Table Of ContentInsider-Attacks on Physical-Layer Group
Secret-Key Generation in Wireless Networks
J. Harshan†, Sang-Yoon Chang⋆, Yih-Chun Hu∗ †
†Advanced Digital Sciences Center, Singapore, ⋆University of Colorado, Colorado Springs, USA,
∗University of Illinois Urbana-Champaign, USA
Email: [email protected], [email protected], [email protected]
7 Abstract—Physical-layergroupsecret-key(GSK)generationis [2]. In PKG, the two participants observe a common source
1 an effective way of generating secret keys in wireless networks, of randomness to generate a common key without leaking
0 wherein the nodes exploit inherent randomness in the wireless informationtoanexternalpassiveeavesdropper.Although,the
2 channelstogenerategroupkeys,whicharesubsequentlyapplied
sourcesofrandomnessareinnumerable,easilyaccessibleones
to secure messages while broadcasting, relaying, and other
n network-level communications. While existing GSK protocols are the variations in the wireless channel strengths, such as
a focus on securing the common source of randomness from the received signal strength indicator (RSSI) values, complex
J
external eavesdroppers, theyassumethat thelegitimatenodesof basebandsignalsamples,andthechannelestimates.Otherthan
3 the group are trusted. In this paper, we address insider attacks
the concept of generating secret-keys for two nodes that are
1 from the legitimate participants of the wireless network during
the key generation process. Instead of addressing conspicuous within radio frequency (RF) range, some works [3]-[5] have
] attacks such as switching-off communication, injecting noise, or also addressed using third-party relay(s) to assist the secret-
T
denying consensus on group keys, we introduce stealth attacks key generation between nodes that are out of range.
.I thatcangoundetectedagainststate-of-the-artGSKschemes.We A generalization of relay-assisted secret-key sharing is the
s propose two forms of attacks, namely: (i) different-key attacks, concept of wireless physical-layer group secret key (GSK)
c
whereinaninsiderattemptstogeneratedifferentkeysatdifferent
[ generation,wherein a groupof nodes in the network generate
nodes, especially across nodes that are out of range so that
1 theyfail to recover group messages despitepossessingthe group asecretkeybyobservingacommonsourceofrandomness[6],
v key, and (ii) low-rate key attacks, wherein an insider alters [7], [9]. Unlike two-user wireless PKG, in GSK generation,
8 the common source of randomness so as to reduce the key- nodes in the group exchange additional messages apart from
6 rate. We also discuss various detection techniques, which are the pilots so that all the nodes witness the common source of
5 based on detectinganomalies and inconsistencieson thechannel randomness. GSK generation is applicable in ad hoc wireless
3 measurements at the legitimate nodes. Through simulations we
networksthat operate in mobile environments,e.g., MANETs
0 show that GSK generation schemes are vulnerable to insider-
. threats, especially on topologies that cannot support additional and VANETs [14]. Existing works on GSK have focused on
1 secure links between neighbouring nodes to verify the attacks. developing protocols for exchanging messages so as to (i)
0
reduce the latency, and (ii) to secure the generated keys from
17 I. INTRODUCTION anexternaleavesdropper[6],[7],[9].Also,themodelsassume
: In wireless ad hoc networks the participating nodes typi- trusted groupmembersand secure the communicationagainst
v
cally engage in group communication such as broadcasting, passive eavesdroppersand active attacks from externalnodes.
i
X multiple-access, or relaying operations, where more than two In this work, we deviate at this point, to not to discard the
r nodes may be simultaneously involved. These sophisticated possibility of the presence of insiders that involve in active
a
protocols are motivated by mission-critical goals such as attacks, that disturb the key generation process. In particular,
achievinghigh-throughput,orsupportingresource-constrained we incorporate the possibility that some legitimate nodes
nodes (such as bandwidth and power) in the network. In mightbe compromised(for e.g., as in [10]), and the attackers
ordertosecuregroupcommunicationfromexternaleavesdrop- might enter the system as insiders before the commencement
pers, the nodes use group secret keys (GSKs) to exchange of key generation.
