Based on paper for ACM SIGCOMM Conference, August 30-September 3, 2010, New Delhi, India</p

JAMIESON, Kyle

XIONG, Jie


            Wireless local area networks play an important role in our everyday lives, at the workplace and at home. However, wireless networks are also relatively vulnerable: physically located off-premises, attackers can circumvent wireless security protocols such as WEP, WPA, and even to some extent WPA2, presenting a security risk to the entire network. To address this problem, we propose
            SecureAngle
            , a system designed to operate alongside existing wireless security protocols, adding defense in depth. SecureAngle employs multiantenna APs to profile the directions at which a client's signal arrives, using this
            angle-of-arrival
            information to construct unique
            signatures
            that identify each client. With these signatures, we are currently investigating how a SecureAngle enabled AP can enable a "virtual fence" that drops frames injected into the network from a client physically located outside a building, and how a SecureAngle-enabled AP can prevent malicious parties from spoofing the link-layer address of legitimate clients.
          </jats:p

Jie Xiong

Kyle Jamieson

Crossref

ACM SIGCOMM Computer Communication Review

SecureAngle

Institutional Knowledge at Singapore Management University

Singapore Management UniversityInstitutional Knowledge at Singapore Management UniversityResearch Collection School Of Information Systems School of Information Systems10-2010SecureAngle: Improving wireless security usingangle-of-arrival informationJie XIONGSingapore Management University, jxiong@smu.edu.sgKyle JAMIESONUniversity College LondonDOI: https://doi.org/10.1145/1851275.1851238Follow this and additional works at: https://ink.library.smu.edu.sg/sis_researchPart of the Software Engineering CommonsThis Magazine Article is brought to you for free and open access by the School of Information Systems at Institutional Knowledge at SingaporeManagement University. It has been accepted for inclusion in Research Collection School Of Information Systems by an authorized administrator ofInstitutional Knowledge at Singapore Management University. For more information, please email libIR@smu.edu.sg.CitationXIONG, Jie and JAMIESON, Kyle. SecureAngle: Improving wireless security using angle-of-arrival information. (2010). ComputerCommunication Review. 40, (4), 415-416. Research Collection School Of Information Systems.Available at: https://ink.library.smu.edu.sg/sis_research/2707SecureAngle: Improving Wireless Security UsingAngle-of-Arrival Information (Poster Abstract)Jie XiongUniversity College LondonJ.Xiong@cs.ucl.ac.ukKyle JamiesonUniversity College LondonK.Jamieson@cs.ucl.ac.ukABSTRACTWireless local area networks play an important role in oureveryday lives, at the workplace and at home. However,wireless networks are also relatively vulnerable: physicallylocated oﬀ-premises, attackers can circumvent wireless secu-rity protocols such as wep, wpa, and even to some extentwpa2, presenting a security risk to the entire network. Toaddress this problem, we propose SecureAngle, a system de-signed to operate alongside existing wireless security proto-cols, adding defense in depth. SecureAngle employs multi-antenna aps to proﬁle the directions at which a client’s signalarrives, using this angle-of-arrival information to constructunique signatures that identify each client. With these sig-natures, we are currently investigating how a SecureAngle-enabled ap can enable a “virtual fence” that drops framesinjected into the network from a client physically locatedoutside a building, and how a SecureAngle-enabled ap canprevent malicious parties from spooﬁng the link-layer ad-dress of legitimate clients.Categories and Subject DescriptorsC.2.1 [Computer-Communication Networks]: NetworkArchitecture and Design—Wireless communicationGeneral