PaperlayerView exact revision on arXiv

Source-linked AI summary

Surveillance and Intervention of Infrastructure-Free Mobile Communications: A New Wireless Security Paradigm

Jie Xu, Lingjie Duan, Rui Zhang

arXiv:1612.07859v1cs.ITcs.CRmath.IT

TL;DR

Infrastructure-free communications can be used by malicious users, challenging wireless security’s assumption of rightful use and raising public-security concerns. The article proposes jointly using legitimate eavesdropping and jamming for surveillance and intervention. It reports significant eavesdropping-rate gains for proactive over passive eavesdropping.

  • Problem

    Infrastructure-free communications can be used by malicious users, challenging the conventional assumption that wireless communications are rightful and raising public-security concerns.

    Source: §I · p. 2

  • Method

    The article proposes jointly exploiting legitimate eavesdropping and jamming to surveil and intervene in suspicious or malicious infrastructure-free communications.

    Source: §I · pp. 2–3

  • Results

    Proactive eavesdropping achieves significant eavesdropping-rate gains over passive eavesdropping by adjusting operations between relaying and jamming.

    Source: 1) Proactive Eavesdropping via Jamming… · p. 9

  • Takeaways & Limitations

    The unified design uses eavesdropping and jamming to help improve surveillance and intervention performance, respectively.

    Source: §I · p. 3

Abstract

from arXiv · show

Conventional wireless security assumes wireless communications are rightful and aims to protect them against malicious eavesdropping and jamming attacks. However, emerging infrastructure-free mobile communication networks are likely to be illegally used (e.g., by criminals or terrorists) but difficult to be monitored, thus imposing new challenges on the public security. To tackle this issue, this article presents a paradigm shift of wireless security to the surveillance and intervention of infrastructure-free suspicious and malicious wireless communications, by exploiting legitimate eavesdropping and jamming jointly. In particular, {\emph{proactive eavesdropping}} (via jamming) is proposed to intercept and decode information from suspicious communication links for the purpose of inferring their intentions and deciding further measures against them. {\emph{Cognitive jamming}} (via eavesdropping) is also proposed so as to disrupt, disable, and even spoof the targeted malicious wireless communications to achieve various intervention tasks.

I. INTRODUCTION

The introduction argues that the assumption of rightful wireless use does not fit emerging infrastructure-free mobile communications, which can be exploited by malicious users and create public-security challenges. It proposes authorized surveillance and intervention using legitimate eavesdropping and jamming jointly.

  • Infrastructure-free mobile communications can be used by malicious users, challenging the presumption of rightful communications and creating public-security concerns.Source: §I · p. 2
  • The article shifts wireless security from protecting rightful communications to surveilling and intervening in suspicious or malicious infrastructure-free communications through legitimate eavesdropping and jamming.Source: §I · p. 2
  • Cooperative SIDs eavesdrop on suspicious links to intercept and decode information, infer users’ intentions, and decide further measures.Source: §I · p. 3
  • SIDs use jamming to disrupt, disable, or spoof targeted malicious communications for intervention tasks.Source: §I · p. 3
  • The unified design makes jamming alter suspicious-link parameters to aid interception and uses eavesdropping to inform jamming signals for intervention.Source: §I · p. 3

A. Using Existing Wireless Infrastructures as SIDs

The section proposes reusing existing wireless infrastructure as surveillance-and-intervention devices (SIDs), since dedicated deployment is costly. It also outlines possible analytics for identifying suspicious or malicious users, while noting that identification is not the article’s main focus.

