Physical layer orthogonal frequency‐division multiplexing acquisition and timing synchronization security

Abstract

Orthogonal frequency-division multiplexing (OFDM) has become the manifest modulation choice for 4G standards. Timing acquisition and carrier frequency offset synchronization are prerequisite to OFDM demodulation and must be performed often. Most of the OFDM methods for synchronization were not designed with security in mind. In particular, we analyze the performance of a maximum likelihood synchronization estimator against highly correlated jamming attacks. We present a series of attacks against OFDM timing acquisition: preamble whitening, the false preamble attack, preamble warping, and preamble nulling.The performance of OFDM synchronization turns out to be very poor against these attacks, and a number of mitigation strategies and security improvements are discussed.

Jamming Attacks and Anti-Jamming Strategies in Wireless Networks: A Comprehensive Survey

“…5, timing synchronization is a critical component of the Wi-Fi receiver to decode the data packet. Various jamming attacks have been proposed to thwart the signal timing acquisition and disrupt the start-of-packet detection procedure, such as false preamble attack, preamble nulling attack, and preamble warping attack [32], [52], [53]. These attacks were sophisticatedly designed to thwart the timing synchronization process at a Wi-Fi receiver.…”

“…These attacks were sophisticatedly designed to thwart the timing synchronization process at a Wi-Fi receiver. False preamble attack [52], [53], also known as preamble spoofing, is a simple method devised to falsely manipulate timing synchronization output injecting the same preamble signal as that in legitimate Wi-Fi packets. By doing so, a Wi-Fi receiver will not be capable of decoding the desired data packet as it will fail in the correlation peak detection.…”

Swift Jamming Attack on Frequency Offset Estimation: The Achilles’ Heel of OFDM Systems

“…Constant, deceptive, and random jamming models achieve a high level of DoS by excessively transmitting over the channel, but exhibit poor energy efficiency and high detection probability [22]. On the other hand, energy-efficient reactive jamming attacks select and target a (part of a) packet based on traffic analysis, protocol semantics, or publicity of some fields [3], [4], [8]- [10], [20]. These attacks may fail to significantly corrupt ongoing transmissions if, for example, channel hopping, randomization, and coding are used to hide the transmission features.…”

“…In contrast, our proposed attack lasts for less than the duration of a pilot symbol jamming and corrupts the channel estimation without jamming pilots. Jamming against timing acquisition in OFDM systems and some countermeasures were discussed in [8], [11], [12]. However, OFDM systems are more sensitive to FO than timing errors.…”

“…These works often consider vulnerabilities in time synchronization or susceptibility to inter-carrier interference (ICI). For example, the authors in [8] proposed several jamming attacks against OFDM time synchronization, including barrage attacks, false preamble timing, and preamble warping. In the barrage attack, white noise is transmitted to decrease the SNR during synchronization.…”