Secure Physical Layer Key Generation Schemes: Performance and Information Theoretic Limits

Transcription

1 Secure Physica Layer Key Generation Schemes: Performance and Information Theoretic Limits Jon Waace Schoo of Engineering and Science Jacobs University Bremen, Campus Ring, 879 Bremen, Germany Phone: Emai: Abstract There is growing interest in wireess security methods that provide strong or even perfect secrecy by taking advantage of features of the physica propagation channe. In advantage-based methods, high channe quaity in an average or opportunistic sense is expoited between two egitimate nodes, such that nonzero secrecy capacity can be achieved. Since such methods require bounds on the quaity of the eavesdropper channe, they are somewhat impractica. Secret key generation based on tracking channe evoution in time division dupex systems is a more attractive option, where two nodes generate secret key bits based on a mutuay known random channe. Since the eavesdropper channe is typicay independent of the egitimate channe, the key can ony be broken by brute force attacks, which are difficut when new keys are continuousy generated. In this paper, the information theoretic imits of key generation schemes are investigated, based on the eve of estimation error, tempora correation, and dependence of the eavesdropper and egitimate channes. Two practica candidate key generation schemes are aso considered: channe quantization and channe quantization with guardband. I. INTRODUCTION Security is an important concern for wireess networks where by nature signas are transmitted in a broadcast fashion, and there is growing interest in methods that provide strong or even perfect secrecy by taking advantage of the behavior of wireess channes. For exampe, if the egitimate users have a channe with an SNR advantage reative to a potentia eavesdropper, there exists a nonzero secrecy capacity, aowing finite information to be exchanged without giving any information to the eavesdropper [], []. For fading channes, pairs of users can signa opportunisticay to create an effective SNR advantage reative to an eavesdropper, thus providing nonzero secrecy capacity even when the eavesdropper has an average SNR advantage. A probem with advantage-based methods is that some knowedge or bound about the eavesdropper channe quaity is required. Aternativey, secret keys can be generated based on fuctuations or evoution of the channe state [] []. In a wireess system with time-division dupex (TDD), the forward and reverse propagation channes are identica by reciprocity. When there is high mutipath, rapid fading causes the channe to the eavesdropper to be independent of the egitimate channe. Even for a ine-of-sight (LOS) channe without mutipath, random movement can cause channe phase fuctuations that are independent at mutipe nodes. The evoving channe state information represents common randomness [6], [7] that can be observed by the egitimate transmitter and receiver, but not at the eavesdropper, aowing keys to be dynamicay generated. Since secret key generation ony requires channe independence, it may be more practica than advantage-based methods. In practice, a number of factors imit the rate at which secret key bits can be generated: () estimation error, () spatetime correation, and () dependence of the eavesdropper and Node h a h b h a Eavesdropper h c Node Fig.. System mode for a wireess communications scenario consisting of egitimate communicating nodes and as we as a node that is an eavesdropper egitimate channe. This paper provides an information theoretic anaysis of these factors for vector Gaussian channes, indicating fundamenta imits on the number of unique key bits that can be generated per channe reaization. In addition to the information theoretic anaysis, two simpe and practica key generation schemes are considered: channe quantization (CQ) [] and a new extension to CQ that incudes guardband (CQG). The methods are simuated for a path-based fading channe mode, and their performance is compared in terms of efficiency and the mismatch rate of key bits. II. SYSTEM MODEL Figure depicts the mode for a wireess