ACE: Adaptive channel estimation for detecting analog/RF trojans in WLAN transceivers

We propose a defense method capable of detecting hardware Trojans (HTs) in the analog/RF circuitry of wireless local area network (WLAN) transceivers. The proposed method, which is implemented on the receiver (RX) side and cannot be tampered with by the attacker, leverages the channel estimation capabilities present in Orthogonal Frequency Division Multiplexing (OFDM) systems. Specifically, it employs an adaptive approach to robustly isolate possible HT activity from channel and device noise, thereby exposing the Trojan's presence. The adaptive channel estimation (ACE) defense mechanism is put to the test using a HT which is implemented on a printed circuit board (PCB) and mounted on the Wireless Open-Access Research Platform (WARP). This HT, which is introduced through minute modifications in the power amplifier (PA), manipulates the transmission power characteristics of an 802.11a/g transmitter (TX) in order to leak sensitive data, such as the encryption key. Effectiveness of the proposed defense has been verified through experiments conducted in actual channel conditions, namely over-the-air and in the presence of interference.