Interference Robustness and Security of Impulse-Radio Ultra-Wide Band Networks

In this thesis we study Impulse-Radio Ultra-Wide Band (IR-UWB), a physical layer radio technology offering many features that make it a promising choice for future short-range wireless networks. The challenges in such networks are many, ranging from the cost-complexity constraints of devices, through the presence of interference created by other users, up to stringent security requirements imposed by sensitive applications. Our main goal is to understand and show how a low-complexity IR-UWB receiver can be designed such that it is able to cope with the difficult environment that it will face in such networks. Although IR-UWB systems promise to provide a solution for some of the above-mentioned challenges, IR-UWB is not a panacea: More often than not, it will be able to live up to its promises only if the entire system is carefully designed. One example is robustness to interference from concurrent users, which is the topic of the first part of this thesis. Short-range wireless networks are expected to be self-organized and uncoordinated rather than centrally organized. This in turn leads to uncontrolled interference due to concurrent transmissions from uncoordinated devices. Thanks to its large bandwidth, combined with low duty-cycle transmissions, IR-UWB should in theory be able to accommodate a large number of concurrent users while keeping multi-user interference (MUI) levels low. We show that, if not properly addressed, MUI can severely affect the performance of an IR-UWB receiver, making this benefit of IR-UWB void. This is especially true if low complexity architectures, such as the popular non-coherent energy-detection receiver, are used. Further, we show that MUI affects all aspects of physical layer packet reception and appropriate algorithms to deal with it are thus required at every level. The first crucial step to receive an IR-UWB data packet is signal acquisition. We present a robust and low-complexity algorithm that allows for reliable signal acquisition with an IR-UWB energy-detection receiver in the presence of MUI, even in near-far scenarios. After signal acquisition, the receiver performs a phase of channel estimation. Channel estimation is of particular importance for interference mitigation: it allows the receiver to distinguish the signal of the user of interest from MUI. In the case of energy-detection receivers that are compliant with the IR-UWB standard IEEE 802.15.4a, channel estimation is especially challenging because with this standard the signalling structure changes within a data packet. We introduce a novel receiver structure that takes this peculiarity into account and allows for the design of robust low-complexity receivers for IEEE 802.15.4a networks. The final step in receiving a data packet is demodulation and decoding of the payload. We show that an adaptive thresholding scheme that uses the channel state information, obtained during channel estimation, can yield very good robustness against MUI. We also introduce more sophisticated algorithms that are based on statistical interference modeling and show that they yield an additional increase in robustness against MUI. In the second part of this thesis we investigate clock-offset tracking for IR-UWB energy-detection receivers. Clock-offset tracking is needed because the oscillators driving the clocks of low-complexity receivers are of average quality at best. We show that the resulting desynchronization between transmitter and receiver may lead to a huge performance degradation in the case of adaptive energy-detection receivers. To overcome this sensitivity to clock offsets, we present a clock-offset tracking algorithm that is constructed around the Radon transform, an image processing tool traditionally used to detect line features in images. Our algorithm is fully compatible with the IEEE 802.15.4a standard, does not increase the hardware complexity of the receiver and reduces the performance loss due to clock offsets to a marginal level. In the third part of this thesis, we look at IR-UWB from the viewpoint of security. We evaluate to what extent IEEE 802.15.4a is vulnerable to distance-decreasing attacks on the physical layer. These attacks target the ranging mechanism that allows two wireless devices to estimate their mutual distance. Commonly, ranging is secured by secure ranging protocols employing cryptographic mechanisms that guarantee that the estimated distance is an upper-bound on the actual distance. However, a new breed of attacks bypasses these cryptographic mechanisms, introduced at higher communication layers, by directly attacking the physical layer. Understanding the impact of these attacks on IEEE 802.15.4a is of the utmost importance: its high precision ranging capabilities make IR-UWB a natural candidate for ranging applications, and IEEE 802.15.4a is the only wireless standard that has been specifically designed for ranging. Our analysis shows that IEEE 802.15.4a, does not automatically provide security against such attacks. We find that with the mandatory modes of the standard and no appropriate countermeasures in place, an external attacker can decrease the measured distance by more than one hundred meters with a very high probability.

