Analysis of Channel-Based User Authentication by Key-Less and Key-Based Approaches

TL;DR

This paper compares key-less and key-based user authentication methods using physical layer channel features, analyzing their security and performance in asymptotic scenarios with various attack models.

Contribution

It introduces a unified comparison framework for physical layer authentication and key agreement schemes based on channel features, including passive and active attack analysis.

Findings

All schemes are asymptotically correct.

Secure authentication rate depends on channel resources.

Passive and active attack resilience varies among methods.

Abstract

User authentication (UA) supports the receiver in deciding whether a message comes from the claimed transmitter or from an impersonating attacker. In cryptographic approaches messages are signed with either an asymmetric or symmetric key, and a source of randomness is required to generate the key. In physical layer authentication (PLA) instead the receiver checks if received messages presumably coming from the same source undergo the same channel. We compare these solutions by considering the physical-layer channel features as randomness source for generating the key, thus allowing an immediate comparison with PLA (that already uses these features). For the symmetric-key approach we use secret key agreement, while for asymmetric-key the channel is used as entropy source at the transmitter. We focus on the asymptotic case of an infinite number of independent and identically distributed channel realizations, showing the correctness of all schemes and analyzing the secure authentication rate, that dictates the rate at which the probability that UA security is broken goes to zero as the number of used channel resources (to generate the key or for PLA) goes to infinity. Both passive and active attacks are considered and by numerical results we compare the various systems.

Equations

$$\mathbf{X}(2t+1)=[x_1(2t+1),\dots ,x_n(2t+1)],$$

$$\mathbf{Y}(2t)=[y_1(2t),\dots ,y_n(2t)].$$

$${\mathbf{V}}_{\mathrm{A}}(2t+1)=[v_{1,\mathrm{A}}(2t+1),\dots ,v_{n,\mathrm{A}}(2t+1)]$$

$${\mathbf{V}}_{\mathrm{B}}(2t)=[v_{1,\mathrm{B}}(2t),\dots ,v_{n,\mathrm{B}}(2t)]$$

$$\mathbf{Z}(2t)=[{\mathbf{V}}_{\mathrm{A}}(1),{\mathbf{V}}_{\mathrm{B}}(2),\dots ,{\mathbf{V}}_{\mathrm{A}}(2t-1),{\mathbf{V}}_{\mathrm{B}}(2t)].$$

$$\mathbf{z}(2t)=[v_{\mathrm{A}}(1),v_{\mathrm{B}}(2),\dots ,v_{\mathrm{A}}(2t-1),v_{\mathrm{B}}(2t)].$$

$$R(t)=\underset{n\to \infty }{\lim }-\frac{1}{n}\log P_s(t)$$

$$R_{\mathrm{S}-\mathrm{CBCA}}(2t+1)=C_{\mathrm{SKA}}(2t),$$

$$P_s(t)\approx 2^{-n{R}_{\mathrm{SKA}}(2t+1)}$$

$$\begin{array}{r}\mathbb{I}(x(1);y(2))-\min \{\mathbb{I}(x(1);\mathbf{z}(2t)),\mathbb{I}(y(2);\mathbf{z}(2t))\}\\ \le C_{\text{lx@glossaries@gls@link}acronymSKA\text{leavevmode}SKA}(2t+1)\le \\ \min \{\mathbb{I}(x(1);y(2)),\mathbb{I}(x(1);y(2)|\mathbf{z}(2t))\},\end{array}$$

$$R_{\mathrm{A}-\mathrm{CBCA}}(2t+1)=\mathbb{H}(⟨y(2)⟩|\mathbf{z}(2t)),$$

$$\begin{array}{r}\min \{\mathbb{I}(⟨y(2)⟩;⟨y(2)⟩),\mathbb{I}(⟨y(2)⟩;⟨y(2)⟩|\mathbf{z}(2t))\}\\ =\mathbb{I}(⟨y(2)⟩;⟨y(2)⟩|\mathbf{z}(2t))=\mathbb{H}(⟨y(2)⟩|\mathbf{z}(2t)),\end{array}$$

$$\begin{array}{r}\mathbb{I}(⟨y(2)⟩;⟨y(2)⟩)-\mathbb{I}(⟨y(2)⟩;\mathbf{z}(2t))\\ =\mathbb{H}(⟨y(2)⟩)-\mathbb{H}(⟨y(2)⟩)+\mathbb{H}(⟨y(2)⟩|\mathbf{z}(2t)),\end{array}$$

$$\begin{array}{rl}{R}_{\mathrm{A}-\mathrm{CBCA}}(2t+1)& =\mathbb{H}(⟨y(2)⟩)-\mathbb{I}(⟨y(2)⟩;\mathbf{z}(2t))\\ & \ge \max \{0,\mathbb{H}(⟨y(2)⟩)-\mathbb{I}(y(2);\mathbf{z}(2t))\},\end{array}$$

$$R_{\mathrm{A}-\mathrm{CBCA}}(2t+1)=\infty .$$

$$\mathbb{H}(⟨y(2)⟩|\mathbf{z}(2t))=\int \mathbb{H}(⟨y(2)⟩|\mathbf{z}(2t)=\mathbf{b})p_{\mathbf{z}(2t)}(\mathbf{b})\mathrm{d}\mathbf{b}.$$

$$R_{\text{lx@glossaries@gls@link}\mathrm{acronym}\mathrm{PLA}\text{leavevmode}\mathrm{PLA}}(2t+1)=\mathbb{D}(p_{x(1),x(2t+1)|{\mathcal{H}}_0}||p_{x(1),x(2t+1)|{\mathcal{H}}_1}),$$

$$P_s\sim 2^{-n\mathbb{D}(p_{x(1),x(2t+1)|{\mathcal{H}}_0}||p_{x(1),x(2t+1)|{\mathcal{H}}_1})},$$

$$R_{\text{lx@glossaries@gls@link}\mathrm{acronym}\mathrm{PLA}\text{leavevmode}\mathrm{PLA}}(2t+1)\le \mathbb{I}(x(1);x_{{\mathcal{H}}_0}(2t+1)|\mathbf{z}(2t)).$$

$$x(t)=h(t)+{\sigma }_{\mathrm{x}}{w}_{\mathrm{x}}(t),y(t)=h(t)+{\sigma }_{\mathrm{y}}{w}_{\mathrm{y}}(t),$$

