Group Secret Key Generation in Wireless Networks: Algorithms and Rate Optimization

Transcription

1 Group Secret Key Generation in Wireless Networks: Algoriths and Rate Optiization Peng Xu, Kanapathippillai Cuanan, Meber, IEEE, Zhiguo Ding, Senior, Meber, IEEE, Xuchu Dai and Kin K. Leung Fellow, IEEE Abstract This paper investigates group secret key generation probles for different types of wireless networks, by exploiting physical layer characteristics of wireless channels. A new group key generation strategy with low-coplexity is proposed, which cobines the well established point-to-point pairwise key generation technique, the ulti-segent schee, and the onetie pad. In particular, this group key generation process is studied for three types of counication networks: the threenode network, the ulti-node ring network and 3 the ultinode esh network. Three group key generation algoriths are developed for these counication networks, respectively. The analysis shows that the first two algoriths yield optial group key rates, whereas the third algorith achieves the optial ultiplexing gain. Next, for the first two types of networks, we address the tie allocation proble in the channel estiation step to axiize the group key rates. This non-convex axin tie allocation proble is first reforulated into a series of geoetric prograing, and then a single-condensation-ethod based iterative algorith is proposed. Nuerical results are also provided to validate the perforance of the proposed key generation algoriths and the tie allocation algorith. Index Ters Inforation-theoretic security, group key generation, ultiplexing gain, tie allocation, geoetric prograing I. INTRODUCTION Recently, secret key generation based on physical layer (PHY resources and inforation-theoretic security concepts has received a significant attention. The notion of inforationtheoretic security was first introduced by Shannon in []. In his seinal work, an one-tie pad operation was proposed to protect the secret essage whose rate cannot exceed the key Copyright (c 03 IEEE. Personal use of this aterial is peritted. However, perission to use this aterial for any other purposes ust be obtained fro the IEEE by sending a request to pubs-perissions@ieee.org The work of P. Xu and X. Dai was supported in part by the National Natural Science Foundation of China (NSFC , in part by the coprehensive strategic cooperation project of the Chinese Acadey of Sciences and Guangdong Province (03B , and in part by China Postdoctoral Science Foundation (05M The work of Z. Ding and K. Cuanan was supported by H00-MSCA-RISE-05 under grant nuber The work of Z. Ding was also supported by the Royal Society International Exchange Schee and the UK EPSRC under grant nuber EP/N005597/. Kin K. Leung was financially supported in part by the U.S. Ary Research Laboratoryand the U.K. Ministry of Defence and was accoplished under AgreeentNuber W9NF P. Xu and X. Dai are with Key Laboratory of Wireless-Optical Counications, Chinese Acadey of Sciences, School of Inforation Science and Technology, University of Science and Technology of China. Address: No. 96 Jinzhai Road, Hefei, Anhui Province, 3006, P. R. China. Kanapathippillai Cuanan is with Departent of Electronics, University of York, York, UK, YO0 5DD. Zhiguo Ding is with School of Coputing and Counications, Lancaster University, LA 4WA, UK. Kin K. Leung is with the Departent of Electrical and Electronic Engineering, Iperial College, London SW7 BT, U.K. rate, such that perfect secrecy can be achieved. This eans that the eavesdropper cannot retrieve any inforation about the secret essage even if it has unliited coputational power. Following this pioneering work, Wyner first utilized a PHYbased approach to realize inforation-theoretically secure counications in a wiretap channel, where the secrecy capacity was characterized as the difference between the utual inforation of the ain channel and the eavesdropper channel []. This type of odels is known as channel odel in the literature. In recent years, a variety of channel odel based approaches have been studied as evidenced by the work in [3] [5] and the survey in [6], where intelligent channel coding designs are exploited to avoid the requireent of secret keys. However, it has been shown that the secrecy rates achieved by these channel odel approaches are liited even with large aount of transit power, which unintentionally iproves the decoding capability of the eavesdropper [4]. In contrast to the channel odel based techniques, recently the source odel based PHY security approach has received a considerable attention, where correlative source observations between legitiate users are exploited to generate coon randoness and inforation-theoretically secure syetric keys. The works in [7] [5] aied to find inforationtheoretic secrecy key capacities in a variety of source odels, however, they have not provided ethods to obtain the source observations. Due to channel reciprocity in tie-division duplex (TDD systes, the correlative observations can be obtained via estiates of the wireless fading channels between the legitiate users, which deonstrates the advantages of the source odel based key generation approach to support secure ultiedia service. Along this direction, any works have investigated this channel reciprocity based key generation proble [6] [6]. In addition, it is exploited the fact that the eavesdropper channels are independent fro channels between the legitiate users as long as the eavesdroppers are halfwavelength away fro the legitiate users, which is a general case in wireless networks [7]. The key generation proble between a group of terinals is ore challenging due to the different rando channels associated with these terinals. The inforation-theoretic secret key capacity (i.e., the optial key rate for the group key generation in the ulti-terinal source odel was first provided in [0]. Since then, several tree-based algoriths have been developed to achieve the group secret key capacity for the ulti-terinal pairwise independent network (PIN [] [5]. On the other hand, effective group key generation algoriths have been proposed for wireless networks by exploiting channel characteristics in [8] [30]. These algoriths

2 are ore practical for real systes at the expense of soe scarification in the group key rate. This paper proposes new group key generation algoriths for three types of wireless topologies, naely, the three-node network, the ulti-node ring network and the ulti-node esh network. Firstly, this proposed schee is deonstrated using a siple three-node wireless network, where three legitiate nodes wish to agree on a coon group key without revealing this key to an external eavesdropper. Secondly, a ore coplicated ring network is considered, where the wireless links aong the M( 3 legitiate nodes are in ring-shape. Finally, the proposed key generation protocol is extended to the esh wireless network, where a wireless link exists between every two nodes. To realize optial or order-optial group key rates, the propose key generation strategy is based on the careful cobination of the well established point-topoint pairwise key generation technique, the ulti-segent schee (i.e., divide each pairwise key into ulti-segents [], [], and the one-tie pad []. The ain contributions for each type of wireless network are suarized as follows. Three-node network: a two-segent key generation algorith is proposed for a three-node network, whose ain feature is to divide each pairwise key into two segents, and then use the to generate the three-way group key. Then, the optial rate allocated to each segent is analyzed, and the achievable group key rate of the proposed algorith is deonstrated to be optial for the three-node network. Multi-node ring network: a ulti-segent key generation algorith is proposed for a ring network with M legitiate nodes, where each pairwise key is divided into M segents to a generate group key. Then, the optial rate allocated to each segent is analyzed, and the group key rate of the proposed algorith is deonstrated to be optial for the ulti-node ring network. Multi-node esh network: we extend the proposed twosegent based algorith for the three-node network to a esh network with M legitiate nodes, where each pairwise key is also divided into two segents for generating group secret keys. This proposed algorith achieves orderoptial perforance aong training-based key generation approaches in the esh wireless network with the optial ultiplexing gain M/ as defined in []. For the first two types of networks, the tie allocation is addressed in the training phases to axiize the group key rate. The non-convex tie allocation ax-in proble is first reforulated into a series of geoetric prograing through an approxiation, and then an iterative algorith is proposed by exploiting single condensation ethod. In addition, it is proven that the solution obtained through the proposed algorith satisfies the KKT conditions of Foral definitions of a ring network will be given later in this paper. An exaple of this ring network could arise in a scenario, where a nuber of legitiate users are located surrounding a ansion, and each of the can only counicate with the nearest two users via wireless channels. Note that the tie allocation algoriths are essentially different fro the key generation algoriths, the latter is used to generate keys, while the forer is used to axiize the rates of the generated keys. the original key rate axiization proble. However, the optiality of the proposed iterative algorith is validated by coparing with the exhaustive search results. Now, we briefly explain the difference between the proposed group key generation algoriths and the related existing ones to highlight our contributions. Firstly, copared to the key generation proble between two terinals in [9], [], [], the group key generation proble considered in this paper is ore challenging. Specifically, in the key agreeent process, the algoriths in [9], [], [] do not give consideration to the ulti-segent schee for each pairwise key, whereas the proposed algoriths not only design the segent-pairing schee to perfor the one-tie pad, but also analyze the optial rate allocated for each segent. Secondly, copared to the tree-based algoriths in [] [3], the proposed algoriths enjoy high efficiency and low coplexity. Specifically, the tree-based group key algoriths divide each pairwise key into ultiple one-bit segents. Then, in order to propagate these one-bit segent, the nodes adopt a transission scheduler via repeatedly finding spanning trees in the corresponding ultigraphs. Whereas, the proposed algoriths only divide each pairwise key into a sall nuber of segents with optial rate allocation, such that only a siple round robin scheduler is adopted by the nodes to transit one-tie pads of these segents in the group key agreeent. Finally, this paper solves the key rate optiization proble with respect to optial tie allocation for soe networks, which is nontrivial due to the non-convex characteristic. To the authors best knowledge, such an optiization proble has not been solved in any existing work. II. GROUP KEY GENERATION: MODEL AND REVIEW In this section, we first define the group key generation syste odel, and then review soe previous related works for the considered odel. A. Syste Model We consider a group key generation odel, where M (M 3 terinals wish to generate a coon group secret key through wireless fading channels in the presence of a passive eavesdropper. In this odel, all the legitiate terinals can transit signals over the wireless channels and they are assued to be half-duplex and equipped with a single antenna. Each node ( {,, M} sends a signal s in a given channel use. The received signals at the rest of the nodes and the eavesdropper are y i h,i s + n i, i {,, M}, i ; y E h,e s + n E, ( where h,i and h,e denote the fading channel coefficients fro node to node i and the eavesdropper, respectively; n i and n E are zero ean additive Gaussian noises with variance δ at node i and the eavesdropper, respectively. All the channel gains are assued to be independent of each other, hence, h,i is independent of h,e. In addition, it is assued that none of the terinals have a priori channel state inforation, however, their distributions are available at each nodes. For siplicity, each channel gain is assued to be a Gaussian

