Hold The Door! Fingerprinting Your Car Key to Prevent Keyless Entry - - PowerPoint PPT Presentation

β–Ά
hold the door fingerprinting your car key
SMART_READER_LITE
LIVE PREVIEW

Hold The Door! Fingerprinting Your Car Key to Prevent Keyless Entry - - PowerPoint PPT Presentation

Aug 25, 2023 106 likes β€’490 views

Hold The Door! Fingerprinting Your Car Key to Prevent Keyless Entry Car Theft Kyungho Joo* Wonsuk Choi* Dong Hoon Lee Korea University * Co-first Authors Outline Introduction Attack Model Our Method Evaluation Discussion

slide-1
SLIDE 1

Hold The Door! Fingerprinting Your Car Key to Prevent Keyless Entry Car Theft

Kyungho Joo* Wonsuk Choi* Dong Hoon Lee

Korea University

* Co-first Authors

slide-2
SLIDE 2

Outline

  • Introduction
  • Attack Model
  • Our Method
  • Evaluation
  • Discussion
  • Conclusion

2

slide-3
SLIDE 3

Introduction

  • Traditional system
  • Physically insert a key into the keyhole
  • Inconvenient
  • Vulnerable to key copying

3

slide-4
SLIDE 4

Introduction

  • Keyless Entry System
  • Remote Keyless Entry (RKE) System
  • Passive Keyless Entry and Start (PKES) System
  • Attacks on Keyless Entry System
  • Cryptanalysis
  • Relay Attack
  • etc. (e.g., Roll-jam)

4

slide-5
SLIDE 5

Introduction

  • Countermeasures
  • Distance bounding protocol
  • Sensitive to timing error (Propagates at the speed of light)
  • UWB-IR Ranging System
  • Efforts are underway (IEEE 802.15.4z Task Group) [1-3]
  • Requires an entirely new system
  • Motivation
  • Device Fingerprint: Exploits hardware imperfection
  • PHY-layer signal analysis

[1] UWB with Pulse Reordering: Securing Ranging against Relay and Physical Layer Attacks (M. Singh et al.) [2] UWB-ED: Distance Enlargement Attack Detection in Ultra-Wideband (M. Singh et al.) [3] Message Time of Arrival Codes: A Fundamental Primitive for Secure Distance Measurement (P. Leu et al.)

Verifier Prover

Challenge Response

Time of Flight (T

  • F)

𝑒 = 𝑑 βˆ— ToF 2

5

slide-6
SLIDE 6

Introduction

  • Contributions
  • New attack model
  • Combines all known attack methods; our attack model covers both PKES and RKE systems
  • Single/Dual-band relay attack, Cryptographic attack
  • No alterations to the current system
  • Easily employed by adding a new device that captures and analyzes the ultra-high frequency (UHF) band

RF signals emitted from a key fob

  • Evaluations under varying environmental factors
  • Temperature variations, NLoS conditions (e.g., a key fob placed in a pocket) and battery aging

6

slide-7
SLIDE 7

Introduction

  • Passive Keyless Entry System
  • LF band (125~135 kHz, Vehicle)
  • 1 ~ 2 meter communication range
  • UHF band (433, 858 MHz, Key fob)
  • ~100 meter communication range)
  • Shared cryptographic key between the key and the vehicle

Key fob Vehicle

Press button

  • n the door

If Key in communication range If ID is Correct If correct, unlock the door

  • 1. Wake up(LF)
  • 2. Ack(UHF)
  • 3. ID with challenge(LF)
  • 4. Key response

Periodic Beacon signal

7

slide-8
SLIDE 8

Introduction

  • System Model

Vehicle

BCM

(Body Control Module) HODOR Door Controller

In-Vehicle Network

Power Controller

Key Fob

LF Receiver UHF Transmitter LF Transmitter UHF Receiver Air Conditioner

8

slide-9
SLIDE 9

Outline

  • Introduction / Background
  • Attack Model
  • Our Method
  • Evaluation
  • Discussion
  • Conclusion

9

slide-10
SLIDE 10

Attack Model

  • Coverage
  • Attacks on PKES and RKE systems implemented with the LF/UHF band RFID communication
  • Main Objectives of adversary
  • Unlocking a vehicle
  • Out of Scope
  • Excluded other functions, such as an engine start message
  • Physical damage to a vehicle

10

slide-11
SLIDE 11

Attack Model

  • Single-band Relay Attack [*]
  • Manipulate LF band signal only
  • Wired / Wireless Attack

UHF band LF band

[*] Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (Aurelien Francillon et al.)

