# Joint secure communications and sensing in 6G networks

Miroslav Mitev, Amitha Mayya, Arsenia Chorti

► To cite this version:

Miroslav Mitev, Amitha Mayya, Arsenia Chorti. Joint secure communications and sensing in 6G networks. 2023. [hal-04246414](https://hal.science/hal-04246414v1)

HAL Id: hal-04246414

https://hal.science/hal-04246414v1

Preprint submitted on 17 Oct 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# Chapter 1

## Joint secure communication and sensing in 6G networks

Miroslav Mitev,<fnref n="1" />* Amitha Mayya,<fnref n="1" /> and Arsenia Chorti<fnref n="1" />,<fnref n="2" />

*Corresponding Author: miroslav.mitev@barkhauseninstitut.org

**Keywords:** Physical layer security, Joint communication and sensing, Secret key generation, practical implementation.

Joint communication and sensing is expected to be one of the features introduced by the sixth-generation (6G) wireless systems. This will enable a huge variety of new applications, hence, it is important to find suitable approaches to secure the exchanged information. Conventional security mechanisms may not be able to meet the stringent delay, power, and complexity requirements which opens the challenge of finding new lightweight security solutions. A promising approach coming from the physical layer is the secret key generation (SKG) from channel fading. While SKG has been investigated for several decades, practical implementations of its full protocol are still scarce. The aim of this chapter is to evaluate the SKG rates in real-life setups under a set of different scenarios. We consider a typical radar waveform and present a full implementation.

<footnote n="1">¹Wireless connectivity group, Barkhausen Institut, 01187, Dresden, Germany</footnote>

<footnote n="2">²ETIS, UMR 8051 CY Cergy Paris Université, ENSEA, CNRS, 95000, Cergy, France</footnote>
tation of the SKG protocol. Each step is evaluated to demonstrate that gener-
ating keys from the physical layer can be a viable solution for future networks.
However, we show that there is not a single solution that can be generalized
for all cases, instead, parameters should be chosen according to the context.

1.1. Introduction

The development of wireless communications and radar sensing technologies
has been progressing independently for many years. Their design has been fully
separated, relying on different resources (frequency, hardware, waveform, etc.).
However, as both services depend on the same principle, i.e., transmitting/re-
ceiving electromagnetic signals, it is envisioned that a co-designed approach
can bring a number of benefits. In fact, the idea of a joint design is seeing a
growing interest by both industry and academia and it is expected to become
a key enabling technology for variety of 6G applications [1].

A simple approach to integrate both services in one device is by sharing the
same spectrum but transmitting separate signals. The main problem for this
case is finding a flexible interference cancellation technique that can smoothly
operate in different scenarios [2]. Another, more efficient, approach is to use a
single signal for both communication and sensing. This approach can provide
higher spectral efficiency but requires joint waveform design. In this sense, de-
pending on the application the waveform design can be communication-centric
(suitable for application with high data rate requirements and low sensing pre-
cision, e.g., smart home applications) and radar-centric (suitable for applica-
tion with low data rate requirements and high sensing precision, e.g., vehicular
networks).
Communication signals have complex structure and are typically modulated in one or multiple domains, e.g., time, spatial and frequency. This increases the cost as advanced transmitter/receiver modules [2] are required. On the other hand, signals used for radar have a simple structure, e.g., pulsed or continuous waves. Such waveforms are specifically designed for sensing and do not require the deployment of advanced processing modules. Such signals cannot provide high throughput, however, their achievable data rates can still be sufficient for certain sensing-oriented applications [3]. Some of the key performance indicators for such applications are high sensing precision, low-latency, low-complexity and power efficiency [4].

