Preventing Overshadowing Attacks in Self-Jamming Audio Channels

Recently there has been a growing interest in short-range communication using audio channels for device pairing and as a self-jamming communication medium. Given that such channels are audible to participants they are considered more resistant to active attacks, i.e., the attack signal would be heard by the participants. In this paper, we investigate the validity of this assumption using two prominent acoustic self-jamming systems implementations. We show that basic overshadowing attacks are possible in these systems and that these attacks cannot be effectively detected by the participants if the attacker is close to the receiving device. Finally, we propose a novel physical-layer solution for effectively detecting overshadowing attacks, which can improve state-of-the-art acoustic self-jamming systems by ensuring channel integrity while not requiring fundamental modifications to these schemes.

1 Introduction

Devices are becoming increasingly smarter and interconnected due to technology initiatives related to machine-to-machine communication and the Internet-of-Things [1], [2]. The large number of of devices that need to make ad-hoc connections presents challenges in terms of security, especially with scalable cryptographic key management. In this regard, researchers are looking at the physical layer of wireless communication to enable secure, keyless communication. Self-jamming is a widely proposed method for providing confidential communication between devices that have no prior security relationship, i.e., neither device has knowledge of other device's cryptographic keys. The basic idea is that jamming noise transmitted by the receiver can hide the data signal of the sender from passive adversaries. This builds on the initial theory of Wyner's wiretap model [3], where a channel is shown to allow secure communication if the noise affecting the attacker's signal is greater than that affecting the receiver's channel. Jamming ensures this channel condition as the intentionally added noise can be removed by the legitimate receiver but not by an adversary [4]. The jamming signal can be transmitted by either a third party (friendly-jamming) or the receiver (self-jamming). There are numerous works on self-jamming schemes for creating confidential channels, e.g., [5], [6], [7], and the effectiveness of such schemes, e.g., [8], [9], especially for short-range ad-hoc connectivity of mobile devices that are capable of implementing near field communication [10], [11], [12], [13], [14] or audio channels [15], [16]. The majority of these schemes only rigorously evaluate their effectiveness against single and/or multiple passive attackers seeking to recover the transmitted data.