Security Vulnerability of FDD Massive MIMO Systems in Downlink Training Phase

TL;DR

This paper analyzes how a multi-antenna jammer can significantly disrupt downlink channel training in FDD massive MIMO systems by exploiting channel statistics, leading to increased estimation errors even with optimal training.

Contribution

It introduces a novel jamming attack based on second-order channel statistics and derives conditions for maximizing the mean square error in downlink training.

Findings

Jamming can substantially increase channel estimation MSE.

Optimal training signals are vulnerable to targeted jamming.

The attack remains effective even with many pilot symbols.

Abstract

We consider downlink channel training of a frequency division duplex (FDD) massive multiple-input-multiple-output (MIMO) system when a multi-antenna jammer is present in the network. The jammer intends to degrade mean square error (MSE) of the downlink channel training by designing an attack based on second-order statistics of its channel. The channels are assumed to be spatially correlated. First, a closed-form expression for the channel estimation MSE is derived and then the jammer determines the conditions under which the MSE is maximized. Numerical results demonstrate that the proposed jamming can severely increase the estimation MSE even if the optimal training signals with a large number of pilot symbols are used by the legitimate system.

Equations

$$\mathbf{y}=\sqrt{L{P}_b}{\mathbf{\Phi }}^H\mathbf{h}+\sqrt{L{P}_j}{\mathbf{Z}}^H\mathbf{g}+\mathbf{w},$$

$$\hat{\mathbf{h}}={\mathbf{C}}_{\mathbf{h},\mathbf{y}}{\mathbf{C}}_{\mathbf{y},\mathbf{y}}^{-1}\mathbf{y},$$

$${\mathbf{C}}_{\mathbf{h},\mathbf{y}}=\sqrt{L{P}_b}{\mathbf{R}}_h\mathbf{\Phi }$$

$${\mathbf{C}}_{\mathbf{y},\mathbf{y}}=L{P}_b{\mathbf{\Phi }}^H{\mathbf{R}}_h\mathbf{\Phi }+L{P}_j{\mathbf{Z}}^H{\mathbf{R}}_g\mathbf{Z}+{\sigma }^2{\mathbf{I}}_L.$$

$$\mathbf{\psi }={\mathbf{R}}_h\mathbf{\Phi }({\mathbf{\Phi }}^H{\mathbf{R}}_h\mathbf{\Phi }+\frac{P_j}{P_b}{\mathbf{Z}}^H{\mathbf{R}}_g\mathbf{Z}+\frac{{\sigma }^2}{L{P}_b}{\mathbf{I}}_L{)}^{-1}{\mathbf{\Phi }}^H{\mathbf{R}}_h.$$

$$MSE=\frac{1}{M}\mathbb{E}[\parallel \mathbf{ϵ}{\parallel }_2^2].$$

$$MSE=\frac{1}{M}tr({\mathbf{R}}_h-\mathbf{\psi }).$$

$${\mathbf{\Phi }}_{opt}=\arg \underset{\mathbf{\Phi }}{\min }\frac{1}{M}tr({\mathbf{R}}_h-\mathbf{\psi })={\mathbf{U}}_h(1:L).$$

$${\mathbf{Z}}_{opt}=\arg \underset{\mathbf{Z}}{\max }\frac{1}{M}tr({\mathbf{R}}_h-\mathbf{\psi }).$$

$$s.t.{\mathbf{Z}}^H\mathbf{Z}={\mathbf{I}}_L$$

$${\mathbf{Z}}_{opt}=\arg \underset{\mathbf{Z}}{\max }tr({\mathbf{Z}}^H{\mathbf{R}}_g\mathbf{Z}).$$

$$s.t.{\mathbf{Z}}^H\mathbf{Z}={\mathbf{I}}_L$$

$${\mathbf{Z}}_{opt}^H{\mathbf{R}}_g{\mathbf{Z}}_{opt}=diag({\lambda }_1^g,{\lambda }_2^g,...,{\lambda }_L^g)$$

$${\mathbf{Z}}_{opt}^H{\mathbf{Z}}_{opt}={\mathbf{I}}_L$$

$${\mathbf{\Phi }}_c=\arg \underset{\mathbf{\Phi }}{\max }\frac{1}{M}tr({\mathbf{R}}_h-\mathbf{\psi })={\mathbf{U}}_h(M-L+1:M).$$

$$\arg \underset{\mathbf{Z}}{\max }\frac{1}{M}tr({\mathbf{R}}_h-\mathbf{\psi })=\arg \underset{\mathbf{Z}}{\min }tr(\mathbf{\psi })$$

