Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2003.12034 · Globecom

Man-in-the-Middle and Denial of Service Attacks in Wireless Secret Key Generation

Miroslav Mitev, Arsenia Chorti, E. Veronica Belmega, Martin J. Reed

Published Dec 1, 2019• 25 citations
arXivHTMLPDF

Abstract

Wireless secret key generation (W-SKG) from shared randomness (e.g., from the wireless channel fading realizations), is a well established scheme that can be used for session key agreement. W-SKG approaches can be of particular interest in delay constrained wireless networks and notably in the context of ultra reliable low latency communications (URLLC) in beyond fifth generation (B5G) systems. However W- SKG schemes are known to be malleable over the so called "advantage distillation" phase, during which observations of the shared randomness are obtained at the legitimate parties. As an example, an active attacker can act as a man-in- the-middle (MiM) by injecting pilot signals and/or can mount denial of service attacks (DoS) in the form of jamming. This paper investigates the impact of injection and reactive jamming attacks in W-SKG. First, it is demonstrated that injection attacks can be reduced to - potentially less harmful - jamming attacks by pilot randomization; a novel system design with randomized QPSK pilots is presented. Subsequently, the optimal jamming strategy is identified in a block fading additive white Gaussian noise (BF-AWGN) channel in the presence of a reactive jammer, using a game theoretic formulation. It is shown that the impact of a reactive jammer is far more severe than that of a simple proactive jammer.

DOI
10.1109/globecom38437.2019.9013816

Related papers

Protecting Physical Layer Secret Key Generation from Active Attacks

Miroslav Mitev, Arsenia Chorti, E. Veronica Belmega +1 more

Lightweight session key agreement schemes are expected to play a central role in building Internet of things (IoT) security in sixth-generation (6G) networks. A well-established approach deriving from the physical layer is a secret key generation (SKG) from shared randomness (in the form of wireless fading coefficients). However, although practical, SKG schemes have been shown to be vulnerable to active attacks over the initial "advantage distillation" phase, throughout which estimates of the fading coefficients are obtained at the legitimate users. In fact, by injecting carefully designed signals during this phase, a man-in-the-middle (MiM) attack could manipulate and control part of the reconciled bits and thus render SKG vulnerable to brute force attacks. Alternatively, a denial of service attack can be mounted by a reactive jammer. In this paper, we investigate the impact of injection and jamming attacks during the advantage distillation in a multiple-input-multiple-output (MIMO) system. First, we show that a MiM attack can be mounted as long as the attacker has one extra antenna with respect to the legitimate users, and we propose a pilot randomization scheme that allows the legitimate users to successfully reduce the injection attack to a less harmful jamming attack. Secondly, by taking a game-theoretic approach we evaluate the optimal strategies available to the legitimate users in the presence of reactive jammers.

Entropy•Jul 27, 2021•24 citations

Optimal signalling strategies and power allocation for wireless secret key generation systems in the presence of a jammer

Arsenia Chorti

Secret key generation (SKG) schemes have been shown to be vulnerable to denial of service (DoS) attacks in the form of jamming. In this paper, a comprehensive study on the impact of correlated and uncorrelated jamming in wireless SKG systems is presented. First, optimal signalling schemes for the legitimate users and jamming approaches for an active adversary launching a DoS attack on the SKG system are derived. It is shown that the legitimate users should employ constant signalling. On the other hand, the jammer should inject either correlated jamming when imperfect channel state information (CSI) regarding the main channel is at their disposal, or, uncorrelated jamming when the main channel CSI is completely unknown. In both cases, optimal power allocation policies are studied under short-term power constrains for M block fading additive white Gaussian noise (BF-AWGN) channels. Numerical evaluations demonstrate that equidistribution of the jamming power is near-optimal in the case of uncorrelated jamming.

