mirror of
https://github.com/ruvnet/RuView
synced 2026-08-11 20:41:44 +00:00
Claude
16b2a629d1
VEIL (Verifiable Emission-shaping for Identity-Leakage prevention) is the countermeasure counterpart to BFLD (ADR-118/121): where BFLD detects when beamforming feedback becomes identifying, VEIL shapes a node's own outgoing feedback so an unauthorized passive sniffer cannot re-identify people, while a legitimate receiver that shares the per-session key sees an unchanged link. Mechanism: identity leaks through the fine cross-subcarrier phase structure of a compressed beamforming report; throughput rides the dominant beam direction. These are (mostly) separable subspaces. VEIL composes extra keyed Givens rotations (the report's native primitive) over the fine subspace only. The rotation is orthogonal (energy-preserving -> not jamming), keyed per session (the AP inverts it -> throughput preserved), and fresh each session (a sniffer cannot average it back -> re-identification collapses to chance). Contents: - v2/crates/wifi-densepose-privshield: deterministic, dependency-free, WASM-ready pure-compute leaf implementing the attacker-vs-protector experiment, the four compliant controls, a throughput model, a machine-checkable "not jamming" compliance audit, and a pinned witness. 29 tests + doctest pass; clippy -D warnings clean; builds for wasm32-unknown-unknown. - docs/research/privacy-shield: 8-file research bundle (SOTA, threat model, design, compliance/regulatory, experiment protocol, market, roadmap). - docs/adr/ADR-288: formal decision record. Reference results (SYNTHETIC / L0, N=16 identities): passive re-ID accuracy 100% shield-off -> 7.8% shield-on (chance 6.25%); modeled throughput ratio 98.0%; emission energy ratio 1.000000 (compliant). All defense numbers are SYNTHETIC until a two-node hardware capture with a witness exists. Compliant waveform controls only; never jamming (47 U.S.C. 333/302a analysis in the bundle). Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01WEXNqzs7UsfNFBcP5yW21p
142 lines
9.2 KiB
Markdown
142 lines
9.2 KiB
Markdown
# 01 — State of the Art
|
||
|
||
Scope: what a passive or active adversary can extract about *who* is in a space
|
||
and *what they are doing* from WiFi, the standard that broadens that surface, and
|
||
the countermeasures that try to prevent it. Claims are tagged **MEASURED** (from
|
||
a primary source, with metric), **CLAIMED** (asserted without an independent
|
||
measurement), or analytical inference (flagged).
|
||
|
||
---
|
||
|
||
## 1. The attack surface: beamforming feedback (BFI)
|
||
|
||
Since WiFi 5 (802.11ac), a client (beamformee) measures the downlink channel,
|
||
compresses the steering matrix **V** into **Givens-rotation angles φ/ψ**, and
|
||
transmits them **in cleartext** so the AP can steer beams. Anyone in monitor
|
||
mode can capture these frames for *every* client simultaneously — no network
|
||
access, and the target need carry no device. Quantization is coarse (802.11ac
|
||
angle steps of π/4…π/32 rad) yet retains rich motion and body information.
|
||
|
||
| Work | Venue / year | Result | Label |
|
||
|---|---|---|---|
|
||
| **BFId** — identity inference from BFI | ACM CCS 2025 (KIT/KASTEL) | Re-identifies individuals from BFI alone; novel 197-person dataset. Press reports **99.5%** in a controlled study (ACM full text was not openable to confirm class count/split) | MEASURED (paper); 99.5% is CLAIMED via press |
|
||
| **LeakyBeam** — occupancy through walls | NDSS 2025 | Occupancy detection **TPR 82.7% / TNR 96.7%** at **20 m, through walls**, from plaintext BFI. Proposes a BFI-obfuscation defense | MEASURED (attack); defense overhead CLAIMED |
|
||
| **BFIAttack** — CSI reconstruction from BFI | arXiv 2026 (USF) | Reconstructs CSI from BFI, then defeats CSI defenses. ASR: device auth 95.5% / user auth 92.6% / key-gen 94.2% (single-antenna), 1.5–6 m | MEASURED |
|
||
| **BeamSense** — activity recognition from BFI | Computer Networks vol. 258, 2025 (Northeastern) | Human activity recognition **up to 99.28%** on commodity 802.11ac, no firmware mod, ~10% better than CSI | MEASURED |
|
||
| **Wi-BFI** — capture tooling | arXiv 2309.04408, 2023 | Pip-installable extraction of 802.11 BFI from commercial devices | tooling |
|
||
|
||
**Takeaway for the defender.** BFI is the highest-leverage surface: unencrypted,
|
||
management-plane, device-free, capturable en masse with off-the-shelf tools. It
|
||
is also a *stepping stone* — BFIAttack shows BFI can reconstruct the CSI that all
|
||
older attacks assume.