3 3 rando variable and the corresponding results can be easily extended to other fading channel coefficients. Moveover, we assue that channels between two nodes are reciprocal, i.e., h i,j h j,i for i, j {,, M}, and they are constant over a period of T sybols and change randoly at the beginning of the next period of T, which is known as a quasi static block fading odel in the literature. Note that these assuptions are coonly used in existing related works for key generation in wireless TDD systes [9], [], []. For each,, M, let S [s (,, s (L ] T denote the signals transitted by node in L channel uses. Following [], we assue that each node transits signals with an equal power constraint for siplicity, i.e., L E{S T S } P, {,, M}. ( In addition to the wireless channels, the legitiate terinals can also use the noiseless public channel with infinite capacity to exchange essages which can be copletely accessed by the eavesdropper. This assuption of the public channel access has been widely used in existing literature [7], [8], []. The eavesdropper is passive, which eans that it only receives fro the public and wireless channels and does not send any signals. Let F denote all the essages transitted over the public channel. Each of the legitiate terinal exploits the signals received fro wireless channels and the public channel to generate a group secret key. Let f be the key generation function at node, i.e., K N, f (S, Y, F. A group key rate R key is defined to be achievable, if for any ϵ > 0, there exists a coding schee and a rando variable K g such that P r(k N, K g ϵ,,, M, N I(K g; F ϵ, N H(K g R key ϵ. (3 Reark : Note that a ore general group key generation proble is to share a key aong a subgroup of terinals, and the other terinals outside this subgroup act as dedicated helper nodes [0], []. Such a general key generation proble has been recognized as a challenging issue, and the key capacity has not been achieved by any existing algorith. This paper ainly consider the case that all the terinals wish to share the group key. However, the proposed key generation algoriths in the following sections can be extended to this general scenario, based on the cobination with cooperative key generation approaches in [] for the dedicated helper nodes. We will take a esh network as an exaple to discuss this issue, as shown later in Section V-C. B. Review of Previous Works In this subsection, we review previous related work including the pairwise key and the group key generation schees. Pairwise key generation: By exploiting the channel reciprocity, the basic idea of the PHY based pairwise key generation (i.e., point-to-point key generation, between each pair of nodes are reviewed here [6], [7], [9], [], []. This will provide necessary background for further developent key generation algoriths in this paper. There are two ain steps involved the pairwise key generation via wireless fading channel reciprocity: ( Channel estiation via training sybols and ( Pairwise key agreeent via Slepian-Wolf coding. In the channel estiation step, each fading block is divided into M phases with each duration T,,, M, where the M nodes take turns to broadcast training sequences in these phases. Suppose node broadcasts a known sequence S using T sybols in each fading block, fro which node i obtains the estiate h,i, i. The size of S is T and the corresponding energy is defined as S T i P. For each channel h i,j, i, j,, M and i < j, the received signals after the training process, at node j and node i can be written as Y (i j Y (j i h i,j S i + N (i j, (4 h i,j S j + N (j i (5 in the i-th and the j-th phases, respectively. Then node j and node i can obtain the following estiates: h i,j h j,i ST i S i Y(i j h j,i + ST i S i N(i j, (6 ST j S j Y(j i h j,i + ST j S j N(j i. (7 In the pairwise key agreeent step, each node pair (i, j can agree on a nearly uniforly distributed pairwise key K i,j ( K j,i with arbitrarily sall error probability and the rate is R i,j I i,j /T, where I i,j is defined as [9], [], [] I i,j I j,i I( h i,j ; h j,i log ( + δ δ i,j P T i ( + δ δi,j P T j. (8 The above key rate can be achieved based on Slepian-Wolf coding and through additional transissions over the public channel and the additional details can be found in any existing works [9], [], []. Group Key Generation: A classical strategy for group key generation using the pairwise keys is to utilize tree-based algoriths related to graphs [], []. The basic idea is to treat the group key generation odel as a ultigraph, in which each pairwise key rate can be viewed as the weight of the edge associated with the corresponding two nodes. Then, a spanning tree can be found in this ultigraph, and the group key inforation can be propagated over this spanning tree by dividing each pairwise key into ultiple one-bit segents and transitting one-tie pads of these segents. By deterining the axial packing of the spanning tree in this ultigraph, the achieved group key rate can be obtained, which has been proved to achieve the group key capacity (i.e., the optial group key rate. For a given tie tuple (T,, T M, an upper bound on achievable key rates for the training-based group key

4 4 ( h, h K, : I / T, 3, N ( h, h, 3, N K : I / T 3, K : I / T,3 3 ( h, h,3,3 Fig.. The wireless network with three legitiate terinals, where each pairwise key and its rate are illustrated. For siplicity, node is denoted as N,,, 3. generation approaches can be expressed as [], [] R M upper(t,, T M where I (A in M N 3 T ( I (A, (9 in (B,,B B (A (i,j:i B l ;j B r ;l<r I( h i,j, h j,i, (0 when all the M legitiate nodes wish to share a coon key. Here B (A denotes the set of all -partitions (B,, B with each eleent B l, l, intersects with the set A {,, M}. The above upper bound can be achieved by applying existing tree-based algoriths in [], [] to the wireless networks. However, in the following sections, we develop siple ulti-segent algoriths to achieve or approach the upper bound. In addition, the key rate optiization proble in (9 with respect to tie allocation is also solved for soe scenarios in Section VI. III. GROUP KEY GENERATION AMONG THREE NODES In this section, we study the siplest group key generation proble aong three legitiate nodes (i.e., nodes, and 3, as shown in Fig.. For siplicity, we assue that h 3, N (0, δ, h, N (0, δ, h,3 N (0, δ 3. A two-segent based algorith is proposed for this odel and the corresponding paraeters are also established. This key generation proble with a larger nuber of legitiate nodes will be investigated in Section IV and Section V. A. Key Generation Algorith The proposed two-segent based key generation algorith is suarized in Algorith A, where the three legitiate nodes first generate pairwise keys based on channel estiation. Then a three-way group key is derived based on a twosegent schee and through additional counications over the public channel. More details of this algorith are discussed as follows. In the pairwise key agreeent step, based on channel estiates (shown in Fig. fro a training process and the pairwise key generation ethod in Section II-B, every pair of nodes can agree on a nearly uniforly distributed pairwise Algorith A: Group Key Generation Aong Three Nodes Step : Pairwise Key Agreeent: According to Section II-B, pairwise keys can be generated based on the training process, where the node pair (i, j agrees on a pairwise key K i,j for (i, j {(,, (, 3, (3, }. Step : Three-way Key Agreeent: Each pairwise key is divided into two independent segents, i.e., K 3, (K3,, 3 K3,, K, (K,, K,, K,3 (K,3, K,3. 3 Node broadcasts K, K3,, so that nodes, and 3 can obtain both K, and K3,. They choose the first group secret key as the one with a saller rate, denoted as K3, K,. Siilarly, nodes and 3 broadcast K,3 K, and K3, 3 K,3 3 respectively, so the three nodes can obtain the second and third group keys, denoted by K,3 K, and K3, 3 K,3. 3 Nodes, and 3 concatenate (K3, K,, K,3 K,, K3, 3 K,3 3 as the final group key. key K i,j whose rate is R i,j I /T, where I j is defined as I j I( h i,j ; h j,i log ( (, + δ δj P T + δ i δj P T j ( where (i, j {(3,, (,, (, 3}. Since the pairwise key agreeent based on channel estiation has been widely studied in any existing works (e.g., [9], [], [], the details are oitted here for siplicity. The three-way key agreeent step is ephasis of the proposed algorith, in which the two-segent schee is utilized, i.e., each pairwise key is divided into two independent segents. For exaple, let K 3, to be K 3, (K 3 3,, K 3,, which can be obtained by the one-to-one apping: K 3, K 3, K 3 3,. Such a apping criteria is known by all the nodes including the eavesdropper. Siilar appings are eployed for K, and K,3, i.e., K, (K,, K, and K,3 (K,3, K 3,3. Then, node sends K 3, K, over the public channel, so nodes and 3 can obtain both K 3, and K,. In this case, the three nodes choose the one with a saller rate as the first group key, denoted as K 3, K,. Obviously, the eavesdropper learns nothing about K 3, K, due to the one-tie pad operation. Furtherore, let R 3, and R, denote the rates of K 3, and K,, so the rate of K 3, K, is in{r 3,, R,}. Siilarly, nodes and 3 send K, K,3 and K 3,3 K 3 3,, respectively. Hence, the three nodes can obtain the second and the third group keys K, K,3 and K 3,3 K 3 3, with rates in{r,, R,3} and in{r 3,3, R 3 3,}, respectively. Concatenating the three group keys, the final group key (K 3, K,, K, K,3, K 3,3 K 3 3, can be obtained with the rate R 3 key in{r 3,,R,}+in{R,,R,3}+in{R 3,3,R 3 3,}, (

