Wireless infrastructure protection using low-cost radio frequency fingerprinting receivers

Abstract

Physical layer security WPAN Spoofing ZigBee Networks a b s t r a c t Low-data-rate wireless networks incorporated in critical infrastructure applications can be protected through 128-bit encryption keys and address-based access control lists. However, these bit-level credentials are vulnerable to interception, extraction and spoofing using software tools available free of charge on the Internet. Recent research has demonstrated that wireless physical layer device fingerprinting can be used to defend against replay and spoofing attacks. However, radio frequency (RF) fingerprinting typically uses expensive signal collection systems; this is because fingerprinting wireless devices with low-cost receivers has been reported to have inconsistent accuracy. This paper demonstrates a robust radio frequency fingerprinting process that is consistently accurate with both highend and low-cost receivers. Indeed, the results demonstrate that low-cost software-defined radios can be used to perform accurate radio frequency fingerprinting and to identify spoofing attacks in critical IEEE 802.15.4-based infrastructure networks such as ZigBee.Published by Elsevier B.V. IntroductionLow-cost, low-data-rate wireless connectivity is pervasive in critical infrastructure applications. IEEE 802.15.4-based wireless personal area networks (WPANs) operate in one-quarter of the surveyed wireless industrial control systems [1], communicate with tens of millions of smart meters [7] and are trusted components in numerous civilian and military healthcare facilities [12,21]. Security in such systems is often an afterthought, exposing critical WPANs to malicious attacks. A recent analysis of WPANs in ten U.S. cities revealed that healthcare and utility control networks operate with faulty security or none at all [17]. The threats to the critical infrastructure and other WPAN applications [15,20] are ever increasing as open source attack tools such as KillerBee [24] and Api-do [9] become more sophisticated.WPAN security is challenging due to the cost, power and computational constraints levied on IEEE 802.15.4-based hardware. Secure, albeit computationally-intensive, intrusion detection algorithms have been developed for high-power networks, but they are impractical for WPAN applications. While networklayer encryption is a viable option for critical networks, attackers can readily extract keys from inexpensive WPAN hardware when tamper resistance is not a design priority [2,8].A promising solution for securing WPANs without placing additional burden on end devices is radio frequency (RF) fingerprinting. In such a system, an "air monitor" passively observes WPAN packets and identifies message spoofing (e.g., http://dx.(B.W. Ramsey). i n t e r n a t i o n a l j o u r n a l o f c r i t i c a l i n f r a s t r u c t u r e p r o t e c t i o n ] ( ] ] ] ] ) ] ] ] -] ] ] Please cite this article as: B.W. Ramsey, et al., Wireless infrastructure protection using low-cost radio frequency fingerprinting receivers, International Journal of Critical Infrastructu...

Evaluating ITU-T G.9959 Based Wireless Systems Used in Critical Infrastructure Assets

“…A fingerprinting technique known as preamble manipulation may be applicable to Z-Wave devices [14]. Unfortunately, it was difficult to find a Z-Wave device that uses a transceiver other than the ZM3102N to verify this technique.…”

“…IEEE 802.15.4 networks (e.g., WirelessHART and ZigBee) fulfill low-rate communications roles similar to those of Z-Wave in the critical infrastructure. Recent research efforts (see, e.g., [4,12,14]) have proposed novel security strategies for these networks. However, Z-Wave product development has been significantly restricted by nondisclosure and confidentiality agreements that stifle open-source security and resilience research.…”

Assessment of Features and Classifiers for Bluetooth RF Fingerprinting

“…Mobile devices, such as cell phones and tablets, are considered as the most widely used wireless devices. These mobile devices need to be supported by multiple security approaches [1].…”

Comparison of parametric and non-parametric statistical features for Z-Wave fingerprinting

“…In light of these attacks, wireless situational awareness is an important component for network defense-in-depth. Radio frequency (RF) fingerprinting with low-cost signal collection receivers to protect critical infrastructures was recently demonstrated for the low-rate ZigBee protocols [1], but this work is the first to examine such techniques on Z-Wave.…”

“…While these differences are minute and still produce adequate symbol constellations for digital communication, they have been found useful for device authentication [2]- [5]. The RF signal from each network node is collected, reduced with feature generation 1 Approved for Public Release; Distribution Unlimited : 88ABW-2015-1475 and used to generate a device authentication model via various classifiers. With the learned model, these devices can then be identified and authenticated.…”