Wireless channels are vulnerable to eavesdroppers due to their broadcast nature. One approach to thwart an eavesdropper (Eve) is to decrease her SNR, e.g., by reducing the signal in her direction. Unfortunately, such methods are vulnerable to (1) a highly directional Eve that can increase her received signal strength and (2) Eve that is close to the receiver, Bob, or close to the transmitter, Alice. In this paper, we design and experimentally evaluate Multipath Multicarrier Misinformation to Adversaries (M3A), a system for Alice to send data to Bob while simultaneously sending misinformation to Eve. Our approach does not require knowledge of Eve's channel or location and, with multipath channels, randomly transforms Eve's symbols even if Eve is located one wavelength-scale distance from Bob (approximately 10 cm) or if Eve is located between Alice and Bob in their direct path (Eve is approximately 1/3 closer to Alice). In particular, our approach is to move each of Eve's received symbols (over time and across subcarriers), to an independently random transformation as compared to Bob, without Alice or Bob knowing Eve's location or channel. We realize this by modulating Alice's per-subcarrier beamforming weights with an i.i.d. random binary sequence, as if Alice had a separate antenna array for each subcarrier, and could randomly turn antennas in each array on and off. We implement M3A on a real-time Massive MIMO testbed and show that M3A can increase Eve's bit error rate more than two hundredfold compared to beamforming, even if she is positioned approximately a wavelength away, whether above, below, or beside Bob. Finally, to ensure reliability at Bob, we show that with M3A, Bob's bit error rate is approximately an order of magnitude lower than achieved with prior work.
Wireless channels are vulnerable to eavesdroppers due to their broadcast nature. One approach to thwart an eavesdropper (Eve) is to decrease her SNR, e.g., by reducing the signal in her direction. Unfortunately, such methods are vulnerable to (1) a highly directional Eve that can increase her received signal strength and (2) Eve that is close to the receiver, Bob, or close to the transmitter, Alice. In this paper, we design and experimentally evaluate Multipath Multicarrier Misinformation to Adversaries (M3A), a system for Alice to send data to Bob while simultaneously sending misinformation to Eve. Our approach does not require knowledge of Eve's channel or location and, with multipath channels, randomly transforms Eve's symbols even if Eve is located one wavelength-scale distance from Bob (approximately 10 cm) or if Eve is located between Alice and Bob in their direct path (Eve is approximately 1/3 closer to Alice). In particular, our approach is to move each of Eve's received symbols (over time and across subcarriers), to an independently random transformation as compared to Bob, without Alice or Bob knowing Eve's location or channel. We realize this by modulating Alice's per-subcarrier beamforming weights with an i.i.d. random binary sequence, as if Alice had a separate antenna array for each subcarrier, and could randomly turn antennas in each array on and off. We implement M3A on a real-time Massive MIMO testbed and show that M3A can increase Eve's bit error rate more than two hundredfold compared to beamforming, even if she is positioned approximately a wavelength away, whether above, below, or beside Bob. Finally, to ensure reliability at Bob, we show that with M3A, Bob's bit error rate is approximately an order of magnitude lower than achieved with prior work.
Wireless channels are vulnerable to eavesdroppers due to their broadcast nature. One approach to thwart an eavesdropper (Eve) is to decrease her SNR, e.g., by reducing the signal in her direction. Unfortunately, such methods are vulnerable to (1) a highly directional Eve that can increase her received signal strength and (2) Eve that is close to the receiver, Bob, or close to the transmitter, Alice. In this paper, we design and experimentally evaluate Multipath Multicarrier Misinformation to Adversaries (M3A), a system for Alice to send data to Bob while simultaneously sending misinformation to Eve. Our approach does not require knowledge of Eve’s channel or location and, with multipath channels, randomly transforms Eve’s symbols even if Eve is located one wavelength-scale distance from Bob (approximately 10 cm) or if Eve is located between Alice and Bob in their direct path (Eve is approximately 1/3 closer to Alice). In particular, our approach is to move each of Eve’s received symbols (over time and across subcarriers), to an independently random transformation as compared to Bob, without Alice or Bob knowing Eve’s location or channel. We realize this by modulating Alice’s per-subcarrier beamforming weights with an i.i.d. random binary sequence, as if Alice had a separate antenna array for each subcarrier, and could randomly turn antennas in each array on and off. We implement M3A on a real-time Massive MIMO testbed, and show that M3A increases Eve’s bit error rate up to more than two hundredfold compared to beamforming, even if she is positioned approximately a wavelength away, whether above, below, or beside Bob. Finally, to ensure reliability at Bob, we show that with M3A, Bob’s bit error rate is approximately an order of magnitude lower than achieved with prior work.
