The wireless medium contains domain-specific information that can be used to complement and enhance traditional security mechanisms. In this paper we propose ways to exploit the spatial variability of the radio channel response in a rich scattering environment, as is typical of indoor environments. Specifically, we describe a physical-layer authentication algorithm that utilizes channel probing and hypothesis testing to determine whether current and prior communication attempts are made by the same transmit terminal. In this way, legitimate users can be reliably authenticated and false users can be reliably detected. We analyze the ability of a receiver to discriminate between transmitters (users) according to their channel frequency responses. This work is based on a generalized channel response with both spatial and temporal variability, and considers correlations among the time, frequency and spatial domains. Simulation results, using the ray-tracing tool WiSE to generate the time-averaged response, verify the efficacy of the approach under realistic channel conditions, as well as its capability to work under unknown channel variations.
In commodity networks, such as 802.11 networks, it is easy for a device to alter its MAC address and claim to be another device by simply issuing an ifconfig command. This weakness is a serious threat, and there are numerous attacks, ranging from session hijacking @cite_1 to attacks on access control lists @cite_21 , which are facilitated by the fact that an adversarial device may masquerade as another device. In response, researchers have proposed using physical layer information to enhance wireless security. For example, spectral analysis has been used to identify the type of wireless network interface card (NIC), and thus to discriminate among users with different NICs @cite_23 . A similar method, radio frequency fingerprinting, discriminates wireless devices according to the transient behavior of their transmitted signals @cite_24 . For more general networks, the clock skew characteristic of devices has been viewed as a remote fingerprint of devices over the Internet @cite_12 . In addition, the inherent variability in the construction of various digital devices has been used to detect intrusion @cite_8 .
@cite_8 @cite_21 @cite_1 @cite_24 @cite_23 @cite_12
2120188593 19610032 1894693606 1510900102 2161743771 2104599106
In this paper, we present a new paradigm for security in conventional networks that has dramatic implications for improving their physical layer network security. We call this paradigm, Detecting Intrusions at Layer ONe (DILON). DILONs enabling hypothesis is that the inherent variability in the construction of digital devices leads to significant variability in their analog signaling. This is true not only for different device models but even for nearly identical devices of the same manufacturing lot. The idea is that by oversampling digital signals to make analog measurements that constitute voiceprints of network devices. These form a profile that can be used for detecting MAC address spoofing, reconfiguration of network topologies, and in the long term possibly predict the failure of network devices. This paper discusses historic references and how digital networks enable new approaches as well as a number of applications. Polymer-containing, crosslinked, durable press 100 cotton, high-cotton blend, and other cellulosic fabrics are given a durable pucker without steaming by treatment with a rewetting agent, followed by drying, printing with a caustic printing paste permitting the printed fabric to develop a pucker at room temperature in a substantially tension-free state, and washing. Alternatively, the application of the rewetting agent can be bypassed by adding compatible wetting agents directly to the printing paste. The present process is also compatible with pigment printing processes so that caustic printing and pigment printing can be combined, the cold-puckered fabric being dried and then heated to set the pigment vehicle. Radio Frequency Fingerprinting (RFF) is a technique, which has been used to identify wireless devices. It essentially involves the detection of the transient signal and the extraction of the fingerprint. The detection phase, in our opinion, is the most challenging yet crucial part of the RFF process. Current approaches, namely Threshold and Bayesian Step Change Detector, which use amplitude characteristics of signals for transient detection, perform poorly with certain types of signals. This paper presents a new algorithm that exploits the phase characteristics for detection purposes. Validation using Bluetooth signals has resulted in a success rate of approximately 85-90 percent. We anticipate that the higher detection rate will result in a higher classification rate and thus support various device authetication schemes in the wireless domain. IEEE 802.11 wireless networks are plagued with problems of unauthorized access. Left undetected, unauthorized access is the precursor to additional mischief. Current approaches to detecting intruders are invasive or can be evaded by stealthy attackers. We propose the use of spectral analysis to identify a type of wireless network interface card. This mechanism can be applied to support the detection of unauthorized systems that use wireless network interface cards that are different from that of a legitimate system. The approach is passive and works in the presence of encrypted traffic. We introduce the area of remote physical device fingerprinting, or fingerprinting a physical device, as opposed to an operating system or class of devices, remotely, and without the fingerprinted device's known cooperation. We accomplish this goal by exploiting small, microscopic deviations in device hardware: clock skews. Our techniques do not require any modification to the fingerprinted devices. Our techniques report consistent measurements when the measurer is thousands of miles, multiple hops, and tens of milliseconds away from the fingerprinted device and when the fingerprinted device is connected to the Internet from different locations and via different access technologies. Further, one can apply our passive and semipassive techniques when the fingerprinted device is behind a NAT or firewall, and. also when the device's system time is maintained via NTP or SNTP. One can use our techniques to obtain information about whether two devices on the Internet, possibly shifted in time or IP addresses, are actually the same physical device. Example applications include: computer forensics; tracking, with some probability, a physical device as it connects to the Internet from different public access points; counting the number of devices behind a NAT even when the devices use constant or random IP IDs; remotely probing a block of addresses to determine if the addresses correspond to virtual hosts, e.g., as part of a virtual honeynet; and unanonymizing anonymized network traces.