$$\mathbb{E}[h(t)h^{\ast }(t+\ell )]=\rho (\ell ).$$

$$v_{\mathrm{A}}(t)={\alpha }_{\mathrm{A}}h(t)+\sqrt{1-{\alpha }_{\mathrm{A}}^2}{q}_{\mathrm{A}}(t)+{\sigma }_{\mathrm{v},\mathrm{A}}{w}_{\mathrm{v},\mathrm{A}}(t),$$

$$v_{\mathrm{B}}(t)={\alpha }_{\mathrm{B}}h(t)+\sqrt{1-{\alpha }_{\mathrm{B}}^2}{q}_{\mathrm{B}}(t)+{\sigma }_{\mathrm{v},\mathrm{B}}{w}_{\mathrm{v},\mathrm{B}}(t),$$

$$\begin{array}{rl}R& {}_{\mathrm{A}-\mathrm{CBCA}}(2t+1)=\mathbb{H}(⟨y(2)⟩|\mathbf{z}(2t))=\mathbb{H}(⟨y(2)⟩|\mathbf{z}(2t))=\\ & -\sum _{i=0}^{M-1}\int p_{⟨y(2)⟩|\mathbf{z}(2t)}(a_i|\mathbf{b})p_{\mathbf{z}(2t)}(b)\log p_{⟨y(2)⟩|\mathbf{z}(2t)}(a_i|\mathbf{b})\mathrm{d}\mathbf{b}.\end{array}$$

$$\begin{array}{rl}\mathbf{R}& {}_{[y(2),\mathbf{z}(2t)]}=\\ =& \mathbb{E}[[y(2),\mathbf{z}(2t){]}^H[y(2),\mathbf{z}(2t)]]\\ =& \left[\begin{array}{cc}1+{\sigma }_{\mathrm{y}}^2& {\mathbf{r}}_{\mathrm{y}}^H\\ {\mathbf{r}}_{\mathrm{y}}& {\mathbf{R}}_{\mathbf{z}(2t)}\end{array}\right],\end{array}$$

$$[{\mathbf{r}}_{\mathrm{y}}{]}_{\ell }=\{\begin{array}{ll}{\alpha }_{\mathrm{A}}^{\ast }\rho (\ell -2)& \ell \text{mbox}even,\\ {\alpha }_{\mathrm{B}}^{\ast }\rho (\ell -2)& \ell \text{mbox}odd.\end{array}$$

$$\begin{array}{rl}\mathbb{I}& (y(2);\mathbf{z}(2t))=\bar{\mathbb{H}}(y(2))+\bar{\mathbb{H}}(\mathbf{z}(2t))\\ & -\bar{\mathbb{H}}([y(2),\mathbf{z}(2t)])=\log \frac{(1+{\sigma }_{\mathrm{y}}^2)\det {\mathbf{R}}_{\mathbf{z}(2t)}}{\det {\mathbf{R}}_{[y(2),\mathbf{z}(2t)]}}\\ & =-\log \left(1-\frac{{\mathbf{r}}_{\mathrm{y}}^H{\mathbf{R}}_{\mathbf{z}(2t)}^{-1}{\mathbf{r}}_{\mathrm{y}}}{1+{\sigma }_{\mathrm{y}}^2}\right),\end{array}$$

$$[\bm{R}_{\bm{z}(2t)}]_{m,n}=\begin{cases}\alpha_{\rm A}^{*}\alpha_{\rm B}\rho(m-n)&\mbox{$n$ odd, $m$ even}\\ \alpha_{\rm A}\alpha_{\rm B}^{*}\rho(m-n)&\mbox{$n$ even, $m$ odd}\\ |\alpha_{\rm B}|^{2}\rho(m-n)&\mbox{$n$ and $m$ even, $m\neq n$}\\ |\alpha_{\rm A}|^{2}\rho(m-n)&\mbox{$n$ and $m$ odd, $m\neq n$}\\ 1+\sigma_{\rm z}^{2}&n=m\,.\end{cases}$$

$$\begin{array}{rl}\mathbb{I}(x(1);y(2))& =\mathbb{H}(x(1))+\mathbb{H}(y(2))-\mathbb{H}(x(1),y(2))\\ & =-\log \left(1-\frac{|\mathbb{E}[x(1)y^{\ast }(2)]{|}^2}{(1+{\sigma }_{\mathrm{x}}^2)(1+{\sigma }_{\mathrm{y}}^2)}\right)\\ & =-\log \left(1-\frac{\rho (1)}{(1+{\sigma }_{\mathrm{x}}^2)(1+{\sigma }_{\mathrm{y}}^2)}\right),\end{array}$$

$$\begin{array}{rl}\mathbb{I}(x(1);\mathbf{z}(2t))=& \log \frac{(1+{\sigma }_{\mathrm{x}}^2)\det {\mathbf{R}}_{\mathbf{z}(2t)}}{\det {\mathbf{R}}_{[x(1),\mathbf{z}(2t)]}}\\ & =-\log \left(1-\frac{{\mathbf{r}}_{\mathrm{x}}^H{\mathbf{R}}_{\mathbf{z}(2t)}^{-1}{\mathbf{r}}_{\mathrm{x}}}{1+{\sigma }_{\mathrm{x}}^2}\right)\end{array}$$

Full text

I Introduction

User authentication (UA) methods in communication systems are used to confirm the identity of a message sender [1]. In particular, the receiver must take a decision on who has transmitted the message considering that an attacker aims at impersonating the legitimate transmitter. Typically, UA includes two phases: an identification association (ID-A) phase, when the legitimate transmitter is assigned an identifying feature using an authenticated channel, and an identification verification (ID-V) phase, when the identifying feature is verified upon reception of a message.