TermsExperimentation, measurement, securityKeywordsWireless, 802.11, SecureAngle, Angle of arrival1. INTRODUCTIONIn the past few years, wireless local area network connec-tivity has undergone a transition from a niche service intoan essential utility widely used by the general public. Enter-prises have rolled out large scale wireless lan across entirecampuses. Many homes with a broadband Internet link areequipped with a WiFi-enabled router, and most mobile de-vices now integrate wireless WiFi chipsets, allowing userseasy network connectivity.However, from a security perspective, wireless aps presenta number of problems. Once a client is connected to a com-promised ap, an attacker may both eavesdrop on users’ traf-Copyright is held by the author/owner(s).SIGCOMM’10, August 30–September 3, 2010, New Delhi, India.ACM 978-1-4503-0201-2/10/08.ﬁc and inject traﬃc into the wired network. wlan securityprotocols such as wep, wpa, leap, and wpa2 have beenproposed in the past few years, however they have a trackrecord of being compromised [2, 7, 8]. Furthermore, oncedeployed, they are slow to be ﬁxed: six years after wep wasknown to be insecure, Bittau et al. reported that a full 76%of secured aps in London still used it [3].We propose SecureAngle, a new approach to the abovesecurity problems. Recently, 802.11n aps have begun to ap-pear on the market equipped with multiple antennas, to im-plement mimo schemes. On top of the resulting throughputbeneﬁts of mimo, we observe that with the right signal pro-cessing at the physical layer, a multi-antenna ap can alsomeasure the diﬀerences in time between an incoming sig-nal’s arrival at each antenna, and use these measurements toidentify the incoming signal’s angles of arrival (AoA). ThisAoA information can then be applied to construct a signa-ture that is unique to each client and extremely diﬃcult toforge.We will investigate two applications of SecureAngle:Virtual fences. We will investigate restriction of wlanuse to the building containing the ap. This would be ap-propriate, for example, in an enterprise setting where thecompany is contained in a secured building, and it is desiredthat only clients within the building be allowed access to thewlan. For this application, we don’t require the ap to dis-criminate between two inside or two outside clients, but wedo require that signatures for all clients inside the buildingcan be discriminated from signatures for clients outside thebuilding. One reason this may hold is that indoors, there ismore extensive multipath propagation than outdoors.Address spoofing prevention. Another application ofAoA-based signatures is to detect when a client is spooﬁngthe link-layer address of legitimate stationary clients. Link-layer address spooﬁng can grant unauthorized access, if theonly method of security is address-based access control lists,and spooﬁng often forms the basis of more sophisticated at-tacks against the security protocols we mention above. Ourapproach is to require the administrator to manually “cer-tify” a legitimate client’s signature at some point in time,and compare all incoming packets’ signatures to the certi-ﬁed signature. A central challenge here is that signaturesmay change to some degree when obstacles in the environ-ment move, and therefore must be tracked and updated.There also must be a signiﬁcant diﬀerence between the cer-tiﬁed signature and an attacker’s signature so that they canbe discriminated from each other. We hypothesis that AoAsignatures are stable and tractable enough to be of use in415Figure 1: Floor plan with nodes position marked.this and subsequent proposed applications, but leave the ex-act signature speciﬁcation as an open research question.2. RELATED WORKMany schemes have been proposed to capture signaturesthat characterize wireless clients’ identity and location. Themost widely used physical layer information is received sig-nal strength (rss) [1, 4]. While readily available from com-modity hardware, compared