A question that naturally arises is: *How can we secure the communication in radar-centric applications?* It is clear that current cryptographic algorithms may not be able to support the requirements listed above. As an example, [5] has reported that the verification of digital signature over 400 MHz processor in a vehicular to everything (V2X) network exceeds the low-latency requirements and requires approximately 20 ms. Furthermore, traditional asymmetric public-key encryption (PKE) protocols do not satisfy low-energy requirements and cannot scale well for massive deployment [6]. Finally, the advances in quantum computing can leave current security solutions vulnerable, unless key sizes increase significantly [7]. Therefore, proposals for new lightweight security alternatives are sought.

Following from the above, the goal of this chapter is to provide a performance evaluation of one lightweight and quantum-secure key distribution technique (currently considered for 6G [8]). In particular, we investigate the physical layer security (PLS)-based secret key generation (SKG) with a focus on sensing-oriented networks. The SKG process (introduced in [9] and [10])
allows two devices to extract a common random key sequence relying on the
stochastic behaviour and reciprocity of wireless channels. Some of the advan-
tages of SKG are that, it does not require a complex infrastructure (as in the
case of PKE), it can be employed using an arbitrary PHY waveform (if the
transmitted power spectral density (PSD) is known) and it does not require
matched receivers [11, 12]. This work focuses on an SKG approach that uti-
lizes one of the widely used signals for radar sensing, i.e., the compressed high
resolution pulse (chirp).

Thanks to their wide bandwidth, chirps can be used to harvest entropy from
the wireless channel. To extract channel observations we rely on a filterbank-
based approach, where keys are generated from power measurements at differ-
ent frequencies. This approach has been proposed in [11] and analytically/nu-
merically analyzed by some of the authors of this chapter in [12, 13, 14]. As a
continuation of these works, here, we take a step further and evaluate the per-
formance of the approach in an experimental setup. A measurement campaign
is performed in an indoor environment considering a set of different scenarios.
To arrive at the final key rate all steps of the SKG protocol are implemented.
First, advantage distillation is performed by applying a filterbank over received
signals. Next, information reconciliation is done using Polar codes. To evaluate
the key generation rate we pass the output of the reconciliation through a con-
ditional min-entropy (conditioning on an eavesdropper knowledge) estimation.

The rest of this chapter is organized as follows: Section 1.2 motivates this work, Section 1.3 gives an overview of our system model, Section 1.4 gives a detailed overview of the SKG protocol, Section 1.5, presents the details of the measurement campaign, Section 1.6 summarizes some of the main results of this work and concludes this chapter.
## 1.2. Related work and motivation

Radar systems are already deployed in numerous verticals including, automotive industry, ship and aircraft navigation, smart factories and many more [15]. It is clear that the applications above can benefit from a co-designed communication and sensing approach. Particularly, vehicles can continuously sense the environment while sharing the obtained information with others on the road [16]. Similarly, autonomous machinery can communicate to improve production, while sensing for approaching people. Furthermore, in bistatic (or multistatic) radar applications, radars can accurately detect multiple targets and simultaneously convey location information to improve safety, e.g., in traffic control. Generally, in many joint communication and sensing scenarios, the data to be transmitted consists of confidential information, including location, speed and identity. Therefore, it is important to protect the transmission from possible information leakage and provide confidentiality.

As noted in the 3GPP report [17] a major limitation of 5G networks, especially in the context of Internet of things (IoT), is related to security. Standard cryptographic solutions rely on computationally intensive modulo arithmetic operations which makes them unsuitable for power constraint devices. This issue has also been long investigated by the national institute of standards and technology (NIST). Particularly an investigation on cryptography for constrained environments was initiated by NIST in 2013 [18]. After a decade, in 2023, the Ascon family of symmetric authenticated ciphers has been announced as a winner [19]. The algorithm is designed to protect data exchanged between IoT electronics. However, the issue of finding a lightweight and quantum resistant secret key distribution technique has not been yet resolved. As it stands at present, all approved mechanisms rely on the employment of longer keys [20].
This leads to increased complexity and contradicts to the requirements for low latency and low footprint. Therefore, the current state of post-quantum innovations does not align well with the expectations towards 6G networks.

