Artificial Intersymbol Interference (ISI) to Exploit Receiver Imperfections for Secrecy

Transcription

1 Artificial Interymbol Interference ISI to Exploit Receiver Imperfection for Secrecy Azadeh Sheikholelami, Denni Goeckel and Hoein ihro-nik Electrical and Computer Engineering Department, Univerity of Maachuett, Amhert Abtract Secure communication over a wirele channel in the preence of a paive eavedropper i conidered. We preent a method to exploit the eavedropper inherent receiver vulnerabilitie to obtain everlating ecrecy. An ephemeral cryptographic key i pre-hared between the tranmitter and the legitimate receiver and i utilized to induce intentional interymbol interference ISI. The legitimate receiver ue the key to cancel the ISI while the eavedropper, ince it doe not have the key, cannot do uch. It i hown that although ISI reduce the capacity of the main channel, it can lead to a net gain in ecrecy rate. The achievable ecrecy rate for different ISI filter etting are evaluated and the propoed method i compared with other information-theoretic ecurity cheme. I. INTRODUCTION The meage ent over a wirele network are vulnerable to being overheard by any maliciou party in the coverage range of the tranmitter. The traditional way to prevent an eavedropper from obtaining a ecret meage i to encrypt the meage uch that decoding the cypher without having the key i beyond the eavedropper computational capability []. However, the vulnerability hown by many implemented cryptographic cheme, the lack of a fundamental proof etablihing the difficulty of the cheme, and the potential for tranformative change in computing motivate form of ecurity that are provably everlating. In particular, when a cryptographic cheme i employed, the adverary can record the clean cypher and recover it later when the cryptographic algorithm i broken [] or when the eavedropper obtain the key, which i not acceptable in enitive application requiring everlating ecrecy. The deire for uch everlating ecurity motivate conidering information-theoretic approache, where the eavedropper i unable to extract any information about the ecret meage from the received ignal. The feaibility of informationtheoretic ecurity wa demontrated by the eminal work of Wyner [3], where he howed for dicrete memoryle wiretap channel, that, if the eavedropper channel i degraded with repect to the main channel, adding randomne to the codebook allow perfect ecrecy to be achieved. Later, the idea wa extended to the more general cae where the eavedropper channel i not necearily degraded, but more noiy or le capable with repect to the main channel []. Thu, the deirable ituation for achieving information theoretic ecrecy i to have a better channel from the tranmitter to the intended receiver than that from the tranmitter to the eavedropper. However, thi i not alway guaranteed, a the eavedropper can be very cloe to the tranmitter or can ue a directional antenna to improve it received ignal, while the eavedropper location and it channel tate information i not known to the legitimate node. When uch an advantage doe not exit, approache baed on public dicuion [5], [] can be employed. However, thee approache, while they could be ued to generate an information-theoretically ecure one-time pad, are baically deigned for ecret key agreement by performing multiple two-way tranmiion and utilizing a public authenticated channel [7, Chapter 7.] rather than efficient one-way ecret communication. Recently, approache baed on the cooperative jamming approach of [8] have been conidered. However, all of thee approache require either multiple antenna, helper node, and/or fading, and many are uceptible to attack uch a pointing directive antenna. For a one-way cenario with a ingle antenna, Cachin and Maurer [9] exploited hardware limitation to obtain everlating ecurity, a i our interet. In particular, they introduced the bounded memory model in uch a way that the eavedropper i not able to tore the information it would need to eventually break the cypher. Thi novel approach uffer from two hortcoming: by Moore Law ee NAND caling plot at [], the denity of memorie increae at an exponential rate; memorie can be tacked arbitrarily ubject only to very large pace limitation. Hence, although the bounded memory model i a viable approach to everlating ecurity, it i difficult to pick a memory ize beyond which it will be effective and thu it i difficult to employ in wirele communication. Our approach to provide everlating ecurity i that, intead of attacking the memory in the receiver back-end, we attack the receiver front-end. In particular, the technology of analog-to-digital converter progree lowly and unlike memory, they cannot be tacked arbitrarily in fact, high-quality already employ parallelization to the limit of the jitter. Alo, importantly from a long-term perpective, there i a fundamental bound on the ability to perform converion [], []. Hence, our goal i to exploit the receiver analog-to-digital converion proceing effect for ecurity. The tranmitter Alice and the intended receiver Bob pre-hare a cryptographic key that only need to be kept ecret for the duration of the tranmiion i.e. it can be given to the

