Upload
others
View
2
Download
0
Embed Size (px)
Citation preview
On the Effectiveness of Secret Key Extraction from Wireless Signal Strength in Real Environments
Suman Jana, Sriram Nandha Premnath
Mike Clark, Sneha K. Kasera, Neal Patwari
University of Utah
Srikanth V. Krishnamurthy
University of California, Riverside
wireless nodes, Alice & Bob, need to share secret key
concerns with public key cryptography
quantum cryptography – too expensive
less expensive solution - use inherent randomness in wireless channel to extract secret key bits
Problem Definition
2
measured reciprocally at Alice, Bob
when away by more than few multiples of wavelength, Eve cannot measure same channel
channel varies with time
Wireless Channel Characteristics
3
Use of Received Signal Strength (RSS)
4
Alice, Bob expected to see “identical” RSS variations [Stutzman „82]
realistically, they must deal with lack of perfect reciprocity
Probe Exchange &
RSS Measurement
Alice Bob
Eve
RSS Variations AliceBob
RSS Variations
Eve
Related Work
Mathur ‟08, Li ‟06, Aono ‟05 extract single bit per measurement
experimental results from limited indoor settings
Alice, Bob do not communicate to handle mismatches will result in key disagreement in large number of cases
Azimi-Sadjadi ‟07 suggested using 2 stages from quantum
cryptography - information reconciliation, privacy amplification
did not implement!
5
Our Contributions
• adaptive key extraction increases secret bit rate 4-fold
• implement information reconciliation to handle bit mismatch
• implement privacy amplification to reduce correlation between successive bits
• through extensive real world measurements, identify settings (un)suitable for key extraction
• expose new predictable channel attack in static settings
6
Overview
adversary model
secret key extraction
real world measurements, results
summary
7
Adversary Model
adversary Eve
listens to all communication between Alice, Bob
can measure channel between herself and Alice, Bob
separated from both parties by distance >> wavelength
Eve not interested in disrupting communication between Alice, Bob
Alice, Bob are not authenticated
8
Secret Bit Extraction
9
RSS
Measurements
Quantization
Information
Reconciliation
Privacy
Amplification
Secret Key
Bits
Adaptive Quantization
how to generate bits from RSS measurements?
Extracted Bits – 1 1 1 0 1 …
Extract “1”
Drop
Drop
Extract “0”
Upper Threshold
Lower
Threshold
10
adapt threshold for small blocks of measurements
Adaptive Quantization
adapt # intervals depending on range
Extracted Bits - 11 10 11 10 10 11 01 00 01 …
Extract
“10”
“11”
“01”
“00” Interval 1
Interval 2
Interval 3
Interval 4
Interval 1
Interval 2
Interval 3
Interval 4
Interval 5
Interval 6
Interval 7
Interval 8
Adaptive Quantization
Extracted Bits - 101 110 101 110 110 100 010 …
Extract
“111”
“110”
“101”
“100”
“011”
“010”
“001”
“000”
adapt #intervals depending on range
limit: N ≤ log [Range]
Adaptive Secret Bit Generation (ASBG)
Information Reconciliation [Brassard ’06]
differences in between bit streams of Alice, Bob arise due to noise/interference, wireless hardware limitations
half-duplex nature of channel
solution: exchange parity information of small blocks of bits
locate, correct mismatches using binary search
permute, iterate until probability [success] > threshold
13
Privacy Amplification [Impagliazzo ’89]
short-term correlation between subsequent bits when probing rate > (coherence time)-1
need to remove bits leaked during information reconciliation
solution: apply 2-universal hash function h: {1…M} {1…m}
for inputs x, y, probability [h(x) = h(y)] upper bounded by 1/m
decreases output length, but increases entropy
14
Implementation
laptops - Alice, Bob
equipped with Intel PRO/Wireless 3945 ABG cards
monitor mode for collecting RSS measurements
use ipwraw driver for raw packet injection
probes – IEEE 802.11g beacon frames
management frames prioritized over data frames
allows better control over probing rate
probing rate ~20 packets per second 15
Implementation
privacy amplification
2-universal hash functions
use BigNumber OpenSSL routines
16
Implementation
17
RSS Measurement Protocol
18
packet losses handled by initiator
20 ms timeout for detecting packet loss
responder discards last RSS if duplicate beacon sequence #
tim
e
Initiator
(Alice)
Responder
(Bob)
Record
RSS
Record
RSS
Record
RSS
Record
RSS
Measurement Goals
• in what kind of settings, key extraction “works”?
• how does device heterogeneity affect key extraction?