5 5 where R i i,j + Rj i,j R i,j, and (i, j {(3,, (,, (, 3}. B. Optial Rate Allocation In this subsection, the optial rate allocation schee for each segent is analyzed, i.e., analyzing (R 3,, R,, R,, R,3, R 3,3, R 3 3, in (, for a fixed tie tuple (T, T, T 3. Then, we establish the group key rate achieved by the proposed algorith. Assue that I I I 3, so R 3, R, R,3 and let R 3, x a, R 3 3, x b R 3, x a for siplicity. Then ( can be expressed as R 3 key in{x a, R,} + in{r 3,3, x b } + in{r, R,, R,3 R 3,3}, (3 where R, R,, R,3 R 3,3. We will show that it is optial to set R, x a and R 3,3 x b. Specifically, R 3 key in (3 can be upper bounded as R 3 key in{r, + in{r 3,3, x b }, R,3 + in{x a, R,}} in{r, + R 3, x a, R,3 + x a }, (4 where in each step can be replaced by when R, x a and R,3 3 x b R 3, x a. Thus, it is optial to set x a [(R 3, +R, R,3 /] + [(I + I I 3 /(T ] +, where [x] + ax{0, x}. Then Rkey 3 in{(i + I /T, (I + I + I 3 /(T } can be obtained for the case R 3, R, R,3. Syetrically, by considering other five possible orderings of (I, I, I 3, the achievable group key rate can be expressed as Rkey 3 {I T in + I, I + I 3, I 3 + I, } (I + I + I 3. (5 The following theore states that the proposed algorith is optial in ters of achieved key rates. Theore : Aong the training-based approaches for secret key generation aong three nodes, Algorith A achieves the optial key rate for a given tuple (T, T, T 3, which is defined in (5. Proof: Setting M 3 in Eq. (9, obviously the upper bound Rupper 3 is equal to Rkey 3 in (5 for a given tuple (T, T, T 3. Hence Algorith A achieves the optial group key rate. IV. GROUP KEY GENERATION IN RING NETWORKS In this section, we study the group key generation proble for a ring network, where M legitiate nodes wish to establish a coon key in a ring-shaped topology. To be ore specific, assue that h i,j h j,i N (0, δ j when (i, j {(,,, (, +,, (M, M, (M, }, and h i,j h j,i otherwise. Here denotes that there does not exist any wireless link between nodes i and j. An exaple of the ring network with four legitiate nodes is shown in Fig.. A ulti-segent based algorith is proposed for this odel and the corresponding paraeters are also established in the following subsections. Fig.. An exaple of the ring network with four legitiate nodes, where each pairwise key and its rate are illustrated. A. Group Key Generation Algorith Siilar to Section III, the pairwise and group key agreeents steps are included in the key generation protocol, as shown in Algorith B. In the pairwise key agreeent step, based on channel estiates fro a training process (shown in Fig. and the pairwise key generation ethod in Section II-B, M pairwise keys can be generated using the channel estiates, as shown in Section II-B. According to (8, the rate of K i (i,, M can be derived as R i I i /T, where I i can be expressed as I i I( h i,i ; h i,i log ( (. (6 + δ δi P + δ Ti δi P Ti In the group key agreeent step, we generate M independent group keys to establish the final group key. Firstly, each pairwise key is divided into M independent segents, Specifically, let K (K ][,, K ] [, K ]+[,, K ]M[ when M, K M (K ][. We denote the M,, K]M [ M rate of the segent K ]i[ j as R ]i[ j for i j. Secondly, we use these segents of pairwise keys to agree on M group keys. For generation of the -th group key,,, M, node first generates a rando key K ][ with a rate 3 R ][ in j {,,M},j {R ][ j }. Specifically, K ][ is generated by randoly and uniforly selecting a eleent fro the set {,, R][ }, which is independent of each pairwise key K. Then it delivers K ][ to the next node + by sending K ][ K ][ + over the public channel, so that node + can decode K ][ since it knows K ][ +. Repeat delivering this key M ties until all the M nodes obtain it. Note that the delivering order aong these nodes is (, +,, M, 0,,,. Obviously, the eavesdropper learns nothing about each group K ][, since the one-tie pad operation is exploited. Third, the final group key (K ][,, K ]M[ can be obtained by concatenating these 3 In the key generation process, the rate of each segent is known by all nodes (including the eavesdropper a priori, so that node can deterine the rate of K ][. Note that a segent is a uniforly distributed rando variable, and its rate is a constant, which only represents the value of the entropy but has nothing to do with the randoness of the segent.

6 6 Algorith B: Group Key Generation in the Ring Network Step : Pairwise Key Agreeent: According to Section II-B, pairwise keys can be generated based on the training process, where nodes M and agree on a pairwise key K, and nodes and agree on a pairwise key K,,, M. Step : Group Key Agreeent: Each pairwise key is divided into M independent segents. For generation of the -th group key, node first generates a rando key K ][, then delivers it to the next node (i.e., node + when < M, or node when M, by encrypting it using a certain segent of the pairwise key K +. Deliver this group key one-by-one M ties, until all the M nodes obtain it. All the M nodes concatenate these M groups (K ][,, K ]M[ as the final group key. ][ ][ K K ]3[ ]3[ 3 K K N N N N ][ ][ K K 3 ][ Generation of K with rate x ]3[ ]3[ K K N 3 N 4 N 3 N 4 ][ ][ 3 K K 4 ]3[ ]3[ K K 4 ]4[ ]4[ K K N N N N ][ ][ K K 3 ][ ][ 3 K K ][ Generation of K with rate x 4 ]4[ ]4[ 3 K K 3 R( x4 x x3 ]4[ ]4[ K K ]3[ ]4[ Generation of K with rate x Generation of K with rate x 3 Fig. 3. An exaple of the group key agreeent process with four legitiate nodes, where the ordering of (I, I, I 3, I 4 is I 3 I I 4 I, i.e., (3,, 4, ((, (, (3, (4, and the values of (x, x, x 3, x 4 are given in Lea. group keys with the rate of R M ring M in j {,,M},j i R]i[ i N 3 N 4 N 3 N 4 ][ ][ K K 4 j (7 where i {,,M},i j R]i[ j R j I j /T j, for j {,, M}. An exaple of the group key agreeent process with four legitiate nodes is shown in Fig. 3. B. Optial Rate Allocation In this subsection, the optial rate allocation schee for each segent is analyzed, i.e., analyzing the optial R ]i[ j (i, j {,, M}, i j in (7 for a fixed tie tuple (T,, T M. Then, we analyze the group key rate of the proposed algorith. Let R ( R ( R (M be the ordering of the rate tuple (R, R,, R M. Then, (7 can be rewritten as M axiize R of in j {,,M},j i R](i[ (j (8 i s.t. R ](i[ (j R (j, for j {,, M}; (9 i {,,M},i j R ](i[ (j 0, for i j, i, j {,, M}. (0 First, define the in function in j,,m R ]([ (j in (8 as x. Then according to each equation in (9, x in j,,m R (j R ](i[ (j. ( i {,,M},i j Furtherore, let x k R ](k[ ( for each k,, M, so M k x k R (. Then we can show that it is optial to set R ](k[ (j x k for j k and k. Specifically, the objective function R of in (8 can be expressed as M R of x + in j {,,M},j i R](i[ (j, i and its upper bound can be calculated as { R of x + in in k,,m in k,,m k,,m + in i {,,M},i k R ](i[ (k j {,,M},j k R](k[ (j { } R (k + in j {,,M},j k R](k[ (j { } R(k + x k, ( where in each step can be replaced by when R ](k[ (j x k, j k and k. This eans that it is optial to set the rate of the segent K ](k[ (j equal to the rate of the segent K ](k[ (, j k and k. In this case, x can be calculated as x in R (j j,,m in j,,m i,i j x i } ( R(j R ( + x j, (3 where the last relationship is due to the fact that M i x i R (. So x 0 is obtained. Furtherore, since x can be expressed as M x R ( x i, (4 i3

