Protecting Physical Layer Secret Key Generation from Active Attacks

Abstract

Lightweight session key agreement schemes are expected to play a central role in building Internet of things (IoT) security in sixth-generation (6G) networks. A well-established approach deriving from the physical layer is a secret key generation (SKG) from shared randomness (in the form of wireless fading coefficients). However, although practical, SKG schemes have been shown to be vulnerable to active attacks over the initial “advantage distillation” phase, throughout which estimates of the fading coefficients are obtained at the legitimate users. In fact, by injecting carefully designed signals during this phase, a man-in-the-middle (MiM) attack could manipulate and control part of the reconciled bits and thus render SKG vulnerable to brute force attacks. Alternatively, a denial of service attack can be mounted by a reactive jammer. In this paper, we investigate the impact of injection and jamming attacks during the advantage distillation in a multiple-input–multiple-output (MIMO) system. First, we show that a MiM attack can be mounted as long as the attacker has one extra antenna with respect to the legitimate users, and we propose a pilot randomization scheme that allows the legitimate users to successfully reduce the injection attack to a less harmful jamming attack. Secondly, by taking a game-theoretic approach we evaluate the optimal strategies available to the legitimate users in the presence of reactive jammers.

1. Introduction

The increasing interest in physical layer security (PLS) has been stimulated by many practical needs, particularly in the context of Internet of things (IoT) applications [1]. For example, in [2,3], secret key generation (SKG) from wireless fading coefficients was analyzed, showing its potential as a lightweight alternative to standard security schemes. In fact, the SKG scheme allows two legitimate parties (Alice and Bob) to extract on-the-fly secret keys, without the need for significant infrastructure. Furthermore, it has been information-theoretically proven that by following the SKG process, Alice and Bob can extract a shared secret over unauthenticated channels [4,5,6]. Building on that, numerous practical experiments have demonstrated the feasibility of the scheme [7,8]. Moreover, it has been shown that SKG can be combined with authenticated encryption (AE) schemes [9,10] in order to overcome trivial man-in-the-middle (MiM) attacks, similarly to known MiM attacks on unauthenticated Diffie–Hellman schemes.

The success of the SKG scheme relies on the reciprocity and variability of wireless channels. On the one hand, the reciprocity property allows both Alice and Bob to measure an identical channel impulse response during the coherence time of the channel [11,12,13], while on the other hand, the variability property of the wireless channel directly affects the key generation rates [14,15,16,17].

However, the exchange of pilots during the channel estimation phase between Alice and Bob could allow an adversary (Mallory) to estimate the channels Alice–Mallory and Bob–Mallory. Having this information, Mallory could inject suitably precoded signals during the SKG process and could potentially control a significant part of the reconciled sequence while remaining undetected. To overcome this, instead of transmitting publicly known pilot signals, we propose a two-way randomized pilot transmission between Alice and Bob. An earlier work studied this problem for an orthogonal frequency-division multiplexing (OFDM) system [18]. Here, we investigate the scenario of a multiple-input–multiple-output (MIMO) system. We prove that if Mallory has one extra antenna with respect to Alice and Bob, she could always launch an injection attack. Next, through theoretical analysis, we show that the proposed pilot randomization scheme successfully reduces an injection attack to a less harmful uncorrelated jamming attack, ensuring that the extracted key bits are secret from both active and passive adversaries.

In the second part of this paper, we delve deeper into jamming attacks over MIMO systems. In particular, we focus on denial of service (DoS) in the form of reactive jamming. We derive the optimal strategies for both the attacker and the legitimate users. Through numerical evaluation, we demonstrate that, depending on their capabilities, reactive jammers could provoke legitimate users to transmit at full power in order to achieve a positive SKG rate.

2. System Model

In this work, we consider a time-division duplex MIMO (TDD–MIMO) system consisting of two legitimate nodes and an active adversary, namely, Alice, Bob, and Mallory, respectively. On the one hand, Alice and Bob are generating secret keys using the wireless SKG procedure, while on the other hand, Mallory performs an injection attack on the MIMO links Mallory–Alice and Mallory–Bob. The number of antennas at Alice $N_A$ and Bob $N_B$ are assumed to be equal, i.e., $N_A=N_B=N$. To better illustrate the considered scenario, we give a brief overview of the SKG procedure, and show how an injection attack could affect the process.

