Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Beamforming Feedback as a Novel Attack Surface for Wi-Fi Physical-Layer Security

Jingzhe Zhang, Yitong Shen, Ning Wang, Yili Ren

Abstract

With the rapid evolution of wireless technologies, Wi-Fi has expanded beyond its original role in data transmission to support various emerging applications, particularly in physical-layer security, including device authentication, user authentication, and secret key generation. Despite extensive research on Wi-Fi Channel State Information (CSI)-based physical-layer security, its vulnerabilities remain largely unexplored. In this work, we propose BFIAttack, a novel attack that exploits Beamforming Feedback Information (BFI) to reconstruct the CSI of a legitimate user or device, thereby compromising Wi-Fi-based physical-layer security. We realize the attack by leveraging a closed-form CSI reconstruction method for the single-antenna station scenario and a maximum likelihood estimation-based CSI reconstruction for the multi-antenna station scenario. Moreover, we exploit spatial similarities among antenna pairs to refine the reconstructed CSI and enhance attack effectiveness. Experimental results show that BFIAttack achieves an average attack success rate of $73\%$ in multi-antenna station scenarios with no more than five attack attempts, and over $93\%$ in single-antenna station scenarios with only a single attempt. BFIAttack reveals critical vulnerabilities in existing Wi-Fi-based physical-layer security.

Beamforming Feedback as a Novel Attack Surface for Wi-Fi Physical-Layer Security

Abstract

With the rapid evolution of wireless technologies, Wi-Fi has expanded beyond its original role in data transmission to support various emerging applications, particularly in physical-layer security, including device authentication, user authentication, and secret key generation. Despite extensive research on Wi-Fi Channel State Information (CSI)-based physical-layer security, its vulnerabilities remain largely unexplored. In this work, we propose BFIAttack, a novel attack that exploits Beamforming Feedback Information (BFI) to reconstruct the CSI of a legitimate user or device, thereby compromising Wi-Fi-based physical-layer security. We realize the attack by leveraging a closed-form CSI reconstruction method for the single-antenna station scenario and a maximum likelihood estimation-based CSI reconstruction for the multi-antenna station scenario. Moreover, we exploit spatial similarities among antenna pairs to refine the reconstructed CSI and enhance attack effectiveness. Experimental results show that BFIAttack achieves an average attack success rate of in multi-antenna station scenarios with no more than five attack attempts, and over in single-antenna station scenarios with only a single attempt. BFIAttack reveals critical vulnerabilities in existing Wi-Fi-based physical-layer security.

Paper Structure

This paper contains 27 sections, 33 equations, 22 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Preliminary
  4. Typical Procedures of Wi-Fi-Based Physical-Layer Security Applications
  5. BFI Basics
  6. Attack Design
  7. Threat Model
  8. Attack Overview
  9. Attack on Single-Antenna STA Scenario
  10. Attack on Multi-Antenna STA Scenario
  11. Evaluation
  12. Experimental Setup
  13. Overall Performance
  14. Impact of Different Numbers of Antennas
  15. Impact of Different Bandwidths
  16. ...and 12 more sections

Figures (22)

  • Figure 1: Wi-Fi-based device authentication.
  • Figure 2: Wi-Fi-based user authentication.
  • Figure 3: Wi-Fi-based secret key generation.
  • Figure 4: Wi-Fi sounding procedure. When the STA sends the BFI and ASNR back to the AP, an adversary can easily capture the BFI and ASNR using a passive sniffer.
  • Figure 5: BFI calculation process.
  • ...and 17 more figures