With the wide bandwidths in millimeter wave (mmWave) frequency band that results in unprecedented accuracy, mmWave sensing has become vital for many applications, especially in autonomous vehicles (AVs). In addition, mmWave sensing has superior reliability compared to other sensing counterparts such as camera and LiDAR, which is essential for safety-critical driving. Therefore, it is critical to understand the security vulnerabilities and improve the security and reliability of mmWave sensing in AVs. To this end, we perform the end-to-end security analysis of a mmWave-based sensing system in AVs, by designing and implementing practical physical layer attack and defense strategies in a state-of-the-art mmWave testbed and an AV testbed in real-world settings. Various strategies are developed to take control of the victim AV by spoofing its mmWave sensing module, including adding fake obstacles at arbitrary locations and faking the locations of existing obstacles. Five real-world attack scenarios are constructed to spoof the victim AV and force it to make dangerous driving decisions leading to a fatal crash. Field experiments are conducted to study the impact of the various attack scenarios using a Lincoln MKZ-based AV testbed, which validate that the attacker can indeed assume control of the victim AV to compromise its security and safety. To defend the attacks, we design and implement a challenge-response authentication scheme and a RF fingerprinting scheme to reliably detect aforementioned spoofing attacks.

Millimeter wave wireless systems rely heavily on directional communication in narrow steerable beams. Tools to measure the spatial and temporal nature of the channel are necessary to evaluate beamforming and related algorithms. This paper presents a novel 60 GHz phased-array based directional channel sounder and data analysis procedure that can accurately extract paths and their transmit and receive directions. The gains along each path can also be measured for analyzing blocking scenarios. The sounder is validated in an indoor office environment.

Channel measurements at millimeter wave (mmWave) frequencies are typically carried out using directional antennas to overcome high path loss at mmWave frequencies. Unlike traditional directional channel measurements using narrow beam horn antennas where ray paths can be uniquely mapped to a direction with sufficient high accuracy, phased arrays with irregular beam pattern offers additional complexity in determining the arrival statistics of ray paths. In this work, we propose a systematic method to infer the ray path characteristics with the knowledge of beam patterns used by the phased array. We leverage on the channel measurement data obtained from extensive 60 GHz measurement campaign performed for indoor living room scenario and extract the ray path information from the measured data with high reliability. We also verify our findings through ray tracing simulation.

With millimeter wave (mmWave) wireless communication envisioned to be the key enabler of next generation high data rate wireless networks, security is of paramount importance. While conventional security measures in wireless networks operate at a higher layer of the protocol stack, physical layer security utilizes unique device dependent hardware features to identify and authenticate legitimate devices. In this work, we identify that the manufacturing tolerances in the antenna arrays used in mmWave devices contribute to a beam pattern that is unique to each device, and to that end we propose a novel device fingerprinting scheme based on the unique beam pattern of different codebooks used by the mmWave devices. Specifically, we propose a fingerprinting scheme with multiple access points (APs) to take advantage of the rich spatial-temporal information of the beam pattern. We perform comprehensive experiments with commercial off-the-shelf mmWave devices to validate the reliability performance of our proposed method under various scenarios. We also compare our beam pattern feature with a conventional physical layer feature namely power spectral density feature (PSD). To that end, we implement PSD feature based fingerprinting for mmWave devices. We show that the proposed multiple APs scheme is able to achieve over 99% identification accuracy for stationary LOS and NLOS scenarios and significantly outperform the PSD feature fingerprinting method. For mobility scenario, the overall identification accuracy is 99%. In addition, we perform security analysis of our proposed beam pattern fingerprinting system and PSD fingerprinting system by studying the feasibility of performing impersonation attacks. We design and implement an impersonation attack mechanism for mmWave wireless networks using state-of-the-art 60 GHz software defined radios. We discuss our findings and their implications on the security of the mmWave wireless networks.

Next generation wireless communication networks utilizing 60 GHz millimeter wave (mmWave) frequency bands are expected to achieve multi-gigabit throughput with the use of highly directional phased-array antennas. These directional signal beams provide enhanced security to the legitimate networks due to the increased difficulties of eavesdropping. However, there still exists significant possibility of eavesdropping since (i) the reflections of the signal beam from ambient reflectors enables opportunistic stationary eavesdropping attacks; and (ii) carefully designed beam exploration strategy enables active nomadic eavesdropping attack. This paper discusses eavesdropper attack strategies for 802.11ad mmWave systems and provides the first analytical model to characterize the success possibility of eavesdropping in both opportunistic stationary attacks and active nomadic attacks.