Ensure an RF message received is from a legitimate source? - Page 1
Forum section: electronics / general

author: AcHmed99
author_rank: Contributor
timestamp: May 09, 2016, 06:04:40 pm
content: What I have is some nrf24l01 modules and I want to control steppers for exterior security cams. I’m not protecting the louvre or fort Knox, just my own property. The most likely possibility is someone close by sending bogus step and direction messages to the cameras. I don't really care if someone can see and read the commands just that no-one can send it bogus commands.From some research I’m guessing what I need is message authentication? I’m looking at maybe, this chiphttp://www.digikey.ca/product-detail/en/atmel/ATSHA204A-MAHDA-T/ATSHA204A-MAHDA-TCT-ND/4814553Are there any other ones more suitable, with more detailed examples closer to what I’m after?I haven’t decided on a micro yet either PIC16F171X or a PSOC M0 mainly because those are what I have on hand and am most familiar with.

author: 6thimage
author_rank: Regular Contributor
timestamp: May 09, 2016, 08:23:37 pm
content: Whilst you can use an additional chip, you could always use the microcontroller to do the authentication. Although, I would probably use encryption, with a set key on each device (kind of like wifi's WEP and WPA2 with a pre-shared key). A cortex m0 should be beefy enough to encrypt and decrypt messages with most encryption algorithms, but if you need to use long messages then there might be some noticeable latency. A quick google brought up this app note on AES encryption for the PIC16http://ww1.microchip.com/downloads/en/AppNotes/00821a.pdf,so it should be possible with a PIC as well.If you are after a software encryption library for a microcontroller, I'd take a look at mbed tls (https://tls.mbed.org/) - it used to be polar ssl and has tonnes of features and is licensed under the apache 2 license.One important thing to remember is to include a nonce in your message, otherwise someone could just replay the messages to control your cameras (I'd probably go a little overboard and add RTCs to each camera and then a validity time for each message as well as a nonce).

author: nctnico
author_rank: Super Contributor
timestamp: May 09, 2016, 08:33:59 pm
content: You don't need to encrypt the messages. Signing them so the source can be verified is enough. You can use SHA1 or SHA256 hashing algorithms and a limited lifetime of a message to prevent replay attacks. Most micros are beefy enough to do hashing but a Cortex M0 with a few kB of RAM will have it easier and due to the 32 bit architecture it will be much easier (no effort at all) to use readily available source code.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: May 09, 2016, 08:57:39 pm
content: Lots of options. It's a sliding scale-- well, a chunky one, not really smoothly sliding, but there are more than enough approaches.Trivial: use signal pulses (usually of specific frequencies) to activate specific functions. This is literally 1900s tech. Con: sensitive to interference. Such a setup would probably bounce around erratically, just sitting there. Obviously, easy to manipulate with, well, a signal generator and an amplifier, really.The radio module probably isn'tthisbasic, so as far as digital:You can do it on the link layer. FHSS or CDMA is more-or-less this sort of thing: if the hops or codes only match a particular sequence, only that sequence will be decoded; anything else is noise and discarded. Possibly the radio does this already. And possibly can be programmed for a new key I don't know, I haven't looked at it, at all.You can do it on the data layer. I'm guessing this is what you're after. The most basic here might be, a packet composed of a command or ID word, some data, and a checksum (well, even more basic without a checksum, but you want at least a little sanity). This will almost never respond to ambient noise, and the worst an unsophisticated attacker can do is jam your signal by brute force. But, it is easy to figure out, since the ID or command segments never vary, or only vary between a small set of options.Next up is encryption. Maybe you still have a "plain text" preamble, just to show that the packet is more or less intended for the device. But the rest is just "noise". You generate "noise" by encrypting the remainder of the packet with a key, that is only known to the transmitter and receiver.You can also add error correction methods (which may be internal to the radio, too), which have the effect of scrambling the data (so a bit-level inspection wouldn't be very helpful), but don't provide much security otherwise (indeed, multiple bit-flips map to the same message, hence the error correcting property; in a sense, it's less secure, because more inputs map to valid command messages; though not nearly enough to be a problem).Tim

author: hans
author_rank: Super Contributor
timestamp: May 09, 2016, 09:50:14 pm
content: Crypto or hashing are probably valid options. Hashing if you don't care the message contents are public, crypto if you do.In terms of speed, I would straight up skip the PIC16.Even a PIC24 will struggle to decrypt 16-byte blocks of AES128-CBC, it takes ~1ms at 8MIPS per 16 byte block using a very popularC implementation. In contrast; a KL05Z @ 48MHz with Mbed compiler does that in ~0.4ms. Even faster is a micro with hardware crypto module, e.g. I am working now on an EFM32GG chip that does it <5us@ 48MHz (including software overhead), those speeds are very common..I agree with 6thimage that a nonce is important, so a message with the same contents will never result in the same cipher text. This means the resulting data stream is pure garbage/noise for an attacker. Practically for AES I think, you should send a new random IV on every message with data you want to transmit. Lifetime is also nice, but requires timestamps on both sides.However, I would like to add, I am no expert in this field, and it's very easy to get burned by crypto because 1 minor detail.Also any RF jammer for 2.4GHz (which burglars may carry) will shut off communication anyway. If that is a problem, use wired installations instead.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 09, 2016, 10:08:08 pm
content: How is the data coming back from the cameras ? Could commands not be sent back via the same path?How are they powered? Could instructions not be sent via the same cabling?