In this sense, PLS-based SKG is a promising quantum-secure approach, that can provide confidentiality at a low computational cost. This is a major advantage compared to standardized solutions. The SKG procedure follows a sequence of steps which allow a pair of devices to extract a shared secret key. A standard source of randomness used to implement SKG is the wireless channel. Reciprocity and stochastic behavior are the properties of the channel that provide the ground SKG [6, 21, 22]. Devices can extract randomness from their channel observations at a low cost and without the need to perform complex modulo arithmetic in large fields as in current solutions. However, it is important to note that, the achievable key generation rates depend on the statistical properties of the channel, i.e., SKG rates in static channels are significantly lower than in mobile environments. This makes SKG a good candidate for key distribution in many joint communication and sensing applications, where mobility is expected.

Only a few studies have yet considered the security of joint communication and sensing applications [16, 23, 24, 25]. The work in [23] provides an information-theoretic perspective on the information leakage between sensing and communication in a discrete memoryless broadcast channel. The considered scenario assumes a transmitter that aims to simultaneously perform channel state estimation and reliable communication with a legitimate user. Next, [24] proposes a multi-carrier chirp approach to perform joint communication and sensing. The aim of the study is to maximize the secrecy rate of a wiretap channel in the presence of one or multiple eavesdroppers. Through
numerical evaluation it is demonstrated that sensing can provide valuable in-
formation about potential eavesdroppers. Finally, the authors of [16] and [25]
provide simulation-based analyses on the performance of chirp signals for key
generation. In particular [16], provides an estimate of the bit mismatch prob-
ability between two nodes in a vehicular and a smart factory scenarios. The
work in [25] provides a different perspective and investigates the number of
bits that are leaked to eavesdroppers in the vicinity.

All studies above show promising results proving that employing PLS can
be beneficial for future networks. Based on that, we examine a filterbank-
based SKG approach, suitable for radar-centric application, where chirp signals
are employed. Such scenarios would typically require high sensing precision
and low-rate transfer of sensitive information. Multiple use cases that fit this
description can be found in the 3GPP report [26]. A particular example is
collective situational awareness, where devices need to simultaneously perform
sensing with high precision and exchange small packets at low latency. With
a successful history in radar application and the advantage of low-complexity
processing wideband chirp signals are seen as a viable waveform candidate for
such scenarios. Furthermore, chirps can provide a broad view of the wireless
channel and offer rich entropy source for SKG. From this perspective, channel
measurements (e.g., for equalization purposes) can be used towards SKG and
subsequently, secure the information exchange. The idea of the filterbank-based
SKG with chirp signals is to divide the received signal bandwidth into a set
of parallel sub-bands and measure the power at each sub-band. As compared
to RSS-SKG methods, where single value is obtained per transmission, the
filterbank approach allows to capture a series of power measurements that
represent the randomness of the channel.
## 1.3. System model

The system model in this work consists of three parties: two legitimate users, namely Alice and Bob, and an eavesdropper, namely Eve. Each of the parties has a single antenna. To measure the channel Alice and Bob exchange a series of linear complex up-chirp signals. Eve is positioned in the vicinity of Bob and eavesdrops their exchange. The goal of Alice and Bob is to generate a secret key using the observed channel measurements while keeping the leakage to Eve close to zero. A chirp signal can be represented in baseband as $x(t) = \frac{1}{T}e^{j\pi ct^2}$, where T denotes the duration of the chirp, c = B/T is chirp rate and B denotes bandwidth. The instantaneous frequency changes linearly with time, $f(t) = ct + f_0$, where $f_0 = f_c - B/2$ is the starting frequency at t = 0 and $f_c$ is the center frequency of the signal.