confidential data, and are also involved in key management Our specific contributions are:
tasks such as key generation, distribution and maintenance • We introduce a novel threat model with insider-
[1]. While strengthening the security of key management compromise,thatpriorworkshavenotconsidered.Some
is an evolving research field, researchers are concurrently crude attacks in our model are to stop relaying signals
focussing on methods to dynamically generate secret keys in the key-generation process, or to inject noise into the
by exploiting randomness available in the environment. The system,ortopreventtheneighbouringnodesinachieving
purpose of dynamic key generation is either to use it as an consensusonthegroupsecretkey.We,however,consider
independent recipe of generating keys, or to use it to update more sophisticated attacks that enable the attacker to
theexistingkeys.Dynamickeygenerationtechniquesarewell manipulate the key generation process and yet go unde-
known, and have been particularlywell studied in the context tected.Morespecifically,wehaveproposedthefollowing
of wireless two-user physical-layer key generation (PKG) two types of attacks: (i) different-key attacks, wherein
an insider attempts to force different realizations of key For the chain-topology,the set of all channels for a given l is
at different nodes, especially in a network when the H(l)={h (l)|∀j =i+1}.Forthiscase,thecommonsource
ij
legitimate nodes do not have private channels to verify of randomness is some function f(H′(l)) ∈ C for H′(l) ⊂
theattack(fore.g.,inchain-topologybasednetworks[8]), H(l). Since each node can broadcast its pilot to a maximum
and (ii) low-ratekey attacks, wherein an insider attempts of two nodes, some nodes need to forward their observations
to slow down the channel variations over time, in order so that all the nodes witness H′(l).
to reduce the secret-key rate, which is a measure of how We assume that the coherence time T is longer than one
c
fast the generated keys can be updated (Section III). roundof the GSK generationprotocol.A genericprotocolfor
• To detect the above attacks, one can envision a scheme exchanging the observations is given below:
that uses a separate communication channel built on • For l∈{1,2,...,L}
neighbour discovery and explicit pair-wise communica-
– For i∈{1,2,...,N}
tion with the legitimate neighbours; however, such a
∗ Nodeibroadcastspilotsymbol(s),whichareused
straightforwardschemeintroducesnewsetsofvulnerabil-
by the rest of the nodes in its RF range to learn
ities and can be expensieve in terms of communication-
the corresponding channel estimates.
overhead.Therefore,weapplydetectionschemesthatare
End
based on standard phy-layer techniques such as measur-
– DependingonthetargetH′,thenodesexchangetheir
ing average power levels and Doppler spread (variations
acquiredsetofchannelestimates,oneaftertheother
of channel over time) [11] to identify anomalies and in-
until each node learns f(H′(l)).
consistencies. We show that the proposed insider-attacks
cangoundetectedonthestate-of-the-artGSK generation End
schemes with a non-negligiblerate despite using off-the- In practice, GSK generation protocols have to be repeated
shelf channel measurement techniques. This implies that L times to accumulate the required number of bits for the
GSKgenerationschemesarevulnerabletoinsider-threats, digitalkey (say K bits). Therefore,the numberL dependson
especially on topologies that cannot support additional numberofbitsgeneratedineveryround(sayk bits).Also,the
secure links between neighbouring nodes to verify the nodes go through additional rounds of communication over a
attacks. (Section IV) public channel to arrive at consensus on the generated digital
secret.Inthiswork,weonlyfocusontheprotocolforsharing
II. SYSTEMMODELFORGSK GENERATION observations,as it is fundamentalto establishing the common
Consider a chain-topology based wireless network of N source of randomness. For some examples of physical-layer
nodes,denotedbythesetS ={1,2,...,N−1,N},wherethe GSK generation, we refer the readers to [8], [9].
