# On Improving 5G Internet of Radio Light Security Based on LED Fingerprint Identification Method
## 2 LED Fingerprint Verification Mechanism
### Envisioned Applications for the IoRL Security Framework  
The threat that we would like to mitigate with the proposed LED fingerprinting method is as follows. The rogue device is a device placed by the attacker, which due to, e.g., a stronger signal, can lure users to connect to it and intercept valuable, confidential data send by the tricked users. Further in this paragraph we present how LED fingerprinting could be used in real-life systems. As an exemplary test system, we choose IoRL project [32]. The main subsystems of the IoRL system are optical RAN, UEs (User Equipment) and Intelligent Home IP Gateway (IHIPG). In the IHIPG, there is an OpenStack environment with SDN (Software Defined Network) which hosts various VNFs (Virtual Network Functions), for example, for security purposes. An example of the device that can be susceptible to such kind of attack is a LED device in the IoRL system. In effect, UE (User Equipment) receives data from the attacker's LED, which, for example, could lead to installation of malware on it. Thus, the security system should detect such a situation and react accordingly. As already mentioned in the previous section, in this scenario we assume that during the registration phase before installation each new LED is tested in the laboratory environment. Its fingerprint is extracted to create a sort of \"signature\" of the LED for further use in the next phases and stored in the security system's database enriched with the information where a given LED is physically installed.  
Then, during the rogue LED detection phase, the security system periodically polls UE (using specialized software/firmware at UE) to establish the LED characteristics (i.e., LED fingerprint). The extracted LED fingerprints are sent to the security system for evaluation. Using these fingerprints and localization information security system verifies whether the extracted fingerprint is consistent with the fingerprint registered. In the case when the attacker placed a rogue LED device, the extracted fingerprint should be inconsistent with the fingerprint of the LED placed in the security system database during the registration phase. As a result, if the attack is detected, the security system can block the traffic directed towards/outgoing from the LED (so exfiltration of the confidential data obtained by the attacker is possible), and the administrators can be notified about this incident.  
Figure 3 presents the main components used during the detection of rogue LED attacks. The main steps of the proposed detection mechanism are as follows:  
* Step 0: Register LED fingerprint and their localization database (this information is established and inserted to the database before LED installation)--the database is located at the security system.
* Step 1: A heartbeat-like protocol (UE <-> security subsystem) with which the security subsystem would be able to periodically poll the UE to initiate the LED fingerprint extraction process and securely transmit the determined fingerprint back to the security subsystem.
* Step 2: The measurement-based protocol (UE <-> LED) that would operate between the selected UE and the LED which would allow to determine the fingerprint of the LED under investigation.
* Step 3: The mechanism at the security subsystem that would compare the fingerprint of the chosen LED and its location with the corresponding data stored in the database.
* Step 4: In the case of a detected security breach, the security system can install rules on the SDN controller to block incoming/outgoing traffic to the LED and notify the administrators.