Many commonly-used UA protocols for communication systems use as identifier a key, i.e., a secret know by either only the transmitter (asymmetric key) or both the transmitter and the receiver (symmetric key), and encryption techniques are adopted in the ID-V phase [1]. These methods go also under the name of key-based UAs [2, 3]. An alternative key-less approach is physical layer authentication (PLA) [4], in which the identifying feature is the physical channel over which the communication occurs. In this case the ID-A phase consists in the identification of the channel features, while the ID-V phase consists in checking if the received message has undergone the same channel of the ID-A phase (see e.g. [5, 6, 7] and [4] for a survey). For example, in wireless systems, the propagation phenomena (e.g., fading) are associated to the specific position of both transmitter and receiver, thus the attacker should be in the same position of the legitimate transmitter for a successful impersonation. PLA has been studied for discrete memory-less channels in [8]; implementations for multiple-input multiple-output (MIMO) and intersymbol-interference channels have been proposed in [5] and [9], while a game-theoretic study of PLA has appeared in [10]. Recently, a review of key-based and key-less security approaches with a comparison of cryptography and physical-layer security solutions has been proposed in [11]. In [8] the keyless UA was studied in a new noisy model, where there are two discrete memoryless channels, one from sender to receiver and and the other the from adversary to the receiver, in addition to an insecure noiseless channel between the legitimate parties. Optimality of the scheme was further proofed in [12].

In both key-based and key-less approaches a source of randomness is needed to either generate the keys or identify the user feature. In this paper we focus on the use of physical-layer channel features as randomness source for all the UA techniques. While the exploitation of channel features is intrinsic in PLA, for key-based solutions we extract a random number (the key) from the channel. The key must remain secret to the attacker, in order to prevent impersonation: thus for symmetric-key systems we use the secret key agreement (SKA) procedure of [13, 14], while for asymmetric-key systems the channel is used as an entropy source for one user only, and a set of secret bits is obtained from this source.

Most of the literature has considered separately key-based and key-less UA. In [15] a first comparison of the approaches when the unique source of randomness was the channel has been proposed, but limited to quantized channel model with a finite number of samples per frame. In this paper instead we focus on the asymptotic case of an infinite number of available independent and identically distributed (i.i.d.) channel realizations. In this asymptotic regime all considered UA schemes can be shown to be correct, i.e., authentic messages are always accepted. We then analyze the secure authentication rate (SAR), that dictates the rate at which the probability that UA security is broken goes to zero as the number of channel resources used to extract either the key or the channel features goes to infinity. In particular, we focus on time-invariant channels, time-variant channels and Rayleigh fading channels with additive white Gaussian noise (AWGN). Most derivations are obtained considering a passive attacker that listens to transmissions in the ID-A phase and then attempts to impersonate the legitimate transmitter in the ID-V phase. However, we also consider active attacks aiming at disrupting the ID-A phase in order to ease the impersonation attack in the ID-V phase. Beyond considering optimal attacks by Eve we also discuss a simple approach in which the attacker first performs a linear combination of all channel estimates to obtain the minium mean square error (MMSE) linear estimate of the legitimate channel which is then used for the attack. By numerical results we closely compare the various systems, highlighting their potentials and vulnerabilities.

The rest of the paper is organized as follows. Section II introduces the system model, with emphasis on both the channel and the considered schemes. The analysis of the protocols in terms of SAR is performed in Section III, while its derivation for the relevant case of reciprocal Rayleigh fading AWGN channels is discussed in Section IV. Active attacks during the ID-A phase are discussed in Section V. Numerical results comparing the various strategies are presented in Section VI, before the main conclusions are outlined in Section VII.

Notation: $\mathbb{P}[{\mathcal{X}}]$ denotes the probability of the event $\mathcal{X}$. $\mathbb{E}[x]$ denotes the expectation of the random variable $x$, $\mathbb{H}(x)$ denotes the entropy of the discrete random variable $x$, and $\bar{\mathbb{H}}(x)$ denotes the differential entropy of the continuous random variable $x$. $\mathbb{I}(x;y)$ denotes the mutual information between random variables $x$ and $y$. ${\mathbb{D}}(p||q)$ denotes the Kullback-Leibler (KL) divergence between the two probability density function (PDF) $p$ and $q$. Vectors are denoted in boldface, while scalar quantities are denoted in italic. $\ln x$ and $\log x$ denote the natural-base and base-2 logarithms of $x$, respectively. $\det\bm{A}$ and ${\rm tr}\bm{A}$ denote the determinant and trace of matrix $\bm{A}$, respectively. $p_{x}(a)$ denotes the PDF of random variable $x$.

II System Model

We consider a communication system with two legitimate users, Alice and Bob, and one attacker Eve. Time is divided into frames, each of the same duration. In order to simplify the analysis we suppose that in even and odd frames Alice and Bob alternate their transmissions. In particular, starting from the first frame and in all odd frames $2t+1$ ($t=0,\ldots$) Alice transmits to Bob, while starting from the second frame and in all even frames $2t$ ($t=1,\ldots$) Bob transmits to Alice. Eve can transmit at any frame.

Bob must decide if packets received in odd frames are coming from either Alice or Eve. To this end, initial frames are used for ID-A purposes, extracting keys from the channel or identifying reference channel features as described in the following. In forthcoming frames Bob receives packets and performs ID-V, i.e., he decides if they are coming from Alice (hypothesis $\mathcal{H}_{0}$) or not (hypothesis $\mathcal{H}_{1}$).

Channel between each users’ couple are assumed to be time-invariant within each frame, and described by $n$ complex random variables. All transmissions include pilot symbols known to all users (including Eve) for channel estimation. The channel estimated by Bob at frame $2t+1$ is described by the random vector

[TABLE]

while the channel estimated by Alice in frame $2t$ is described by the random vector

[TABLE]

Let

[TABLE]

[TABLE]

be the estimated channels by Eve when either Alice or Bob are transmitting, respectively. We also collect into the vector $\bm{Z}(2t)$ the channel estimates of Eve up to frame $2t$, i.e.,

[TABLE]

Eve will exploit all these estimates to perform her attacks.

