Information Theoretic Security: Fundamentals and Applications

Transcription

1 Information Theoretic Security: Fundamentals and Applications Ashish Khisti University of Toronto IPSI Seminar Nov 25th 23 Ashish Khisti (University of Toronto) / 35

2 Layered Architectures Layered architecture for communication systems. Application Layer (Semantics of Information) Transport Layer (End to End Connectivity) Encryption, Authentication Secure Socket Layer Where is Security? Network Layer (Routing and Path Discovery) Virtual Private Networks Anonymous Routing Data Link Layer (Error Correction Codes) Physical Layer (Signals, RF hardware) Device level Authentication Anti-Jamming Ashish Khisti (University of Toronto) 2 / 35

3 Layered Architectures Layered architecture for communication systems. Application Layer (Semantics of Information) Transport Layer (End to End Connectivity) Encryption, Authentication Secure Socket Layer Where is Security? Wireless Systems Network Layer (Routing and Path Discovery) Virtual Private Networks Anonymous Routing Data Link Layer (Error Correction Codes) Physical Layer (Signals, RF hardware) Ashish Khisti (University of Toronto) 2 / 35

4 Traditional Approach A typical graduate level course in computer security introduces Shannon s notion of security. Shannon s Notion Message W Alice X X Bob decoded message W key K X key K Eve Perfect Secrecy: p(w x)=p(w) Note that Key Size = Message length, hence impractical Focus: computational cryptography Is this all about information theoretic security? Ashish Khisti (University of Toronto) 3 / 35

5 Outline Motivating Applications Secure Biometrics Smart-Meter Privacy Wireless Systems Information Theoretic Models Wiretap Channel Model Secret-key agreement Ashish Khisti (University of Toronto) 4 / 35

6 Biometric Technologies Laptop ATM Passport Ashish Khisti (University of Toronto) 5 / 35

7 Biometric Technologies Laptop ATM Passport Enrollment Feature Extraction Biometric Stored in clear Authentication =? Feature Extraction Ashish Khisti (University of Toronto) 5 / 35

8 Biometric Technologies Laptop ATM Passport Enrollment Feature Extraction Biometric Stored in clear Authentication =? Feature Extraction Issue: Biometrics are stored in the clear Ashish Khisti (University of Toronto) 5 / 35

9 Biometrics: Toy Example Enrolment Biometric Biometric Channel Authentication Biometric No Error Bit Flipped Bit 6 Flipped Bit 7 Flipped 8 Possible Events : All Equally Likely Ashish Khisti (University of Toronto) 6 / 35

10 Biometrics: Toy Example X, Y : length seven binary sequence Channel Model: one bit flip (8 possibilities) 3 bits required. Ashish Khisti (University of Toronto) 7 / 35

11 Biometrics: Toy Example X, Y : length seven binary sequence Channel Model: one bit flip (8 possibilities) 3 bits required. Syndrome Encoder Syndrome Decoder Enrollment Biometric Syndrome bits Authentication Biometric Syndr. Ashish Khisti (University of Toronto) 7 / 35

12 Biometrics: Toy Example X, Y : length seven binary sequence Channel Model: one bit flip (8 possibilities) 3 bits required. Syndrome Encoder Syndrome Decoder Enrollment Biometric Syndrome bits Authentication Biometric Syndr. Ashish Khisti (University of Toronto) 7 / 35

13 Biometrics: Toy Example X, Y : length seven binary sequence Channel Model: one bit flip (8 possibilities) 3 bits required. Syndrome Encoder Syndrome Decoder Enrollment Biometric Syndrome bits Authentication Biometric Syndr. Ashish Khisti (University of Toronto) 7 / 35

14 Biometrics: Toy Example X, Y : length seven binary sequence Channel Model: one bit flip (8 possibilities) 3 bits required. Syndrome Encoder Syndrome Decoder Enrollment Biometric Syndrome bits Authentication Biometric Syndr. Ashish Khisti (University of Toronto) 7 / 35