$$tr(\mathbf{\psi })=tr((\frac{P_j}{P_b}{\mathbf{Z}}^H{\mathbf{R}}_g\mathbf{Z}+{\mathbf{Q}}_1{)}^{-1}{\mathbf{Q}}_2)$$

$${\mathbf{Q}}_1={\mathbf{\Phi }}^H{\mathbf{R}}_h\mathbf{\Phi }+\frac{{\sigma }^2}{L{P}_b}{\mathbf{I}}_L$$

$${\mathbf{Q}}_2={\mathbf{\Phi }}^H{\mathbf{R}}_h^2\mathbf{\Phi }$$

$$\arg \underset{\mathbf{Z}}{\min }tr(\mathbf{\psi })=\arg \underset{\mathbf{Z}}{\max }tr({\mathbf{Z}}^H{\mathbf{R}}_g\mathbf{Z}).$$

$${\mathbf{Z}}_{opt}^H{\mathbf{R}}_g{\mathbf{Z}}_{opt}=diag({\lambda }_1^g,{\lambda }_2^g,...,{\lambda }_L^g)$$

Full text

‎

I Introduction

Massive MIMO is known as one of the main technologies in next generation of wireless networks (5G) in which the base stations (BS) in the cellular networks are supplied with a very large number of antennas [1]. This technology brings different advantages in the performance which spectral efficiency (SE) improvement is the most important one [2]. Massive MIMO can be deployed in two modes: frequency division duplex (FDD) and time division duplex (TDD). In contrast to the TDD massive MIMO systems, in the FDD mode, the SE does not always improve with the number of BS antennas and it may even degrade if the number of BS antennas gets too large. The reason is due to large overhead in downlink training of the FDD massive MIMO systems [3]. On the other hand, in the TDD mode, channel reciprocity can be utilized to estimate the downlink channel gain from the uplink training. But there are some problems in the TDD mode, for example, pilot contamination and calibration errors caused by hardware impairment can degrade the TDD massive MIMO systems performance significantly [4],[5]. Besides, the FDD mode has some advantages over the TDD mode, e.g. lower latency and better performance in symmetric traffic services. More importantly, most of the currently deployed systems are working in the FDD mode and economically it will be more efficient for the new generation networks to operate in the FDD mode. Therefore, using the FDD mode in massive MIMO systems has been an important research topic in recent years. One of the important problems in this regard is reducing the downlink training overhead that has been investigated in some papers, e.g. [6, 7, 8, 9, 10]. Also, there are some works on improving the efficiency of FDD massive MIMO systems with some assumptions about the channel model. For instance, the authors in [11] have considered a single-user FDD massive MIMO with a correlated channel and proposed an algorithm to optimize the energy efficiency of the system by adjusting training length and transmit power.

Another main issue in 5G networks is the security concerns because of their huge capacity and wider coverage. Physical layer security is one of the most effective approaches to solve the security issues of wireless networks against eavesdropping and jamming attacks [12]. Massive MIMO has an intrinsic security against passive eavesdropping [13]. But in the case of active eavesdroppers and jammers, massive MIMO security is not guaranteed and could be vulnerable. This problem has been investigated extremely in many works, e.g. [14, 15, 16, 17, 18]. In [14], the authors have considered a multi-user TDD massive MIMO system and demonstrated that how a limited-power smart jammer can perform an optimal attack in both uplink channel estimation and data transmission to minimize the uplink spectral efficiency of the system. In [15], the authors have explored the pilot contamination attack by an active eavesdropper in a multi-cell TDD massive MIMO network. The secrecy rate is analyzed for matched filter precoding and an artificial random noise transmission strategy. In addition, a precoder null space design is proposed to secure the communication against the eavesdropper. In [16], the authors have studied an advanced full-duplex adversary with a massive array who tries to attack a TDD single-user massive MIMO network. The adversary simultaneously performs eavesdropping and jamming. It is shown that even with imperfect jamming channel estimation and self-interference, the jammer can still disable conventional physical layer protecting schemes. In [17], the authors have proposed an approach to detect jammers in the TDD massive MIMO systems by exploiting some unused pilots in the system and showed that by increasing the number of base station antennas and unused pilots, the proposed scheme can detect the jamming more efficiently. In [18], a robust jamming-resistant receiver in the uplink of a TDD massive MIMO network is designed which utilizes some purposely unused pilot symbols in the training phase. All of the aforementioned papers and other related references therein have assumed the TDD mode for massive MIMO networks and as far as we know, no work in the literature has considered the security issues of FDD massive MIMO systems.