2 Alice Fig.. The tranmitter perform fat power modulation to obtain ecrecy by utilizing a cryptographic key pre-hared between Alice and Bob. eavedropper immediately afterward. By uing thi key, we conider inerting intentional ditortion on the tranmitted ignal. Since Bob know the ditortion, he can undo it effect before hi, wherea Eve mut tore the ignal and try to compenate for the ditortion after her ; however, he already lot the information he need to recover the meage. We conidered a rapid power modulation intance of thi approach in [3] and [], where the tranmitted ignal i modulated by two vatly different power level at the tranmitter Figure. Since Bob know the key, he can cancel the effect of power modulator before hi, putting hi ignal in the appropriate range for converion. On the other hand, Eve mut compromie between larger quantization noie and more overflow. Conequently, he will loe information he need to recover the meage and informationtheoretic ecurity i obtained. However, a clear rik of thi approach i an eavedropper with multiple. Motivated by the fact that an additive white Gauian noie AWGN channel will have a higher capacity than an interymbol interference channel under the ame output power contraint, we eek to induce an ISI channel for Eve while preerving an AWGN channel at Bob. The tranmitter i equipped with a linear filter with random coefficient that are taken baed on a pre-hared key between Alice and Bob. The ecret meage i broken into chunk of data with a guard interval between every two chunk and i tranmitted over the channel after going through the ISI filter. Bob, ince he know the key, place a filter before hi in concert with the ISI filter to cancel the ISI. In order to prevent Eve from performing any kind of adaptive equalization to cancel the ISI, the coefficient of the ISI filter are changed baed on the key during each chunk. By exploiting the reulting ditortion, information-theoretic ecrecy can be obtained, even if Eve i given the key immediately after meage tranmiion. The ret of paper i a follow. Section II decribe the ytem model, metric, and the propoed idea in detail. In Section III, the achievable ecrecy rate for the propoed method are characterized. In Section IV, the reult of numerical example for variou realization of the ytem and comparion of the propoed method to the public dicuion approache of [5], [] are preented. Concluion and idea for future work are dicued in Section V. Bob Eve II. SYSTEM MODEL AND AROACH A. Sytem Model A imple wiretap channel i conidered, which conit of a tranmitter, Alice, an intended receiver, Bob, and an eavedropper, Eve. The eavedropper i aumed to be paive, i.e. it doe not attempt to actively thwart i.e. via jamming, ignal inertion the legitimate node. Thu, the location and channel tate information of the eavedropper i aumed to be unknown to the legitimate node. Alice and Bob either pre-hare a cryptographic key or ue a tandard key agreement cheme e.g. Diffie-Hellman [5] to generate a hared key. Then, the number of key bit can be expanded aggreively uing a linear feedback hift regiter LFSR to make a long key equence. Generally, the output of an LFSR, even when the initial tate i unknown, i eaily predictable, thu making it inappropriate for cryptography. However, here the key i employed only ephemerally and it i aumed peimitically that Eve i handed the full key once tranmiion i complete. Since Eve only view the tranmitted ignal through a very noiy proce uing the method decribed in Section II.B, and the key i changed by the legitimate node periodically, he cannot hope to recover the key during the tranmiion period. We conider a one-way communication ytem, and aume that both Bob and Eve are at a unit ditance from the tranmitter by including variation of the path-lo in the noie variance; thu, the channel gain of both channel i unity. Both channel experience additive white Gauian noie AWGN. Let n B and n E denote the zero-mean noie procee at Bob and Eve receiver with flat power pectrum N B f =N B / and N E f =N E /, repectively. Let ˆX denote the input of both channel, Ŷ denote the received ignal at Bob receiver, and Ẑ denote the received ignal at Eve receiver Figure. Both Bob and Eve employ high preciion uniform analogto-digital converter and the effect of the on the