Paul Staat

Hi! I'm a postdoc in the Embedded Security (EMSEC) group at MPI-SP in Bochum, Germany. My research explores security and privacy challenges associated with physical-layer information in wireless technologies, including Wi-Fi, UWB, Bluetooth, cellular systems, and mmWave radar. I currently focus on reconfigurable intelligent surfaces (RIS), adversarial wireless sensing, and physical tamper detection, investigating both offensive (e.g., RIS-based jamming, relay and distance manipulation attacks) and defensive solutions (e.g., Anti-Tamper Radio, IRShield). Much of my work involves real-world prototypical implementation and experimentation.

Publications

A full and up-to-date list of my publications can be found on my Google Scholar profile profile. Here is a list of publications representative for my research:

• Anti-Tamper Radio meets Reconfigurable Intelligent Surface for System-Level Tamper Detection 2025
  M. Tabar, J. Kortz, P. Staat, H. Elders-Boll, C. Paar, C. Zenger
  under review
• arXiv

• Spatial-Domain Wireless Jamming with Reconfigurable Intelligent Surfaces 2025
  P. Mackensen, P. Staat, S. Roth, A. Sezgin, C. Paar, V. Moonsamy
  32nd Annual Network and Distributed System Security Symposium (NDSS), San Diego, USA
• Paper
• Media coverage (selected): RUB | Interesting Engineering | Hackster

• Key Exchange in the Quantum Era: Evaluating a Hybrid System of Public-Key Cryptography and Physical-Layer Security2025
  P. Staat, M. Dörpinghaus, A. Sheikholeslami, C. Paar, G. Fettweis, and D. Goeckel
  59th Annual Conference on Information Science and Systems (CISS), Baltimore, USA
• arXiv

• Stealing Maggie’s Secrets – On the Challenges of IP Theft Through FPGA Reverse Engineering 2024
  S. Klix, N. Albartus, J. Speith, P. Staat, A. Verstege, A. Wilde, D. Lammers, J. Langheinrich, C. Kison, S. Sester, D. Holcomb, C. Paar
  ACM Conference on Computer and Communications Security (CCS), Salt Lake City, USA
• Paper | Extended Version (arXiv) | Artifact

• RIS-Jamming: Breaking Key Consistency in Channel Reciprocity-Based Key Generation 2024
  G. Li, P. Staat, H. Li, M. Heinrichs, C. Zenger, R. Kronberger, H. Elders-Boll, C. Paar, A. Hu
  IEEE Transactions on Information Forensics and Security, Vol. 19, pp. 5090-5105
• arXiv

• Reconfigurable Intelligent Surface for Physical Layer Key Generation: Constructive or Destructive?2022
  G. Li, L. Hu, P. Staat, H. Elders-Boll, C. Zenger, C. Paar, A. Hu
  IEEE Wireless Communications Magazine, Vol. 29, No. 4, pp. 146-153
• arXiv

• Mirror, Mirror on the Wall: Wireless Environment Reconfiguration Attacks Based on Fast Software-Controlled Surfaces2022
  P. Staat, H. Elders-Boll, M. Heinrichs, C. Zenger, C. Paar
  17th ACM ASIA Conference on Computer and Communications Security (AsiaCCS), Nagasaki, Japan
• Paper | Talk

• IRShield: A Countermeasure Against Adversarial Physical-Layer Wireless Sensing2022
  P. Staat, S. Mulzer, S. Roth, V. Moonsamy, M. Heinrichs, R. Kronberger, A. Sezgin, C. Paar
  43rd IEEE Symposium on Security and Privacy (S&P), San Francisco, USA
• Paper (arXiv) | Talk | Data
• Media coverage (selected): RUB

• Anti-Tamper Radio: System-Level Tamper Detection for Computing Systems2022
  P. Staat, J. Tobisch, C. Zenger, C. Paar
  43rd IEEE Symposium on Security and Privacy (S&P), San Francisco, USA
• Paper (arXiv) | Talk
• Media coverage (selected): Golem | heise.de | mpg.de

• Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging2022
  P. Staat, K. Jansen, C. Zenger, H. Elders-Boll, C. Paar
  15th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), San Antonio, USA
• Paper

• Full-Duplex meets Reconfigurable Surfaces: RIS-assisted SIC for Full-Duplex Radios2022
  S. Tewes, M. Heinrichs, P. Staat, R. Kronberger, A. Sezgin
  IEEE International Conference on Communications (ICC), Seoul, South Korea
• Paper (arXiv)

• Intelligent Reflecting Surface-Assisted Wireless Key Generation for Low-Entropy Environments2021
  P. Staat, H. Elders-Boll, M. Heinrichs, R. Kronberger, C. Zenger, C. Paar
  IEEE 32nd Annual International Symposium on Personal, Indoor and Mobile Radio Communications (PIMRC), Helsinki, Finland
• Paper (arXiv)

• Securing Phone as a Key against relay attacks 2020
  P. Staat, K. Jansen, C. Zenger, C. Paar
  18th escar Europe, Bonn, Germany
• Paper

Talks

Invited Talks

• IRShield: How to Counter Privacy Threats of Wireless Sensing October 2023
  8th Huawei Future Device Technology Summit, Helsinki, Finland
• Your Wi-Fi is the Eavesdropper's Radar: How to Counter Privacy Threats of Wireless SensingMay 2023
  RuhrSec 2023, Bochum, Germany
  Video
• A Guide to Wireless Sensing for Security and PrivacySeptember 2022
  Joint talk with Christof Paar, AFO Seminar Series, Microsoft AFO Research (remote presentation)

