Existing studies on physical layer security often assume the availability of perfect channel state information (CSI) and overlook the importance of channel training needed for obtaining the CSI. In this letter, we discuss how an active eavesdropper can attack the training phase in wireless communication to improve its eavesdropping performance. We derive a new security attack from the pilot contamination phenomenon, which targets at systems using reverse training to obtain the CSI at the transmitter for precoder design. This attack changes the precoder used by the legitimate transmitter in a controlled manner to strengthen the signal reception at the eavesdropper during data transmission. Furthermore, we discuss an efficient use of the transmission energy of an advanced full-duplex eavesdropper to simultaneously achieve a satisfactory eavesdropping performance whilst degrading the detection performance of the legitimate receiver.
Existing studies on physical layer security often assume the availability of perfect channel state information (CSI) and overlook the importance of channel training needed for obtaining the CSI. In this letter, we discuss how an active eavesdropper can attack the training phase in wireless communication to improve its eavesdropping performance. We derive a new security attack from the pilot contamination phenomenon, which targets at systems using reverse training to obtain the CSI at the transmitter for precoder design. This attack changes the precoder used by the legitimate transmitter in a controlled manner to strengthen the signal reception at the eavesdropper during data transmission. Furthermore, we discuss an efficient use of the transmission energy of an advanced full-duplex eavesdropper to simultaneously achieve a satisfactory eavesdropping performance whilst degrading the detection performance of the legitimate receiver.
The pilot contamination attack is one kind of active eavesdropping activities conducted by a malicious user during the channel training phase. In the existing physical layer transmission against such attack, it is usually assumed that the transmitters may obtain prior knowledge to identify the legitimate users first, then design secure scheme based on the corrected main channel information. However, sometimes it is likely that the prior knowledge is not available, which makes it more difficult to design the transmitting scheme. Motivated by this, we propose a novel transmission against the pilot contamination attack. In our scheme, it is assumed that ideal prior knowledge of the main channel state information (CSI) is not available. Additionally, an extra assistant node is introduced to the well-known Wyner eavesdropping model. Both the uncorrected main CSI and the CSI at the assistant node are used to design the random scrambling scheme at the transmitter, which means there is no need to differentiate between eavesdroppers and legitimate users. Furthermore, we discuss the receiving performance of legitimate users cooperated with the assistant node. Numerical results shows that the legitimate users could achieve pleasant receiving performance while eavesdroppers could hardly obtain acceptable recovery of the original signal.
In this work, we propose a new channel training (CT) scheme to enhance physical layer security in a full-duplex wiretap channel, where the multi-antenna and full-duplex receiver simultaneously receives the information signal and transmits artificial noise (AN). In order to suppress the self-interference caused by AN, the receiver has to estimate the self-interference channel prior to the data communication phase. In the proposed CT scheme, the receiver transmits limited pilot symbols which are known only to itself, which prevents the eavesdropper from estimating the jamming channel from the receiver to the eavesdropper, hence effectively degrades the eavesdropping capability. Compared with the traditional CT scheme that uses publicly known pilots, the newly proposed secret CT scheme offers significantly better performance when the number of antennas at the eavesdropper is larger than one, e.g., Ne> 1. The optimal power allocation between CT and data/AN transmission at the legitimate transmitter/receiver is determined for the proposed secret CT scheme.
This paper proposes a new channel training (CT) scheme for a full-duplex receiver to enhance physical layer security. Equipped with NBfull-duplex antennas, the receiver simultaneously receives the information signal and transmits artificial noise (AN). In order to reduce the non-cancellable self-interference due to the transmitted AN, the receiver has to estimate the self-interference channel prior to the data communication phase. In the proposed CT scheme, the receiver transmits a limited number of pilot symbols that are known only to itself. Such a secret CT scheme prevents an eavesdropper from estimating the jamming channel from the receiver to the eavesdropper, hence effectively degrading the eavesdropping capability. We analytically examine the connection probability (i.e., the probability of the data being successfully decoded by the receiver) of the legitimate channel and the secrecy outage probability due to eavesdropping for the proposed secret CT scheme. Based on our analysis, the optimal power allocation between CT and data/AN transmission at the legitimate transmitter/receiver is determined. Our examination shows that the newly proposed secret CT scheme significantly outperforms the non-secret CT scheme that uses publicly known pilots when the number of antennas at the eavesdropper is larger than one.