2.1. Secret Key Generation from Fading Coefficients

As illustrated in Figure 1, the standard SKG procedure consists of three phases [19]: (1) advantage distillation: the legitimate nodes exchange pilot signals, each using N transmit and N receive antenna elements, in order to estimate their reciprocal channel state information (CSI).

$$\begin{array}{cc}\hfill & {\mathbf{z}}_A=\mathbf{H}\mathbf{x}+{\mathbf{n}}_A\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill & {\mathbf{z}}_B={\mathbf{H}}^T\mathbf{x}+{\mathbf{n}}_B,\hfill \end{array}$$

(2)

where $\mathbf{H}$ represents the channel matrix of size $N_r\times N_t=N\times N$ such that its $(i,j)$ entry represents the channel linking the i-th receive antenna, and the j-th transmit antenna, $\mathbf{z}$ represents the received vector of length $N_r$, $\mathbf{x}$ denotes the transmitted vector consisting of $N_t=N_r=N$ elements, ${\mathbf{n}}_A$ and ${\mathbf{n}}_B$ are the received noise vectors at Alice and Bob, each of length $N_r$, respectively. Note that, due to the reciprocity of the wireless channel, Alice and Bob observe $\mathbf{H}$ and ${\mathbf{H}}^T$, respectively. To conclude this step, ${\mathbf{z}}_A$ and ${\mathbf{z}}_B$ are passed through suitable quantizers [20], generating binary vectors ${\mathbf{r}}_A$ and ${\mathbf{r}}_B$, respectively; (2) information reconciliation: discrepancies, due to imperfect channel estimation in the quantizer local outputs, are reconciled through a public exchange of helper data ${\mathbf{s}}_A$ (see Figure 1), e.g., by using Slepian–Wolf reconciliation techniques [10,21]; (3) privacy amplification: the legitimate nodes apply universal hash functions to the reconciled information ${\mathbf{r}}_A$ and obtain key $\mathbf{k}$. This step ensures that the generated key $\mathbf{k}$ is uniformly distributed and completely unpredictable by an adversary.

During the process above, an eavesdropping adversary could obtain channel observations, given as follows:

$$\begin{array}{cc}\hfill & {\mathbf{z}}_{AM}={\mathbf{H}}_{AM}\mathbf{x}+{\mathbf{n}}_{AM},\hfill \end{array}$$

(3)

$$\begin{array}{cc}\hfill & {\mathbf{z}}_{BM}={\mathbf{H}}_{BM}\mathbf{x}+{\mathbf{n}}_{BM},\hfill \end{array}$$

(4)

where the channel matrices in the links Alice–Mallory and Bob–Mallory are denoted by ${\mathbf{H}}_{AM}$ and by ${\mathbf{H}}_{BM}$, respectively, while the received noise vectors are demoted by ${\mathbf{n}}_{AM}$ and ${\mathbf{n}}_{BM}$. Afterward, the SKG capacity between Alice and Bob is expressed as the conditional mutual information between the observations of Alice, Bob, and Mallory.

$$I({\mathbf{z}}_A;{\mathbf{z}}_B|{\mathbf{z}}_{AM},{\mathbf{z}}_{BM}).$$

(5)

2.2. Injection Attacks during SKG

One of the most critical threats to the SKG model, given in Figure 1, is MiM in the form of an injection attack [11,22,23]. The main components of the injection attack are captured in Figure 2. While, the legitimate nodes Alice and Bob exchange pilot signals during the advantage distillation phase, Mallory injects signals $\mathbf{p}$. Based on the results in [22], we assume that Mallory has perfect knowledge of the channel vectors in the MIMO links Mallory–Alice, ${\mathbf{H}}_{MA}={\mathbf{H}}_{AM}^T$ and Mallory–Bob, ${\mathbf{H}}_{MB}={\mathbf{H}}_{BM}^T$. This is a reasonable assumption since Mallory can estimate the channel vectors while Alice and Bob exchange pilot signals, as long as the channel’s coherence time is respected (a plausible scenario in slow-fading, low-mobility environments). Finally, Mallory chooses the vector $\mathbf{p}$ such that the same signal is “injected“ at both Alice and Bob, i.e., ${\mathbf{H}}_{MA}\mathbf{p}={\mathbf{H}}_{MB}\mathbf{p}$.

3. Analysis of Injection Attacks in MIMO SKG

In this section, we first prove that if Mallory has one extra antenna, with respect to Alice and Bob, she could always launch an injection attack. Next, we propose a pilot randomization scheme and show that when employed, legitimate users could successfully reduce the attack to a jamming attack.

Lemma 1.

While Alice and Bob perform advantage distillation using N antennas, Mallory could always launch an injection attack, as long as she has at least $N+1$ antennas.

Proof. 

The precoding vector of Mallory $\mathbf{p}$ of size $(N+1)\times 1$ is represented as

$$\mathbf{p}=\left[\begin{array}{c}{p}_1\\ ⋮\\ p_{N+1}\end{array}\right].$$

(6)

The channel matrices ${\mathbf{H}}_{MA}$ and ${\mathbf{H}}_{MB}$ have size $N\times (N+1)$, such that

$${\mathbf{H}}_{MA}=\left[\begin{array}{ccc}{H}_{{MA}_{1,1}}& \cdots & H_{{MA}_{1,N+1}}\\ ⋮& \cdots & ⋮\\ H_{{MA}_{N,1}}& \cdots & H_{{MA}_{N,N+1}}\end{array}\right],$$