received ignal quantization noie i modeled by an additive Gauian noie with variance δ /, where δ i the length of one quantization level. The aumption that quantization noie follow a Gauian ditribution i not accurate; however, it enable u to ue reult of Gauian channel to obtain ome inight about the actual ytem. The equivalent continuoutime power pectrum of the quantization noie of Bob, n QB, and quantization noie of Eve, n QE, are aumed to be flat, i.e. N QB f =N QB / and N QE f =N QE /, repectively. Let X denote the current code ymbol. Since all noie are aumed to be Gauian procee, we aume that X i taken from a tandard Gauian codebook where each entry ha variance,i.e.x N,. B. Artificial ISI for ecrecy Our goal i to tudy how Alice and Bob can employ bit of the hared cryptographic key to modify their radio to gain an information theoretic advantage. Aume that Alice applie a linear filter after her D/A with pectral denity G k f a hown in Figure. The pectral denity of thi filter i choen

3 Alice Bob Eve Fig. 3. Equivalent wiretap channel. Fig.. Alice end the meage through an ISI filter that i determined by the key equence, pre-hared between Alice and Bob. Bob ue the key equence to cancel the effect of ISI on hi ignal before the analog-to-digital converion proce. baed on the pre-hared key between Alice and Bob. Since Bob hare the long key with Alice, he eaily cancel the effect of thi filter before hi properly, wherea Eve will truggle with uch. In eence, we are inducing an ISI channel that Bob i able to equalize before hi, while Eve cannot. Thu, Eve will uffer from the channel degradation due to ISI and information-theoretic ecurity i obtained. Further, Alice change the weight of ISI filter tap frequently baed on the hared key to enure that Eve i not able to perform any kind of adaptive ISI cancellation. Here we ue a filter imilar to a n-tap ISI channel, ˆxj = n g k ixj i n j= where xj i the channel input, ˆxj i the channel output, and g k i, i=,,n are filter coefficient. Hence, the pectrum of the ISI filter i, { n n G k f = i= g kie jiπf/w, f W, ele In order to confue Eve, the coefficient vector g k = [g k g k g k n ] i choen randomly from an i.i.d enemble that follow N μ, σ according to the key equence, k, pre-hared between Alice and Bob. Thee coefficient are choen uch that the ISI filter doe not change the average output tranmit power, i.e. E[g k i ]=,i=,,n. To cancel the ISI at Bob receiver, we put a filter with power pectrum H k f =/G k f at the input of Bob receiver. Note that the aumption that Bob applie a H k f =/G k f i for eae of proof of Theorem and etablihe an achievable ecrecy rate of the propoed approach. The optimization of H k f to maximize the provable ecrecy rate i a topic of ongoing work. In the equel, the average ecrecy rate that can be obtained uing the propoed method will be invetigated. III. ARTIFICIAL ISI FOR SECRECY To the bet of our knowledge the ecrecy capacity of the wiretap ISI channel i not etablihed yet. Therefore we repreent a theorem for the achievable ecrecy rate of the Gauian band-limited wiretap channel that i hown in Figure. Theorem. The average ecrecy rate of the wiretap channel hown in Figure without CSI of both the main and eavedropper channel for a given key equence, k, i: R = W log + G k f W N QB G k f + N B log + G kf W N QE + N E df. roof: The equivalent wiretap channel i hown in Figure 3. The channel noie of the main channel can be ubtituted by n B with pectrum N B f = N Bf/ G k f at the input of the main channel. Since H k fg k f =, the pectrum of quantization noie of Bob receiver will be N QB fh k fg k f =N QB f and thu n QB remain unchanged. Similarly, the total noie of the eavedropper channel can be ubtituted by n E with pectrum N E f =N Ef+ N EB f/ G k f. Since we want to induce ISI and the tranmitter doe not have knowledge of the main channel, the tranmitter doe not perform pectral-loading e.g. waterfilling at the tranmitter and thu the power pectral denity of the input of the wiretap channel, /W,ifixed. In a finite time interval of length T, by expanding the auto-correlation function of the equivalent noie of the main channel, n B t, uing the Karhunen-Loeve expanion, n Bt = n Blφ l t, l= where φ l t are the orthonormal eigenfunction and the coefficient n Bl are independent Gauian random variable of variance λ Bl = λ l N B /. The λ l are the eigenvalue correponding to the pectrum / G k f. We can repreent the other noie and the input ignal in term of φ l t, n E t = l= n El φ lt, n BQ t = l= n BQlφ l t, and xt = l= x lφ l t, where n El, n BQl, and x l are independent Gauian random variable with variance λ l N E + N QE /, N QB /, and/w, repectively. Thu, our wiretap channel i decompoed into an infinite number of independent parallel wiretap channel. Thu, R = lim T = lim T T R T log l= + log + /W N QB /+λ l N B /. /W λ l N QE + N E / By applying the Toeplitz ditribution theorem for continuou random variable [] and ince the pectrum of output filter

