Secret-Key Generation over Reciprocal Fading Channels

Transcription

1 Secret-ey Generation over Reciprocal Fading Channels shish histi Department of Electrical and Computer Engineering University of oronto Nov. 14, 2012

2 Motivation Secret-ey Generation in Wireless Fading Channels m Forward Link y = h x + n m Channel Gain Forward Channel time Nov. 14, / 22

3 Motivation Secret-ey Generation in Wireless Fading Channels m Forward Link y = h x + n y = h x + n Reverse Link m Channel Gain Fading: Reverse Channel Forward Channel y (t) = h (t)x (t)+n (t) Reciprocity: y (t) = h (t)x (t) + n (t) y (t) = h (t)x (t) + n (t) time Nov. 14, / 22

4 Motivation Secret-ey Generation in Wireless Fading Channels m Forward Link y = h x + n y = h x + n Reverse Link m Channel Gain z E = g E x + ne z E = g E x + ne Eavesdropper Link Forward Channel Reverse Channel E Spatial Decorrelation: y (t)= h (t)x (t) + n (t) y (t)= h (t)x (t) + n (t) z (t)= g E (t)x (t) + n E (t) z (t)= g E (t)x (t) + n E (t) time Nov. 14, / 22

5 Secret-ey Generation : Prior Literature Secret-ey Generation in Wireless Systems. Hassan, W. Stark, J. Hershey, and S. Chennakeshu ( 96) UW Systems: Wilson-se-Scholz ( 07), M. o ( 07), Madiseh-Neville-McGuire( 12) Experimental UW: Measurements for ey Generation Madiseh ( 12) Narrowband Systems: zimi Sadjadi- iayias-mercado-yener ( 07), Mathur-rappe-Mandayam -Ye-Reznick ( 10), Patware and asera ( 07) OFDM reciprocity: Haile ( 09), souri and Wulich ( 09) Quantization echniques: Ye-Reznik-Shah ( 07), Hamida-Pierrot-Castelluccia ( 09), Sun-Zhu-Jiang-Zhao ( 11) daptive Channel Probing: Wei-Zheng-Mohapatra ( 10) Unauthenticated Channels, Impersonation ttacks, Spoofing: Mathur et al. ( 10), Xiao-Greenstein-Mandayam-rappe ( 07). Mobility ssisted ey Generation: Zhang-asera-Patwari ( 10), Gungor-Chen-oksal ( 11) ctive Eavesdroppers: Zafer-grawal-Srivatsa Software Radio Implementations: Jana et. al. ( 09) MIMO systems: Wallace and Sharma ( 10), Shimizu et al. Zeng-Wu-Mohapatra Nov. 14, / 22

6 Secret-ey Generation : Prior Literature Information heoretic Secret-ey Generation: Information heoretic Secrecy: Shannon 49 Secret-ey Generation from Correlated Randomness: Maurer ( 93), Csiszar-hlswede ( 93) Strong Secrecy: Csiszar ( 96), Maurer-Wolf ( 00), Watanabe ( 11) Secret-ey Generation over Unauthenticated Channels: Maurer and Wolf ( 03) Multi-terminal Secret-ey Generation: Csiszar-Narayan ( 04) Joint Source-Channel Coding: histi-diggavi-wornell ( 12), Prabhakaran-Eswaran-Ramchandran ( 12) Secret-ey Generation over Channels with State: histi-diggavi-wornell ( 12), histi ( 10), Zibaeenejad ( 12) Secret-ey generation over wo-way channels: hmadi and Safavi-Naini ( 11) Network Coding for Secret-ey greement: Chan ( 11) uthentication based on Secret-ey Generation: Willems and. Ignatenko ( 12) Minimum Rate for Secret-ey Generation: yagi ( 12) Nov. 14, / 22

7 Gap between heory and Practice Observation here exists a disconnect between the Information heoretic Models and Practical Systems for Secret-ey Generation No Information heoretic limits are known! No provably optimal signalling scheme is known. Nov. 14, / 22

8 Problem Setup m Forward Link y = h x + n y = h x + n Reverse Link m z + E = g E x ne z E = g E x + ne E No CSI: h (i) and h (i) g (i) & g (i) known to Eve lock-fading: Coherence Period:. pproximate Reciprocity: (h, h ) p h,h (, ) Independence: (g E, g E ) (h, h ) Channel Gain h h 0 Channel Reciprocity ime Nov. 14, / 22

