The pilot contamination attack is one kind of active eavesdropping activities conducted by a malicious user during the channel training phase. In the existing physical layer transmission against such attack, it is usually assumed that the transmitters may obtain prior knowledge to identify the legitimate users first, then design secure scheme based on the corrected main channel information. However, sometimes it is likely that the prior knowledge is not available, which makes it more difficult to design the transmitting scheme. Motivated by this, we propose a novel transmission against the pilot contamination attack. In our scheme, it is assumed that ideal prior knowledge of the main channel state information (CSI) is not available. Additionally, an extra assistant node is introduced to the well-known Wyner eavesdropping model. Both the uncorrected main CSI and the CSI at the assistant node are used to design the random scrambling scheme at the transmitter, which means there is no need to differentiate between eavesdroppers and legitimate users. Furthermore, we discuss the receiving performance of legitimate users cooperated with the assistant node. Numerical results shows that the legitimate users could achieve pleasant receiving performance while eavesdroppers could hardly obtain acceptable recovery of the original signal.
The pilot contamination attack is one kind of active eavesdropping activities conducted by a malicious user during the channel training phase. In the existing physical layer transmission against such attack, it is usually assumed that the transmitters may obtain prior knowledge to identify the legitimate users first, then design secure scheme based on the corrected main channel information. However, sometimes it is likely that the prior knowledge is not available, which makes it more difficult to design the transmitting scheme. Motivated by this, we propose a novel transmission against the pilot contamination attack. In our scheme, it is assumed that ideal prior knowledge of the main channel state information (CSI) is not available. Additionally, an extra assistant node is introduced to the well-known Wyner eavesdropping model. Both the uncorrected main CSI and the CSI at the assistant node are used to design the random scrambling scheme at the transmitter, which means there is no need to differentiate between eavesdroppers and legitimate users. Furthermore, we discuss the receiving performance of legitimate users cooperated with the assistant node. Numerical results shows that the legitimate users could achieve pleasant receiving performance while eavesdroppers could hardly obtain acceptable recovery of the original signal.
Existing studies on physical layer security often assume the availability of perfect channel state information (CSI) and overlook the importance of channel training needed for obtaining the CSI. In this letter, we discuss how an active eavesdropper can attack the training phase in wireless communication to improve its eavesdropping performance. We derive a new security attack from the pilot contamination phenomenon, which targets at systems using reverse training to obtain the CSI at the transmitter for precoder design. This attack changes the precoder used by the legitimate transmitter in a controlled manner to strengthen the signal reception at the eavesdropper during data transmission. Furthermore, we discuss an efficient use of the transmission energy of an advanced full-duplex eavesdropper to simultaneously achieve a satisfactory eavesdropping performance whilst degrading the detection performance of the legitimate receiver.
This paper proposes a secure transmission scheme based on the twice channel estimation in a three- node MIMO system according to the malicious pilot contamination. Firstly, the pilot transmission length is divided into two segments during the reverse training stage and the legitimate receiver allocates all the power to one arbitrary segment for transmitting the pilot. Then, the transmitter obtains the approximate estimation of the eavesdropping channel and an erroneous CSI of the main channel based on the twice channel estimation. After eliminating the eavesdropping channel from the erroneous CSI, the transmitter transmits both the signal and the artificial noise based on the modified CSI to ensure the transmission. Finally, the simulation results show that the proposed scheme significantly improves the security performance.
Achieving secure transmission in wireless network is a significantly important research topic. Classic cryptography encrypts a confidential message to an unreadable cipher message. Thus only the authentic receiver with correct secrecy key is able to decrypt the message. However, with the growing computational capability of adversaries, the requirement of secrecy key generation and distribution is getting stringent. Another method to achieve wireless security, which has attracted much attention in recent years, is through physical layer processing, named physical layer security. In a typical wiretap channel model consisting of a transmitter, a legal receiver and an adversary (illegal receiver), early works have proven that it is possible to achieve positive secrecy rate using multiple antenna techniques, such as beamforming, at the transmitter. In this thesis, we focus on two types of malicious behaviors of the adversary: passive eavesdropping and active attack. For the passive eavesdropping, we first consider the multi-input-single-output (MISO) wiretap channel, in which the legitimate transmitter utilizes the artificial noise aided precoding strategy to maximize the achievable secrecy rate of the channel. Both scenarios of known and unknown channel state information (CSI) for the eavesdropper channels are considered. By deriving the closed-form expression of ergodic secrecy rate, we prove that there exists an optimal power ratio between the information signal and the artificial noise. We then extend our study to a four-node fading channel model in a wireless relay network, which includes two single-antenna users, one single-antenna eavesdropper and one relay node equipped with multiple antennas. By studying the decode-and-forward (DF) scheme, cooperative jamming (CJ) scheme and one proposed hybrid relay scheme, relay-and-jamming (RJ), we aims to find the optimal relay scheme with the condition that the transmitter and the relay node are under individual power constraints and the CSI of the illegitimate channel is only statistically known. Our analysis shows that the hybrid RJ scheme is optimal when the transmitter has a relatively small power budget and/or the transmitter is far away from the intended receiver. Besides the passive eavesdropping, the adversary could also choose the active attack. The pilot spoofing attack is one active attack conducted by the adversary during the channel estimation phase of the legitimate transmission. In practical systems, the pilot signals are usually known \textit{a priori} and repeatedly used information. In this attack, an intelligent adversary spoofs the transmitter on the estimation of CSI by sending the identical pilot signal as the legitimate receiver. By doing so, the adversary could obtain a larger channel rate in the data transmission phase, and also drastically weaken the strength of the received signal at the legitimate receiver if the adversary utilizes large enough power. Due to the serious consequences caused by such an attack, we first propose an energy ratio detector (ERD) that explores the asymmetry of received signal power levels at the transmitter and the legitimate receiver when the attack occurs. Our analysis shows that the ERD could provide very high probability of detection with certain requirement on the false alarming probability. Furthermore, we design a two-way training based scheme to provide not only attack detection but also secure transmission. The two-way training based detector (TWTD) exploits the intrusive component created by the adversary, followed by a secure beamforming-assisted data transmission. In addition to the good detection performance, our scheme could estimate both legitimate and illegitimate channels, with which the beamforming could be designed for data transmission.
