Ranking-based attacks to in-region location verification systems

In-region location verification (IRLV) aims at securely verifying that a wireless device is in a given region of interest (ROI), e.g., an authorized area where specific services can be provided. We consider an IRLV system that verifies the position through the estimated attenuations of the wireless channels connecting the device to the access points (APs) of the IRLV network. We propose techniques that can be used by an attacker located outside the ROI in order to break the IRLV system and let the network believe that he is inside the ROI. This is achieved either by transmitting from positions outside the ROI exhibiting wireless channel characteristics similar to inner positions (passive attack), or by directly inducing desired estimated channel attenuations at the APs, i.e., suitably transmitting signals with multiple antennas (active attacks). In both cases, we aim at minimizing the number of attack attempts before the first successful attack. To this end we consider ranking solutions based on machine learning (ML), where the attacker ranks random candidate attacks according to metrics related their success, and then performs attacks according to the ranking.