to the wealth of informationavailable at the phy of a multi-antenna sdr, rss is a verycoarse measure of the incoming signal, and is therefore proneto error if relatively few readings are available. Further-more, attackers with directional antennas can subvert sys-tems based on rss measurements [5].SecureAngle has unique advantages over the above workbecause it is very diﬃcult for an attacker to generate a signalthat arrives at the ap from the same directions as anotherclient without being co-located with the latter. SecureAngleis the ﬁrst work we are aware of that uses AoA-based signa-tures indoors, where reﬂections from walls and objects arerelatively strong. Although Wong et al. [9] investigate theuse of AoA information for localization, they stop short of afull system design and do not address the problem of indoormultipath reﬂections as we will.3. EXPERIMENTAL RESULTSOur experimental testbed is setup with a 4-antenna warp[6] as the ap and Soekris boxes as transmitting clients. Thewarp fpga is programmed to support 4x4 mimo receptionat 2.4GHz. ap and four Soekris boxes named N121, N122,N123 and N124 are marked on the ﬂoor plan as shown inFigure 1. The 4 antennas of the warp are arranged in a linewith 6.1 cm (half the RF wavelength) separation.Four Soekris boxes are put in diﬀerent oﬃces and transmitone by one separately. The warp ap records the transmit-ted signals and outputs the sampled time domain informa-tion (both amplitude and phase) for further processing. Weimplement the Schmidl-Cox algorithm in Matlab to detectthe preamble of packets and apply the music method to cal-culate AoA information. Figure 2 summarizes the resultsfor all clients: the X axis is the ground-truth angle for eachclient with respect to the ap’s antennas and Y axis is theAoA of the strongest incoming signal.We then force two Soekris boxes to transmit simultane-ously by turning oﬀ csma/ca. We modify Schmidl-Coxalgorithm to detect overlapped packets even if the secondpacket (P2) is weaker than the ﬁrst one. Both packets aredetected and the AoA pseudo-spectrums (likelihood versusangle) for both transmitters are shown in Figure 3 (upper).−60 −40 −20 0 20−60−40−20020Ground−truth angle (degrees)Estimated angle (degrees)Figure 2: Estimated client bearing to the ap versusground-truth, for each of the four clients.−100 −50 0 50 100−2−10Angle (degrees)P(θ) (dB)P1P2P1P2 TimeFigure 3: Upper: AoA pseudo spectrum (likelihoodversus angle) for two colliding packets (lower)The two curves in Figure 3 (upper) correspond to the twopackets (lower) from two diﬀerent Soekris boxes. Multiplepeaks on the curve indicate multipath reﬂections in the in-door environment for each transmission. With 4 antennas,maximum of 3 peaks can be captured which correspondingto one direct path and two multipaths.4. REFERENCES[1] P. Bahl and V. Padmanabhan. radar: An in-buildingrf-based user location and tracking system. In Proc. ofthe ieee infocom Conf., volume 2, pages 775–784,Mar. 2000.[2] M. Beck and E. Tews. Practical attacks against wepand wpa. In Proc. of acm WiSec Conf., pages 79–86,Mar. 2009.[3] A. Bittau, M. Handley, and J. Lackey. The ﬁnal nail inwep’s coﬃn. In ieee Symp. Security and Privacy, 2006.[4] D. Faria and D. Cheriton. Radio-layer security:Detecting identity-based attacks in wireless networksusing signalprints. In acm WiSe Workshop, 2006.[5] N. Patwari and S. Kasera. Robust location distinctionusing temporal link signatures. In Proc. of the acmMobiCom Conf., pages 111–122, Sept. 2007.[6] Rice Univ. Wireless Open Access Research Platform(warp). http://warp.rice.edu/trac.[7] B. Schneier, Mudge, and D. Wagner. Cryptanalysis ofMicrosoft’s pptp authentication mechanisms, Oct. 1999.[8] E. Tews, R. Weinmann, and A. Pyshkin. Breaking104-bit wep in less than 60 sec. Springer lncs,4867:188–202, 2008.[9] C. Wong, R. Klukas, and G. Messier. Using wlaninfrastructure for angle-of-arrival indoor user location.In Proc. of the ieee vtc Conf., pages 1–5, Sept. 2008.416

