Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Network and Distributed System Security Symposium

Practical Known-Plaintext Attacks against Physical Layer Security in Wireless MIMO Systems

Matthias Schulz, Adrian Loch, Matthias Hollick

Published Jan 1, 2014• 41 citations
Publisher

Abstract

Physical layer security schemes for wireless communication systems have been broadly studied from an information theory point of view. In contrast, there is a dearth of attack methodologies to analyze the achievable security on the physical layer. To address this issue, we develop a novel attack model for physical layer security schemes, which is the equivalent to known-plaintext attacks in cryptoanalysis. In particular, we concentrate on analyzing the security of orthogonal blinding schemes that disturb an eavesdropper’s signal reception using artificial noise transmission. We discuss the theory underlying our attack methodology and develop an adaptive filter trained by known-plaintext symbols to degrade the secrecy of orthogonal blinding. By means of simulation and measurements on real wireless channels using software-defined radios with OFDM transceivers, we obtain the operating area of our attack and evaluate the achievable secrecy degradation. We are able to reduce the secrecy of orthogonal blinding schemes to Symbol Error Rates (SERs) below 10% at an eavesdropper, with a knowledge of only a 3% of the symbols transmitted in typical WLAN frames.

DOI
10.14722/ndss.2014.23162

Related papers

ROBin: Known-Plaintext Attack Resistant Orthogonal Blinding via Channel Randomization

Yanjun Pan, Yao Rui Zheng, Ming Li

Orthogonal blinding based schemes for wireless physical layer security aim to achieve secure communication by injecting noise into channels orthogonal to the main channel and corrupting the eavesdropper’s signal reception. These methods, albeit practical, have been proven vulnerable against multiantenna eavesdroppers who can filter the message from the noise. The vulnerability is rooted in the fact that the main channel state remains static in spite of the noise injection, which allows an eavesdropper to estimate it promptly via known symbols and filter out the noise. Our proposed scheme leverages a reconfigurable antenna for Alice to rapidly change the channel state during transmission and a compressive sensing based algorithm for her to predict and cancel the changing effects for Bob. As a result, the communication between Alice and Bob remains clear, whereas randomized channel state prevents Eve from launching the knownplaintext attack. We formally analyze the security of the scheme against both single and multi-antenna eavesdroppers and identify its unique anti-eavesdropping properties due to the artificially created fast-changing channel. We conduct extensive simulations and real-world experiments to evaluate its performance. Empirical results show that our scheme can suppress Eve’s attack success rate to the level of random guessing, even if she knows all the symbols transmitted through other antenna modes.

arXiv:2002.07355•IEEE Conference on Computer Communications (INFOCOM)•Jul 1, 2020•7 citations

Profiling the Strength of Physical-Layer Security

Yao Rui Zheng, Matthias Schulz, Wenjing Lou +2 more

Physical layer security for wireless communication is broadly considered as a promising approach to protect data confidentiality against eavesdroppers. However, despite its ample theoretical foundation, the transition to practical implementations of physical-layer security still lacks success. A close inspection of proven vulnerable physical-layer security designs reveals that the flaws are usually overlooked when the scheme is only evaluated against an inferior, single-antenna eavesdropper. Meanwhile, the attacks exposing vulnerabilities often lack theoretical justification. To reduce the gap between theory and practice, we posit that a physical-layer security scheme must be studied under multiple adversarial models to fully grasp its security strength. In this regard, we evaluate a specific physical-layer security scheme, i.e. orthogonal blinding, under multiple eavesdropper settings. We further propose a practical "ciphertext-only attack" that allows eavesdroppers to recover the original message by exploiting the low entropy fields in wireless packets. By means of simulation, we are able to reduce the symbol error rate at an eavesdropper below 1% using only the eavesdropper's receiving data and a general knowledge about the format of the wireless packets.

ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec)•Jul 15, 2016•6 citations

Transmit Filter and Artificial Noise Design for Secure MIMO-OFDM Systems

Wenfei Liu, Ming Li, Xiaowen Tian +2 more

Physical layer security has been considered as an important security approach in wireless communications to protect legitimate transmission from passive eavesdroppers. This paper investigates the physical layer security of a wireless multiple-input multiple-output (MIMO) orthogonal frequency division multiplexing (OFDM) communication system in the presence of a multiple-antenna eavesdropper. We first propose a transmit-filter-assisted secure MIMO-OFDM system which can destroy the orthogonality of eavesdropper's signals. Our proposed transmit filter can disturb the reception of eavesdropper while maintaining the quality of legitimate transmission. Then, we propose another artificial noise (AN)-assisted secure MIMO-OFDM system to further improve the security of the legitimate transmission. The time-domain AN signal is designed to disturb the reception of eavesdropper while the legitimate transmission will not be affected. Simulation results are presented to demonstrate the security performance of the proposed transmit filter design and AN-assisted scheme in the MIMO-OFDM system.

arXiv:1704.08007•Apr 26, 2017•1 citation

Wireless Physical Layer Security: Towards Practical Assumptions and Requirements

Biao He

The current research on physical layer security is far from implementations in practical networks, arguably due to impractical assumptions in the literature and the limited applicability of physical layer security. Aiming to reduce the gap between theory and practice, this thesis focuses on wireless physical layer security towards practical assumptions and requirements. In the first half of the thesis, we reduce the dependence of physical layer security on impractical assumptions. The secrecy enhancements and analysis based on impractical assumptions cannot lead to any true guarantee of secrecy in practical networks. The current study of physical layer security was often based on the idealized assumption of perfect channel knowledge on both legitimate users and eavesdroppers. We study the impact of channel estimation errors on secure transmission designs. We investigate the practical scenarios where both the transmitter and the receiver have imperfect channel state information (CSI). Our results show how the optimal transmission design and the achievable throughput vary with the amount of knowledge on the eavesdropper's channel. Apart from the assumption of perfect CSI, the analysis of physical layer security often ideally assumed the number of eavesdropper antennas to be known. We develop an innovative approach to study secure communication systems without knowing the number of eavesdropper antennas by introducing the concept of spatial constraint into physical layer security. That is, the eavesdropper is assumed to have a limited spatial region to place (possibly an infinite number of) antennas. We show that a non-zero secrecy rate is achievable with the help of a friendly jammer, even if the eavesdropper places an infinite number of antennas in its spatial region. In the second half of the thesis, we improve the applicability of physical layer security. The current physical layer security techniques to achieve confidential broadcasting were limited to application in single-cell systems. The primary challenge to achieve confidential broadcasting in the multi-cell network is to deal with not only the inter-cell but also the intra-cell information leakage and interference. To tackle this challenge, we design linear precoders performing confidential broadcasting in multi-cell networks. We optimize the precoder designs to maximize the secrecy sum rate with based on the large-system analysis. Finally, we improve the applicability of physical layer security from a fundamental aspect. The analysis of physical layer security based on the existing secrecy metric was often not applicable in practical networks. We propose new metrics for evaluating the secrecy of transmissions over fading channels to address the practical limitations of using existing secrecy metrics for such evaluations. The first metric establishes a link between the concept of secrecy outage and the eavesdropper's ability to decode confidential messages. The second metric provides an error-probability-based secrecy metric which is often used for the practical implementation of secure wireless systems. The third metric characterizes how much or how fast the confidential information is leaked to the eavesdropper. We show that the proposed secrecy metrics enable one to appropriately design secure communication systems with different views on how secrecy is measured.

•Jan 1, 2016•1 citation

Study On Physical Layer Wireless Security Techniques

S Lemya, VM Meera, A Thrupthi

Communication security is an essential and progressively difficult issue in wireless networks. Physical-layer approach to secret key generation which is each quick and independent of channel variations is taken into account. This approach makes a receiver jam the signal during a manner that also permits it to decrypt the info, nevertheless prevents alternative nodes from cryptography. Another well-known approach for achieving information-theoretic secrecy depends on deploying artificial noises to blind the intruders’ interception within the physical layer. A multiple inter-symbol obfuscation (MIO) theme is planned, that utilizes a collection of artificial vociferous symbols to alter the initial knowledge symbols within the physical layer. MIO will effectively enhance the wireless communications security.

