WO2015121492A1

WO2015121492A1 - Method for wireless communication

Info

Publication number: WO2015121492A1
Application number: PCT/EP2015/053292
Authority: WO
Inventors: Stefano SEVERI; Guiseppe ABREU
Original assignee: Jacobs University Bremen Ggmbh
Priority date: 2014-02-17
Filing date: 2015-02-17
Publication date: 2015-08-20
Also published as: EP3108608A1; DE112015000826A5

Abstract

The invention relates to a method for arranging an encrypted NFC connection. Two NFC devices (A, B) each exchange a signal of the same frequency having a random phase (ϕ_A, ϕ_B), this signal being registered at the other of the devices (B, A) as a reception signal with a frequency-specific and distance-dependent phase rotation (ϕ_C), the phase of the devices' own transmission signal being added to said reception signal in order to obtain a phase total (θ _A=ϕ_A+ϕ _B+ϕ_C, θ _B= ϕ _A +ϕ_B+ϕ_C). The phase total produced in this manner is quantised in the signal space, in L of the same type levels, and the signal is coded in symbols represented by bit sequences. The suggested method does not require channel entropy and is secured from eavesdropping in a spatial section determined by the frequencies used.

Description

Method for wireless communication

The invention relates to a method for negotiating an encrypted near-field wireless connection between two spaced-apart devices, each having a transmitting and a receiving unit.

[02] Near-field communication (NFC) is becoming increasingly important for electronic devices to wirelessly exchange information locally. Typical scenarios requiring near field communication are contactless transactions and data exchange.

[03] Not only in payment methods, near-field communication must be secure against unwanted wiretaps. The acceptance of data-exchanging everyday devices and thus their rapid dissemination depends, among other things, on the fact that the near-field communication used already takes account of security and data protection in the basic concept. Encrypting the connection is therefore a necessary requirement for acceptance.

[04] It is expected that in the near future almost every power-driven device will interface to

Have wireless communication. The high number of expected devices makes it unattractive or impossible to provide a separate key for every conceivable permutation on device couplings and to keep it locally fixed in each case. A dynamic key generation and a Ad-hoc exchange of the key pair generated in this way is therefore essential.

To make matters worse, that NFC communication is characterized on the one hand by very short distances and thus by a high signal-to-noise ratio (SNR) and on the other hand no channel randomities can be used.

In order to generate and exchange secret keys despite these difficulties, essentially two prior art methods are known: the first set of methods uses receive-field-strength-dependent (RSSI-based) protocols, and the second set of methods form channel-phase-based protocols.

[07] A disadvantage of this method is that both types of methods use the channel entropy as a source for the generation of random variables in order to hide a key from a listener. However, in typical high SNR NFC scenarios, in the absence of obstacles between the transmitter and the receiver, and thus the lack of multiple signal propagation paths, such channel entropy is usually absent or insufficient. Therefore, these methods are at least less reliable, if not unsuitable, to communicate only with each other and in front of third parties safely.

Object of the invention [08] It is therefore an object of the invention to provide a method for negotiating an encrypted near-field

Provide wireless connection that allows secure communication even in case of insufficient channel entropy. It is a further object of the invention to provide devices for carrying out such a method. It is therefore an object of the invention to improve the prior art.

[09] The first object is achieved in a method for negotiating an encrypted near-field wireless connection between two spaced-apart devices, each having a transmitting and a receiving unit, in that the transmitting units of the devices each have a transmission signal of the same frequency with a random one Produce phase, which is registered with the other device with a frequency-specific and distance-dependent phase rotation and possibly an error as a received signal with the phase to which the phase of each own transmit signal is added to a phase sum, the phase sums in the signal space in L respectively are quantized and the signals of each level are encoded into symbols represented by bit sequences.

[10] Advantageous embodiments are the subject of the dependent claims.

[11] According to the invention, a channel entropy is thus not absolutely necessary. Rather, areas are identified by the method according to the invention in which Due to their relative position to each other, the reception of a decoding of the exchanged bit sequence for an eavesdropping third party is possible or not possible. The zone in which this is not possible for this third party is hereinafter referred to as geometric security zone or zone of geometric secrecy. Within the geometric security zone is the secret

Data exchange is no longer limited by the strategy and possibilities of the intercepting third party, but only by the available SNR.

The inventive method is not limited to NFC scenarios, but is in principle also for applications in which the entropy is significantly higher.

