Robust Wireless Communication for Multi-Antenna, Multi-Rate, Multi-Carrier Systems

129 Pages·2016·4.15 MB·English

Ph.D. Dissertation
Robust Wireless Communication for
Multi-Antenna, Multi-Rate, Multi-Carrier Systems
Triet Dang Vo-Huu
CollegeofComputerandInformationScience
NortheasternUniversity
Ph.D.Committee
ProfessorGuevaraNoubir Advisor,NortheasternUniversity
ProfessorErik-OliverBlass AirbusGroupInnovations/NortheasternUniversity
ProfessorRajmohanRajaraman NortheasternUniversity
ProfessorSrdjanCapkun Externalmember,ETHZurich
ProfessorDavidStarobinski Externalmember,BostonUniversity
June2015

Abstract
Today’s trend of migrating radio devices from hardware to software provides potentials to create flexible
applications for both commercial and military use. However, this raises security concerns, as malicious
attackscanalsobealleviatedtobreaklegitimatecommunications. Inthisresearchwork,westudyandbuild
practicalsystemstomitigatetheimpactofsomeseriousjammingthreats: high-powerjamming,rate-based
attacks,andjamminginmulticarriersystems.
First,wedevelopSAIM–ahybridsystemofmixedmechanicalsteerableantennaandsoftwarejamming
cancellation – to counter high-power jamming adversary. The system robustness relies on a new antenna
structurewespeciallydesignforanti-jammingpurpose,andasetofnewalgorithmsthatcanadaptivelyand
effectively mitigate the jamming signal up to 100,000 times higher than legitimate signals. Our solution is
appropriateformaliciousenvironmentswithpowerfuljammers,wheremechanicalsteeringisfeasible,e.g.,
militaryapplications.
In residential wireless deployments, even limited-power rate adaptation attacks can dramatically affect
the system performance. To tackle this problem, we develop CBM for hiding rate information, and – at
the same time – increasing resiliency against jammers up to seven times higher than regular rate-exposing
systems. The resiliency boost is achieved by our new generalized non-uniform Trellis Coded Modulation
codes,whilethemodulationandcodeinformationisconcealedbyanewefficientmethodforcryptographi-
callyinterleavingbasebandsymbols.
Asathirdpartofthiswork,weinvestigatethejammingimpactonmulticarriersystemswithfocusonWi-
Fi communications. Toward this goal, we develop the first open source software defined radio Wi-Fi stack
thatcanoperateathighratesandallowdetailedanalysisfromPhysicalLayertoMediumAccessControland
LinkLayers. Usingourplatform,weanalyzetheinterleavingprocessspecifiedbyIEEE802.11andexploit
ittodeviseanefficientInterleavingJammingstrategythatcantotallyblocktheWi-Ficommunicationswith
jammingpowerlessthan1%oftheregulartransmittedsignalpower. Ourjammingstrategyisatleast5dB
andupto15dBmorepower-efficientthanthosethatareunawareoftheWi-Fiinterleavingstructure.
Acknowledgements
Firstofall,IwouldliketoexpressmydeepgratitudetomyPh.D.advisor,ProfessorGuevaraNoubir,who
hascontinuouslybeensupportingmeduringmyPh.D.workandinspiringmetotacklechallengingresearch
problems. Hehasnotonlybroughttomegreathigh-levelideasbutalsowalkedmethroughdeeptechnical
details. Besideswork,heisalsotheoneIalwaystrustandfeelcomfortabletodiscussandsharemythoughts
onnon-technicalthings. TobeadvisedbyGuevaraisthebestluckinmyacademiclife.
I am especially grateful to Bishal Thapa, Tao Jin and Professor Erik-Oliver Blass who have been giving
invaluableexperiencesandadvices,spendingdaysandnightswithmeondiscussingnewideasandsolutions.
I would like to sincerely thank Professor Rajmohan Rajaraman, Professor Srdjan Capkun, and Professor
David Starobinski for being in my Ph.D. committee, taking their invaluable time for evaluating my work
andprovidingthoughtfulandhelpfulcomments.
MywarmthanksgotomyfriendsAbhishekSamanta,AldoCassola,AmiraliSanatinia,SevtapDumanand
others in the Secure Systems Lab for everything they did for me, and for moments we shared and spent
together.
Finally, I want to dedicate this dissertation to my parents Võ Hữu Thảo and Nguyễn Ngọc Hạnh, my wife
Nguyễn Ngọc Minh Châu, and my younger brother Võ Hữu Đăng Tiến who unconditionally love me and
havebeenconstantlysupportingmeduringmyPh.D.work.
Contents
1 Introduction 1
1.1 High-PowerJamming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1.2 Proposedsolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 JammingonLinkRateAdaptivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2.2 Proposedsolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3 JamminginMulticarrierSystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.3.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.3.2 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.4 Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2 SAIM–CounteringHigh-PowerJamming 10
2.1 Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.1.1 CommunicationandAdversarialModel . . . . . . . . . . . . . . . . . . . . . . . . 10
2.1.2 Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2 Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.3 Firststage–AntennaAuto-Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.3.1 PatternAnalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.3.1.1 AnalyticalPattern–Light-of-SightModel . . . . . . . . . . . . . . . . . 15
2.3.1.2 OutdoorExperimentalPattern . . . . . . . . . . . . . . . . . . . . . . . . 18
2.3.1.3 IndoorExperimentalPattern . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.3.1.4 PatternContinuity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.3.2 AntennaConfigurationAlgorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.3.2.1 OutdoorandKnownLocations . . . . . . . . . . . . . . . . . . . . . . . 20
2.3.2.2 UnknownLocations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.4 Secondstage–DigitalJammingCancellation . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.4.1 ChannelGainRatioEstimation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.4.2 RemovingandDecoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
2.4.3 PracticalIssues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
2.5 PrototypeandImplementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
2.6 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.6.1 AntennaConfiguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.6.1.1 BasicOperations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.6.1.2 Brute-ForceAlgorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
2.6.1.3 FastAlgorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
