SecBeam: Securing mmWave Beam Alignment Against Beam-Stealing Attacks

Millimeter wave (mmWave) communications employ narrow-beam directional transmissions to compensate for the high path loss. The beam alignment process is crucial to establishing a mmWave communication link and maximizing the link quality. However, existing beam alignment protocols employ unauthenticated beacons to discover the best direction, allowing adversaries to launch active beam-stealing attacks by injecting forged beacons of high power, forcing the legitimate devices to beamform toward the adversary's direction. Once beams align with the adversary, she fully controls the communication link between the victim devices, thus breaking the false sense of security given by the transmission directionality.In this paper, we demonstrate the feasibility of beam-stealing attacks against the beam alignment process employed in wireless standards and the state-of-the-art improvements in the literature. We propose an active amplify-and-relay attack that can steer the victims' beams toward the adversary, even if beam-sweeping beacons are authenticated. Fundamentally, the main challenge lies in that the integrity of physical properties such as the signal-to-noise ratio used for beam selection cannot be validated, even if the beacons used to measure it are authentic. To counter beam-stealing attacks, we propose a novel beam-alignment protocol, SecBeam, that detects the AnR attack by validating physical properties of the RF environment which are difficult to manipulate. The basic idea is to use the power delay profile (PDP) to verify that a longer path has a higher path loss. We validate the security of SecBeam via extensive testbed experiments and simulations.