9 Problem Setup m Forward Link y = h x + n y = h x + n Reverse Link m z + E = g E x ne z E = g E x + ne wo Way Channel: E y (i) = h (i)x (i) + n (i), z E (i) = g (i)x (i) + n E (i), y (i) = h (i)x (i) + n (i) z E (i) = g (i)x (i) + n E (i) Interactive Comm.: x (i) = f (m, y i 1 ), x (i) = f (m, y i 1 ) verage Power Constraint E[ x 2 ] P, E[ x 2 ] P. Nov. 14, / 22

10 Problem Setup m Forward Link y = h x + n m y = h x + n Reverse Link z + E = g E x ne z E = g E x + ne Secret-ey Generation E k = (y N, m ), k = (y N, m ) Reliability: Pr(k k ) ε N Secrecy: I(k ; z N, zn, g N, g N) Nε N Rate R = 1 N H(k ) Secret-ey Capacity. Nov. 14, / 22

11 Secret-ey Capacity Upper ound histi 12 heorem n upper bound on the secret-key capacity is given by: R + 1 I(h ; h )+ max P (h ) P {I(y ; x h, z, g )} + max P (h ) P I(y ; x h, z, g ) where: p x h CN (0, P (h )), p x h CN (0, P (h )). Nov. 14, / 22

12 Secret-ey Capacity Upper ound histi 12 heorem n upper bound on the secret-key capacity is given by: R + 1 I(h ; h )+ max P (h ) P {I(y ; x h, z, g )} + max P (h ) P I(y ; x h, z, g ) where: p x h CN (0, P (h )), p x h CN (0, P (h )). Interpretation of the Upper ound: Channel Reciprocity: 1 I(h ; h ) Forward Channel: I(y ; x h, z, g ) Reverse Channel: I(y ; x h, z, g ) Nov. 14, / 22

13 raining-only Scheme Probe Coherence locks P P P P P P P P P P P P h (i) h ( i 1) ( i 2) h x (i, t) = P y (i) = P h (i) 1 + n(i) ĥ (i): MMSE estimate Estimate ĥ on the forward link; ĥ on the reverse link. Secret-ey Rate: R + = 1 I(ĥ; ĥ) Nov. 14, / 22

14 raining-only Scheme Probe Coherence locks P P P h (i) h ( i 1) ( i 2) h x (i, 1) = P, x (i, t) = 0, i = 1...,, t = 2,...,. y (i) = P h (i) + n(i), i = 1, 2,..., ĥ (i): MMSE estimate Estimate ĥ on the forward link; ĥ on the reverse link. Secret-ey Rate: R + = 1 I(ĥ; ĥ) Nov. 14, / 22

15 Message ransmission Lai-Liang-Poor 12 P1 P1 P1 Message ransmission Message ransmission raining: x (i, 1) = P 1, R = 1 I(ĥ; ĥ) Secure Msg. ransmission: {x (i, 2),..., x (i, )} i=1,2..., ] R M = [log(1 1 E + P 2 (ĥ) ĥ 2 ) log(1 + P 2 (ĥ) g 2 ) he overall rate is NO: R + R M Power llocation in R M leaks ĥ to Eavesdropper Without Power llocation, R M is generally zero. Nov. 14, / 22

16 Proposed Scheme: Randomness Sharing histi 12 P N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) 1 P1 P1 Randomness Sharing Randomness Sharing raining: x (i, 1) = P 1 Randomness Sharing: x (i, t) CN (0, P 2 ) for t = 2,..., x (i) = [x (i, 2),..., x (i, )] C 1. raining: ĥ(i) and ĥ(i) Correlated Sources: Forward Channel: y (i) = h (i)x (i) + n (i) C 1, Reverse Channel: y (i) = h (i)x (i) + n (i) C 1. Nov. 14, / 22

17 Proposed Scheme: Randomness Sharing histi 12 P N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) 1 P1 P1 Randomness Sharing Randomness Sharing E Channel State ĥ ĥ (g, g ) Forward Channel x y z E Reverse Channel y x z E Nov. 14, / 22