15 Privacy Preserving Biometrics S. Draper, A. Khisti, et. al Using distributed source coding to secure fingerprint biometrics ICASSP, 27 X Encode enrollment biometric Syndrome Encoding S Store syndrome S Original enrollment biometric Store syndromes Ashish Khisti (University of Toronto) 8 / 35

16 Privacy Preserving Biometrics S. Draper, A. Khisti, et. al Using distributed source coding to secure fingerprint biometrics ICASSP, 27 X Encode enrollment biometric Syndrome Encoding S Store syndrome S Decode w/ probe biometric Syndrome Decoding Original enrollment biometric Fingerprint Channel Y Original enrollment biometric Store syndromes Reproduce enrollment biometric Authentication biometric Ashish Khisti (University of Toronto) 8 / 35

17 Privacy Preserving Biometrics S. Draper, A. Khisti, et. al Using distributed source coding to secure fingerprint biometrics ICASSP, 27 Biometric Authentication X Encode enrollment biometric Syndrome Encoding S One way hash Store syndrome S Decode w/ probe biometric Syndrome Decoding One way hash Original enrollment biometric Fingerprint Channel Y Original enrollment biometric Store syndromes Reproduce enrollment biometric Authenticate Authentication biometric Ashish Khisti (University of Toronto) 8 / 35

18 Smart-Meter Privacy D. Varodayan and A Khisti, ICASSP 2 C. Efthymiou and G. Kalogridis, Smart grid privacy via anonymization of smart metering data, Smart Grid Commun. Conf., Gaithersburg, 2. Ashish Khisti (University of Toronto) 9 / 35

19 Smart-Meter Privacy D. Varodayan and A Khisti, ICASSP 2 User Appliances X Rechargeable Battery Y Utility Company Privacy Leakage: I(X N ;Y N ) Battery: Limited Storage Model Battery as a Finite State Communication Channel Design the Channel Ashish Khisti (University of Toronto) 9 / 35

20 Secret-Key Generation in Wireless Fading Channels m A A Forward Link BA B y h x n B y h x n A BA AB A AB Reverse Link B m B K A K B Channel Gain Reverse Channel Forward Channel Fading Reciprocity Spatial Decorrelation time Ashish Khisti (University of Toronto) / 35

21 Secret-Key Generation in Wireless Fading Channels m A A Forward Link A BA B y h x n B y h x n BA AB A AB Reverse Link B m B K A z AE g AE x n A AE z BE g x n BE B K B BE Channel Gain Eavesdropper Link E Reverse Channel Forward Channel Fading Reciprocity Spatial Decorrelation time Ashish Khisti (University of Toronto) / 35

22 Secret-Key Generation in Wireless Fading Channels A. Khisti 23 m A K A A z AE ForwardLink g y h A AE BA y h B x n A B x n AE BA AB z x n BE A AB ReverseLink g BE x n B BE B K B m B Start E Channel Probing N ĥ AB N ĥ BA Key Extraction Shared Key Two Phase Approach: Phase I: Channel Probing and Estimation: (ĥn AB, ĥn BA ) Phase 2: Source Reconciliation and Key Extraction Secret-Key Generation: Capacity Limits Ashish Khisti (University of Toronto) / 35

23 Secure MIMO Communication Enc. Dec. Rx. Tx. Eaves.?????? Signal of interest: direction of legitimate receiver. Synthetic noise: null-space of legitimate receiver. Ashish Khisti (University of Toronto) 2 / 35

24 Secure MIMO Multicast A. Khisti, 2 Noise Symbols Artificial Noise Alignment Rx Information Symbols IA Precoder Ev Rx2 Signal Masking Transmitter Align Noise Symbols at Legitimate Receivers Mask Information Symbols at Eavesdroppers Ashish Khisti (University of Toronto) 3 / 35

25 Outline Motivating Applications Secure Biometrics Smart-Meter Privacy Wireless Systems Information Theoretic Models Wiretap Channel Model Secret-key agreement Ashish Khisti (University of Toronto) 4 / 35