communications system. Nodes and are egitimate users that woud ike to communicate securey, whie node is a potentia eavesdropper. Reciproca vector channes h a = h a are referred to as the forward and reverse channes for egitimate communications, which are estimated by nodes and, respectivey. Channes h b and h c, on the other hand, convey information to (and are estimated by) the eavesdropper. Due to noise, the nodes have imperfect estimates of the channes, or ĥ a = h a +ɛ, ĥ a = h a +ɛ, ĥ b = h b +ɛ, ĥ c = h c +ɛ, () where ɛ i is zero-mean compex Gaussian estimation error at node i having variance σi. Note that the meaning of the eements in the channe vectors is arbitrary and can refer to mutipe frequency bins, stacked eements of a mutipe-input mutipe-output (MIMO) channe, or both. In the anaysis, it is assumed that the channes are aso zero-mean correated compex Gaussian random processes, characterized by the covariance matrices R rp = E { h r h H } } p ˆR rp = E {ĥr ĥ H p, ()

2 Fig.. ĥ a ĥ b, ĥc (i) Bits avaiabe for key generation I(ĥa;ĥa ) = I K ĥ a (ii) Secret bits I(ĥa;ĥa ĥb,ĥc) = I SK (iii) Vunerabe Bits I VK = I K I SK Graphica representation of quantities for key generation where {r, p} {a, a, b, c}. For simpicity, it is assumed that the processes are not temporay correated, which coud be achieved by ony samping the inks at intervas much onger than the coherence time or performing a pre-whitening operation. Scenarios with nonzero channe mean can aso be handed by subtracting this mean from the channes, as this does not change mutua information. A two-dimensiona path-based channe mode wi be used to describe the inks in Figure. The genera MIMO channe from transmitter k of node n to receiver i of node m is h (m,n) ik = β (m,n) r (m,n ;m,n ) i k,i k exp{jπ[x (m) i +x (n) k cos φ (m,n) cos φ(n,m) +y (n) k +y (m) i sin φ (m,n) cos φ(n,m) ]}, () where β (m,n), φ (m,n), and φ (n,m) are the compex gain, ange of arriva, and ange of departure of the th path, and (x (m) i, y (m) i ) is the coordinate of the ith antenna in waveengths at node m. The genera covariance of the inks between the nodes is represented as { = E h (m,n ) i k h (m,n ) i k }, () where i and k are stacked to obtain a standard covariance matrix. Channe variation can arise due to changing gains β, positions of the nodes, or path anges. An important specia case is that of a common transmitter n = n = n with cose receiver nodes, so that the path anges for the two receivers are identica: φ (m,n) and φ (n,m) = φ (n,m) = φ (m,n). Assuming that just the transmitter moves randomy in a arge area, the covariance reduces to r (m,n;m,n) i k,i k ψ (m,m,n) = i k,i k = (x (m) β (m,n) exp(jπψ (m,m,n) i k,i k ) () i +(y (m ) i y (m ) i +(x (n) k +(y (n) k x (m) i ) cos φ (m,n) x (n) k ) sin φ (m,n) ) cos φ (n,m) y (n) k ) sin φ (n,m ). III. INFORMATION THEORETIC ANALYSIS Figure graphicay depicts the quantities to be identified in this section, indicating the number of common key bits that can be generated and how many of these may be received by the eavesdropper. The estimated random channes ĥa and ĥa are observed by nodes and, respectivey, and the maximum number of information bits extracted from this process for key generation is I K = I(ĥa; ĥa ). The number of secure bits is the remaining mutua information when the eavesdropper channes are aready known or I SK = I(ĥa; ĥa ĥb, ĥc). The (6) number of vunerabe key bits that can be obtained by the eavesdropper is the difference of these two quantities, or I VK = I K I SK. Assuming correated zero-mean compex Gaussian random vectors for the inks, we have I K = h(ĥa) + h(ĥa ) h(ĥa, ĥa ) = og (πe) N a ˆR aa + og (πe) N a ˆR a a og (πe) Na ˆR AA = og ˆR aa ˆR a a ˆR, (7) AA where N r is the number of eements in h r, and covariances of combined (stacked) random vectors are defined as ˆR P...P M = E { qq H}, q = [p T p T... p T M ] T. (8) Straightforward evauation reveas ˆR aa = R aa + σ I (9) ˆR a a = R aa + σi () Raa + σ ˆR AA = I R aa R aa + σi. () R aa Substituting into (7) and simpifying resuts in where I K = og R aa R σ + I, () R σ = (σ + σ )I + σ σ R aa. () Evauation of the secret key