18 Proposed Scheme: Randomness Sharing histi 12 P N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) N(0,P 2 ) 1 P1 P1 Randomness Sharing Randomness Sharing E Channel State ĥ ĥ (g, g ) Forward Channel x y z E Reverse Channel y x z E Generate a secret-key from these sequences. Nov. 14, / 22

19 Error Reconciliation Public Discussion Channel, Discrete-Valued Sequences Channel-Sequence Reconciliation ĥ ĥ ĥ ĥ Discussion Channel ĥ hˆ ( hˆ ĥ, hˆ ) Discussion Channel H(φ ) = H(ĥ ĥ), H(φ ) = H(ĥ ĥ) Nov. 14, / 22

20 Error Reconciliation Public Discussion Channel, Discrete-Valued Sequences Channel-Sequence Reconciliation ĥ ĥ ĥ ĥ Discussion Channel ĥ hˆ Source-Sequence Reconciliation ( hˆ ĥ, hˆ ) Discussion Channel y x, hˆ x h ˆ, y Discussion Channel y Common Sequence: ( y y, y, hˆ ) Discussion Channel H(ψ ) H(y x, ĥ, ĥ), H(ψ ) H(y x, ĥ, ĥ) Nov. 14, / 22

21 Equivocation ound Public Messages: {φ, φ, ψ, ψ } Common Sequences: (y, y, ĥ, ĥ ) Equivocation Rate: 1 H(y, y, ĥ, ĥ φ, φ, ψ, ψ, z, g ) Nov. 14, / 22

22 Equivocation ound Equivocation-Rate ound: 1 H(y, y, ĥ, ĥ φ, φ, ψ, ψ, z, g ) 1 { H(y, y, ĥ, ĥ z, z, g, g ) } H(φ ) H(φ ) H(ψ ) H(ψ ) }{{} = 1 { } H(ĥ, ĥ )+H(y, y z, z, g, g, ĥ, ĥ ) 1 { H(y h, z, g ) + H(y h, z, g ) } + H(ĥ, ĥ ) Nov. 14, / 22

23 Equivocation ound 1 H(y, y, ĥ, ĥ φ, φ, ψ, ψ, z, g ) { 1 I(ĥ; ĥ) + 1 [ ] I(y }{{} ; x, ĥ) I(y ; z, g, h ) }{{} raining Forward Channel + 1 [ ] } I(y ; x, ĥ)) I(y ; z, g, h ) = R key }{{} Reverse Channel Nov. 14, / 22

24 Equivocation ound 1 H(y, y, ĥ, ĥ φ, φ, ψ, ψ, z, g ) { 1 I(ĥ; ĥ) + 1 [ ] I(y }{{} ; x, ĥ) I(y ; z, g, h ) }{{} raining Forward Channel + 1 [ ] } I(y ; x, ĥ)) I(y ; z, g, h ) = R key }{{} Reverse Channel R + 1 I(h ; h )+ max P (h ) P {I(y ; x h, z, g )} + max P (h ) P I(y ; x h, z, g ) Nov. 14, / 22

25 High SNR Regime heorem In the high SNR regime our upper and lower bounds coincide: } lim {R + (P ) R PD (P ) c P where [ c =E log (1 + h 2 )] [ g E 2 +E log (1 + h 2 )] g E 2 Nov. 14, / 22

26 Separation Scheme Without Public Discussion (-1) raining Communication ransmission Public Discussion Coherence locks 1 2 Phase Probing + Randomness Sharing Channel-Sequence Reconciliation Source-Sequence Reconciliation Coherence locks ε 1 ε 2 Nov. 14, / 22

27 Error Reconciliation - Channel Sequences ĥ ĥ Quantizer u inning R NC (P) u Wireless Channel ĥ u R NC (P) inning u Quantizer ĥ Wireless Channel Common Sequence: u (u, u ). Rate Constraints: I(u ; ĥ ĥ) ε 1 ( 1)R NC (P ) I(u ; ĥ ĥ) ε 1 ( 1)R NC (P ) Nov. 14, / 22

28 Error Reconciliation - Source Sequences y Quantizer v inning R NC (P) x, u v Wireless Channel x, u v R NC (P) Quantizer v inning y Wireless Channel Rate Constraints: I(v ; y x, u) ε 2 R NC (P ), I(v ; y x, u) ε 2 R NC (P ) Nov. 14, / 22