nodes want to securely communicate among each other using
A. Illustrative Example
a GSK. We assume that a GSK is dynamically generated at
the nodes by exploiting common randomness in the wireless Consider a small network of three nodes S = {1,2,3}
channels.ThewirelesschannelbetweenNodei∈S andNode as shown in Fig. 1, where the nodes 1 and 3 are out of
j = i + 1 ∈ S is denoted by a discrete random process each other’s RF range. This implies that nodes 1 and 3
{h (l) ∈ C | l = 1,2,3,...}, where the index l captures can communicate only through Node 2. We assume that the
ij
the realization of the channels at different time instants. All topology remains fixed for L rounds of the protocol. For
thechannelsareassumedquasi-staticwithidenticalcoherence a given l, the set of underlying channels of the network
interval of Tc seconds, and thus {hij(l)} can be viewed as is H(l) = {h12(l),h23(l)}, which is the set of complex
the outputof sampling a continuousrandom process {h (t)} channel estimates. For this network, let the common source
ij
at t = lTc for l = 1,2,.... Here, {hij(l)} denotes the set of of randomness be h12(l)h23(l), which implies H′(l) = H(l)
channelestimatesderivedfromthecomplexbasebandsamples and f is a productfunction. To gain insights, we assume that
at the receivers. We assume that nodes communicate on a the nodes in the network do not experience additive noise
single frequency but in time division duplex (TDD) fashion, (the noisy case is treated in Section IV). To achieve the
i.e., no two nodes transmit at the same time. Also, by the target h12(l)h23(l) at all the nodes, the following protocol
virtue of channel reciprocity, we assume that nodes i and is followed during the l-th round [4].1
j observe the same channel environment between them, i.e., • Phase 1: Node 1 transmits a pilot symbol p= 1, which
hij(l) = hji(l). Further, the network topology is assumed to is used by Node 2 to learn h12(l), i.e,
be fixed over several blocks of coherence intervals.
Θ (l)=h (l). (1)
In the abovenetworkmodel,the nodesintendto generatea 1,2 12
GSKbyobservinganaccessibleandsecuresourceofcommon Here Θ (l) denotes the observation seen by Node j at
i,j
randomness. Unlike two-node physical-layer key generation, the end of Phase i.
which requires a minimum of two rounds of pilot exchanges,
the multi-node generalization requires more exchanges; the 1Although the protocol in [4] was primarily proposed to facilitate two-
node secret generation via arelay, the sametechnique has been generalized
number of times a node transmits depends on the underlying
to generate a GSK in mesh networks by [9]. In this work, we apply the
protocol,and also the chosen source of common randomness. protocolof[4]forGSKgeneration inchaintopology.
III. THREATMODEL
p = 1 Phase 1 Phase 2 p = 1 We study insider-attacks from one of the nodes in the
network (specifically the middle node), and leave open the
1 2 3 1 2 3 general problem of multiple-insiders or collaborative insider-
attacks for future research. We assume that the attacker in
h12 h12, h23
thenetworkhasthefollowingcapabilities:Assumption1:The
insidercantransmitsignalswithhigherpowerthantherestof
Symbols below the nodes represent channels
learnt during each phase the nodes.Assumption2: Theinsider haslargestorage size to
store the pastchannelrealizationsof the network.Assumption
Phase 4 h12 + h23 p = 1 Phase 3 3: The insider can learn the topology of the network.
We envisage the following two types of attacks from an
insider during the key generation process.
1 2 3 1 2 3
h12, h23 h12, h23 h12, h23 h12 h12, h23 h23 A. Different-Key Attack
In GSK generation, the nodes have to securely exchange
Common source of randomness –h12*h23
1 their observations so that they view correlated source of
randomness. A potential threat is the different-key attack,
Fig. 1. A GSK generation protocol between nodes 1, 2 and 3, where h12 whereinaninsiderforwardsmessagestopartitionthenetwork
denotes the channel between nodes 1 and 2, and h23 denotes the channel into two or more subgroupssuch that nodes across subgroups
between nodes 2 and 3. The protocol includes 4 phases (read clock-wise
fromtopleft), attheendofwhichallthe3nodes learnthecommonsource observe uncorrelated source of randomness. As a result, the
ofrandomnessh12h23. nodes across subgroups are forced to generate a different
digital-key than the rest of the nodes in other subgroups. If
the insider achieves such an attack, then the nodes believe
thattheyhavethecorrectgroupkey.However,duringthedata
• Phase 2: Node 3 transmits a pilot symbol p =1, which
communication phase, they will fail to accurately recover the
is used by Node 2 to learn h (l), i.e,
23
group messages due to mismatched keys. Assumption 2 and
Θ (l)=h (l). (2) Assumption 3 may have to be invoked to realize this attack.
