Preventing Scaling of Successful Attacks: A Cross-Layer Security Architecture for Resource-Constrained Platforms

Abstract

Key-establishment based on parameters of the communication channels is a highly attractive option for many applications that operate in a dynamic mobile environment with peer-to-peer association. So far, high usability and dynamic key management with the capability of perfect forward secrecy are very difficult to achieve for wireless devices which have to operate under strict resource constraints. Additionally, previous work has failed to address hybrid systems composed of physical layer security (PHYSEC) and asymmetric cryptography for key establishment. In this work we present the first hybrid system architecture suitable for resource-constrained platforms. As a result, long term deployment due to key diversity and forward/backward secrecy can be achieved while still satisfying the tight timing of an initial setup imposed by high user acceptance. Our design strongly focuses on reusing communication chip components for PHYSEC and makes use of efficient asymmetric cryptography (e.g., ECDH) augmented by physical layer security. Our prototype implementation demonstrates that our approach has the potential to dramatically reduce the cost of securing small embedded devices for the Internet of Things, and hence make mass production and deployment viable.

C. T. Zenger, A. Ambekar, F. Winzer and H.D. Schotten, and C. Paar — This author was supported in part by BMBF within the project Providing Physical Layer Security for the Internet of Things (PROPHYLAXE) (Grant 16KIS0008 and 16KIS0010).

Appendix

Experimental Measurement Setup: The hardware platforms, WRT54GL WiFi router and WiFi DipCortex, for our prototypical implementation are illustrated in Fig. 5.

Fig. 5.

Experimental measurement setups including access point Alice (A), wireless sensor node Bob stationary ($B_s$), cyclic moving ($B_d$), and randomly moving ($B_r$) and the eavesdropper Eve placed away from Alice and Bob (E$_1$), between Alice and Bob (E$_2$), and next to Alice (E$_3$).

Fig. 6.

Evaluation results of setup 1: Required samples per of 128-bit keys for stationary node, for different quantizerper evaluated BCH(n, k, d) code, (a) without Kalman filter and (b) with.

Fig. 7.

Evaluation results of setup 2: Required samples per of 128-bit keys for stationary node, for different quantizerper evaluated BCH(n, k, d) code, (a) without Kalman filter and (b) with.

Fig. 8.

Evaluation results of setup 3: Required samples per of 128-bit keys for stationary node, for different quantizerper evaluated BCH(n, k, d) code, (a) without Kalman filter and (b) wit.

Evaluation Results: The required samples of a symmetric secret key with a security level 128 bit for setup 1, 2 and 3 are evaluated. In setup 1 the single bit quantizer by Jana et al. [32] requires less time to generate 128-bit keys, the key generation is greatly improved by the precomputation by Kalman filter, as depicte in the required samples per key in Fig. 6. In setup 2 also the single bit quantizer by Jana et al. [32] requires less time to generate 128-bit keys, moreover the key generation is harmed by the precomputation by Kalman filter, as depicte in the required samples per key in Fig. 7. Best key generation is performed in setup 3 again by the single it quantizer by Jana et al. [32]. Also the other quantizer perform their best results in this setup, as shown in Fig. 8. But also in this setup the precomputation using a Kalman filter effects the key generation performance.

Table 1. Minimum number of required samples for establishing symmetric keys with a security level of 128 bit, as well as the coresponding BCH(n,k,d) code.

Table 2. Pass rates of several NIST statistical tests for preliminary key material of the quatizations schemes by Tope et al. [48], Aono et al. [5], Mathur et al. [34], Jana et al. [32], and Ambekar et al. [3] (setup 2).

The results regarding quantizer and BCH(n, k, d) code are summarized in Table 1. Usually the single bit quantizer by Jana et al. [32] requires least samples to generate a 128-bit key. In setup 3 this quantizer requires 347 RSSI values without Kalman to generate a single key and in setup 1 the Kalman improves the result to a requirement from 2200 RSSI values to only 512 RSSI values. Therefore, it takes between 6 upto 9 min (without Kalman 36 min). Overall, the quantizer by Jana et al. [32] requires significantly less RSSI values than the other mentioned quantizer. Especially the quantizer by Mathur et al. [34] requires a high amount of samples to generate keys as this quantizer drops most of the samples and generates much shorter bit stream [34]. For some system parameter no key could be achieved.

Statistical Analysis: For statistical analysis we evaluated the preliminary key material offline by applying NIST suite [37]. As some these tests require large number of bits, we constrain the evaluated test to those which are able to execute blocks of 500 bit. The outputs of the NIST statistical tests are successful rates for each quantizer listed in Table 2. Most of quantizers output pass the tests with high rates. Note that this shall not apply to the multi-bit quantizer by Jana et al. [32], as the blocks by this quantizer do not have high pass rates. Moreover the results for the quantizer by Mathur et al. [34] are not reliable as the amount of quantized block is not representative.