29 Secret-ey Rate Without Public Discussion R = ε 1 + ε 2 ( 1 R + 1 R F + 1 R ) Nov. 14, / 22

30 Secret-ey Rate Without Public Discussion R = ε 1 + ε 2 ( 1 R + 1 R F + 1 R ) R = I(u ; ĥ) + I(u ; ĥ) I(u ; u ) R F = I(v ; x, u, u ) I(v ; z, g, h ) R = I(v ; x, u, u ) I(v ; z, g, h ) Rate Constraints: I(u ; ĥ ĥ) ε 1 ( 1)R NC (P ) I(u ; ĥ ĥ) ε 1 ( 1)R NC (P ) I(v ; y x, u, u ) ε 2 R NC (P ) I(v ; y x, u, u ) ε 2 R NC (P ) Nov. 14, / 22

31 High SNR Regime heorem In the high SNR regime our upper and lower bounds coincide: { } lim R + (P ) R (P ) c P where [ c =E log (1 + h 2 )] [ g E 2 +E log (1 + h 2 )] g E 2 Nov. 14, / 22

32 Numerical Plot SNR =35 d, h 1, h 2 CN (0, 1), ρ = Lower ound Upper ound Public Discussion raining Rate (nats/symbol) Coherence Period () Nov. 14, / 22

33 Numerical Plot = 10, h 1, h 2 CN (0, 1), ρ = 0.95 Rate (nats/symbol) Lower ound Upper bound Public Discussion raining SNR(d) Nov. 14, / 22

34 Secret-ey Capacity Upper ound histi 12 heorem n upper bound on the secret-key capacity is given by: R + 1 I(h ; h )+ max P (h ) P {I(y ; x h, z, g )} + max P (h ) P I(y ; x h, z, g ) where: p x h CN (0, P (h )), p x h CN (0, P (h )). Nov. 14, / 22

35 Upper ound - Proof Maurer 93 NR I(k ; k ) I(k ; z N, g ) I(k ; k z N, g ) I(m, h N, y N ; m, h N, y N z N, g N ) Nov. 14, / 22

36 Upper ound - Proof Maurer 93 NR I(k ; k ) I(k ; z N, g ) I(k ; k z N, g ) I(m, h N, y N ; m, h N, y N z N, g N ) = I(m, h, N y N 1 ; m, h, N y N 1 z N, g )+ I(y (N); m, h, N y N 1 z N, g, m, h, N y N 1 )+ I(m, h N, y N 1 ; y (N) z N, g, m, h N, y N 1 )+ I(y (N); y (N) z N, g,m, h N, y N 1,m, h N,y N 1 ). Nov. 14, / 22

37 Upper ound - Proof Maurer 93 NR I(k ; k ) I(k ; z N, g ) I(k ; k z N, g ) I(m, h N, y N ; m, h N, y N z N, g N ) = I(m, h, N y N 1 ; m, h, N y N 1 z N, g ) + }{{} I(m,h N N 1,y ;m,h N N 1,y z N 1,g ) I(y (N); m, h, N y N 1 z N, g, m, h, N y N 1 ) + }{{} I(x (N);y (N) z (N),g (N),h (N)) I(y (N); m, h, N y N 1 z N, g, m, h, N y N 1 ) + }{{} I(x (N);y (N) z (N),g (N),h (N)) I(y (N); y (N) z N, g, m, h, N y N 1, m, h, N y N 1 ). }{{} Nov. 14, 2012 =0 21/ 22

38 Upper ound - Proof Maurer 93 NR I(k ; k ) I(k ; z N, g ) I(k ; k z N, g ) I(m, h N, y N ; m, h N, y N z N, g N ) N I(h; N h) N + I(x (i); y (i) z (i), g (i), h (i))+ i=1 N I(x (i); y (i) z (i), g (i), h (i)) i=1 Optimality of Gaussian Inputs, Power Constraints... Nov. 14, / 22

39 Conclusions Secret-ey greement in wo-way fading channels Upper and Lower ounds on Capacity symptotic Optimality Significant Gains over raining ased Schemes Future Work: Improved Upper ounds Stationary Fading Channels Low SNR Regime Stronger Eavesdropper Channels Nov. 14, / 22