[13] The method according to the invention is described below with reference to two devices, called Alice and Bob, between which information is to be exchanged. An uninvolved third party, Eve, is a listening attacker who can receive both the signals sent by Alice and Bob, as well as the implemented key generation and key exchange mechanism.

[14] In a first step to establish an encrypted channel for communication, Alice and Bob exchange two signals of the same frequency. Preferably, these are sinusoidal signals of only one frequency and with the same amplitude. The phases with which the signals are sent are randomly generated and are only known to the sender.

In one embodiment of the method is provided that Alice and Bob have no common time measurement, so that is turned off in the exchanged signals to relative phase differences. Advantageously, therefore, there is no need for time synchronization between Alice and Bob.

[16] For the sake of simplicity, however, the method according to the invention will be described below in terms of absolute phases and thus assumed that Alice and Bob have a common time measurement. Thus, Alice sends a signal of the phase φ _Α and Bob one of the phase φ _Β , with their phases are generated randomly.

[17] Because the signal path from Alice to Bob is the same as that from Bob to Alice, the principle of channel reciprocity applies, with the result that each signal receives the same gain and phase shift φ ₀ .

[18] Alice and Bob receive the signals emitted by each other with the phases _Β + φο and _Α + ΦΟ. The phases ι differ from the originally emitted phases φι by an estimated error n _T. To the phases thus received, the respective own phase φ _Α or φ _{Β is} added, so locally now the signals

available. [19] Preferably, the signals are routed through ordinary phase-locked loops (PLL), which are available at low cost.

[20] The values ΘΑ and Θ _Β are then considered in the signal space [0, 2π), which is quantized in L like levels. For example, a quantization in L = 4 level leads to four quadrants in the signal space of 0 to 2%. The signal of each level is then encoded into a bit sequence, hereafter referred to as a symbol.

[21] Coding of the p. and q. Levels, where p = Q (0 _A ) and q = Q (ÖB), where p and q can take values from 1 to L, preferably in two = log ₂ L bit sequences (symbols). The probability that both symbols match is dependent, among other things, on the number L of quantizations and the signal-to-noise ratio (SNR).

[22] If two symbols are alike in Alice and Bob, then Alice and Bob each have the same bit sequence that results from the random phases of both and can act as a key or as a subsequence of a key to be generated. In the following

Embodiment is shown that there are location-dependent zones of geometric secrecy, in which the key a third party outside basically can not be known and unsafe zones in which a decoding is possible in principle. Although the method basically requires only one frequency to exchange the phase, it is advantageous to use multiple frequencies because it can extend the geometric secrecy zone. Preferably, the replacement takes place over different frequencies simultaneously, although a sequential exchange is also possible.

[24] The second sub-task is solved by devices for carrying out the method.

[25] In summary, the invention features a method that provides a dynamically generated key for two devices, Alice and Bob, that enables encrypted communication without relying on fixed precoded solutions. For this purpose, two phases are sent via sinusoidal signals of the same frequency f, to generate from the received signals and the own one bit sequence, the symbol. The symbol can only be decoded by a listening third party, Eve, if it is in a certain part of space which is determinable by a function as a function of the frequency f.

[26] A parallel exchange of signals over M different frequencies then results in a constriction of the parts of space that make it virtually impossible to get into key ownership without being in the line of sight of Alice and Bob. From the set M of symbols, a part of the final key Θ can be obtained. [27] By iterating the above process, the desired length for the final key Θ can then be obtained.

[28] In an optional way, the final key Θ thus generated is still verified, for example, by one of the known key matching methods.

[29] In the following, the invention will be explained in more detail by means of exemplary embodiments. Show it

FIG. 1 shows a typical Alice-Bob-Eve scenario, with the associated phase rotations of the respective channels,

Figure 2 shows the quantization in the signal space on

Example of L = 4 levels,

Figure 3a shows the zone of geometric secrecy with

L = 8 levels for the frequency

MHz,

Figure 3b shows the zone of geometric secrecy with

L = 8 level for the frequency f2 = 4 MHz,

Figure 3c the zone of geometric secrecy with

L = 8 level for the frequency 3 = 26 MHz,

3d figure the zone of geometric secrecy with

L = 8 for the frequency set [f _lr f ₂ , f ₃ ] whose frequencies are all used in common for key generation. Figure 1 shows a typical Alice Bob Eve constellation in which the respective lines of sight between Alice, Bob and Eve form a triangle. It will be shown below under which circumstances the symbols generated by the method according to the invention can not be generated by the intercepting third party Eve and the key is thus secure.