Massive multiple-input and multiple-output (massive MIMO) has the potential to thwart passive eavesdropping as the signals transmitted by large antenna arrays become highly focused. Indeed, the impact of passive eavesdropping has been shown to be negligible when the base station (BS) antenna size approaches infinity for Rayleigh channels. In this paper, we experimentally explore eavesdropping in massive MIMO incorporating real-world factors including a limited BS antenna array size, potential correlation in over-the-air channels, and adaptation of modulating and coding schemes (MCS) over a discrete and finite set. Using a 96-antenna ArgosV2 BS, we first explore scaling the array size and identify eavesdropper (Eve) advantages due to channel correlation. We next identify the “MCS saturation regime” as a vulnerability even with high SNR due to limited MCS levels, and thereby demonstrating the need for power control as a counter-strategy, especially considering Eve’s advantages in the over-the-air channels. We further demonstrate Eve’s gain in optimizing her position, not only via being nomadic and searching for the most favorable position, but also via exploiting predictable line-of-sight (LoS) positional vulnerabilities. Specifically, we demonstrate Eve’s advantage by simply sharing the elevation angle with Bob in the LoS scenario. Finally, we examine how Eve’s advantage due to channel correlation scales with more eavesdropping antennas.
Physical-layer secure transmissions require that the legitimate parties Alice and Bob have certain signal advantages over the eavesdropper Eve. Unfortunately, it is still unknown what advantages can be guaranteed realistically in practice. This letter shows that hybrid massive MIMO can be exploited to the advantage of Alice for this purpose. Specifically, it allows Alice to use large antenna arrays that stealthy eavesdroppers cannot afford in many practical situations. To realize this advantage, an efficient transmission scheme is developed with hybrid massive MIMO, random dumb antenna selection, and channel reciprocity-based signal randomization techniques. It can secure the transmission against multiple stealthy eavesdroppers. Transmission security is analyzed assuming eavesdroppers with sufficient side knowledge and channel estimation capabilities. Simulations are conducted to verify the superior performance.
Traditional approaches for providing confidentiality of wirelessly transmitted signals are often based on cryptographic techniques. While these techniques ensure that messages are encrypted and secured against eavesdropping, they are not sufficient to protect important transmission attributes at the physical (PHY) layer. Specifically, several elds in the headers of PHY and medium access control (MAC) frames are typically sent unencrypted to maintain proper protocol functionality (e.g., sender/receiver identification). As a result, they leak side-channel information (SCI), including payload size, frequency and phase oset, modulation and coding scheme, identities of communication nodes, frame type, transmission rate, etc. These SCI can be exploited by an adversary to launch various passive (eavesdropping) and active (jamming) attacks. To complement cryptographic techniques used at upper layers and prevent the leakage of SCI at the PHY/MAC layers, PHY-layer security techniques have been introduced. These techniques exploit the characteristics of the wireless channel along with multiple-input multiple-output (MIMO) technologies, in which multiple transmitting and receiving antennas are utilized to prevent information leakage to eavesdroppers and/or avoid jamming attacks. In particular, if the signal-to-interference-plus-noise ratio (SINR) at an adversary is lower than the one at a legitimate receiver, secure communication can be achieved through the so-called wiretap coding. MIMO systems enable the transmitter and/or the receiver to generate artificial noise, called friendly jamming (FJ), so as to reduce the SINR at the adversary without impacting the SINR at the legitimate receiver. In this dissertation, we focus on exploring the security threats to next-generation wireless systems. We develop MIMO-based PHY-layer security methods to achieve reliable and secret communications in these systems. First, we consider a broadcast channel, in which a multi-antenna transmitter (Alice) sends K confidential information signals to K legitimate receivers (Bobs) in the presence of L eavesdropping devices (Eves). Alice uses MIMO precoding to generate the information signals along with her own Tx-based friendly jamming (TxFJ). Interference at each Bob is removed via a technique called MIMO zero-forcing. This TxFJ, however, leaves an eavesdropping \vulnerability region" in the proximity of each Bob, which can be exploited by a nearby Eve. Specically, because of the high correlation in the channel state information (CSI) at a Bob and nearby Eves, the TxFJ becomes less effective in preventing eavesdropping at these Eves. We address this