International Conference on Communications•May 1, 2017•8 citations

Optimal signalling strategies and power allocation for secret key generation schemes in the presence of a jammer

Arsenia Chorti

Secret key generation (SKG) schemes have been shown to be vulnerable to denial of service (DoS) attacks in the form of jamming. In this paper, a comprehensive study on the impact of correlated and uncorrelated jamming in wireless SKG systems is presented. First, optimal signalling schemes for the legitimate users and jamming approaches for an active adversary launching a DoS attack on the SKG system are derived. It is shown that the legitimate users should employ constant signalling. On the other hand, the jammer should inject either correlated jamming when imperfect channel state information (CSI) regarding the main channel is at their disposal, or, uncorrelated jamming when the main channel CSI is completely unknown. In both cases, optimal power allocation policies are studied under short-term power constrains for M block fading additive white Gaussian noise (BF-AWGN) channels. Numerical evaluations demonstrate that equidistribution of the jamming power is near-optimal in the case of uncorrelated jamming.

•Jul 31, 2017•0 citations

Secret key generation in Rayleigh block fading AWGN channels under jamming attacks

Arsenia Chorti, E. Veronica Belmega

Jamming attacks have been shown to disrupt secret key generation (SKG) in systems that exploit the reciprocity of the wireless medium to generate symmetric keys at two remote locations through public discussion. In this study, the use of frequency hopping/spreading in Rayleigh block fading additive white Gaussian noise (BF-AWGN) channels is investigated as a means to counteract such attacks. The competitive interaction between a pair of legitimate users and a jammer is formulated as a zero-sum game and the corresponding Nash equilibria (NE) are characterized analytically and in closed form. It is found that the jammer's optimal strategy is to spread its power across the entire spectrum. On the contrary, the pair of legitimate users should use frequency spreading only in favorable transmission conditions, and frequency hopping otherwise (e.g., low signal to jamming power ratio). Numerical results show that frequency hopping/spreading in BF-AWGN channels is an effective technique for combating jamming attacks in SKG systems; a modest increase of the system bandwidth can substantially increase the SKG rates.

International Conference on Communications•May 1, 2017•5 citations

Deep Learning for Hardware-Impaired Wireless Secret Key Generation with Man-in-the-Middle Attacks

Mehdi Letafati, Hamid Behroozi, Babak Hossein Khalaj +1 more

Wireless secret key generation (WSKG) allows efficient key agreement protocols for securing the sixth generation (6G) wireless networks. Nevertheless, due to external adversaries or internal impairments, WSKG schemes might become vulner-able during the randomness distillation, where the legitimate nodes try to observe their source of common randomness. In this paper, we investigate the WSKG scheme with legitimate parties suffering from hardware impairments (HIs), while an active adversary acts as a man-in-the-middle (MiM) via injecting fake pilot signals. We first utilize randomized pilots to overcome the MiM. We also leverage the concept of recurrent neural networks (RNNs) to further enhance the randomness distillation. More specifically, the long short-term memory networks (LSTMs)-as a well-established type of RNNs-are implemented to learn the long-term dependencies between the observations of legitimate parties. The achievable secret key rate (SKR) and the impact of MiM on system's performance are analyzed. Our numerical results verify the performance gain of our proposed learning-based approach compared with the state-of-the-art methods and provide useful insights on system design. We show that our RNN-based approach achieves 30% and 15% improvement in terms of observation mismatches compared with the naïve scheme and the fully-connected benchmarks, respectively.

