Search

Traditional approaches for providing confidentiality of wirelessly transmitted signals are often based on cryptographic techniques. While these techniques ensure that messages are encrypted and secured against eavesdropping, they are not sufficient to protect important transmission attributes at the physical (PHY) layer. Specifically, several elds in the headers of PHY and medium access control (MAC) frames are typically sent unencrypted to maintain proper protocol functionality (e.g., sender/receiver identification). As a result, they leak side-channel information (SCI), including payload size, frequency and phase oset, modulation and coding scheme, identities of communication nodes, frame type, transmission rate, etc. These SCI can be exploited by an adversary to launch various passive (eavesdropping) and active (jamming) attacks. To complement cryptographic techniques used at upper layers and prevent the leakage of SCI at the PHY/MAC layers, PHY-layer security techniques have been introduced. These techniques exploit the characteristics of the wireless channel along with multiple-input multiple-output (MIMO) technologies, in which multiple transmitting and receiving antennas are utilized to prevent information leakage to eavesdroppers and/or avoid jamming attacks. In particular, if the signal-to-interference-plus-noise ratio (SINR) at an adversary is lower than the one at a legitimate receiver, secure communication can be achieved through the so-called wiretap coding. MIMO systems enable the transmitter and/or the receiver to generate artificial noise, called friendly jamming (FJ), so as to reduce the SINR at the adversary without impacting the SINR at the legitimate receiver. In this dissertation, we focus on exploring the security threats to next-generation wireless systems. We develop MIMO-based PHY-layer security methods to achieve reliable and secret communications in these systems. First, we consider a broadcast channel, in which a multi-antenna transmitter

We consider a single-cell massive MIMO system in which a base station (BS) with a large number of antennas transmits simultaneously to several single-antenna users in the presence of an attacker.The BS acquires the channel state information (CSI) based on uplink pilot transmissions. In this work, we demonstrate the vulnerability of CSI estimation phase to malicious attacks. For that purpose, we study two attack models. In the first model, the attacker aims at minimizing the sum-rate of downlink transmissions by contaminating the uplink pilots. In the second model, the attacker exploits its in-band full-duplex capabilities to generate jamming signals in both the CSI estimation and data transmission phases. We study these attacks under two downlink power allocation strategies when the attacker knows and does not know the locations of the BS and users. The formulated problems are solved using stochastic optimization, Lagrangian minimization, and game-theoretic methods. A closed-form solution for a special case of the problem is obtained. Furthermore, we analyze the achievable individual secrecy rates under a pilot contamination attack, and provide an upper bound on these rates. Our results indicate that the proposed attacks degrade the throughput of a massive MIMO system by more than half.

We consider a broadcast channel, in which a multi-antenna transmitter (Alice) sends $K$ confidential information signals to $K$ legitimate users (Bobs) in the presence of $L$ eavesdroppers (Eves). Alice uses MIMO precoding to generate the information signals along with her own (Tx-based) friendly jamming. Interference at each Bob is removed by MIMO zero-forcing. This, however, leaves a "vulnerability region" around each Bob, which can be exploited by a nearby Eve. We address this problem by augmenting Tx-based friendly jamming (TxFJ) with Rx-based friendly jamming (RxFJ), generated by each Bob. Specifically, each Bob uses self-interference suppression (SIS) to transmit a friendly jamming signal while simultaneously receiving an information signal over the same channel. We minimize the powers allocated to the information, TxFJ, and RxFJ signals under given guarantees on the individual secrecy rate for each Bob. The problem is solved for the cases when the eavesdropper's channel state information is known/unknown. Simulations show the effectiveness of the proposed solution. Furthermore, we discuss how to schedule transmissions when the rate requirements need to be satisfied on average rather than instantaneously. Under special cases, a scheduling algorithm that serves only the strongest receivers is shown to outperform the one that schedules all receivers., Comment: IEEE Transactions on Communications