Channel estimates $\bm{X}(t_{1})$, $\bm{Y}(t_{2})$, $\bm{V}_{\rm A}(t_{3})$ and $\bm{V}_{\rm B}(t_{4})$ are assumed to be correlated, in general however they do not have the same value since they are affected by noise, time-varying channel phenomena and changing positions of transmitters and receivers. Within each estimated vector, we assume that $x_{k}(t)$, are i.i.d. for $k\in[1,n]$, with frame-dependent PDF $p_{x(t)}(a)$, $a\in\mathbb{C}$. Similarly we have that $y_{k}(t)$, $v_{k,\rm A}(t)$ and $v_{k,\rm B}(t)$ are i.i.d.. In the following we will drop index $k$ from all channel estimates, i.e., using $x(t)$ instead of $x_{k}(t)$ (for any $k$). Moreover, we define the $2t$-size vector

[TABLE]

We consider three UA approaches, namely asymmetric channel-based cryptographic authentication (A-CBCA), symmetric channel-based cryptographic authentication (S-CBCA) and physical layer authentication (PLA). While both A-CBCA and S-CBCA have a cryptography background and exploit some secret known by either or both the legitimate parties, PLA has information-theoretic foundations and mostly relies on the communication channel characteristics. In order to obtain a fair comparison of the three approaches, we extract the secret needed for both A-CBCA and S-CBCA from the channel, so that all three schemes have the same source of randomness.

Moreover, both Alice and Bob must be able to exchange authenticated messages in the ID-A phase, to ensure that they are talking to each other, and not with Eve. This is a common feature to all UA protocols and we assume it for granted. The authenticated channel can be obtained for example when devices are in a protected location immune from attacks. Also, the authenticated channel is available when the keys used for authentication must be renewed, but we can still use the old keys in the ID-A phase. Moreover PLA, which is not based on a key, can be considered as a low-complexity alternative to be used in replacement of a more expensive UA procedure that is adopted only for the ID-A phase of the PLA protocol.

We now details the UA procedures for the three authentication approaches.

II-A A-CBCA

The basic structure of the A-CBCA can be summarized as follows.

ID-A Phase

In this phase Alice generates a private and public key couple from a source of randomness, where the public key decrypts messages encrypted with the private key. Then, she transmits the public key to Bob over an authenticated channel.

ID-V Phase

In this phase, whenever Alice wants to transmit a message, she encrypts it with her private key, including a signature. Bob decrypts the message with the public key and checks if the signature is correct, and in this case the message is accepted as authentic, otherwise it is discarded as non-authentic.

Suitable variants of this scheme have been proposed to prevent various attacks (including the replay attack) and are out the scope of this paper. With proper adaptations, the scheme is proofed to be secure [1], provided that the private key is secret.

In our implementation of A-CBCA, the random bits are obtained from the channel. In particular, in the second frame Alice extracts random bits from $\bm{Y}(2)$. On her side, Eve attempts to extract the private key from her channel observations. Therefore, we must ensure that the randomness extraction procedure provides bit that are not known to Eve. Proof of correctness and security in this case is provided in Section III.

II-B S-CBCA

The basic structure of the S-CBCA can be summarized as follows.

ID-A Phase

Alice and Bob share over an authenticated and confidential (to Eve) channel a secret key.

ID-V Phase

Alice encrypts the message with her secret key, including a signature. Bob decrypts the message with the same secret key and checks if the signature is correct.

Also this scheme, with proper modifications and improvements (out of the scope of this work) is proofed to be secure [1], provided that the key is secret. In our implementation of S-CBCA the key is obtained from the channel, using what is known as a SKA protocol [16] that provides a secret key to two parties, with the support of an authenticated channel. In particular, in the first two frames they estimate their channels and using a public error-free authenticated channel they complete the reconciliation process. The proof of correctness and security in this case is provided in Section III.

II-C PLA

With PLA the authentication is provided by the physical channel over which the communication occurs [5]. The PLA algorithm works as follows.

ID-A Phase

In this phase, occurring at frame 1, Bob obtains a reference estimate of the channel to Alice $\bm{X}(1)$. The estimation must be performed using an authenticated message, so that Bob is sure that the estimated channel is connecting him to Alice (rather than Eve).

ID-V Phase

In this phase, occurring for frames $2t+1$, with $t>0$, whenever Bob receives a message, he decides that it comes from Alice if the estimated channel in that frame, $\bm{X}(2t+1)$, is similar to $\bm{X}(1)$.

The correctness and security proof of PLA is provided in Section III.

III Protocols Analysis With ID-V Attacks

In this section we consider only the attacks in ID-V phase, while attacks in the ID-A phase will be considered in Section V. We assess the correctness and security (as usually defined in cryptography) of each UA protocol. We first provide a definition of correctness and security:

Definition 1** (Correctness and Security)**

A UA protocol is correct when a message coming from Alice is verified as authentic by Bob and is secure when a message coming from Eve is dismissed as non-authentic by Bob.

Let $\bm{K}(n)$ be the key used for key-based UA or the features used for PLA: since we assume that the $n$ channel realizations are i.i.d., the length of $\bm{K}(n)$ grows linearly with $n$. We aim at establishing the protocols’ correctness and security asymptotically, as the number of channel uses per frame $n$ goes to infinity. About security, we show that for all schemes, the probability of successful attack (PSA) $P_{s}(t)$ at frame $t$ goes exponentially to zero as $n$ goes to infinity and we define

[TABLE]

as the secure authentication rate* (SAR)* at frame $t$. Interpreting the $n$ entries of the channel estimate vectors as $n$ channel uses, $R(t)$ is the number of secret bits in $\bm{K}(t)$ per channel use at frame $t$, i.e, the number of bits that are not known to Eve in $\bm{K}(n)$, as $n\rightarrow\infty$. Note that the PSA depends on the frame index $t$ since Eve collects channel estimates as time goes on, thus being able to refine her knowledge of the Alice-Bob channel. In the following we derive the maximum SAR for each UA protocol achieved by proper use of channel knowledge. We consider attacks at odd frames, starting from frame $t=3$, after Eve has collected an even number of channel observations.

III-A S-CBCA

We establish the correctness and security of the S-CBCA protocol by the following Theorem.

Theorem 1

As $n\rightarrow\infty$, the S-CBCA protocol is correct and the SAR for frame $2t+1$, with $t\geq 1$ is

[TABLE]

where $C_{\lx@glossaries@gls@link{acronym}{SKA}{\leavevmode SKA}}(2t)$ is the weak secret-key capacity of the SKA process between Alice and Bob, given the channel knowledge by Eve at frame $2t$.

Proof:

S-CBCA is proofed to be correct and secure [1] provided that the key is secret. About correctness, asymptotically SKA ensures that Alice and Bob have the same key, as long as the secret key rate $R_{\rm SKA}(2t+1)$ satisfies $R_{\rm SKA}(2t+1)\leq C_{\rm SKA}(2t+1)$.