A. Using Existing Wireless Infrastructures as SIDs

  • Existing cellular base stations and WiFi access points can serve as cost-effective SIDs, addressing the expense of deploying dedicated devices.The article notes that small-cell BSs and WiFi APs are densely deployed, with users expected to be within at least one coverage area.Source: A. Using Existing Wireless… · p. 3
  • Some infrastructure-free communications, including cellular-coordinated D2D links, can be monitored through cooperation between cellular systems and SIDs.The systems can share information to support surveillance and intervention.Source: A. Using Existing Wireless… · p. 4

B. Identification of Suspicious and Malicious Users

  • Identifying suspicious or malicious users is not the article’s main focus; the section briefly discusses possible identification methods.These include analyzing sensitive contents, mobility profiles, social connections, and large-scale communication data.Source: B. Identification of Suspicious and… · pp. 4–5
  • Abnormal mobility patterns and links to identified malicious users can help flag users for further examination.The section describes using sensitive-content and video analysis to further confirm whether selected users are malicious.Source: B. Identification of Suspicious and… · pp. 4–5

C. Related Works

Prior work addressed infrastructure-based eavesdropping and jamming, as well as passive eavesdropping and active jamming of wireless links. The article identifies a lack of systematic study of their cooperative interplay.

C. Related Works

  • Infrastructure-based monitoring methods include wiretapping devices and software installed on network infrastructure or targeted smartphones, but are not readily applicable to infrastructure-free mobile networks.The passage cites dedicated wiretapping devices in network operators’ infrastructures and monitoring software such as FlexiSPY in targeted smartphones.Source: C. Related Works · p. 5
  • Passive eavesdropping applies to infrastructure-free communications but works well only when the eavesdropper is close to the transmitter with a sufficiently strong received signal.The related-work discussion cites.Source: C. Related Works · p. 5
  • Existing jamming schemes use generated Gaussian noise and require strong jamming at the target, typically placing the jammer nearby and using large transmit power.The schemes include constant, intermittent, reactive, and adaptive jamming.Source: C. Related Works · pp. 5–6
  • Applying those jamming schemes to malicious communications can expose the jamming and affect legitimate receivers.The article notes that such activity can be detected by malicious receivers and can cause many legitimate receivers to become victims.Source: C. Related Works · p. 6
  • The article identifies a missing systematic study of cooperative eavesdropping and jamming, which motivates its joint treatment.Prior work generally investigated the two approaches as separate lines of research for different attack purposes.Source: C. Related Works · p. 6

II. PROACTIVE EAVESDROPPING OF SUSPICIOUS COMMUNICATIONS

The section introduces proactive eavesdropping to address physical-layer surveillance challenges, including user movement, channel fluctuations, and co-channel interference. It models an SID that manipulates the suspicious link through jamming or relaying while eavesdropping.

II. PROACTIVE EAVESDROPPING OF SUSPICIOUS COMMUNICATIONS

  • The analysis assumes successful higher-layer extraction after error-free physical-layer decoding and a priori SID knowledge of any encryption key.The text gives key exchange overhearing and pre-installed device keys as examples.Source: §II · p. 6
  • Proactive eavesdropping is proposed to address physical-layer surveillance challenges from user movements, channel fluctuations, and co-channel interference.The stated surveillance pipeline decodes suspicious signals at the physical layer before extracting their contents at higher layers.Source: §II · p. 6

A. Proactive Eavesdropping

  • The SID’s eavesdropping rate is the suspicious data rate it can decode, which is R0 when its link rate R1 is at least R0 and zero otherwise.R1 denotes the Alice-to-SID eavesdropping-link rate; R0 denotes the Alice-to-Bob suspicious-link rate.Source: A. Proactive Eavesdropping · pp. 6–7
  • Unlike passive eavesdropping with fixed link rates, the full-duplex SID can deliberately change R0 and/or R1 by jamming while eavesdropping.Simultaneous jamming creates self-interference, which the SID must minimize through antenna separation and/or cancellation methods.Source: A. Proactive Eavesdropping · p. 7

1) Proactive Eavesdropping via Jamming the Suspicious Receiver:

The SID can improve eavesdropping by choosing between jamming and relaying according to the relationship between its eavesdropping-link rate and the suspicious link’s rate. In the numerical example, proactive eavesdropping outperforms passive eavesdropping across the reported operating cases.

