Detecting Ranging Spoofing Attacks on IEEE 802.15.4z

With the development of wireless sensing, both accuracy and privacy issues have gained much attention from industry to academia. Short range plays a role in sensing field, and in precision ranging the Impulse Radio Ultra-Wideband (IR-UWB) is widely adopted primarily due to its high temporal resolution. The IEEE 802.15.4 group has especially set UWB physical layer (PHY) for precision ranging. In the latest standard IEEE 802.15.4z, the scrambled timestamp sequence (STS) field has been added to improve the security of ranging. However, it is still vulnerable to PHY attacks, such as Ghost Peak and Cicada\Cicada++ attack. These spoofing attacks introduce distance reduction, sometimes be fatal in practice. In this paper, we propose a consistency check scheme (CCS) to detect spoofing attacks. Based on the special structure of STS, we calculate both segment-based estimates and STS-based estimate. The scheme checks the consistency of these two types of estimates. If all differences are less than the consistency threshold, we judge that no spoofing attacks exist in current ranging process and the final estimated distance is equal to the STS-based estimate. If any difference exceeds the threshold, a spoofing attack is detected and we conclude the ranging environment is insecure and invalid all estimates. Taking Ghost Peak as an example, simulation results show that the scheme is an effective method to detect spoofing attacks.