author: AF6LJ
author_rank: Unknown
timestamp: May 09, 2016, 10:20:12 pm
content: Maybe it is just me; but I think this is overkill for a less than 1% probability problem.Just use straight FM radios, take a 16 button touch tone encoder, and change the clock crystal.Now you have custom tones and assign each camera a number and use the same four tones to move the cameras.

author: 6thimage
author_rank: Regular Contributor
timestamp: May 09, 2016, 10:27:48 pm
content: Quote from: hans on May 09, 2016, 09:50:14 pm1 ms for a 16 byte block is fairly slow, but it might just be usable.Quote from: hans on May 09, 2016, 09:50:14 pmAnd reasonably accurate clocks, which essentially means you need to either have RTCs or an authenticated time protocol - its nice, but is quite a bit more complex.Quote from: hans on May 09, 2016, 09:50:14 pmChances are small errors are not going to be a massive issue - as it isn't a commercial product. But still, it's better to do it right, which essentially means use an available crypto library rather than rolling your own. It's always fun to bring up the original xbox whenever cryptography errors are mentioned - Microsoft's development team made a few silly errors, which meant they might as well have not bothered putting any security on the original xbox.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 09, 2016, 10:38:31 pm
content: For a 1-off job like this, maybe a simple answer is to just have a one-time pad at each end, with a sufficiently long roll-around period to make snooping impractical.

author: 6thimage
author_rank: Regular Contributor
timestamp: May 09, 2016, 11:55:54 pm
content: Quote from: AcHmed99 on May 09, 2016, 11:03:11 pmWouldn't a much simpler solution be to use a raspberry pi (or beaglebone / other small sbc) wired directly to the stepper motors and then control the stepper motors from a very simple website running on the pi (or alternative). That way, you will be able to control it from a smartphone or tablet anywhere on your property (as long as your wifi reaches) and you don't have to worry about security (assuming you don't have an open wifi).Quote from: AcHmed99 on May 09, 2016, 11:16:27 pmWow ... nut is putting it nicely

author: uncle_bob
author_rank: Unknown
timestamp: May 10, 2016, 01:03:47 am
content: Quote from: AcHmed99 on May 09, 2016, 11:16:27 pmHiHere would be my concern:Any RF link can be taken out by jamming. If the control system to the cameras goes out, you effectively loose the function of the cameras. I would say it is more likely the neighbor kid builds a jammer than he goes to the trouble of working out the command set.Bob

author: Mechatrommer
author_rank: Super Contributor
timestamp: May 10, 2016, 03:43:57 am
content: if resources is too limited, make your own encryption/checksum/protocol scheme... not the best but better than plain ascii... the xor... remember the xor?Quote from: uncle_bob on May 10, 2016, 01:03:47 amuse "manual" frequency hopping, one at mhz range one at ghz, the kid will need to rent military grade jammer, unless he know what range you are working on.

author: Alex Eisenhut
author_rank: Super Contributor
timestamp: May 10, 2016, 04:14:30 am
content: Hobby DSM2 stuff?

author: CJay
author_rank: Super Contributor
timestamp: May 10, 2016, 07:00:47 am
content: Quote from: mikeselectricstuff on May 09, 2016, 10:08:08 pmI'd go for that approach too, there are plenty of examples out there using 'simple' op-amp circuits to superimpose bi-directional command channels on video signals over coax and twisted pair.Seems a lot of effort for a home project where the likelihood of it being hacked is very low and there are already multiple proven solutions out there.

author: Cerebus
author_rank: Super Contributor
timestamp: May 10, 2016, 11:13:43 pm
content: What you're looking for is a Message Authentication Code or MAC.HMAC is simple, secure, easy to implement and not computationally intensive. See RFC2104 (https://tools.ietf.org/html/rfc2104) for a description. It combines your message and a secret key into a short authentication code that you can't, for all practical purposes, recreate without the secret key. The usual cryptographic caveats apply - your secret key needs to be long enough and genuinely random for good security.If you search around you should find dozens of implementations of HMAC you can use if you don't want to rewrite the code yourself. Don't use HMAC-MD5 as the MD5 hash algorithm is regarded as deprecated. Use one of the HMAC-SHA-2 variants, HMAC-SHA256 should be more than secure enough for your needs.

author: Len
author_rank: Frequent Contributor
timestamp: May 11, 2016, 12:52:09 am
content: Quote from: uncle_bob on May 10, 2016, 01:03:47 amExactly right. Plus, it sounds like you have multiple cameras, how do you plan to control them from a single remote?It sounds like you’d want a central controller for the cameras, in which case you can use the same cabling for control and video. And your remote (likely your phone) just talks to the control PC. It’s easier to secure that link, you probably already have wifi that your neighbour hasn’t hacked into (yet). Jamming would only disable your remote control, not the whole system.

author: uncle_bob
author_rank: Unknown
timestamp: May 12, 2016, 12:39:46 am
content: Quote from: AcHmed99 on May 11, 2016, 02:43:46 amHiBy far the most easy "kid level" jammer is a broadband noise source and a directional antenna. The antenna is a zero effort item (click on Amazon). The noise source isn't that much harder to do. Point it at a camera .... gee ... the camera stops moving. No impact to other devices unless they are inside the "cone" of the narrow beam width antenna. Even back when I was that age ... not very hard to do. Do *not* ask how I know this ...Bob