilots sould be inserted frequently to enable frequent updates of te cannel estimation. Note tat, te extension of te frame structure introduces limited overeads, wic will be evaluated in Section VI-D. Te complete jammer cannel estimation sceme proceeds as follows: ) after detecting te beginning of jamming (refer to Section IV-C), te intended receiver finds te next jammed pilots; 2) te received pilots are reconstructed using te known pilot symbol transformed by te estimated sender s cannel (sender cannel estimation is presented below); 3) te constructed received pilots are subtracted from te jammed pilots to restore te jamming signal; 4) te extracted jamming signal is used to compute te jammer s cannel ratio (jamming signal direction). Iterative Cannel Tracking Mecanism. For IC to work, we need te estimations of bot te sender cannel and te.

5 27 jammer cannel. Wen te cannel is being jammed, deriving an accurate estimation of sender cannel is a difficult task. In addition, wireless cannels are time-varying due to inevitable multipat fading. Jammers are also motivated to vary te cannel in order to evade te defense mecanism. To keep te cannel estimation updated and accurate, we need to carry out te cannel estimation frequently. However, te estimation of bot cannels under te jamming situation is ard - we ave two cannel responses to estimate and te received signal is a mixed signal wit two unknown signal components. We propose te following alternating and iterative metod to keep track of te sender and jammer cannels. Te key idea of te proposed metod is tat, we will not be able to calculate te two cannel estimations given two unknown signals. However, we will be able to estimate one cannel if te oter is known. We can make te initial sender cannel estimation after receiving te preamble. Assume tere was no jamming signal, te initial sender cannel response can be estimated as: H s () = ( s() s ()) = (y y 2 )/x s, (6) were x s denotes te known pilots. We will ten do te sender and jammer cannel estimations alternately for every pilot received. Assume te pilots are numbered as i =,...,n. After receiving te first pilot (or odd numbered pilot), te receiver updates te jammer cannel ratio as: j (i)/ j(i) = y x s s (i ) y 2 x s, i =,3,..., (7) s(i ) were we assume te sender cannel did not cange in te past time slot. Similarly, after receiving te second pilot (or an even numbered pilot), te receiver updates te sender cannel estimation H s (i) = ( s(i) s (i)) according to: s (i) j(i ) s(i) = (y j(i ) j (i ) j (i )y 2)/x s, i = 2,4,..., (8) were we assume te jammer cannel did not cange in te past time slot. Two unknown sender cannel components s (i) and s(i) in Eq. (8) are updated alternately after receiving an even numbered pilot. Specifically, s (i) gets updated wen i = 4,8,..., wile s(i) gets updated wen i = 2,6,..., by assuming te oter cannel component did not cange over te past two time slots. Tis updating process continues in suc a way tat te sender and jammer cannels are updated alternately. Note tat tis mecanism requires very frequent cannel updates, witin te cannel coerence time, wic can be as sort as tens of OFDM symbol time [2] in some application scenarios. On te oter and, tis frequent cannel updates elp us to keep close track of te jammer s potential fast adaptation. Sender Signal Decoding. Based on Eq. (2), te signal of interest x s can be written as: y j x s = jy 2, (9) s j j s Fig. 6: Soft error vector in QPSK constellation in wic j is updated every odd numbered pilot in Eq. (7), j and ( s j j s) is updated every even numbered pilot in Eq. (8). Wit precise and frequent updates of cannel estimation, te signal of interest can be correctly recovered using any standard decoder. Inter-Symbol Interference Issue. Anoter practical issue wit te wideband jamming signal is tat it suffers from multipat effects, wic leads to inter-symbol interference (ISI). ISI of jamming signals will impose additional noise to Eq. (5). To counteract ISI, we average our cannel tracking results derived from multiple pilots witin cannel coerence time to mitigate te negative effects of ISI on cannel estimation. Wile it is not a problem for accurate cannel estimation, tis additional noise would reduce te SNR of te intended signal, ence, affects te trougput. To address ISI issue, we must directly investigate te time-domain signal, since ISI is inerently a time-domain penomenon. We apply te metod in [] to deal wit ISI issue, i.e., we convolute te received time-domain signals wit a filter constructed by taking te IFFT of jammer