PHY foundation for multi-factor ZigBee node authentication

Abstract

The ZigBee specification builds upon IEEE 802.15.4 low-rate wireless personal area standards by adding security and mesh networking functionality. ZigBee networks may be secured through 128-bit encryption keys and by MAC address access control lists, yet these credentials are vulnerable to interception and spoofing via free software tools available over the Internet. This work proposes a multi-factor PHY-MAC-NWK security framework for ZigBee that augments bit-level security using radio frequency (RF) PHY features. These features, or RF fingerprints, can be used to differentiate between dissimilar or like-model wireless devices. Previous PHY-based works on mesh network device differentiation predominantly exploited the signal turn-on region, measured in nanoseconds. For an arbitrary benchmark of 90% or better classification accuracy, this work shows that reliable PHY-based ZigBee device discrimination can be achieved at SNR ≥ 8 dB. This is done using the entire transmission preamble, which is less technically challenging to detect and is over 1000 times longer than the signal turn-on region. This work also introduces a statistical, pre-classification feature ranking technique for identifying relevant features that dramatically reduces the number of RF fingerprint features without sacrificing classification performance.

Wireless infrastructure protection using low-cost radio frequency fingerprinting receivers

“…11.002 1874-5482/Published by Elsevier B.V. packet replay attacks) through device-unique radio frequency fingerprints. Wireless device classification accuracy exceeding 99% has been demonstrated using high-end signal collection receivers (with per unit cost exceeding USD 50,000) that include a 4 Gsps oscilloscope [3], 8 Gsps oscilloscope [4], 50 Gsps oscilloscope [16], a 95 Gsps Agilent E3238S signal intercept system [5,19], and an Agilent PSA E4448A spectrum analyzer combined with a 4Gsps oscilloscope [22]. The high cost of these signal receivers prohibits their use in practical radio frequency fingerprinting systems.…”

An Optimization Framework for Generalized Relevance Learning Vector Quantization with Application to Z-Wave Device Fingerprinting

“…This involves computing the AUC for each ROC curve, one curve is associated with one device, and then computing the mean of all curves considered. Table 3 presents verification results via %Aut, AUC and AUC M at SNR = [18,20,22] dB; further verification results will only be considered herein for SNR = 20dB (the SNR at which GRLVQI achieves %C = 90%). As seen in the %Aut column Table 3, the %Aut rate involves dichotomization, c.f.…”

“…For all devices used herein, prior probabilities were considered equal between devices, with the update logic and GRLVQI classifier model as described in [18], [23].…”

“…RF-DNA differs from typical WPAN defense and security strategies that target higher bitlevel network layers [19], i.e., the Network (NWK) and Media Access Control (MAC) layers [20]. Using underutilized PHY information [18] with NWK and MAC information yields a more robust biometric-like wireless security strategy that includes [18], [21]:…”

“…Device hardware ID and operating state discrimination for CI security applications has been reliably demonstrated using Physical (PHY) layer security enhancement [4], [9], [15]. As discussed in [16], PHY layer security involves either 1) adding physically traceable objects to devices [17] or 2) Radio Frequency Distinct Native Attribute (RF-DNA) fingerprinting based on PHY device emissions which overcome limitations of encryption key-based measures [18]. RF-DNA differs from typical WPAN defense and security strategies that target higher bitlevel network layers [19], i.e., the Network (NWK) and Media Access Control (MAC) layers [20].…”