Security over mobile Internet-of-Things (IoT) devices is critical due to the open nature of distributed wireless communication. To efficiently establish a secure connection between two communication parties, a fast mobile key extraction protocol, KEEP, is proposed. KEEP fastly generates similar bit sequences from two communication parties’ measurements of channel-state information (CSI) of different subcarriers. Then, a distributed “verification-recombination” mechanism is introduced to generate the same encryption key from bit sequences without the public-key authentication, digital signature, or key distribution center of the other party. We implemented real-world experiments using commercial off-the-shelf 802.11n devices to evaluate the performance of KEEP in various scenarios. Theoretical analysis and experimental verification show that KEEP is more secure, effective, and reliable than the state-of-the-art methods.
Security over mobile Internet-of-Things (IoT) devices is critical due to the open nature of distributed wireless communication. To efficiently establish a secure connection between two communication parties, a fast mobile key extraction protocol, KEEP, is proposed. KEEP fastly generates similar bit sequences from two communication parties’ measurements of channel-state information (CSI) of different subcarriers. Then, a distributed “verification-recombination” mechanism is introduced to generate the same encryption key from bit sequences without the public-key authentication, digital signature, or key distribution center of the other party. We implemented real-world experiments using commercial off-the-shelf 802.11n devices to evaluate the performance of KEEP in various scenarios. Theoretical analysis and experimental verification show that KEEP is more secure, effective, and reliable than the state-of-the-art methods.
Device to device (D2D) communication is expected to become a promising technology of the next-generation wireless communication systems. Security issues have become technical barriers of D2D communication due to its “open-air” nature and lack of centralized control. Generating symmetric keys individually on different communication parties without key exchange or distribution is desirable but challenging. Recent work has proposed to extract keys from the measurement of physical layer random variations of a wireless channel, e.g., the channel state information (CSI) from orthogonal frequency-division multiplexing (OFDM). Existing CSI-based key extraction methods usually use the measurement results of individual subcarriers. However, our real world experiment results show that CSI measurements from near-by subcarriers have strong correlations and a generated key may have a large proportion of repeated bit segments. Hence attackers may crack the key in a relatively short time and hence reduce the security level of the generated keys. In this work, we propose a fast secret key extraction protocol, called KEEP. KEEP uses a validation-recombination mechanism to obtain consistent secret keys from CSI measurements of all subcarriers. It achieves high security level of the keys and fast key-generation rate. We implement KEEP using off-the-shelf 802.11n devices and evaluate its performance via extensive experiments. Both theoretical analysis and experimental results demonstrate that KEEP is safer and more effective than the state-of-the-art approaches.
Device-to-device communication is increasingly important for emerging wireless applications, including the Internet of Things and industry mobile networks. To establish a secure communication channel between multiple legitimate devices, key agreement is an essential first step. Physical layer channel information is a promising technology for achieving communication security by generating a shared channel key. In this paper, we propose an efficient and random method for generating channel keys based on channel state information (CSI). Firstly, we preprocess the available subcarriers to reduce the correlation of adjacent subcarriers. Secondly, we propose a novel quantization process to generate random and secure channel keys. The part consists of two phases: the quantization phase and the inconsistency removal phase. In the quantization stage, CSI sub carriers are grouped into small blocks, and appropriate thresholds are generated. Then, wireless users quantize the CSI subcarriers into initial bit streams of 0 and 1 with different thresholds. In the inconsistency removal phase, we design an error correction mechanism where wireless users exchange the discarded index sequences in the initial bit streams to achieve key sequence consistency. We implement the proposed scheme using off-the-shelf wireless devices and evaluate its performance. The experimental results show that each CSI packet can produce 30 bits, which have passed the NIST randomness tests.
Generating keys and keeping them secret is critical in secure communications. Due to the "open-air" nature, key distribution is more susceptible to attacks in wireless communications. An ingenious solution is to generate common secret keys by two communicating parties separately without the need of key exchange or distribution, and regenerate them on needs. Recently, it is promising to extract keys by measuring the random variation in wireless channels, e.g., RSS. In this paper, we propose an efficient Secret Key Extraction protocol without Chasing down Errors, SKECE. It establishes common cryptographic keys for two communicating parties in wireless networks via the realtime measurement of Channel State Information (CSI). It outperforms RSS-based approaches for key generation in terms of multiple subcarriers measurement, perfect symmetry in channel, rapid decorrelation with distance, and high sensitivity towards environments. In the SKECE design, we also propose effective mechanisms such as the adaptive key stream generation, leakage resilient consistence validation, and weighted key recombination, to fully exploit the excellent properties of CSI. We implement SKECE on off-the-shelf 802.11n devices and evaluate its performance via extensive experiments. The results demonstrate that SKECE achieves a more than 3x throughput gain in the key generation from one subcarrier in static scenarios, and due to its high efficiency, a 50% reduction on the communication overhead compared to the state-of-the-art RSS based approaches.
Device-to-device communication is important to emerging mobile applications such as Internet of Things and mobile social networks. Authentication and key agreement among multiple legitimate devices is the important first step to build a secure communication channel. Existing solutions put the devices into physical proximity and use the common radio environment as a proof of identities and the common secret to agree on a same key. However they experience very slow secret bit generation rate and high errors, requiring several minutes to build a 256-bit key. In this work, we design and implement an authentication and key agreement protocol for mobile devices, called The Dancing Signals (TDS), being extremely fast and error-free. TDS uses channel state information (CSI) as the common secret among legitimate devices. It guarantees that only devices in a close physical proximity can agree on a key and any device outside a certain distance gets nothing about the key. Compared with existing solutions, TDS is very fast and robust, supports group key agreement, and can effectively defend against predictable channel attacks. We implement TDS using commodity off-the-shelf 802.11n devices and evaluate its performance via extensive experiments. Results show that TDS only takes a couple of seconds to make devices agree on a 256-bit secret key with high entropy.
The Internet of Things (IoT) consists of a range of devices that communicate with other devices that are surrounding them. Secure communications between IoT devices have been an essential requirement. However, most existing authentication protocols fail to provide privacy protection for devices such that sensitive information including device owner’s identity and device type can be leaked. In this paper, based on attribute-based encryption (ABE), we propose two private and mutual authentication protocols to protect the privacy of IoT devices. The first protocol is a three-message key exchange protocol, following the public-key encryption mode of the Internet Key Exchange (IKE). The second protocol is a one-round key exchange protocol, thereby providing simplicity and efficiency of messages communicated between the participants. Both of our protocols can be proved secure in the defined model. Finally, we implement the two protocols in an open source framework.
The Internet of Things (IoT), as a new type of communication network, is involved in developing and applying secure transmission and storing a large amount of sensitive information. Due to the IoT devices' constrained resources, high connection costs, sluggish transmission speeds, and the inapplicability of security fundamentals like public key methods and digital signatures for simple device authentication, this paper presents a lightweight anonymous key-sharing authentication protocol for IoT devices. The protocol utilizes the tamper-resistant and anti-cloning properties of Hardware Physical Unclonable Functions (PUFs) to generate shared keys. In addition, it incorporates security primitives such as the MASK algorithm and Hash functions. The security analysis and verification using Ban logic and the proper tool ProVerif demonstrate that the protocol can defend against attacks such as man-in-the-middle, de-synchronization, impersonation, and modeling attacks. Compared with other protocols, this protocol exhibits the characteristics of low computational cost, minimal communication overhead and storage capacity, and high-security performance, making it suitable for secure communication and transmission in resource-constrained devices.