Secure LTF Using DFT Precoded OFDM in IEEE 802.11-20
Explore the concept of Secure LTF using DFT Precoded OFDM in the IEEE 802.11-20 standard. The document discusses physical layer security, attacker scenarios, integrity attacks, and computational strategies for protecting communication systems. Learn about safeguarding against proximity spoofing, integrity breaches, and guard interval replay attacks using innovative techniques and security measures.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
July, 2020 doc.: IEEE 802.11-20/1097r1 Secure LTF using DFT Precoded OFDM Date: 2020-07-15 Authors: Name Christian Berger Affiliations NXP Address 350 Holger Way, San Jose, CA Phone email christian.berger@nxp.com Submission Slide 1 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 PHY Security Attacker tries to modify the measured range Make STA appear closer to AP to fake proximity detection Spoof time-stamps t2 or t4 to achieve that Focus on physical layer attack Assume that MAC level is authenticated/encrypted Includes time-stamps t1/t4 feedback to initiator VHT- STF VHT- SIG-B L-STF L-LTF L-SIG VHT-SIG-A VHT-LTF Data VHT-LTF Adversary Timing advance Submission Slide 2 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Integrity Attack Scenario First line security Use secure LTF (sequence unknown to attacker) Replace Cyclic Prefix (CP) with zero-padded Guard Interval (to reduce structure) Attack types 1. Computational attack: attacker observes fraction of symbol and predicts the rest to attack the later part Replay attack: for both Cyclic Prefix or Guard Interval, attacker repeats first quarter portion of secure LTF with offset Brute-force attack: attacker tries to guess the secure LTF Noise only: performance in low SNR or attacker caused SINR 2. 3. 4. Submission Slide 3 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Attacker Type 1 Computational Attack Attacker will listen to first half portion of LTF Then try to estimate the full time-domain LTF waveform (typically by estimating frequency QAM symbols) Change measured t2 or t4 by transmitting the last (estimated) quarter of time-domain LTF waveform with timing advance Waveform for channel measurement First half Timing advance Last quarter Waveform transmitted by attacker Submission Slide 4 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Attacker Type 2 Guard Interval (GI) Replay Attack Attacker will listen to first quarter portion of LTF Then try to change measured t2 or t4 by re-transmitting the first quarter with timing advance at the end Will affect overlap-add based receiver Waveform for channel measurement First quarter Timing advance Copy Waveform transmitted by attacker Submission Slide 5 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Attacker Type 3 Brute Force Attack Attacker will try to change measured t2 or t4 by guessing the secure LTF and transmitting with timing advance Attack efficacy depends on likelihood of high cross-correlation between sequences A and B Waveform for channel measurement LTF Sequence A Waveform transmitted by attacker Timing advance LTF Sequence B Submission Slide 6 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Attacker Type 4 Performance in Noise Even without an attacker the likelihood of triggering a false proximity detection increases with decreasing SNR Attacker can send interference to artificially lower SNR Used as a baseline to compare effectiveness of attacks Measures of PHY security If brute-force attack achieves no worse performance as noise-only If replay attack achieves no worse performance than brute-force Submission Slide 7 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Example: Computational Attack Setup 40 MHz, overlap-add receiver LTF with random QPSK symbols Observation period 50% Observations First half of time domain, contains information about all symbols Intercarrier-interference (ICI) between neighboring symbols Submission Slide 8 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 DFT Precoded OFDM Overview Data symbols are precoded with a DFT matrix before IFFT processing Can be used with cyclic prefix or without Effectively Sinc interpolation of symbols instead of traditional pulse shaper Can also omit DC Christian Berger (NXP) Submission Slide 9
July, 2020 doc.: IEEE 802.11-20/1097r1 Example of DFT Precoded LTF Setup Use VHT40 as example 128 QPSK symbols, DFT precoded Zero out 3 DC tones + guard bands Keep 114 non-zero subcarriers Submission Slide 10 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Spectrum Using VHT40 as example Generate three LTF 4x time-domain oversampling Zero padding Take large FFT to estimate average spectrum Submission Slide 11 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Comparison to regular OFDM and Mask Submission Slide 12 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Cross-correlation for DFT Precoded LTF Setup 40 MHz, overlap-add receiver LTF with DFT precoded random QPSK Observation period 50% Observations First half of time domain, contains little information about second half Only source is ICI between neighboring symbols at least 25 dB Christian Berger (NXP) Submission Slide 13
July, 2020 doc.: IEEE 802.11-20/1097r1 Frequency Domain Windows Raised Cosine Window Can reduce leakage using window Submission Slide 14 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 PAPR Comparison DFT Precoded OFDM Peaks up to 2x due to interpolation (same neighboring symbols) About 1 dB worse than Golay About 2-3 dB better than QPSK Submission Slide 15 Christian Berger (NXP)
July, 2020 doc.: IEEE 802.11-20/1097r1 Conclusion Presented DFT Precoded OFDM for Secure LTF Requires extra FFT operation to populate subcarriers PAPR closer to frequency Golay sequences Attacker resilience Can be used without CP to avoid replay attack Large signal space to avoid brute force attack Low cross-correlation in time-domain prevents computational attack Submission Slide 16 Christian Berger (NXP)
