Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IEEE Wireless Communications Letters

Exploiting Malicious RIS for Secret Key Acquisition in Physical-Layer Key Generation

Lei Hu, Guyue Li, Aiqun Hu, Derrick Wing Kwan Ng

Published Nov 7, 2023• 14 citations
Publisher

Abstract

Due to the capability of controlling wireless environments, reconfigurable intelligent surface (RIS) can be exploited to assist radio channel-based physical-layer key generation (PKG). However, this may also pose great security threats to PKG when it is controlled by an attacker. To this end, this letter studies a RIS leakage (RISL) attack that assists the attacker to manipulate the generated keys between the legitimate ends in PKG systems. Specifically, in block fading environments, by alternatingly adapting the RIS reflection coefficients to all 0s and 1s in each block, the received signal strength (RSS) at the legitimate ends is likely to be boosted and attenuated regularly across time, causing predictable 0s and 1s in the quantized bits. To resist this attack, we propose a countermeasure based on dynamic private pilots (CDPP) and prove that the RISL success probability can be significantly reduced by CDPP. Simulation results verify the effectiveness of the proposed attack and countermeasure, highlighting the importance of introducing artificial randomness for secret key security in block fading channels.

DOI
10.1109/lwc.2023.3330809

Related papers

Reconfigurable Intelligent Surface for Physical Layer Key Generation: Constructive or Destructive?

Guyue Li, Lei Hu, Paul Staat +4 more

Physical layer key generation (PKG) is a promising means to provide on-the-fly shared secret keys by exploiting the intrinsic randomness of the radio channel. However, the performance of PKG is highly dependent on the propagation environments. Due to its feature of controlling the wireless environment, reconfigurable intelligent surface (RIS) is appealing to be applied in PKG. In this article, in contrast to the existing literature, we investigate both the constructive and destructive effects of RIS on the PKG scheme. For the constructive aspect, we have identified static and wave-blockage environments as two RIS-empowered-PKG applications in future wireless systems. In particular, our experimental results in a static environment showed that RIS can enhance the entropy of the secret key, achieving a key generation rate (KGR) of 97.39 bit/s with a bit disagreement rate (BDR) of 0.083. In multi-user systems where some remote users are in worse channel conditions, the proposed RIS-assisted PKG algorithm improves the sum secret key rate by more than 2 dB, compared to the literature. Furthermore, we point out that RIS could be utilized by an attacker to perform new jamming and leakage attacks and give countermeasures, respectively. Finally, we outline future research directions for PKG systems in light of the RIS.

arXiv:2112.10043•IEEE Wireless Communications•May 9, 2022•61 citations

Impact of reconfigurable intelligent surfaces on physical layer key generation in NextG wireless networks

Guyue Li, Lei Hu, Long Jiao +3 more

Physical layer key generation (PKG) is a promising means to provide on-the-fly shared secret keys by exploiting the intrinsic randomness of the radio channel. However, the performance of PKG is highly dependent on the wireless propagation environment. Due to its feature of controlling the wireless environment, reconfigurable intelligent surface (RIS) is appealing to be applied in PKG. In this chapter, we explore the effects of RIS on PKG from both constructive and destructive perspectives. For the constructive aspect, we have identified static and wave-blockage environments as two RIS-empowered-PKG applications in future wireless systems. Furthermore, we also point out that RIS could be utilized by an attacker to perform new jamming and leakage attacks and provide countermeasures, respectively. At last, possible directions for future research have also been given.

•Apr 23, 2024•0 citations

Enhancing Secret Key Generation in Block Fading Channels using Reconfigurable Intelligent Surfaces

Hibatallah Alwazani, Anas Chaaban

Physical-layer security (PLS) is superior to classical cryptography techniques due to its notion of perfect secrecy and independence to an eavesdropper's computational power. One form of PLS arises when Alice and Bob (the legitimate users) exchange signals to extract a common key from the random common channels. The drawback of extracting keys from wireless channels is the ample dependence on the dynamicity and fluctuations of the radio channel. However, some radio channels are constant such as line-of-sight (LoS) and can be estimated by Eve (an illegitimate user), or can be quite static in behavior due to the presence low-mobility users thus restricting the amount of randomness. This in turn lowers the secret key rate (SKR) defined as the number of bits of key generated per channel use. In this work, we aim to address this challenge by using a reconfigurable intelligent surface (RIS) to produce random phases at certain carefully curated intervals such that it disrupts the channel in low-entropy environments. We propose an RIS assisted key generation method, study its performance, and compare with benchmarks to observe the benefit of using an RIS while considering various important metrics such as key mismatch rate and average secret key throughput. Simulations are made to validate our theoretical findings showing an improvement in performance when an RIS is deployed.

arXiv:2308.04726•IEEE International Symposium on Personal, Indoor and Mobile Radio Communications (PIMRC)•Sep 5, 2023•0 citations

RIS-Assisted Multi-Carrier Secret Key Generation in Static Environments

Ji Hong Gu, Chongjun Ouyang, Xin Zhang +1 more

Physical layer key generation (PLKG) is a promising method to generate secret keys by harnessing the randomness of wireless channels. In this letter, a reconfigurable intelligent surface (RIS)-assisted multi-carrier PLKG framework is proposed to overcome the lack of channel randomness in static environments. Specifically, the secret key generation rate (SKGR) is analyzed based on the inter-frequency correlation among the channel coefficients across subcarriers. Building upon this analysis, a novel scheme for configuring RIS elements is proposed to enhance the SKGR by introducing correlations into the random phase shifts of RIS elements. Simulation results are presented to validate the effectiveness of the proposed scheme.