2,2 23
Weexemplifyadifferent-keyattackontheprotocolofSection
• Phase 3: Node 2 transmits a pilot symbol p =1, which II-A,byintroducingtheattackparameters{ρ,ρ1,ρ2}suchthat
is used by Node 1 to learn h12(l), and Node 3 to learn the special case of {ρ = 1,ρ1 = h12,ρ2 = h23} represents
h (l), i.e., the no-attack case.
23
1) Different-key attack on the chain-topology by Node 2:
Θ (l)=h (l),Θ (l)=h (l). (3) For the protocol discussed in Section II-A, Node 2 gets two
3,1 12 3,3 23
chancestosabotagethekey-generationprocessineveryround;
• Phase 4: Finally, Node 2 broadcasts the sum h12(l)+ first time when it transmits the pilot p=1, and the next time
h23(l) to the other nodes. Node 1 and Node 3 receive whenittransmitsthesumoftwochannelsh12(l)+h23(l).The
h (l)(h (l)+h (l)) and h (l)(h (l)+h (l)), re- most general attack scenario from Node 2 is the following:
12 12 23 23 12 23
spectively, i.e, • In Phase 3, Node 2 transmits p = ρ(l) ∈ C other than
p=1.
Θ4,1(l)=h12(l)(h12(l)+h23(l)), (4) • In Phase 4, Node 2 transmits ρ1(l)+ρ2(l) instead of
Θ4,3(l)=h23(l)(h12(l)+h23(l)). (5) h12(l)+h23(l), where ρ1(l) and ρ2(l) are chosen based
on the attack-objective.
Sincenodes1and3alreadyknowoneofthecomponents Since p = ρ(l) in Phase 3, the nodes 1 and 3 believe that
inthelinearcombination,theycanceltheself-interference theirchannelstoNode2areρh (l)andρh (l),respectively.
12 23
to retrieve h12(l)h23(l), i.e., Upon completionof Phase 4, the observationsat Node 1 and
Node3aftercancellingself-interferencearerespectivelygiven
Θs4c,1(l)=h12(l)h23(l),Θs4c,3(l)=h12(l)h23(l). (6) by,
Meanwhile, since Node 2 has the realizations of two Θsc (l)=h (l)(ρ (l)+ρ (l))−ρ2(l)h (l),
4,1 12 1 2 12
channels,itcomputestheproducttoacquirethecommon
Θsc (l)=h (l)(ρ (l)+ρ (l))−ρ2(l)h (l).
randomness. 4,3 23 1 2 23
TheaboveprotocolisdepictedinFig.1bydroppingtheindex The objective of the different-key attack is to make sure
l.Inthisillustrativeexample,theorderofthefirstthreephases that Θsc (l) and Θsc (l) are uncorrelated, which can be
4,1 4,3
Phase 1, Phase 2 and Phase 3 can be permuted in any of 6 achieved by choosing ρ (l),ρ (l) statistically independent of
1 2
possible ways. h (l),h (l).Inthisexample,Assumption2hastobeinvoked
12 23
in order to store the channels {ρ (l),ρ (l)}, and Assumption attack, the nodes are forced to believe that the individual
1 2
3 has to be invoked for Node 2 to learn the chain-topology. channels are ρ(l)h (l) and ρ(l)h (l), instead of h (l) and
12 23 12
In(7)-(9),weillustratetheeffectofthedifferent-keyattack h (l), respectively. For the above model, the attacker can
23
on the digital keys, by quantizing the values of |Θsc | and replace Θsc (l) and Θsc (l) by a slow-varying channel h′(l)
4,3 4,1 4,3
|Θs4c,1|intotwolevels.Althoughmoresophisticatedalgorithms by choosing ρ(l) as ρ(l) = h′(l) . Thus, this attack
exist in literature to generate digital keys [2], we have used h12(l)h23(l)
forces the nodes to generateqa structured digital key rather
a primitive method to showcase the effect of the proposed
than a random one.
attacks on the digital keys.
In(10) - (11), we illustrate the effectof low-ratekey attack
Kno attack = [0 1 1 1 1 0 1 1], (7) on the digital keys, by quantizing the values of |Θs4c,3| and
|Θsc | into two levels.