26 Wiretap Channel Wyner 75 AWGN Wiretap Channel Model Z n r M Encoder X n Z n e Y n r Receiver ˆM Y n e?? Eaves. Reliability Constraint : Pr(M ˆM) n Secrecy Constraint : n H(M Y n e ) = n H(M) o n() Secrecy Capacity Ashish Khisti (University of Toronto) 5 / 35

27 Secrecy Criterion n H(M Y e n ) }{{} Equivocation rate = n H(M) o n () }{{} Information rate Perfect Secrecy: o n (), (Shannon 49) n Weak Secrecy: o n (), (Wyner 75) Strong Secrecy: o n () O ( n), (Maurer and Wolf ) Guessing approach : (Arikan & Merhav 2) Focus: Wyner s notion Ashish Khisti (University of Toronto) 6 / 35

28 Joint Encryption and Encoding Separation based approach vs. Wiretap codes Traditional Approach : Separation... Z n r Key M Key Encryption Encoder X n Z n e Yn r Decoder Decryption ˆM Y n e?? Eaves. Traditional Approach Separation based Requires keys Wiretap Codes Joint encryption/encoding Channel based secrecy Ashish Khisti (University of Toronto) 7 / 35

29 Joint Encryption and Encoding Separation based approach vs. Wiretap codes Wiretap Codes: Joint Encryption and Encoding Z n r Key M Secure Encoder X n Z n e Yn r Decoder Decryption ˆM Y n e?? Eaves. Traditional Approach Separation based Requires keys Wiretap Codes Joint encryption/encoding Channel based secrecy Ashish Khisti (University of Toronto) 7 / 35

30 Joint Encryption and Encoding Separation based approach vs. Wiretap codes Wiretap Codes: Joint Encryption and Encoding Z n r M Secure Encoder X n Z n e Yn r Secure Decoder ˆM Y n e?? Eaves. Traditional Approach Separation based Requires keys Wiretap Codes Joint encryption/encoding Channel based secrecy Ashish Khisti (University of Toronto) 7 / 35

31 Wiretap Codes Uniform Noise Wiretap Channel Model Z n r M Secure Encoder X n Z n e Yn r Secure Decoder ˆM Y n e?? Eaves. QAM Modulation Uniform noise model Recv. Noise Eaves. Noise σ 2 e = 4σ 2 r σ 2 e = 4σ 2 r Ashish Khisti (University of Toronto) 8 / 35

32 Wiretap Codes QAM Modulation Recv. Noise Eaves. Noise σ 2 e = 4σ2 r Uniform noise model Ashish Khisti (University of Toronto) 9 / 35

33 Wiretap Codes QAM Modulation Recv. Noise Eaves. Noise σ 2 e = 4σ2 r Uniform noise model Receiver s Constellation Eavesdropper s Constellation C r = log 2 64 = 6 b/s C e = log 2 6 = 4 b/s Ashish Khisti (University of Toronto) 9 / 35

34 Wiretap Codes QAM Modulation Recv. Noise Eaves. Noise σ 2 e = 4σ2 r Uniform noise model Receiver s Constellation Eavesdropper s Constellation C r = log 2 64 = 6 b/s C e = log 2 6 = 4 b/s C s = C r C e = 2 b/s Ashish Khisti (University of Toronto) 9 / 35

35 Wiretap Codes Secure QAM Constellation Msg Msg2 Msg3 Msg4 Ashish Khisti (University of Toronto) 2 / 35

36 Wiretap Codes Encoding: Randomly select one candidate Msg Msg2 Msg3 Msg4 Ashish Khisti (University of Toronto) 2 / 35

37 Wiretap Codes Decoding at legitimate receiver Msg Msg2 Msg3 Msg4 Ashish Khisti (University of Toronto) 2 / 35

38 Wiretap Codes Confusion at the eavesdropper Msg Msg2 Msg3 Msg4 Ashish Khisti (University of Toronto) 2 / 35

39 Gaussian Wiretap Channel Leung-Yan-Cheong and Hellman 78 Z n r M Encoder X n Z n e Y n r Receiver ˆM Y n e?? Eaves. Secrecy Capacity C s = {log(+snr r ) log(+snr e )} + = {C(SNR r ) C(SNR e )} + SNR r : Legitimate receiver s signal to noise ratio SNR e : Eavesdropper s signal to noise ratio Ashish Khisti (University of Toronto) 2 / 35