About security, for SKA the length of the secret key (in bits) grows as $nR_{\rm SKA}(2t+1)$. Therefore

[TABLE]

and from (7) the maximum SAR coincides with $C_{\rm SKA}(2t+1)$, and we obtain (8). ∎

We recall that the secret key capacity for the source-model SKA is not known with a closed-form expression, but is bounded as

[TABLE]

since the two channel estimates used for SKA are $\bm{X}(1)$ and $\bm{Y}(2)$ and the information on the channel available at Eve at frame $2t+1$ is $\bm{Z}(2t)$.

III-B A-CBCA

For A-CBCA we first consider the case in which the channel estimates are discrete-valued random variable. This occurs for example if Alice quantizes $y(2)$ into $\langle y(2)\rangle\in\mathcal{A}$, where $\mathcal{A}=\{a_{0},\ldots,a_{M-1}\}$ is an $M$-size quantization alphabet. The random number used for the private key is then extracted from $\langle y(2)\rangle$.

Theorem 2

The A-CBCA scheme is correct and for discrete-valued estimated channels $\langle y(2)\rangle$, as $n\rightarrow\infty$ its SAR at frame $2t+1$, with $t\geq 1$ is

[TABLE]

where $\mathbb{H}(\cdot|\cdot)$ is the conditional entropy.

Proof:

Correctness of A-CBCA scheme follows immediately by the assumption that the public-key broadcast is error-free and authenticated.

About security, the A-CBCA protocol can be seen as a source-based SKA protocol where both Alice and Bob observe the same source of randomness. In this case the SKA capacity upper bound becomes

[TABLE]

which coincides with the lower bound

[TABLE]

providing (11). ∎

For the channel quantization case a lower bound on SAR is obtained as follows

[TABLE]

where the first line is obtained by the definition of mutual information and the second line by the data processing inequality, where we upper-bounded the mutual information on the quantized variable by the corresponding mutual information on the continuous-valued channel estimate.

Now, we consider the case in which the channel is a continuous random random variable, for which the SAR is established by the following Lemma.

Lemma 1

For continuous channel estimates at Alice (i.e., $y(2)$ is a continuous random variable), the SAR is

[TABLE]

Proof:

We first observe that the conditional entropy in (11) can be written as

[TABLE]

Now, the continuous random variable $y(2)$ is the asymptotic case of the quantized $\langle y(2)\rangle$ with a number of quantization points $M\rightarrow\infty$. Asymptotically, the conditional entropy for each value of $\bm{z}(t)$ is the limiting density of discrete points which tends to infinity logarithmically with $M$ under very mild assumptions [17]. Therefore, the average of the logarithm, which corresponds to the conditional entropy tends to infinity, i.e., $\mathbb{H}(\langle y(2)\rangle|\bm{z}(2t))\rightarrow\infty$, providing (15). ∎

III-C PLA

We establish the correctness and security of PLA by the following Theorem.

Theorem 3

The PLA protocol is asymptotically correct, and as $n\rightarrow\infty$ its SAR at frame $2t+1$, with $t\geq 1$, is

[TABLE]

where $p_{x(1),x(2t+1)|\mathcal{H}_{0}}$ and $p_{x(1),x(2t+1)|\mathcal{H}_{1}}$ are the joint PDF of $x(1)$ and $x(2t+1)$ when Alice and Eve are transmitting, respectively in the ID-V phase (frame $2t+1$).

Proof:

About correctness, using the Chernoff-Stein Lemma [18, Theorem 11.8.3] we have that for $n\rightarrow\infty$ the probability of correctly authenticating messages coming from Alice can be made arbitrarily small.

About security, still from the Chernoff-Stein Lemma [18, Theorem 11.8.3] the PSA goes to zero as

[TABLE]

which directly provides (17). ∎

Note that the SAR depends on the attack that Eve is performing through $p_{x(1),x(2t+1)|\mathcal{H}_{1}}$. Therefore it is interesting to have results under the hypothesis that Eve performs a specific attack, as in the following Lemma.

Lemma 2

If Eve is able to induce any channel estimate $\bm{X}(2t+1)$ to Bob when attacking, and assuming that Eve generates the induced estimate randomly distributed according to the PDF of the legitimate channel given Eve’s observations, $p_{x(2t+1)|\bm{z}(2t),\mathcal{H}_{0}}$, then the SAR is upper-bounded by

[TABLE]

Proof:

See Appendix A. ∎

From this lemma we observe that if the statistics of estimated channels at both Alice and Bob are the same ($p_{x}=p_{y}$) then $R_{\rm\lx@glossaries@gls@link{acronym}{PLA}{\leavevmode PLA}}(2t+1)\leq{\mathbb{I}}(x(1);y(2)|\bm{z}(2t))$, i.e., the PLA has the same upper-bound of S-CBCA.

Remark 1

For time-varying channels we assumed that Eve can induce any channel estimate when performing the attack. This however does not hold as the channel are changing and Eve does not know the exact channel (with respect to Bob) on which she attacks, therefore in practice she will not be able to induce any desired channel estimate. Therefore our assumption is conservative and the obtained SAR is a lower bound on the effective SAR. Moreover, for PLA the time-varying channel scenario is particularly challenging, since the variations decrease the ability of the receiver to identify the channel in the ID-V phase. In other words, for PLA SAR will decrease over time. In particular, as $t\rightarrow\infty$ the KL divergence will tend to zero, thus nulling the SAR.

Remark 2

We have assessed the performance for the three UA methods, and from the theorems we can conclude that A-CBCA has an unlimited SAR as we increase the number of quantization bits. For PLA we have an explicit expression for SAR, depending however on the attack by Eve. For the SAR of S-CBCA we have only bounds. Moreover, for a particular attack strategy by Eve the SAR of PLA share the same upper bound of S-CBCA.

IV Rayleigh AWGN Reciprocal Channels

We now consider a scenario in which the estimates are corrupted by AWGN, which corresponds for example to a massive MIMO system in which all users (Alice, Bob and Eve) have $\sqrt{n}$ antennas each, so that the resulting channel matrices have $n\rightarrow\infty$ entries111Other antennas configurations can be considered, leading to similar results and expressions as those derived in this section. Also, orthogonal frequency division multiplexing (OFDM) systems can be cast in this model.. Moreover, channel matrix entries are assumed i.i.d., and zero-mean unitary power complex Gaussian (ZMUPCG), in accordance with the Rayleigh fading model. By reordering the $n$ entries of each matrix into a vector we obtain the channel model described in Section II, where $x(t)$, $y(t)$ and $z(t)$ are Gaussian distributed.