s cannel ratio to cancel out te ISI and jamming signal simultaneously. Te signal of interest can ten be decoded using a standard decoder. C. Detecting te Jamming Signal As mentioned in previous section, te receiver needs to detect te beginning and end of jamming to facilitate IC mecanism. Te jamming detection problem as been studied in [2], in wic te constellation diagrams are employed to identify jammed symbols. We follow te same principle. Soft error vector is utilized to build te detection metric, defined as te distance vector between te received symbol vector and te nearest constellation points in te I/Q diagram, as sown in Fig. 6. Te soft error is furter normalized by minimum distance of te constellation. We assume te normalized soft error vector is V k for k-t received symbol, ten te jamming detection metric is defined as V k / V k at k- t symbol time, wic is named as jumped value. Jamming attack is supposed to start wen V k / V k > γ, were γ is a pre-defined tresold for jamming detection. Jamming attack stops if te jumped value returns to normal. In our system design, we discover a potential jammer by identifying a jump tat is iger tan doubling te errors wit te jamming attack, so tat γ = 2. D. Enanced Defense Mecanism Te fundamental idea of IC is to project te received sender signal to te direction tat is ortogonal to te received jammer signal. As sown in Fig. 3, te signal after projection will ave a reduced signal amplitude, depending on te angle between te two signals. Te IC metod is most effective

6 272 wen te sender signal and te jammer signal are ortogonal [], [2]. Terefore, anoter approac we can explore ere is to maximize te amplitude of projected sender signal, i.e. to improve te sender signal decodability. Te key idea is to rotate te sender s signal so tat te received sender signal is ortogonal to te jamming signal. Tis mecanism works for a multi-antenna sender. Using a 2 2 MIMO link as an example, ( y y 2 ) = j x j + H s ( )x s, () were j denotes a two-dimensional cannel vector from J to R, and H s is te 2 2 cannel matrix from S to R. We exploit te nice property of MIMO communications to control te received signal vector along wic te signal is received [9]. Instead of multiplying vector [ ] T, MIMO allows te sender to multiply wit a different two-dimensional vector r, wic we call rotation vector 3. After tat, te sender will transmit two elements of r x s, one over eac antenna respectively, and te receiver will receive H s r x s. In tis way, te sender is able to control te received signal vector, tus te received signal direction. Constraints on Rotation Vector. After signal rotation, te received signal can be represented as: ( y y 2 ) = j x j + H s rx s, wit a 2 2 cannel matrix between S, J and R as H = { j, H s r}. In order to make x s decodable, H sould remain as a full rank matrix. Tus, one constraint on r is tat it cannot reduce te rank of cannel matrix. In addition, te received signal powers from te sender and jammer are P SR P s H s r 2 and P JR P j j 2, were P s and P j are te sender and jammer s transmission powers. From te above formulas, different r may induce differentp SR and SJR, wic will in turn affect te decoding performance. Terefore, we set r as a unit vector, i.e., r =, suc tat P SR can be confined in a reasonable range. Signal Enancing Rotation Mecanism. In a 2 2 MIMO link of Eq. (), signal rotation can be acieved by simply multiplying normalized r = (H s j )/ H s j = H s [, j ] T / H s j to te sender signal, so tat te received j legitimate signal will be ortogonal to te jamming signal, were j stands for te ortogonal vector of j. However, signal enancing rotation is carried out over sender signal, wile te cannel estimation is conducted at te receiver side. A feedback mecanism is necessary for sending te rotation vector r calculated at te receiver back to te sender. A burst of packets is regarded as a consecutive sequence of packets during te communications as sown in Fig. 7. During eac burst, after identifying jamming treats, te sender continuously rotates te transmit signals of te subsequent frame using te computed rotation vector of te previous frame carried by te feedback frame. To reliably feedback rotation vectors in te presence of reactive jammer, we develop a feedback mecanism as follows. 