Reconfigurable antenna based solutions for device authentication and intrusion detection in wireless networks

• US 10,178,124 B2
• Filed: 12/23/2016
• Issued: 01/08/2019
• Est. Priority Date: 09/08/2011
• Status: Active Grant

• Current Assignee: Drexel University
• Original Assignee: Drexel University
• Inventors: Mookiah, Prathaban, Dandekar, Kapil R., Walsh, John MacLaren, Greenstadt, Rachel
• Primary Examiner(s): Feild, Lynn D
• Assistant Examiner(s): Lakhia, Viral S
• Application Number:
  US15/390,134
• Publication Number:
  US 20170180420A1
• Time in Patent Office: 746 Days
• Field of Search: 370230-252, 455101, 726 1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint

Abstract

Channel based authentication schemes for intrusion detection that operates at the physical layer are described that apply the capabilities of a pattern reconfigurable antenna for improved performance. Performance gains are achieved by the schemes as a function of the number of antenna modes. The first scheme relies on a channel based fingerprint for differentiating between transmitters whereas another scheme poses the intruder detection problem as a generalized likelihood ratio (GLR) test problem that operates on the channel realizations corresponding to different modes present in a reconfigurable antenna. The benefits of these two schemes over single element antennas are demonstrated. General guidelines are provided on how to choose the different elements of the decision metric in order to realize better performance for physical layer based authentication schemes based on any diversity scheme.

Claims

1. A method of detecting intrusion into a wireless transmission between a transmitter and a receiver in a communication system using at least one multi-mode reconfigurable antenna, comprising:

at a physical layer of the multi-mode reconfigurable antenna, determining wireless channel information between said transmitter and receiver for different antenna modes of said at least one multi-mode reconfigurable antenna;

determining, based on the wireless channel information for the different antenna modes, a likelihood ratio function associated with the wireless channel information, wherein the likelihood ratio function comprises an estimate of cumulative wireless channel information between the transmitter and receiver;

determining a threshold for the likelihood ratio function based at least on a maximum value generated by applying a generalized likelihood ratio test to a sequence of channel estimate values generated during an initial training period of the transmitter;

determining, via use of the generalized likelihood ratio test, if the likelihood ratio function exceeds the predetermined threshold during the wireless transmission; and

generating an alarm when the predetermined threshold is exceeded, said exceeding being representative of an intrusion.

2. The method of claim 1, wherein the wireless channel information is provided for multiple decorrelated modes of the reconfigurable antenna.

3. The method of claim 1, wherein the predetermined threshold is a variable threshold.

4. The method of claim 3, wherein a value of the variable threshold is further set based on an acceptable false alarm rate.

5. The method of claim 1, wherein collecting wireless channel information comprises the receiver estimating a probability distribution σ

₀ through a training sequence where a number of packets used for training is denoted by N_T and computing a likelihood ratio L(h) for packets h=[h_j, K, h_k] for j=i−

N+1 where N=k−

j+1 is a block size and k=i based on channel estimates at each instant i (N≤

i≤

N_T) for each packet transmission.

6. The method of claim 5, further comprising the receiver selecting, based on L(h) computed during a training phase, a threshold γ

such that an alarm is raised whenever L(h)>

γ

.

7. The method of claim 6, wherein in the event of an alarm, a re-authentication procedure is evoked to reverify an identity of the transmitter.

8. The method of claim 5, wherein for a single antenna mode:

9. The method of claim 5, wherein for multiple antenna modes:

10. The method of claim 1, wherein the antenna modes are selected such that pattern correlation coefficients between different antenna modes are kept as low as possible.