IEEE Wireless Communications Letters•Aug 16, 2024•1 citation

RIS-Jamming: Breaking Key Consistency in Channel Reciprocity-Based Key Generation

Guyue Li, Paul Staat, Haoyu Li +6 more

Channel Reciprocity-based Key Generation (CRKG) exploits reciprocal channel randomness to establish shared secret keys between wireless terminals. This new security technique is expected to complement existing cryptographic techniques for secret key distribution of future wireless networks. In this paper, we present a new attack, reconfigurable intelligent surface (RIS) jamming, and show that an attacker can prevent legitimate users from agreeing on the same key by deploying a malicious RIS to break channel reciprocity. Specifically, we elaborate on three examples to implement the RIS-jamming attack: Using active nonreciprocal circuits, performing time-varying controls, and reducing the signal-to-noise ratio. The attack effect is then studied by formulating the secret key rate with a relationship to the deployment of RIS. To resist such RIS-jamming attacks, we propose a countermeasure that exploits wideband signals for multipath separation. The malicious RIS path is distinguished from all separated channel paths, and thus the countermeasure is referred to as contaminated path removal-based CRKG (CPR-CRKG). We present simulation results, showing that legitimate users under RIS jamming are still able to generate secret keys from the remaining paths. We also experimentally demonstrate the RIS-jamming attack by using commodity Wi-Fi devices in conjunction with a fabricated RIS prototype. In our experiments, we were able to increase the average bit disagreement ratio (BDR) of raw secret keys by 20%. Further, we successfully demonstrate the proposed CPR-CRKG countermeasure to tackle RIS jamming in wideband systems as long as the source of randomness and the RIS propagation paths are separable.

arXiv:2303.07015•IEEE Transactions on Information Forensics and Security•Jan 1, 2024•29 citations

Reconfigurable Intelligent Surface-induced Randomness for mmWave Key Generation

Shubo Yang, Han Han, Yihong Liu +3 more

Secret key generation in physical layer security exploits the unpredictable random nature of wireless channels. The millimeter-wave (mmWave) channels have limited multipath and channel randomness in static environments. In this paper, for mmWave secret key generation of physical layer security, we use a reconfigurable intelligent surface (RIS) to induce randomness directly in wireless environments, without adding complexity to transceivers. We consider RIS to have continuous individual phase shifts (CIPS) and derive the RIS-assisted reflection channel distribution with its parameters. Then, we propose continuous group phase shifts (CGPS) to increase the randomness specifically at legal parties. Since the continuous phase shifts are expensive to implement, we analyze discrete individual phase shifts (DIPS) and derive the corresponding channel distribution, which is dependent on the quantization bit. We then derive the secret key rate (SKR) to evaluate the randomness performance. With the simulation results verifying the analytical results, this work explains the mathematical principles and lays a foundation for future mmWave evaluation and optimization of artificial channel randomness.

