Investigation of Signal and Message Manipulations on the Wireless Channel

Abstract

Abstract. We explore the suitability of Dolev-Yao-based attacker models for the security analysis of wireless communication. The Dolev-Yao model is commonly used for wireline and wireless networks. It is defined on abstract messages exchanged between entities and includes arbitrary, real-time modification of messages by the attacker. In this work, we aim at understanding and evaluating the conditions under which these real-time, covert low-energy signal modifications can be successful. In particular, we focus on the following signal and message manipulation techniques: symbol flipping and signal annihilation. We analyze these techniques theoretically, by simulations, and experiments and show their feasibility for particular wireless channels and scenarios.

Distance Hijacking Attacks on Distance Bounding Protocols

“…FORMAL ANALYSIS Previous formal models capture Distance Hijacking to an insufficient extent. Specifically, they do not capture overshadowing parts of a message (see [22]), e. g., by sending bits using a stronger signal. Several of our Distance Hijacking attacks involve such overshadowing.…”

“…We extend the formal framework of Basin et al [3] to capture all known types of Distance Hijacking attacks and use the resulting framework to analyze several protocols. The new framework enables us to model bit-level manipulations of messages by considering overshadowing parts of a message [22], as well as flipping some bits of a message. We use our framework to formally prove for specific protocols that our fixes indeed prevent the found attacks.…”

Friendly Jamming on Access Points: Analysis and Real-World Measurements

“…Our simulations in Section IV are most similar to [7], [10], [29], [33], [41], which consider the effect of interference for different time and phase offset of the sender and receiver. However, these works only consider the temporal displacement at the frame preamble level [33]; focus on different technologies (IEEE 802.15.4) [41]; analyze the effects of jamming at the bit level when neither spreading or other explicit error detection and correction techniques are in use [29]; and consider only the relative time offset ignoring the relative power of the interfering signals [10]. What makes our analysis different from previous works is that we focus on IEEE 802.11 modulations and encoding schemes, we consider a scenario in which the receiver is already synchronized with the attack frame when the intentional interference starts and we take into account both the power ratio and the temporal displacement between interfering signals.…”

On robustness of physical layer network coding to pollution attack

“…This gives us a fair comparison where the intruder is present only in one time slot for all schemes. An example for networks with an intruder can be a wireless network with static wireless nodes, quasi-free-space channel properties such as the ones observed in wireless sensor networks deployed in large areas [28]. Another common scenario can be described with an example in a wireless network for TWRC model where two users (cell phones) try to communicate via a base station (relay).…”

“…Digital wireless attacks for signals such as Bluetooth and Wi-Fi are possible with very low power. For the transmission power of the intruder (P I ), the example of reactive (or responsive) attacker can be used where the intruder looks for ongoing transmissions in order to compose their attack signal (the intruder applies power management to identify the appropriate direction of transmission, power, and timing for its attack) [28]. Through the transmission of a high power signal on the same frequency of a user, the intruder can create a competing signal that collides with and, in effect, cancels out the users' signal.…”