K1 = [0 1 0 1 1 0 0 1], (8) 4,1
attack
K3 = [0 0 1 1 0 1 0 1]. (9) Kno attack = [1 1 0 1 0 0 0 1], (10)
attack
K = [1 1 1 1 1 1 1 1]. (11)
In the above example, 8-bit digital group keys are generated attack
with (denoted by K1 and K3 for Node 1 and 3, re- Intheaboveexample,8-bitdigitalgroupkeyisgeneratedwith
attack attack
spectively)andwithout(denotedbyKno attack)thedifferent- (denoted by Kattack) and without (denoted by Kno attack)
key attack by Node 2. With the different-key attack, the keys the low-rate key attack by Node 2. With the low-rate key
generated at Node 1 and Node 3 are different. attack, the channelrealizations are forced to vary slowly over
time, thereby ensuring the quantized values to lie in one of
B. Low-Rate Key Attack
the regions.
In physical-layer GSK generation, the number of bits gen-
erated from every round of the protocol determines the key- IV. DETECTIONTECHNIQUES AND SIMULATION RESULTS
rate. To illustrate further, if k bits of GSK are generated In this section, we discuss possible techniques to detect
from each round, and the absolute time difference between insider-attacks during the key generation protocol. Detection
successiveroundsisτ seconds,thenthekey-rateis k bits/sec. methods can be broadly classified into two types: (i) direct
τ
This implies that to generate a randombit sequence of length detection and (ii) indirect detection. In the former class, the
K, say K = 128 for application under advanced encryption nodescommunicateamongeachothertoverifythecorrectness
standard, the key generation method requires Kτ seconds. ofthegeneratedkeybyexchangingeitherthecommonsource
k
Thus, if we wish to update the K-bit key frequently,then we of randomnessor the generatedkey (preferablyovera private
shouldusewirelesschannelsthatsupporthighentropy,and/or channel to shield leakage from an eavesdropper).In the latter
use protocols that have low-latency. class of methods, the nodes do not explicitly exchange keys
With the above discussion on key-rate, a possible insider- orcommonsourceof randomness,insteadtheymeasuresome
attack is to lower the key-rate. This can be accomplished physicalcharacteristicsoftheirchannelstoidentifyanomalies
eitherbyreducingtheentropyofthechannel,i.e.,byreducing or inconsistencies. For the chain-topology based networks,
the number k, or by enforcing a slow-varying channel so former class of methods suffer from higher communication-
that the accumulated bits look structured rather than random. overhead (e.g., nodes need high transmit power to reach the
Assumption 1 and Assumption 2 may have to be invoked to farthernodes),and hence,we focuson the followingstandard
realize this attack. We illustrate a low-rate key attack on the methodsinthelatterclass:(i)MeasurementofDopplerspread
protocolof Section II-A. In the nextsubsection, we introduce [11] (ii) Measurementof average power levelson the channel
the attack parameters {ρ,ρ ,ρ } for the low-rate attack such estimates.
1 2
thatthe specialcase ofρ=ρ =ρ =1 representsno-attack. In the rest of the section, we present a comprehensive
1 2
1) Low-rate key attack on the chain-topology by Node 2: analysis on the possibility of detecting an insider-attack by
To execute a low-rate key attack, the fundamentalcriterion is measuring some physical characteristics of wireless channels.
to enforce Θsc (l) and Θsc (l) are identical and vary slowly In our simulations, we incorporate the existence of additive
4,1 4,3
over time. An attack strategy from Node 2 is given below: noise at all the receivers. As a result, the observations made
• In Phase 3, instead of p = 1, Node 2 transmits p = at the nodes are erroneous channel estimates (not ideal as
ρ(l)∈C. in Section II-A). To demonstrate the impact of the detection
• In Phase 4, Node 2 transmits ρ1(l)h12(l)+ρ2(l)h23(l) schemes, we realize the attacks of Section III on the protocol
insteadofh (l)+h (l),whereρ (l)andρ (l)suitably discussed in Section II-A.
12 23 1 2
chosen.
