Outline A taxonomy of CR security threats Primary user emulation - PDF document

10/25/19 Outline • A taxonomy of CR security threats • Primary user emulation attacks Cognitive Radio Network Security • Byzantine failures in distributed spectrum sensing • Security vulnerabilities in IEEE 802.22 Yao Zheng 1 2 Introduction COGNITIVE RADIO TECHNOLOGY • Successful deployment of CR networks and the realization of their benefits will depend on the placement of essential security mechanisms Cognitive • Emergence of the opportunistic spectrum sharing Radios (OSS) paradigm and cognitive radio technology raises new security implications that have not been studied previously • Researchers have only recently started to examine Spectrum Spectrum Spectrum Spectrum the security issues specific to CR devices and Sensing Management Sharing Mobility networks 3 4 Some Recent Publications on CR Security Some Recent Publications on CR Security • T. Clancy, N. Goergen, “Security in Cognitive Radio Networks: Threats and Mitigation,” Int’l Conference on Cognitive Radio Oriented Wireless Networks and • R. Chen, J. Park, & J. Reed, “Defense against primary user emulation Communications , May 2008. attacks in cognitive radio networks,” IEEE Journal on Selected Areas in • T.B. Brown and A. Sethi, “Potential cognitive radio denial-of-service vulnerabilities Communications , vol. 26, no. 1, Jan. 2008. and protection countermeasures: a multi-dimensional analysis and assessment,” • R. Chen, J. Park, T. Hou, & J. Reed, “Toward secure distributed spectrum Journal of Mobile Networks and Applications , vol. 13, no. 5, Oct. 2008. sensing in cognitive radio networks,” IEEE Comm. Magazine , vol. 46, no. • A. Brawerman et al., “Towards a fraud-prevention framework for software defined 4, 2008. radio mobile devices,” EURASIP Journal on Wireless Comm. and Networking , vol. 2005, no. 3, 2005. • S. Xiao, J. Park, and Y. Ye, “Tamper Resistance for Software Defined Radio Software,” IEEE Computer Software and Applications Conference , • L.B. Michael et al., “A framework for secure download for software-defined radio,” July 2009. IEEE Comm. Magazine , July 2002. • P . Flanigan et al., “Dynamic policy enforcement for software defined radio,” 38 th • K. Bian and J. Park, “Security Vulnerabilities in IEEE 802.22,” Fourth Annual Simulation Symposium , 2005. International Wireless Internet Conference , Nov. 2008. 5 6 1

10/25/19 The Importance of Distinguishing Primary Users from A Taxonomy of CR Security Threats Secondary Users • Spectrum usage scenario for a secondary user CR CR netwo work se secu curity y threats o Periodically search for spectrum “white spaces” (i.e., fallow bands) to transmit/receive data o When a primary user is detected in its spectrum Sp Spectrum access- Radio softwa Ra ware related securi re rity thre reats security se y threats band Secu curity y threats s to the • Immediately vacate that band and switch to a vacant one software download proce so cess ss Inject ction of false se/fo forged à “vertical spectrum sharing” polici cies Th Threats to incumbent Threats to self- Th o When another secondary user is detected in its Inject ction of false se/fo forged co coexi xistence ce mech chanism sms co coexi xist stence ce mech chanism sms SW updates SW Inject ction of malici cious s SW spectrum band Spect ctral “honeyp ypots” s” Tx x false se/sp spurious s inter-ce cell (vi viruse ses) Senso sory y manipulation : beaco cons s (co control messa ssages) Software IP So P theft - Primary y use ser emulation Exp xploit/obst struct ct inter-ce cell • When there are no better spectrum opportunities, it may choose to share - Geosp spatial manipulation sp spect ctrum sh sharing proce cesse sses So Software tampering the band with the detected secondary user - Chaff point attack ck Unauthorize zed policy cy ch changes - Spam point bias s attack k à “horizontal spectrum sharing” Tampering w/ Ta / CR reaso soners Obst struct ct syn synch chroniza zation of QPs (e.g., , Syst ystem Strategy y Reaso soner • CR MAC protocol guarantees fair resource allocation among secondary & & Policy cy Reaso soner ) users 7 8 Existing Technique (1): Using Energy Detection to Primary User Emulation Attacks Conduct Spectrum Sensing • Trust model Distributed Spectrum Sensing Ø An energy detector measures RF energy or the RSS to determine whether a given channel is idle Sensor Sensing data Local collector or not spectrum Data fusion Final spectrum sensing Sensor sensing result Primary results Ø Secondary users can recognize each other’s signals . . . signal transmitter and share a common protocol, and therefore are Sensor able to identify each other Signals with the same characteristics Ø If an unidentified user is detected, it is considered Adversaries as primary signals a primary user Primary-User Emulation attack : An attacker emulates the characteristics of a primary signal transmitter 9 10 Existing Technique (1): Using Energy Detection to Existing Technique (1): Using Energy Detection to Conduct Spectrum Sensing Conduct Spectrum Sensing • Problem: If a malicious secondary user transmits a signal that • Transmitter detection is not recognized by other secondary users, it will be identified as a primary user by the other secondary users 2) Energy detection o Interference to primary users o Prevents other secondary users from accessing that band Decision statistic Y follows Chi-square distribution ì c 2 ï H 2 M 0 Y ! í c g ï 2 ( ) H î 2 M 1 10/25/19 11 11 12 2

