Wi-Fi Sensing: Attack on Privacy & Countermeasures

Wi-Fi Sensing:
Attack on Privacy &Countermeasures
Advanced Networking Systems, DII
University of Brescia – Italy
https://ans.unibs.it/
Renato Lo Cigno
with the fundamental contribution of
• Francesco Gringoli
• Marco Cominelli
• Lorenzo Ghiro

Outline& Goals
• Wi-Fi Fundamentals
• CSI-based Wi-Fi Localization & Sensing
• Learning positions with CNNs fingerprinting
• Obfuscation through CSI randomization
• Proper manipulation of the CSI at the transmitter or with and intelligent ambient can
hide position information & maintain communication performance
Speck&Tech- Trento, Sept.29, 2022. Wi-FiSensing:Attack ... renato.locigno@unibs.it
1

Outline& Goals
2

Common view of Wi-Fi
But we are interested in Wi-Fi
packets and signals, not the network!
3
AP
AP
AP Wired LAN / Eth Switch
AP: Access Point
"INTERNET"
Router

Wi-Fi packets & signals - 1
• 802.11 comes in many flavors: g/a/h/ac/ax ...
• They define different packet formats and transmission technologies,
including MIMO
4
h11
h22

• Some fields in the packets remain fixed and are used to help the correct
reception
5
L-STF
L-LTF
L-SIG
VHT-SIG-A
VHT-STF
VHT-LTF
VHT-SIG-B
DATA
8µs 8µs 4µs 8µs 4µs 4µs 8µs 4µs 4µs
...
20MHz
20MHz
20MHz
20MHz
256
carriers
80MHz
IDFT X
{...,SIN
n,...}
I/Q samples
central
carrier
modulated signal s(t)
to antenna
{...,Sout
n,...}
randomizer

6
• All versions use OFDM as modulation technique

Wi-Fi ChannelStateInformation(CSI)
7
• Packet decoding happens
thanks to the knowledge
of the distortion
introduced by the channel
(multipath, refractions, ...)
• This knowledge (CSI) is
obtained thanks analyzing
known portions of the
packets

Outline& Goals
8

Wi-Fi PositionSensing
9
input
filter
sampling
equalizer
decoding
localization
system
received
bits
estimated
position
CSI extraction
input
filter
sampling
equalizer
decoding
received
bits
CSI extraction
RX1
RX2
U
• CSI is essential for equalization and high
throughput
• Once extracted the CSI can also be used
to sense & probe the environment
• People (& objects) change the
channel response

Wi-Fi PositionSensing
10
• CSI most evident
characteristic is the
amplitude change
in frequency
• Amplitude heatmap
with the same person
in two different positions in our lab
• Question: how to exploit this information?

CNN Fingerprinting
• Most recent "trend" is using supervised learning with a Convolutional Neural Network
• CSI I/Q samples are fed to the CNN that returns a position classification
11
Conv.
Layer
1
Conv.
Layer
2
Fully-Conn.
Layer
1
Fully-Conn.
Layer
2
Fully-Conn.
Layer
3
CNN
CSI
values
(real
/
imag)
8
Indoor
Locations
• It works, we'll see
results
• Still fragile, but AI is
improving VERY fast

Localization
• Tracking a person without her/his consent
• Violate privacy
• Often violate laws / rules
• Channel State Information (CSI) carries
details on the propagation environment
12
6.60 m
Tx
Rx2
7.00
m
P1
P2
P3
P8
P4
P7
P6
P5
Rx5
Rx1
Rx3
Rx4
`
BIG BROTHER IS
SENSING YOU

Localization
• Big Brother
• Controls one (or more) receivers
• Knows the position of Tx (e.g., an Access Point)
• The victim
• Is unaware of the system
• Does not need to hold a Wi-Fi device
13
6.60 m
Tx
Rx2
7.00
m
P1
P2
P3
P8
P4
P7
P6
P5
Rx5
Rx1
Rx3
Rx4
`
BIG BROTHER IS
SENSING YOU