We assume that the channel between any couple of devices is reciprocal, therefore we have

[TABLE]

where $w_{\rm x}(t),w_{\rm y}(t)$ are jointly ZMUPCG and $\sigma_{\rm x}^{2},\sigma_{\rm y}^{2}$ are the noise powers at the receivers. We also define the correlation of $h(t)$ over time as

[TABLE]

Eve’s channels are correlated with coefficients $\alpha_{\rm A}\in[-1,1]$ and $\alpha_{\rm B}\in[-1,1]$ to $h(t)$, and affected by AWGN with powers $\sigma_{\rm v,A}^{2}$ and $\sigma_{\rm v,B}^{2}$ (typically $\sigma_{\rm v,A}^{2}=\sigma_{\rm v,B}^{2}$). Therefore, her estimate of the channel to Alice is

[TABLE]

while her estimate of the channel to Bob is

[TABLE]

where $w_{\rm v,A}(t)$, $w_{\rm v,B}(t)$ are ZMUPCG independent with respect to $h(t)$, $q_{\rm A}(t)$ and $q_{\rm B}(t)$, and $q_{\rm A}(t)$, $q_{\rm B}(t)$ are ZMUPCG variables. Note that by these definitions all channel estimates have unitary variance in the absence of noise.

A-CBCA

As we have already seen, using directly the continuous-valued channel estimate we obtain that the SAR of A-CBCA is infinite, thus we focus here on the channel quantization case. The conditional entropy in (11) can be written (by definition) as

[TABLE]

About the bound (14), recall that for a Gaussian vector $\bm{v}$ of size $k$ with correlation matrix $\bm{R}_{\rm v}$ the differential entropy is $\bar{\mathbb{H}}(\bm{v})=\log\det((\pi e)^{k}\bm{R}_{\rm v})$. Let us define

[TABLE]

where $\bm{r}_{\rm y}=\mathbb{E}[y(2)\bm{z}^{H}(2t)]$ has entries

[TABLE]

Then we have

[TABLE]

where $\bm{R}_{\bm{z}(2t)}=\mathbb{E}[\bm{z}^{H}(2t)\bm{z}(2t)]$, with entries

[TABLE]

S-CBCA

For S-CBCA we have the bound (10). In particular for the Gaussian case we have

[TABLE]

and analogously to (27)

[TABLE]

where

[TABLE]

[TABLE]

Moreover we have

[TABLE]

[TABLE]

and

[TABLE]

PLA

Assuming that Eve generates the induced estimate $x(2t+1)$ randomly distributed according to the PDF of the legitimate channel given Eve’s observations, i.e., $p_{x(2t+1)|\bm{z}(2t),\mathcal{H}_{0}}$ the SAR has been computed in [5]. In particular, let us define $\bm{S}=\bm{R}_{[x(1)\bm{z}(2t+1)]}^{-1}$ and $\bm{T}=\bm{R}_{[x(2t+1)\bm{z}(2t+1)]}^{-1}$ where

[TABLE]

[TABLE]

Partitioning the two matrices as

[TABLE]

where $T_{1,1}$ and $S_{1,1}$ are scalars, while all other entries are vectors and matrices of suitable dimensions, we define

[TABLE]

and

[TABLE]

Then (17) becomes

[TABLE]

where

[TABLE]

IV-A Linear Eve’s Processing

With linear Eve’s processing (LEP) Eve first performs a linear combination of all channel estimates to obtain the MMSE linear estimate of the legitimate channel $\hat{h}$, which is then used for the attack. In particular, for the A-CBCA scheme Eve estimates $h(2)$, while for PLA she estimates $h(1)$. For S-CBCA since we have only bounds on the SAR, Eve can maximize the SAR lower bound. Therefore, from the estimates obtained for PLA and A-CBCA Eve picks the one that minimizes the minimum of the two mutual information, i.e.,

[TABLE]

Let $k$ be the frame index of the desired channel estimate, $k=1,2$. We first define the correlation vector

[TABLE]

with entries

[TABLE]

Then we have

[TABLE]

where $\bm{w}_{0}$ is a jointly ZMUPCG $2t$-size vector with i.i.d. entries and the correlation matrix $\bm{R}_{\rm s}(2t)$ is

[TABLE]

Now, the MMSE estimation of $h(k)$ is obtained as follows

[TABLE]

where $\bm{1}$ is a $2t$-long column vector of all ones, $\hat{w}_{\rm z}(2t)$ is ZMUPCG and

[TABLE]

In general, LEP is a suboptimal procedure (except for time-invariant channels) in the sense that the attacks by Eve will be less effective. However, this procedure has a limited computational complexity. The SAR obtained with LEP is readily computed from the results of the previous section where $\bm{z}(2t)$ is replaced by $\hat{z}(2t)$ having unitary correlation with $h(k)$ and noise power $\sigma_{\rm z}^{2}(2t)$.

IV-B LEP* with Time-invariant Channels*

We now focus on time invariant channels, therefore $h(t)=h$, $q_{\rm A}(t)=q_{\rm A}$ and $q_{\rm B}(t)=q_{\rm B}$. We also have $\rho(t)=1$ $\forall t$. In this case, the LEP procedure corresponds to optimal processing at Eve.

For $t=1$ we have

[TABLE]

and

[TABLE]

For the upper bound of S-CBCA SAR we have

[TABLE]

[TABLE]

For $t>1$ note instead that, since $q_{\rm A}$ and $q_{\rm B}$ are the same at all frames, LEP boils down to first estimating

[TABLE]

[TABLE]

where $w_{\rm v,A}(2t)$ and $w_{\rm v,B}(2t)$ are ZMUPCG and

[TABLE]

and then applying MMSE combining on $\bar{v}_{\rm A}(2t)$ and $\bar{v}_{\rm B}(2t)$ as for the case $t=1$.

In particular, for $t\rightarrow\infty$, from (56) we have that $\sigma_{\bar{v},\rm A}^{2}(2t)=\sigma_{\bar{v},\rm B}^{2}(2t)=0$, and

[TABLE]

i.e., the Eve’s channel estimate is affected only by $q_{\rm A}$ and $q_{\rm B}$.