(7)

and

$${\mathbf{H}}_{MB}=\left[\begin{array}{ccc}{H}_{{MB}_{1,1}}& \cdots & H_{{MB}_{1,N+1}}\\ ⋮& \cdots & ⋮\\ H_{{MB}_{N,1}}& \cdots & H_{{MB}_{N,N+1}}\end{array}\right].$$

(8)

Next, we can represent the equation

$${\mathbf{H}}_{MA}\mathbf{p}={\mathbf{H}}_{MB}\mathbf{p},$$

(9)

as

$$({\mathbf{H}}_{MA}-{\mathbf{H}}_{MB})\mathbf{p}=0,$$

(10)

where ${\mathbf{H}}_M={\mathbf{H}}_{MA}-{\mathbf{H}}_{MB}$ is equal to:

$${\mathbf{H}}_M=\left[\begin{array}{ccc}{H}_{M{A}_{1,1}}-H_{M{B}_{1,1}}& \cdots & H_{M{A}_{1,N+1}}-H_{M{B}_{1,N+1}}\\ ⋮& \cdots & ⋮\\ H_{M{A}_{N,1}}-H_{M{B}_{N,1}}& \cdots & H_{M{A}_{N,N+1}}-H_{M{B}_{N,N+1}}\end{array}\right].$$

(11)

Given the above, Equation (10) can be rewritten as ${\mathbf{H}}_{\mathbf{M}}\mathbf{p}=0$, where ${\mathbf{H}}_{\mathbf{M}}$ is given in Equation (11). The equality ${\mathbf{H}}_{\mathbf{M}}\mathbf{p}=0$ is equivalent to solving the following linear system of equations:

$$\left\{\begin{array}{ccc}{H}_{M_{1,1}}{p}_1+H_{M_{1,2}}{p}_2+\cdots +H_{M_{1,N+1}}{p}_{N+1}\hfill & =& 0\hfill \\ ⋮\hfill \\ H_{M_{N,1}}{p}_1+H_{M_{N,2}}{p}_2+\cdots +H_{M_{N,N+1}}{p}_{N+1}\hfill & =& 0.\hfill \end{array}\right.$$

(12)

Due to the fact that Mallory has an additional degree of freedom (one extra antenna), as compared to Alice and Bob, she can treat one of the elements in $\mathbf{p}$ as a constant and solve for the others in terms of it. Based on this, we let $p_{N+1}$ be a constant and rewrite the system in (12) as

$$\left\{\begin{array}{ccc}{H}_{M_{1,1}}{p}_1+H_{M_{1,2}}{p}_2+\cdots +H_{M_{1,N}}{p}_N\hfill & =& -H_{M_{1,N+1}}{p}_{N+1}\hfill \\ ⋮\hfill \\ H_{M_{N,1}}{p}_1+H_{M_{N,2}}{p}_2+\cdots +H_{M_{N,N}}{p}_N\hfill & =& -H_{M_{N,N+1}}{p}_{N+1}.\hfill \end{array}\right.$$

(13)

The system of equations in (13) can be represented as $\mathbf{A}\mathbf{x}=\mathbf{b}$, where the $N\times N$ matrix $\mathbf{A}$ is the $N\times N$ matrix containing the first N lines and N columns of ${\mathbf{H}}_M$, $\mathbf{x}={(p_1,p_2,\cdots ,p_N)}^T$, and $\mathbf{b}$ contains the right-hand side of the system, i.e., $\mathbf{b}={(-H_{M_{1,N+1}}{p}_{N+1},\cdots ,-H_{M_{N,N+1}}{p}_{N+1})}^T$. Finally, since $\det \left(\mathbf{A}\right)\ne 0$ almost surely, (i.e., under the assumptions in Section 2, $\det \left(\mathbf{A}\right)$ is a continuous random variable, hence $\det \left(\mathbf{A}\right)\ne 0$ with probability 1) and therefore the system’s solution is unique and given by

$${(p_1,p_2,\cdots ,p_N)}^T={\mathbf{A}}^{-1}\mathbf{b}.$$

(14)

Note that if Mallory has the same number of antennas as Alice and Bob, she will not have one extra degree of freedom and the transition from the system in Equation (12) to the system in Equation (13) would not be possible. However, as shown here, if Mallory has one extra antenna, with respect to Alice and Bob, she can treat one of the elements in $\mathbf{p}$ as constant, which allows her to find the rest of the elements as in Equation (14). This concludes the proof of Lemma 1. □

Based on Lemma 1, the observations of Alice and Bob are now given by

$$\begin{array}{c}\hfill {\mathbf{z}}_A=\mathbf{H}\mathbf{x}+\mathbf{w}+{\mathbf{n}}_A\end{array}$$

(15)

$$\begin{array}{c}\hfill {\mathbf{z}}_B={\mathbf{H}}^T\mathbf{x}+\mathbf{w}+{\mathbf{n}}_B,\end{array}$$

