Zhi Sun

Zhi Sun, Sarankumar Balakrishnan, Lu Su et al.

With the wide bandwidths in millimeter wave (mmWave) frequency band that results in unprecedented accuracy, mmWave sensing has become vital for many applications, especially in autonomous vehicles (AVs). In addition, mmWave sensing has superior reliability compared to other sensing counterparts such as camera and LiDAR, which is essential for safety-critical driving. Therefore, it is critical to understand the security vulnerabilities and improve the security and reliability of mmWave sensing in AVs. To this end, we perform the end-to-end security analysis of a mmWave-based sensing system in AVs, by designing and implementing practical physical layer attack and defense strategies in a state-of-the-art mmWave testbed and an AV testbed in real-world settings. Various strategies are developed to take control of the victim AV by spoofing its mmWave sensing module, including adding fake obstacles at arbitrary locations and faking the locations of existing obstacles. Five real-world attack scenarios are constructed to spoof the victim AV and force it to make dangerous driving decisions leading to a fatal crash. Field experiments are conducted to study the impact of the various attack scenarios using a Lincoln MKZ-based AV testbed, which validate that the attacker can indeed assume control of the victim AV to compromise its security and safety. To defend the attacks, we design and implement a challenge-response authentication scheme and a RF fingerprinting scheme to reliably detect aforementioned spoofing attacks.

Sekhar Rajendran, Zhi Sun, Feng Lin et al.

In Internet of Things, where billions of devices with limited resources are communicating with each other, security has become a major stumbling block affecting the progress of this technology. Existing authentication schemes-based on digital signatures have overhead costs associated with them in terms of computation time, battery power, bandwidth, memory, and related hardware costs. Radio frequency fingerprint (RFF), utilizing the unique device-based information, can be a promising solution for IoT. However, traditional RFFs have become obsolete because of low reliability and reduced user capability. Our proposed solution, Metasurface RF-Fingerprinting Injection (MeRFFI), is to inject a carefully-designed radio frequency fingerprint into the wireless physical layer that can increase the security of a stationary IoT device with minimal overhead. The injection of fingerprint is implemented using a low cost metasurface developed and fabricated in our lab, which is designed to make small but detectable perturbations in the specific frequency band in which the IoT devices are communicating. We have conducted comprehensive system evaluations including distance, orientation, multiple channels where the feasibility, effectiveness, and reliability of these fingerprints are validated. The proposed MeRFFI system can be easily integrated into the existing authentication schemes. The security vulnerabilities are analyzed for some of the most threatening wireless physical layer-based attacks.

Sarankumar Balakrishnan, Shreya Gupta, Arupjyoti Bhuyan et al.

With millimeter wave (mmWave) wireless communication envisioned to be the key enabler of next generation high data rate wireless networks, security is of paramount importance. While conventional security measures in wireless networks operate at a higher layer of the protocol stack, physical layer security utilizes unique device dependent hardware features to identify and authenticate legitimate devices. In this work, we identify that the manufacturing tolerances in the antenna arrays used in mmWave devices contribute to a beam pattern that is unique to each device, and to that end we propose a novel device fingerprinting scheme based on the unique beam patterns used by the mmWave devices. Specifically, we propose a fingerprinting scheme with multiple access points (APs) to take advantage of the rich spatial-temporal information of the beam pattern. We perform comprehensive experiments with commercial off-the-shelf mmWave devices to validate the reliability performance of our proposed method under various scenarios. We also compare our beam pattern feature with a conventional physical layer feature namely power spectral density feature (PSD). To that end, we implement PSD feature based fingerprinting for mmWave devices. We show that the proposed multiple APs scheme is able to achieve over 99% identification accuracy for stationary LOS and NLOS scenarios and significantly outperform the PSD based method. For mobility scenarios, the overall identification accuracy is 96%. In addition, we perform security analysis of our proposed beam pattern fingerprinting system and PSD fingerprinting system by studying the feasibility of performing impersonation attacks. We design and implement an impersonation attack mechanism for mmWave wireless networks using state-of-the-art 60 GHz software defined radios. We discuss our findings and their implications on the security of the mmWave wireless networks.

Kalvik Jakkala, Arupjyoti Bhuya, Zhi Sun et al.

