Replay Attack Detection

The cornerstone of modern replay detection. A receiver continuously monitors the wireless channel's unique multipath profile—the combination of amplitude attenuation, phase shift, and delay spread caused by the physical environment. A replayed signal, even if perfectly recorded, will arrive through a different spatial path than the original, creating a measurable mismatch in the CSI. This technique exploits the principle that channel reciprocity is time-bound; the channel decorrelates rapidly in dynamic environments, making a delayed replay statistically distinguishable from a live transmission.

A cryptographic defense embedded within the protocol stack. Each legitimate transmission includes a monotonically increasing sequence number, a cryptographically secure nonce, or a precise timestamp synchronized between transmitter and receiver. The receiver maintains a sliding window of acceptable sequence numbers and rejects any message with a duplicate or expired value. This method is computationally lightweight but requires secure time synchronization and is vulnerable if the nonce space is exhausted or the clock drifts beyond tolerance.

Exploits the fact that a transmitter's local oscillator phase noise is a continuous, non-repeating stochastic process. A live signal exhibits a coherent, evolving phase trajectory dictated by the oscillator's physics. A recorded and replayed signal, however, introduces a phase discontinuity at the loop point or superimposes the attacker's own phase noise profile. By tracking the Allan variance or the instantaneous phase derivative, the receiver can detect the unnatural break in the noise process that signals a replay.

A challenge-response mechanism that verifies physical proximity, making a distant replay attacker detectable. The verifier sends a cryptographic challenge and measures the precise round-trip time (RTT) of the response. Because the speed of light is finite, a response that takes longer than the time equivalent of the maximum allowed distance is rejected. This defeats wormhole attacks and high-power replay attacks where an adversary captures a signal and retransmits it from a different location.

Focuses on the out-of-band spectral artifacts generated by a transmitter's power amplifier non-linearity. When a clean, digitally recorded signal is replayed through a different transmitter's analog front-end, the attacker's own power amplifier imposes its unique AM-AM and AM-PM distortion on the waveform. The resulting spectral regrowth pattern will be a convolution of the original and the attacker's impairments, creating a detectable mismatch against the expected clean profile or the legitimate transmitter's known signature.

Monitors the DC offset and I/Q imbalance of the transmitter over time. A legitimate transmitter's local oscillator leakage creates a stable or slowly drifting origin offset in the constellation diagram, governed by thermal physics. A replayed signal captured from a different device will exhibit a sudden jump in the DC offset or an I/Q gain/phase imbalance pattern that is inconsistent with the enrolled device's known slow drift trajectory, revealing the handover between the original and replaying hardware.

A location-bound authentication method that uses the unique multipath propagation characteristics of a wireless channel as a dynamic, unforgeable token. Because the physical environment between two points is unique and reciprocal, an attacker at a different location cannot reproduce the exact CSI. Key properties:

• Rapid decorrelation over distance (half-wavelength)
• Reciprocity in time-division duplex systems
• Used in 802.11n/ac/ax for fine-grained localization

CSI-based replay detection compares the estimated channel of a current transmission against a trusted baseline. A mismatch indicates a relayed or replayed signal from a different physical position.

A cryptographic defense that embeds a monotonically increasing counter or random nonce in each transmission. The receiver maintains a sliding window of acceptable sequence numbers and rejects any message with a duplicate or expired value. Implementation considerations:

• Synchronized clocks: Require secure time distribution (e.g., GPS-disciplined oscillators)
• Nonce size: Must be large enough to prevent birthday attacks (≥ 128 bits)
• Replay window: Balances security against network jitter tolerance

This method is effective against store-and-forward replay but fails if the attacker can manipulate timestamps or if clock synchronization is compromised.

A cryptographic challenge-response mechanism that places an upper bound on the physical distance between verifier and prover by measuring round-trip time with nanosecond precision. How it works:

• Verifier sends a rapid single-bit challenge
• Prover must respond within a tight temporal window
• Speed-of-light propagation enforces a maximum distance

An attacker attempting to relay or replay a signal introduces measurable latency that violates the distance bound. This defeats both mafia fraud (relay attacks) and terrorist fraud (colluding provers). Widely used in contactless payment and passive keyless entry systems.

A hardware security primitive that derives a unique, tamper-proof identifier from the inherent manufacturing variations in a device's analog radio front-end. Unlike stored keys, an RF-PUF cannot be read out or cloned. Replay defense application:

• Each transmission carries a PUF-derived authentication tag
• The tag is a function of the specific hardware path the signal traversed
• A recorded and replayed signal will fail PUF verification because the replay device's own impairments are superimposed

RF-PUFs bind authentication to the physical silicon, making even perfect bit-level replay detectable at the waveform level.

An interactive authentication protocol where the verifier issues an unpredictable challenge that the prover must cryptographically sign or transform. Freshness guarantees:

• Challenge is randomly generated per session
• Response is valid only for that specific challenge
• Prevents pre-computation and replay of old responses

In wireless replay detection, the challenge can be modulated onto a carrier, and the response must exhibit the correct hardware fingerprint. An attacker replaying a previous valid response will fail because the challenge has changed. This combines cryptographic freshness with physical-layer identity verification.