(16)

where $\mathbf{w}={\mathbf{H}}_{MA}\mathbf{p}={\mathbf{H}}_{MB}\mathbf{p}$ denotes the observed injected signals at Alice and Bob, which are identical due to the precoding vector $\mathbf{p}$. By injecting $\mathbf{w}$, Mallory controls the secret key rate, which is now upper bounded by [18,24]

$$L\le I({\mathbf{z}}_A,{\mathbf{z}}_B;\mathbf{w}).$$

(17)

Pilot Randomization as a Countermeasure to Injection Attacks

It has been shown that a countermeasure to injection attacks can be built by randomizing the pilot sequence exchanged between Alice and Bob [18,23,24]. In this work, we propose a MIMO pilot randomization scheme in which pilots are drawn from a (scaled) QPSK modulation. Specifically, Alice and Bob do not transmit the same pilot signal $\mathbf{x}$; instead, they transmit independent, random pilot signals $\mathbf{x}$ and $\mathbf{y}$ drawn from i.i.d. zero-mean discrete uniform distributions in which the individual elements of the vectors have probability mass functions as $\mathcal{U}\left(\right\{\pm r\pm jr\},\cdots ,\{\pm r\pm jr\left\}\right),\mathrm{where}j=\sqrt{-1},r=\sqrt{P/2}$, so that $\mathbb{E}\left[\mathbf{x}\right]=\mathbb{E}\left[\mathbf{y}\right]={(0,\cdots ,0)}^T$, ${(\mathbb{E}\left[|x_1{|}^2\right],\cdots ,\mathbb{E}\left[|x_N{|}^2\right])}^T={(\mathbb{E}\left[|y_1{|}^2\right],\cdots ,\mathbb{E}\left[|y_N{|}^2\right])}^T={(P,\cdots ,P)}^T$ and ${(\mathbb{E}\left[x_1{y}_1\right],\cdots ,\mathbb{E}\left[x_N{y}_N\right])}^T={(0,\cdots ,0)}^T$, i.e., the pilots are randomly chosen QPSK signals. Given that Alice’s and Bob’s observation ${\mathbf{z}}_A$ and ${\mathbf{z}}_B$ are modified as

$$\begin{array}{cc}\hfill & {\mathbf{z}}_A=\mathbf{H}\mathbf{y}+\mathbf{w}+{\mathbf{n}}_A,\hfill \end{array}$$

(18)

$$\begin{array}{cc}\hfill & {\mathbf{z}}_B={\mathbf{H}}^T\mathbf{x}+\mathbf{w}+{\mathbf{n}}_B.\hfill \end{array}$$

(19)

Finally, to generate shared randomness, Alice and Bob post-multiply ${\mathbf{z}}_A$ and ${\mathbf{z}}_B$ by their own randomized pilot signals, such as ${\tilde{z}}_A={\mathbf{x}}^T{\mathbf{z}}_A$ and ${\tilde{z}}_B={\mathbf{y}}^T{\mathbf{z}}_B$ (unobservable by Mallory). Given this, the modified observations are expressed as

$$\begin{array}{ccc}\hfill {\tilde{z}}_A& =& {\mathbf{x}}^T\mathbf{H}\mathbf{y}+{\mathbf{x}}^T\mathbf{w}+{\mathbf{x}}^T{\mathbf{n}}_A,\hfill \end{array}$$

(20)

$$\begin{array}{ccc}\hfill {\tilde{z}}_B& =& {\mathbf{y}}^T{\mathbf{H}}^T\mathbf{x}+{\mathbf{y}}^T\mathbf{w}+{\mathbf{y}}^T{\mathbf{n}}_B,\hfill \end{array}$$

(21)

where the shared randomness between Alice and Bob is now represented by ${\mathbf{x}}^T\mathbf{H}\mathbf{y}=\mathbf{x}{\mathbf{H}}^T{\mathbf{y}}^T$. Furthermore, the independence of $\mathbf{x}$ and $\mathbf{y}$ ensures the following:

$$L\le I\left({\tilde{z}}_A,{\tilde{z}}_B;\mathbf{w}\right)=0.$$

(22)

4. Jamming Attacks on SKG

In this section, we focus on reactive jamming attacks in SKG systems and examine the scenario in which Mallory reactively jams Alice (note that the scenario in which Mallory jams Bob is identical). A reactive jamming attack is an intelligent approach in which the jammer initially senses the spectrum and jams only if a transmission is detected. Due to the difficulty to be detected, reactive jamming attacks are considered to be a great threat to legitimate transmission [25,26]. Next, we assume that Alice and Bob perform SKG in a TDD–MIMO system with a spatially uncorrelated channel. It has been proven that the optimal power strategy for Alice and Bob in this scenario is to employ equal power distribution [27], which is also assumed for this study, i.e.,

$${\left(\mathbb{E}\left[|x_1{|}^2\right],\cdots ,\mathbb{E}\left[|x_N{|}^2\right]\right)}^T={(p,\cdots ,p)}^T\mathrm{with}p\in [0,P].$$

