IEEE Solid-States Circuits Magazine - Fall 2020 - 67

operating in the radio-frequency (RF)to-terahertz spectrum. To illustrate
an example physical-layer attack sur-
face analysis, we discuss two of these
hardware solutions in detail: 1) pro-
tecting against a time- and modula-
tion-based attack targeting selective
jamming of low-power IoT communi-
cations and 2) another attack scenar-
io exploiting authentication protocol
weaknesses for disrupting the opera-
tion of an on-demand drug delivery
system using an implantable medical
device (IMD).

Rapid Bit-Level Frequency
-Hopping with Physical-Layer
Data Encryption
The most common protocol for lowpower and short-distance commu-
nications is Bluetooth low energy
(BLE). Data security in BLE networks
has a number of goals, including
both maintaining the privacy of the
data and ensuring a reliable link. It is
well accepted that strong encryption
schemes can provide privacy guar-
antees on the content of packets at
higher layers of the protocol stack.
Instead, this work is aimed at the sec-
ond goal of maintaining a robust link
in the face of physical-layer attacks.
Specifically, a selective jamming deni-
al-of-service attack is addressed.

Threat Model
In this threat model, the adversary
corrupts messages transmitted by a

single victim. Selective jamming is
particularly challenging, as it con-
ceals the attacker's presence, con-
trary to broadband-wireless jamming
[5]. Further, a selective jammer can
overwrite individual bits in a packet.
This BLE vulnerability to selective
jamming and selective overwriting
is due to both long dwell times in a
channel exploited in a time-based
attack and individual bit location pre-
dictability exploited in a modulationbased attack, respectively.
Researchers demonstrated an
example selective jamming attack
against a commercial BLE fitness de-
vice using the demo setup shown in
Figure 1. The board on the left of the
selective jammer system is a Texas
Instruments (TI) CC2541EM operating
as a packet sniffer, while the board on
the right is the transmitter (Tx) from
[7] operating as a selective jammer
trigger by the sniffer only for specific
targeted packets. Once the jammer
is enabled, the phone no longer dis-
plays the fitness band as a connect-
able device, whereas the headphones
continue to be connectable without
interruption. The advertising packets
received by a commercial receiver
are shown in Figure 1, where the fit-
ness device packets are corrupted
with cyclic redundancy check (CRC)
errors (red box), while the BLE head-
phone packets have no CRC errors
(blue box) and continue their com-
munication with no interruption [6].

Selective Jammer
System

Time- and modulation-based vulner-
abilities of current BLE Txs leveraged
by an adversary in this selectivejamming attack demo are discussed
in the following.

Time-Based Attack
Existing BLE Txs employ conven-
tional packet-level frequency hop-
ping (FH) [8] by sending the data
packet on a single 1-MHz frequency
channel with a slow hop period of
612 ns, as illustrated in Figure 2. In
contrast, an attacker needs only a
single 1-ns bit period to localize the
channel. This localization time is
inversely proportional to the chan-
nel bandwidth, e.g., 1-MHz chan-
nels. After localizing the channel
in a very short time, the attacker
has the rest of the slow hop period
of 612 ns to jam the remainder of
the packet.

Modulation-Based Attack
Current BLE Txs leak their individual
bit locations and frequency-hopping
sequence. Individual bit location
is predictable due to the choice of
modulation scheme with a fixed car-
rier offset, such as the BLE Gaussian
frequency shift keying (GFSK) mod-
ulation, with ±250 kHz for bit 1 and
bit 0 depicted in Figure 3. A fixed
carrier offset permits the attacker
to selectively overwrite individual
bits in a packet once the carrier fre-
quency is localized. The attacker

Packets From the BLE Headphone With No Errors

BLE
Receiver

Packets From the BLE Fitness Device With CRC Errors

Commercial BLE
Txs
(a)

(b)

FIGURE 1: The selective jamming denial-of-service attack demonstration setup [6]. (a) The demonstration system and (b) The physical-layer attack:
selective jamming. FCE: frame check sequence error; AdvA: advertisement address; FCS: frame check sequence; AdvData: advertisement data.

IEEE SOLID-STATE CIRCUITS MAGAZINE

FA L L 2 0 2 0

IEEE Solid-States Circuits Magazine - Fall 2020

Table of Contents for the Digital Edition of IEEE Solid-States Circuits Magazine - Fall 2020