Individual papers can also be downloaded from their respective presentation pages. Copyright to the individual works is retained by the author[s]. In this paper, we present PhyAuth, a PHY hop-by-hop message authentication framework to defend against packet-injection attacks in ZigBee networks.
Comprehensive USRP experiments confirm that PhyAuth can efficiently detect fake packets with very low false-positive and false-negative rates while having a negligible negative impact on normal data transmissions. UWB chips have been integrated into consumer electronics and considered for security-relevant use cases, such as access control or contactless payments.
However, several publications in the recent past have shown that it is difficult to protect the integrity of distance measurements on the physical layer. In this paper, we identify transceiver clock imperfections as a new, important parameter that has been widely ignored so far. We demonstrate Mix-Down on commercial chips and achieve distance reductions from 10 m to 0 m. To prevent the attack, we propose and analyze an effective countermeasure. Although BLE-SC pairing employs well-studied cryptographic primitives to guarantee its security, a recent study revealed a logic flaw in the protocol.
Our model is compliant with the latest Bluetooth specification version 5. We also partly loosen the perfect cryptography assumption in traditional symbolic analysis approaches by designing a low-entropy key oracle to detect attacks caused by the poorly derived keys. Our analysis confirms two existing attacks and discloses a new attack. We propose a countermeasure to fix the flaws found in the BLE-SC pairing protocol and discuss the backward compatibility.
Moreover, we extend our model to verify the countermeasure, and the results demonstrate its effectiveness in our extended model. Wi-Fi devices routinely queue frames at various layers of the network stack before transmitting, for instance, when the receiver is in sleep mode.
