View source for Experimental Security Analysis

In this section, we provide an experimentally-supported security analysis of the PHYSEC system. Therefore, we analyzed the child nodes of the attack tree. Child nodes are conditions that must be satisfied to make the direct parent node true. Recent security analyses of systems from
correlated observations are based on broad channel abstractions or claims based on elusively experimental evaluations and thus are not fully substantiated as we will see later.

==Testbed Implementation==
The protocol ensures that all three common measurements are done within the probing duration of <math>r_{p}^{-1} \leq 5 ms</math>. The sampling rate is <math>r_s \approx (10ms)^{-1}</math>. Figure 3.5 illustrates the procedure for synchronized measurements between Alice, Bob, and a potential passive attacker. The common channel measurement process is implemented on the hardware platform Raspberry Pi. This credit card sized computer is universally deployable with a Linux-based operating system and flexible expansion options. We equipped the computer with a TP-Link TL-WN722N wireless USB adapter as well as with a battery for mobility. Alice is mounted on a cyclic moving robotic measurement platform.

[[File:Esa-fig5-3.png|500px|thumb|right|Figure 5.3: Illustration of the test environment and layout of sensor nodes: (a) automated antenna positioning setup, (b) cyclic moving robotic measurement platform.]]

Motion is required because otherwise no channel reciprocity is given due to a low reciprocityto-noise ratio. Additionally, in realistic scenarios no unpredictable motion leads to no new entropy. Bob and Eve are mounted on an automated antenna positioning setup. Please refer to Figure 5.3 for illustration. With this setup, we evaluate the correlation possibilities of a potential measurement attack for different distances between Bob and Eve. The minimum distance between Bob and Eve is 1mm and the maximum is 300mm. Due to a servo motor 1000 (angular) position in this 300mm range of Eve are programmable.

==Statistical Defect of Raw Readings==

[[File:Esa-fig5-4.png|500px|thumb|right|Figure 5.4: Spectral representation of the RSSI values showing statistical defect.]]
Statistical defects of the random source, as introduced in [[Threats Against Environment-Dependent Security]], is the very first attack
vector we utilize. Our analysis showed that for measurements within <math>\approx</math> 300 ms still exhibit temporal correlation. Several further approaches for analyzing the statistical defect could be applied. For instance, temporal correlations or the mutual information I(X; Y ) between the observation X of a legitimized node and the observation Y of an eavesdropper represents further potential statistical defects.
For simplicity, we analyzed the statistical defect of the raw sensor readings by applying a spectrum analysis. The magnitude spectrum of both setups is illustrated in Figure 5.4. Clearly, the frequencies are not entirely uniformly distributed; a bias towards low frequencies is given.
After quantization, the defect will lead to symbol frequencies that dramatically reduce the space of the preliminary key material. For this reason, on-line statistical testing is urgently required. Further, we address in [[Experimental Security Analysis#Eavesdropping Information Reconciliation Data]] how such a defect can affect the security even more drastically.

==Statistical Defect of Quantizers==
To analyze potential statistical defects of quantization schemes, the following metric is introduced. The BER indicates the percentage of bits that are in disagreement between the initial key material of two parties. With decreasing BER, the effort needed to detect and correct errors
decreases as well. BER is evaluated after quantization by the relation: BER = be b where be is the number of bits in the sequence that disagree and b is the length of the initial key. A defect is given if the quantizers output leads to a BER lower than 0.5 for low correlated observations. 
To evaluate quantization schemes, we first applied the Monte-Carlo simulation environment presented in <ref>76</ref>. Two independent random sequences of length 1, 000, 000 are modeled as temporally correlated Rayleigh distributed random variables. The maximum Doppler shift specifies the assumed Jake’s Doppler spectrum. To achieve a quantitative measure for the grade of reciprocity, we define <math>\rho_{\alpha\beta}\in [0;1]</math> as the correlation coefficient between the channel measurements of two nodes.

Further, based on all data of the extensive measurement campaign, we evaluated the BER versus the correlation coefficient <math>\rho</math>. Therefore, we calculated the block-wise correlation as well as the corresponding block-wise BER and sorted those by correlation value. Further, we sorted those by correlation strength and calculated the BER distribution for the following subgroups:
[0 : 0.05, 0.05 : 0.1, ..., 0.95 : 1]. Figure 5.5 shows the distribution of the block-wise BER of the preliminary key material as well as the simulation results of both quantization schemes of Jana et al. <ref>103</ref>.

