SecBeam: Securing mmWave Beam Alignment against Beam-Stealing Attacks

TL;DR

SecBeam introduces a novel protocol to secure mmWave beam alignment against amplify-and-relay attacks by leveraging power and angle-of-arrival information, demonstrated through experiments and simulations.

Contribution

The paper proposes SecBeam, a new beam sweeping protocol that detects amplify-and-relay attacks without relying on message integrity, enhancing mmWave security.

Findings

SecBeam effectively detects amplify-and-relay attacks in mmWave systems.

Experimental and simulation results show minimal performance overhead.

SecBeam outperforms existing integrity-based defenses against beam-stealing attacks.

Abstract

Millimeter wave (mmWave) communications employ narrow-beam directional communications to compensate for the high path loss at mmWave frequencies. Compared to their omnidirectional counterparts, an additional step of aligning the transmitter's and receiver's antennas is required. In current standards such as 802.11ad, this beam alignment process is implemented via an exhaustive search through the horizontal plane known as beam sweeping. However, the beam sweeping process is unauthenticated. As a result, an adversary, Mallory, can launch an active beam-stealing attack by injecting forged beacons of high power, forcing the legitimate devices to beamform towards her direction. Mallory is now in control of the communication link between the two devices, thus breaking the false sense of security given by the directionality of mmWave transmissions. Prior works have added integrity protection to beam alignment messages to prevent forgeries. In this paper, we demonstrate a new beam-stealing attack that does not require message forging. We show that Mallory can amplify and relay a beam sweeping frame from her direction without altering its contents. Intuitively, cryptographic primitives cannot verify physical properties such as the SNR used in beam selection. We propose a new beam sweeping protocol called SecBeam that utilizes power/sector randomization and coarse angle-of-arrival information to detect amplify-and-relay attacks. We demonstrate the security and performance of SecBeam using an experimental mmWave platform and via ray-tracing simulations.