The pilot spoofing attack (PSA) is one kind of active eavesdropping that happens in the channel training phase, in which an intelligent eavesdropper transmits identical pilot sequences synchronously with the legitimate user to spoof the transmitter. This attack leads to the estimated channel being a mix of a legitimate channel (the channel from the transmitter to the legitimate user) and an eavesdropper channel (the channel from the transmitter to the eavesdropper). And as a result, confidential information is leaked to the eavesdropper during the data transmission phase. Especially when the eavesdropper utilizes sufficiently large power, the channel rate at the legitimate user end decreases observably and increases dramatically at the eavesdropper. To against the active PSA, we propose a new effective scheme called the spatial spectrum method (SSM) which can be applied in situations in which the eavesdropper attacks not only the transmitter but also the legitimate user in multiple-input multiple-output (MIMO) communication systems. Specifically, this method utilizes the spatial spectrums that are attained by the uplink training phase to detect the eavesdropper. Besides it also can locate the legitimate user and the eavesdropper by identifying the direction-of-arrival (DOA) of the legitimate user and the eavesdropper based on the symmetry of the uplink and downlink channels in a time-division-duplex (TDD) system and estimating the geographical distance between the legitimate user and the eavesdropper. Consequently, the secure transmission of secret information can be guaranteed by utilizing spatial information, such as by adopting beamforming technology. Numerical results show that our method can effectively detect and locate the eavesdropper.
The pilot spoofing attack (PSA) is one kind of active eavesdropping that happens in the channel training phase, in which an intelligent eavesdropper transmits identical pilot sequences synchronously with the legitimate user to spoof the transmitter. This attack leads to the estimated channel being a mix of a legitimate channel (the channel from the transmitter to the legitimate user) and an eavesdropper channel (the channel from the transmitter to the eavesdropper). And as a result, confidential information is leaked to the eavesdropper during the data transmission phase. Especially when the eavesdropper utilizes sufficiently large power, the channel rate at the legitimate user end decreases observably and increases dramatically at the eavesdropper. To against the active PSA, we propose a new effective scheme called the spatial spectrum method (SSM) which can be applied in situations in which the eavesdropper attacks not only the transmitter but also the legitimate user in multiple-input multiple-output (MIMO) communication systems. Specifically, this method utilizes the spatial spectrums that are attained by the uplink training phase to detect the eavesdropper. Besides it also can locate the legitimate user and the eavesdropper by identifying the direction-of-arrival (DOA) of the legitimate user and the eavesdropper based on the symmetry of the uplink and downlink channels in a time-division-duplex (TDD) system and estimating the geographical distance between the legitimate user and the eavesdropper. Consequently, the secure transmission of secret information can be guaranteed by utilizing spatial information, such as by adopting beamforming technology. Numerical results show that our method can effectively detect and locate the eavesdropper.
In a multi-antenna time-division duplex (TDD) communication system, due to channel reciprocity, the downlink channel state information can be obtained by conducting uplink training. In a wire-tap channel, an active eavesdropper can perform active eavesdropping by pilot spoofing attack. In such an attack, the eavesdropper, during the uplink training phase, transmits the identical pilot sequence as that of the legitimate receiver to the transmitter. As a result, the estimated channel by the transmitter is a weighted sum of the legitimate channel and the eavesdropping channel. Motivated by the seriousness of pilot spoofing attack, in this paper, we propose a two-stage uplink training method for pilot spoofing attack detection and secure transmission. Using the new training method, the legitimate channel and the eavesdropping channel can be correctly estimated separately. Then we propose a pilot spoofing attack detector followed by a beamforming scheme for secure data transmission. Simulation results have shown that our proposed method achieves higher detection probability, and larger secrecy rate than previously proposed anti-pilot spoofing methods.
Proactive eavesdropping is an effective method for government to monitor suspicious users who are deemed to misuse communication systems for illegal activities. In this paper, considering that a legitimate full-duplex (FD) eavesdropper tries to monitor a dubious multi-antenna system, we propose a covert pilot spoofing attack (PSA) scheme to enhance the legitimate eavesdropping performance by taking the channel training phase into consideration. For the proposed covert PSA scheme, the total error detection probability and optimal detection threshold of suspicious source are derived as the worst case for the considered monitoring system. Given the optimal detection threshold, the closed-form expressions of effective eavesdropping rate are also derived based on the results of detection at suspicious source. Furthermore, an optimal power allocation algorithm to maximize the effective eavesdropping rate is proposed under the covert PSA and transmission power constraints. Simulation results illustrate that the adversary's uncertain about channel state information (CSI) before channel estimation process, can be exploited by legitimate eavesdropper to cover the PSA without being detected. Therefore, the proposed covert PSA scheme can achieve a better performance with respect to effective eavesdropping rate and effectively combat with a suspicious multi-antenna system.