International Journal of Computer Sciences and Engineering•Nov 11, 2025•0 citations

Static and Dynamic Finite Constellation Decomposition for Wireless Physical Layer Security

Eyyüp Taşçı, Arman Tan, Timur Zirtiloglu +3 more

Security is a critical element in the design of communication systems. However, despite its essential role in enabling low-cost implementations and robust theoretical foundations, physical layer security is often overlooked in developing countermeasures against eavesdropping. In this work, we propose practical physical-layer countermeasures that enhance secrecy with low computational overhead. Our approach decomposes the constellation diagram using basis vectors, constructing the original message symbol in the main lobe aimed at the intended receiver, while projecting randomized constellation points in other directions to mislead potential eavesdroppers. When the eavesdropper’s location is known, we use static basis vectors, achieving a higher level of secrecy in that direction. When the location is unknown, we dynamically change the basis vectors to provide information-theoretic security in all directions through basis vector randomization. This design enables the intended receiver to operate without knowledge of the basis vectors, reducing receiver overhead. We evaluate the scheme’s secrecy performance through bit error rate and secrecy rate analyses, demonstrating its potential to improve physical layer security.

IEEE International Conference on Communications workshops•Jun 8, 2025•1 citation
Physical layer security schemes for wireless communication systems have been broadly studied from an information theory point of view. In contrast, there is a dearth of attack methodologies to analyze the achievable security on the physical layer. To address this issue, we develop a novel attack model for physical layer security schemes, which is the equivalent to known-plaintext attacks in cryptoanalysis. In particular, we concentrate on analyzing the security of orthogonal blinding schemes that disturb an eavesdropper’s signal reception using artificial noise transmission. We discuss the theory underlying our attack methodology and develop an adaptive filter trained by known-plaintext symbols to degrade the secrecy of orthogonal blinding. By means of simulation and measurements on real wireless channels using software-defined radios with OFDM transceivers, we obtain the operating area of our attack and evaluate the achievable secrecy degradation. We are able to reduce the secrecy of orthogonal blinding schemes to Symbol Error Rates (SERs) below 10% at an eavesdropper, with a knowledge of only a 3% of the symbols transmitted in typical WLAN frames.
Orthogonal blinding based schemes for wireless physical layer security aim to achieve secure communication by injecting noise into channels orthogonal to the main channel and corrupting the eavesdropper’s signal reception. These methods, albeit practical, have been proven vulnerable against multiantenna eavesdroppers who can filter the message from the noise. The vulnerability is rooted in the fact that the main channel state remains static in spite of the noise injection, which allows an eavesdropper to estimate it promptly via known symbols and filter out the noise. Our proposed scheme leverages a reconfigurable antenna for Alice to rapidly change the channel state during transmission and a compressive sensing based algorithm for her to predict and cancel the changing effects for Bob. As a result, the communication between Alice and Bob remains clear, whereas randomized channel state prevents Eve from launching the knownplaintext attack. We formally analyze the security of the scheme against both single and multi-antenna eavesdroppers and identify its unique anti-eavesdropping properties due to the artificially created fast-changing channel. We conduct extensive simulations and real-world experiments to evaluate its performance. Empirical results show that our scheme can suppress Eve’s attack success rate to the level of random guessing, even if she knows all the symbols transmitted through other antenna modes.
Physical layer security for wireless communication is broadly considered as a promising approach to protect data confidentiality against eavesdroppers. However, despite its ample theoretical foundation, the transition to practical implementations of physical-layer security still lacks success. A close inspection of proven vulnerable physical-layer security designs reveals that the flaws are usually overlooked when the scheme is only evaluated against an inferior, single-antenna eavesdropper. Meanwhile, the attacks exposing vulnerabilities often lack theoretical justification. To reduce the gap between theory and practice, we posit that a physical-layer security scheme must be studied under multiple adversarial models to fully grasp its security strength. In this regard, we evaluate a specific physical-layer security scheme, i.e. orthogonal blinding, under multiple eavesdropper settings. We further propose a practical "ciphertext-only attack" that allows eavesdroppers to recover the original message by exploiting the low entropy fields in wireless packets. By means of simulation, we are able to reduce the symbol error rate at an eavesdropper below 1% using only the eavesdropper's receiving data and a general knowledge about the format of the wireless packets.
Physical layer security has been considered as an important security approach in wireless communications to protect legitimate transmission from passive eavesdroppers. This paper investigates the physical layer security of a wireless multiple-input multiple-output (MIMO) orthogonal frequency division multiplexing (OFDM) communication system in the presence of a multiple-antenna eavesdropper. We first propose a transmit-filter-assisted secure MIMO-OFDM system which can destroy the orthogonality of eavesdropper's signals. Our proposed transmit filter can disturb the reception of eavesdropper while maintaining the quality of legitimate transmission. Then, we propose another artificial noise (AN)-assisted secure MIMO-OFDM system to further improve the security of the legitimate transmission. The time-domain AN signal is designed to disturb the reception of eavesdropper while the legitimate transmission will not be affected. Simulation results are presented to demonstrate the security performance of the proposed transmit filter design and AN-assisted scheme in the MIMO-OFDM system.