[[File:Esa-fig5-5.png|500px|thumb|right|Figure 5.5: Evaluation results based on simulation and real-world measurements for both quantization
scheme of Jana et al. <ref>103</ref>. The bit disagreement rate versus correlation coefficient <math>\rho</math> is presented.]]

The BER distribution of the real-world measurements is very similar to the pattern of the simulation. Our results show that the single-bit scheme of Jana et al. <ref>81</ref> has an approximately linearly increasing BER for decreasing correlation. Thereby the BER for correlations higher than <math>\rho = 0.75</math> is smaller than <math>\rho = 0.03</math> and BER values larger than BER= 0.4 are reached if the correlation is smaller than 0.2. This indicates that passive attackers with low correlated observations can reconstruct a large amount of the preliminary key material. The BER function of the multi-bit scheme shows a stable correlation coefficient behaviour of over 0.4 between 0 and 0.7, which strongly decreases towards higher correlations. The BER for high correlations is not as low as for the single-bit version, which leads to stronger error correction capabilities, but the behaviour for low correlations fulfills the security requirement, as we will present in the following Section. 
Further, for statistical analysis we evaluated the preliminary key material off-line by applying a subset of the NIST suite of statistical tests <ref>167</ref>. As some of these tests require a large number of bits, we constrain the evaluated tests to those who can evaluate blocks of 128 bit. 
The success (or acceptance) rates of the NIST statistical tests for each quantizer are listed in Table 5.1. The single-bit quantizer’s output passes the tests with high rates, whereas the blocks produced by the multi-bit quantizer by Jana et al. <ref>103</ref> do not have high pass rates. The results of the sub-test FFT implicate the same result as our frequency analysis of the raw measurement sequence. With the knowledge of the statistical defect, a subset of the preliminary key space can be easily constructed, but it is not performed in this work.
[[File:Esa-tab5-1.png|500px|thumb|right|Table 5.1: Pass rates of several NIST statistical tests for preliminary key material of the quantization schemes by Jana et al. <ref>103</ref>. A block size of 128 bit was applied.]]

==Measurement Attack==
The attacker measures corresponding quantities of the random source between legitimate parties and itself. We assume that a (partial) access to the random source depends on the physical position of the attacker. To evaluate the correlation between Bob’s and Eve’s channel measurements
over distance, we measured the channel 100, 000 times per millimeter. Then the absolute value of the Pearson correlation coefficient was calculated for blocks of 1000 measured values. 
The distributions of the correlation coefficients for different experiments are exemplarily illustrated in Figure 5.6. The three illustrations represent a good example of the diversity of the correlation function.
[[File:Esa-fig5-6.png|500px|thumb|right|Figure 5.6: Three exemplary correlation results of attacker’s observation versus his distance are given. Unequal to general claims - total decorrelation after half of carrier wavelength (6.25 cm) - no uniform behaviour can be recognized.]]
[[File: Esa-fig5-7.png|500px|thumb|right|Figure 5.7: The distribution of the results of 10, 000 repetition attacks are given. Several attacks
lead to correlations larger than 0.7.]]


Several positions for the automated antenna position setup were applied. The positions of each experiment are marked in a certain graphic. The correlation over distance function strongly depends on the positioning of the setup. As the results show, the usual assumption which
claims, that the closer Eve gets to Bob the higher its observation correlates to that of the legitimate parties, is only true for certain positions of the setup, e.g., position 10 as illustrated in Figure 5.6(b). The reason for this may be that the positions of the (multipath-creating) scatterers are not uniformly distributed as required.

==Environment Dependent Results of Spatial Cross-corelation Behavior Between Channel Profile==
We evaluated the environment dependent behaviour of the spatial cross-correlation at a different point c.f. section 4.
An interesting overall result is the fact that cross-correlations and recorrelations are extremely hard to predict. A potential attack will have heavy problems to estimate when he receives (high) correlated observations. Furthermore, it will be hard to verify how high its eavesdrop
observations are correlated to the observations of the legitimate users.

