Are We Really Close? Verifying Proximity in Wireless Systems

Ranganathan, Aanjhan; Čapkun, Srđjan

doi:10.1109/msp.2017.56

Cited by 35 publications

(15 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Existing ranging systems are typically vulnerable to one of three types of attacks: Relay, Cicada [27] and Early-Detect/Late-Commit. These are illustrated in Figure 3.…”

Section: B Physical-layer Attacksmentioning

confidence: 99%

“…techniques have been shown to be vulnerable to physicallayer attacks [27]; most notable examples include spoofing attacks on GPS [24], [19], relay attacks on passive entry/start systems in cars [15] and credit card payments [16]. Those vulnerabilities have real-world implications, as shown by a recent car theft that found widespread media attention [5].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

UWB with Pulse Reordering: Securing Ranging against Relay and Physical-Layer Attacks

Singh

Leu

Čapkun

2019

Proceedings 2019 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

Physical-layer attacks allow attackers to manipulate (spoof) ranging and positioning. These attacks had realworld impact and allowed car thefts, executions of unauthorized payments and manipulation of navigation. UWB impulse radio, standardized within 802.15.4a,f, has emerged as a prominent technique for precise ranging that allows high operating distances despite power constraints by transmitting multi-pulse symbols. Security of UWB ranging (in terms of the attacker's ability to manipulate the measured distance) has been discussed in the literature and is, since recently also being addressed as a part of the emerging 802.15.4z standard. However, all research so far, as well as security enhancements proposed within this emerging standard face one main limitation: they achieve security through short symbol lengths and sacrifice performance (i.e., limit the maximum distance of measurement), or use longer symbol lengths, therefore sacrificing security. We present UWB with pulse reordering (UWB-PR), the first modulation scheme that secures distance measurement between two mutually trusted devices against all physical-layer distance shortening attacks without sacrificing performance, therefore simultaneously enabling extended range and security. We analyze the security of UWB-PR under the attacker that fully controls the communication channel and show that UWB-PR resists such strong attackers. We evaluate UWB-PR within a UWB system built on top of the IEEE 802.15.4 device and show that it achieves distances of up to 93m with 10cm precision (LoS). UWB-PR is, therefore, a good candidate for the extended mode of the new 802.15.4z Low Rate Pulse standard. Finally, UWB-PR shows that secure distance measurement can be built on top of modulation schemes with longer symbol lengths-so far, this was considered insecure.

show abstract

“…Existing ranging systems are typically vulnerable to one of three types of attacks: Relay, Cicada [27] and Early-Detect/Late-Commit. These are illustrated in Figure 3.…”

Section: B Physical-layer Attacksmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

UWB with Pulse Reordering: Securing Ranging against Relay and Physical-Layer Attacks

Singh

Leu

Čapkun

2019

Proceedings 2019 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

show abstract

“…These relay attack prevention methods focus on improving the proximity detection. Ranganathan et al [10] concluded that various attacks could exploit the proximity verification method.…”

Section: Introductionmentioning

confidence: 99%

User Context Detection for Relay Attack Resistance in Passive Keyless Entry and Start System

Yang

Fang

et al. 2020

Sensors

View full text Add to dashboard Cite

In modern cars, the Passive Keyless Entry and Start system (PKES) has been extensively installed. The PKES enables drivers to unlock and start their cars without user interaction. However, it is vulnerable to relay attacks. In this paper, we propose a secure smartphone-type PKES system model based on user context detection. The proposed system uses the barometer and accelerometer embedded in smartphones to detect user context, including human activity and door closing event. These two types of events detection can be used by the PKES to determine the car owner’s position when the car receives an unlocking or a start command. We evaluated the performance of the proposed method using a dataset collected from user activity and 1526 door closing events. The results reveal that the proposed method can accurately and effectively detect user activities and door closing events. Therefore, smartphone-type PKES can prevent relay attacks. Furthermore, we tested the detection of door closing event under multiple environmental settings to demonstrate the robustness of the proposed method.

show abstract

“…Numerous wireless ranging and localization techniques were developed in the last decade based on time of arrival, time difference of arrival, phase, RSSI measurements, etc. However, these techniques have shown to be vulnerable to physical-layer attacks [8]; most notable examples include spoofing attacks on GPS, relay attacks on passive entry/start systems in cars [5] and credit card payments. Those vulnerabilities have real world implications as shown by a recent car theft that found widespread media attention [2].…”

Section: Introductionmentioning

confidence: 99%

UWB with Pulse Reordering: Securing Ranging against Relay and Physical Layer Attacks

Singh¹,

Leu²,

Čapkun³

2018

EasyChair Preprints

Self Cite

View full text Add to dashboard Cite

Physical layer attacks allow attackers to manipulate (spoof) ranging and positioning. These attacks had real world impact and allowed car thefts, executions of unauthorised payments and manipulation of navigation. UWB impulse radio (UWB-IR) has emerged as a prominent technique for precise ranging that allows high operating distances despite power constraints by transmitting multi-pulse symbols. Unfortunately, longer symbols make UWB-IR vulnerable to physical layer attacks. Currently, none of the existing systems is precise, performant and secure at the same time. We present UWB with Pulse Reordering (UWB-PR), the first modulation scheme that secures distance measurement between two mutually trusted devices against all physical-layer attacks.

show abstract

Are We Really Close? Verifying Proximity in Wireless Systems

Cited by 35 publications

References 6 publications

UWB with Pulse Reordering: Securing Ranging against Relay and Physical-Layer Attacks

UWB with Pulse Reordering: Securing Ranging against Relay and Physical-Layer Attacks

User Context Detection for Relay Attack Resistance in Passive Keyless Entry and Start System

UWB with Pulse Reordering: Securing Ranging against Relay and Physical Layer Attacks

Contact Info

Product

Resources

About