The pilot spoofing attack is one kind of active eavesdropping activities conducted by a malicious user during the channel training phase. By transmitting the identical pilot (training) signals as those of the legal users, such an attack is able to manipulate the channel estimation outcome, which may result in a larger channel rate for the adversary but a smaller channel rate for the legitimate receiver. With the intention of detecting the pilot spoofing attack and minimizing its damages, we design a two-way training-based scheme. The effective detector exploits the intrusive component created by the adversary, followed by a secure beamforming-assisted data transmission. In addition to the solid detection performance, this scheme is also capable of obtaining the estimations of both legitimate and illegitimate channels, which allows the users to achieve secure communication in the presence of pilot spoofing attack. The detection probability is evaluated based on the derived test threshold at a given requirement on the probability of false alarming. The achievable secrecy rate is utilized to measure the security level of the data transmission. Our analysis shows that even without any pre-assumed knowledge of eavesdropper, the proposed scheme is still able to achieve the maximal secrecy rate in certain cases. Numerical results are provided to show that our scheme could achieve a high detection probability as well as secure transmission.
In a time-division duplex (TDD) based multi-input single-output (MISO) system, the channel state information (CSI) can be obtained during the channel estimation phase in which the receiver transmits the pilot symbols to the transmitter. This scheme may suffer from a so-called pilot spoofing attack, i.e., an adversary may send identical pilot signals as those of the legitimate receiver to spoof the transmitter. The resultant channel estimate may then contain the CSI of both legitimate and illegitimate receivers, and if such estimated channel is used for transmit beamforming, the information dedicated for legitimate receiver will leak to the illegitimate receiver. In this paper, we study the detection and defending strategies for such pilot spoofing attack. A two-way training based scheme is proposed. The durations of the training periods are also designed to optimize the secrecy rate. Finally, numerical results are presented to show the performance of our proposed method.
As for the time-division communications system, the pilot spoofing attack (PSA) technique is maliciously utilized by active eavesdroppers during the uplink training phase, for contaminating the legitimate channel estimation and thus altering the beamforming design towards the eavesdroppers. Nonorthogonal multiple access (NOMA) has been recognized as the key technology for the envisioned Internet of Things (IoT) networks. In order to prevent the aforementioned information leakage in NOMA-IoT systems, we develop a novel two-way training scheme to detect PSA and a robust secure beamforming design for providing secure transmission, by utilizing the emerging technique of reconfigurable intelligent surface (RIS), which is turned off during the uplink training phase and turned on during the downlink training phase, respectively. Considering that the perfect channel state information related to the eavesdropping channel is typically difficult to obtain, a secrecy outage probability-constrained robust secure beamforming design is proposed to maximize the achievable sum secrecy rate of the legitimate users, by alternatively optimizing the active beamforming and RIS passive beamforming, while satisfying the requirements of the NOMA transmission. Elaborate simulation results reveal that the proposed detection method attains a super PSA detection performance and the proposed robust secure beamforming design is capable of efficiently enhancing the achievable sum secrecy rate, compared with various benchmark schemes.
In this paper, we study the design of secure communication for time division duplexing multi-cell multi-user massive multiple-input multiple-output (MIMO) systems with active eavesdropping. We assume that the eavesdropper actively attacks the uplink pilot transmission and the uplink data transmission before eavesdropping the downlink data transmission phase of the desired users. We exploit both the received pilots and data signals for uplink channel estimation. We show analytically that when the number of transmit antennas and the length of the data vector both tend to infinity, the signals of the desired user and the eavesdropper lie in different eigenspaces of the received signal matrix at the base station if their signal powers are different. This finding reveals that decreasing (instead of increasing) the desire user's signal power might be an effective approach to combat a strong active attack from an eavesdropper. Inspired by this result, we propose a data-aided secure downlink transmission scheme and derive an asymptotic achievable secrecy sum-rate expression for the proposed design. Numerical results indicate that under strong active attacks, the proposed design achieves significant secrecy rate gains compared to the conventional design employing matched filter precoding and artificial noise generation.