|
||
|
||
---
|
||
|
||
## 2. The older adjacent surface: CSI identity/gait/activity
|
||
|
||
CSI requires special extraction (Intel 5300 / Atheros / ESP32) but is the
|
||
foundation the BFI attacks build on. Person-ID exploits **gait** as a biometric.
|
||
Representative MEASURED results (commodity WiFi, CSI amplitude):
|
||
|
||
| System | Accuracy | N (candidates) | Note |
|
||
|---|---|---|---|
|
||
| WiWho (IPSN 2016) | 92%→80% | 2→6 | 2–3 m straight walk |
|
||
| WiFi-ID (2016) | 93%→77% | 2→6 | wavelet features |
|
||
| WiPIN (2018) | 92–100% | ≤30 | operation-free |
|
||
| Deep-WiID (2019) | 92.5–99.7% | 6→15 | GRU |
|
||
| WiNet / LWID (2020) | 98.5% / 98.8% | 40 / 50 | CNN |
|
||
|
||
**Pattern the defender must exploit and not overstate:** accuracy is high in
|
||
small closed sets but *degrades as N grows and conditions become realistic*
|
||
(cross-day, cross-location, cross-walking-style). Chance is **1/N**; a 99% result
|
||
on N=5 is far weaker evidence than 99% on N=197. Open-world scale is largely
|
||
unproven (see *SoK: Security Evaluation of Wi-Fi CSI Biometrics*, 2025).
|
||
|
||
---
|
||
|
||
## 3. The standard: IEEE 802.11bf-2025
|
||
|
||
IEEE Std **802.11bf-2025** (Amendment 4: *Enhancements for WLAN Sensing*) was
|
||
published **26 September 2025**. It standardizes WLAN sensing in 1–7.125 GHz and
|
||
above 45 GHz, defining sensing capability signaling, measurement/sounding
|
||
setup, feedback types, and both passive (ambient-traffic) and active
|
||
(dedicated null-packet) sensing modes.
|
||
|
||
- **Attack-surface implication (analytical).** 802.11bf turns CSI/measurement
|
||
acquisition from proprietary hacks into open, vendor-agnostic, machine-readable
|
||
MAC signaling across heterogeneous devices — institutionalizing exactly the
|
||
measurements the BFI attacks abuse. The standard frames sensing as a feature,
|
||
not a threat.
|
||
- **The privacy gap (MEASURED from standards minutes).** A 2023 proposal for a
|
||
BFI "secure transmission mechanism" (IEEE 802.11-23/0782) was **withdrawn**;
|
||
"the group did not align on the characterization of [the] privacy problem."
|
||
The standard shipped without privacy protections, and its own analysis admits
|
||
passive eavesdroppers can extract location, respiration, heart rate, and
|
||
identity.
|
||
|
||
---
|
||
|
||
## 4. Countermeasures (the defense literature)
|
||
|
||
All operate on the defender's *own* transmissions; none are jamming.
|
||
|
||
| Countermeasure | Venue / year | Mechanism | Effect | Label |
|
||
|---|---|---|---|---|
|
||
| **IRShield** | IEEE S&P 2022 | IRS/reconfigurable surface randomizes reflected paths | Attacker motion-detection **≤5%** | MEASURED |
|
||
| **PhyCloak** | USENIX NSDI 2016 | Full-duplex obfuscator injects Doppler/phase distortion into sensing only | **88.69%** gesture-spoof; throughput can rise (whitelist legit sensors) | MEASURED (spoof); throughput CLAIMED |
|
||
| **DP-Givens dithering** | IEEE DySPAN 2026 | Differentially-private stochastic quantization of BFI φ/ψ angles | Attacker speed-class error 19%→~73% (chance); **fine (3-bit) resolution ≈ non-private baseline throughput** | MEASURED |
|
||
| **MIMOCrypt / WiShield** | 2023 / IEEE JSAC 2024 | Secret precoding / MIMO CSI manipulation so only the intended RX decodes | Anti-tracking | CLAIMED/formal |
|
||
| **CSI Fuzzing / DP feature release** | IEEE 2024–25 | Randomized CSI features with DP budget | Formal DP guarantee | CLAIMED/formal |
|
||
| **ScatterShield** | ACM IMWUT 2025 | Backscatter tags inject controlled clutter | Defeats unauthorized sensing | MEASURED |
|
||
| **Adversarial packet perturbation** | ACM MobiCom 2024 | Small in-spec packet perturbations degrade attacker model | Symmetric defense | MEASURED |
|
||
|
||
**The fundamental tradeoff (MEASURED, DySPAN 2026).** Perturbing precoding/
|
||
feedback that an attacker exploits also degrades legitimate beamforming gain —
|
||
*but the cost collapses at fine feedback resolution*:
|
||
|
||
| Randomization | Attacker error | Beamforming gain retained |
|
||
|---|---|---|
|
||
| none | 19% | 100% |
|
||
| moderate (p=0.3) | >50% | median >90% |
|
||
| maximum (p≥0.9) | ~73% (≈chance) | median ~58% |
|
||
|
||
At **high (3-bit) feedback resolution, privacy was "nearly indistinguishable
|
||
from the non-private baseline"** in link performance. This is the empirical basis
|
||
for VEIL's design choice (compliant fine-resolution feedback shaping — see
|
||
[03-countermeasure-design.md](03-countermeasure-design.md)).
