[Paper Review] Hiding Data in Plain Sight: Undetectable Wireless Communications Through Pseudo-Noise Asymmetric Shift Keying

Salvatore D’Oro, Francesco Restuccia+1 more|arXiv (Cornell University)|May 6, 2019

Internet Traffic Analysis and Secure E-voting15 references4 citations

TL;DR

This paper proposes PN-ASK, a covert wireless communication scheme that embeds data by subtly shifting the amplitude of primary phase-modulated symbols (e.g., 8-PSK), making covert signals indistinguishable from channel noise. It achieves over 8x higher throughput than prior art and enables undetectable, high-rate covert transmission on standard WiFi frames without hardware modifications.

ABSTRACT

Undetectable wireless transmissions are fundamental to avoid eavesdroppers. To address this issue, wireless steganography hides covert information inside primary information by slightly modifying the transmitted waveform such that primary information will still be decodable, while covert information will be seen as noise by agnostic receivers. Since the addition of covert information inevitably decreases the SNR of the primary transmission, key challenges in wireless steganography are: i) to assess the impact of the covert channel on the primary channel as a function of different channel conditions; and ii) to make sure that the covert channel is undetectable. Existing approaches are protocol-specific, also we notice that existing wireless technologies rely on phase-keying modulations that in most cases do not use the channel up to its Shannon capacity. Therefore, the residual capacity can be leveraged to implement a wireless system based on a pseudo-noise asymmetric shift keying (PN-ASK) modulation, where covert symbols are mapped by shifting the amplitude of primary symbols. This way, covert information will be undetectable, since a receiver expecting phase-modulated symbols will see their shift in amplitude as an effect of channel/path loss degradation. We first investigate the SER of PN-ASK as a function of the channel; then, we find the optimal PN-ASK parameters that optimize primary and covert throughput under different channel condition. We evaluate the throughput performance and undetectability of PN-ASK through extensive simulations and on an experimental testbed based on USRP N210 software-defined radios. We show that PN-ASK improves the throughput by more than 8x with respect to prior art. Finally, we demonstrate through experiments that PN-ASK is able to transmit covert data on top of IEEE 802.11g frames, which are correctly decoded by an off-the-shelf laptop WiFi.

Motivation & Objective

• To address the critical need for undetectable wireless communications in environments with censorship or surveillance.
• To overcome limitations of existing protocol-specific steganographic techniques that degrade primary channel performance and lack generalizability.
• To exploit unused channel capacity in phase-modulated systems (e.g., BPSK, QPSK) by using amplitude variations for covert signaling.
• To mathematically analyze and optimize symbol error rate (SER) for both primary and covert channels under varying channel conditions.
• To demonstrate practical feasibility and high performance through software-defined radio experiments and real-world WiFi integration.

Proposed method

• Proposes pseudo-noise asymmetric shift keying (PN-ASK), where covert symbols are encoded by shifting the amplitude of primary phase-modulated symbols (e.g., 8-PSK) while preserving their phase.
• Models the symbol error rate (SER) of PN-ASK as a function of channel conditions, including path loss and SNR degradation due to covert transmission.
• Derives optimal PN-ASK parameters (e.g., number of covert symbol levels, amplitude shifts) to maximize primary and covert throughput under different SNR and path loss conditions.
• Implements PN-ASK on USRP N210 software-defined radios using GNU Radio, enabling real-time transmission and reception of both primary and covert data streams.
• Develops PN-ASK-WiFi, a variant that embeds covert data within standard IEEE 802.11g frames, compatible with off-the-shelf WiFi cards in monitor mode.
• Uses Wireshark and custom USRP-based receivers to validate correct decoding of primary frames and extraction of covert messages without altering standard WiFi hardware or firmware.

Experimental results

Research questions

• RQ1 How can covert data be embedded in primary wireless transmissions without degrading the primary channel’s reliability or detectability?
• RQ2 What is the optimal trade-off between primary and covert throughput under varying channel conditions, such as path loss and SNR?
• RQ3 Can PN-ASK achieve high covert throughput while remaining undetectable to receivers expecting only standard phase-modulated signals?
• RQ4 How does PN-ASK perform in real-world environments with interference and hardware limitations compared to prior steganographic methods?
• RQ5 To what extent can PN-ASK be integrated with widely deployed wireless standards like IEEE 802.11g without requiring hardware modifications?

Key findings

• PN-ASK achieves a covert throughput of approximately 1.5 Mbit/s on a 2.5 MHz channel, even under severe interference and with software-based DSP on USRP N210 radios.
• The system improves covert throughput by more than 8x compared to the state-of-the-art DTY-PSK method, with 6.28x and 8.37x gains in office and hall test environments, respectively.
• Primary frames are correctly decoded by standard off-the-shelf WiFi cards without any hardware or firmware modifications, confirming compatibility and transparency.
• Covert data remains undetectable because receivers expecting phase-modulated signals interpret amplitude shifts as normal channel fading or path loss effects.
• Mathematical analysis confirms that SER for both primary and covert channels is minimized when PN-ASK parameters are optimized for given SNR and path loss conditions.
• Experimental results show that PN-ASK is robust to real-world impairments such as multipath fading and ISM band interference, maintaining high performance across diverse settings.