(23)

In the following, we assume that Mallory has N antennas, and as a reactive jammer, she senses the spectrum and jams in the link Mallory–Alice only if she detects a power greater than a certain threshold $p_{\mathit{th}}$. Thus, instead of considering Mallory’s power allocation matrix, we work with the sum jamming power for all antennas, which can be represented as a power allocation vector $\underline{\mathbf{\gamma }}=({\gamma }_1,\cdots ,{\gamma }_N)$. By denoting the available jamming power by $N\Gamma$, the following short-term power constraint is considered:

$$\underline{\mathbf{\gamma }}\in {\mathbb{R}}_{+}^N,\sum _{i=1}^N{\gamma }_i\le N\Gamma .$$

(24)

Assuming that $\mathbf{H}$ is uncorrelated with ${\mathbf{H}}_{AM},{\mathbf{H}}_{BM}$ and that all channel matrices have independent and identically distributed elements that are drawn from circularly symmetric zero-mean Gaussian distributions of variances ${\sigma }^2$ and ${\sigma }_J^2$, respectively, then the SKG capacity can be expressed as [27]

$$C_K(p,\underline{\mathbf{\gamma }})=N\sum _{i=1}^{N}log\left(1+\frac{p{\sigma }^2}{2(1+{\gamma }_i{\sigma }_J^2)+\frac{{(1+{\gamma }_i{\sigma }_J^2)}^2}{p{\sigma }^2}}\right).$$

(25)

4.1. Optimal Power Allocation Strategies

In the following, we take a game-theoretic approach in order to evaluate the optimal strategies of Alice, Bob and Mallory. Throughout the following Alice and Bob’s common objective is to maximize $C_K(p,\underline{\mathbf{\gamma }})$ with respect to (w.r.t.) p, while Mallory wants to minimize $C_K(p,\underline{\mathbf{\gamma }})$ w.r.t. $\underline{\mathbf{\gamma }}$. Due to the reversed objectives, we formulated a noncooperative zero-sum game, which studies the strategic interaction between the legitimate users and the jammer: $\mathcal{G}=(\{L,J\},\{{\mathcal{A}}_{\mathrm{L}},{\mathcal{A}}_{\mathrm{J}}\left(p\right)\},C_K(p,\underline{\mathbf{\gamma }}))$. The game $\mathcal{G}$ has three components: (i) there are two players, namely, L, denoting the legitimate users (Alice and Bob act as a single player), and J being the jammer (Mallory); (ii) player L has a set of possible actions ${\mathcal{A}}_L=[0,P]$, while player J’s set of actions is

$${\mathcal{A}}_J\left(p\right)=\left\{\begin{array}{cc}\left\{\right(0,\cdots ,0\left)\right\},\hfill & \mathrm{if}p\le p_{\mathit{th}},\hfill \\ \left\{\underline{\mathbf{\gamma }}\in {\mathbb{R}}_{+}^N|\sum _{i=1}^N{\gamma }_i\le N\Gamma \right\},\hfill & \mathrm{if}p>p_{\mathit{th}}.\hfill \end{array}\right.$$

(26)

Lastly, $C_K(p,\underline{\mathbf{\gamma }})$ denotes the payoff function of player L.

Given the fact that player J is a reactive jammer, i.e, first observes the transmit power of player L and subsequently chooses a strategy, we study a hierarchical game in which player L is the leader, and player J is the follower. In this game, the solution is the Stackelberg equilibrium (SE)—rather than Nash—and it is defined as a strategy profile $(p^{\mathrm{SE}},{\underline{\mathbf{\gamma }}}^{\mathrm{SE}})$ where player L chooses their optimal strategy first, by anticipating the strategic reaction of player J (i.e., its best response). This is expressed as:

$$\begin{array}{cc}\hfill & p^{\mathrm{SE}}\triangleq \underset{p\in {\mathcal{A}}_L}{argmax}{C}_K(p,{\underline{\mathbf{\gamma }}}^{*}\left(p\right)),\mathrm{and}{\underline{\mathbf{\gamma }}}^{\mathrm{SE}}\triangleq {\underline{\mathbf{\gamma }}}^{*}\left(p^{\mathrm{SE}}\right),\hfill \end{array}$$

(27)

where ${\underline{\mathbf{\gamma }}}^{*}\left(p\right)$ defines the best response (BR) of player J to any strategy $p\in {\mathcal{A}}_L$ chosen by player L, and it is defined as follows:

$${\underline{\mathbf{\gamma }}}^{*}\left(p\right)\triangleq \underset{\underline{\mathbf{\gamma }}\in {\mathcal{A}}_J\left(p\right)}{argmin}{C}_K(p,\underline{\mathbf{\gamma }}).$$

(28)

Finally, based on the detection capabilities at player L, two scenarios are considered: (i) when the detection threshold $p_{\mathit{th}}$ is fixed (defined by the sensing capability of Mallory’s receiver); (ii) when $p_{\mathit{th}}$ is part of player L’s strategy and could vary.