arXiv:2111.00428•International Conference on Communications•May 28, 2023•9 citations
Due to the capability of controlling wireless environments, reconfigurable intelligent surface (RIS) can be exploited to assist radio channel-based physical-layer key generation (PKG). However, this may also pose great security threats to PKG when it is controlled by an attacker. To this end, this letter studies a RIS leakage (RISL) attack that assists the attacker to manipulate the generated keys between the legitimate ends in PKG systems. Specifically, in block fading environments, by alternatingly adapting the RIS reflection coefficients to all 0s and 1s in each block, the received signal strength (RSS) at the legitimate ends is likely to be boosted and attenuated regularly across time, causing predictable 0s and 1s in the quantized bits. To resist this attack, we propose a countermeasure based on dynamic private pilots (CDPP) and prove that the RISL success probability can be significantly reduced by CDPP. Simulation results verify the effectiveness of the proposed attack and countermeasure, highlighting the importance of introducing artificial randomness for secret key security in block fading channels.
Physical layer key generation (PKG) is a promising means to provide on-the-fly shared secret keys by exploiting the intrinsic randomness of the radio channel. However, the performance of PKG is highly dependent on the propagation environments. Due to its feature of controlling the wireless environment, reconfigurable intelligent surface (RIS) is appealing to be applied in PKG. In this article, in contrast to the existing literature, we investigate both the constructive and destructive effects of RIS on the PKG scheme. For the constructive aspect, we have identified static and wave-blockage environments as two RIS-empowered-PKG applications in future wireless systems. In particular, our experimental results in a static environment showed that RIS can enhance the entropy of the secret key, achieving a key generation rate (KGR) of 97.39 bit/s with a bit disagreement rate (BDR) of 0.083. In multi-user systems where some remote users are in worse channel conditions, the proposed RIS-assisted PKG algorithm improves the sum secret key rate by more than 2 dB, compared to the literature. Furthermore, we point out that RIS could be utilized by an attacker to perform new jamming and leakage attacks and give countermeasures, respectively. Finally, we outline future research directions for PKG systems in light of the RIS.
Physical layer key generation (PKG) is a promising means to provide on-the-fly shared secret keys by exploiting the intrinsic randomness of the radio channel. However, the performance of PKG is highly dependent on the wireless propagation environment. Due to its feature of controlling the wireless environment, reconfigurable intelligent surface (RIS) is appealing to be applied in PKG. In this chapter, we explore the effects of RIS on PKG from both constructive and destructive perspectives. For the constructive aspect, we have identified static and wave-blockage environments as two RIS-empowered-PKG applications in future wireless systems. Furthermore, we also point out that RIS could be utilized by an attacker to perform new jamming and leakage attacks and provide countermeasures, respectively. At last, possible directions for future research have also been given.
Physical-layer security (PLS) is superior to classical cryptography techniques due to its notion of perfect secrecy and independence to an eavesdropper's computational power. One form of PLS arises when Alice and Bob (the legitimate users) exchange signals to extract a common key from the random common channels. The drawback of extracting keys from wireless channels is the ample dependence on the dynamicity and fluctuations of the radio channel. However, some radio channels are constant such as line-of-sight (LoS) and can be estimated by Eve (an illegitimate user), or can be quite static in behavior due to the presence low-mobility users thus restricting the amount of randomness. This in turn lowers the secret key rate (SKR) defined as the number of bits of key generated per channel use. In this work, we aim to address this challenge by using a reconfigurable intelligent surface (RIS) to produce random phases at certain carefully curated intervals such that it disrupts the channel in low-entropy environments. We propose an RIS assisted key generation method, study its performance, and compare with benchmarks to observe the benefit of using an RIS while considering various important metrics such as key mismatch rate and average secret key throughput. Simulations are made to validate our theoretical findings showing an improvement in performance when an RIS is deployed.
Physical layer key generation (PLKG) is a promising method to generate secret keys by harnessing the randomness of wireless channels. In this letter, a reconfigurable intelligent surface (RIS)-assisted multi-carrier PLKG framework is proposed to overcome the lack of channel randomness in static environments. Specifically, the secret key generation rate (SKGR) is analyzed based on the inter-frequency correlation among the channel coefficients across subcarriers. Building upon this analysis, a novel scheme for configuring RIS elements is proposed to enhance the SKGR by introducing correlations into the random phase shifts of RIS elements. Simulation results are presented to validate the effectiveness of the proposed scheme.
Channel Reciprocity-based Key Generation (CRKG) exploits reciprocal channel randomness to establish shared secret keys between wireless terminals. This new security technique is expected to complement existing cryptographic techniques for secret key distribution of future wireless networks. In this paper, we present a new attack, reconfigurable intelligent surface (RIS) jamming, and show that an attacker can prevent legitimate users from agreeing on the same key by deploying a malicious RIS to break channel reciprocity. Specifically, we elaborate on three examples to implement the RIS-jamming attack: Using active nonreciprocal circuits, performing time-varying controls, and reducing the signal-to-noise ratio. The attack effect is then studied by formulating the secret key rate with a relationship to the deployment of RIS. To resist such RIS-jamming attacks, we propose a countermeasure that exploits wideband signals for multipath separation. The malicious RIS path is distinguished from all separated channel paths, and thus the countermeasure is referred to as contaminated path removal-based CRKG (CPR-CRKG). We present simulation results, showing that legitimate users under RIS jamming are still able to generate secret keys from the remaining paths. We also experimentally demonstrate the RIS-jamming attack by using commodity Wi-Fi devices in conjunction with a fabricated RIS prototype. In our experiments, we were able to increase the average bit disagreement ratio (BDR) of raw secret keys by 20%. Further, we successfully demonstrate the proposed CPR-CRKG countermeasure to tackle RIS jamming in wideband systems as long as the source of randomness and the RIS propagation paths are separable.
Secret key generation in physical layer security exploits the unpredictable random nature of wireless channels. The millimeter-wave (mmWave) channels have limited multipath and channel randomness in static environments. In this paper, for mmWave secret key generation of physical layer security, we use a reconfigurable intelligent surface (RIS) to induce randomness directly in wireless environments, without adding complexity to transceivers. We consider RIS to have continuous individual phase shifts (CIPS) and derive the RIS-assisted reflection channel distribution with its parameters. Then, we propose continuous group phase shifts (CGPS) to increase the randomness specifically at legal parties. Since the continuous phase shifts are expensive to implement, we analyze discrete individual phase shifts (DIPS) and derive the corresponding channel distribution, which is dependent on the quantization bit. We then derive the secret key rate (SKR) to evaluate the randomness performance. With the simulation results verifying the analytical results, this work explains the mathematical principles and lays a foundation for future mmWave evaluation and optimization of artificial channel randomness.