Openwifi CSI fuzzer for authorized sensing and covert channels

TL;DR

This paper introduces an open-source CSI fuzzer integrated into WiFi transmitters to protect privacy by obfuscating channel information, enabling secure sensing and covert communication without degrading WiFi performance.

Contribution

It presents a novel CSI fuzzer that embeds artificial channel responses into WiFi signals, enhancing privacy and security for WiFi CSI applications on open-source hardware.

Findings

Successfully prevents unauthorized CSI sensing.

Enables covert channels with artificial response patterns.

Maintains WiFi link performance despite obfuscation.

Abstract

CSI (Channel State Information) of WiFi systems contains the environment channel response between the transmitter and the receiver, so the people/objects and their movement in between can be sensed. To get CSI, the receiver performs channel estimation based on the pre-known training field of the transmitted WiFi signal. CSI related technology is useful in many cases, but it also brings concerns on privacy and security. In this paper, we open sourced a CSI fuzzer to enhance the privacy and security of WiFi CSI applications. It is built and embedded into the transmitter of openwifi, which is an open source full-stack WiFi chip design, to prevent unauthorized sensing without sacrificing the WiFi link performance. The CSI fuzzer imposes an artificial channel response to the signal before it is transmitted, so the CSI seen by the receiver will indicate the actual channel response combined with the artificial response. Only the authorized receiver, that knows the artificial response, can calculate the actual channel response and perform the CSI sensing. Another potential application of the CSI fuzzer is covert channels based on a set of pre-defined artificial response patterns. Our work resolves the pain point of implementing the anti-sensing idea based on the commercial off-the-shelf WiFi devices.