  Millimeter wave (mmWave) communications employ narrow-beam directional
communications to compensate for the high path loss at mmWave frequencies.
Compared to their omnidirectional counterparts, an additional step of aligning
the transmitter's and receiver's antennas is required. In current standards
such as 802.11ad, this beam alignment process is implemented via an exhaustive
search through the horizontal plane known as beam sweeping. However, the beam
sweeping process is unauthenticated. As a result, an adversary, Mallory, can
launch an active beam-stealing attack by injecting forged beacons of high
power, forcing the legitimate devices to beamform towards her direction.
Mallory is now in control of the communication link between the two devices,
thus breaking the false sense of security given by the directionality of mmWave
transmissions.
  Prior works have added integrity protection to beam alignment messages to
prevent forgeries. In this paper, we demonstrate a new beam-stealing attack
that does not require message forging. We show that Mallory can amplify and
relay a beam sweeping frame from her direction without altering its contents.
Intuitively, cryptographic primitives cannot verify physical properties such as
the SNR used in beam selection. We propose a new beam sweeping protocol called
SecBeam that utilizes power/sector randomization and coarse angle-of-arrival
information to detect amplify-and-relay attacks. We demonstrate the security
and performance of SecBeam using an experimental mmWave platform and via
ray-tracing simulations.
