频移反向散射系统的窃听与欺骗攻击方法

频移反向散射系统（Frequency Shift Backscatter Systems）是一种新型低功耗通信系统，即将广泛应用于物联网应用。本文提出了一种基于探针信号对频移反向散射系统进行窃听和欺骗攻击的方法，展示现有系统安全漏洞。首先，发射探针信号并采集标签反射信号进行比对，获取标签对探针的频移量和调制方式，对标签上数据解调，完成窃听。其次，使用软件定义无线电（Software Defined Radio， SDR）采集时域信号，进行下变频处理后与自身做相关性计算，通过阈值筛选出激励信号中心频率。最后，构建错误数据的标签反射信号，同步发送激励信号，欺骗接收机收到合法数据。实验验证该方法在频移反向散射系统中的可行性，实验结果表明，该方法可以解码标签数据并成功向接收机发送虚假数据。 

Method of Eavesdropping and Spoofing Attacks on Frequency Shift Backscatter Systems

Frequency shift backscatter system is a new low power communication system that will be widely used in IoT applications. In this paper， a method of eavesdropping and spoofing attacks on frequency shift backscatter systems based on a probe signal was proposed to demonstrate the security vulnerability of existing systems. Firstly， the probe signal was transmitted and the reflected signal from the tag was collected for comparison to obtain the frequency shift and modulation method of the tag， and the data on the tag was demodulated to eavesdrop. Secondly， the time domain signal was captured by software defined radio （SDR），down-converted and correlated with itself， and the center frequency of the excitation signal was filtered by a threshold. Finally， a tag-reflected signal of the wrong data was constructed and the excitation signal was sent simultaneously to trick the receiver into receiving the legitimate data. Experiments were conducted to verify the feasibility of the method in frequency shift backscatter systems. The experimental results showed that the method can decode the tag data and sent fake data to the receiver successfully.