Biblio

Radar sensors have shown great potential for surveillance and security authentication applications. However, a thorough analysis of their vulnerability to spoofing or replay attacks has not been performed yet. In this paper, the feasibility of performing spoofing attacks to radar sensor is studied and experimentally verified. First, a simple binary phase-shift keying system was used to generate artificial spectral components in the radar's demodulated signal. Additionally, an analog phase shifter was driven by an arbitrary signal generator to mimic the human cardio-respiratory motion. Characteristic time and frequency domain cardio-respiratory human signatures were successfully generated, which opens possibilities to perform spoofing attacks to surveillance and security continuous authentication systems based on microwave radar sensors.

Internet of Things (IoT) enable information transmission and sharing among massive IoT devices. However, the key establishment and management in IoT become more challenging due to the low latency requirements and resource constrained IoT devices. In this work, we propose a practical physical layer based secret key sharing scheme for MIMO (multiple-input-multiple-output) IoT devices to reduce the communication delay caused by key establishment of MIMO IoT devices. This is because the proposed scheme attachs secret key sharing with communication simultaneously. It is achieved by the proposed MIMO self-injection AN (SAN) tranmsission, which is designed to deliberately maximum the receive SNR (signal to noise ratio) at different antenna of the legitimate IoT device, based on the value of secret key sharing to him. The simulation results verified the validity and security of the proposed scheme.

The open and broadcast nature of wireless channels makes eavesdropping possible, leading to the inherent problem of information leakage. Inherent problems should be solved by endogenous security functions. Accordingly, wireless security problems should be resolved by channel-based endogenous security mechanisms. Firstly, this paper analyzes the endogenous security principle of the physical-layer-secret-key method. Afterward, we propose a novel conjecture that in a fast-fading environment, there must exist wireless systems where the endogenous secret key rate can match the user data rate. Moreover, the conjecture is well founded by the instantiation validation in a wireless system with BPSK inputs from the perspectives of both theoretical analysis and simulation experiments. These results indicate that it is possible to accomplish the one-time pad via endogenous secret keys in wireless communication.

We propose a coding scheme for covert communication over additive white Gaussian noise channels, which extends a previous construction for discrete memoryless channels. We first show how sparse signaling with On-Off keying fails to achieve the covert capacity but that a modification allowing the use of binary phase-shift keying for "on" symbols recovers the loss. We then construct a modified pulse-position modulation scheme that, combined with multilevel coding, can achieve the covert capacity with low-complexity error-control codes. The main contribution of this work is to reconcile the tension between diffuse and sparse signaling suggested by earlier information-theoretic results.

We discuss the threat that hardware Trojans (HTs) impose on wireless networks, along with possible remedies for mitigating the risk. We first present an HT attack on an 802.11a/g transmitter (TX), which exploits Forward Error Correction (FEC) encoding. While FEC seeks to protect the transmitted signal against channel noise, it often offers more protection than needed by the actual channel. This margin is precisely where our HT finds room to stage an attack. We, then, introduce a Trojan-agnostic method which can be applied at the receiver (RX) to detect such attacks. This method monitors the noise distribution, to identify systematic inconsistencies which may be caused by an HT. Lastly, we describe a Wireless open-Access Research Platform (WARP) based experimental setup to investigate the feasibility and effectiveness of the proposed attack and defense. More specifically, we evaluate (i) the ability of a rogue RX to extract the leaked information, while an unsuspecting, legitimate RX accurately recovers the original message and remains oblivious to the attack, and (ii) the ability of channel noise profiling to detect the presence of the HT.