Achieving secure transmission in wireless network is a significantly important research topic. Classic cryptography encrypts a confidential message to an unreadable cipher message. Thus only the authentic receiver with correct secrecy key is able to decrypt the message. However, with the growing computational capability of adversaries, the requirement of secrecy key generation and distribution is getting stringent. Another method to achieve wireless security, which has attracted much attention in recent years, is through physical layer processing, named physical layer security. In a typical wiretap channel model consisting of a transmitter, a legal receiver and an adversary (illegal receiver), early works have proven that it is possible to achieve positive secrecy rate using multiple antenna techniques, such as beamforming, at the transmitter. In this thesis, we focus on two types of malicious behaviors of the adversary: passive eavesdropping and active attack. For the passive eavesdropping, we first consider the multi-input-single-output (MISO) wiretap channel, in which the legitimate transmitter utilizes the artificial noise aided precoding strategy to maximize the achievable secrecy rate of the channel. Both scenarios of known and unknown channel state information (CSI) for the eavesdropper channels are considered. By deriving the closed-form expression of ergodic secrecy rate, we prove that there exists an optimal power ratio between the information signal and the artificial noise. We then extend our study to a four-node fading channel model in a wireless relay network, which includes two single-antenna users, one single-antenna eavesdropper and one relay node equipped with multiple antennas. By studying the decode-and-forward (DF) scheme, cooperative jamming (CJ) scheme and one proposed hybrid relay scheme, relay-and-jamming (RJ), we aims to find the optimal relay scheme with the condition that the transmitter and the relay node are under individual power constraints and the CSI of the illegitimate channel is only statistically known. Our analysis shows that the hybrid RJ scheme is optimal when the transmitter has a relatively small power budget and/or the transmitter is far away from the intended receiver. Besides the passive eavesdropping, the adversary could also choose the active attack. The pilot spoofing attack is one active attack conducted by the adversary during the channel estimation phase of the legitimate transmission. In practical systems, the pilot signals are usually known \textit{a priori} and repeatedly used information. In this attack, an intelligent adversary spoofs the transmitter on the estimation of CSI by sending the identical pilot signal as the legitimate receiver. By doing so, the adversary could obtain a larger channel rate in the data transmission phase, and also drastically weaken the strength of the received signal at the legitimate receiver if the adversary utilizes large enough power. Due to the serious consequences caused by such an attack, we first propose an energy ratio detector (ERD) that explores the asymmetry of received signal power levels at the transmitter and the legitimate receiver when the attack occurs. Our analysis shows that the ERD could provide very high probability of detection with certain requirement on the false alarming probability. Furthermore, we design a two-way training based scheme to provide not only attack detection but also secure transmission. The two-way training based detector (TWTD) exploits the intrusive component created by the adversary, followed by a secure beamforming-assisted data transmission. In addition to the good detection performance, our scheme could estimate both legitimate and illegitimate channels, with which the beamforming could be designed for data transmission.
Wireless communication is highly susceptible to eavesdropping attacks where a malicious user can exploit the broadcast nature of the wireless signals to eavesdrop on confidential information. At the physical layer, there are multiple possible avenues to utilize the inherent randomness of the wireless transmission medium to achieve secure communication. One of the lucrative possibilities is to use the channel state information (CSI) to establish a secure communication link because it is vital in decoding the received signal at the transmitter. This technique is commonly referred to as discriminatory channel estimation (DCE) where the channel estimation performance is intentionally degraded at the eavesdropper as compared to the legitimate nodes to achieve secure communication.In this thesis, we capitalize on full-duplex (FD) transmissions to transmit the pilot signals to obscure the channel estimates from the eavesdropper. FD transmission severely limits the estimation performance at the eavesdropper while the legitimate nodes can acquire robust estimates. The secrecy of channel estimates from the eavesdropper provides a bandwidth-efficient security technique as the channel estimation requires less bandwidth than the data transmission. We have presented the achievable secrecy capacity analysis along with the simulation analysis to illustrate the performance improvements achieved by the proposed novel secure channel estimation. In this thesis, we also study the impact of artificial noise (AN) to improve the secrecy achieved by the use of FD transmission of pilot signals. For a strategically located eavesdropper, we have presented novel DCE techniques where AN signals are transmitted along with pilot signals using FD transmission. The AN signals confuse the nearby eavesdropper to establish a secure and robust communication link. We have also presented novel local adaptive power allocation algorithms, where each legitimate node performs power allocation in the absence of statistical channel characteristics regarding the eavesdropping channel. We have provided an in-depth simulation analysis including a location-based simulation analysis to illustrate that the secrecy performance achieved by the proposed DCE techniques. The simulation results indicate that the proposed DCE techniques achieve robust secure communication against a strategically located eavesdropper: while the other DCE techniques are unable to avoid the leakage of information to the eavesdropper
This paper considers a MIMO communication system that includes a transmitter, a legitimate receiver and an eavesdropper. In such a scenario, the eavesdropper has the knowledge of the pilot and utilizes pilot contamination to reduce the secrecy rate. Firstly, we analyze the effects of malicious pilot contamination on channel estimation. The more the pilot contamination power is, the more the eavesdropping performance enhances, by deducing the secrecy rate and its asymptotic expression in the data transmission phase. Besides, the optimal power allocation scheme for a full-duplex eavesdropper to simultaneously transmit pilot contamination and noise jamming is further studied. Simulation results show that the average secrecy rate with pilot contamination is 0.899bits/s/Hz less than that with noise jamming when the jamming power is 10 mW.