SecureAngle: Improving wireless security using angle-of-arrival information

Singapore Management University 
Institutional Knowledge at Singapore Management University 
Research Collection School Of Information 
Systems School of Information Systems 
10-2010 
SecureAngle: Improving wireless security using angle-of-arrival 
information 
Jie XIONG 
Singapore Management University, jxiong@smu.edu.sg 
Kyle JAMIESON 
University College London 
Follow this and additional works at: https://ink.library.smu.edu.sg/sis_research 
 Part of the Software Engineering Commons 
Citation 
XIONG, Jie and JAMIESON, Kyle. SecureAngle: Improving wireless security using angle-of-arrival 
information. (2010). Computer Communication Review. 40, (4), 415-416. Research Collection School Of 
Information Systems. 
Available at: https://ink.library.smu.edu.sg/sis_research/2707 
This Magazine Article is brought to you for free and open access by the School of Information Systems at 
Institutional Knowledge at Singapore Management University. It has been accepted for inclusion in Research 
Collection School Of Information Systems by an authorized administrator of Institutional Knowledge at Singapore 
Management University. For more information, please email library@smu.edu.sg. 
SecureAngle: Improving Wireless Security Using
Angle-of-Arrival Information (Poster Abstract)
Jie Xiong
University College London
J.Xiong@cs.ucl.ac.uk
Kyle Jamieson
University College London
K.Jamieson@cs.ucl.ac.uk
ABSTRACT
Wireless local area networks play an important role in our
everyday lives, at the workplace and at home. However,
wireless networks are also relatively vulnerable: physically
located off-premises, attackers can circumvent wireless secu-
rity protocols such as wep, wpa, and even to some extent
wpa2, presenting a security risk to the entire network. To
address this problem, we propose SecureAngle, a system de-
signed to operate alongside existing wireless security proto-
cols, adding defense in depth. SecureAngle employs multi-
antenna aps to profile the directions at which a client’s signal
arrives, using this angle-of-arrival information to construct
unique signatures that identify each client. With these sig-
natures, we are currently investigating how a SecureAngle-
enabled ap can enable a “virtual fence” that drops frames
injected into the network from a client physically located
outside a building, and how a SecureAngle-enabled ap can
prevent malicious parties from spoofing the link-layer ad-
dress of legitimate clients.
Categories and Subject Descriptors
C.2.1 [Computer-Communication Networks]: Network
Architecture and Design—Wireless communication
General Terms
Experimentation, measurement, security
Keywords
Wireless, 802.11, SecureAngle, Angle of arrival
1. INTRODUCTION
In the past few years, wireless local area network connec-
tivity has undergone a transition from a niche service into
an essential utility widely used by the general public. Enter-
prises have rolled out large scale wireless lan across entire
campuses. Many homes with a broadband Internet link are
equipped with a WiFi-enabled router, and most mobile de-
vices now integrate wireless WiFi chipsets, allowing users
easy network connectivity.
However, from a security perspective, wireless aps present
a number of problems. Once a client is connected to a com-
promised ap, an attacker may both eavesdrop on users’ traf-
Copyright is held by the author/owner(s).
SIGCOMM’10, August 30–September 3, 2010, New Delhi, India.
ACM 978-1-4503-0201-2/10/08.
fic and inject traffic into the wired network. wlan security
protocols such as wep, wpa, leap, and wpa2 have been
proposed in the past few years, however they have a track
record of being compromised [2, 7, 8]. Furthermore, once
deployed, they are slow to be fixed: six years after wep was
known to be insecure, Bittau et al. reported that a full 76%
of secured aps in London still used it [3].
We propose SecureAngle, a new approach to the above
security problems. Recently, 802.11n aps have begun to ap-
pear on the market equipped with multiple antennas, to im-
plement mimo schemes. On top of the resulting throughput
benefits of mimo, we observe that with the right signal pro-
cessing at the physical layer, a multi-antenna ap can also
measure the differences in time between an incoming sig-
nal’s arrival at each antenna, and use these measurements to
identify the incoming signal’s angles of arrival (AoA). This
AoA information can then be applied to construct a signa-
ture that is unique to each client and extremely difficult to
forge.
We will investigate two applications of SecureAngle:
Virtual fences. We will investigate restriction of wlan
use to the building containing the ap. This would be ap-
propriate, for example, in an enterprise setting where the
company is contained in a secured building, and it is desired
that only clients within the building be allowed access to the
wlan. For this application, we don’t require the ap to dis-
criminate between two inside or two outside clients, but we
do require that signatures for all clients inside the building
can be discriminated from signatures for clients outside the
building. One reason this may hold is that indoors, there is
more extensive multipath propagation than outdoors.
Address spoofing prevention. Another application of
AoA-based signatures is to detect when a client is spoofing
the link-layer address of legitimate stationary clients. Link-
layer address spoofing can grant unauthorized access, if the
only method of security is address-based access control lists,
and spoofing often forms the basis of more sophisticated at-