To perform SKG, Alice and Bob send signals $x(t)$, up converted to a chosen passband. The received signals at Alice, Bob and Eve are:

$$y_A(t) = x(t) * h(t) + w_A(t), \qquad (1.1)$$

$$y_B(t) = x(t) * h(t) + w_B(t), \qquad (1.2)$$

$$y_E(t) = x(t) * h_E(t) + w_E(t), \qquad (1.3)$$

respectively. In the equations above, $h(t)$ is a complex channel response representing the channel between Alice and Bob, $h_E(t)$ represents the channel between Alice and Eve, which, depending on Eve's position may be or may not be correlated to $h(t)$, $w_A(t) \sim \mathcal{N}(0, \sigma_A^2)$, $w_B(t) \sim \mathcal{N}(0, \sigma_B^2)$, $w_E(t) \sim \mathcal{N}(0, \sigma_E^2)$ are additive white Gaussian noise (AWGN) variables experienced at Alice, Bob and Eve respectively. Please note that this study considers an eavesdropper located close to Bob, hence, measurements in the channel Bob-Eve are ignored.
<figure><img src="image_2.png" /><figcaption>Figure 1.1: Secret key generation between Alice and Bob.</figcaption></figure>

The channel impulse response is a sum of multi-path components (MPCs),

$$h(t) = \sum_{i=0}^{L-1} \alpha_i \delta(t - \tau_i), \qquad (1.4)$$

where $L$ is the number of MPCs, $\alpha_i$ and $\tau_i$ are the complex amplitude and delay of $i$-th MPC, $\delta(t)$ is the Dirac delta function ($h_E(t)$ is defined similarly). Having their channel observations all parties perform filterbank-based SKG as detailed in the next section.

## 1.4. SKG Protocol

The SKG protocol follows three basic steps, namely, advantage distillation, information reconciliation and privacy amplification. A sketch of the protocol is illustrated in Figure 1.1. Alice and Bob pass their channel estimation vectors through a quantizer, obtaining binary sequences $r_A$ and $r_B$, respectively. To reconcile mismatches at the generated binary sequences, one of the legitimate parties, e.g. Alice, sends syndrome information $s_A$ to Bob. Finally, to create maximal entropy secret keys, both users employ privacy amplification over the reconciled information. A detailed description of our implementation of the protocol is given below.
<figure><img src="image_3.png" /><figcaption>Figure 1.2: Filterbank constructed of N = 5 filters. The transmit signal has bandwidth B = 70 MHz. Power measurements at each sub-band are given as dots.</figcaption></figure>

**Advantage distillation:** To extract randomness from (1.1)-(1.3), each party passes its received signal through a filterbank with N filters. Each individual filter n = 1, ..., N has an impulse response given as

$$g_n(t) = g(t)e^{(j2\pi f_n(t))}, \qquad (1.5)$$

where g(t) is a protyping filter. Each filter has bandwidth B/N and center frequency, f_n(t) calculated as $f_n = -\frac{B(N-2n+1)}{2N}$. The randomness from the channel is extracted through power measurements at the output of each filter. An example is illustrated in Figure 1.2. The figure shows a normalized power spectrum densities (PSDs) of transmit and received signals with B = 70 MHz. The impulse response of the filterbank, for N = 5, is also illustrated along with the power measurements obtained at the output of each filter. The obtained vector of power measurements at Alice can be expressed as $p_A = [\hat{p}_{A,1} \cdots \hat{p}_{A,N}]$. The measurements at Bob and Eve can be similarly expressed. Assuming that measurements are obtained over long enough periods, the power of the sam-
pled version of the filtered signal can be approximated as the average of the continuous-time signals, i.e., $\hat{p}_{A,n} = |g_n(t) * y_A(t)|^2$ with $\langle \cdot \rangle$ denoting time-averaging operator.