11

slide-12
SLIDE 12

Attack Model

  • Dual-band Relay Attack (β… . Amplification Attack)
  • Receives LF band signal and forward to the adversary at the key fob side
  • Injects LF band signal to the key fob
  • Amplifies UHF band signal and injects to the vehicle

LF band UHF band

12

slide-13
SLIDE 13

Attack Model

  • Dual-band Relay Attack (β…‘. Digital Relay Attack) [*]
  • Demodulate LF/UHF band signal
  • Relay binary information

UHF band signal information LF band signal information

[*] Car keyless entry system attack (Yingtao Zeng et al.)

13

slide-14
SLIDE 14

Attack Model

  • Cryptographic Attack [*]
  • Single adversary
  • Injects LF band signals to the key fob
  • Records valid responses and extract secret key
  • Exploits weaknesses of cryptographic algorithm

[*] Fast, Furious and Insecure: Passive Keyless Entry and Start Systems in Modern Supercars (Wouters et al.)

Record LF band signals Injects LF band signals (Challenges) Record UHF band signals (Responses) {π·β„Žπ‘π‘šπ‘š1, π‘†π‘“π‘‘π‘ž1} {π·β„Žπ‘π‘šπ‘š2, π‘†π‘“π‘‘π‘ž2} … 14

slide-15
SLIDE 15

Outline

  • Introduction / Background
  • Attack Model
  • Our Method
  • Evaluation
  • Discussion
  • Conclusion

15

slide-16
SLIDE 16

Our Method

  • Overview (HODOR)

Normalization Parameter Calculation (NPC) Pre-processing Feature Extraction Generating Classifier Pre-processing Feature Extraction Classifier Normalized Output Legitimate Signal Set < Ξ“

Newly Received Signal

Phase β… . Training Phase β…‘. Attack Detection

Verify Alarm

Yes No 16

slide-17
SLIDE 17

Our Method

  • Preprocessing
  • Feature Extraction

𝑒𝑆𝑁𝑇[𝑒]

RMS Normalization Band-Pass filter

𝑑(𝑒) 𝑑[𝑒]

Demodulator

𝑒[𝑒]

𝑒𝑆𝑁𝑇[𝑒]

FFT 𝑔

π‘žπ‘“π‘π‘™

𝑔 𝐡 𝐢𝑗𝑒 π‘ˆπ‘—π‘›π‘“

17

slide-18
SLIDE 18

Our Method

  • Feature Extraction (Continue)

𝑒𝑆𝑁𝑇[𝑒]

𝑇𝑂𝑆𝑒𝐢 Kurtosis Spectral Brightness

𝑑[𝑒]

Carrier Frequency offset 𝑔 𝐡

Ideal Carrier Frequency (i.e. 433MHz) Actual Carrier Frequency

𝑔 𝐡

Signal Noise

𝑒 𝐡

Increase

𝑔 𝐡

Signal Noise Energy in high frequency band

18

slide-19
SLIDE 19

Our Method

  • Training
  • Semi-supervised learning
  • Only requires legitimate data
  • Covers unknown attacks
  • OC-SVM, k-NN

Legitimate data 90% Training 10% Testing Classifier Output 𝜈 𝜏

X10 Normalization Parameter

19

slide-20
SLIDE 20

Our Method

  • Attack Detection

Newly Received Signal

Preprocessing Feature Extraction Classifier Normalization Training Phase < Ξ“? {𝑔

π‘žπ‘“π‘π‘™, 𝑇𝑂𝑆𝑒𝐢, Kurtosis,

Spectral Brightness, Carrier Frequency Offset} Yes No 𝜈, 𝜏

20

slide-21
SLIDE 21

Outline

  • Introduction / Background
  • Attack Model
  • Our Method
  • Evaluation
  • Discussion
  • Conclusion

21

slide-22
SLIDE 22

Evaluation

  • Experimental Setup
  • Cars: KIA Soul,

Volkswagen Tiguan

  • SDRs: HackRF One, USRP X310
  • SW: GNURadio
  • Loop Antenna, SMA Cable (Relay LF band signal)

22

slide-23
SLIDE 23

Evaluation

  • Selected Classification Algorithms
  • One-Class SVM (OC-SVM) with Radial Basis Function (RBF) kernel
  • k-NN with Standardized Euclidean Distance
  • MatLab implementation
  • Performance Metric
  • Assume False Negative Rate (FNR) as 0%
  • Calculate False Positive Rate (FPR)