19
Experiments
A. Underground concrete tunnel
B. Ed Catmull Gallery
C. Lawn
20
D. Walk Indoors
E. Walk Outdoors
F. Bike Ride
G. Crowded Cafeteria
H. Across busy road
1. Stationary Endpoints, Intermediate objects
2. Mobile Endpoints
3. Stationary Endpoints, Mobile Intermediate objects
Stationary Endpoints & Intermediate Objects
variations very small (range: ~2 dB), exhibit poor reciprocity
expect Alice‟s & Bob‟s bit streams to have very high mismatch
small scale variations represent noise
21
Underground Concrete Tunnel Experiment
distance between Alice, Bob = 10 feet
-59
-58
-57
-56
-55
-54
RSS
Probes Alice Bob
snapshot of data collected for few seconds
Stationary Endpoints & Intermediate Objects
22
Gallery Experiment Lawn Experiment
• even typical stationary settings are no different from underground concrete tunnel!
distance = 30 ft distance = 10 ft
-85
-75
-65
-55
-45
RSS
Probes Alice Bob -66
-64
-62
-60
-58
-56
-54
RSS
Probes Alice Bob
Mobile Endpoints
23
Walk Indoors Experiment large variations
range ~25 dB
highly reciprocal
hints that Alice‟s & Bob‟s bit streams will have very low mismatch
normal walk speed
distance = 10-15 ft
-75
-70
-65
-60
-55
-50
-45
RSS
Probes Alice Bob
Mobile Endpoints
24
Walk Outdoors Experiment Bike Ride Experiment
• more evidence - mobile devices likely to have very low mismatch
• effects of noise diminished by large scale variations
normal walk speed
20-25 ft distance
slow bike ride
10 ft or more distance
-85
-75
-65
-55
-45
RSS
Probes Alice Bob
-80
-70
-60
-50
-40
-30
RSS
Probes Alice Bob
Mobile Intermediate Objects & Stationary Endpoints
25
Crowded Cafeteria Experiment Experiment Across Busy Road
intermediate variation range (~8-16 dB), reciprocity
hints - Alice‟s, Bob‟s bit streams will have moderate mismatch
low speed mobility; distance = 10 ft high speed mobility; distance = 25 ft
-66
-62
-58
-54
-50
-46
RSS
Probes Alice Bob-79
-77
-75
-73
-71
-69
RSS
Probes Alice Bob
Predictable Channel Attack
novel attack
in „all stationary‟ settings Eve can cause predictable channel variations by controlling movements of
intermediate objects
break key extraction schemes without spending compute power
26
Predictable Channel Attack
no precision machinery required
Eve can produce zig-zag patterns, or any other pattern by controlling movements
no post processing will ensure security of extracted key!
27
-63
-58
-53
-48
-43
RSS
Probes
bits extracted: 0000 1111 0000 1111 …
Effect of Device Heterogeneity
greater mismatch than with homogeneous devices
mismatch low enough to help establish secret key
28
Walk Indoors Experiment
-85-80-75-70-65-60-55-50-45-40
RSS
Probes
Alice (Intel 3945 ABG) Bob (Atheros)
Comparison of Key Extraction Approaches in Various Settings
29
performance metrics entropy rate
mismatch rate
secret bit rate
single bit, multiple bit extraction
Comparison of Key Extraction Approaches in various Settings
30
• secret bit stream from ASBG
entropy close to 1
passes randomness tests of NIST test suite we conduct
0.00
0.25
0.50
0.75
1.00
Entr
op
y
Experiments Aono Mathur Tope Azimi-Sadjadi ASBG
stationary
mobile
intermediate
Comparison of Key Extraction Approaches in various Settings
31
• mobile settings yield bits with low mismatch rates
0.00
0.25
0.50
0.75
1.00
Entr
op
y
Experiments Aono Mathur Tope Azimi-Sadjadi ASBG
0.00
0.25
0.50
0.75
1.00
Mis
mat
ch R
ate
Experiments Aono Mathur Tope Azimi-Sadjadi ASBG
stationary
mobile
intermediate
stationary
mobile
intermediate
Comparison of Key Extraction Approaches in various Settings
32
• ASBG exhibits highest secret bit rate among those with entropy > 0.7
0.00
0.25
0.50
0.75
1.00
Entr
op
y
Experiments Aono Mathur Tope Azimi-Sadjadi ASBG
0.00
0.25
0.50
0.75
1.00
Secr
et b
it r
ate
Experiments Aono Mathur Tope Azimi-Sadjadi ASBG
0.00
0.25
0.50
0.75
1.00
Mis
mat
ch R
ate
Experiments Aono Mathur Tope Azimi-Sadjadi ASBG
stationary
mobile
intermediate
stationary
mobile
intermediate
stationary
mobile
intermediate
Multiple Bit Extraction
33
significant increase in secret bit rate at least 4 times (with N = 2) compared to single bit extraction
0.00
0.05
0.10
0.15
0.20
0.25
0.30
0.35
Mis
mat
ch R
ate
Experiments 2 bits Gray 3 bits Gray 4 bits Gray
0.00
0.25
0.50
0.75
1.00
Secr
et b
it r
ate
Experiments
1 bit 2 bits Gray 3 bits Gray 4 bits Gray
bit mismatch rate increases with N
Gray code assignment produces smaller mismatch rates
mobile
intermediate
mobile
intermediate
Summary
mobile settings best suited for key extraction due to low mismatch
don‟t depend solely on movements of limited intermediate objects beware of predictable channel attack!
our environment adaptive quantization scheme + information reconciliation + privacy amplification generates high entropy bits at high rate
34