3 Note tat te signal rotation is carried out in te antenna-spatial domain rater tan in te I-Q domain. Fig. 7: Burst of packets Feedback Mecanism. Te feedback frame can be formulated using te same frame structure in Fig. because it is sort. Te same IC tecnique can be employed to decode te feedback information at te sender, reversing te roles of te sender and receiver in te forward cannel. However, during te transmission of packet bursts, it is igly likely tat bot te feedback packets and te subsequent forwarding packets will be completely jammed by te reactive jammer. In suc a scenario, we try to find an opportunity to compute te jammer s cannel ratio wen te jammer is alone on te medium. Tere are various situations tat a jammer s isolated transmission could be captured. In te case tat te feedback packets are covered by te jamming signals, te jamming signal transmits aead of te feedback signal, leaving te opportunity of capturing te jammer s isolated transmission, from wic te sender can compute te jammer s cannel ratio by taking te ratio of two jamming signals received on js js is/er two antennas y s = js x js and y s2 = js x js. Te receiver could also delay te transmission of te feedback packet for a random time period so tat te sender could capture jammer s isolated transmission rigt after is/er own transmission finises. In eiter case, te sender uses te jammer s cannel ratio to eliminate te jamming signal from te received mixed signal J r +S r, and find te preamble to estimate te feedback cannel using Eq. (6), wic can be used for signal decoding as usual. Similarly, te receiver can also use te same mecanism to recover te completely jammed forwarding packets in a packet burst. Two points are wort noting: first, te sender needs to detect te jamming signals to decide weter e/se will apply te rotation vectors to te subsequent packet. In particular, if te sender detects jamming signals wen decoding te feedback packet, e/se will apply rotation vectors, assuming te jammer will be active for te subsequent transmission. Second, te feedback information sould be received in a timely fasion, because if te cannel estimation expires, te rotation vector will no longer be effective. Tus, te sender will count te feedback time to determine weter to apply rotation vectors or not. V. IMPLEMENTATION We build a prototype using five USRP-N2 radio platforms [22] and GNURadio software package. Eac USRP board is equipped wit one XCVR245 daugterboard operating on 82. spectrums. Te MIMO cable allows two USRP devices to sare reference clock and acieve time syncronization by letting te slave device acquire clock and time reference from te master device. By connecting two USRP boards using MIMO cable to act as one MIMO node, we build a 2 2 MIMO system using four USRP boards. Eac MIMO node

7 273 runs 82.-like PHY layer protocol using OFDM tecnology wit 64 OFDM subcarriers. Te MIMO system works wit various modulation types, wile we use BPSK for legitimate communications in our experiments. We configure eac USRP to span M Hz bandwidt by setting bot te interpolation rate and decimation rate to. MIMO IC tecnique is implemented at te receiver to recover te signals of interest. We also implement te decoding mecanism incorporating signal enancing rotation at bot te sender and receiver sides. Te reactive jammer is anoter USRP device connected wit XCVR 245 daugterboard. To defend against jamming attack, te receiver first estimates sender s cannel and jammer s cannel ratio, ten uses IC tecnique to eliminate te signals from te jammer. Meanwile, te receiver will compute te rotation vector and transmit it back to te sender for signal enancing rotation. After receiving te rotation vector, te sender cecks weter it is still witin te predefined cannel coerence time since its previous transmission. If it is, te sender will apply te rotation vector to te newly generated symbols and send te rotated elements troug two antennas. We set te transmission power of bot te sender and jammer as mw. Implementing a software radio-based reactive jammer is itself a non-trivial task [5], [23]. Here, we emulate te reactive jamming attack and te jammer s carrier sensing process by letting te receiver broadcast a trigger signal. Bot te jammer and sender record te timestamp of detecting te trigger t trig, ten sender sets its beginning time of transmission as t send = t trig +t, and jammer sets its jamming start time as t jam = t trig +t 2. Ten, te reactive jammer s reaction time is equivalent to (t 2 t ). VI. EVALUATION In tis section, we demonstratively sow te ability of jammer to disable MIMO IC mecanism by managing te received signal directions, and we also evaluate te performance of our defense mecanisms in an indoor lab environment. In our experiments, we first sow ow te received signal direction