40 Other Classical Results The secrecy capacity was also characterized for: Degraded Memoryless Wiretap Channel(Wyner 75) X Y r Y e C = max p X I(X;Y r ) I(X;Y e ) Discrete Memoryless Wiretap Channel (Csiszar-Korner 78) C = max p U,X I(U;Y r ) I(U;Y e ), U X (Y r,y e ) Cardinality bounds on the alphabet of U Ashish Khisti (University of Toronto) 22 / 35

41 Gaussian Wiretap Channel Receiver Transmitter?????? Eavesdropper Strong Requirement: Eavesdropper must not be closer to the transmitter Ashish Khisti (University of Toronto) 23 / 35

42 Gaussian Wiretap Channel Receiver Transmitter Eavesdropper Strong Requirement: Eavesdropper must not be closer to the transmitter Ashish Khisti (University of Toronto) 23 / 35

43 Solution... Multiple Antennas Khisti-Wornell 2 Multi-antenna wiretap channel Receiver Transmitter???? Eavesdropper Spatial Diversity: Multiple Antennas Temporal Diversity: Fading Channels Ashish Khisti (University of Toronto) 24 / 35

44 Solution... Multiple Antennas Khisti-Wornell 2 Multi-antenna wiretap channel Receiver Transmitter???? Channel Model Y r = H r X +Z r Y e = H e X +Z e Eavesdropper Channel matrices: H r C Nr Nt, H e C Ne Nt N t : # Tx antennas AWGN noise: Z r, Z e Ashish Khisti (University of Toronto) 24 / 35

45 MIMOME: Secrecy Capacity Khisti-Wornell 2 Theorem Secrecy capacity of the Multi-antenna wiretap channel is given by, C s = max logdet(i r +H r QH r ) logdet(i e +H e QH e ) Q :Tr(Q) P Ashish Khisti (University of Toronto) 25 / 35

46 MIMOME: Secrecy Capacity Khisti-Wornell 2 Theorem Secrecy capacity of the Multi-antenna wiretap channel is given by, C s = max logdet(i r +H r QH r ) logdet(i e +H e QH e ) Q :Tr(Q) P Scalar Gaussian Case (Leung-Yan-Cheong & Hellman 78), C s = log(+snr r ) log(+snr e ) New information theoretic upper-bound Convex Optimization Matrix Analysis Ashish Khisti (University of Toronto) 25 / 35

47 Secrecy Capacity: Remarks C s = max logdet(i r +H r QH r) logdet(i e +H e QH e) Q :Tr(Q) P Ashish Khisti (University of Toronto) 26 / 35

48 Secrecy Capacity: Remarks C s = max logdet(i r +H r QH r) logdet(i e +H e QH e) Q :Tr(Q) P Convex Reformulation C s = min Φ P max Q Q R +(Φ,Q) Ashish Khisti (University of Toronto) 26 / 35

49 Secrecy Capacity: Remarks C s = max logdet(i r +H r QH r) logdet(i e +H e QH e) Q :Tr(Q) P Convex Reformulation C s = min Φ P max Q Q R +(Φ,Q) 2 MISOME Case: rank-one covariance is optimal C s = log + λ max (I +Ph r h r,i +PH eh e ) Ashish Khisti (University of Toronto) 26 / 35

50 Secrecy Capacity: Remarks C s = max logdet(i r +H r QH r) logdet(i e +H e QH e) Q :Tr(Q) P Convex Reformulation C s = min Φ P max Q Q R +(Φ,Q) 2 MISOME Case: rank-one covariance is optimal C s = log + λ max (I +Ph r h r,i +PH eh e ) 3 High SNR case: GSVD transform Simultaneous diagonalization: (H r,h e ) Ashish Khisti (University of Toronto) 26 / 35