bits I SK gives I SK = I(ĥa; ĥa ĥb, ĥc) = h(ĥa ĥb, ĥc) + h(ĥa ĥb, ĥc) h(ĥa, ĥ a ĥb, ĥc) = h(ĥa, ĥb, ĥc) + h(ĥa, ĥb, ĥc) h(ĥb, ĥc) h(ĥa, ĥa, ĥb, ĥc) = og ˆR ABC ˆR A BC ˆR BC ˆR AA BC, () where the covariance matrices are again the covariance of the stacked subscripted variabes. For many practica scenarios, the eavesdropper wi be far away from both nodes and, in which case ĥb and ĥc are independent of ĥa and ĥa and I SK = og ˆR A ˆR BC ˆR A ˆR BC ˆR BC ˆR AA ˆR, () BC which reduces to (7), meaning a key bits are safe. The worst case for security, however, is when the eavesdropper is near one of the nodes. Consider the case where the eavesdropper is near node and ony movement of node or scatterers causes variation of h c and h a. With the reative positions of node and fixed, h b is not random and contains no information, and () reduces to I SK = og ˆR AC ˆR A C ˆR C ˆR AA C, (6)

3 IK (bits/ch) N= N= N= Number of Paths N path Fig.. Theoretica key bits that can be generated for N transmit and receive antennas and different eves of mutipath for db SNR (channe to estimation error power ratio) and the covariances can be written expicity as Raa + σ ˆR AC = I R ac R H ac R cc + σi, (7) Raa + σ ˆR A C = I R ac R H ac R cc + σi, (8) ˆR C = R cc + σi, (9) ˆR AA C = R aa + σi R aa R ac R aa R aa + σi R ac. () R H ac R H ac R cc + σi A. Exampe Computations In this section, numerica vaues for I K and I SK are presented for the path-based channe mode with varying numbers of paths and numbers of antennas. For each pot, the resuts are averaged over random covariances, where the paths for each reaization have anges uniform on [, π] and equa power, scaed to give tota average unit power. Figure pots I K versus the number of paths and the number of transmit and receive antennas N for an SNR of db, where SNR is the mean squared estimation error divided by mean squared channe gain. For a fixed number of antennas, the shared information saturates with increasing paths, and there is a dramatic increase in the avaiabe number of key bits with additiona antennas N. Figure pots the reative number of vunerabe bits I VK /I K for a singe antenna scenario, where the eavesdropper is ocated a distance d (in waveengths) from node. Athough the eavesdropper can stea most of the key bits for itte separation or imited mutipath, the key bits are safe for reaistic separation and moderate mutipath. Figure considers a simiar scenario with antennas per user. In this case, athough many more key bits can be generated, far richer mutipath and separation are required to keep a bits safe. This suggests that adding antennas to enhance the generation rate of key bits potentiay eaks increasing information to the eavesdropper. How much information can be stoen when the eavesdropper has an advantage in SNR or the number of antennas is considered in Figures 6 and 7. For the singe antenna system in Figure 6 the eavesdropper has an SNR of db compared to db for the egitimate users. The curves are shifted up sighty, but for moderate mutipath and arge separation, most key bits are sti safe. Figure 7 indicates the resut when.8.6. N path = N path =. N path =. Eavesdropper Separation d (waveengths) Fig.. Reative number of vunerabe key bits for singe antenna channes for an eavesdropper at a distance d with varying eves of mutipath and db SNR N path = N path = N path =. Eavesdropper Separation d (waveengths) Fig.. Reative number of vunerabe key bits for N = antennas for an eavesdropper at a distance d with varying eves of mutipath and db SNR the eavesdropper has antennas compared to antennas for the egitimate users. Far more paths are required to maintain secrecy of the key, suggesting that key generation schemes may sti be vunerabe to eavesdroppers with a arge advantage. IV. PRACTICAL KEY GENERATION METHODS In this section, three different key generation methods are considered and compared in terms of their efficiency as we as their abiity to keep key bits secret from an eavesdropper. Ony singe antenna channes wi be considered, but mutipe antenna extensions are possibe by appying the methods to the mutipe dimensions separatey. For the foowing Monte