23

slide-24
SLIDE 24
  • Single-Band Relay Attack Detection

Γ𝑄𝐿𝐹𝑇 = 5 Γ𝑄𝐿𝐹𝑇 = 4

Evaluation

Experimental Setup

(LF band signal relay)

Results

(0% FPR in both algorithms) 5m, 10m, 15m

(1 meter) (1 meter)

24

slide-25
SLIDE 25

Evaluation

  • Dual-Band Relay Attack Detection
  • Amplification Attack

Experimental Setup (UHF band amplification)

Γ𝑄𝐿𝐹𝑇 = 5 Ξ“

𝑄𝐿𝐹𝑇 = 4

20 ~ 25m

Results

(0% FPR in both algorithms)

25

slide-26
SLIDE 26

Evaluation

  • Dual-Band Relay Attack Detection
  • Digital Relay/ Cryptographic Attack

Experimental Setup (Cryptographic Attack)

Laptop USRP X310 Laptop HackRF One Attack Device HODOR

Results

(Average FPR k-NN: 0.65%, SVM:0.27% )

26

slide-27
SLIDE 27

Evaluation

  • Environmental Factors
  • Non-Line of Sight (NLoS) conditions, Dynamic Channel Conditions

Location of key fob Location of key fob

Backpack: FPR k-NN: 1.32%, SVM:1.35% Pocket: FPR k-NN: 1.71%, SVM:1.67% Underground: FPR k-NN: 5%, SVM:4% Roadside: FPR k-NN: 2%, SVM:3%

27

slide-28
SLIDE 28

Evaluation

  • Environmental Factors
  • Signals from RKE system

Key fob HackRF (SDR) Dry ice

Average FPR k-NN: 6.36%, SVM:0.65% Average FPR k-NN: 0%, SVM:0%

28

slide-29
SLIDE 29

Evaluation

  • Execution time
  • Implementation on Raspberry Pi
  • 1.4Ghz Core, 1G RAM
  • Python Code

Total Execution Time

K-NN: 163.8ms and SVM: 159.038ms

29

slide-30
SLIDE 30

Evaluation

  • Feature Importance

Single-band relay attack Amplification attack Digital relay attack Playback attack

30

slide-31
SLIDE 31

Outline

  • Introduction / Background
  • Attack Model
  • Our Method
  • Evaluation
  • Discussion
  • Conclusion

31

slide-32
SLIDE 32

Discussions

  • HODOR and Security
  • Threshold is a trade-off parameter in HODOR
  • Small threshold leads to the false alarm; a large threshold leads to the false-negative (attack

success)

  • Feature Impersonation
  • Adversary must impersonate the whole feature at the same time
  • Impersonating a specific feature leads to a distortion in other features
  • Practicality
  • Develop additional features and algorithms that properly operate even in extreme environments

32

slide-33
SLIDE 33

Future Work

  • Robustness
  • Comprehensive experiments against feature variations
  • IEC certified facilities (Temperature, Humidity, Impact)
  • Incremental/ Decremental learning
  • Cope with a feature variation (a.k.a Concept drift)
  • Scalability
  • Feature collision
  • Defense against strong attacker equipped with signal-generator
  • Performance optimization
  • Low sample rate, memory usage

33

slide-34
SLIDE 34

Conclusion

  • Proposed a sub-authentication system
  • Supports manufacturer-installed support systems to prevent keyless entry system car theft
  • Effectively detect simulated attacks that are defined in our attack model
  • Reducing the number of erroneous detection occurrences (i.e., false alarms)
  • Found a set of suitable features in a number of environmental conditions
  • Temperature variation, battery aging, and NLoS conditions

34

slide-35
SLIDE 35

Q&A

HODOR!

(Thank you!)

This work was supported by Samsung Electronics

slide-36
SLIDE 36

Appendix

  • Remote Keyless Entry System
  • Unidirectional
  • UHF band (433MHz, 868MHz)
  • ~100 meter communication range
  • FSK or ASK Modulation
  • Shared cryptographic key between the key and the car

Vehicle Key fob

Press Unlock Button If correct, unlock the door

  • 1. ID with encrypted data

36

slide-37
SLIDE 37

Appendix

  • Playback Attack Detection

Experimental Results (SDR with 5MS/s) Experimental Results (USRP with various sample rate) Record & Playback

37