7 7 the objective function in ( and the corresponding optiization proble can be forulated as { M axiize R of in R ( + R ( x i, R (3 + x 3,, R (M + x M } i3 (5 s.t. x i 0, i,, M. (6 The following lea provides the optial solution of the above optiization proble, and hence defines the optial rate allocation policy in (7. Lea : For a given rate tuple (R (,, R (M, we have the optial solution of the optiization proble in (5 with respect to M distinct cases. Case : i.e., R ( + R ( R (3, the optial solution is x R (, x R (, x i 0 for 3 i M; Rof R ( + R (. Case ( M : i.e., + j R (j + i R (j for and optial solution is x i + j R (j > R ( + R (+, the R (i for i +, x i 0 for + i M; R of + i R (j Case M : i.e., + j R (j. > R ( + for M, the optial solution is x i M j R (j M R (i for i M; Rof M i R (j M. Proof: Refer to Appendix A. Based on the above lea, we can conclude that the proposed ulti-segent based algorith is optial. Theore 3: Aong the training-based approaches for secret key generation in the M-node ring network, the proposed ulti-segent based algorith in Algorith B achieves the optial key rate for a given tuple (T,, T, which can be written as R M ring T in {,,M} i I (i, (7 where I ( I (M is the ordering of (I,, I M with I i defined in (6. Proof: An upper bound of the group key rate for the wireless esh network has been defined in (9. Here, we siplify this upper bound according to the characteristic of the ring network considered in this section. For a given -partition (B,, B of the set of legitiate nodes A {,, M}, denote the nuber of legitiate nodes in the l-th bin B l as M l, where l M l M, M l < M. Then it can be observed that, the ter (i,j:i B l ;j B r;l<r I( h i,j, h j,i in (0 is fored by the su of the utual inforation with respect to all the wireless links that connect the nodes in different bins. For the ring network, we can show that there exist at least such wireless links. Specifically, for each l,,, there are at ost M l wireless links inside bin B l when M l < M. Hence, at ost l (M l M links exist inside all the bins. Since the total nuber of wireless links is M, the sallest nuber of links that connect the nodes in different bins is M (M. In this case, Eq. (0 can be expressed as I (A in {a,,a } A a ia I i I (i, (8 where I i is defined in (6. Then, the upper bound can be siplified as Rupper M i in I (i M T (, which is consistent with (7. On the other hand, the key rate defined in (7 can be easily obtained via Lea. Hence the proposed ulti-segent algorith achieves the optial group key rate aong trainingbased approaches. C. Discussion This subsection discusses the key rate achieved by applying the two-segent algorith in Section III to the M-node ring network, where M 4. If we divide each pairwise key into two segents, M segents can be obtained. Since the generation of a group key requires at least M segents obtained fro M different pairwise keys, at ost M/(M group keys can be generated when M 4, which require (M segents and the other two segents are useless. Thus, we only need to divide M pairwise keys, and keep the two other pairwise keys undivided. Naturally, we keep the two pairwise keys K ( and K ( undivided, and divide each of the other M pairwise keys into two segents, i.e., K ( (K(, K (, 3. For the key generation process, two group keys will be generated. Siilar to Algorith B, the first group key K can be generated based on the M segents (K (, K(3,, K (M, whose rate is in{r (, R(3,, R (M}; the second group key K can be generated based on the M segents (K (, K(3,, K (M, whose rate is in{r (, R(3,, R (M}. Cobing these two group keys, we can obtain the final group key (K, K with rate i R two ring in{r (, R (3,, R (M } + in{r (, R(3,, R (M}, (9 where R ( R( + R (, 3. It is not difficult to prove that the axiu value of Rring two is in{r ( + R (, R (3,, R (M }, which can be achieved by setting R( R (, 3. In suary, applying the two-segent algorith in Section III to the M-node ring network, the achievable rate is R two ring T in{i ( + I (, I (3,, I (M }. (30 Reark : Coparing (7 and (30, Algorith B obviously achieves a larger group key rate than the two-segent algorith, i.e., R ring Rring two. This eans that dividing each pairwise key into M segents is ore appropriate than the two-segent schee, for the M-node ring network.

8 8 Algorith C: Group Key Generation in the Mesh Network Step : Pairwise Key Agreeent: According to Section II-B, pairwise keys can be generated based on the training process, where every two nodes (i, j, i < j, agree on a pairwise key K i,j ( K j,i fro the pair of channel estiates ( h j,i, h i,j. Step : Group Key Agreeent: Each pairwise key is divided into two independent segents, i.e., K i,j (Ki,j i, Kj i,j, where Ki i,j and Kj i,j can also be expressed as Kj,i i and Kj j,i, respectively, i < j. For generation of the -th group key, node first chooses the shortest key aong {K,l, l {,, M}, l }, denoted as K,l ; then node broadcasts K,l K,l for l & l l over the public channel, such that all the M nodes can obtain this group key K,l. All the M nodes concatenate (K,l, K,l,, KM,l M M as the final group key. V. GROUP KEY GENERATION IN MESH NETWORK In this section, Algorith A proposed for the three-node scenario in Section III is extended to the wireless esh network with M legitiate nodes, where every two nodes are connected via a wireless link. Assue that h i,j h j,i N (0, δi,j for i, j {,, M}, i < j. A. Group Key Generation Algorith As shown in Algorith C, the proposed algorith also includes two key agreeent steps: pairwise key agreeent and group key agreeent. In the pairwise key agreeent step, based on channel estiates fro a training process and the pairwise key generation ethod in Section II-B, every two nodes (i, j, i < j, agree on a pairwise key K i,j ( K j,i fro ( the pair of channel estiates ( h j,i, h M i,j. Hence, there are M(M independent pairwise keys. The rate of K i,j (K j,i can be expressed as R i,j I i,j /T (R j,i I j,i /T, where I i,j (or I j,i has been given in (8. In the group key agreeent step, each pairwise key is divided into two independent segents, i.e., K i,j (Ki,j i, Kj i,j where Ki,j i and K j i,j can also be expressed as Kj,i i and K j j,i respectively, i < j. The rate of Ki,j i and Kj i,j are defined as Ri,j i ( Ri j,i and Rj i,j ( Rj j,i, respectively, where Ri,j i + Rj i,j R i,j. Using these segents, all the M legitiate nodes take turns to send essages over the public channel. For each,, M, node first chooses the shortest key K,l aong M segents, where l arg in l {,,M},l R,l. Then, it successively sends K,l K,l for l & l l, fro which node l can obtain K,l since it knows Kl, ( K,l. Finally, all the M nodes concatenate (K,l, K,l,, KM,l M M as the final group key with the rate R M key M R,l M in l {,,M},l R,l, (3 where R,l + Rl,l R,l( R l, I,l /T. The above key rate generally is not optial for the wireless esh networks, however it is order-optial as shown in the following theore. Theore 4: Algorith C achieves the ultiplexing gain M/, and such a ultiplexing gain is order-optial. Proof: On the one hand, set the rates of K,l and Kl,l to be R,l Rl,l R,l/( R l, /. Then according to (3, Algorith C achieves the following group key rate: R M key T M in R,l l {,,M},l M in I,l. (3 l {,,M},l According to (8, it can be shown that li P I,l /R s T by setting T T T M T/M, where R s log P/T. Based on the definition of the ultiplexing gain of a key rate in [], the ultiplexing gain of R M key is Rkey M li P R s T M in l {,,M},l ( li P I,l M R s. (33 On the other hand, by choosing M in (9 and (0, the upper bound of the group key rate satisfies: R M upper T (M I M(A in T (M I( h i,j, h j,i (B,,B M B M (A (i,j:i B l ;j B r ;l<r T (M i,j {,,M},i<j I i,j, (34 where the last relationship is due to the fact that there is only one node in each bin B l for the M-partition ( of the set of M legitiate nodes A. Since there are M(M such I i,j, we have Rupper M ( I i,j li li P R s T (M P R s i,j {,,M},i<j T M(M T (M M. (35 Now, it is proved that the achieved ultiplexing gain of the proposed algorith is order-optial. Reark 3: For the M-node ring network considered in Section IV, the optial ultiplexing gain is M/(M, which can be easily derived fro Theore 3. The esh network achieves a larger ultiplexing gain M/ with M > 3 copared to the ring network. This is due to that each legitiate node in the esh network can doinate ore PHY resources (i.e., wireless channels for generating a group key.