affects te packet delivery performance. Ten, we present our measured cannel coerence time in te indoor environment and discuss ow it will affect te performance of our defense mecanism. Finally, we exibit te performance of jamming attack and defense mecanisms under different bandwidt settings. A. Impact of Received Signal Direction We argued in Section III tat te angle between two received signal directions will affect te decoding performance using IC. In tis section, we will sow te packet delivery performance wit respect to different angles. We set up two clients syncronized by a MIMO cable, togeter wit a twoantenna receiver. Ten, two clients transmit different streams to te receiver. Te receiver applies IC tecnique to decode one of te streams by regarding te oter stream as interference from te jammer. We mentioned tat te signal direction is determined by te cannels between te transmitter and te receiver in Section II-C. Altoug te cannel evolves over time, we observe tat te angle remains relatively stable for te time being, given te fixed locations of clients and receiver. Ten, we cange te locations of te clients and receiver to Angle Between Two Received Signals in Degrees Fig. 8: Packet delivery rate performance wit different angles between two received signals measure te packet delivery performance wit different angles between two received signals. We fix te distance between te clients and receiver, so tat te performance variation among different cases is mainly induced by different angles, rater tan different pat losses. We sow te performance measurement in Fig. 8, from wic we can see te angle between two received signals indeed affects te packet delivery performance significantly. Te major observation is tat PDR declines below 2% once te angle becomes smaller tan 2, wile PDR rises above 9% once te angle expands greater tan 6. Tis result confirms our analysis. B. Impact of Cannel Coerence Time Te cannel coerence time determines ow often te cannel estimation sould be updated and te validity period of te rotation vector. In tis section, we measure te cannel coerence time in an indoor environment. We let a sender transmit consecutive known OFDM symbols following a preamble to track te cannel variations. Te receiver uses tese known OFDM symbols to estimate te cannel coefficients, and examines ow long te cannel from te sender to te receiver remains correlated. Eac cannel coefficient is a complex number wit amplitude and pase values. We investigate multiple subcarriers over several rounds. Fig. 9 sows te autocorrelation of cannel pase over multiple subcarriers. Te cannel pase correlates over multiple OFDM symbols before it becomes uncorrelated (i.e. autocorrelation value becomes zero [2]). Te number of correlated OFDM symbols varies wit subcarriers, wit te average number of 33. On te oter and, te cannel amplitude stays more stable over multiple OFDM symbols, wose autocorrelation value sows correlation over 5 OFDM symbols. Terefore, te cannel coerence time in our experimental environment is nearly 33 OFDM symbols or 8.5ms, wic indicates tat te cannel estimation sould be updated at least every 3 OFDM symbols, nearly 2 bytes under 5KHz bandwidt, or nearly 4 bytes under M Hz bandwidt. Terefore, te pilots sould be inserted at least once every (2) bytes of data under 5KHz (M Hz) bandwidt, because te estimation of te sender s and jammer s cannels is updated alternately every oter pilot as sown in Section IV-B. Tis result also tells us te rotation vector is effective witin te 33 OFDM symbol time, after wic te rotation vector becomes expired. Note tat during jammer s cannel estimation in Section IV-B, we assume jammer s cannel keeps static during te cannel coerence time. However, mobile jammer as te ability of canging is/er cannel conditions in real-

8 274 Normalized Autocorrelation Value st Subcarrier Autocorrelation 5 t Subcarrier Autocorrelation 35 t Subcarrier Autocorrelation Number of OFDM Symbols Fig. 9: Autocorrelation of te cannel pase in an indoor environment (tested using 5KHz bandwidt communications) Fig. : Testbed. Te receiver is placed at A, wile te sender and jammer are placed at te selected locations to 9. time. Referring back to Fig. 4, we notice cm distance cange will bring a dissimilar cannel, i.e., if te jammer moves cm witin te cannel coerence time, not only te jammer s cannel estimation will be inaccurate, but te jammer can also vary is/er signal directions to nullify te cannel tracking. However in tis case, te jammer sould move at a speed of at least cm 8ms = 2.5m/s, or