The probability distribution of a single power measurement, considering a Rayleigh channel, has been evaluated in our previous work [14]. It was shown that the probability is a sum of Gamma-distributed variables $\sum_{m=1}^{M} \Gamma(\kappa_m, \theta_m)$, with shape $\kappa_m$ and scale $\theta_m$ parameters and can be approximated as

$$ \hat{p}_n \sim \Gamma \left( \kappa = \frac{\left(\sum_{m=1}^{M} \kappa_m \theta_m + 2\sigma^2\right)^2}{\sum_{m=1}^{M} \kappa_m \theta_m^2 + \frac{8\sigma^4}{K-1}}, \theta = \frac{\sum_{m=1}^{M} \kappa_m \theta_m + 2\sigma^2}{\kappa} \right), \quad (1.6) $$

where $M$ is the number of resolvable MPCs, $K$ is the number of digital samples that fall within the filter bandwidth and $\sigma^2$ is AWGN variance.

**Information reconciliation:** Power measurements at each party are quantized to bit sequences. Depending on the type of quantizer each power measurement can generate one or multiple bits. Using Gray codes, the number of bits per measurement is $\log_2(Q)$, where the number of quantization levels (regions), $Q$, is chosen to be a power of 2. After performing quantization the three parties obtain binary vectors $\mathbf{r}_A, \mathbf{r}_B, \mathbf{r}_E \in \{0, 1\}^{N \log_2(Q)}$. Due to noise or imperfect power estimation the observations at Alice and Bob could differ.

To correct errors, Alice (or Bob) generates and sends reconciliation information (e.g., syndrome) $\mathbf{s}_A$ over a public channel. The syndrome can be generated using distributed source coding techniques. Next, $\mathbf{s}_A$ is used by Bob to correct $\mathbf{r}_B$ and obtain $\mathbf{r}_A$. However, due to public exchange of the reconciliation information Eve also obtains $\mathbf{s}_A$. She can use the syndrome and her initial measurements to correctly guess part or the entire sequence. To remove leakages to Eve and limit her chances of guessing the legitimate key a final
step is performed, i.e., privacy amplification.

**Privacy amplification:** Keys are the core of cryptographic mechanisms; hence, their quality is of utmost importance for the security of modern communication systems. In this sense, the final key $\mathbf{k} \in \mathcal{K}$ between Alice and Bob should satisfy the following randomness inequality [27] $|\mathbf{k}| \le H_\infty(\mathbf{r}_A)$, where

$$H_\infty(\mathbf{r}_A) = -\log_2 \max_{\mathbf{r}_A \in \mathcal{R}_A} p(\mathbf{r}_A), \qquad (1.7)$$

denotes min-entropy [28]. However, the equation above does not consider any leakage at Eve. Therefore, a more rigorous metric is required to represent the scenario in this work. To measure the quality of generated keys in such situations, conditional min-entropy is used. It is defined as [29]:

$$H_\infty(\mathbf{r}_A|\mathbf{r}_E, \mathbf{s}_A) = -\log_2 \max_{\mathbf{r}_A \in \mathcal{R}_A, \mathbf{r}_E \in \mathcal{R}_E, \mathbf{s}_A \in \mathcal{S}_A} p(\mathbf{r}_A|\mathbf{r}_E, \mathbf{s}_A), \qquad (1.8)$$

where the shared sequence between Alice and Bob is conditioned on both, initial measurements at Eve and the leaked syndrome. In fact, the difference between (1.7) and (1.8) represents the total amount of leaked information [30]:

$$\text{Leakage} = H_\infty(\mathbf{r}_A) - H_\infty(\mathbf{r}_A|\mathbf{r}_E, \mathbf{s}_A) \qquad (1.9)$$

Following the above, the final key should be of size $|\mathbf{k}| \le H_\infty(\mathbf{r}_A|\mathbf{r}_E, \mathbf{s}_A)$.