4.2. Stackelberg Equilibrium with Fixed Detection Threshold

In this section, we evaluate SE, when player J’s detection threshold $p_{\mathit{th}}$ is predefined and constant. Note that the case $P\le p_{\mathit{th}}$ is trivial as ${\underline{\mathbf{\gamma }}}^{\mathrm{SE}}=(0,\cdots ,0)$, and the legitimate users will optimally use their maximum available power, i.e., $(p^{\mathrm{SE}}=P)$. Indeed, due to the poorly chosen threshold $p_{\mathit{th}}$ or low sensing capabilities of Mallory, the legitimate transmission will not be detected and therefore will not be jammed. In the following, we assume that $P>p_{\mathit{th}}$.

Lemma 2.

The BR of player J for any $p\in {\mathcal{A}}_L$ chosen by player L defined in (28) is the uniform power allocation, given as

$${\underline{\mathbf{\gamma }}}^{*}\left(p\right)\triangleq \left\{\begin{array}{cc}(\Gamma ,\cdots ,\Gamma ),\hfill & ifp>p_{\mathit{th}},\hfill \\ (0,\cdots ,0),\hfill & ifp\le p_{\mathit{th}}.\hfill \end{array}\right.$$

(29)

Proof. 

Note that $C_K(p,{\gamma }_i)$ is a monotonically decreasing convex function w.r.t ${\gamma }_i,i=1,\dots ,N$ for any $p>0$. Based on the principles of convexity in order to minimize $C_K$, Mallory has to transmit with full power from all antennas. The detailed proof can be found in [18]. □

Based on the result from Lemma 1, the SKG rate can have the following two forms:

$$C_K(p,{\underline{\mathbf{\gamma }}}^{*}\left(p\right))=\left\{\begin{array}{cc}{C}_K(p,(0,\cdots ,0)),\hfill & \mathrm{if}p\le p_{\mathit{th}},\hfill \\ C_K(p,(\Gamma ,\cdots ,\Gamma )),\hfill & \mathrm{if}p>p_{\mathit{th}},\hfill \end{array}\right.$$

(30)

which simplifies the players’ options.

Theorem 1.

Depending on their available power P for SKG, Alice and Bob will either transmit at P or $p_{\mathit{th}}$. The SE point of the game is unique when $P\ne p_{\mathit{th}}(\Gamma {\sigma }_J^2+1)$ and is given by

$$(p^{\mathrm{SE}},{\underline{\mathbf{\gamma }}}^{\mathrm{SE}})=\left\{\begin{array}{cc}\left\{(p_{\mathit{th}},(0,\cdots ,0))\right\},\hfill & \mathit{if}P<p_{\mathit{th}}({\sigma }_J^2\Gamma +1),\hfill \\ \left\{\right(P,(\Gamma ,\cdots ,\Gamma )\left)\right\},\hfill & \mathit{if}P>p_{\mathit{th}}({\sigma }_J^2\Gamma +1).\hfill \end{array}\right.$$

(31)

When $P=p_{\mathit{th}}({\sigma }_J^2\Gamma +1)$, the game $\mathcal{G}$ has two SEs: $(p^{\mathrm{SE}},{\underline{\mathbf{\gamma }}}^{\mathrm{SE}})\in \{(p_{\mathit{th}},(0,\cdots ,0)),(P,(\Gamma ,\cdots ,\Gamma ))\}$.

Proof. 

Given the BR of player J defined in (29), the legitimate users want to identify their optimal $p\in {\mathcal{A}}_L$ that maximizes

$$C_K(p,{\underline{\mathbf{\gamma }}}^{*}\left(p\right))=\left\{\begin{array}{cc}{C}_K(p,(0,\cdots ,0)),\hfill & \mathrm{if}p\le p_{\mathit{th}},\hfill \\ C_K(p,(\Gamma ,\cdots ,\Gamma )),\hfill & \mathrm{if}p>p_{\mathit{th}},\hfill \end{array}\right.$$

(32)

Given the fact that $C_K(p,\underline{\mathbf{\gamma }})$ is monotonically increasing with p for fixed $\underline{\mathbf{\gamma }}$, two cases are distinguished: (a) $p\in [0,p_{\mathit{th}}]$, (b) $p\in (p_{\mathit{th}},P]$. The optimal p in each case is given by

(a) $\underset{p\in [0,p_{\mathit{th}}]}{argmax}{C}_K(p,{\underline{\mathbf{\gamma }}}^{*}\left(p\right))=\underset{p\in [0,p_{\mathit{th}}]}{argmax}{C}_K(p,(0,\cdots ,0)=p_{\mathit{th}},$

