Skip to content
BoKSA

CYBOK 22 Physical Layer and Telecommunications Security

CYBOK 22 Physical Layer and Telecommunications Security

1. The Strategic Significance of the Physical Layer in Cyber Security

In the hierarchy of the security stack, the physical layer is the foundational bedrock upon which all logical protections—from TLS to AES—are built. It is a common fallacy to view this layer as merely a collection of cables and radio waves; in reality, it is the medium where data first manifests as electromagnetic energy. If the integrity of the physical layer is compromised, the mathematical elegance of high-level cryptography becomes irrelevant. A breach at this level bypasses logical gates entirely, rendering higher-order security controls ineffective.The socio-technical context of modern wireless communication fundamentally changes the threat model. Unlike wired systems, which require physical access to a conductor, wireless systems operate on a shared broadcast medium. Because radio signals propagate through open air, an adversary can "hear" every bit of data without ever touching the infrastructure. Crucially, the wireless channel response is both frequency and position dependent. This leads to the "half-wavelength rule": because of the multi-path behavior of signals (reflection, diffraction, and scattering), an observer located more than half a carrier wavelength away from a legitimate receiver will experience a de-correlated channel response. This physical reality provides a unique opportunity: we can leverage these environmental "flaws" to create innovative defense mechanisms that are rooted in the laws of physics rather than just algorithmic complexity.

2. Securing the Wireless Channel: Confidentiality and Integrity

Traditional encryption is often insufficient in environments where pre-shared secrets are absent or where the goal extends beyond simple data exchange to physical verification. To defend a wireless link effectively, a security specialist must move beyond the data layer and leverage physical-layer constructs.

Key Establishment based on Channel Reciprocity

We can exploit the inherent randomness of the wireless environment to derive shared secrets. Since two communicating parties (Alice and Bob) measure highly correlated channel responses in a short time window, they can use properties like Received Signal Strength Indicator (RSSI) or Channel Impulse Response (CIR) to establish a key. The process follows three mandatory phases:

  1. Quantization Phase: Alice and Bob independently convert their continuous channel measurements into binary sequences using fixed or dynamic thresholds.
  2. Information Reconciliation Phase: Because measurements are never identical, parties use error-correcting codes and privacy amplification to reconcile the sequences and eliminate discrepancies.
  3. Key Verification Phase: The parties confirm they have established a matching secret; if they fail, the process restarts. Because an attacker at a distance measures a de-correlated channel, they are physically barred from the secret randomness.
MIMO-Supported Approaches: Orthogonal Blinding and Zero-Forcing

Multiple-Input Multiple-Output (MIMO) systems allow for precise signal manipulation:

  • Zero-Forcing: If the transmitter knows the specific channel state for both the receiver and the attacker, it can encode the data so it is measurable at the receiver while the attacker measures zero signal related to the data.
  • Orthogonal Blinding: In scenarios where the attacker's channel is unknown, the transmitter "steers" the signal to the receiver and intentionally mixes the data with random noise in all other directions, "blinding" any potential eavesdropper.
Integrity Codes

Data integrity can be verified without pre-shared keys using Integrity Codes . This involves modulation schemes like Manchester coding paired with on-off keying. By creating a known ratio of signals (e.g., an equal number of 1s and 0s), the receiver can measure the energy of the signal. In a multi-path environment, it is physically difficult for an attacker to "cancel out" these signals, allowing the receiver to verify authentication based on energy thresholds.Starting Points for Further Study:

  1. Analyze the Quantization Phase in CyBOK Section 1.1 to understand the transition from physics to bits.
  2. Expert's Research Task: Search for "Practical applications of 802.11 beamforming in security." Hint: Focus on how commercial beamforming hardware can practically implement Zero-Forcing to create spatial "null zones" for adversaries.Points of Attention:
  3. Adversarial Capability: Assume the adversary utilizes an N-antenna array; quantify how this multi-antenna advantage might allow them to separate your "blinded" signals or recover the message through spatial filtering.
  4. Physical Proximity: Is it verified that the attacker is located more than half a wavelength away from the legitimate parties? If not, the channel response correlation will likely leak the secret.
3. Electronic Warfare: Jamming, Annihilation, and Resilience

In critical infrastructure, interference is a strategic threat, not a nuisance. A resilient system must maintain functionality despite an adversary’s attempt to destroy the communication link.

Concept Explanation: Jamming, Annihilation, and Overshadowing
  • Constant vs. Reactive Jamming: Constant jammers flood the spectrum permanently, while reactive jammers sense legitimate transmissions and fire only when needed to save energy and remain covert.
  • Signal Annihilation: A highly sophisticated attack where the adversary transmits a signal of opposite polarity to cause destructive interference. Unlike jamming, which increases energy on the channel and is easily detected, annihilation reduces energy , potentially dropping the signal below the detection threshold—making it far more difficult to diagnose.
  • Overshadowing: The attacker emits a high-amplitude signal that forces the receiver to lock onto the adversarial signal instead of the legitimate one. This is devastating for positioning systems, as it can be used to alter the perceived Time of Arrival (ToA).
Defense Mechanisms: Resilience through Spreading

Resilience is achieved through Frequency Hopping (FHSS) and Direct Sequence (DSSS) .