In this paper, we study the security of massive MIMO systems in FDD mode. In particular, we consider downlink channel training of an FDD massive MIMO system when there is a multi-antenna jammer in the environment who tries to attack the training phase and degrade the channel estimation performance. In contrast to many other papers in this field, we have taken into account the spatial correlation of the channels which makes the channel model more realistic. The jammer designs its attack based on the second-order statistics of its channel. We show that how a smart jammer can efficiently attack the training phase and increase the estimation error significantly. The mean square error (MSE) maximization is selected as the attack criterion and the optimal design of the jammer signal is analytically derived. Numerical results illustrate that how much the proposed attack can jeopardize the downlink training phase in this system even if the BS uses optimal pilots for channel estimation. This security vulnerability is shown to be more severe at stronger correlated channels.

The remainder of this paper is organized as follows. In Section II, the system model is introduced. Downlink channel training procedure is presented in Section III. In Section IV, the jamming signal design problem is formulated and solved. Numerical results are given in Section V and in the end, Section VI provides the conclusion of this paper.

I-A Notation

Throughout the paper, we use boldface uppercase to denote matrices, boldface lowercase for vectors and italic letters to denote scalars. $(.)^{H}$ represents conjugate transpose and $\bm{A}(i:j)$ denotes a matrix containing columns $i$ to $j$ of a matrix $\bm{A}$. $\mathbb{E}\{.\}$ is the expectation operator and $\bm{v}\sim CN(0,\bm{R})$ represents circularly-symmetric complex Gaussian random vectors with zero mean and covariance matrix $\bm{R}$. The $L\times L$ identity matrix is denoted by $\bm{I}_{L}$. For two random matrices $\bm{x}$ and $\bm{y}$, the covariance matrix is represented by $\bm{C}_{\bm{x},\bm{y}}$.

II System Model

We consider a single-cell network with a large-scale BS supplied with $M>>1$ antennas and a single-antenna user-equipment (UE) in the presence of a jammer who has $N$ antennas. The network operates in the FDD mode. Therefore, for downlink channel estimation, the BS transmits a training sequence to the UE, then the UE estimates the channel gain and feedbacks its estimation to the BS. The BS transmits a pilot signal, $\bm{\varphi}_{m}$ with the length of $L$ symbols from each of its transmit antennas. These pilots can be stacked into an $M\times L$ matrix called $\bm{\Phi}$. Unitary training sequence with the same power at each of the pilot symbols is adopted in this paper, i.e. $\bm{\Phi}^{H}\bm{\Phi}=\bm{I}_{L}$. We assume that the jammer has a prior knowledge of $L$ and transmits a jamming signal containing at least $L$ symbols from each of its antennas. The signal transmitted by the jammer can be collected into an $N\times L$ matrix called $\bm{Z}$. The received signal by the UE will be

[TABLE]

where $P_{b}$ is the BS transmit power in the training phase, $\bm{h}\in\mathbb{C}^{M\times 1}$ is the channel gain from the BS to the UE, $P_{j}$ is the jammer transmit power, $\bm{g}\in\mathbb{C}^{N\times 1}$ is the channel gain from the jammer to the UE and $\bm{w}\sim CN(0,\sigma^{2}\bm{I}_{L})$ models the thermal noise at the UE.

The channel gain from the BS to the UE is assumed to be spatially correlated. It is modeled as $\bm{h}\sim CN(0,\bm{R}_{h})$ where $\bm{R}_{h}=\mathbb{E}(\bm{h}\bm{h}^{H})$ is the covariance matrix of the channel vector $\bm{h}$. The same model is used for the channel gain from the jammer to the UE, i.e. $\bm{g}\sim CN(0,\bm{R}_{g})$.

