Security Assessment of Phase-Based Ranging Systems in a Multipath Environment

Phase-based ranging has been widely deployed in proximity detection scenarios including security-critical applications due to their low implementation complexity on existing transceivers. In this work, the security of multi-carrier phase-based ranging systems in a multipath propagation environment is investigated. We present a threat model that can successfully target any decreasing distance in different multipath environmental conditions rendering the phase-based ranging method insecure. We assess the feasibility of attacks in various attack scenarios through simulations using a multipath channel and demonstrate a simplified version of the attacker model implemented in hardware. We show that the attacker can spoof the measured distance to less than one meter when the devices are separated by 30 meters. The evaluation of possible countermeasures and their limitations for different threat models is performed.