9 9 Reark 4: Since a siple round robin scheduler is adopted by the nodes to transit one-tie pads of the segents in the group key agreeent, the proposed algoriths (both Algoriths B and C only have coplexity O(M for a given tie tuple. This eans that the proposed algoriths have linear coplexity with respect to the nuber of legitiate nodes. Copared to the existing tree-based algoriths in references [] [3] with polynoial coplexity, the proposed algoriths enjoy lower coplexity. B. Optial Rate Allocation In this subsection, the optial rate allocation for each segent in (3 is solved for a fixed tie tuple (T,, T M, where the corresponding optiization proble can be fored as follows: M axiize Rkey M in l {,,M},l R,l, (36 s.t. R,l + R l,l R,l, 0 R,l R,l, (37 l, {,, M}, l. For a fixed tie tuple (T,, T M, this non-convex proble can be transfored into a convex one as follows: M axiize z (38 s.t. z R,l, (39 R,l + R l,l R,l, 0 R,l R,l, (40 l, {,, M}, l. However, a general closed-for solution for the optial rate allocation of this linear prograing proble does not exist, and this optiization proble will be solved later in Section VII using existing convex optiization softwares [3], [3]. C. Discussion This subsection discusses an achievable ultiplexing gain for a general esh network, based on a siple cobination of the proposed algorith and a cooperative key generation approach in []. As defined in [0], [], only a subgroup of terinals, denoted as A {,, L}, wish to share a coon key, and the other subgroup of terinals, denoted as B {L +,, M}, act as dedicated helper nodes. We also utilize the training ethod to generate pairwise keys between every pair of terinals, denoted as K i,j ( K j,i with rate R i,j I i,j /T, where I i,j is defined in (8, i, j {,, M}. For the group key generation process, two group keys can be generated. We first utilize the proposed algorith in Section V-A (i.e., Algorith C to generate a group key by exploiting all pairwise keys for the terinal pairs inside group A. Denote this group key as K (g. Fro (3, K(g achieves the rate R (g T L in I,l. (4 l A,l The second group key is generated with the help of the terinals in group B, i.e., it is generated by exploiting all pairwise keys for the terinal pairs (i, j, i A, j B. Specifically, based on the cooperative key generation approach in [], each terinal j B sends K j,ij K j,i, i A, i i j, over the public channel in turns, where K j,ij is the shortest key aong {K j,i, i A}. Then, all terinals in A can agree on the key K j,ij with the rate R j,ij T in i A I j,i, j B. (4 Concatenating (K j,ij, j B, the second group key can be obtained, denoted as K (g. Furtherore, concatenating (K (g, K(g, the final group key is generated, whose rate is M R(g + R j,ij. (43 R (g A jl+ In the following lea, R (g A is shown to achieve the optial ultiplexing gain in the considered general network. Lea 5: When considering the general group key generation proble aong subgroup A, the optial ultiplexing gain can be achieved by siply cobining Algorith C with the cooperative key generation approach in [], that is M L/. Proof: Siilar to the proof of Theore 4, we have li P R (g /R s L/ and li P R j,ij /R s, so the achievable ultiplexing gain is L/ + M L M L/. Furtherore, M L/ can be proved to be the optial ultiplexing gain. Based on the proof ethod for Theore 4 and a general expression of Rupper M in [] (Lea, it is not difficult to obtain li P Rupper/R M s M L/. The details are oitted here for siplicity. VI. GROUP KEY RATE OPTIMIZATION In this section, we propose an algorith to solve key rate optiization proble as shown in (9 with respect to tie allocation in the training frae. This optiization proble is non-convex and difficult to be solved in general. In this section, in order to axiize the group key rate, we solve the tie allocation proble for two cases: the three-node network and the ulti-node ring network. Note that the tie allocation proble is solved not only to optiize the proposed ulti-segent algoriths but also to optiize the previous tree-based algoriths (e.g., [], [] when applying the in wireless networks. Since a closed-for solution of the linear prograing proble in (38-(40 does not exist for a given tie tuple, the optial tie allocation proble for the esh network in Section V is untractable, which will be solved based on an exhaustive search later in Section VII. A. Three-Node network Fro (9 (or (5, this proble can be forulated as { axiize in I +I, I +I 3, I 3 +I, } (I +I +I 3 s.t. (44 3 T i T, T i 0, i,, 3. (45 i

10 0 It can be easily verified that this proble is not convex in ters of T i, i,, 3 due to the non-convex objective function. Without loss of generality, we rewrite the original proble into the following for: axiize τ 0 (46 s.t. I + I τ 0, I + I 3 τ 0, I 3 + I τ 0, (I + I + I 3 τ 0, (47 3 T i T, T i 0, i,, 3, τ 0 0. (48 i In order to approxiate this proble into a convex proble (geoetric prograing, the equivalent constraints are rewritten as fractions of two posynoials as follows [33]: iniize τ (49 s.t. ϕ i (T, T, T 3 f i(t, T, T 3 g i (T, T, T 3 τ, i,, 3, ϕ 4 (T, T, T 3 f 4(T, T, T 3 g 4 (T, T, T 3 τ, (50 3 T i T, T i 0, i,, 3, τ 0, (5 i where f (T, T, T 3 ( δ δ P T 3 + δ δ P T + δ 4 ( δ δ P T + δ δ P T + δ 4 (5 g (T, T, T 3 ( δ P T 3 + δ ( δ + δ P T ( δ + δ ( P T δ + δ P T g k (T, T, T 3, k (53 and f (T, T, T 3 (or g (T, T, T 3 and f 3 (T, T, T 3 (or g 3 (T, T, T 3 are siilarly defined by substituting (δ, δ, T 3, T, T into (δ, δ 3, T, T, T 3 and (δ 3, δ, T, T 3, T, respectively. Moveover, f 4 (T, T, T 3 ( δ P T 3 δ + δ δ P T + δ 4 (54 ( δ δ P T + δ δ P T + δ 4 ( δ δ 3 P T 3 + δ δ 3 P T + δ 4 (55 g 4 (T, T, T 3 ( δ P T 3 + δ ( δ + δ P T ( δ + δ ( P T δ + δ P T ( δ + δ ( 3 P T δ + δ 3 P T 3 g 4k (T, T, T 3. k (56 Note that here g ik (T, T, T 3, i,, 3, 4 represents the individual suation ters obtained by expanding the corresponding function. The constraints in (50 and (5 are quadratic fractional functions and therefore the corresponding optiization proble cannot be solved directly. However, the original non-convex proble can be converted into a series of geoetric prograing by exploiting single condensation ethod. In general, a fractional constraint where both the nuerator and the denoinator are posynoials, is not convex, whereas the constraint with a posynoial nuerator and a onoial denoinator is convex [33]. Therefore, the basic idea in single condensation ethod is to approxiate the denoinator posynoial into a onoial, which will convert the non-convex constraint into a convex one. Based on this approxiation, the posynoials in the denoinators of the constraints in (50-(5 are approxiated to the best onoial at a given solution and the optial tie allocations can be efficiently deterined. In order to approxiate these posynoial into the corresponding onoial the following lea is required [33]: Lea 6: Let h(x, be a posynoial and defined as K K h(x w k (x c k x n k x n k x n k, (57 k k where c k and n lk are the positive constants and arbitrary real nubers, respectively. For this posynoial, the following inequality holds: K h(x ĥ(x ( ak wk (x (58 where a k > 0 and K k a k. ĥ(ˆx is the best approxiation of h(ˆx at a given point ˆx with a k w k(ˆx h(ˆx and the inequality holds with an equality at this point. Proof: This can be easily proven based on aritheticgeoetric ean inequality. The proof is oitted here due to space liitation. Based on Lea 6, the denoinator in (50 is rewritten as follows: g (T, T, T 3 ĝ (T, T, T 3 ( ak gk (T, T, T 3, a k k (59 where a k g k(t, T, T 3, k (60 g (T, T, T 3 Siilarly g i (T, T, T 3, i, 3, 4 can be rewritten based on Lea 6 and the original proble in (49 can be reforulated as k iniize τ (6 s.t. ϕi (T, T, T 3 f i(t, T, T 3 ĝ i (T, T, T 3 τ, i,, 3, ϕ 4 (T, T, T 3 f 4(T, T, T 3 ĝ 4 (T, T, T 3 τ, (6 3 T i T, T i 0, i,, 3, τ 0. (63 i The above optiization proble can be forulated into standard geoetric prograing (convex optiization proble [34] and can be efficiently solved using existing convex optiization softwares [3], [3]. Based on single condensation ethod we develop an algorith, where tie allocation is iteratively optiized. The key steps of the proposed algorith is suarized in Algorith D. Next, we show that the solution obtained fro Algorith D satisfies the KKT conditions of the original proble in (44. a k