51 Masked Beamforming Scheme MISOME Case: Y r = h rx +Z r, Y e = H e X +Z e Enc. Dec. Rx. Tx. Eaves.?????? Ashish Khisti (University of Toronto) 27 / 35

52 Masked Beamforming Scheme MISOME Case: Y r = h rx +Z r, Y e = H e X +Z e Enc. Dec. Rx. Tx. Eaves.?????? Signal of interest: direction of legitimate receiver. Synthetic noise: null-space of legitimate receiver. Ashish Khisti (University of Toronto) 27 / 35

53 Masked Beamforming vs. Capacity Achieving Scheme MISOME Case: Y r = h rx +Z r, Y e = H e X +Z e Masked beamforming scheme Capacity achieving scheme h r, H e Scalar Wiretap Code h r Masked Beam-forming Scalar Wiretap Code h, H r e Optimal Beam-forming Ashish Khisti (University of Toronto) 28 / 35

54 Masked Beamforming vs. Capacity Achieving Scheme MISOME Case: Y r = h rx +Z r, Y e = H e X +Z e Masked beamforming scheme Capacity achieving scheme h r, H e Scalar Wiretap Code h r Masked Beam-forming Scalar Wiretap Code h, H r e Optimal Beam-forming { ) } lim C (h r,h e, PNt R MB (h r,h e,p) = P Transmit Power: P Transmit antennas: N t Ashish Khisti (University of Toronto) 28 / 35

55 Outline Motivating Applications Secure Biometrics Smart-Meter Privacy Wireless Systems Information Theoretic Models Wiretap Channel Model Secret-key agreement Ashish Khisti (University of Toronto) 29 / 35

56 Secret Key Generation Maurer 93, Ahlswede-Csiszar 93 u N v N A F = f(u N ) B k = K A (u N ) ˆk = K B (v N,f) Error Probability: Pr(k ˆk) ε N Equivocation: N H(k f) N H(k) ε n Rate R = N H(k) C key = I(u;v) Ashish Khisti (University of Toronto) 3 / 35

57 Achievability Random Binning Technique (Slepian-Wolf 73) u N Slepain-Wolf Encoder Bin-Index Bin Bin 2 No. of Bins: 2 nh(v u) No. of Sequences/Bin: 2 ni(u;v) Ashish Khisti (University of Toronto) 3 / 35

58 Joint Source and Channel Coding Khisti-Diggavi-Wornell 8 u N v N Enc. x n p(y,z x) yn z n dec w.t. Two types of uncertainty Sources Channel How to combine both these equivocation for secret-key-distillation? Ashish Khisti (University of Toronto) 32 / 35

59 Achievability Wiretap Codebook x n y n Wiretap Decoder u N Wyner-Ziv Codebook Bin Index v N Bin Index Wyner-Ziv Decoder W-Z Codeword Secret-Key Codebook k k W-Z Codeword Secret Key Codebook Encoder Decoder R key = max βi(t;v) t,x }{{} src. equiv. +I(x;y) I(x;z) }{{} channel equiv. t u v, β{i(t;u) I(t;v)} I(x;y) Ashish Khisti (University of Toronto) 33 / 35

60 Capacity Results R key = max t,x βi(t;v)+i(x;y z) t u v, β{i(t;u) I(t;v)} I(x;y) Upper and lower bounds coincide, when channels are degraded or parallel reversely degraded broadcast. Capacity for Parallel Gaussian broadcast channels and Gaussian sources Extension to side information at the eavesdropper, when sources and channels are degraded. Ashish Khisti (University of Toronto) 34 / 35

61 Conclusions Motivating Applications Secure Biometrics Smart-Meter Privacy Wireless Systems Information Theoretic Models Wiretap Channel Model Secret-key agreement Ashish Khisti (University of Toronto) 35 / 35