The pilot spoofing attack is one kind of active eavesdropping activities conducted by a malicious user during the channel training phase. By transmitting the identical pilot (training) signals as those of the legal users, such an attack is able to manipulate the channel estimation outcome, which may result in a larger channel rate for the adversary but a smaller channel rate for the legitimate receiver. With the intention of detecting the pilot spoofing attack and minimizing its damages, we design a two-way training-based scheme. The effective detector exploits the intrusive component created by the adversary, followed by a secure beamforming-assisted data transmission. In addition to the solid detection performance, this scheme is also capable of obtaining the estimations of both legitimate and illegitimate channels, which allows the users to achieve secure communication in the presence of pilot spoofing attack. The detection probability is evaluated based on the derived test threshold at a given requirement on the probability of false alarming. The achievable secrecy rate is utilized to measure the security level of the data transmission. Our analysis shows that even without any pre-assumed knowledge of eavesdropper, the proposed scheme is still able to achieve the maximal secrecy rate in certain cases. Numerical results are provided to show that our scheme could achieve a high detection probability as well as secure transmission.
Pilot contamination attack is an important activity of active eavesdropping conducted by a malicious user during channel training phase. This attack is potentially harmful to the physical layer security. In this paper, motivated by the fact that frequency asynchronism could introduce divergence of the transmitted pilot signals between intended user and attacker, we propose a new uncoordinated frequency shift (UFS) scheme for detecting pilot contamination attack in multiple antenna system. During the reverse training phase of the UFS scheme, the legitimate user Bob deliberately introduces multiple random frequency shifts in the publicly known pilot sequence. Since eavesdropper Eve has no knowledge of these random frequency shifts, it is almost impossible for her to pretend exactly like Bob. This provides the opportunity to detect the presence of Eve. An attack detection algorithm is then developed based on source enumeration method. Both the asymptotic performance analysis and numerical results are provided to verify the proposed detection scheme. The proposed scheme is also enhanced based on noise power estimation to cope with attacks from a multi-antenna Eve. Furthermore, the proposed UFS scheme is extended by introducing general parameterized phase shifts. It is demonstrated that the proposed UFS scheme can achieve comparable detection performance as the existing superimposed random sequence based scheme, without sacrifice of legitimate channel estimation performance.
In this paper, a secure communication model for cognitive multi-user massive multiple-input multiple-output (MIMO) systems with underlay spectrum sharing is investigated. A secondary (cognitive) multi-user massive MIMO system is operated by using underlay spectrum sharing within a primary (licensed) multi-user massive MIMO system. A passive multi-antenna eavesdropper is assumed to be eavesdropping upon either the primary or secondary confidential transmissions. To this end, a physical layer security strategy is provisioned for the primary and secondary transmissions via artificial noise (AN) generation at the primary base-station (PBS) and zero-forcing precoders. Specifically, the precoders are constructed by using the channel estimates with pilot contamination. In order to degrade the interception of confidential transmissions at the eavesdropper, the AN sequences are transmitted at the PBS by exploiting the excess degrees-of-freedom offered by its massive antenna array and by using random AN shaping matrices. The channel estimates at the PBS and secondary base-station (SBS) are obtained by using non-orthogonal pilot sequences transmitted by the primary user nodes (PUs) and secondary user nodes (SUs), respectively. Hence, these channel estimates are affected by intra-cell pilot contamination. In this context, the detrimental effects of intra-cell pilot contamination and channel estimation errors for physical layer secure communication are investigated. For this system set-up, the average and asymptotic achievable secrecy rate expressions are derived in closed-form. Specifically, these performance metrics are studied for imperfect channel state information (CSI) and for perfect CSI, and thereby, the secrecy rate degradation due to inaccurate channel knowledge and intra-cell pilot contamination is quantified. Our analysis reveals that a physical layer secure communication can be provisioned for both primary and secondary massive MIMO systems even with the channel estimation errors and pilot contamination.