Caro simuations, curves were generated considering channe reaizations. A. Channe Quantization (CQ) Perhaps the simpest method for generating a random key at nodes and is for the two nodes to simutaneousy quantize ĥ a and ĥa, respectivey []. Due to estimation error at the two nodes, sometimes the key bits wi not match, necessitating some kind of error correction method over a pubic channe. The channe quantization (CQ) is performed by dividing the tota space of observabe channes into decision regions, each with a unique bit pattern. Ideay the channe has equa probabiity of anding in any region. For vector channes, quantization can be performed individuay to mutipe independent channes, yieding more key bits per channe observation. This

4 N path =.8.6 N path =.. N path =. Eavesdropper Separation d (waveengths) I K 6... SNR (db) Fig. 6. Reative number of vunerabe key bits for an eavesdropper with an SNR advantage and singe-antenna communications. SNR at the eavesdropper is db, whie the SNR at the communicating nodes is ony db. Fig. 8. Performance of key generation using channe quantization for PSK versus SNR Decision Region N path = N path = N path = γ Guardband x x x x N γ/ x N+ = Fig. 9. Parameters for defining decision regions with guardband. Ony one positive dimension of the QAM pattern is considered, where x n is the start of the nth out of N tota decision regions separated by guardband of size γ.. Eavesdropper Separation d (waveengths) Fig. 7. Reative number of vunerabe key bits for an eavesdropper with an antenna advantage. The eavesdropper has antennas compared to at the communicating nodes, and SNR is db. paper considers decision region patterns that are simiar to those empoyed in phase shift keying (PSK) [] and quadrature ampitude moduation (QAM). Figure 8 depicts resuts for key generation with CQ using PSK regions versus the SNR. The efficiency () of the key generation is the number of matching key bits at nodes and that can be generated per channe reaization. It is assumed that a symbo mismatch is essentiay a deetion, so that a bits for that symbo are discarded. Aso potted is the idea number of key bits avaiabe I K. For the moderate SNR of db, it is noted that the symbo error rate () is quite high (around.), which may make forward error correction difficut. Athough the method has acceptaby ow for high SNR, the efficiency is far beow the theoretica imit. The fact that the and I K curves cross for ow SNR is due to the simpe definition of efficiency, since the good symbos at such high coud not reay be identified. It shoud be noted that for practica impementation, any deterministic variation of the channe phase due to carrier offset between nodes shoud be removed before appying any CQ-ike methods, since an eavesdropper can easiy derive this variation by ooking at the phase difference of channes ĥ b and ĥc. Athough not rigorousy derived or simuated, it is expected that the fraction of bits that can be stoen by the eavesdropper wi foow the same behavior studied in Section III, which is to be considered in future work. B. Channe Quantization with Guardband (CQG) One of the probems with CQ is that when the channe state is near the boundary between two regions, there is a high probabiity of a symbo error. To overcome this probem and aso to generaize the CQ idea, this work proposes dividing the domain of observabe channes into equa probabiity regions with a specified guardband between those regions. For each observed channe, the nodes ony add bits to the key if the observed channe did not fa in the guardband. A handshake mechanism is needed for the nodes to agree on whether a channe symbo shoud be accepted or not. The handshake can be uni-directiona (node aways estimates and adds a symbo when node sends the OK bit), or bi-directiona (both nodes must agree that the observed channe is not in the guardband). By making the guardband arge enough (a few standard deviations of the estimation error), the probabiity of making a symbo error can be made sma. A simpe method for generating optima decision regions is proposed here based on QAM. Figure 9 depicts the parameters of the QAM decision regions, and for regions symmetric with respect to the I and Q axes, the probem can be considered in just one dimension on the positive I axis. Here, γ is the desired minimum guardband between regions, and x [x n, x n+ γ] is the extent of the nth decision region. The basic probem is to find the x n such that the regions are equay probabe, or xn+ γ C = p(x)dx, () x n for constant C with the required guardband, or x = γ/ x n+ x n + γ x N+ =. ()