The current research on physical layer security is far from implementations in practical networks, arguably due to impractical assumptions in the literature and the limited applicability of physical layer security. Aiming to reduce the gap between theory and practice, this thesis focuses on wireless physical layer security towards practical assumptions and requirements. In the first half of the thesis, we reduce the dependence of physical layer security on impractical assumptions. The secrecy enhancements and analysis based on impractical assumptions cannot lead to any true guarantee of secrecy in practical networks. The current study of physical layer security was often based on the idealized assumption of perfect channel knowledge on both legitimate users and eavesdroppers. We study the impact of channel estimation errors on secure transmission designs. We investigate the practical scenarios where both the transmitter and the receiver have imperfect channel state information (CSI). Our results show how the optimal transmission design and the achievable throughput vary with the amount of knowledge on the eavesdropper's channel. Apart from the assumption of perfect CSI, the analysis of physical layer security often ideally assumed the number of eavesdropper antennas to be known. We develop an innovative approach to study secure communication systems without knowing the number of eavesdropper antennas by introducing the concept of spatial constraint into physical layer security. That is, the eavesdropper is assumed to have a limited spatial region to place (possibly an infinite number of) antennas. We show that a non-zero secrecy rate is achievable with the help of a friendly jammer, even if the eavesdropper places an infinite number of antennas in its spatial region. In the second half of the thesis, we improve the applicability of physical layer security. The current physical layer security techniques to achieve confidential broadcasting were limited to application in single-cell systems. The primary challenge to achieve confidential broadcasting in the multi-cell network is to deal with not only the inter-cell but also the intra-cell information leakage and interference. To tackle this challenge, we design linear precoders performing confidential broadcasting in multi-cell networks. We optimize the precoder designs to maximize the secrecy sum rate with based on the large-system analysis. Finally, we improve the applicability of physical layer security from a fundamental aspect. The analysis of physical layer security based on the existing secrecy metric was often not applicable in practical networks. We propose new metrics for evaluating the secrecy of transmissions over fading channels to address the practical limitations of using existing secrecy metrics for such evaluations. The first metric establishes a link between the concept of secrecy outage and the eavesdropper's ability to decode confidential messages. The second metric provides an error-probability-based secrecy metric which is often used for the practical implementation of secure wireless systems. The third metric characterizes how much or how fast the confidential information is leaked to the eavesdropper. We show that the proposed secrecy metrics enable one to appropriately design secure communication systems with different views on how secrecy is measured.
Communication security is an essential and progressively difficult issue in wireless networks. Physical-layer approach to secret key generation which is each quick and independent of channel variations is taken into account. This approach makes a receiver jam the signal during a manner that also permits it to decrypt the info, nevertheless prevents alternative nodes from cryptography. Another well-known approach for achieving information-theoretic secrecy depends on deploying artificial noises to blind the intruders’ interception within the physical layer. A multiple inter-symbol obfuscation (MIO) theme is planned, that utilizes a collection of artificial vociferous symbols to alter the initial knowledge symbols within the physical layer. MIO will effectively enhance the wireless communications security.
Security is a critical element in the design of communication systems. However, despite its essential role in enabling low-cost implementations and robust theoretical foundations, physical layer security is often overlooked in developing countermeasures against eavesdropping. In this work, we propose practical physical-layer countermeasures that enhance secrecy with low computational overhead. Our approach decomposes the constellation diagram using basis vectors, constructing the original message symbol in the main lobe aimed at the intended receiver, while projecting randomized constellation points in other directions to mislead potential eavesdroppers. When the eavesdropper’s location is known, we use static basis vectors, achieving a higher level of secrecy in that direction. When the location is unknown, we dynamically change the basis vectors to provide information-theoretic security in all directions through basis vector randomization. This design enables the intended receiver to operate without knowledge of the basis vectors, reducing receiver overhead. We evaluate the scheme’s secrecy performance through bit error rate and secrecy rate analyses, demonstrating its potential to improve physical layer security.