Interference management in impulse-radio ultra-wide band networks

Ruben Merz

We consider networks of impulse-radio ultra-wide band (IR-UWB) devices. We are interested in the architecture, design, and performance evaluation of these networks in a low data-rate, self-organized, and multi-hop setting. IR-UWB is a potential physical layer for sensor networks and emerging pervasive wireless networks. These networks are likely to have no particular infrastructure, might have nodes embedded in everyday life objects and have a size ranging from a few dozen nodes to large-scale networks composed of hundreds of nodes. Their average data-rate is low, on the order of a few megabits per second. IR-UWB physical layers are attractive for these networks because they potentially combine low-power consumption, robustness to multipath fading and to interference, and location/ranging capability. The features of an IR-UWB physical layer greatly differ from the features of the narrow-band physical layers used in existing wireless networks. First, the bandwidth of an IR-UWB physical layer is at least 500 MHz, which is easily two orders of magnitude larger than the bandwidth used by a typical narrow-band physical layer. Second, this large bandwidth implies stringent radio spectrum regulations because UWB systems might occupy a portion of the spectrum that is already in use. Consequently, UWB systems exhibit extremely low power spectral densities. Finally IR-UWB physical layers offer multi-channel capabilities for multiple and concurrent access to the physical layer. Hence, the architecture and design of IR-UWB networks are likely to differ significantly from narrow-band wireless networks. For the network to operate efficiently, it must be designed and implemented to take into account the features of IR-UWB and to take advantage of them. In this thesis, we focus on both the medium access control (MAC) layer and the physical layer. Our main objectives are to understand and determine (1) the architecture and design principles of IR-UWB networks, and (2) how to implement them in practical schemes. In the first part of this thesis, we explore the design space of IR-UWB networks and analyze the fundamental design choices. We show that interference from concurrent transmissions should not be prevented as in protocols that use mutual exclusion (for instance, IEEE 802.11). Instead, interference must be managed with rate adaptation, and an interference mitigation scheme should be used at the physical layer. Power control is useless. Based on these findings, we develop a practical PHY-aware MAC protocol that takes into account the specific nature of IR-UWB and that is able to adapt its rate to interference. We evaluate the performance obtained with this design: It clearly outperforms traditional designs that, instead, use mutual exclusion or power control. One crucial aspect of IR-UWB networks is packet detection and timing acquisition. In this context, a network design choice is whether to use a common or private acquisition preamble for timing acquisition. Therefore, we evaluate how this network design issue affects the network throughput. Our analysis shows that a private acquisition preamble yields a tremendous increase in throughput, compared with a common acquisition preamble. In addition, simulations on multi-hop topologies with TCP flows demonstrate that a network using private acquisition preambles has a stable throughput. On the contrary, using a common acquisition preamble exhibits an effect similar to exposed terminal issues in 802.11 networks: the throughput is severely degraded and flow starvation might occur. In the second part of this thesis, we are interested in IEEE 802.15.4a, a standard for low data-rate, low complexity networks that employs an IR-UWB physical layer. Due to its low complexity, energy detection is appealing for the implementation of practical receivers. But it is less robust to multi-user interference (MUI) than a coherent receiver. Hence, we evaluate the performance of an IEEE 802.15.4a physical layer with an energy detection receiver to find out whether a satisfactory performance is still obtained. Our results show that MUI severely degrades the performance in this case. The energy detection receiver significantly diminishes one of the most appealing benefits of UWB, specifically its robustness to MUI and thus the possibility of allowing for parallel transmissions. This performance analysis leads to the development of an IR-UWB receiver architecture, based on energy detection, that is robust to MUI and adapted to the peculiarities of IEEE 802.15.4a. This architecture greatly improves the performance and entails only a moderate increase in complexity. Finally, we present the architecture of an IR-UWB physical layer implementation in ns-2, a well-known network simulator. This architecture is generic and allows for the simulation of several multiple-access physical layers. In addition, it comprises a model of packet detection and timing acquisition. Network simulators also need to have efficient algorithms to accurately compute bit or packet error rates. Hence, we present a fast algorithm to compute the bit error rate of an IR-UWB physical layer in a network setting with MUI. It is based on a novel combination of large deviation theory and importance sampling.

EPFL2008

Distance Bounding with IEEE 802.15.4a: Attacks and Countermeasures

Manuel Flury, Jean-Pierre Hubaux, Jean-Yves Le Boudec, Panagiotis Papadimitratos, Marcin Poturalski

Impulse Radio Ultra-Wideband, in particular the recent standard IEEE 802.15.4a, is a primarycandidate for implementing distance bounding protocols, thanks to its ability to perform accurate indoor ranging. Distance bounding protocols allow two wireless devices to securely estimate the distance between themselves, with the guarantee that the estimate is an upper-bound on the actual distance. These protocols serve as building blocks in security-sensitive applications such as tracking, physical access control, or localization. We investigate the resilience of IEEE 802.15.4a to physical-communication-layer attacks that decrease the distance measured by distance bounding protocols, thus violating their security. We consider two attack types: malicious prover (internal) and distance-decreasing relay (external). We show that if the honest devices use energy-detection receivers (popular due to their low cost and complexity), then an adversary can perform highly effective internal and external attacks, decreasing he distance by hundreds of meters. However, by using more sophisticated rake receivers, or by implementing small modifications to IEEE 802.15.4a and employing energy-detection receivers with a simple countermeasure, honest devices can reduce the effectiveness of external distance-decreasing relay attacks to the order of 10m. The effectiveness of malicious prover can also be reduced to 10m, by an additional modification to IEEE 802.15.4a along with the same simple countermeasure for both energy-detection receivers and rake receivers.

2010

Distance Bounding with IEEE 802.15.4a: Attacks and Countermeasures

Manuel Flury, Jean-Pierre Hubaux, Jean-Yves Le Boudec, Panagiotis Papadimitratos, Marcin Poturalski

Impulse Radio Ultra-Wideband, in particular the recent standard IEEE 802.15.4a, is a primary candidate for implementing distance bounding protocols, thanks to its ability to perform accurate indoor ranging. Distance bounding protocols allow two wireless devices to securely estimate the distance between themselves, with the guarantee that the estimate is an upper-bound on the actual distance. These protocols serve as building blocks in security-sensitive applications such as tracking, physical access control, or localization. We investigate the resilience of IEEE 802.15.4a to physical-communication-layer attacks that decrease the distance measured by distance bounding protocols, thus violating their security. We consider two attack types: malicious prover (internal) and distance-decreasing relay (external). We show that if the honest devices use energy-detection receivers (popular due to their low cost and complexity), then an adversary can perform highly effective internal and external attacks, decreasing the distance by hundreds of meters. However, by using more sophisticated rake receivers, or by implementing small modifications to IEEE 802.15.4a and employing energy-detection receivers with a simple countermeasure, honest devices can reduce the effectiveness of external distance-decreasing relay attacks to the order of 10m. The same is true for malicious prover attacks, provided that an additional modification to IEEE 802.15.4a is implemented.

Institute of Electrical and Electronics Engineers2011

Interference management in impulse-radio ultra-wide band networks

Ruben Merz

EPFL2008