The evaluation of these quantities requires knowledge on the underlying marginal and conditional distributions. Finding a closed-form solution is a complex task and falls out of the scope for this chapter. Instead, we use a numerical estimator that can evaluate the above without prior knowledge on the analytical expressions. We use the fast black-box leakage estimation (FBLEAU) [31].
<figure><img src="image_4.png" /><figcaption>Figure 1.3: Sketch of the measurement setup created with floorplaner.com. The distance between Alice and Bob is 4 m. Alice is placed at 2.3 m height. Bob and Eve are at 0.85 m height. Throughout the measurement campaign Eve is placed on a linear positioner which moves her with one-wavelength steps with respect to Bob's position (from $1\lambda$ to $10\lambda$).</figcaption></figure>

To evaluate the leakage and arrive at the conditional min-entropy, the estimator relies on nearest neighbor and frequentist estimates [32]. Once the conditional min-entropy is evaluated a standard way to compress the sequence to the desired size is through the use of one-way collision resistant compression functions, e.g., hash function.
## 1.5. Measurement setup

This section illustrates a real-life setup configured to execute the SKG protocol presented in Section 1.4. Based on the system model from Section 1.3 three universal software radio peripherals (USRPs), two representing the legitimate nodes (Alice and Bob) and a third acting as an eavesdropper (Eve), were used. For the purpose of this study, USRP-2974 from National Instruments are employed. A floorplan of the measurement setup is illustrated in Figure 1.3. The distance between Alice and Bob is 4 m. Alice is placed at 2.3 m height, Bob and Eve are placed on a desk at 0.85 m height. The positions of Alice and Bob are kept constant throughout the measurement campaign. To evaluate the leakage towards Eve, ten different positions are considered for her node. As it can be seen in the figure, she is placed on a linear positioner next to Bob which moves her with steps of one-λ, starting from 1λ and ending at 10λ. For the considered frequency, i.e., $f_c = 3.75$ GHz, the wavelength is $λ ≈ 8$ cm.

To obtain channel measurements Alice and Bob transmit chirp signals in a time division duplex (TDD) fashion. The USRP, configured as Eve, is always in receiving mode and eavesdrops the exchange between the legitimate nodes. Note that, due to her position, Eve is only interested in the signals received from Alice. The duration of individual chirp symbol is 17.1875 µs and the bandwidth is 70 MHz. At each of the 10 positions of Eve, Alice and Bob transmit/receive $10^5$ chirp signals. The process described above is repeated considering four different scenarios.

**Scenarios:** The measurements were performed under a set of four different scenarios including: line-of-sight (LoS) static, LoS dynamic, non-LoS (NLoS)
<figure><img src="image_5.png" /><figcaption>Figure 1.4: Line-of-sight scenario. Dynamic and static cases differentiate based on whether there is movement in the room. Eve is placed on a linear positioner and is moved from 1λ up to 10λ with respect to Bob’s position.</figcaption></figure>

static, NLoS dynamic. Dynamic measurements are achieved by movement of
people and objects in the room. Static measurements are performed throughout
night and nothing moves during the process. The LoS scenario is illustrated in
Figure 1.4. One of the objects moved throughout the campaign, i.e., a circular
metal plate, is also displayed on the figure. The NLoS case is illustrated in
Figure 1.5. The difference between the two setups is that, several absorbers
are placed to block the direct path between antennas. Apart from that the
setup is kept identical as in the LoS scenario.

**Details on the SKG implementation:** Upon receiving a signal, each of the three nodes executes the steps of the SKG protocol presented in Section 1.4. First, the received signals $y_A, y_B, y_E$ are passed through filterbanks; different number of filters are considered, i.e., $N = \{8, 16, 32, 64\}$. Power measurements at the output of each filter are used as a source for the SKG. Next, the mea-
<figure><img src="image_6.png" /><figcaption>Figure 1.5: Non-line-of-sight scenario achieved using a set of absorbers to block the direct path between nodes. Dynamic and static cases differentiate based on whether there is movement in the room. Eve is placed on a linear positioner and is moved from $1\lambda$ up to $10\lambda$ with respect to Bob’s position.</figcaption></figure>