11 This can be proven by validating the following three conditions [35]: ϕ i (T, T, T 3 ϕ i (T, T, T 3, i, T, T, T 3. ϕ i (T, T, T 3 ϕ i (T, T, T 3, i, where T, T, T 3 are the solution obtained fro the previous iteration in Algorith D. 3 ϕ i (T, T, T 3 ϕ i (T, T, T 3, i The first condition is satisfied due to g i (T, T, T 3 ĝ i (T, T, T 3, which is developed based on Lea 6. The second condition can be shown based on the fact that the inequality in (58 is satisfied with equality when K k a k as follows: g i (T, T, T 3 k ĝ i (T, T, T 3 k g ik (T, T, T 3, When (T, T, T 3 (T, T, T 3. g ik(t, T, T 3 ( g ik (T,T,T 3 g i (T,T,T 3 a ik, (64 ĝ i (T, T, T 3 (g i (T, T, T 3 a ik k ( ĝ i (T, T, T 3 g i (T, T, T 3 k a ik. (65 Since k a ik, ĝ i (T, T, T 3 g i (T, T, T 3, therefore ϕ i (T, T, T 3 ϕ i (T, T, T 3, i. The third condition can be verified by showing ĝ i (T, T, T 3 g i (T, T, T 3. ĝ i (T, T, T 3 g ik(t, T, T 3 ( g ik k (T,T,T 3 g i(t,t,t 3 [ ] ĝ i (T, T, T 3 ĝ i ĝ i ĝ i T T T T T T T 3 T3 T 3 [ ] ĝ i T ĝ i (T, T, T 3 a ik j α jt TT ĝ k i (T, T, T 3 ĝ i (T, T, T 3 k a ik j α jt ĝ i (T, T, T 3 j α j g i T T, (66 TT where α j s is the a ik s corresponding to the coponents of g ik s with T. Siilarly, the following derivatives can be verified: ĝ i T g i ĝ i TT T, TT T 3 g i T3T T 3. 3 T3T 3 (67 Hence, the solution of Algorith D satisfies the KKT conditions of the original proble in (44. Reark 5: In the proposed algorith, the denoinator posynoial is approxiated into a onoial in each iteration based on the tie allocation obtained fro the previous iteration. Therefore, the accuracy of the approxiation of the posynoial iproves over the nuber of iterations as a ik Algorith D: Optial Tie Allocation Algorith Aong Three Nodes Step : Initialization of tie allocations of T, T and T 3 Step : Repeat Calculate g (T, T, T, g (T, T, T, g 3 (T, T, T and g 4 (T, T, T for given T, T and T 3. Calculate a ik, i,, 3, 4, k fro (60 Deterine ĝ (T, T, T 3, ĝ (T, T, T 3, ĝ 3 (T, T, T 3 and ĝ 4 (T, T, T 3 Solve the proble in (6-(63 Step 3: Until required accuracy. the difference between the tie allocations obtained fro the previous and current iterations decreases. The accuracy of the approxiation of the proposed algorith will be validated through coparison with exhaustive search results in siulations in Section VII. Reark 6: The coputational coplexity of the proposed algorith is less than that of the exhaustive search ethod. The proposed iterative algorith solves a geoetric prograing (convex optiization proble at each iteration with polynoial tie coplexity, whereas the exhaustive search ethod has non-polynoial tie coplexity. Therefore, the ain advantage of the proposed algorith is the coputational coplexity reduction. B. Four-Node Ring Network In this subsection, we consider the four-node ring network (i.e., M 4 to discuss the optial tie allocation issue. In this case, the optiization proble in (9 (or (7 can be expressed as axiize R 4 key T in {I +I, I + I 3, I + I 4, I + I 3, I + I 4, I 3 + I 4, (I + I + I 3, (I + I 3 + I 4, (I + I 3 + I 4, (I + I 3 + I 4, } 3 (I + I + I 3 + I 4, s.t. (68 4 T i T, T i 0, i,, 3, 4. (69 i Without loss of generality, the above ax-in proble can be rewritten siilar to the proble in (49-(5 by introducing a new slack variable. In addition, an iterative algorith can be developed siilar to the Algorith D to find the optial tie allocation based on a series of geoetric prograing and single condensation ethod. Due to space liitation, we oit the key steps of the algorith here. Note that the proposed Algorith D can be easily extended to a network with different nuber of nodes. VII. NUMERICAL RESULTS In this section, soe nuerical exaples are provided to illustrate the analytical results derived in this paper. For the

12 TABLE I THREE-NODE NETWORK WITH THE BLOCK LENGTH T 9 Equal Tie Allocation Proposed Algorith Exhaustive Search T T T I I I Rkey(BPCU (bits per channel use R key optial tie allocation (exhaustive search proposed tie allocation algorith equal tie allocation SNR in db TABLE II FOUR-NODE NETWORK WITH THE BLOCK LENGTH T Equal Tie Allocation Proposed Algorith Exhaustive Search T T T T I I I I Rring(BPCU (bits per channel use R ring optial tie allocation (exhaustive search proposed tie allocation algorith equal tie allocation Fig. 4. Illustration of key rate in Eq. (9 or (44 using different tie allocation schees in the three-node network. three-node and ring networks, both the proposed algoriths and existing algoriths in [], [] can achieve the optial key rate, and we ainly illustrate the proposed tie allocation algoriths. For the esh network, the proposed algorith is copared with the optial tree-based algorith [], []. For siplicity, all noise variances are assued to be one (i.e., δ, therefore the signal-to-noise ratio (SNR is equal to the power P. We first consider an asyetric three-node network, where the variance of each channel gain is δ 0., δ., δ3 5., and the channel coherence tie is T 9. The algorith is initialized with equal tie allocation (i.e., T T T 3 3. Table I represents the siulation results of three tie allocation schees with P, where the accuracy of the tie distribution is set to 0.0. As can be seen fro these results, there is only a slight difference between the results of the proposed algorith in Section VI-A and the optial exhaustive search results. Nevertheless, both of the achieve the sae group key rate bits per channel use (BPCU, which is bigger than that of the equal tie allocation schee. Fig. 4 depicts ore nuerical results of these three tie allocation schees. For this figure, it can be observed that the key rate curve of the proposed iterative algorith coincides with the one fro the exhaustive search schee, and outperfors the equal tie allocation especially at low SNRs. However, differences between these two curves becoes saller as the SNR increases. This is because the transit power becoes as the doinant factor in ters of the achievable key rate at high SNRs, and hence the perforance iproveent using the optial tie allocation is liited. Siilar phenoenons are observed in [] with respective to SNR in db Fig. 5. Illustration of key rate in Eq. (9 or (68 using three tie allocation schees in the four-node ring network. the optial power allocation. Secondly, an asyetric four-node ring network siilar to the previous scenario is also considered, where the variance of each channel gain is assued to be δ 0.5, δ 5.9, δ3 0.0, δ4., and the channel coherence tie is set to be T. Table II provides the siulation results of three tie allocation schees with P, where the required accuracy of the tie distribution has been set to the second decial. As shown in this table, the difference between the results of the proposed algorith and the optial exhaustive search schee is negligible, and both of the achieve the sae group key rate BPCU. Fro Fig. 5, it can be observed that the key rate curve of the proposed iterative algorith is the sae as the one fro the exhaustive search schee. In addition, the proposed iterative algorith outperfors the equal tie allocation. Thirdly, the key rate of the four-node esh network is considered as a function of the power P, with T, δ,3 δ,4 δ,3 δ,4 δ3,4.5, and different values of δ,. Fig. 6 copares the group key rate of the proposed key generation algorith (i.e., Eq. (3 and the optial upper bound (i.e., Eq. (9. Note that the optial rate allocation of Algorith C in Section V is obtained by solving the linear prograing proble in (38, and the optial tie allocation is obtained based on an exhaustive search. As shown in this figure, the proposed algorith achieves the optial upper bound only for a syetric network (δ,.5. The reason will be explained. Specifically, Algorith C achieves the upper

