Proactive eavesdropping is an effective method for government to monitor suspicious users who are deemed to misuse communication systems for illegal activities. In this paper, considering that a legitimate full-duplex (FD) eavesdropper tries to monitor a dubious multi-antenna system, we propose a covert pilot spoofing attack (PSA) scheme to enhance the legitimate eavesdropping performance by taking the channel training phase into consideration. For the proposed covert PSA scheme, the total error detection probability and optimal detection threshold of suspicious source are derived as the worst case for the considered monitoring system. Given the optimal detection threshold, the closed-form expressions of effective eavesdropping rate are also derived based on the results of detection at suspicious source. Furthermore, an optimal power allocation algorithm to maximize the effective eavesdropping rate is proposed under the covert PSA and transmission power constraints. Simulation results illustrate that the adversary's uncertain about channel state information (CSI) before channel estimation process, can be exploited by legitimate eavesdropper to cover the PSA without being detected. Therefore, the proposed covert PSA scheme can achieve a better performance with respect to effective eavesdropping rate and effectively combat with a suspicious multi-antenna system.
Proactive eavesdropping is an effective method for government to monitor suspicious users who are deemed to misuse communication systems for illegal activities. In this paper, considering that a legitimate full-duplex (FD) eavesdropper tries to monitor a dubious multi-antenna system, we propose a covert pilot spoofing attack (PSA) scheme to enhance the legitimate eavesdropping performance by taking the channel training phase into consideration. For the proposed covert PSA scheme, the total error detection probability and optimal detection threshold of suspicious source are derived as the worst case for the considered monitoring system. Given the optimal detection threshold, the closed-form expressions of effective eavesdropping rate are also derived based on the results of detection at suspicious source. Furthermore, an optimal power allocation algorithm to maximize the effective eavesdropping rate is proposed under the covert PSA and transmission power constraints. Simulation results illustrate that the adversary's uncertain about channel state information (CSI) before channel estimation process, can be exploited by legitimate eavesdropper to cover the PSA without being detected. Therefore, the proposed covert PSA scheme can achieve a better performance with respect to effective eavesdropping rate and effectively combat with a suspicious multi-antenna system.
This paper studies a legitimate proactive eavesdropping scenario where a central monitor covertly wiretaps the communications between suspicious users through a full-duplex multi-antenna relay. Specifically, the suspicious information is intercepted by the eavesdropping relay, and then encoded and forwarded to the central monitor. At the same time, the relay sends jamming signals to the suspect destination to reduce the quality of suspicious communication. To minimize the suspicious secrecy rate, the optimal forwarding and jamming beamforming vectors of the eavesdropping relay are first designed. Based on this optimized result, the best power allocation ratio is obtained. To this end, the optimal beamforming vectors and power allocation ratio are derived in closed-form. The simulation results verify the existence of the optimal forwarding power of the relay and show that the proposed scheme achieves better performance than the conventional schemes.
In this paper, we consider a legitimate proactive eavesdropping scenario where a distant central monitor covertly wiretaps the communication between a pair of suspicious users via several multi-antenna full-duplex spoofing relays and a multi-antenna cooperative jammer. Assuming an adaptive transmission policy at the suspicious users, the spoofing relays not only intercept but also forward the manipulated information to control the data rate of the suspicious users in collaboration with the jammer. We provide a technique which jointly optimizes the receive combining vector at the central monitor, the precoders at the relays, and the transmit covariance matrix at the jammer for maximizing the eavesdropping rate. To reveal some fundamental properties of the optimal operation, we first study a single-relay system. It is shown that when the central monitor experiences a poor eavesdropping channel link, the spoofing relay and the jammer should transmit destructive signals and jamming signals, respectively. In this case, the suspicious users are forced to decrease their data rate, while the intercepted information can be successfully decoded by the central monitor. On the other hand, when the eavesdropping channel condition is favorable, the spoofing relay forwards constructive signals to further increase the data rate at the suspicious users in a way that more information can be intercepted from the suspicious users. We then formulate a general eavesdropping rate maximization problem for multiple relays and present a semi-definite relaxation approach. A low-complexity design is also proposed based on our analysis for the single-relay system. Simulation results verify the efficiency of the proposed solutions compared to other baseline schemes in various practical setups.
