Orthogonal blinding based schemes for wireless physical layer security aim to achieve secure communication by injecting noise into channels orthogonal to the main channel and corrupting the eavesdropper’s signal reception. These methods, albeit practical, have been proven vulnerable against multiantenna eavesdroppers who can filter the message from the noise. The vulnerability is rooted in the fact that the main channel state remains static in spite of the noise injection, which allows an eavesdropper to estimate it promptly via known symbols and filter out the noise. Our proposed scheme leverages a reconfigurable antenna for Alice to rapidly change the channel state during transmission and a compressive sensing based algorithm for her to predict and cancel the changing effects for Bob. As a result, the communication between Alice and Bob remains clear, whereas randomized channel state prevents Eve from launching the knownplaintext attack. We formally analyze the security of the scheme against both single and multi-antenna eavesdroppers and identify its unique anti-eavesdropping properties due to the artificially created fast-changing channel. We conduct extensive simulations and real-world experiments to evaluate its performance. Empirical results show that our scheme can suppress Eve’s attack success rate to the level of random guessing, even if she knows all the symbols transmitted through other antenna modes.
Orthogonal blinding based schemes for wireless physical layer security aim to achieve secure communication by injecting noise into channels orthogonal to the main channel and corrupting the eavesdropper’s signal reception. These methods, albeit practical, have been proven vulnerable against multiantenna eavesdroppers who can filter the message from the noise. The vulnerability is rooted in the fact that the main channel state remains static in spite of the noise injection, which allows an eavesdropper to estimate it promptly via known symbols and filter out the noise. Our proposed scheme leverages a reconfigurable antenna for Alice to rapidly change the channel state during transmission and a compressive sensing based algorithm for her to predict and cancel the changing effects for Bob. As a result, the communication between Alice and Bob remains clear, whereas randomized channel state prevents Eve from launching the knownplaintext attack. We formally analyze the security of the scheme against both single and multi-antenna eavesdroppers and identify its unique anti-eavesdropping properties due to the artificially created fast-changing channel. We conduct extensive simulations and real-world experiments to evaluate its performance. Empirical results show that our scheme can suppress Eve’s attack success rate to the level of random guessing, even if she knows all the symbols transmitted through other antenna modes.
Physical layer security schemes for wireless communication systems have been broadly studied from an information theory point of view. In contrast, there is a dearth of attack methodologies to analyze the achievable security on the physical layer. To address this issue, we develop a novel attack model for physical layer security schemes, which is the equivalent to known-plaintext attacks in cryptoanalysis. In particular, we concentrate on analyzing the security of orthogonal blinding schemes that disturb an eavesdropper’s signal reception using artificial noise transmission. We discuss the theory underlying our attack methodology and develop an adaptive filter trained by known-plaintext symbols to degrade the secrecy of orthogonal blinding. By means of simulation and measurements on real wireless channels using software-defined radios with OFDM transceivers, we obtain the operating area of our attack and evaluate the achievable secrecy degradation. We are able to reduce the secrecy of orthogonal blinding schemes to Symbol Error Rates (SERs) below 10% at an eavesdropper, with a knowledge of only a 3% of the symbols transmitted in typical WLAN frames.
Physical-layer key generation methods utilize the variations of the communication channel to achieve a secure key agreement between two parties with no prior security association. Their secrecy rate (bit generation rate) depends heavily on the randomness of the channel, which may reduce significantly in a stable environment. Existing methods seek to improve the secrecy rate by injecting artificial noise into the channel. Unfortunately, noise injection cannot alter the underlying channel state, which depends on the multipath environment between the transmitter and receiver. Consequently, these methods are known to leak key bits toward multi-antenna eavesdroppers, which is capable of filtering the noise through the differential of multiple signal receptions. This work demonstrates an improved approach to reinforce physical-layer key generation schemes, e.g., channel randomization. The channel randomization approach leverages a reconfigurable antenna to rapidly change the channel state during transmission, and an angle-of-departure (AoD) based channel estimation algorithm to cancel the changing effects for the intended receiver. The combined result is a communication channel stable in the eyes of the intended receiver but randomly changing from the viewpoint of the eavesdropper. We augmented an existing physical-layer key generation protocol, iJam, with the proposed approach and developed a full-fledged remote instrumentation platform to demonstrate its performance. Our evaluations show that augmentation does not affect the bit error rate (BER) of the intended receiver during key establishment but reduces the eavesdropper's BER to the level of random guessing, regardless of the number of antennas it equips.