13 3 key rate (bits per channel use proposed KG algo, δ, proposed KG algo, δ.5, proposed KG algo, δ., upper bound in Eq (9, δ, upper bound in Eq (9, δ.5, upper bound in Eq (9, δ., SNR in db Fig. 6. Key rate of the proposed key generation (KG algorith (Eq. (3 and the optial upper bound (Eq. (9 in the four-node esh network, where T, δ,3 δ,4 δ,3 δ,4 δ 3,4.5. key rates (bits per channel use M R, P0 ring M R key, P0 M R ring, P0 M R key, P M (Nuber of Legitiate Nodes Fig. 7. Key rates of the proposed key generation algoriths for the ring network (Eq. (7 and esh network (Eq. (3 versus the nuber of legitiate nodes, where T 5, and the variances of all channel gains are unit. bound in Eq. (34 only when all pairwise keys have the sae rate, as discussed in the proof of Theore 4. Moreover, nuerical results deonstrate that an equal tie allocation is optial for the upper bound in Eq. (34 only in a syetric network, which eans that all pairwise keys have the sae rate and Algorith C achieves this upper bound only in the syetric case. For an asyetric network (δ,. or., a gap exists between the key rate curves of the proposed algorith and the optial one in Eq. (9. However, this gap reains constant as the SNR increases. This is due to the fact that the proposed algorith achieves the optial ultiplexing gain as shown in Theore 4. Finally, key rates of syetric ring and esh networks are considered as a function of the nuber of legitiate nodes (i.e., M, where T 5, the variances of all channel gains are unit, and the power P 0 or 0. Fig. 7 shows the group key rates of Algorith B for the ring network and Algorith C for the esh network, i.e., Rring M in Eq. (7 and RM key in Eq. (3. As shown in this figure, Rring M decreases with M and Rkey M increases with M. This is because they achieve ultiplexing gains M/(M and M/, respectively, as discussed in Reark 3. VIII. CONCLUSIONS A new key generation strategy with low-coplexity has been proposed for different types of wireless networks, which is based on the careful cobination of well established pointto-point pairwise key generation technique, the ulti-segent schee, and the one-tie pad. In the proposed algoriths, each pairwise key is divided into two segents for the threenode network, whereas each pairwise key is divided into M segents for the M-node ring network. Both of these algoriths are optial in ters of the achieved group key rates. Moreover, the proposed two-segent based algorith for the three-node scenario has been extended to the M-node esh wireless network and shown to achieve the optial ultiplexing gain M/. Next, the optial tie allocation probles have been solved for soe cases where the original non-convex ax-in proble is reforulated into a series of geoetric prograing and an iterative algorith has been developed by exploiting single condensation ethod. APPENDIX A PROOF OF LEMMA To obtain the optial solution of the ax-in optiization proble in (5, we consider (M potential steps as follows. Step : this step copares R ( + R ( and R (3. If R ( + R ( R (3, the optial solution is x i 0 for 3 i M. Such a solution axiizes the first ter in the in function in (5, and this ter becoes R ( + R ( now. Furtherore, the objective function achieves the optial rate R ( + R (, since R ( + R ( R (3 R (M in this case. Moreover, x R ( can be obtained according to (4, hence x R ( according to (3. If R ( + R ( > R (3, coparing the first two ters in the in function in (5, obviously it is optial to set x 3 to be x 3 (R ( +R ( R (3 M i4 x i/, such that R ( +R ( M i3 x i R (3 + x 3 (R ( + R ( + R (3 M i4 x i/. Then, one can refer to the following steps to find the optial tuple (x,, x M. The derivations fro step to (M can be suarized as follows: Step ( M : this step corresponds to the case + j R (j > R ( + for. (70 Moreover, the optiization proble in this step is forulated as { + j axiize R of in R (j M i+ x i, } R (+ + x +,, R (M + x M (7 s.t. x i 0, i,, M, (7

14 4 where x is given in (4 and x i is iteratively given by i j x i R (j (i R (i M i i+ x i i for 3 i +. (73 These relationships are iteratively obtained fro step to step. and R (+. First con- Now, we will copare sider the case that + i R (j + j R (j R (+. (74 Obviously the optial solution is x i 0 for + i M. Then, when 3 i +, x i can be obtained using the iterative relationship in (73 and the inductive ethod: Since x i 0 for + i M, according to (73, j x + R (j ( R (+ + j R (j R (+. (75 Note that when, x 3 is given by the above equation and this proble has been solved. When 3, we carry out with the following inductive process. i i+ i i+ + j R (j Assue that x i R (i for i + i +, where 3 i, then M i i+ x i can be calculated as M + + ( + j x i x i R (j R (i i + i + i i+ + R (j j i j + i i+ R (j i R (i + ji+ R (j. (76 So according to (73, the optial x i can be calculated as ( x i i R (j (i R (i (i j i + ( i + R (j + (i R (j j ji+ ( i (i R (j [(i (i j + i + ]R (i + (i + ji+ R (j i j R (j ( R (i + + ji+ R (j + j R (j R (i. (77 Therefore, x i + j R (j i +. Then, according to (4, x R ( + i3 R ( R (i has been proved for 3 ( + j R (j R (i + j R ( + + j3 R (j + j R (j + R (j + i3 R (i R ( R (. (78 According to (3, x can be obtained { + x j in R (j R (, R (+ R (, + j, R (M R ( } R (j R (, (79 where the last relationship holds, since the case in (74 is considered here. Now, one can verify that x i 0 for i {,, M} since the case in (74 is considered. So this solution satisfies the condition in (7, and the optial value of the objective function is R of + j R (j. + j R (j > On the other hand, consider the second case R (+. When < M, we set + j x + R (j R (+ M i+3 x, (80 + and then go to step +. When M, x M can be calculated as M x j M R (j R (M. (8 M Then, for i,, M, M x j i R (j R (i (8 M can be obtained following siilar inductive derivations fro (76 to (79. Hence R of M j R (j M. Suarizing these M steps, Lea can be proved, and there exist M distinct cases as shown in Lea. REFERENCES [] C. Shannon, Counication theory of secrecy systes, Bell Syste Technical Journal, vol. 8, no. 4, pp , 949. [] A. Wyner, The wire-tap channel, Bell Syste Technical Journal, vol. 54, no. 8, pp , Jan [3] Y. Liang, H. V. Poor, and S. Shaai, Secure counication over fading channels, IEEE Transactions on Inforation Theory, vol. 54, no. 6, pp , 008. [4] P. K. Gopala, L. Lai, and H. El Gaal, On the secrecy capacity of fading channels, IEEE Transactions on Inforation Theory, vol. 54, no. 0, pp , 008. [5] P. Xu, Z. Ding, X. Dai, and K. Leung, A general fraework of wiretap channel with helping interference and state inforation, IEEE Transactions on Inforation Forensics and Security, vol. 9, no., pp. 8 95, Feb 04.