equivalently 45km/, making it extremely difficult to target at a specific MIMO link. Apparently, reducing te pilot interval is a remedy to defeat a ig-speed jammer. We will design experiments to evaluate te IC performance under mobile jammers in our future work. C. Jamming Attack and Defense Performance In tis section, we evaluate te performance of te jamming attack and defense mecanisms in terms of packet delivery rate. We place te receiver at location A in Fig.. In eac run, we place te sender and jammer at te selected locations in Fig.. We run te experiments in seven different cases, i.e., case : (,2); case 2: (3,7); case 3: (4,5); case 4: (6,8); case 5: (8,9); case 6: (5,9); case 7: (4,8), were (x,y) denotes te locations of te sender and jammer respectively. We repeat eac case for more tan times, wit eac run transmitting 5 packets. First, we present te jamming attack performance by jamming te 2 MIMO link in Fig., from wic we can see tat te PDR drops to zero in almost all seven cases in te presence of te reactive jammer. Tis result sows te reactive jammer succeeds in trottling OFDM-MIMO communications completely. Ten, we run anoter set of experiments to jam a 2 2 MIMO link. Fig. 2 plots te sender s PDR performance under different bandwidt settings. Tis figure also sows te reactive jammer is very effective in degrading packet delivery performance of te MIMO links, as none of te packets is successfully delivered to te receiver using te traditional MIMO decoding sceme. In contrast, using our defense mecanism witout signal enancing rotation, te jamming signals can be eliminated to some extent by estimating jammer cannel ratio. Terefore, te PDR under 5KHz bandwidt can stay iger tan 3%, wile exact PDR value depends on te cannel estimation accuracy and te relative angles between te received signals from te jammer and sender. We notice tat te acieved performance sows great variations across difference cases. Finally, te PDR performance can be furter improved using signal enancing rotation. Bot Fig. 2(a) and Fig. 2(b) reveal tat te packet delivery performance using enanced defense mecanism after applying signal enancing rotation as been significantly improved and becomes more stable. In particular, te jamming resilient communications acieve more tan 6% PDR under 5KHz bandwidt and more tan 4% PDR under M bandwidt. Tus, we conclude tat signal enancing rotation can elp sustain more robust OFDM communications. From Fig. 2(a) to Fig. 2(b), we note a trend tat te packet delivery performance becomes worse as te transmission bandwidt expands. Tat is because iger data rate transmission is more sensitive to burst of interference and noise in te environment [24]. D. Overead Analysis We analyze te overead for bot te pilots and feedback information. As mentioned in Section VI-B, one pilot symbol is inserted every 5 OFDM data symbols. Terefore, te pilot takes nearly 6% of te wole packet. On te oter and, te feedback message includes 48 rotation vectors wit one for eac subcarrier in our setting. In order to reduce te feedback size, instead of returning all te 48 vectors, it is sufficient to respond 2 vectors, since te cannels for consecutive subcarriers are rater similar. In addition, as te direction of vector [v,v 2 ] is equivalent to [, v2 v ], we can reduce te number of elements in a vector into one complex number. Te overall feedback overead adds up to 24 bytes, or 4 OFDM symbols. Terefore, te feedback information is also very sort wit only a few OFDM symbols. VII. RELATED WORK Jamming Attack and Defense Mecanisms. Powerful reactive jamming as aroused many researcers interests. For instance, [5] demonstrates te feasibility of reactive jamming using software-defined radios. [3] proposes detection mecanism to unveil reactive jammer in sensor networks. [25] investigates te impacts of reactive smart jamming attacks to IEEE 82. rate adaptation algoritms. Recent studies consider more powerful wideband and ig power jamming attacks [2], [5]. However, bot of tem only support low data rate communications. Besides tat, bot of tese two defense mecanisms only work for conventional wireless communications tat are not OFDM-based. In [26], Vo-Huu et al. proposes a mecanical beamforming sceme and a digital interference cancellation algoritm to cancel jamming signals. However, tey can only deal wit static adversaries and require additional ardware costs, wile our mecanism is purely digital wic is capable of dealing wit mobile attackers as long as te cannel estimation is accurate. Furter, tey only focus on non-ofdm systems.