[31] Eve knows the used, publicly known signal exchange mechanism between Alice and Bob exactly and can also catch the signals of both. In an attempt to eavesdrop on the signal exchange - if possible without betraying its presence - it receives the signals with phase rotations, which depend on their location. Assuming that Eve is not collinear between Alice and Bob and is thus out of line of sight between Alice and Bob, Eve perceives the Alice signal with the phase shift Φ _{Ο (ΑΕ} >, that of Bob with φ ₀ ( _ΒΕ ) · Both values are usually different from each other and, due to the above assumption that Eve is out of line of sight, of the phase shift φ ₀ between Alice and Bob Eve, unlike Alice and Bob, does not benefit from the channel reciprocity between Alice and Bob.

[32] For each sinusoidal transmit signal φι emitted by Alice or Bob, Eve can guess the correct signal θι on the basis of a quantization of L level if the condition - (0 _{C (AE)} + 0 _{C (BE)} ) | <ß is fulfilled. Where β = 27μ / L represents the quantization width. [33] From the general relationship between the distance and

, d. _

the phase rotation <p _c = -modz, it is possible to analytically determine the vulnerable areas in which Eve would in principle be able to accurately capture the phase of the transmission signal φι and thus gain access to the structure of the key. With respect to the distances between Alice, Bob and Eve, this means that the method is potentially unsafe whenever the condition dAB + n-Δ _d <d _E <dAB + n + Δ _{d is} met, where

is the sum of the distances between Eve and Alice and Eve and Bob, n is a natural number and Δ ^ λ / L is given. The inequality defines periodically repeating regions bounded respectively inwardly and outwardly by ellipses in which perfect secrecy of the transmit phase is not possible.

[34] Such a region is shown in Figure 3a. Due to the used frequency of 2 MHz, the number of levels 8 and the given distance of Alice and Bob, designated Α ^Λ Β, the ellipses degenerate almost to concentric circles. In the dark color uncertain areas are shown, in which interception is possible in principle, while in the bright area in between an area in which this is not possible from the above-mentioned spatial relationships and as a result creates a zone of geometric secrecy.

[35] FIGS. 3b and 3c show, analogously to FIG. 3a, the changing zones of geometric secrecy and unsafe zones at frequencies of 4 MHz and 26 MHz.

[36] The range in which interception is possible in principle depends on the frequency used and is still relatively large.

[37] In order to increase the zone of geometric secrecy, it is provided in one embodiment of the method to carry out the signal exchange on two or more frequencies.

[38] Preferably, the exchange takes place simultaneously on the different frequencies. Since Eve can not be in several places at the same time, Eve must simultaneously meet the geometric conditions for all frequencies used, which significantly reduces the extent of the unsafe zones.

Alternatively, the exchange can also take place in succession, the time offset should be as small as possible, so that a possible change in location of Eve with sufficient

Probability can be excluded.

[40] The frequencies used to generate the key are preferably significantly different from each other. For example, they differ by half or even an order of magnitude.

[41] Depending on the desired minimization of the unsafe zones, the method with M different frequencies can be used. As a result, the plane spanned by Alice, Bob, and Eve is divided into elliptical zones whose focal points are opposed by Alice and Bob.

[42] If a very high frequency f _{M is} used, this means for the unsafe zone of the primary order, ie the zone containing the connecting line between Alice and Bob, according to the above relation dAB + λη † λΜL with n = 0 and the of the high f _M small value for λΜ, that the ellipse degenerates to the connecting line between Alice and Bob. By definition, Eve should not be in the line of sight between Alice and Bob. Since the frequencies can not be selected arbitrarily high, a distance from the line of sight of λΜL is still required.

[43] In the case of the representations of FIGS. 3a to 3c, the frequency fi of 2 MHz used results in a zone of geometric safety with a diameter of at least approximately 20 m to a maximum of 123 m. By combining with the frequency 3 = 26 MHz, a zone of geometric safety of a minimum of about 2.5m and a maximum of lim and an intermediate frequency of f2 = 4 MHz, a zone of geometric safety of at least 2.5m to a maximum of 123m can be created , [44] The superposition of zones of geometric safety is shown in Figure 3d. The zone of geometric safety can be maximized by large frequency spread - ie by the combination of very high and very low frequencies.

[45] Most near field communication devices have limits in the generation of signals due to their size and energy requirements. In addition, due to national regulatory requirements, there are usually only a few frequency bands available.