tacks against the security protocols we mention above. Our
approach is to require the administrator to manually “cer-
tify” a legitimate client’s signature at some point in time,
and compare all incoming packets’ signatures to the certi-
fied signature. A central challenge here is that signatures
may change to some degree when obstacles in the environ-
ment move, and therefore must be tracked and updated.
There also must be a significant difference between the cer-
tified signature and an attacker’s signature so that they can
be discriminated from each other. We hypothesis that AoA
signatures are stable and tractable enough to be of use in
415
Figure 1: Floor plan with nodes position marked.
this and subsequent proposed applications, but leave the ex-
act signature specification as an open research question.
2. RELATED WORK
Many schemes have been proposed to capture signatures
that characterize wireless clients’ identity and location. The
most widely used physical layer information is received sig-
nal strength (rss) [1, 4]. While readily available from com-
modity hardware, compared to the wealth of information
available at the phy of a multi-antenna sdr, rss is a very
coarse measure of the incoming signal, and is therefore prone
to error if relatively few readings are available. Further-
more, attackers with directional antennas can subvert sys-
tems based on rss measurements [5].
SecureAngle has unique advantages over the above work
because it is very difficult for an attacker to generate a signal
that arrives at the ap from the same directions as another
client without being co-located with the latter. SecureAngle
is the first work we are aware of that uses AoA-based signa-
tures indoors, where reflections from walls and objects are
relatively strong. Although Wong et al. [9] investigate the
use of AoA information for localization, they stop short of a
full system design and do not address the problem of indoor
multipath reflections as we will.
3. EXPERIMENTAL RESULTS
Our experimental testbed is setup with a 4-antenna warp
[6] as the ap and Soekris boxes as transmitting clients. The
warp fpga is programmed to support 4x4 mimo reception
at 2.4GHz. ap and four Soekris boxes named N121, N122,
N123 and N124 are marked on the floor plan as shown in
Figure 1. The 4 antennas of the warp are arranged in a line
with 6.1 cm (half the RF wavelength) separation.
Four Soekris boxes are put in different offices and transmit
one by one separately. The warp ap records the transmit-
ted signals and outputs the sampled time domain informa-
tion (both amplitude and phase) for further processing. We
implement the Schmidl-Cox algorithm in Matlab to detect
the preamble of packets and apply the music method to cal-
culate AoA information. Figure 2 summarizes the results
for all clients: the X axis is the ground-truth angle for each
client with respect to the ap’s antennas and Y axis is the
AoA of the strongest incoming signal.
We then force two Soekris boxes to transmit simultane-
ously by turning off csma/ca. We modify Schmidl-Cox
algorithm to detect overlapped packets even if the second
packet (P2) is weaker than the first one. Both packets are
detected and the AoA pseudo-spectrums (likelihood versus
angle) for both transmitters are shown in Figure 3 (upper).
−60 −40 −20 0 20
−60
−40
−20
0
20
Ground−truth angle (degrees)
Es
tim
at
ed
 a
ng
le
 (d
eg
re
es
)
Figure 2: Estimated client bearing to the ap versus
ground-truth, for each of the four clients.
−100 −50 0 50 100
−2
−1
0
Angle (degrees)
P
(θ
) 
(d
B
)
P1
P2
P1
P2 Time
Figure 3: Upper: AoA pseudo spectrum (likelihood
versus angle) for two colliding packets (lower)
The two curves in Figure 3 (upper) correspond to the two
packets (lower) from two different Soekris boxes. Multiple
peaks on the curve indicate multipath reflections in the in-
door environment for each transmission. With 4 antennas,
maximum of 3 peaks can be captured which corresponding
to one direct path and two multipaths.
4. REFERENCES
[1] P. Bahl and V. Padmanabhan. radar: An in-building
rf-based user location and tracking system. In Proc. of
the ieee infocom Conf., volume 2, pages 775–784,
Mar. 2000.
[2] M. Beck and E. Tews. Practical attacks against wep
and wpa. In Proc. of acm WiSec Conf., pages 79–86,
Mar. 2009.
[3] A. Bittau, M. Handley, and J. Lackey. The final nail in
wep’s coffin. In ieee Symp. Security and Privacy, 2006.
[4] D. Faria and D. Cheriton. Radio-layer security:
Detecting identity-based attacks in wireless networks
using signalprints. In acm WiSe Workshop, 2006.
[5] N. Patwari and S. Kasera. Robust location distinction
using temporal link signatures. In Proc. of the acm
MobiCom Conf., pages 111–122, Sept. 2007.
[6] Rice Univ. Wireless Open Access Research Platform
(warp). http://warp.rice.edu/trac.
[7] B. Schneier, Mudge, and D. Wagner. Cryptanalysis of
Microsoft’s pptp authentication mechanisms, Oct. 1999.
[8] E. Tews, R. Weinmann, and A. Pyshkin. Breaking
104-bit wep in less than 60 sec. Springer lncs,
4867:188–202, 2008.
[9] C. Wong, R. Klukas, and G. Messier. Using wlan
infrastructure for angle-of-arrival indoor user location.
In Proc. of the ieee vtc Conf., pages 1–5, Sept. 2008.
416


English

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=3707&amp;context=sis_research

SecureAngle: Improving wireless security using angle-of-arrival information

Abstract

Similar works

Full text

Available Versions

Crossref

Institutional Knowledge at Singapore Management University

Institutional Knowledge at Singapore Management University

Institutional Knowledge at Singapore Management University