|
||
|
||
---
|
||
|
||
## 5. Where VEIL sits
|
||
|
||
The literature has two families: **external** obfuscation (IRShield/ScatterShield
|
||
— extra hardware, perturbs the channel) and **transmitter-side** feedback/precoder
|
||
shaping (DP-Givens, MIMOCrypt — no extra hardware, perturbs your own report).
|
||
VEIL is in the second family and adds the missing property the others do not all
|
||
combine: a transform that is simultaneously **energy-preserving** (provably
|
||
compliant), **key-reversible** (throughput-preserving for the legitimate link),
|
||
and **session-fresh** (defeats cross-session re-identification), unified around
|
||
the Givens-rotation primitive the report already uses.
|
||
|
||
---
|
||
|
||
## Sources
|
||
|
||
- BFId — ACM CCS 2025: https://dl.acm.org/doi/10.1145/3719027.3765062 · KIT record: https://publikationen.bibliothek.kit.edu/1000185756
|
||
- LeakyBeam — NDSS 2025: https://www.ndss-symposium.org/ndss-paper/lend-me-your-beam-privacy-implications-of-plaintext-beamforming-feedback-in-wifi/
|
||
- BFIAttack — arXiv 2604.04179: https://arxiv.org/html/2604.04179v1
|
||
- BeamSense — Computer Networks 2025: https://dl.acm.org/doi/10.1016/j.comnet.2024.111020 · arXiv 2303.09687: https://arxiv.org/pdf/2303.09687
|
||
- Wi-BFI — arXiv 2309.04408: https://arxiv.org/pdf/2309.04408
|
||
- SoK: Security Evaluation of Wi-Fi CSI Biometrics — arXiv 2511.11381: https://arxiv.org/pdf/2511.11381
|
||
- WiWho (IPSN 2016): https://dl.acm.org/doi/10.5555/2959355.2959359 · WiPIN — arXiv 1810.04106: https://arxiv.org/pdf/1810.04106
|
||
- Survey on Wi-Fi Sensing for Human Identity — MDPI Electronics 2023: https://www.mdpi.com/2079-9292/12/23/4858
|
||
- IEEE Std 802.11bf-2025: https://standards.ieee.org/ieee/802.11bf/11574/ · Overview — IEEE COMST 2024: https://ieeexplore.ieee.org/document/10547188/ · NIST: https://www.nist.gov/publications/ieee-80211bf-enabling-widespread-adoption-wi-fi-sensing
|
||
- 802.11bf privacy proposal withdrawal (802.11-23/0782), summarized: https://pascalpiron.substack.com/p/wifi-sensing-and-the-privacy-fix
|
||
- IRShield — IEEE S&P 2022 / arXiv 2112.01967: https://arxiv.org/abs/2112.01967 · https://ieeexplore.ieee.org/document/9833676/
|
||
- PhyCloak — USENIX NSDI 2016: https://www.usenix.org/conference/nsdi16/technical-sessions/presentation/qiao
|
||
- Protecting Human Activity Signatures in Compressed 802.11 CSI Feedback — DySPAN 2026 / arXiv 2512.18529: https://arxiv.org/abs/2512.18529
|
||
- MIMOCrypt — arXiv 2309.00250: https://arxiv.org/pdf/2309.00250 · WiShield — IEEE JSAC 2024: https://dl.acm.org/doi/abs/10.1109/JSAC.2024.3414597
|
||
- ScatterShield — ACM IMWUT 2025: https://dl.acm.org/doi/abs/10.1145/3770653
|
||
- Practical Adversarial Attack on WiFi Sensing — ACM MobiCom 2024: https://dx.doi.org/10.1145/3636534.3649367
|
||
- Privacy-Preserving Wi-Fi Data Generation via DP — INFOCOM 2025: https://www.eng.auburn.edu/~szm0001/papers/INFOCOM25.pdf
|