9 kHz Bandwidt w/o Jammer M Bandwidt w/o Jammer 5KHz Bandwidt wit Jammer M Bandwidt wit Jammer Case No. Fig. : Packet delivery rate wit and witout jammer in 2 link Wit Jammer Using Defense Mecanism Using Enanced Defense Mecanism Witout Jammer Case No. (a) 5KHz Bandwidt Wit Jammer Using Defense Mecanism Using Enanced Defense Mecanism Witout Jammer Case No. (b) M Bandwidt Fig. 2: Jamming attack and defense performance Interference Cancellation Mecanisms. Researc efforts in te interference management area ave developed novel interference cancellation tecniques to improve te network trougput [9], medium access protocol [] and robustness [] of MIMO networks. Te most relevant work is [], wic enables MIMO communications under ig-power cross-tecnology interferers. Yet, our work exposes several significant differences: ) we consider smart jammers, wo can adapt teir attack strategy to be more destructive, wile interferers are unintentional; 2) teir cannel estimation metods require to average over multiple OFDM symbols, wic is not applicable for tracking jammer s cannel due to jammer s fast adaptation, wile our mecanism inserts pilots into known locations to jointly track te sender and jammer s cannels instantaneously. VIII. CONCLUSION OFDM is one of te most widely adopted wireless communication scemes. Despite of its popularity in te wireless field, it is vulnerable to advanced jamming attacks, especially te powerful reactive jamming attack enabled by software defined radio tecnology. Wile no effective anti-jamming solutions exist to secure OFDM communications, for te first time, we exploited MIMO tecnologies to defend against suc jamming attacks. We sowed tat suc attacks can severely disrupt OFDM-MIMO communications troug controlling te jamming signal vectors in te antenna-spatial domain. Accordingly, we proposed defense mecanisms based on interference cancellation and transmit precoding tecniques to maintain OFDM communications under reactive jamming. REFERENCES [] A. Wood and J. Stankovic, Denial of service in sensor networks, Computer, vol. 35, no., pp , 22. [2] W. Xu, W. Trappe, Y. Zang, and T. Wood, Te feasibility of launcing and detecting jamming attacks in wireless networks, in Proceedings of te 6t ACM International Symposium on Mobile Ad Hoc Networking and Computing, ser. MobiHoc 5, 25, pp [3] M. Strasser, B. Danev, and S. Capkun, Detection of reactive jamming in sensor networks, ACM Transactions on Sensor Networks(TOSN), vol. 7, no. 6, pp. 29, 2. [4] K. Pelecrinis, M. Iliofotou, and S. Krisnamurty, Denial of service attacks in wireless networks: Te case of jammers, Communications Surveys Tutorials, IEEE, vol. 3, no. 2, pp , 2. [5] M. Wilelm, I. Martinovic, J. B. Scmitt, and V. Lenders, Reactive jamming in wireless networks - ow realistic is te treat? in Proc. of WiSec, June 2. [6] A. Cassola, W. Robertson, E. Kirda, and G. Noubir, A practical, targeted, and stealty attack against wpa enterprise autentication, in Proceedings of te 2t Annual Network and Distributed System