Gait is a person's natural walking style and a complex biological process that is unique to each person. Recently, the channel state information (CSI) of WiFi devices have been exploited to capture human gait biometrics for user identification. However, the performance of existing CSI-based gait identification systems is far from satisfactory. They can only achieve limited identification accuracy (maximum $93\%$) only for a very small group of people (i.e., between 2 to 10). To address such challenge, an end-to-end deep CSI learning system is developed, which exploits deep neural networks to automatically learn the salient gait features in CSI data that are discriminative enough to distinguish different people Firstly, the raw CSI data are sanitized through window-based denoising, mean centering and normalization. The sanitized data is then passed to a residual deep convolutional neural network (DCNN), which automatically extracts the hierarchical features of gait-signatures embedded in the CSI data. Finally, a softmax classifier utilizes the extracted features to make the final prediction about the identity of the user. In a typical indoor environment, a top-1 accuracy of $97.12 \pm 1.13\%$ is achieved for a dataset of 30 people.

Tianhang Zheng, Zhi Sun, Kui Ren

Trusted identification is critical to secure IoT devices. However, the limited memory and computation power of low-end IoT devices prevent the direct usage of conventional identification systems. RF fingerprinting is a promising technique to identify low-end IoT devices since it only requires the RF signals that most IoT devices can produce for communication. However, most existing RF fingerprinting systems are data-dependent and/or not robust to impacts from wireless channels. To address the above problems, we propose to exploit the mathematical expression of the physical-layer process, regarded as a function $\mathbf{\mathcal{F}(\cdot)}$, for device identification. $\mathbf{\mathcal{F}(\cdot)}$ is not directly derivable, so we further propose a model to learn it and employ this function model as the device fingerprint in our system, namely $\mathcal{F}$ID. Our proposed function model characterizes the unique physical-layer process of a device that is independent of the transmitted data, and hence, our system $\mathcal{F}$ID is data-independent and thus resilient against signal replay attacks. Modeling and further separating channel effects from the function model makes $\mathcal{F}$ID channel-robust. We evaluate $\mathcal{F}$ID on thousands of random signal packets from $33$ different devices in different environments and scenarios, and the overall identification accuracy is over $99\%$.

Wenhao Wang, Zhi Sun, Kui Ren et al.

Wireless Physical Layer Identification (WPLI) system aims at identifying or classifying authorized devices based on the unique Radio Frequency Fingerprints (RFFs) extracted from their radio frequency signals at the physical layer. Current works of WPLI focus on demonstrating system feasibility based on experimental error performance of WPLI with a fixed number of users. While an important question remains to be answered: what's the user number that WPLI can accommodate using different RFFs and receiving equipment. The user capacity of the WPLI can be a major concern for practical system designers and can also be a key metric to evaluate the classification performance of WPLI. In this work, we establish a theoretical understanding on user capacity of WPLI in an information-theoretic perspective. We apply information-theoretic modeling on RFF features of WPLI. An information-theoretic approach is consequently proposed based on mutual information between RFF and user identity to characterize the user capacity of WPLI. Based on this theoretical tool, the achievable user capacity of WPLI is characterized under practical constrains of off-the-shelf receiving devices. Field experiments on classification error performance are conducted for the validation of the information-theoretic user capacity characterization.

Wenhao Wang, Zhi Sun, Kui Ren et al.

The wireless physical-layer identification (WPLI) techniques utilize the unique features of the physical waveforms of wireless signals to identify and classify authorized devices. As the inherent physical layer features are difficult to forge, WPLI is deemed as a promising technique for wireless security solutions. However, as of today it still remains unclear whether existing WPLI techniques can be applied under real-world requirements and constraints. In this paper, through both theoretical modeling and experiment validation, the reliability and differentiability of WPLI techniques are rigorously evaluated, especially under the constraints of state-of-art wireless devices, real operation environments, as well as wireless protocols and regulations. Specifically, a theoretical model is first established to systematically describe the complete procedure of WPLI. More importantly, the proposed model is then implemented to thoroughly characterize various WPLI techniques that utilize the spectrum features coming from the non-linear RF-front-end, under the influences from different transmitters, receivers, and wireless channels. Subsequently, the limitations of existing WPLI techniques are revealed and evaluated in details using both the developed theoretical model and in-lab experiments. The real-world requirements and constraints are characterized along each step in WPLI, including i) the signal processing at the transmitter (device to be identified), ii) the various physical layer features that originate from circuits, antenna, and environments, iii) the signal propagation in various wireless channels, iv) the signal reception and processing at the receiver (the identifier), and v) the fingerprint extraction and classification at the receiver.