problem by augmenting TxFJ with receiver-based friendly jamming (RxFJ), generated by each Bob. Specifically, we allow each Bob to use self-interference suppression (SIS) techniques to transmit a friendly jamming signal while simultaneously receiving an information signal over the same channel. These SIS techniques exploit circulators to attenuate the self-interference power of RxFJ at Bobs and utilize analog/digital cancellation methods to clean out any remaining residual self-interference. Considering the resulting broadcast channel, we rst study a two-user scenario and develop a secrecy encoding scheme for constructing the signals intended to two Bobs. We characterize the corresponding achievable secrecy sum-rate and formulate an optimization problem to maximize this metric. We then extend our approach to K-user scenarios and study a power minimization problem. Particularly, in our analysis we minimize the powers allocated to information and friendly jamming signals (both TxFJ and RxFJ) while guaranteeing individual secrecy rates for various Bobs. The problem is solved for the cases when the eavesdropper's CSI (ECSI) is known or unknown (but with a known distribution). Simulations show the effectiveness of the proposed solutions. Furthermore, we discuss how to schedule transmissions when the rate requirements need to be satised on average rather than instantaneously. In low and high power regime, a scheduling algorithm that serves only the strongest receivers is shown to outperform the one that schedules all receivers. Next, we consider a single-cell massive MIMO system in which a base station (BS) with a large number of antennas transmits simultaneously to several single antenna users. The BS acquires the CSI for various receivers using uplink pilot transmissions. We demonstrate the vulnerability of the CSI estimation process to a pilot-contamination (PC) attack that aims at minimizing the sum-rate of downlink transmissions by contaminating uplink pilots. We rst study PC attacks for two downlink power allocation strategies under the assumption that the attacker knows the locations of the BS and its users. Later on, we relax this assumption and consider the case when such knowledge is probabilistic. The formulated problems are solved using stochastic optimization, Lagrangian minimization, and game-theoretic methods. A closed-form solution for a special case of the problem is obtained. Furthermore, we analyze the \achievable individual secrecy rates" under PC attacks, and provide an upper-bound on these rates. We also study this scenario without a priori knowledge of user locations at the attacker by introducing chance constraints. Another attack model is considered, where the attacker generates jamming signals in both the CSI estimation and data transmission phases by exploiting inband full-duplex techniques. Our results indicate that such attacks can degrade the throughput of a massive MIMO system by more than 50%, and reduce fairness among users significantly.
The paper considers the secure transmission in a wireless environment in which both the transmitter (Alice) and the legitimate receiver (Bob) send artificial noise (AN) to interfere with the eavesdropper (Eve). Optimal design is analyzed in detail for this AN-by-both-side model to deal with Eve’s stochastic channel condition and random spatial distribution. Bipolar-beamforming is first proposed to jointly design Alice and Bob’s transmitting signals. By optimally assigning the transmitting antenna for Bob and allocating the power ratio between Alice’s information and the AN signal, maximum secrecy capacity can be achieved. Simulation is done to illustrate the process of bipolar-beamforming optimization. Results show that the AN-by-both-side model has good secrecy performance on both average and extreme conditions as Eve approaches Alice or Bob.
In this work, a directional modulation-based technique is devised to enhance the security of a multi-antenna wireless communication system employing M-PSK modulation to convey information. The directional modulation method operates by steering the array beam in such a way that the phase of the received signal at the receiver matches that of the intended M-PSK symbol. Due to the difference between the channels of the legitimate receiver and the eavesdropper, the signals received by the eavesdropper generally encompass a phase component different than the actual symbols. As a result, the transceiver which employs directional modulation can impose a high symbol error rate on the eavesdropper without requiring to know the eavesdropper's channel. The optimal directional modulation beamformer is designed to minimize the consumed power subject to satisfying a specific resulting phase and minimal signal amplitude at each antenna of the legitimate receiver. The simulation results show that the directional modulation results in a much higher symbol error rate at the eavesdropper compared to the conventional benchmark scheme, i.e., zero-forcing precoding at the transmitter.