Globecom•Dec 1, 2021•29 citations

Protecting Secret Key Generation Systems Against Jamming: Energy Harvesting and Channel Hopping Approaches

E. Veronica Belmega, Arsenia Chorti

Jamming attacks represent a critical vulnerability for wireless secret key generation (SKG) systems. In this paper, two counter-jamming approaches are investigated for SKG systems: first, the employment of energy harvesting (EH) at the legitimate nodes to turn part of the jamming power into useful communication power, and, second, the use of channel hopping or power spreading in block fading channels to reduce the impact of jamming. In both cases, the adversarial interaction between the pair of legitimate nodes and the jammer is formulated as a two-player zero-sum game and the Nash and Stackelberg equilibria are characterized analytically and in closed form. In particular, in the case of EH receivers, the existence of a critical transmission power for the legitimate nodes allows the full characterization of the game's equilibria and also enables the complete neutralization of the jammer. In the case of channel hopping versus power spreading techniques, it is shown that the jammer's optimal strategy is always power spreading while the legitimate nodes should only use power spreading in the high signal-to-interference ratio (SIR) regime. In the low SIR regime, when avoiding the jammer's interference becomes critical, channel hopping is optimal for the legitimate nodes. Numerical results demonstrate the efficiency of both counter-jamming measures.