4 i limited to [, W ], R in i obtained. The ecrecy rate averaged over all key equence i, R = E k log G k f + W N QB G k f + N B log + G kf ] df. 3 W N QE + N E Equation for a given G k f i complicated, and thu it i not poible to obtain a cloed form for the average achievable ecrecy rate. However, in the high SNR regime, it can be hown that R in 3 i alway greater than the ecrecy capacity of the correponding wiretap channel without applying the ISI filter, which i, C = W {log + Suppoe that C regime, C = E k E k W N B + N QB log + W N E + N QE } >. Since we are working in high SNR logn E + N QE E k [ logn B G k f + N QB df log G k f W N B G k f + N QB log G k f W N E + N QE df ] log + G k f W N B G k f + N QB log + G kf W N E + N QE df ] R where the econd equality i from the fact that E k [ G k f ]=, the firt inequality i Jenen inequality, and in the lat equality we ue the fact that the probability of G k f = at uncountably infinite number of point over the interval [, W ] i zero. Thi how that inducing the ISI, which lower the capacity of the main channel, provide a net gain in ecrecy capacity. Numerical reult are preented in the next ection. IV. NUMERICAL RESULTS AND COMARISON TO OTHER METHODS In thi ection we tudy the achievable ecrecy rate of the propoed method for variou cenario. Alo, we compare the propoed method to the conventional Gauian wiretap channel [7] and public dicuion D [5]. ublic dicuion, in contrat to the wiretap channel which i limited to oneway rate-limited communication, may take advantage of twoway communication over a noiele and public authenticated Amplitude.5 tap filter,.5 =.7.5 tap filter,.5 =.9 tap filter, = Frequancy Fig.. Frequency pectrum of -tap ISI filter for variou value of variance, σ =.5,.7, and.9, and three realization of filter coefficient in each cae. channel. Hence, the legitimate partie can agree on a ecret W log W N E + N QE W log W N E + N QE key by extracting information from realization of correlated random variable. Thi ecret key can be ued in a one-timepad for ecret communication between Alice and Bob. A = W logn E + N QE W logn B + N QB = W cloed form for the general ecret-key capacity i not available; logn E + N QE logn B E k [ G k f ]+N QB df however, in the cae of a Gauian ource model in which X N, and a Gauian wiretap channel, i.e. when W ] the channel between Alice and Bob and the channel between Alice and Eve are AWGN channel, the ecrecy capacity of the public dicuion method ha a imple form [7, Chapter 5]: C SM =log + N t E + N t E N t B where here N t B = N B + N QB and N t E = N E + N QE. In the propoed method, uppoe that the bandwidth of the tranmit filter i normalized a [, W ]=[, ] and it coefficient are taken from an enemble with normal ditribution uch that the ISI filter doe not change the average tranmit power, i.e. g k i Nμ, σ,i=,,n uch that E[g k i ]=μ + σ =. The frequency pectrum of -tap ISI filter for variou value of σ for three realization of the filter coefficient are hown in Figure. oberve that a the variance of the filter coefficient become maller, the uncertainty of the hape of the frequency repone of the ISI filter leen and the eavedropper might be able to increae the information leakage by uing thi information. However, by applying a random phae hift to the tranmitted ignal baed on the key, we can prevent the eavedropper from doing uch while the achievable ecrecy rate remain unchanged. Firt we look at the extreme cae that Eve i able to receive exactly what Alice tranmit and receive e.g. the adverary i able to pick up the tranmitter radio and hook directly to the antenna, but the channel between Alice and Bob i noiy and hence the conventional wiretap channel doe not work. In other word, the channel between Alice and Bob experience an additive white Gauian noie, while Eve

5 R nat/ymbol tap, =.5 tap, =.5 5 tap, =.5 5 tap, =.7 tap, =.7 5 tap, =.7 5 tap, =.9 tap, =.9 5 tap, =.9 D SNR B Fig. 5. Achievable ecure rate of the propoed method, conventional wiretap channel, and public dicuion D v. SNR of channel between Alice and Bob while the channel between Alice and Eve i noiele Eve ha perfect acce to the tranmitted ignal. σ i the variance of the ISI filter coefficient. Becaue Eve ha perfect acce to the ignal, note that the ecrecy rate of the wiretap channel i zero. R nat/ymbol tap, =.5 tap, =.5 5 tap, =.5 5 tap, =.7 tap, =.7 5 tap, =.7 5 tap, =.9 tap, =.9 5 tap, =.9 D SNR B Fig.. Achievable ecure rate of the propoed method, conventional wiretap channel, and public dicuion D v. SNR