==Repetition / Reconstruction Attack==
We evaluated the repetition attack using the cyclic moving robotic platform. We measured 10, 000 runs of the robotic platform passing the entire elliptic course. The robotic platform was moving with a speed of 0.6m/s along a trail of length 3m. One run is represented by approximately 700 [[RSSI]] values. The results of the correlation between one observation and the resulting repetitions are illustrated in Figure 5.7. The results show that reproduction of correlated channel measurements is possible.
The success rate of the attack depends strongly on the applied quantizations scheme. E.g., the bad BER behaviour for low correlations of the single-bit scheme leads to very similar preliminary key material. Repetitions of the attack lead to a <math>\approx 96%</math> reproduction of the key material after quantization and 100% after information reconciliation.

==Eavesdropping Information Reconciliation Data==
Information of the key material might be revealed due to the publicly transmitted error correction information. The passive eavesdropper Eve is able to listen to communication in the network. The distance of our attacker eavesdropping the communication on the channel was 100m. With special equipment, e.g. directed antennas, the attack works even outside the connection range of network specifications.
For example, transmitted parity check bits always reveal information of the encoded information. Further, considering an attacker knowing statistical defects in the preliminary key material or even measuring correlated observations, the attack might be more effective. We summarize
this potential knowledge of an attacker in the variable Y . The left-over secret information per bit between Alice and Bob is called conditional min-entropy <math>H_\infty(r|Y )</math>, where r is the mutual information between Alice and Bob.
Consider a ''state-of-the-art'' information reconciliation approach, e.g., the one by Dodis et al. <ref>51</ref>, where no parity check bits are transmitted and instead syndrome decoding is used. The observed quantity is interpreted as a received codeword '''r'''. The transmitted syndrome usually only reveals information about the error e of a received codeword '''r = c + e''' and not about the codeword '''c''' itself. Therefore, the amount of information that an attacker can infer from eavesdropping syn(r) corresponds to the number of transmitted bits: '''p = n−k''', where '''n''' is the codeword length and '''k''' the number information bits.
However, the assumption, that '''k''' bit entropy for each codeword is retained, is not true if the conditional min-entropy <math>H_\infty(c|Y)</math> or even the min-entropy <math>H_\infty(r)</math> is low. Here, we do not perform the attack, but introduce concrete security boundaries for secure parametrization of the secure sketch information reconciliation scheme <ref>51</ref> based on estimated entropy, e.g., by using on-line entropy estimation. Addressing the worst-case (WC) where the potential knowledge of statistical defects of an attacker and the revealed syndrome information are independent, the following condition needs to be fulfilled to secure the system against passive eavesdropping:
<math>0 < H^{WC}(\textbf{r}| Y,syn(\textbf{r})) = \frac{ (H_{\infty}(\textbf{r}|Y \cdot n) - (n-k)}{n}
= H_{\infty}(\textbf{r}|Y)  - \frac{n-k}{n}. </math>

==Manipulating Channel==
The attacker might be capable of manipulating the environment or forcing one or both legitimate parties into an artificial environment, e.g., using a Faraday cage to artificially build a static scenario. The aim of the attacker is to determine the symmetric key material by ex-ploiting statistical defects. For simple physical setups, manipulation attacks on RSSI-based key extraction schemes are presented in <ref>103</ref>. Here, the attacker intermittently blocks the line of sight path causing a predictable drop in the RSS values.
An active key recovery attack on physical layer key generation schemes was introduced by Eberz et al. <ref>56</ref>. The attack is based on an active channel-influencing attack through packet injection. The attack’s performance was verified for the quantization scheme by Mathur et al. <ref>132</ref> which is a robust bit extraction scheme utilizing a guard interval and, therefore, leads to a recovery rate of 47 %.
We implemented the attack on a fourth Raspberry Pi with attached TL-WN722N Wi-Fi USB stick. We applied the setup for different positions and with several antennas, gains, and channels. First results of the proposed key recovery attack lead to a recovery rate of 0% (also for the quantization scheme by [[Mathur]] et al. <ref>132</ref>). The reason for this could be the different RF front end (Eberz et al. <ref>56</ref> applied MicaZ hardware). More advanced manipulation techniques are conceivable and are also part of the scope of our future work.

==References==
<references/>