  • Coordinated: Uses a secret spreading code to determine the hopping sequence.
  • Uncoordinated (UFH/UDSSS): Designed for broadcast scenarios without pre-shared keys. UFH utilizes Fragment Linking , where message segments are cryptographically or physically linked to allow a broadband receiver to reassemble the packet even if an attacker injects "poisoned" fragments to disrupt the reassembly process.Starting Points for Further Study:
  • Analyze Figure 1 in the CyBOK text: Study how fragment linking prevents message insertion by ensuring that only fragments with the correct physical/logical link are processed during reassembly.
  • Expert's Research Task: Investigate "The Jamming-to-Signal (J/S) ratio impact on receiver decoding" to determine the mathematical breaking point of a specific modulation scheme.Points of Attention:
  • Code Secrecy: Does the system rely on a secret spreading code (Military GPS) or a public one (Civilian GPS)? Public codes provide zero protection against sophisticated spoofing.
  • Receiver Breadth: Is the receiver’s bandwidth sufficient to handle uncoordinated hopping and capture enough fragments for reconstruction?
4. Device Identity and Proximity Verification

Manufacturing tolerances in analog circuitry leave unique, unintentional marks on every device. These "flaws" can be leveraged as Radio Fingerprints for physical-layer identification.

Physical-Layer Identification (Radio Fingerprinting)

Transmitters can be identified by analyzing "turn-on transients" (the energy burst when a radio activates) or modulation errors caused by imperfections in local oscillators. A robust fingerprint must be Universal, Unique, Permanent, Collectable, Robust, and Data-Dependent .

Distance Bounding Protocols

To prevent Relay/Wormhole attacks , we must measure the Time of Flight (ToF) of the signal. Traditional proximity checks fail because an attacker can simply relay a signal to a distant location. Distance bounding uses rapid-fire challenge-response exchanges (often single-bit) to calculate an upper bound on distance based on the speed of light.In the CyBOK framework, you must categorize distance attacks into four distinct Frauds :

  1. Distance Fraud: A dishonest prover claims to be closer than they are.
  2. Mafia Fraud: An external attacker relays signals between an honest prover and an honest verifier.
  3. Terrorist Fraud: A dishonest prover collaborates with an external attacker to trick the verifier.
  4. Distance Hijacking: A dishonest prover exploits honest provers to misrepresent their own location.Starting Points for Further Study:
  5. Review the "Six Properties of Fingerprints" in CyBOK Section 3.3.Points of Attention:
  6. Environmental Robustness: Is the fingerprint stable across changes in temperature, voltage, and aging?
  7. Signal Precision: Is the symbol length short enough (e.g., UWB pulses) to prevent "early-detect" attacks, where an attacker predicts a bit before it is fully received, or "late-commit" attacks, where they delay their response?
5. Compromising Emanations and Sensor Spoofing

The TEMPEST concept dictates that electronic devices are constantly leaking information through optical, acoustic, thermal, and electromagnetic side channels.

Concept Explanation
  • Compromising Emanations: This includes "Van Eck Phreaking," where monitor contents are reconstructed from EM leakage. Modern research has demonstrated that even the high-frequency sounds from a computer’s voltage regulation circuit (capacitors and coils) can leak enough information to reconstruct RSA keys.
  • Sensor Spoofing: This involves injecting physical signals into sensors. An attacker might use ultrasonic waves to send silent, fabricated commands to a voice assistant’s microphone or use intentional EMI to manipulate medical device readings.Starting Points for Further Study:
  • Examine the history of Van Eck Phreaking and the implementation of EMI Monitors to detect active interference in sensor arrays.Points of Attention:
  • Physical Isolation: Are sensitive cables shielded and "air-gapped" from non-confidential systems?
  • Active Defense: Does the sensor use a challenge-response mechanism, such as randomly turning the sensor off to ensure the output returns to a known level, thereby detecting persistent adversarial EMI?
6. Sector-Specific Security: NFC, Aviation, Cellular, and GNSS

Technology,Primary Physical Layer Risks,Key Mitigation Strategies
NFC,Wormhole/Relay attacks bypassing proximity assumptions.,Distance bounding protocols and context-aware location verification.
Aviation (ADS-B),"Unauthenticated broadcasts; ""ghost planes"" and location distortion.",Multilateration (MLAT): Using Time of Arrival (ToA) at multiple ground stations to cross-check positions.
Cellular (2G-5G),Fake Base Stations (IMSI Catchers) exploiting trust.,"Authentication Shift: 2G relied on one-way authentication (mobile to network), which 3G-5G fixed with mutual authentication ."
GNSS (GPS),"""Seamless Takeover"" attacks using public spreading codes to hijack receiver lock.","Monitoring AGC values, RSS, and carrier phase; future use of spreading with delayed key disclosure."
Points of Attention:

  • Power Anomalies: Is the system monitoring Automatic Gain Control (AGC) and signal power for sudden increases that indicate a spoofing or overshadowing attempt?
  • Trust Logic: Does the system rely solely on unverified location data for security decisions?
7. Advanced Notes (For 3rd/4th Year Students)

For specialization, one must master the information-theoretical limits of communication. The core concept is Secrecy Capacity , derived from Wyner’s wire-tap channel. Wyner expanded upon Shannon’s one-time pad result (which requires a key as long as the message) by proving that if an attacker’s channel is even slightly noisier than the legitimate one, "unconditional security" is mathematically possible without a pre-shared key.In high-assurance positioning, the foundational primitive is the Message Time of Arrival Code (MTAC) . MTACs are designed to withstand both reduction and enlargement attacks on distance measurements, typically implemented via UWB modulation.Open Research Directions: The emergence of IEEE 802.15.4z aims to standardize secure distance measurement, yet the industry remains vulnerable to "Record-and-Relay" attacks. Even with authenticated signals, a broadband attacker can record the entire frequency band and replay it with a delay. Preventing these attacks in global systems like GNSS, where the attacker controls the signal at the antenna, remains the ultimate "ground truth" challenge in cyber security.