In Appendix B we derive the SAR with LEP processing of the A-CBCA scheme considering a uniform quantizer with saturation interval $[-v_{\rm sat},v_{\rm sat}]$ and quantization step $\Delta$.

V Attacks in the ID-A Phase

In this section we consider attacks by Eve in the ID-A phase for the various UA strategies. Eve transmits together and synchronously with Alice and Bob in the ID-A phase. Therefore she can overlap her signal on the pilots transmitted by Alice. Furthermore, Eve is assumed to be a full-duplex terminal, therefore she can transmit pilots and at the same time receive signals by Alice and Bob thus estimating the channel. Channels are time-invariant (thus we drop index $t$) and, in order to simplify notation, we assume that Eve has perfect estimates of her channels to both Alice and Bob, i.e., $\sigma_{\rm v}^{2}=0$.

Two attacks are considered: pilot contamination (PC) and artificial noise (AN) attack. These attacks are very well known in the literature, and we now apply them to the UA procedures.

PC Attack

With PC attack, Eve transmits a scaled version of pilots transmitted by Alice, with scaling factors $\zeta_{\rm A}$ and $\zeta_{\rm B}$, so that Alice and Bob estimate the same channel to Eve, i.e.,

[TABLE]

The estimated channels by Alice and Bob are

[TABLE]

In order to analyze the performance of this attack we note that if we divide $x(t)$ and $y(t)$ by $\sqrt{1+|G|^{2}}$ we obtain again the model (20)-(23) where now $\sigma_{\rm x}^{2}$ and $\sigma_{\rm y}^{2}$ become $\sigma_{\rm x}^{2}/(1+|G|^{2})$ and $\sigma_{\rm y}^{2}/(1+|G|^{2})$, respectively. On her side, Eve using LEP obtains the estimate of $(h+G)/\sqrt{1+|G|^{2}}$

[TABLE]

with noise variance $\sigma_{\rm z}^{2}(2t)/(1+|G|^{2})$. Therefore the effect of this attack is the scaling of all noise variances, and results of previous Section can be used to compute the SAR. Note that the PC attack has an impact also on PLA correctness, when Eve does not transmit pilots after the ID-A phase. In this case Bob may not recognize the Alice-Bob channel as correct, since $G$ is missing. A-CBCA and S-CBCA are not affected by this issue, since they only use the key extracted in the ID-A phase.

AN Attack

With this attack Eve transmits AN during the ID-A phase, i.e. a random ZMUPCG signal aimed at increasing the noise for Alice and Bob. This scenario can be analyzed using the results of the previous section, simply modifying the values of $\sigma_{\rm x}^{2}$ and $\sigma_{\rm y}^{2}$. Note that this attack has no impact on the correctness of UA process.

V-A Defense Strategies

We describe now possible defense strategies against the ID-A attacks.

• •

Random pilots: legitimate parties use random pilots, locally generated at the transmitter and shared with the legitimate receiver after the ID-A phase on the public authenticated error-free channel (which as we have seen, must be in any case available in the ID-A phase). In this case Eve would not be able to add coherently her pilot and induce a desired channel;

• •

Channel and noise power estimation: if reference values of these powers are available at the legitimate receivers, the attack can be detected (see also [19]);

• •

Channel agreement: as outlined in [19] by estimating the channel at both Alice and Bob and comparing the estimates without disclosing them to Eve it is possible to check if the two legitimate users see the same channel, thus preventing Eve from performing an attack in which she does not know the channels to Alice and Bob.

Moreover, note that the described attacks require the knowledge of the Alice-Eve and Bob-Eve channels before transmissions, therefore implementing the ID-A stage at the very beginning of transmission would prevent Eve from getting the channel estimates and deploy the attack.

VI Numerical Results

We provide now some results on the SAR of the various UA systems. We focus in particular on the Rayleigh AWGN reciprocal channels of Section IV, where both Alice and Bob transmit with unitary power and channels are vectors of i.i.d. ZMUPCG. We consider both time-invariant and time-variant channels, and ID-A attacks described in Section V. For A-CBCA we have already observed that the SAR can be made arbitrarily large in the presence of a passive eavesdropper: here we report the results for a uniform quantizer with 3 bits (corresponding to 8 quantization levels) and saturation value $v_{\rm sat}$ that ensures a probability of saturation of $10^{-2}$. Unless differently specified we consider $\sigma^{2}_{\rm x}=\sigma^{2}_{\rm y}=\sigma^{2}_{\rm v,A/B}=-10$ dB.

VI-A Time-invariant Channels

We start from time-invariant channels. Fig. 1 shows the SAR versus (vs) the correlation coefficients $\alpha_{\rm A}=\alpha_{\rm B}$, at ID-V frame $t=3$, i.e., immediately after the two ID-A frames. The results for the lower and upper bound on the SAR of S-CBCA are shown as $R_{\rm S-CBCA}$ low and up, respectively. As expected, with an increasing correlation among the legitimate and eavesdropper’s channels the SAR decreases. Note that even when $\alpha_{\rm A}=\alpha_{\rm B}=1$ we still may have a non-zero SAR. In particular, in A-CBCA Bob benefits from the randomness of the noise which is assumed independent with respect to that of Eve. Similarly, in PLA Eve generates a random attack channel having as mean her channel estimate rather than the estimate obtained by the legitimate user in the ID-A steps, and the two estimates differ due to the noise. The lower bound for S-CBCA is indeed zero in this case.

Fig. 2 shows the SAR vs the ID-V frame for three values of channel correlations: $\alpha_{\rm A}=\alpha_{\rm B}=0.1$ (solid lines), $\alpha_{\rm A}=\alpha_{\rm B}=0.4$ (dashed lines), and $\alpha_{\rm A}=\alpha_{\rm B}=0.8$ (dotted lines). We observe that for all schemes, as the ID-V frame $t$ increases SAR decreases, because in the meantime Eve has obtained a better channel estimate. The degradation of authentication performance is more remarkable for a higher value of channel correlation factor, since in this case having a more accurate knowledge of her channels to Alice and Bob truly provides Eve a better knowledge of the Alice-Bob channel.