5 Fig.. Exampe CQG decision regions for 6QAM with γ =. The required regions (assuming unit-variance zero-mean Gaussian statistics on x) are obtained using an iterative procedure:. Set initia decision regions according to x = γ/, x n+ = x n + γ for n =,..., N and x N+ =, which puts a non-guardband probabiity in the N th decision region.. Compute probabiity taken by the guardband regions: g = erf(x ) and g n = erf(x n ) erf(x n γ) for n =,..., N.. Compute updated decision regions by trying to distribute probabiity not used in guardbands equay to the regions, or for each n =,..., N compute p n = erf(x n ) [ x n+ = erf pn N m=n+ g ] m + p n + γ N (n ). If the probabiities of the decision regions p d,n = erf(x n+ γ) erf(x n ) are neary equa (within some toerance), stop. Otherwise, return to step. As an exampe, Figure shows the resuts for 6QAM generated with N =, γ =., and a toerance of 6, requiring ony 9 iterations. It is found that a two-way handshake gives significanty ower for neary the same efficiency, so this wi be used in the foowing exampes. Figure shows the performance of QAM (same as PSK for CQ) for db SNR versus guardband ranging from to σ. Athough the efficiency drops ineary with the increasing guardband, the drops exponentiay aowing a eve to be chosen that can be overcome with conventiona error contro techniques. Averaging channe estimates over many training symbos may make it possibe to make channe estimation error very ow for channes with sower tempora variation. Figure depicts the resuts for higher SNR ( db) and a higher order 6QAM pattern. In this case, higher efficiency can be obtained, and moderate guardband reduces the to a manageabe eve. A probem with CQG is that the guardband reduces the efficiency of the method since channe information is sometimes discarded. It is expected that an improved method coud be deveoped that uses mutipe decision region patterns and the handshake protoco seects the most beneficia pattern to avoid a disagreement. This way, a simiar situation to guardband can be obtained, but without discarding observed channes, and this wi be studied in future work. I K.... Guardband g Fig.. Performance of channe quantization with guardband (CQG) versus the size of the guardband for QAM and db SNR I K.... Guardband g 8 6 Fig.. Performance of CQG versus guardband for 6QAM moduation and db SNR V. CONCLUSION This paper has presented information theoretic imits for key generation schemes for correated vector Gaussian channes. Two simpe key generation methods were presented, and improving the efficiency and secrecy of these methods is the subject of ongoing work. REFERENCES [] A. O. Hero, III, Secure space-time communication, IEEE Trans. Inf. Theory, vo. 9, pp. 9, Dec.. [] M. Boch, J. Barros, M. R. D. Rodrigues, and S. W. McLaughin, Wireess information-theoretic security, IEEE Trans. Inf. Theory, vo., pp., June 8. [] T. Aono, K. Higuchi, T. Ohira, B. Komiyama, and H. Sasaoka, Wireess secret key generation expoiting reactance-domain scaar response of mutipath fading channes, IEEE Trans. Antennas Propag., vo., pp , Nov.. [] A. Sayeed and A. Perrig, Secure wireess communications: Secret keys through mutipath, in Proc. 8 IEEE Int. Conf. Acoustics, Speech, and Signa Processing, Las Vegas, NV, Mar. -Apr. 8, pp. 6. [] J. E. Hershey, A. A. Hassan, and R. Yaragadda, Unconventiona cryptographic keying variabe management, IEEE Trans. Commun., vo., pp. 6, Jan. 99. [6] I. Csiszar and P. Narayan, Common randomness and secret key generation with a heper, IEEE Trans. Inf. Theory, vo. 6, pp. 66, Mar.. [7] S. Nitinawarat, Secret key generation for correated Gaussian sources, in Proc. 8 IEEE Int. Symp. Inf. Theory, Toronto, ON, 6- Juy 8, pp