1) Proactive Eavesdropping via Jamming the Suspicious Receiver:

  • Combined jamming uses a processed eavesdropped signal with designed phase to destructively combine with Alice’s direct-link signal at Bob.It generally achieves more effective jamming than noise jamming by increasing noise power and decreasing useful signal power, but requires instantaneous channel knowledge.Source: 1) Proactive Eavesdropping via Jamming… · p. 8
  • When R1 > R0, full-duplex relaying can constructively combine the forwarded signal at Bob, increasing Bob’s rate and the eavesdropping rate while R0 remains no greater than R1.The SID needs to adapt between relaying and jamming as fading changes the relation between R1 and R0.Source: 1) Proactive Eavesdropping via Jamming… · p. 8
  • 50% eavesdropping rate gain (from 4 to 6 bps/Hz) is reported at x = 0 meters versus passive eavesdropping.In this case the SID relays Alice’s signal to Bob, increasing Bob’s received signal strength.Source: 1) Proactive Eavesdropping via Jamming… · p. 9
  • 75% eavesdropping rate gain is reported at x = 230 meters, where the text says the relaying tradeoff is optimally balanced.The reported gain increases from 50% to 75% as x increases from 0 to 230 meters.Source: 1) Proactive Eavesdropping via Jamming… · p. 9
  • For x > 500 meters, passive eavesdropping has zero rate, while proactive eavesdropping has positive rates for SID distances from 500 to 1180 meters.The proactive approach uses jamming to reduce Bob’s communication rate until it is no greater than the SID’s achievable eavesdropping-link rate.Source: 1) Proactive Eavesdropping via Jamming… · p. 9
  • Proactive eavesdropping achieves significant rate gains over passive eavesdropping by adjusting between relaying and jamming.Relaying is used when R1 > R0, while jamming can reduce R0 when R1 < R0.Source: 1) Proactive Eavesdropping via Jamming… · pp. 8–9

2) Proactive Eavesdropping via Jamming the Suspicious Transmitter:

Proactive eavesdropping can use jamming or protocol-aware spoofing to improve the SID’s interception of suspicious communications. The section describes pilot and HARQ interventions that alter the link to improve eavesdropping rates.

2) Proactive Eavesdropping via Jamming the Suspicious Transmitter:

3) Stealth Eavesdropping:

Proactive eavesdropping can be detected, so the SID must choose tactics that reduce its exposure. The passage describes signal forwarding and selective control-signal spoofing as alternatives to more detectable tactics.

3) Stealth Eavesdropping:

  • Proactive eavesdropping may be detected by Alice and Bob, who can use physical-layer security or anti-jamming methods such as random frequency hopping.Source: 3) Stealth Eavesdropping · p. 10
  • Forwarding eavesdropped signals to combine destructively with the direct-link signal reduces signal power without increasing noise power.This is offered as an alternative to Gaussian-noise jamming, which is easier to detect by estimating noise power.Source: 3) Stealth Eavesdropping · p. 10
  • For an HARQ link, the SID may spoof ACKs selectively when direct-link channel quality is relatively poor to reduce its exposure.Source: 3) Stealth Eavesdropping · p. 11

B. Cooperative Eavesdropping

Cooperative surveillance requires network-wide coordination of SID roles, frequency bands, and targets. Joint eavesdropping and jamming must handle mixed uplink and downlink operations sharing time and frequency resources.

B. Cooperative Eavesdropping

  • Under optimized SID-user associations, SIDs can use joint detection to eavesdrop cooperatively or joint precoding to maximize jamming power at a common receiver.The example describes SID 1 and SID 2 jointly eavesdropping on user 3, and SID 2 and SID 3 jointly jamming user 3.Source: B. Cooperative Eavesdropping · p. 11
  • Unlike cellular CoMP, cooperative surveillance mixes uplink and downlink operations in the same time and frequency slots, creating more complicated co-channel interference and coordination challenges.Source: B. Cooperative Eavesdropping · p. 11
  • Network-wide optimization must assign SID working modes, frequency bands, and associations with suspicious users across differing roles and operating bands.Depending on network topology, SIDs may eavesdrop, jam nearby receivers for other SIDs, or relay.Source: B. Cooperative Eavesdropping · p. 11
  • SIDs can first coarsely eavesdrop and analyze suspicious users, then prioritize critical nodes to focus limited resources.User 3 is an example of a critical relay whose interception can place the whole network under successful surveillance.Source: B. Cooperative Eavesdropping · p. 11