(b) $\underset{p\in (p_{\mathit{th}},P]}{argmax}{C}_K(p,{\underline{\mathbf{\gamma }}}^{*}\left(p\right))=\underset{p\in (p_{\mathit{th}},P]}{argmax}{C}_K(p,(\Gamma ,\cdots ,\Gamma )=P.$

From (a) and (b), it can be concluded that the overall solution is $p^{\mathrm{SE}}=$

$$\underset{p\in {\mathcal{A}}_L}{argmax}{C}_K(p,{\underline{\mathbf{\gamma }}}^{*}\left(p\right))=\left\{\begin{array}{cc}{p}_{\mathit{th}},\hfill & \mathrm{if}{C}_K(P,\Gamma )<C_K(p_{\mathit{th}},0),\hfill \\ P,\hfill & \mathrm{if}{C}_K(P,\Gamma )>C_K(p_{\mathit{th}},0),\hfill \\ \{p_{\mathit{th}},P\},\hfill & \mathrm{if}{C}_K(P,\Gamma )=C_K(p_{\mathit{th}},0).\hfill \end{array}\right.$$

To simplify the above possibilities, we focus on the case when the utility function $C_K(P,\Gamma )$, i.e., being detected and jammed, equals the utility function when player L is transmitting at threshold $p_{\mathit{th}}$ (player J is silent), i.e., $C_K(P,\Gamma )=C_K(p_{\mathit{th}},0)$. Using this equality, by substituting appropriately into (25), we obtain a quadratic equation in P.

$$P^2(2{\sigma }^2{p}_{\mathit{th}}+1)-P(2{p_{\mathit{th}}}^2{\sigma }^2+2{\sigma }_J^2\Gamma {p_{\mathit{th}}}^2{\sigma }^2)-{(1+{\sigma }_J^2\Gamma )}^2{p_{\mathit{th}}}^2=0.$$

Note that Equation (33) has a unique positive root equal to $p_{\mathit{th}}({\sigma }_J^2\Gamma +1)$. Furthermore, due to the fact that the leading coefficient of (33): $(2{\sigma }^2{p}_{\mathit{th}}+1)\ge 0$ and $P>0$, we can state that the inequalities $C_K(P,\Gamma )>C_K(p_{\mathit{th}},0)$ and $C_K(P,\Gamma )<C_K(p_{\mathit{th}},0)$ are equivalent to $P>p_{\mathit{th}}({\sigma }_J^2\Gamma +1)$ and $P<p_{\mathit{th}}({\sigma }_J^2\Gamma +1)$, respectively. □

A numerical evaluation of the SKG rate is presented in Figure 3. The parameters used are $N=10$, $p_{\mathit{th}}=2$, $\Gamma =3$, and ${\sigma }^2={\sigma }_J^2=1$. Figure 3 compares the achievable SKG rates of the SE strategy, i.e., $p=p^{SE}$ with the two alternative strategies, i.e., $p=P$ or $p=p_{\mathit{th}}$. It can be seen that if player L deviates from the SE point the achievable SKG rate can decrease by up to $40\%$.

4.3. Stackelberg Equilibrium with Strategic $p_{\mathit{th}}$

Finally, we investigate the case when Mallory could optimally adjust $p_{\mathit{th}}$ and show how her choice impacts Alice’s and Bob’s strategies. Allowing $p_{\mathit{th}}$ to vary modifies the game under study as follows $\widehat{\mathcal{G}}=(\{L,J\},\{{\mathcal{A}}_L,{\widehat{\mathcal{A}}}_J\left(p\right)\},C_K(p,\underline{\mathbf{\gamma }},p_{\mathit{th}}))$, where

$${\widehat{\mathcal{A}}}_J\left(p\right)\triangleq \left\{\begin{array}{cc}\{((0,\cdots ,0),p_{\mathit{th}}),p_{\mathit{th}}\ge 0\},\hfill & \mathrm{if}{p}_{\mathit{th}}\ge p,\hfill \\ \left\{(\underline{\mathbf{\gamma }},p_{\mathit{th}})\in {\mathbb{R}}_{+}^N|\sum _{i=1}^N{\gamma }_i\le N\Gamma \right\},\hfill & \mathrm{if}{p}_{\mathit{th}}<p.\hfill \end{array}\right.$$

(33)

The BR of the jammer can then be defined as

$$({\widehat{\underline{\mathbf{\gamma }}}}^{*}\left(p\right),{\widehat{p_{\mathit{th}}}}^{*}\left(p\right))\triangleq \underset{(\underline{\mathbf{\gamma }},p_{\mathit{th}})\in {\widehat{\mathcal{A}}}_J\left(p\right)}{argmin}{C}_K(p,\underline{\mathbf{\gamma }},p_{\mathit{th}}).$$

(34)

Lemma 3.

Mallory’s BR in this scenario is a set of strategies as follows:

$$\begin{array}{c}\hfill ({\widehat{\underline{\mathbf{\gamma }}}}^{*}\left(p\right),{\widehat{p_{\mathit{th}}}}^{*}\left(p\right))\in \{\left((\Gamma ,\cdots ,\Gamma )ϵ\right),ϵ\in [0,p)\}.\end{array}$$

(35)

Proof. 