15 5 [6] A. Mukherjee, S. A. Fakoorian, J. Huang, and A. Swindlehurst, Principles of physical layer security in ultiuser wireless networks: A survey, IEEE Counications Surveys & Tutorials, vol. 6, no. 3, pp , 04. [7] U. M. Maurer, Secret key agreeent by public discussion fro coon inforation, IEEE Transactions on Inforation Theory, vol. 39, no. 3, pp , 993. [8] R. Ahlswede and I. Csiszar, Coon randoness in inforation theory and cryptography. Part I: secret sharing, IEEE Transactions on Inforation Theory, vol. 39, no. 4, 993. [9] I. Csisza r and P. Narayan, Coon randoness and secret key generation with a helper, IEEE Transactions on Inforation Theory, vol. 46, no., pp , 000. [0], Secrecy capacities for ultiple terinals, IEEE Trans. Inforation Theory, vol. 50, no., pp , 004. [] C. Ye and A. Reznik, Group secret key generation algoriths, in IEEE International Syposiu on Inforation Theory, 007, pp [] S. Nitinawarat, C. Ye, A. Barg, P. Narayan, and A. Reznik, Secret key generation for a pairwise independent network odel, IEEE Trans. Inforation Theory, vol. 56, no., pp , 00. [3] S. Nitinawarat and P. Narayan, Perfect oniscience, perfect secrecy, and steiner tree packing, IEEE Transactions on Inforation Theory, vol. 56, no., pp , 00. [4] L. Lai and S.-W. Ho, Siultaneously generating ultiple keys and ulti-coodity flow in networks, in IEEE Inforation Theory Workshop (ITW, 0, pp [5] H. Zhang, L. Lai, Y. Liang, and H. Wang, The capacity region of the source-type odel for secret key and private key generation, IEEE Trans. Inforation Theory, vol. 60, no. 0, pp , Oct 04. [6] R. Wilson, D. Tse, and R. A. Scholtz, Channel identification: Secret sharing using reciprocity in ultrawideband channels, IEEE Transactions on Inforation Forensics and Security, vol., no. 3, pp , 007. [7] C. Ye, S. Mathur, A. Reznik, Y. Shah, W. Trappe, and N. B. Mandaya, Inforation-theoretically secret key generation for fading wireless channels, IEEE Transactions on Inforation Forensics and Security, vol. 5, no., pp , 00. [8] A. Khisti, Interactive secret key generation over reciprocal fading channels, in IEEE 50th Annual Allerton Conference on Counication, Control, and Coputing (Allerton, 0, pp [9] L. Lai, Y. Liang, and H. V. Poor, A unified fraework for key agreeent over wireless fading channels, IEEE Transactions on Inforation Forensics and Security, vol. 7, no., pp , 0. [0] L. Lai, Y. Liang, and W. Du, Phy-based cooperative key generation in wireless networks, in 49th Annual Allerton Conference on Counication, Control, and Coputing (Allerton, Allerton House, UIUC, Illinois, USA, Sept. 0, pp [], Cooperative key generation in wireless networks, IEEE Journal on Selected Areas in Counications, vol. 30, no. 8, pp , 0. [] H. Zhou, L. Huie, and L. Lai, Secret key generation in the two-way relay channel with active attackers, IEEE Transactions on Inforation Forensics and Security, vol. 9, no. 3, pp , 04. [3] J. Sun, X. Chen, J. Zhang, Y. Zhang, and J. Zhang, Synergy: A gae-theoretical approach for cooperative key generation in wireless networks, in IEEE INFOCOM, Toronto, Canada, Apr. 04, pp [4] B. T. Quist and M. A. Jensen, Maxiizing the secret key rate for infored radios under different channel conditions, IEEE Transactions on Wireless Counications, vol., no. 0, pp , 03. [5], Bound on the key establishent rate for ulti-antenna reciprocal electroagnetic channels, IEEE Transactions on Antennas and Propagation, vol. 6, no. 3, pp , 04. [6] R. Mehood, J. Wallace, and M. Jensen, Key establishent eploying reconfigurable antennas: Ipact of antenna coplexity, IEEE Transactions on Wireless Counications, vol. 3, no., pp , Nov 04. [7] D. Tse and P. Viswanath, Fundaentals of wireless counication. Cabridge university press, 005. [8] Q. Wang, H. Su, K. Ren, and K. Ki, Fast and scalable secret key generation exploiting channel phase randoness in wireless networks, in IEEE INFOCOM, 0, pp [9] H. Liu, J. Yang, Y. Wang, and Y. Chen, Collaborative secret key extraction leveraging received signal strength in obile wireless networks, in IEEE INFOCOM, Orlando, FL, Mar. 0, pp [30] H. Liu, J. Yang, Y. Wang, Y. Chen, and C. Koksal, Group secret key generation via received signal strength: Protocols, achievable rates, [3] [3] [33] [34] [35] and ipleentation, IEEE Transactions on Mobile Coputing, vol. 3, no., pp , 04. M. Grant and S. Boyd, CVX: Matlab software for disciplined convex prograing, Optiization Methods and Software, Apr. 0, available [online]: boyd/cvx. J. Lofberg, Yalip: A toolbox for odelling and optiizationin MATLAB, in Proc. IEEE Int. Syp. on Cop. Aided Control Sys. Design, Taipei, Sept. 004, pp S. Boyd, S. J. Ki, L. Vandenberghe, and A. Hassibi, A tutorial on geoetric prograing, Optiization and Engineering, vol. 8, no., pp. 67 7, 007. S. Boyd and L. Vandenberghe, Convex Optiization. Cabridge, UK: Cabridge University Press, 004. B. R. Marks and G. P. Wright, A general inner approxiation algorith for nonconvex athaatical progras, Operations Research, vol. 6, no. 4, pp , 978. Peng Xu received the B.Eng. and the Ph.D. degrees in electronic and inforation engineering fro the University of Science and Technology of China, Anhui, China, in 009 and 04, respectively. Since July 04, he has been working as a postdoctoral researchers with the Departent of Electronic Engineering and Inforation Science, University of Science and Technology of China, Hefei, China. His current research interests include cooperative counications, inforation theory, inforationtheoretic secrecy, and 5G networks. He received IEEE Wireless Counications Letters Exeplary Reviewer 05. Kanapathippillai Cuanan received the BSc degree with first class honors in electrical and electronic engineering fro the University of Peradeniya, Sri Lanka in 006 and the PhD degree in signal processing for wireless counications fro Loughborough University, Loughborough, UK, in 009. He is currently a lecturer at the Departent of Electronics, University of York, UK. Fro March 0 to Noveber 04, he was working as a research associate at School of Electrical and Electronic Engineering, Newcastle University, UK. Prior to this, he was with the School of Electronic, Electrical and Syste Engineering, Loughborough University, UK. In 0, he was an acadeic visitor at Departent of Electrical and Coputer Engineering, National University of Singapore, Singapore. Fro January 006 to August 006, he was a teaching assistant with Departent of Electrical and Electronic Engineering, University of Peradeniya, Sri Lanka. His research interests include physical layer security, cognitive radio networks, relay networks, convex optiization techniques and resource allocation techniques. Dr. Cuanan was the recipient of an overseas research student award schee (ORSAS fro Cardiff University, Wales, UK, where he was a research student between Septeber 006 and July 007.

16 6 Zhiguo Ding (S 03-M 05-SM 5 received his B.Eng in Electrical Engineering fro the Beijing University of Posts and Telecounications in 000, and the Ph.D degree in Electrical Engineering fro Iperial College London in 005. Fro Jul. 005 to Aug. 04, he was working in Queens University Belfast, Iperial College and Newcastle University. Since Sept. 04, he has been with Lancaster University as a Chair Professor. Fro Oct. 0 to Sept. 06, he has been also with Princeton University as an Acadeic Visitor. Dr Ding s research interests are 5G networks, gae theory, cooperative and energy harvesting networks and statistical signal processing. He is serving as an Editor for IEEE Transactions on Counications, IEEE Transactions on Vehicular Networks, IEEE Wireless Counication Letters, IEEE Counication Letters, and Journal of Wireless Counications and Mobile Coputing. He received the best paper award in IET Co. Conf. on Wireless, Mobile and Coputing, 009, IEEE Counication Letter Exeplary Reviewer 0, and the EU Marie Curie Fellowship Xuchu Dai received the B.Eng. degree in Electrical Engineering in 984 fro Airforce Engineering University, Xi an, China, the M.Eng. degree in 99 and the Ph.D. degree in 998 fro University of Science and Technology of China, Hefei, China, both in Counication and Inforation Syste. He now is a Professor with the Departent of Electronic Engineering and Inforation Science, University of Science and Technology of China, Hefei, China. Fro 000 to 00, he was with Hong Kong University of Science and Technology as a postdoctoral researcher. His current research interests include wireless counication systes, blind adaptive signal processing and signal detection. Kin K. Leung received his B.S. degree fro the Chinese University of Hong Kong in 980, and his M.S. and Ph.D. degrees fro University of California, Los Angeles, in 98 and 985, respectively. He joined AT&T Bell Labs in New Jersey in 986 and worked at its successors, AT&T Labs and Lucent Technologies Bell Labs, until 004. Since then, he has been the Tanaka Chair Professor in the Electrical and Electronic Engineering (EEE, and Coputing Departents at Iperial College in London. He is the Head of Counications and Signal Processing Group in the EEE Departent. His current research focuses on protocols, optiization and odeling of various wireless networks. He also works on ulti-antenna and cross-layer designs for these networks. He received the Distinguished Meber of Technical Staff Award fro AT&T Bell Labs (994, and was a co-recipient of the Lanchester Prize Honorable Mention Award (997. He was elected an IEEE Fellow (00, received the Royal Society Wolfson Research Merits Award ( and becae a eber of Acadeia Europaea (0. Along with his co-authors, he received several best paper awards, including the IEEE PIMRC 0 and ICDCS 03. He has actively served on and led conference coittees, including the IEEE SECON 06 and the ITC 8 (06. He served as a eber (009- and the chairan (0-5 of the IEEE Fellow Evaluation Coittee for Counications Society. He was a guest editor for the IEEE JSAC, IEEE Wireless Counications and the MONET journal, and as an editor for the JSAC: Wireless Series, IEEE Transactions on Wireless Counications and IEEE Transactions on Counications. Currently, he is an editor for the ACM Coputing Survey and International Journal on Sensor Networks.