This paper studies the performance of multi-antenna proactive eavesdropping in 5G uplink systems with spatially correlated Rayleigh fadings, where the base station (BS) serves an illegal user and a multi-antenna legitimate monitor eavesdrops the suspicious link with the help of jamming attack. Based on a practical assumption of channel state information (CSI) in 5G uplink, i.e., imperfect instantaneous CSI of the suspicious link at the BS and that of eavesdropping link at the monitor, and only jamming channel statistics at the monitor, we first give a statistical jamming beamforming design. Then, semi-closed form expressions of eavesdropping non-outage probability and relative average eavesdropping rate are, respectively, derived for delay-sensitive and delay-tolerant scenarios. Via reasonable approximations and asymptotic analysis, we gain many insights on the effect of key system parameters, e.g., location-dependent channel path loss and angular spread, jamming energy and the number of antennas. Further, we provide the optimal energy allocation between pilot and data jamming and the optimal antenna allocation between jamming and eavesdropping under total energy constraint and total antenna number, respectively, which are both explicit functions of system parameters. Finally, simulation results validate our analytical results.
Wireless information surveillance, by which suspicious wireless communications are closely monitored by legitimate agencies, is an integral part of national security. To enhance the information surveillance capability, we propose in this paper a new proactive eavesdropping approach via a spoofing relay, where the legitimate monitor operates in a full-duplex manner with simultaneous eavesdropping and spoofing relaying to vary the source transmission rate in favor of the eavesdropping performance. To this end, a power splitting receiver is proposed, where the signal received at each antenna of the legitimate monitor is split into two parts for information eavesdropping and spoofing relaying, respectively. We formulate an optimization problem to maximize the achievable eavesdropping rate by jointly optimizing the power splitting ratios and relay precoding matrix at the multiantenna monitor. Depending on the suspicious and eavesdropping channel conditions, the optimal solution corresponds to three possible spoofing relay strategies, namely constructive relaying, jamming, and simultaneous jamming and destructive relaying. Numerical results show that the proposed technique significantly improves the eavesdropping rate of the legitimate monitor as compared to the existing passive eavesdropping and jamming-assisted eavesdropping schemes.
The pilot spoofing attack (PSA) is one kind of active eavesdropping that happens in the channel training phase, in which an intelligent eavesdropper transmits identical pilot sequences synchronously with the legitimate user to spoof the transmitter. This attack leads to the estimated channel being a mix of a legitimate channel (the channel from the transmitter to the legitimate user) and an eavesdropper channel (the channel from the transmitter to the eavesdropper). And as a result, confidential information is leaked to the eavesdropper during the data transmission phase. Especially when the eavesdropper utilizes sufficiently large power, the channel rate at the legitimate user end decreases observably and increases dramatically at the eavesdropper. To against the active PSA, we propose a new effective scheme called the spatial spectrum method (SSM) which can be applied in situations in which the eavesdropper attacks not only the transmitter but also the legitimate user in multiple-input multiple-output (MIMO) communication systems. Specifically, this method utilizes the spatial spectrums that are attained by the uplink training phase to detect the eavesdropper. Besides it also can locate the legitimate user and the eavesdropper by identifying the direction-of-arrival (DOA) of the legitimate user and the eavesdropper based on the symmetry of the uplink and downlink channels in a time-division-duplex (TDD) system and estimating the geographical distance between the legitimate user and the eavesdropper. Consequently, the secure transmission of secret information can be guaranteed by utilizing spatial information, such as by adopting beamforming technology. Numerical results show that our method can effectively detect and locate the eavesdropper.
In this paper, we investigate the design of a pilot spoofing attack (PSA) carried out by multiple single-antenna eavesdroppers (Eves) in a downlink time-division duplex system, where a multiple antenna base station (BS) transmits confidential information to a single-antenna legitimate user. During the uplink channel training phase, multiple Eves collaboratively impair the channel acquisition of the legitimate link, aimed at maximizing the wiretapping signal-to-noise ratio (SNR) in the subsequent downlink data transmission phase. Two different scenarios are investigated: 1) the BS is unaware of the PSA and 2) the BS attempts to detect the presence of the PSA. For both scenarios, we formulate wiretapping SNR maximization problems. For the second scenario, we also investigate the probability of successful detection and constrain it to remain below a pre-designed threshold. The two resulting optimization problems can be unified into a more general non-convex optimization problem, and we propose an efficient algorithm based on the minorization-maximization (MM) method and the alternating direction method of multipliers (ADMM) to solve it. The proposed MM-ADMM algorithm is shown to converge to a stationary point of the general problem. In addition, we propose a semi-definite relaxation (SDR) method as a benchmark to evaluate the efficiency of the MM-ADMM algorithm. Numerical results show that the MM-ADMM algorithm achieves near-optimal performance and is computationally more efficient than the SDR-based method.