IEEE Transactions on Information Forensics and Security•Jun 7, 2017•32 citations
Wireless secret key generation (W-SKG) from shared randomness (e.g., from the wireless channel fading realizations), is a well established scheme that can be used for session key agreement. W-SKG approaches can be of particular interest in delay constrained wireless networks and notably in the context of ultra reliable low latency communications (URLLC) in beyond fifth generation (B5G) systems. However W- SKG schemes are known to be malleable over the so called "advantage distillation" phase, during which observations of the shared randomness are obtained at the legitimate parties. As an example, an active attacker can act as a man-in- the-middle (MiM) by injecting pilot signals and/or can mount denial of service attacks (DoS) in the form of jamming. This paper investigates the impact of injection and reactive jamming attacks in W-SKG. First, it is demonstrated that injection attacks can be reduced to - potentially less harmful - jamming attacks by pilot randomization; a novel system design with randomized QPSK pilots is presented. Subsequently, the optimal jamming strategy is identified in a block fading additive white Gaussian noise (BF-AWGN) channel in the presence of a reactive jammer, using a game theoretic formulation. It is shown that the impact of a reactive jammer is far more severe than that of a simple proactive jammer.
Lightweight session key agreement schemes are expected to play a central role in building Internet of things (IoT) security in sixth-generation (6G) networks. A well-established approach deriving from the physical layer is a secret key generation (SKG) from shared randomness (in the form of wireless fading coefficients). However, although practical, SKG schemes have been shown to be vulnerable to active attacks over the initial "advantage distillation" phase, throughout which estimates of the fading coefficients are obtained at the legitimate users. In fact, by injecting carefully designed signals during this phase, a man-in-the-middle (MiM) attack could manipulate and control part of the reconciled bits and thus render SKG vulnerable to brute force attacks. Alternatively, a denial of service attack can be mounted by a reactive jammer. In this paper, we investigate the impact of injection and jamming attacks during the advantage distillation in a multiple-input-multiple-output (MIMO) system. First, we show that a MiM attack can be mounted as long as the attacker has one extra antenna with respect to the legitimate users, and we propose a pilot randomization scheme that allows the legitimate users to successfully reduce the injection attack to a less harmful jamming attack. Secondly, by taking a game-theoretic approach we evaluate the optimal strategies available to the legitimate users in the presence of reactive jammers.
Secret key generation (SKG) schemes have been shown to be vulnerable to denial of service (DoS) attacks in the form of jamming. In this paper, a comprehensive study on the impact of correlated and uncorrelated jamming in wireless SKG systems is presented. First, optimal signalling schemes for the legitimate users and jamming approaches for an active adversary launching a DoS attack on the SKG system are derived. It is shown that the legitimate users should employ constant signalling. On the other hand, the jammer should inject either correlated jamming when imperfect channel state information (CSI) regarding the main channel is at their disposal, or, uncorrelated jamming when the main channel CSI is completely unknown. In both cases, optimal power allocation policies are studied under short-term power constrains for M block fading additive white Gaussian noise (BF-AWGN) channels. Numerical evaluations demonstrate that equidistribution of the jamming power is near-optimal in the case of uncorrelated jamming.
Secret key generation (SKG) schemes have been shown to be vulnerable to denial of service (DoS) attacks in the form of jamming. In this paper, a comprehensive study on the impact of correlated and uncorrelated jamming in wireless SKG systems is presented. First, optimal signalling schemes for the legitimate users and jamming approaches for an active adversary launching a DoS attack on the SKG system are derived. It is shown that the legitimate users should employ constant signalling. On the other hand, the jammer should inject either correlated jamming when imperfect channel state information (CSI) regarding the main channel is at their disposal, or, uncorrelated jamming when the main channel CSI is completely unknown. In both cases, optimal power allocation policies are studied under short-term power constrains for M block fading additive white Gaussian noise (BF-AWGN) channels. Numerical evaluations demonstrate that equidistribution of the jamming power is near-optimal in the case of uncorrelated jamming.
Jamming attacks have been shown to disrupt secret key generation (SKG) in systems that exploit the reciprocity of the wireless medium to generate symmetric keys at two remote locations through public discussion. In this study, the use of frequency hopping/spreading in Rayleigh block fading additive white Gaussian noise (BF-AWGN) channels is investigated as a means to counteract such attacks. The competitive interaction between a pair of legitimate users and a jammer is formulated as a zero-sum game and the corresponding Nash equilibria (NE) are characterized analytically and in closed form. It is found that the jammer's optimal strategy is to spread its power across the entire spectrum. On the contrary, the pair of legitimate users should use frequency spreading only in favorable transmission conditions, and frequency hopping otherwise (e.g., low signal to jamming power ratio). Numerical results show that frequency hopping/spreading in BF-AWGN channels is an effective technique for combating jamming attacks in SKG systems; a modest increase of the system bandwidth can substantially increase the SKG rates.
Wireless secret key generation (WSKG) allows efficient key agreement protocols for securing the sixth generation (6G) wireless networks. Nevertheless, due to external adversaries or internal impairments, WSKG schemes might become vulner-able during the randomness distillation, where the legitimate nodes try to observe their source of common randomness. In this paper, we investigate the WSKG scheme with legitimate parties suffering from hardware impairments (HIs), while an active adversary acts as a man-in-the-middle (MiM) via injecting fake pilot signals. We first utilize randomized pilots to overcome the MiM. We also leverage the concept of recurrent neural networks (RNNs) to further enhance the randomness distillation. More specifically, the long short-term memory networks (LSTMs)-as a well-established type of RNNs-are implemented to learn the long-term dependencies between the observations of legitimate parties. The achievable secret key rate (SKR) and the impact of MiM on system's performance are analyzed. Our numerical results verify the performance gain of our proposed learning-based approach compared with the state-of-the-art methods and provide useful insights on system design. We show that our RNN-based approach achieves 30% and 15% improvement in terms of observation mismatches compared with the naïve scheme and the fully-connected benchmarks, respectively.
Jamming attacks represent a critical vulnerability for wireless secret key generation (SKG) systems. In this paper, two counter-jamming approaches are investigated for SKG systems: first, the employment of energy harvesting (EH) at the legitimate nodes to turn part of the jamming power into useful communication power, and, second, the use of channel hopping or power spreading in block fading channels to reduce the impact of jamming. In both cases, the adversarial interaction between the pair of legitimate nodes and the jammer is formulated as a two-player zero-sum game and the Nash and Stackelberg equilibria are characterized analytically and in closed form. In particular, in the case of EH receivers, the existence of a critical transmission power for the legitimate nodes allows the full characterization of the game's equilibria and also enables the complete neutralization of the jammer. In the case of channel hopping versus power spreading techniques, it is shown that the jammer's optimal strategy is always power spreading while the legitimate nodes should only use power spreading in the high signal-to-interference ratio (SIR) regime. In the low SIR regime, when avoiding the jammer's interference becomes critical, channel hopping is optimal for the legitimate nodes. Numerical results demonstrate the efficiency of both counter-jamming measures.