IEEE 802.11 CSI randomization to preserve location privacy: An empirical evaluation in different scenarios

Channel State Information (CSI) based localization with 802.11 has been proven feasible in multiple scenarios and is becoming a serious threat to people privacy in work spaces, at home, and maybe even outdoors, even if outdoors experiments proving the feasibility are still not available. Countering unauthorized localization without hampering communications is a nontrivial task, although some very recent works suggest that it is feasible with marginal modification of the 802.11 transmission chain, but this requires modifying 802.11 devices. Furthermore, if the attacker controls two devices and not only a receiver, transmission side signal manipulation cannot help. This work explores the possibility of countering CSI based localization with an active device that, instead of jamming signals to avoid that a malicious receiver exploits CSI information to locate a person, superimpose on frames a copy of the same frame signal whose goal is not destroying reception as in jamming, but only obfuscate the location relevant information carried by the CSI. A prototype implementation and early results looks promising; they show feasibility of location obfuscation with high efficiency and excellent preservation of communication performance, paving the road for further research and improved users privacy.

Non Intrusive Wi-Pi CSI Obfuscation Against Active Localization Attacks

On the properties of device-free multi-point CSI localization and its obfuscation

The use of Channel State Information (CSI) as a means of sensing the environment through Wi-Fi communications, and in particular to locate the position of unaware people, is moving from feasibility studies to high precision applications. The work we present in this paper explores how the use of multiple localization receivers can enhance the precision and robustness of device-free CSI-based localization with a method based on a state-of-the-art Convolutional Neural Network. Next we discuss how a randomized pre-filtering at the transmitter can hide the information that the CSI carries on the location of one person indoor formalizing the manipulation technique. Results are presented discussing two different ways of exploiting the multi-receiver redundancy and how, in any case, properly randomized pre-distortion at the transmitter can prevent localization even if the attack is carried out with multiple localization devices (receivers controlled by the attacker).

Passive Device-Free Multi-Point CSI Localization and Its Obfuscation with Randomized Filtering

Backscatter enables wireless transmissions at dramatically lower power compared to mainstream Internet of Things (IoT) transmitters. This significantly improves battery life or even eliminates the need of batteries for backscatter-based 'tags' operating on energy harvested from the environment. However, trading off complexity for low power consumption exposing backscatter tags to a multitude of security risks. A significant challenge is imposter tags that mimic legitimate tag behaviour, compromising the system data integrity. In this work, we argue that tag simplicity and operation on harvested energy can help identify imposter transmissions, thus safeguarding data integrity. Our experimental study reveals that commonly used low-power tag oscillators demonstrate unique fingerprint patterns when exposed to the dynamics of harvested energy. Based on this observation, we design and propose HarvestPrint, which leverages these fingerprints to differentiate authentic backscatter transmissions from imposter transmissions. Experiments with a tag powered through a small solar cell show the potential of HarvestPrint.

https://dl.acm.org/doi/pdf/10.1145/3484266.3487388

HarvestPrint: Securing Battery-free Backscatter Tags through Fingerprinting

The intrinsic hardware imperfection of WiFi chipsets manifests itself in the transmitted signal, leading to a unique radiometric fingerprint. This fingerprint can be used as an additional means of authentication to enhance security. In fact, recent works propose practical fingerprinting solutions that can be readily implemented in commercial-off-the-shelf devices. In this paper, we prove analytically and experimentally that these solutions are highly vulnerable to impersonation attacks. We also demonstrate that such a unique device-based signature can be abused to violate privacy by tracking the user device, and, as of today, users do not have any means to prevent such privacy attacks other than turning off the device. We propose RF-Veil, a radiometric fingerprinting solution that not only is robust against impersonation attacks but also protects user privacy by obfuscating the radiometric fingerprint of the transmitter for non-legitimate receivers. Specifically, we introduce a randomized pattern of phase errors to the transmitted signal such that only the intended receiver can extract the original fingerprint of the transmitter. In a series of experiments and analyses, we expose the vulnerability of adopting naive randomization to statistical attacks and introduce countermeasures. Finally, we show the efficacy of RF-Veil experimentally in protecting user privacy and enhancing security. More importantly, our proposed solution allows communicating with other devices, which do not employ RF-Veil.

https://dl.acm.org/doi/pdf/10.1145/3410220.3456280

Stay Connected, Leave no Trace: Enhancing Security and Privacy in WiFi via Obfuscating Radiometric Fingerprints

The most wide-spread wireless technologies are 3GPP cellular networking solutions (e.g., LTE-A) and IEEE WLAN solutions (e.g., WiFi). Traditionally, these two served distinct purposes. Cellular systems were commonly used for outdoor and long-range communication with limited data-rate, whereas WiFi networks provided short-range communication within residential and office environments. The operational distinction between these two technologies has (almost) disappeared within the past few years, encouraging a more seamless multi-RAT capability in 5G networks. In this poster, we illustrate and evaluate a full-stack and real-time implementation of a multi-RAT system, whose implementation will be publicly made available.

Andreas Bauml

Papers

Stay Connected, Leave no Trace: Enhancing Security and Privacy in WiFi via Obfuscating Radiometric Fingerprints

Poster: An Experimental Study of Multi-RAT Systems