III. COGNITIVE JAMMING TO INTERVENE IN MALICIOUS COMMUNICATIONS

Cognitive jamming uses eavesdropped information to disrupt, disable, or spoof malicious communications. Symbol-level spoofing outperforms direct spoofing over the described SID-to-Alice distances, while the physical-layer intervention methods also include protocol spoofing and signal cancellation.

A. Cognitive Jamming and Intervention

  • Cognitive jamming or intervention is classified by purpose as disruption, disabling, or spoofing.The section focuses on physical-layer intervention as a basis for possible higher-layer approaches.Source: A. Cognitive Jamming and Intervention · p. 12, §III · p. 12
  • Instead of noise alone, the SID can combine Gaussian noise with a processed version of Alice’s eavesdropped signal; noise-level measurement can reveal noise jamming.The SID can also forward the signal so it destructively combines with Alice’s direct-link signal, canceling it without increasing noise power.Source: A. Cognitive Jamming and Intervention · p. 12

1) Disrupting and Disabling Malicious Communications:

2) Spoofing Malicious Communications:

  • More than 6 dB spoofing SINR increase is observed for symbol-level spoofing over direct spoofing when 0 ≤ x ≤ 1000 meters; symbol-level spoofing remains above 0 dB through x ≤ 1110 meters.Direct spoofing is below 0 dB when x > 1000 meters; Fig. 6 compares direct and symbol-level spoofing.Source: Figure 6 · p. 13, 2) Spoofing Malicious Communications · p. 14
  • Direct spoofing requires the SID to learn the signal format and protocol, and its fake signal must overpower Alice’s direct signal, making it detectable by Bob.Symbol-level spoofing instead combines a fake signal with a processed eavesdropped signal to offset Alice’s direct-link signal, leaving Bob with the fake message.Source: 2) Spoofing Malicious Communications · p. 13
  • Eavesdropping Alice’s transmitted signals is key to symbol-level spoofing, which can offset the direct-link signal so Bob receives the fake message.Fig. 6’s comparison uses spoofing SINR at Bob versus distance from the SID to Alice.Source: 2) Spoofing Malicious Communications · pp. 13–14

B. Cooperative Jamming and Intervention

Cooperative SIDs must choose intervention tasks across malicious links while managing interference to rightful users. Their choices can account for users’ different intentions and roles.

IV. CONCLUDING REMARKS

The article proposes a reverse wireless-security paradigm that optimizes legitimate eavesdropping and jamming, then outlines deployment, technical, strategic, and privacy issues. It identifies unresolved constraints including incentives for crowdsourced SIDs and decryption when keys are unknown.

IV. CONCLUDING REMARKS

  • The article proposes surveillance and intervention by authorized parties as a reverse perspective to conventional wireless security, with legitimate eavesdropping and jamming as performance objectives.Source: §IV · pp. 14–15

1) Crowdsourcing of Users’ Smartphones as SIDs:

2) Higher-Layer Encryption and Decryption:

  • When suspicious users use higher-layer encryption and keys are a priori unknown, SIDs may face serious content-extraction problems even with strong computation, an issue left for future work.Source: 2) Higher-Layer Encryption and… · p. 15

3) Countermeasures of the Proposed Surveillance and Intervention:

  • The article frames conventional wireless security and surveillance/intervention as countermeasures to one another and identifies game theory as a potentially useful tool for analyzing their strategic interplay.Source: 3) Countermeasures of the Proposed… · p. 15

4) Surveillance versus Privacy:

  • The article notes privacy concerns around surveillance, while stating that appropriately used surveillance can help protect rightful users from malicious eavesdropping.Source: 4) Surveillance versus Privacy · p. 15

Related papers

Loading 1612.07859v1…