A. Simulation Setup
Undertheabovethreatmodel,choosingρ (l)=ρ (l)=ρ2(l)
1 2 For simulations, all the channels in the network
forces
{h (l),h (l)} are generated using the 1-st order AR model
12 23
Θsc (l)=ρ2(l)h (l)h (l) and Θsc (l)=ρ2(l)h (l)h (l). [12] as,
4,1 12 23 4,3 12 23
Although nodes 1 and 3 observe identical source of random- h12(l+1) = Fh12(l)+n12(l),
ness, their realization has been changed by ρ2(l). With this h (l+1) = Fh (l)+n (l),
23 23 23
for l > 1, where F is the Doppler spread of the channel,
0.9
formally defined as
0.8
NMSE −20 dB (PD)
F =E{hij(l)hij(l+1)}=J0(2πfdτ), (12) 0.7 NMSE −30 dB (PD)
NMSE −40 dB (PD)
Twkl-ihtinhtehda,DJnτ0doi(ps·(p)lthl+ederea1nfb)ors-ettoiqhnluugsetaentmhcteiypmlzieeessrd,ogia-fiftnvhederneofnrdbdcyeeirs(fiBtndheess=esDceolofnpfcdupvcsnl),ecrbtwiefohtrnweeqreoeuefenvnfitcrhsiyest. Probability values000...456 Probability of Pderotebcatbioilnity of false alNNNarMMMmSSSEEE −−−234000 dddBBB (((PPPFFFAAA)))
the node velocity, c is the speed of light and f is the carrier 0.3
c
frequency of signal transmission. For the simulations, we use 0.2
F = 0.98. The noise components n ,n are such that
12 23 0.1
h (l),h (l) are independent and distributed as circularly 50 100 150 200
12 23 Number of rounds of the protocol
symmetric complex Gaussian noise with zero mean and unit
Fig. 2. Different-key attack with static values of ρ1,ρ2: Probability of
variance, denoted by CN(0,1). We assume that the nodes detection (PD) and Probability of false alarm (PFA) values as a function
employthe state-of-the-artchannelestimationalgorithms[13] of channel estimate quality measured by the normalized mean square error
to estimate the channel gains. (NMSE)valuesindB,andthenumberofroundsoftheprotocol.Thisattack
cangoundetected evenatmoderately largevalues ofL.
At the end of Phase 3, the noisy estimates at nodes 1 and
3 are given by,
Θ (l)=h (l)+z (l),Θ (l)=h (l)+z (l). (13) 0.9
3,1 12 3,1 3,3 23 3,3
0.8
Similarly, at the end of Phase 4, the estimates before self-
0.7
interference cancellation are
0.6
and aΘΘft44e,,r31((slle))lf-i==nterfhhe21r32e((nllc))e((hhc12a23n((cll))el++lathhio21n32((all))re))++zz44,,31((ll)),and (14) Probability values000...345 Probability of detection NNNNNMMMMMSSSSSEEEEE −−−−−2342300000 dddddBBBBB (((((PPPPPDDDFFAA)))))
NMSE −40 dB (PFA)
Θs4c,1(l) = Θ4,1(l)−(Θ3,1(l))2 and 0.2 Probability of false alarm
Θsc (l) = Θ (l)−(Θ (l))2. 0.1
4,3 4,3 3,3
0
In (13) and (14), the noise components z3,j(l) and z4,j(l), 100 150 200Numb2er5 0of roun3d0s0 of the3 5p0rotoco4l00 450 500
for j ∈ {1,3} capture the errors in channel estimates, and
Fig.3. Low-ratekeyattackfromNode2:PDandPFAvaluesasafunction
they are assumed to be distributed as CN(0,α ), where α
i,j i,j of NMSE values and the number of rounds of the protocol. This detection
denotes their variance values. In practice, αi,j depends on technique requires accurate channel estimates (withlower NMSE)andmore
the signal-to-noise ratio (SNR) of the wireless channel, the numberofprotocol rounds.