Paper Presentations

• Spatial-Domain Wireless Jamming with Reconfigurable Intelligent SurfacesFebruary 2025
  NDSS, San Diego, USA (joint presentation with Philipp Mackensen)
• Mirror Mirror on the Wall: Wireless Environment Reconfiguration Attacks Based on Fast Software-Controlled SurfacesMay 2022
  ACM AsiaCCS, Nagasaki, Japan (remote presentation)
• IRShield: A Countermeasure Against Adversarial Physical-Layer Wireless SensingMay 2022
  IEEE S&P, San Francisco, USA
  Video
• Anti-Tamper Radio: System-Level Tamper Detection for Computing Systems May 2022
  IEEE S&P, San Francisco, USA
  Video
• Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging May 2022
  ACM WiSec, San Antonio, USA
• Securing Phone as a Key against relay attacks November 2020
  18th escar Europe, Bonn, Germany

PhD Defense

• Physical-Layer Security in Future Wireless Systems March 2024
  Ruhr University Bochum, Germany

Academic Service

Program Committee Member

• International Conference on Applied Cryptography and Network Security (ACNS) 2025
• Artifact Evaluation of the Network and Distributed System Security Symposium (NDSS) 2025
  Distinguished Evaluator

Reviewer

• IEEE Transactions on Information Forensics and Security (TIFS)
• Annual Conference on Information Science and Systems (CISS) 2025
• IEEE Internet of Things Journal
• IEEE Transactions on Dependable and Secure Computing
• ACM Transactions on Internet Technology
• Subreviewer for NDSS '25, ACSAC '24, EuroS&P '23

Other

• External representative of MPI-SP postdocs in the Max Planck Society's PostdocNet 2024-2025

Teaching Activities

• Teaching assistant for "Introduction to Cryptography 1" (winter terms 2020/21, 2021/22, 2022/23, 2024/25)
• Teaching assistant for "Introduction to Cryptography 2" (summer terms 2021, 2022, 2023)
• Contribution of exercises and lecture material on digital signal processing and channel state information to "Wireless Physical-Layer Security" (Prof. Dr.-Ing. Christian Zenger)
• Seminar supervision in 2019 and 2020.
• Supervision of bachelor and master theses as well as research interns.

Master Theses Supervision

• Raphael Sütterlin, "Evaluation of Challenge Mechanisms for Radio-Wave-Based Physical Zero-Knowledge Proofs", Ruhr-University Bochum, co-supervised with Johannes Tobisch 2022
• Tobias Petrausch, "Analysis of Metamaterials for Radio-Based Virtual Proofs of Reality", Ruhr-University Bochum, co-supervised with Johannes Tobisch2022
• Philipp Stamm, "Machine Learning Assisted Integrity Assessment of Edge Servers based on Radio Channel Characteristics", TH Köln 2021
• Daniel Becker, "Quality Assessment and Comparative Analysis of RF Channel Measurement Systems for Tamper Detection Applications", Ruhr-University Bochum 2021
• Simon Mulzer, "Adversarial Wireless Sensing: Refined Wi-Fi Attacks and Countermeasures Based on Smart Surfaces", Ruhr-University Bochum 2021
• Florian Wimmers, "Hardware Tamper Protection: Fundamentals, State of the Art, Challenges, and New Approaches", Ruhr-University Bochum2021
• Marian Hug, "Radio-Wave Propagation meets Machine Learning for Physical-Layer Remote Attestation", Ruhr-University Bochum2020

Bachelor Theses Supervision

• Maximilian Andersen, "Implementation and Evaluation of Beamforming Feedback Side-Channel Attacks for Keystroke Inference on Smartphones", Ruhr-University Bochum2024
• Daniel Davidovich, "Conceptual Analysis and Experimental Investigation of Radio-Wave Based Covert Channels on Embedded Systems", Ruhr-University Bochum2023
• Jan Nold, "Wireless Sensing for Supply Chain Protection in Hostile Environments", Ruhr-University Bochum2021
• Lars Steinschulte, "Physical Intrusion Detection and Localization with Ultra Wideband Communications", Ruhr-University Bochum2020
• Malte Springborn, "Evaluation of Bluetooth Radio Transceivers for Applications in Physical Layer Security", Ruhr-University Bochum2020
• Simon Mulzer, "Implementation of a WiFi-PHY Analysis Framework for Keystroke Recognition Attacks", Ruhr-University Bochum, co-supervised with Christian Zenger)2020

Education and Academic Experience

• Postdoc: Embedded Security Group, MPI-SP, Bochum, Germany since 2024
• PhD: Ruhr University Bochum | MPI-SP, Advisor: Prof. Dr.-Ing. Christof Paar 2019–2024
• Thesis: "Physical-Layer Security in Future Wireless Systems"
  (summa cum laude)
• MSc: Communication Systems and Networks (graduated as best of the year), Cologne University of Applied Science, Germany | Bonn-Rhein-Sieg University of Applied Sciences, Germany 2016-2018
• BSc: Electrical Engineering, Cologne University of Applied Science, Germany 2012–2016

Adapted from the lightweight website template developed by Przemysław Pawełczak.   Last update: March 27, 2025

  Imprint | Privacy