The problem that the jammer wants to solve is $\underset{(\underline{\mathbf{\gamma }},p_{\mathit{th}})\in {\widehat{\mathcal{A}}}_J\left(p\right)}{\min }{C}_K(p,\underline{\mathbf{\gamma }},p_{\mathit{th}}),$ which can be split as follows:

$$\begin{array}{c}\hfill \underset{p_{\mathit{th}}\ge 0}{\min }\underset{\underline{\mathbf{\gamma }}\in {\widehat{\mathcal{A}}}_J\left(p\right)}{\min }{C}_K(p,\underline{\mathbf{\gamma }}\left(p\right),p_{\mathit{th}}).\end{array}$$

(36)

The solution of the inner minimization is known from (29). For the outer problem, we have to find the optimal $p_{\mathit{th}}\ge 0$ that minimizes $C_K(p,{\widehat{\underline{\mathbf{\gamma }}}}^{*}\left(p\right),p_{\mathit{th}})$. Given that

$$\underset{p_{\mathit{th}}\ge 0}{\min }{C}_K(p,{\widehat{\underline{\mathbf{\gamma }}}}^{*}\left(p\right),p_{\mathit{th}})=\left\{\begin{array}{cc}{C}_K(p,\Gamma ,p_{\mathit{th}}),\hfill & \mathrm{if}{p}_{\mathit{th}}<p,\hfill \\ C_K(p,0,p_{\mathit{th}}),\hfill & \mathrm{if}{p}_{\mathit{th}}\ge p,\hfill \end{array}\right.$$

(37)

and that $C_K(p,\Gamma ,p_{\mathit{th}})<C_K(p,0,p_{\mathit{th}})$, player J can optimally choose any $p_{\mathit{th}}$ such that $p_{\mathit{th}}=ϵ,\forall ϵ<p$. This allows the jammer to detect any ongoing transmission and to perform a jamming attack. □

Theorem 2.

The game $\widehat{\mathcal{G}}$ has an infinite number of SEs as follows:

$$({\widehat{p}}^{\mathrm{SE}},{\widehat{\underline{\mathbf{\gamma }}}}^{\mathrm{SE}},{\widehat{p_{\mathit{th}}}}^{\mathrm{SE}})\in \{(P,(\Gamma ,\cdots ,\Gamma )ϵ),\forall ϵ<P\}.$$

(38)

Proof. 

Given Mallory’s BR, we evaluate the SE of the game $\widehat{\mathcal{G}}$. The definition for ${\widehat{p}}^{\mathrm{SE}}$ is given as follows:

$${\widehat{p}}^{\mathrm{SE}}\triangleq \underset{p\in {\mathcal{A}}_L}{arg}max{C}_K(p,{\widehat{\underline{\mathbf{\gamma }}}}^{*}\left(p\right),\widehat{p_{\mathit{th}}}{\left(p\right)}^{*}).$$

(39)

Since Mallory will act as in (35), we have

$$C_K(p,{\widehat{\underline{\mathbf{\gamma }}}}^{*}\left(p\right),\widehat{p_{\mathit{th}}}{\left(p\right)}^{*})=C_K(p,\Gamma ,ϵ),\forall ϵ<p,$$

(40)

and the fact that $C_K(p,\Gamma ,ϵ)$ is monotonically increasing with p results in ${\widehat{p}}^{\mathrm{SE}}=P$. □

Figure 4 illustrates the achievable SKG rate when $p_{\mathit{th}}$ is part of player J’s strategy. As in Figure 3, the parameters are chosen as $\Gamma =3$, $N=10$ and ${\sigma }_J^2=1$. It can be seen that due to a strategically chosen threshold from player J the legitimate users have no other choice but to transmit at full power $p=P=p^{\mathrm{SE}}$. In fact, if the legitimate users deviate from the SE strategy and transmit with low power $p=p_{\mathit{th}}$, player J could successfully disrupt their SKG process and decrease their achievable SKG rate by up to $97\%$.

5. Conclusions

In this study, injection and reactive jamming attacks were analyzed in MIMO SKG systems. With respect to injection attacks, the study demonstrated that a trivial advantage in the form of one extra antenna allows a MiM to mount such an attack. As a countermeasure, we showed that a pilot randomization scheme can successfully reduce injection attacks to jamming attacks. With respect to jamming attacks, using a game-theoretic approach, we showed that an intelligent reactive jammer should optimally jam with full power when a transmission is sensed. Finally, by strategically choosing her jamming threshold, i.e., just below the power level used by the legitimate users, Mallory could perform a much more effective attack. In fact, our theoretical analysis suggests that in this case, Alice and Bob have no choice but to use their full power available for SKG. An important topic for further research in this area is an examination of these initial findings in practical scenarios.