number of pilots used to estimate the channel, and also the
underlying channel estimation method. For our experiments,
we use {α } such that the normalized mean square error B. Different-Key Attacks by Node 2
i,j
(NMSE) values duringPhase 3 and Phase 4 are held fixed at
We have simulated a different-keyattack of Section III-A1
some η, i.e., for j ∈{1,3},
on the protocol in Section II-A. We refer to this attack
E{|Θ (l)−h (l)|2} α as the static different-key attack, wherein ρ = 1 ∀l, and
3,j j = 3,j =η, ρ (l) = h (1),ρ (l) = h (1) ∀l, i.e., ρ (l),ρ (l) are fixed
E{|h (l)|2} E{|h (l)|2} 1 12 2 23 1 2
j j throughoutseveralroundsofthe protocol.Inourexperiments,
where h (l)=h (l) and h (l)=h (l). Similarly, we measure the average power levels on the signals received
1 12 3 23
during Phase 3 and Phase 4 to calculate the probability
E{|Θ4,j(l)−hj(l)(h1(l)+h3(l))|2} =η. of detection (PD) and probability of false alarm (PFA). In
E{|h (l)(h (l)+h (l))|2} particular, the following decision rule was used to detect an
j 1 3
attack:
Other than considering noisy estimates, we also study the
impact of the attacks against the number of observations, DETECT= 1, if EE{{||ΘΘ4s4c,,jj((ll))||22}} <1, for j ∈{1,3}.
which here refers to the number of rounds of the protocol ( 0, otherwise.
(denoted by L). In the following subsections, we share simu- (15)
lation results obtainedwhile detectingthe different-keyattack where the expectationis empirically computed over L rounds
and the low-rate key attacks. of the protocol. The above decision rule follows due to self-
interference cancellation at nodes 1 and 3. The different- canbesubjectto optimizationtofurtherimprovethe trade-off
key attack would result in significant difference in the power between PD ad PFA, which we defer for future research.
levels before and after interference cancellation due to non-
zero residual terms ρ h − (ρh )2 and ρ h − (ρh )2. V. SUMMARY ANDFUTURE WORK
1 12 12 2 23 23
However, the residual terms get fully cancelled in the no We have chosen a simple 3-node wireless network with
attack case. Based on the above rule, the attack is detected chain topology to highlight that GSK generation schemes
if atleast one of the nodes output the flag DETECT=1. The are vulnerable to insider-threats, especially on topologies that
results on PD and PFA were obtained by repeatedly running cannot support additional secure links to verify the attacks.
theprotocolforL={50,100,150,200}againstNMSEvalues Without delving into the expensive option of establishing
ofη ={−20,−30,−40}indB.TheresultsareplottedinFig. securelinks,itisaninterestingdirectionforfutureresearchto
2,whichshowthatthestaticattackgetsundetectedsignificant explore other low communication-overhead methods that can
number of times. The plots also show that the probability of detectattacksathighsuccessratebykeepingthefalsepositive
false alarm is higher for lower number of observations. This rates to low values.
trade-off between PD and PFA can be further optimized by
ACKNOWLEDGEMENTS
treating the above detection problem as a binary hypothesis
This work was supported by the research grant for the
problem.
Human-Centered Cyber-physical Systems Programme at the
C. Low-Rate Key Attack by Node 2 Advanced Digital Sciences Center from Singapore’s Agency
Wehavesimulatedalow-ratekeyattackofSectionIII-B1in for Science, Technology and Research (A*STAR).
order to force a Doppler spread of F =0.99 on the common
REFERENCES
source of randomness {Θsc (l)} and {Θsc (l)}, by replacing
4,1 4,3
h (l)h (l) by ρ2(l)h (l)h (l), which otherwise takes the [1] A. Mishra, K. Nadkarni and A. Patcha, “Intrusion detection in wireless
12 23 12 23 adhocnetworks,”inIEEETrans.onWirelessCommunications, vol.11,
valueofF =0.96(since{h (l)}and{h (l)}haveDoppler
12 23 no.1,pp.48-60,Feb.2004.
spread of F = 0.98, the product {h (l)h (l)} should [2] SuhasMathur,NarayanM,ChunxuanYe,AlexReznik,“Radio-telepathy:
12 23
have Doppler spread of 0.96). In our experiments, we have extractingasecretkeyfromanunauthenticated wirelesschannel,”Mobi-
com2008.
gathered Doppler measurements to compute the probability
[3] H.Zhou,L.M.HuieandL.Lai,“Secret keygeneration inthetwo-way
of detection (PD) and probability of false alarm (PFA). The relay channel with active attackers,” in IEEE TIFS, vol. 9, no. 3, pp.