Security Symposium (NDSS 3), February 23. [7] M. Han, T. Yu, J. Kim, K. Kwak, S. Lee, S. Han, and D. Hong, OFDM cannel estimation wit jammed pilot detector under narrowband jamming, IEEE Transactions on Veicular Tecnology, vol. 57, no. 3, pp , 28. [8] T. Clancy, Efficient OFDM denial: Pilot jamming and pilot nulling, in Proc. of ICC, 2. [9] S. Gollakota, S. D. Perli, and D. Katabi, Interference alignment and cancellation, in Proc. of SIGCOMM, August 29. [] S. Gollakota, F. Adib, D. Katabi, and S. Sesan, Clearing te RF smog: Making 82. robust to cross-tecnology interference, in Proc. of SIGCOMM, August 2. [] K. C.-J. Lin, S. Gollakota, and D. Katabi, Random access eterogeneous MIMO networks, in Proc. of SIGCOMM, August 2. [2] Y. Liu and P. Ning, Bittrickle: Defending against broadband and igpower reactive jamming attacks, in Proc. of IEEE INFOCOM, 22. [3] H. Kim and K. G. Sin, In-band spectrum sensing in cognitive radio networks: energy detection or feature detection? in Proc. of MobiCom, September 28, pp [4] D. Cabric, A. Tkacenko, and R. W. Brodersen, Experimental study of spectrum sensing based on energy detection and network cooperation, in Proceedings of te First International Worksop on Tecnology and Policy for Accessing Spectrum, ser. TAPAS 6, 26. [5] W. Xu, W. Trappe, and Y. Zang, Anti-jamming timing cannels for wireless networks, in Proc. of WiSec, 28. [6] D. Tse and P. Viswanat, Fundamentals of Wireless Communication. Cambridge University Press, 25. [7] Y. Liu, P. Ning, and H. Dai, Autenticating primary users signals in cognitive radio networks via integrated cryptograpic and wireless link signatures, in Proc. of IEEE S&P, May 2. [8] W. Xu, W. Trappe, and Y. Zang, Cannel surfing and spatial retreats: Defenses against wireless denial of service, in Proc. of WiSe, 24. [9] S. Gollakota and D. Katabi, ZigZag decoding: Combating idden terminals in wireless networks, in Proc. of SIGCOMM, August 28, pp [2] K. Miller, A. Sanne, K. Srinivasan, and S. Viswanat, Enabling realtime interference alignment: promises and callenges, in Proceedings of te tirteent ACM international symposium on Mobile Ad Hoc Networking and Computing, 22, pp [2] W.-L. Sen, Y.-C. Tung, K.-C. Lee, K. C.-J. Lin, S. Gollakota, D. Katabi, and M.-S. Cen, Rate adaptation for 82. multiuser MIMO networks, in Proc. of MobiCom, August 22. [22] Ettus researc llc, ttp:// [23] D. Giustiniano, V. Lenders, J. B. Scmitt, M. Spuler, and M. Wilelm, Detection of reactive jamming in dsss-based wireless networks, in Proceedings of te Sixt ACM Conference on Security and Privacy in Wireless and Mobile Networks, ser. WiSec 3, 23, pp [24] W. Stallings, Data and Computer Communications (9t Edition). Prentice Hall, 2. [25] G. Noubir, R. Rajaraman, B. Seng, and B. Tapa, On te robustness of ieee82. rate adaptation algoritms against smart jamming, in Proc. of WiSec, June 2. [26] T. D. Vo-Huu, E.-O. Blass, and G. Noubir, Counter-jamming using mixed mecanical and software interference cancellation, in Proc. of WiSec, April 23.