Wavefront Manipulation Attack via Programmable mmWave Metasurfaces: from Theory to Experiments

Wavefront Manipulation Attack via Programmable mmWave Metasurfaces: from Theory to Experiments
复制标题

DOI:
10.1145/3558482.3590182
复制
发表时间:
2023-05
期刊:
Proceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks
影响因子:
--
通讯作者:
Haoze Chen;H. Saeidi;S. Venkatesh;K. Sengupta;Yasaman Ghasempour
Haoze Chen;H. Saeidi;S. Venkatesh;K. Sengupta;Yasaman Ghasempour
中科院分区:
其他
文献类型:
--
作者:
Haoze Chen;H. Saeidi;S. Venkatesh;K. Sengupta;Yasaman Ghasempour

文献摘要

相似文献

可重构表面使得能够以可控方式按需操纵电磁波特性。这些表面已被证明可以在许多方面增强毫米波无线网络,包括阻塞恢复。在本文中,我们调查的安全漏洞与部署的可重构表面,即,对手可以部署新的恶意表面或篡改已经部署的表面以恶意地设计反射图案。特别是,我们介绍了Metasurface-enabled边带转向(MeSS),一种新的元表面在中间的攻击,其中反射波阵面的频谱-空间属性被操纵,使得隐藏的边带信道在频谱域中被创建,并转向窃听者的位置,同时保持合法的链接完整的受害者。我们制作了一个定制的可重构表面原型,并通过理论分析以及在60 GHz频段的空中实验评估MeSS。我们的研究结果表明,MeSS显着降低经验的保密能力(高达81.7%),同时留下一个小的功率惩罚的受害者,可以掩盖下正常的信道波动。
Reconfigurable surfaces enable on-demand manipulation of electromagnetic wave properties in a controllable manner. These surfaces have been shown to enhance mmWave wireless networks in many ways, including blockage recovery. In this paper, we investigate the security vulnerabilities associated with the deployment of reconfigurable surfaces, i.e., an adversary may deploy new rogue surfaces or tamper with already-deployed surfaces to maliciously engineer the reflection pattern. In particular, we introduceMetasurface-enabled Sideband Steering (MeSS), a new metasurface-in-the-middle attack in which the spectral-spatial properties of the reflected wavefront are manipulated such that a concealed sideband channel is created in the spectral domain and steered toward the eavesdropper location, while maintaining the legitimate link toward the victim intact. We fabricate a custom reconfigurable surface prototype and evaluate MeSS through theoretical analysis as well as over-the-air experiments at the 60 GHz band. Our results indicate that MeSS significantly reduces empirical secrecy capacity (up to 81.7%) while leaving a small power penalty at the victim that can be masked under normal channel fluctuations.