Doppler computations were obtained as 476-488,Mar.2014.
[4] T.Shimizu,H.IwaiandH.Sasaoka,“Physical-layersecretkeyagreement
intwo-way wireless relaying systems,”in IEEETIFS,vol.6,no. 3,pp.
F3,j =E(cid:26)Θ3,j|(Θl+3,j1()l)Θ|2∗3,j(l)(cid:27),F4,j =E(cid:26)Θ4,j|(Θl+4,j1()lΘ)|2∗4,j(l)(cid:27) [5] C65.0D-6.60T,.STehpat.i,2J0.11L.ee and T. Q. S. Quek, “Physical-layer secret key
generation with colluding untrusted relays,” in IEEETrans. onWireless
Communications, vol.15,no.2,pp.1517-1530, Feb.2016
where F3,j and F4,j denote the measured Doppler values on [6] C. Ye and A. Reznik, “Group secret key generation algorithms,” IEEE
{Θ } and {Θsc }, respectively at Node j for j ∈ {1,3}. ISIT2007,Nice,France, 2007,pp.2596-2600.
3,j 4,j [7] P. Xu, K. Cumanan, Z. Ding, X. Dai and K. K. Leung, “Group secret
These values are empirically computed over L rounds of
key generation in wireless networks: algorithms and rate optimization,”
the protocol. The following decision rule was used on the inIEEETIFS,vol.11,no.8,pp.1831-1846,Aug.2016.
measured Doppler values: [8] H. Liu, J. Yang, Y. Wang, Y. J. Chen and C. E. Koksal, “Group secret
key generation via received signal strength: protocols, achievable rates,
1, if (F <0.94) & (F >0.96) andimplementation,” inIEEETrans.onMobileComputing,vol.13,no.
DETECT= 3,j 4,j 12,pp.2820-2835, Dec.2014.
0, Otherwise.
(cid:26) (16) [9] C.D.T.Thai,J.LeeandT.Q.S.Quek,“Secretgroupkeygenerationin
physical layer for mesh topology,” IEEE GLOBECOM San Diego, CA,
The above decision rule is coined based on the rationale that 2015,pp.1-6.
theDopplermeasurementson{Θsc (l)}and{Θsc (l)}should [10] F. Liu, X. Cheng and D. Chen, “Insider attacker detection in wireless
4,1 4,3 sensor networks,” IEEE INFOCOM 2007, Anchorage, AK, 2007, pp.
be less than (or equal to) that of {Θ (l)} and {Θ (l)},
3,1 3,3 1937-1945.
respectively,inthenoattackcase.ThisisbecausetheDoppler [11] T.Yucek,R.M.A.TanniousandH.Arslan,“Dopplerspreadestimation
spread of the product of two independent channels is lower forwireless OFDM systems,” IEEE/Sarnoff Symposium onAdvances in
WiredandWireless Communication, Princeton, NJ,2005,pp.233-236.
than or equal to that of each channel in the first-order AR
[12] K.E.BaddourandN.C.Beaulieu,“Autoregressivemodelingforfading
model. We noticed that the criterion on average power levels channelsimulation,”inIEEETransactionsonWirelessCommunications,
cannotbeusedtodetectthisattacksincetheattackparameters vol.4,no.4,pp.1650-1662,July2005.
[13] J. J. van de Beek, O. Edfors, M. Sandell, S. K. Wilson and P. O.
make sure that the self-interference is successfully cancelled
Borjesson, “On channel estimation in OFDMsystems,” IEEEVehicular
atbothnodes1and3. ThePD and PFA resultswereobtained Technology Conference, 1995,Chicago, IL,pp.815-819,vol.02.1995,
for the number of protocol rounds L = {100,250,500} [14] J. Wan, A. Lopez, M. A. Al Faruque, “Exploiting Wireless Channel
Randomness to Generate Keys for Automotive Cyber-Physical System
with NMSE values of η = {−20,−30,−40} in dB. The
Security,”ACM/IEEEICCPS’16,Vienna, Austria,April,2016
corresponding values of PD and PFA are plotted in Fig. 3,
whichshowsthatthelow-rateattackcangoundetectedunless
measured over large values of L, along with accurate channel
estimate values. The threshold values on the Doppler spread