III Downlink channel estimation

The UE uses the received signal in (1) to estimate $\bm{h}$ by minimum mean square error (MMSE) method [19] that yields

[TABLE]

where the covariance matrices are computed as

[TABLE]

The estimated channel gain distribution is $\bm{{\hat{h}}}\sim CN(0,\bm{\psi})$ where the covariance matrix $\bm{\psi}$ is computed as

[TABLE]

We define the estimation error vector as $\bm{\epsilon}=\bm{h}-\bm{{\hat{h}}}$ that $\bm{\epsilon}\sim CN(0,\bm{R}_{h}-\bm{\psi})$ and the average MSE per antenna (hereafter MSE) is computed as

[TABLE]

By exploiting Wishart matrix properties in [20], the MSE will be

[TABLE]

The eigenvalue decomposition (EVD) of $\bm{R}_{h}$ is $\bm{R}_{h}=\bm{U}_{h}\bm{D}_{h}\bm{U}_{h}^{H}$ where $\bm{D}_{h}=diag(\lambda_{1}^{h},\lambda_{2}^{h},...,\lambda_{M}^{h})$ is a diagonal matrix containing the eigenvalues of $\bm{R}_{h}$ in descending order and $\bm{U}_{h}$ contains the corresponding eigenvectors. The BS does not know about the jammer presence and designs the pilot matrix $\bm{\Phi}$ to minimize the MSE without taking into account the effect of the jammer. In [9], it is shown that the optimal design of pilots to minimize the MSE is as follows

[TABLE]

In the next section, we will analyze the estimation performance with the above optimal pilot design in the presence of our proposed jammer signal design.

IV Jammer attack signal design

In this section, we look at the channel estimation procedure from the jammer’s point of view and show that how a smart jammer with a limited power can efficiently design its attack signal, $\bm{Z}$, to maximize the estimation error even if the BS uses the optimal pilots as in (8). The jammer knows its channel covariance matrix $\bm{R}_{g}$ since it is the second-order statistics of the channel and changes slowly over many coherence intervals. The eigenvalue decomposition (EVD) of $\bm{R}_{g}$ is $\bm{R}_{g}=\bm{U}_{g}{\bm{D}_{g}}\bm{U}_{g}^{H}$ where $\bm{D}_{g}=diag(\lambda_{1}^{g},\lambda_{2}^{g},...,\lambda_{N}^{g})$ is a diagonal matrix containing the eigenvalues of $\bm{R}_{g}$ in decreasing order and $\bm{U}_{g}$ is corresponding eigenvector matrix. The jammer can design the signal $\bm{Z}$ in different ways. However, in all designs, the unitary signal structure with equal power at each of the symbols is used, i.e. $\bm{Z}^{H}\bm{Z}=\bm{I}_{L}$. The jammer solves the following optimization problem to design its attack signal

[TABLE]

The matrix $\bm{Z}_{opt}$ that maximizes the objective function in (9) minimizes $tr(\bm{\psi})$. The following lemma gives a simple equivalent problem for (9) and and presents a solution for it.

Lemma 1**.**

An equivalent problem for (9) is

[TABLE]

The $\bm{Z}_{opt}$ in (10) should satisfy these two conditions

[TABLE]

*which implies that $\bm{Z}_{opt}=\bm{U}_{g}{(1:L)}$.

proof: See Appendix.*

Based on this lemma, we conclude that if the BS uses $L$ symbols for downlink training, a jammer with $N\geq L$ antennas can design an optimal attack signal and maximize the MSE. In the next section, we will evaluate the performance of the proposed jamming attack by numerical simulations.

V Numerical Results

In this section, the performance of the proposed jamming is explored by means of numerical simulations and we inspect the estimation MSE in different channel conditions and pilot signal designs at the BS. We consider a BS with a uniform linear array (ULA) consisting of $M=100$ antennas. The exponential correlation model is used for the covariance matrix $\bm{R}_{h}$ with elements $\bm{R}_{h_{i,j}}=r^{|i-j|}$, where the coefficient $r\in(0,1]$ determines the strength of the correlation in the channel [5]. The same model is used for the jammer’s channel covariance matrix. Path-loss and shadow-fading are assumed to be the same for both channels and are normalized to unity. Furthermore, the variance of thermal noise is assumed to be $\sigma^{2}=1$ and the transmit power of the BS and the jammer are measured in dB relative to $\sigma^{2}$.

To show the vulnerability of the estimation procedure in the presence of the proposed jamming, we consider five different scenarios and compare them in terms of the channel estimation MSE. The BS can design the pilot signal matrix in different ways but two extreme cases are important here. In the first case, the BS uses the optimal pilots in (8). In the second case which is the worst case scenario, the BS uses the complementary of these pilots. We call it the worst-case pilots which are obtained by the following problem,

[TABLE]

This can be derived by following an approach similar to the proof of (8) in [9]. In the jammer side, we consider our proposed jamming design and two other scenarios for benchmarking. First, the jammer is silent and does not attack the system. In the second scenario, the jammer designs its attack signal without considering the second-order statistics of its channel and the objective in (9) and only satisfies constraint $\bm{Z}^{H}\bm{Z}=\bm{I}_{L}$. One way to do this which we call single-shot jamming is when every column of $\bm{Z}$ has only one ’1’ entry, and none of the rows has more than one ’1’ entry.