VI-B Time-varying Channels

We consider now frame-time-variant channels with Jakes fading. In particular the channel is time-invariant in each frame while the evolution over frames is

[TABLE]

with $g(t)$ ZMUPCG and

[TABLE]

with $T$ the frame duration, $f_{d}$ the Doppler frequency and $J_{0}(\cdot)$ the zero-order Bessel function of the first kind.

As we have observed, for PLA channel variations have an impact on the ability of the scheme to effectively authenticate a legitimate transmission, since the channel (which is used as user signature) changes. Therefore Fig. 3 shows the SAR vs the ID-V frame index, for three values of the normalized Doppler frequency $Tf_{\rm D}$ for the PLA scheme when $\alpha_{\rm A}=\alpha_{\rm B}=0.4$. We assume that Eve estimates the channel in only the first two frames, and up to frame $t>2$ Alice and Bob are not transmitting. We observe that as the normalized Doppler frequency increases the SAR decreases. Moreover, as ID-V frame index increases the SAR is reduced as well. In both cases the channel variations prevent an effective authentication. Lastly, note that for the highest value of the normalized Doppler frequency the SAR increases for a higher number of frames: this is due to the Jakes model, and in particular to the behavior of the correlation (62) as $f_{d}$ first decreases and then increases.

We now consider the effect of time-variations on all the schemes. Fig. 4 shows the SAR as a function of the normalized Doppler frequency for three ID-V frames $t=3$ (solid lines), $t=5$ (dashed lines) and $t=9$ (dotted lines). Also in this case $\alpha_{\rm A}=\alpha_{\rm B}=0.4$. We observe that the A-CBCA scheme is not affected by the time-variation of the channel across frames, as it only uses one frame. Moreover, for S-CBCA the SAR decreases for increasing normalized Doppler frequency but it is insensitive to the frame in which authentication is performed: in fact, for this scheme the channel is used only in the ID-A phase to establish the secret key and channel variations in further frames are not relevant. On the other hand, S-CBCA and PLA are more heavily affected, since channel variations have an impact on both ID-A and ID-V phases. Also in this case we observe the effect of increasing channel correlation for high Doppler frequency, as already observed for Fig. 2.

VI-C Active Attacks

We now consider the active attacks by Eve, as described in Section V, namely PC and AN attack. Fig. 5 shows the SAR as a function of $\sigma^{2}_{G}$ for PC attack (solid lines) and AN attack (dashed lines). Also in this case $\alpha_{\rm A}=\alpha_{\rm B}=0.4$ and channels are time-invariant. We recall that for the PC attack $\sigma_{\rm G}^{2}$ is the power of the random channel superimposed to the effective channel that is estimated by the legitimate users in the ID-A phase. From the figure we observe that this attack is not effective for S-CBCA and PLA schemes, instead increasing the SAR. This is due to the fact that this attack is equivalent to a reduction of the noise estimate for both legitimate users and Eve, thus resulting in a globally favorable situation. For A-CBCA this attack in instead effective, since the reduction of the uncertainty on the channel estimated by Bob helps Eve to perform a more effective attack. When we consider the AN attack instead we observe that it is effective for the S-CBCA and PLA schemes, while it yields a higher SAR (thus not being effective) for A-CBCA. In fact, since the AN is not used by Eve in its estimation phase, this attack provides additional randomness to Alice, that is unknown to Eve, thus supporting the extraction of random bits from the channel in A-CBCA. Instead, for the other schemes the additional noise reduces the capabilities of extracting a shared secret key from the channel in the S-CBCA scheme, or the possibility of effectively detecting channel variations in PLA scheme. Therefore this attack is effective against these two schemes. As we mentioned, randomizing pilots and channel agreement can be effective in preventing these attacks.

VII Conclusions

In this paper we have compared three UA strategies, based on either symmetric/asymmetric keys or on physical layer authentication, where in all cases the features used for authenticating the user are extracted from the communication channel. The comparison has been performed in terms of SAR, i.e., the rate at which the probability that UA security is broken goes to zero as the number of used channel resources goes to infinity. From the analysis and the numerical results we can conclude that the A-CBCA scheme provides potentially the highest SAR and is immune to channel changes. Then, the S-CBCA scheme, which uses the source-based SKA, is slightly more sensitive to the channel variations but has a lower bound on SAR that typically is higher than the SAR achieved with PLA. Moreover, PLA is the most sensitive solution to channel variations.

Appendix A Proof of Lemma 2

We first observe that by the chain rule

[TABLE]

Moreover, the KL divergence of the joint PDFs can be written as the expectation of the conditioned PDFs, i.e.,

[TABLE]

where expectation is taken with respect to $\bm{z}(2t)$. Now, we also have the general relation between mutual information and KL divergence for random variables $a$, $b$ and $c$

[TABLE]

Recalling that conditionally on $\bm{z}(2t)$, $x(1)$ and $x(2t+1)$ (as generated by Eve) are independent [20] we have

[TABLE]

Now, assuming that Eve does not attack in the ID-A frames, $p_{x(1)|\mathcal{H}_{1},\bm{z}(t)}=p_{x(1)|\mathcal{H}_{0},\bm{z}(t)}$. Moreover, if the attack has PDF $p_{x(2t+1)|\mathcal{H}_{0},\bm{z}(2t)}$, we have

[TABLE]

and therefore

[TABLE]

and using (63) we have

[TABLE]

which provides (19).

Appendix B SAR for A-CBCA with Rayleigh fading

We first observe that the Rayleigh channel coefficient $h$ has i.i.d. real and imaginary parts, therefore the SAR will be twice of the rate obtained considering the quantization of the real part, i.e.,

[TABLE]

For time-invariant channels and considering $(T_{i-1},T_{i})$ as quantization interval for $a_{i}$ we have

[TABLE]

where we used half of all noise variances since we are considering only the real part of the channel estimates. Now considering $v_{\rm sat}$ as the saturation value and $T_{i}=v_{\rm sat}+\Delta i$, $T_{-1}=-\infty$, $T_{M}=\infty$, we have that the first function in (70) is

[TABLE]

where $\langle y(2)\rangle$ is the quantization index of $y(2)$. Moreover for second and third functions in (70) we have

[TABLE]

[TABLE]

Both integrals in (71) and in (70) must be solved by numerical methods.