[46] In order to be able to use the method well even in narrow frequency bands, it is provided in one embodiment of the invention that the phase transmission takes place via a differential frequency system. For this purpose, a set of several, ie at least two, frequencies is required, of which, for example, the highest is the reference frequency. The other frequencies may also differ from the reference frequency in the initial phase. To generate the phase sums Θ and thus the key is used in each case the phase difference between the reference frequency and another frequency from the frequency system, said phase difference spatially also varies periodically. Thus, the method can also be used well in narrow frequency bands, such as in the free ISM band.

[47] For the ISM band, for example, level numbers of 4, 8 and 16 and M = 2 ... 7 different transmission frequencies are suitable. Such a configuration leads to Areas of geometric secrecy of about one or a few decimetres to the order of 100m or even a few hundred meters.

[48] In the signal determination, the received signal §> ± and thus also the phase sum θ ± generated therefrom differs by an estimated error n _T from the true phase sum θι. If the determined phase sums coincide with the limits generated by the quantization of the levels, misallocations may therefore occur. In one embodiment of the invention, it is therefore provided to provide rejection zones Δψ at the level boundaries. If a determined phase sum θι falls into such a rejection zone, it is discarded. Then it may be provided to initiate a retransmission on the same frequency or on a different frequency. Alternatively, their value is rejected without replacement, provided that sufficient other symbols are available for generating the key.

[49] Figure 2 shows a signal space quantized in L = 4 zones, represented as quadrants Ql to Q4. The signal space comprises the range [0... 2π), the level limits thus being arranged at π / 2, π, 3/2π and 2π. On both sides of the level limits a rejection zone Δψ is arranged, which has a width of π / 32. If the calculated phase sum θι falls in the vicinity of the level boundary and thus in the rejection zones, the probability of a misallocation is high even with small interfering noises, so that the value a posteriori is discarded. Thus, in this embodiment of the invention, there are three possible final states: matching symbol between Alice and Bob, different symbol in Alice and Bob, or thirdly (refusal) rejection of the symbol.

[50] The probabilities of Alice and Bob obtaining a valid, common symbol depend, among other things, on the SNR, the number of L quantizations, and the rejection limits used.

[51] For small and medium SNRs that are below 20dB, with Tikhonov error distributions imputed to both Alice and Bob, the influence of the width of the rejection zones is small; however, the number L of quantizations should not be too high, preferably less than or equal to 8, preferably max. 4, his.

[52] Larger L can be chosen for high SNR values. However, since the rejection probability increases with increasing L, the rejection zone should be sufficiently small depending on the coherence time.

Claims

Claims:

A method of negotiating an encrypted near-field wireless connection between two of each other

spaced devices (A, B), each having a transmitting and a receiving unit,

characterized in that

the transmission units of the devices (A, B) each generate a transmission signal of the same frequency with a random phase (φ _Α , φ _Β ),

- That in the other device (B, A) with a frequency-specific and distance-dependent

Phase rotation (φ ₀ ) and an error as a received signal with the phase (φ _Β + φο, ΦΑ + φο) is registered,

- to which the phase (φ _Α , Φ _Β ) of their own

Transmit signal to phase sums

+ ΦΒ + ΦΟ) is added,

- where the phase sums (Q _Ar Θ _β ) in the signal space, which is quantized in L in each case similar levels,

- assigned to the individual levels and encoded into symbols.

2. The method according to claim 1, characterized in that the symbols are represented by two N = log ² L bit sequences.

3. The method according to claim 1 or 2, characterized in that the transmitting units of the two devices (A, B) have no common time synchronization.

4. The method according to any one of the preceding claims,

characterized in that M frequency different

Transmission signals are exchanged in pairs.

5. The method according to claim 4, characterized in that the frequency-different transmission signals at the same time

be replaced.

6. The method according to any one of the preceding claims, characterized in that one or more symbols each form part of the final key (Θ), wherein the entire final key (Θ) is generated iteratively.

7. The method according to any one of the preceding claims,

characterized in that the devices (A, B) each transmit a transmission signal as a reference signal and another transmission signal with a different frequency, wherein the random phases (φ _Α , φ _Β ) are transmitted as differential relative phases between the transmission signals.

8. The method according to claim 7, characterized in that the reference signal and a plurality of further transmit signals form a common Sendesignalsat z, in a

narrowband frequency corridor lies.

9. The method according to any one of the preceding claims,

characterized in that determined phase sums (Q _Ar Θ _Β ) are discarded if their value falls within rejection zones (Δψ) formed by a boundary between two quantized levels (L), and then optionally generating new phase sums.

10. Device (A, B) for carrying out a method according to one of the preceding claims.