10/25/19 Existing Technique (2): Matched Filter and Existing Technique (2): Matched Filter and Cyclostationary Feature Detection Cyclostationary Feature Detection • Trust model Transmitter detection • Ø Matched filter and cyclostationary feature 1) Matched filter detection detectors are able to recognize the distinguishing characteristics of primary user signals Ø Secondary users can identify each other’s signals • Problem: If a malicious secondary user transmits signals that emulate the characteristics of primary user signals, it will be identified as a primary user by the other secondary users o Interference to primary users Advantages : Better detection performance and less time to achieve processing gain o Prevents other secondary users from accessing Disadvantages : Priori knowledge of primary signal is required (such as that band pilots, preambles or synchronized messages). 13 14 The Disruptive Effects of Primary User Emulation Existing Technique (3): Quiet Period for Spectrum Sensing Attacks • Trust model Ø Define a “quiet period” that all secondary users stop 7 5 Selfish attackers transmission. It is dedicated for spectrum sensing. Legitimate users Available link bandwidth (MHz) Available link bandwidth (MHz) 6 4 Ø Any user detected in the quiet period (using energy 5 detector, matched filter or cyclostationary feature detector) 3 4 is a primary user 3 2 2 • Problem: If a malicious secondary user transmits signals in the quiet 1 period, it will be identified as a primary user by the other secondary users 1 o Interference to primary users 0 0 0 5 10 15 20 25 30 0 5 10 15 20 25 30 Number of pairs of selfish attackers Number of malicious attackers o Prevents other secondary users from accessing that band Selfish PUE attacks Malicious PUE attacks 15 16 A Flowchart of transmitter verification Transmitter Verification for Spectrum Sensing • Transmitter verification for spectrum sensing is composed of three processes: o Verification of signal characteristics o Measurement of received signal energy level o Localization of the signal source 17 18 3

10/25/19 Challenges in PST Localization A solution to PST Localization • Magnitude of an RSS value typically decreases as the distance • Primary signal transmitter (PST) localization is more challenging than the standard localization problem due to two reasons between the signal transmitter and the receiver increases o No modification should be made to primary users to • If one is able to collect a sufficient number of RSS accommodate the DSA of licensed spectrum. This requirement measurements from a group of receivers spread throughout a excludes the possibility of using a localization protocol that large network, the location with the peak RSS value is likely to involves the interaction between a primary user and the be the location of a transmitter. localization device(s). • Advantage of this technique is twofold, • à PST localization problem is a non-interactive localization o Obviates modification of primary users and problem o Supports localizing multiple transmitters that transmit o When a receiver is localized, one does not need to consider the existence of other receivers. However, the existence of multiple signals simultaneously transmitters may add difficulty to transmitter localization 19 20 SSDF Attacks Byzantine failures in distributed spectrum sensing • Cause of Byzantine failures in distributed spectrum sensing (DSS) o Malfunctioning sensing terminals o Spectrum sensing data falsification (SSDF) attacks • A malicious secondary user intentionally sends falsified local spectrum sensing reports to the data collector in an attempt to cause the data collector to make incorrect spectrum sensing decisions 21 22 Data fusion algorithms for DSS Modeling of DSS as a parallel fusion network • Decision fusion • Bayesian detection • Neyman-Pearson test • Weighted sequential probability ratio test (WSPRT) • We can model the DSS problem as a parallel fusion network 23 24 4