PowerKey: Generating Secret Keys from Power Line Electromagnetic Interferences

Abstract

With the increasing adoption of Internet-of-Things devices, autonomously securing device-to-device communications with minimal human efforts has become mandated. While recent studies have leveraged ambient signals (i.e., amplitude of voltage harmonics) in a building’s power networks to secure plugged IoT devices, a key limitation is that the exploited signals are consistent only among nearby outlets, thus resulting in a low key matching rate when devices are far from each other. In this paper, we propose $\mathsf {PowerKey}$ to generate secret keys for multiple plugged IoT devices in an electrical domain (e.g., a lab or an office suite). Concretely, $\mathsf {PowerKey}$ taps into ambient power line electromagnetic interferences (EMI): there exist multiple spatially unique EMI spikes whose frequencies vary randomly but also remain consistent at participating power outlets to which IoT devices are connected. We propose K-means clustering to locate common EMI spikes offline at participating outlets and then dynamically extract secret keys at runtime. For evaluation, we conduct experiments in two different locations—one research lab and one suite with multiple rooms. We show that with $\mathsf {PowerKey}$, multiple devices can successfully obtain symmetric secret keys in a robust and reasonably fast manner (i.e., 100% successful at a bit generation rate of up to 52.7 bits/sec).

This work was supported in part by the NSF under grant ECCS-1610471.

Appendix

Experiment Setup. We conduct experiments in two different trust domains—an office suite with multiple individual rooms (Fig. 8(a)) and a research lab (Fig. 8(b)).

Fig. 8.

(a) Layout of the office. (b) Layout of the lab.

Analysis of EMI Spike Frequencies in the Office Suite. We show the histograms of the 8 independent EMI spike frequencies and the frequency differences at two outlets in Fig. 9 and Fig. 10, respectively. We see that the two outlets share certain time-varying EMI spike frequencies with only minor differences.

Fig. 9.

Histogram of 8 different EMI spike frequencies in the office suite.

Fig. 10.

Distribution of frequency differences between two outlets for 8 different EMI spike frequencies in the office suite. “S-n” means the n-the EMI spike. $\sigma =1,1,1,1,1,4,1,1$ Hz for the 8 EMI spike windows, respectively.

Results for Key Generation in the Lab. We now run experiments in a lab with 20+ desktops shown in Fig. 8(b).

Analysis of EMI Spike Frequencies. After offline pre-processing, $\mathsf {PowerKey}$ identifies a total of 11 EMI spikes for the lab. Then, as shown in correlation analysis in Fig. 11(a), 8 of the 11 spikes are uncorrelated, while the remaining ones are redundant and need to be removed.

Fig. 11.

(a) Correlation coefficients of EMI spike frequencies in the lab. (b) Key matching rate for four devices in the lab.

Key Generation Performance. We show the key generation performance for the lab. The main results are deferred to Fig. 12. We can see that in terms of all the evaluation metrics, the performance of $\mathsf {PowerKey}$ is consistent with that in the office setting. Likewise, the attacker can barely obtain secret keys successfully, with a high bit error rate and practically zero key matching rate.

Fig. 12.

Performance of $\mathsf {PowerKey}$ in the lab.

Multiple Devices. Next, we consider four devices associated with four outlets in Fig. 8(b). Our results in Fig. 11(b) show that with an appropriate quantization and ECC scheme, $\mathsf {PowerKey}$ can still generate secret keys with a negligible bit error rate and almost 100% key matching rate, demonstrating its reliable key generation.