RECONFIGURABLE ANTENNA BASED SOLUTIONS FOR DEVICE AUTHENTICATION AND INTRUSION DETECTION IN WIRELESS NETWORKS

• US 20150135293A1
• Filed: 09/07/2012
• Published: 05/14/2015
• Est. Priority Date: 09/08/2011
• Status: Active Grant

• Current Assignee: Drexel University
• Original Assignee: Drexel University
• Inventors: Mookiah, Prathaban, Dandekar, Kapil R., Walsh, John MacLaren, Greenstadt, Rachel
• Granted Patent: US 9,560,073 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint

Abstract

Channel based authentication schemes for intrusion detection that operates at the physical layer are described that apply the capabilities of a pattern re-configurable antenna for improved performance. Performance gains are achieved by the schemes as a function of the number of antenna modes. The first scheme relies on a channel based fingerprint for differentiating between transmitters whereas another scheme poses the intruder detection problem as a generalized likelihood ratio (GLR) test problem that operates on the channel realizations corresponding to different modes present in a reconfigurable antenna. The benefits of these two schemes over single element antennas are demonstrated. General guidelines are provided on how to choose the different elements of the decision metric in order to realize better performance for physical layer based authentication schemes based on any diversity scheme.

Claims

1. A method of authenticating a transmitting device in a communication system using at least one multi-mode reconfigurable antenna, comprising the steps of:

collecting wireless channel information for different antenna modes of said at least one reconfigurable antenna for a legitimate transmitter;

combining the collected wireless channel information for different modes of said at least one reconfigurable antenna into a characteristic transmission fingerprint;

forming a detection threshold based on the characteristic transmission fingerprint for the legitimate transmitter at the outset of a communication connection;

comparing wireless channel information from a later transmission with said fingerprint based on a test metric to determine if the wireless channel information from the later transmission corresponds to said fingerprint within a designated threshold; and

identifying the transmitter of said later transmission as an intruder if said wireless channel transmission does not correspond to said fingerprint within said designated threshold.

2. The method of claim 1, wherein the test metric comprises an angle between the fingerprint of a later transmission and said fingerprint.

3. The method of claim 2, wherein an acceptable angle range between the later transmission and the fingerprint is determined based on an acceptable false alarm rate.

4. The method of claim 1, wherein said designated threshold for a given false alarm rate is computed during a connection initialization phase of said communication connection by transmitting multiple training packets from the legitimate transmitter to a receiver and the test metric is computed between fingerprints corresponding to all of the training packets.

5. The method of claim 4, wherein the computed test metrics are gathered to form a distribution function on the test metric to determine the designated threshold for the given false alarm rate.

6. The method of claim 1, wherein the different modes of said at least one reconfigurable antenna are at least partially decorrelated.

7. The method of claim 1, wherein respective antennas in said communication system cycle through said modes during the transmission of a data packet including training symbols, a payload, and a pad between the payload and training symbols during which a channel estimation is performed for the respective modes.

8. The method of claim 7, wherein the pad has a duration long enough to permit said respective antennas to switch modes.

9. The method of claim 1, wherein the designated threshold is adaptive.

10. The method of claim 1, further comprising the step of detecting intrusion into a wireless transmission between a transmitter and a receiver of the communication system.

11. The method of claim 10, wherein the wireless channel information for different modes is collected at a physical layer of the transmitter and the intrusion detecting step comprises:

monitoring the wireless channel information using a generalized likelihood ratio test; and

generating an alarm when an abrupt change in the wireless channel information is detected, said abrupt change being representative of an intrusion.

12. The method of claim 11, wherein the wireless channel information is provided for multiple decorrelated modes of the reconfigurable antenna and said alarm is generated when a cumulative abrupt change over multiple modes is observed in the cumulative monitored wireless channel information.

13. The method of claim 11, wherein said alarm is generated when the change in the wireless channel information exceeds a variable threshold.

14. The method of claim 13, wherein a value of the threshold is set based on (1) a maximum value generated by applying the generalized likelihood ratio test to a sequence of channel estimate values generated during an initial training period of said transmitter and (2) an acceptable false alarm rate.

15. A method of detecting intrusion into a wireless transmission between a transmitter and a receiver in a communication system using at least one multi-mode reconfigurable antenna, comprising:

collecting wireless channel information between said transmitter and receiver for different antenna modes of said at least one multi-mode reconfigurable antenna at a physical layer of the antenna;

monitoring the wireless channel information using a generalized likelihood ratio test; and

generating an alarm when an abrupt change in the wireless channel information is detected, said abrupt change being representative of an intrusion.