2.6.2 Anti-JammingPerformance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
2.6.2.1 DBPSKModulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
2.6.2.2 DQPSKModulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
2.6.2.3 VariablePowerJammer . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
2.7 Relatedwork . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
2.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3 CBM–ConcealingRateInformationandBoostingResiliency 39
3.1 RateInformationLeakage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.1.1 Explicitrateinformation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.1.2 Modulationguessing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
3.1.3 Codeguessing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
3.2 ChallengestoRateConcealing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
3.2.1 DataEncryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
3.2.2 UsingSingleModulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
3.2.3 ModulationLevelEncryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
3.2.4 Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
3.3 Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
3.4 GeneralTCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
3.4.1 Codesearchalgorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.4.2 Freedistancecomputationalgorithm . . . . . . . . . . . . . . . . . . . . . . . . . . 47
3.4.3 Searchresults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
3.5 CryptographicInterleaving . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
3.6 SynchronizationMechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.6.1 OverviewofTransmitterandReceiver . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.6.2 FrameSynchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.6.3 PhaseTracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
3.7 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
3.7.1 SimulationResults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
3.7.2 ExperimentalResults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
3.8 RelatedWork . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
3.9 ConclusionandDiscussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
4 SWiFi: Wi-FiNetworkAnalysiswithSDR 65
4.1 OverviewofOFDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
4.2 TransmitterDesign . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
4.3 ReceiverDesign . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
4.3.1 FrequencyOffsetCorrection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
4.3.2 FrequencyDomainEqualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
4.4 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
4.4.1 Componentsandcommonmethodology . . . . . . . . . . . . . . . . . . . . . . . . 79
4.4.2 Performanceovertheair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
4.4.3 Controlledattenuationevaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
4.5 EnablingWi-FiAnalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
4.5.1 TimingAnalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
4.5.2 OpenSourceReleasetotheCommunity . . . . . . . . . . . . . . . . . . . . . . . . 86
4.6 Relatedwork . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
4.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
5 MulticarrierJammingonWi-FiCommunications 90
5.1 OverviewofInterleavingMechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
5.2 JammingStrategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
5.2.1 UnderstandingInterleavingPattern . . . . . . . . . . . . . . . . . . . . . . . . . . 92
5.2.2 JammingStrategy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
5.3 ExperimentalResults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
5.3.1 Narrow-bandJamming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
5.3.2 Wide-bandJamming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
5.3.3 Whole-bandJammingvs. InterleavingJamming . . . . . . . . . . . . . . . . . . . 98
5.3.4 EffectofNumberofJammingSubcarriers . . . . . . . . . . . . . . . . . . . . . . . 98
5.3.5 JammingonPilotSubcarriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
5.3.6 Short-burstJamming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
5.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
6 FutureWork 103
List of Figures
1.1 High-powerjammingattackillustration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 SAIM’s1ststage: Two-elementAntennaControl. . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 SAIM’s2ndstage: DigitalCancellation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.4 Biterrorratescomparisonbetweenmodulations . . . . . . . . . . . . . . . . . . . . . . . . 5
1.5 CBM’smaincomponents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1 BlockdiagramofSAIMsystem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2 SAIM receiver with a two-element antenna (used for the 1st stage) capable of rotation and
elementseparation,andasingle-elementantenna(usedforthe2ndstage) . . . . . . . . . . 13
2.3 Thetwo-elementantennainafree-spacecommunicationwithonetransmitter. . . . . . . . . 16
2.4 Outdoor receive patterns of the two-element antenna. Experimental gains (lines with plus
signs)arecomparedtotheoreticalvalues(lineswithoutmarkers). . . . . . . . . . . . . . . . 19
2.5 Locations of minimizing and maximizing angles for separations between λ/4 and 3λ in
an outdoor environment. Plus (+) indicates experimental results, and cross (X) indicates
theoreticalpredictions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.6 Experimentalindoorreceivepatterns. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.7 Locations of minimizing and maximizing angles for separation values between 0.25λ and
3.25λ measuredinanindoorexperiment. . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.8 Receivercomponentsandconnections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
2.9 Antennamodel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
2.10 Experimentalsetupwith3nodesindifferentlocations. . . . . . . . . . . . . . . . . . . . . 32
2.11 Brute-force: total received power relative to total received power’s minimum value during
search. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
2.12 Fast: totalreceivedpowerrelativetototalreceivedpower’sminimumvalueduringsearch. . 35
2.13 DBPSKandDQPSKmodulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36