Fig. 1 illustrates the MSE of the estimator versus the number of pilot symbols the aforementioned pilot and jamming signal designs. We can see that in a realistic case that the BS uses the optimal pilots $\bm{\Phi}_{opt}$, our proposed jamming has a severe effect on the MSE and makes it close to the case that the BS uses the worst-case pilots. When the number of symbols, $L$ gets close to the number of BS antennas, the MSE under the proposed jamming gets even larger than the worst-case pilots scenario. We also see that when there is no jamming in the system, the MSE will tend to zero by increasing $L$, but in the presence of the proposed jammer, it will saturate to a value around 0.5. This implies that the estimation procedure in this system is severely vulnerable to the jamming attack. The other point that can be seen from this figure is the merit of our proposed jamming in compared to single-shot jamming design.

Fig. 2 is in the same scenario as in Fig. 1 but with a larger correlation coefficient i.e. a stronger correlated channel. We can see that when the channel is more correlated, the optimal pilot design makes the MSE very small in the case of no jammer or with single-shot jamming in the system. But with our proposed jammer signal design, the MSE gets significantly large. Also it should be noted that in all the scenarios, when the number of pilot symbols $L$ is equal to the number of BS antennas, the MSE will be relatively small, but if the jammer uses our proposed design, the MSE will still be around 0.5 and can be very destructive in the downlink data phase precoder design.

Fig. 3 shows the channel estimation MSE versus the number of BS antennas. The number of pilot symbols in the system is fixed at $L=20$ and the jammer is assumed to have $N=25$ antennas. As we see, in the presence of our proposed smart jammer, the more antennas at the BS can blow down the MSE. However, after a minimum point, the MSE starts to grow up by increasing the number of BS antennas. That is because a large number of antennas leads to a high dimensional channel vector and $L=20$ pilot length is not sufficient to estimate this channel even if it is strongly correlated. Note that at any number of BS antennas, the MSE in the presence of our proposed jammer is still larger than all other scenarios that adopt optimal pilot designs at the BS.

VI Conclusion

In this work, we considered the security of an FDD massive MIMO system against a jammer who intends to attack the downlink training phase and degrade the estimation performance. The jammer tries to maximize the estimation MSE by optimal designing of its attack signal even if the BS uses the optimal training signals with a large number of pilot symbols. Numerical results showed the severe impact of this attack. In particular, when the BS uses optimal pilots with enough length of symbols, the estimation MSE could tend to zero in the absence of jammer or in the presence of other jamming schemes. But if the jammer attacks the system using our proposed design, the estimation MSE will be still large even at a large number of pilot symbols. This shows the security vulnerability in the downlink training phase of FDD massive MIMO systems against the proposed smart jammer.

Appendix

VI-A proof of Lemma 1

First, we show that solving the problem in (10) is equivalent to the solution of (9). As $M$ is a constant and $\bm{R}_{h}$ is independent of $\bm{Z}$, we have

[TABLE]

Using the fact that $tr(\bm{A}\bm{B}\bm{C})=tr(\bm{B}\bm{C}\bm{A})$, we can rewrite equation (5) as follows

[TABLE]

$\bm{Q}_{1}$ and $\bm{Q}_{2}$ are independent of $\bm{Z}$. Also note that $\bm{Z}^{H}\bm{R}_{g}\bm{Z}$ is in the inverted part of $\bm{\psi}$, therefore

[TABLE]

To solve the equivalent problem in (10), we use the fact that for a matrix $\bm{R}_{g}$ and any matrix $\bm{Z}$ satisfying the constraint (1), the trace of matrix $\bm{A}=\bm{Z}^{H}\bm{R}_{g}\bm{Z}$ is maximized when $\bm{A}$ is diagonal and also the main diagonal entries of $\bm{A}$ are maximized. By exploiting the EVD of $\bm{R}_{g}$ and noting that the eigenvalues of $\bm{R}_{g}$ are in decreasing order in $\bm{D}_{g}$, we conclude that the matrix $\bm{Z}_{opt}$ which maximizes $tr(\bm{A)}$ and satisfies (1), must meet the following equation

[TABLE]

which implies that $\bm{Z}_{opt}=\bm{U}_{g}{(1:L)}$.