Physical layer security for wireless communication is broadly considered as a promising approach to protect data confidentiality against eavesdroppers. However, despite its ample theoretical foundation, the transition to practical implementations of physical-layer security still lacks success. A close inspection of proven vulnerable physical-layer security designs reveals that the flaws are usually overlooked when the scheme is only evaluated against an inferior, single-antenna eavesdropper. Meanwhile, the attacks exposing vulnerabilities often lack theoretical justification. To reduce the gap between theory and practice, we posit that a physical-layer security scheme must be studied under multiple adversarial models to fully grasp its security strength. In this regard, we evaluate a specific physical-layer security scheme, i.e. orthogonal blinding, under multiple eavesdropper settings. We further propose a practical "ciphertext-only attack" that allows eavesdroppers to recover the original message by exploiting the low entropy fields in wireless packets. By means of simulation, we are able to reduce the symbol error rate at an eavesdropper below 1% using only the eavesdropper's receiving data and a general knowledge about the format of the wireless packets.
Physical-layer based key generation schemes exploit the channel reciprocity for secret key extraction, which can achieve information-theoretic secrecy against eavesdroppers. Such methods, although practical, have been shown to be vulnerable against man-in-the-middle (MitM) attacks, where an active adversary, Mallory, can influence and infer part of the secret key generated between Alice and Bob by injecting her own packet upon observing highly correlated channel/RSS measurements from Alice and Bob. As all the channels remain stable within the channel coherence time, Mallory's injected packets cause Alice and Bob to measure similar RSS, which allows Mallory to successfully predict the derived key bits. To defend against such a MitM attack, we propose to utilize a reconfigurable antenna at one of the legitimate transceivers to proactively randomize the channel state across different channel probing rounds. The randomization of the antenna mode at every probing round breaks the temporal correlation of the channels from the adversary to the legitimate devices, while preserving the reciprocity of the channel between the latter. This prevents key injection from the adversary without affecting Alice and Bob's ability to measure common randomness. We theoretically analyze the security of the protocol and conduct extensive simulations and real-world experiments to evaluate its performance. Our results show that our approach eliminates the advantage of an active MitM attack by driving down the probability of successfully guessing bits of the secret key to a random guess.
An increasing number of devices exchanges data via the wireless medium into large scale, decentralized, and heterogeneous networks, leading to the concept of Internet of Things (IoT). This PhD work proposes a new practical scheme to perform physical layer security (PLS) in this IoT context.Wireless communications in IoT networks are prone to passive eavesdropping. Therefore, this work introduces a scheme that guarantees the reliability of a communication from a transmitter (Alice) towards a legitimate user (Bob), while preventing multiple passive eavesdroppers (Eve) to correctly decode the data in a worst-cases scenario, thereby considering i) Eve to be noiseless, ii) Eve equipped with an arbitrarily large number of antennas, iii) Alice imperfectly estimating Bob's channel state information (CSI). To do so, a frequency domain time-reversal (TR) precoder is proposed using orthogonal frequency-division multiplexing (OFDM) and artificial noise (AN) injection. The scheme exploits the frequency diversity selective behaviour in multipath channels, and can be incorporated into existing standards, such as in LTE or 5G networks. Different configurations are investigated, namely, single-input single-output (SISO), multiple-input single-output (MISO), and single-input multiple-output (SIMO) systems.The handshake procedures between Alice and Bob are described, both in time-division duplexing (TDD) and frequency-division duplexing (FDD) systems, highlighting the amount of CSI acquisition at Eve, which influences the secrecy performances. Depending on the handshake procedures, different decoding structures are investigated at Eve for each system configuration, considering a block-fading environment. Closed-form approximations of the signal-to-noise ratio required at Bob and the maximal CSI error that can be made at Alice, in order to guarantee a communication ergodic secrecy rate (ESR), are derived. Furthermore, the optimal amount of AN energy to inject, as well as the maximal number of eavesdropper's antennas allowed, considering imperfect CSI, are also given as closed-form expressions. A trade-off on the choice of the spreading factor of the TR precoder is established between maximizing the ESR and decreasing the percentage of outage, leading to information leaked to Eve. Finally, thanks to these results, Alice can be a-priori aware of the ESR over which she can establish a secure communication, assuming worst-case assumptions regarding the eavesdroppers. The PLS scheme presented in this PhD work therefore emerges as a promising solution to secure wireless communications in IoT networks.
We investigate the physical layer security of wireless single-input single-output orthogonal-division multiplexing (OFDM) when a transmitter, which we refer to as Alice, sends her information to a receiver, which we refer to as Bob, in the presence of an eavesdropping node, Eve. To prevent information leakage, Alice sends an artificial-noise (AN) signal superimposed over her information signal. We investigate the impact of the channel delay spread, OFDM cyclic prefix, information/AN power allocation, and information and AN precoders design on the achievable average secrecy rate. We consider the two cases of known and unknown channel state information (CSI) at Alice. Furthermore, we compare both cases of per-sub-channel processing and joint sub-channels processing at Eve's receiver. Our numerical results show the gains of AN injection in terms of average secrecy rate for different OFDM operating conditions. Moreover, based on our new insights, we demonstrate that the AN-aided scheme is effective and achieves almost the same average secrecy rate as the full-CSI case without the need for Eve's instantaneous CSI at Alice.