Outline& Goals
• Proper manipulation of the CSI at the transmitter or with and intelligent ambient
can hide position information & maintain communication performance
14

CSI Randomization
• Proper manipulation at the
transmitter "blur" the fingerprints
• Different manipulations result in
different "blurring"
• Manipulation should not hamper
communication
performance
15

ManipulationPrinciples
1. Do not alter power emission
2. Guarantee that the pre-distortion random changes are compatible with
human (time correlation)
3. Guarantee that the pre-distortion random changes in frequency are
compatible with the real channel
4. Hide distortion information to prevent reverse
engineering within a reasonable time horizon
5. Do not change the communication performance
of the system
16

Basic Manipulation
• Multiply the samples amplitude by a Uniform-Markov random process
17

Localization Results
• Performance of single receivers
Percentage of correct decision: random choice = 12.5%
18
6.60 m
Tx
Rx2
7.00
m
P1
P2
P3
P8
P4
P7
P6
P5
Rx5
Rx1
Rx3
Rx4
Rx1 Rx2 Rx3 Rx4 Rx5
Clean 90.6 89.6 93.1 83.1 67.6
Obfuscate 17.6 41.9 15.4 33.6 15.6
C&F, nm 12.9 57.4 30.6 60.5 21.4
F&C 8.8 28.0 7.4 15.2 0.0
F&Cm nm 24.5 37.8 22.1 44.9 22.6

Localization Results
• Majority vote with Nr receivers, average of all
combinations
• Correct decision (not decided)
Percentage of correct (not decided) localization
19
6.60 m
Tx
Rx2
7.00
m
P1
P2
P3
P8
P4
P7
P6
P5
Rx5
Rx1
Rx3
Rx4
Nr=2 Nr = 3 Nr = 4 Nr = 54
Clean 71.1 (28.9) 95.7 ( 4.3) 99.1 ( 0.1) 100.0 ( 0.0)
Obfuscate 8.7 (72.5) 18.1 (39.1) 19.2 (22.9) 18.2 (20.1)
C&F, nm 13.7 (75.0) 29.8 (42.0) 36.4 (24.4) 34.0 (23.0)
F&C 1.1 (70.2) 3.1 (35.9) 2.6 (23.2) 1.5 (31.2)
F&Cm nm 18.2 (60.6) 25.4 (33.1) 27.3 (23.9) 31.4 (16.5)

Packet Delivery Rate
• PDR is influenced by
manipulation
MedComNet'21- PassiveDevice Free... marco.cominelli@unibs.it
20
0 1 2 3 4 5 6 7 8 9
MCS
0
20
40
60
80
100
PDR
[%]
Clean

manipulation
21
0 1 2 3 4 5 6 7 8 9
MCS
0
20
40
60
80
100
PDR
[%]
Clean
Filter & Clip
Filter & Clip no Max

manipulation
• Proper analysis of the
properties can reduce
the impact
22
0 1 2 3 4 5 6 7 8 9
MCS
0
20
40
60
80
100
PDR
[%]
Clean
Filter & Clip
Filter & Clip no Max
Clip & Filter
Clip & Filter no Max

Wi-Fi Sensing:
Attack on Privacy &Countermeasures
Advanced Networking Systems, DII
University of Brescia – Italy
https://ans.unibs.it/
Renato Lo Cigno
¡Thanks for theAttention!

Wi-Fi Sensing: Attack on Privacy & Countermeasures

Recommended

Recommended

More Related Content

Similar to Wi-Fi Sensing: Attack on Privacy & Countermeasures

Similar to Wi-Fi Sensing: Attack on Privacy & Countermeasures (20)

More from Speck&Tech

More from Speck&Tech (20)

Recently uploaded

Recently uploaded (20)

Wi-Fi Sensing: Attack on Privacy & Countermeasures

Editor's Notes