AuthCTC: Defending Against Waveform Emulation Attack in Heterogeneous IoT Environments
AuthCTC: Defending Against Waveform Emulation Attack in Heterogeneous IoT Environments
复制标题
DOI：
10.1145/3320269.3384726
复制
发表时间：
2020-10
期刊：
影响因子：
--
通讯作者：
Sihan Yu;Xiaonan Zhang;Pei Huang;Linke Guo;Long Cheng;Kuang-Ching Wang
中科院分区：
文献类型：
--
作者：
Sihan Yu;Xiaonan Zhang;Pei Huang;Linke Guo;Long Cheng;Kuang-Ching Wang
广泛部署的物联网设备引起了人们对频谱短缺和多协议网关部署成本的严重关注。最近的新兴跨技术通信（CTC）技术可以通过在2.4 GHz上进行异质无线设备（例如WiFi，Bluetooth和Zigbee）进行直接通信来减轻此问题。但是，这种新的范式也带来了安全风险，攻击者可以使用CTC对IoT设备发动无线攻击。由于使用有限的计算能力和不同的无线协议，许多物联网设备无法使用计算密集型加密方法进行安全增强。因此，如果没有正确的检测方法，IoT设备在执行命令信号之前无法区分信号源。在本文中，我们首先在CTC方案中展示了一种新的定义物理层攻击，称为波形仿真攻击，其中WiFi设备可以偷听和效仿Zigbee波形以攻击Zigbee IoT设备。然后，为了防止这种新攻击，我们提出了一种物理层防御机制，称为AUTHCTC，以验证CTC信号的合法性。具体而言，在发件人端，通过利用动态更改的环状前缀来将授权代码嵌入到数据包序言中。基于WiFi的检测器用于验证接收器端的授权代码。进行了广泛的模拟和实验实验，以证明攻击的可行性和防御机制的有效性。
Widely deployed IoT devices have raised serious concerns for the spectrum shortage and the cost of multi-protocol gateway deployment. Recent emerging Cross-Technology Communication (CTC) technique can alleviate this issue by enabling direct communication among heterogeneous wireless devices, such as WiFi, Bluetooth, and ZigBee on 2.4 GHz. However, this new paradigm also brings security risks, where an attacker can use CTC to launch wireless attacks against IoT devices. Due to limited computational capability and different wireless protocols being used, many IoT devices are unable to use computationally-intensive cryptographic approaches for security enhancement. Therefore, without proper detection methods, IoT devices cannot distinguish signal sources before executing command signals. In this paper, we first demonstrate a new defined physical layer attack in the CTC scenario, named as waveform emulation attack, where a WiFi device can overhear and emulate the ZigBee waveform to attack ZigBee IoT devices. Then, to defend against this new attack, we propose a physical layer defensive mechanism, named as AuthCTC, to verify the legitimacy of CTC signals. Specifically, at the sender side, an authorization code is embedded into the packet preamble by leveraging the dynamically changed cyclic prefix. A WiFi-based detector is used to verify the authorization code at the receiver side. Extensive simulations and experiments using off-the-shelf devices are conducted to demonstrate both the feasibility of the attack and the effectiveness of our defensive mechanism.