of channel between Alice and Bob when SNR of channel between Alice and Eve i db. σ i the variance of the ISI filter coefficient. channel i noiele n E =. Figure 5 how the achievable ecrecy rate veru ignal-to-noie ratio at Bob receiver when Eve receiver i noiele. The average tranmit power = and both Bob and Eve ue -bit. It can be een that, although the eavedropper channel i much better than the main channel, when the SNR at Bob receiver i greater than 55 db, which i quite common in hort-range communication, poitive ecrecy rate are obtained. ublic dicuion, although it provide better ecrecy rate in low SNR, need two-way communication and a public authenticated channel which are not alway poible. If a public authenticated channel exit and uer can perform two-way communication, the propoed method till ha utility: it can enhance the underlying channel and thu improve the ecrecy rate of the public dicuion. Another obervation i that a the ISI channel get further from the flat channel, higher ecrecy rate are achievable due to greater variation of the channel. In the current contruction of the ISI filter, thi occur when σ get maller. In Figure, the achievable ecrecy rate veru SNR at Bob receiver i hown. Again, the average tranmit power = and both Bob and Eve ue -bit. Similar to the previou cae, a expected, channel with greater variation lead to higher ecrecy rate. For our model here, thoe correpond to channel with larger number of tap and maller σ. V. CONCLUSION In thi paper, a new method that utilize an ephemeral cryptographic key to achieve ecrecy i introduced. The ecret meage goe through a time-varying ISI filter with filter coefficient determined by the hared key. The intended receiver ue the key equence to cancel the effect of ISI on it ignal, while the eavedropper cannot. The coefficient of the filter are changed frequently and thu the eavedropper i not able to perform adaptive ISI cancellation. It i hown that thi method can ubtantially improve the achievable ecrecy rate of the correponding wiretap channel and provide ecrecy even in the cae that the eavedropper ha perfect acce to the output of the tranmitter radio. At high SNR, the ecrecy rate are better that public dicuion, which take advantage of additional reource in the form of two-way communication and a public authenticated channel. Neverthele, in the cae that two-way communication i poible and a public channel i available, our cheme can be ued in conjunction with public dicuion and improve it performance by adding more uncertainty to the adverary channel. REFERENCES [] D. Stinon, Cryptography: theory and practice. CRC pre,. [] R. Benon, The verona tory, National Security Agency Central Security Service, Hitorical ublication available via WWW. [3] A. Wyner, The wire-tap channel, Bell Sytem Technical Journal, vol. 5, no. 8, pp , 975. [] I. Cizár and J. Korner, Broadcat channel with confidential meage, IEEE Tranaction on Information Theory, vol., no. 3, pp , 978. [5] U. Maurer, Secret key agreement by public dicuion from common information, IEEE Tranaction on Information Theory, vol. 39, no. 3, pp , 993. [] R. Ahlwede and I. Cizár, Common randomne in information theory and cryptography. i. ecret haring, IEEE Tranaction on Information Theory, vol. 39, no., pp. 3, 993. [7] M. Bloch and J. Barro, hyical-layer Security: From Information Theory to Security Engineering. Cambridge Univerity re,. [8] R. Negi and S. Goel, Secret communication uing artificial noie, in IEEE Vehicular Technology Conference, 5, vol., p. 9. [9] C. Cachin and U. Maurer, Unconditional ecurity againt memorybounded adverarie, Advance in Cryptology, pp. 9 3, 997. [] R. Kuchibhatla, Imft 5-nm mlc nand: technology caling barrier broken, EE Time New and Analyi,. [] S. Krone and G. Fettwei, Fundamental limit to communication with analog-to-digital converion at the receiver, in IEEE th Workhop on Signal roceing Advance in Wirele Communication, pp. 8, 9. [] S. Krone and G. Fettwei, A fundamental phyical limit to data tranmiion and proceing, Signal roceing Letter, IEEE, vol. 7, no. 3, pp ,. [3] A. Sheikholelami, D. Goeckel, and H. ihro-nik, Exploiting the noncommutativity of nonlinear operator for information-theoretic ecurity in diadvantaged wirele environment, 5th Annual Allerton Conference,. [] A. Sheikholelami, D. Goeckel, and H. ihro-nik, Everlating ecrecy by exploiting non-idealitie of the eavedropper receiver, arxiv:.79,. [5] W. Diffie and M. Hellman, New direction in cryptography, IEEE Tranaction on Information Theory, vol., no., pp. 5, 97. [] R. E. Blahut, rinciple and ractice of Information Theory. Addion- Weley, 987. [7] S. Leung-Yan-Cheong and M. Hellman, The gauian wire-tap channel, IEEE Tranaction on Information Theory, vol., no., pp. 5 5, 978.