surements are converted into binary sequences $\mathbf{r}_A, \mathbf{r}_B, \mathbf{r}_E$ using linear multi-level quantization technique. Two different number of quantization levels are employed, i.e., $Q = \{4, 16\}$, resulting in 2 or 4 bits per power measurement, respectively. Bit sequences are reconciled using Slepian-Wolf decoders implemented based on Polar (more details on Slepian-Wolf decoding, including Polar codes can be found in [33]). Alice generates a syndrome $\mathbf{s}_A$ and shares it with Bob (this is also observed by Eve). Bob and Eve, use the syndrome along with their observations and aim at reproducing Alice’s bit sequence. Depending on the number and distribution of errors the error correction process might be successful or not. Finally, based on the available conditional min-entropy $H_\infty(\mathbf{r}_A|\mathbf{r}_E, \mathbf{s}_A)$ Alice and Bob generate a shared secret key $\mathbf{k}$. A thorough performance comparison with respect to the value of $N$, the value of $Q$, and the choice of reconciliation technique is presented in the next section.
<figure><img src="image_7.png" /><figcaption>Figure 1.6: PDF of the power measurement taken at different environments, all fitted with different Gamma distributions. The measurements are for a single filter when considering $N = 64, 32, 16, 8$.</figcaption></figure>

## 1.6. Results and discussion

This section provides a detailed overview on how the parameters at each step of the SKG protocol affect the performance. First, we examine our analytical results from [14], (also given by Eq. 1.6), and try to fit the histograms of the observed power values with gamma distribution. As noted in the previous section, the transmit signal has a bandwidth of $B = 70$ MHz. Filters are distributed evenly across this bandwidth, hence, adding more filters results in smaller bandwidth per filter. This changes the number of digital samples falling within a single filter and has an impact on the power distribution. This is illustrated in Fig. 1.6.

The figure shows that when the channel is static the distribution of the power measurements aligns with our analytical finding, i.e., it fits well with
Gamma distribution. Another observation, which was also confirmed in [14], is that when the number of filters $N$ decreases (and the bandwidth of each filter increases) the variance of the measurements also decreases. As a direct consequence of Eq. 1.6 by increasing the number digital samples $K$ (i.e., increasing the bandwidth) the effect of noise $\sigma^2$ decreases. This can be observed for both NLoS and LoS cases. Now, considering dynamic scenarios we can see that only the tail of the distributions align with the Gamma fitted curves and the peaks represent a mixture of several distributions. As expected the variations in dynamic environment are greater from the static ones. However, differently from above, they increase with the bandwidth. This is because the noise is no longer the dominant cause of variation. Instead, multipath provides more degrees of freedom and observing higher bandwidth results in higher spread of the measurements. Overall, this shows that general statistical models cannot fully capture real-life situations, hence, further investigation is required.

The next step is quantization of the observed measurements. Based on the combination of number of filters and quantization levels different number of bits can be obtained (e.g., for $N = 16$ and $Q = 4$ we have $16 \log_2(4) = 32$ bits per channel use). At this step we evaluate the average mismatch probability between nodes.

Figure 1.7 illustrates the average mismatch between legitimate users and the average mismatch observed at Eve. First, as expected, if the legitimate users increase the number of bits generated per frame (i.e., by increasing $N$ or $Q$) the mismatch increases. This is because generated bits become prone to noise variations which are not reciprocal. Second, it can be seen that in the NLoS scenarios the generated bit sequences have more errors as compared to the LoS scenarios. This is expected as the power observed at Alice and Bob decreases
<figure><img src="image_8.png" /><figcaption>Figure 1.7: PDF of the power measurement taken at different environments, all fitted with different Gamma distributions. The measurements are for a single filter when considering $N = 64, 32, 16, 8$.</figcaption></figure>

when LoS is not present. Finally, an interesting result can be observed for the mismatch at Eve. The error bars in the figure represent standard deviation of her average mismatch probability taken over all 10 positions. Note that, during the experiment it was observed that Eve's mismatch does not improve when she is closer to Bob, instead, she can have better probability at further positions - this might be due to in-phase/out-of-phase addition of multi-path components at certain location of the room. This confirms the theoretical result [34], that channels de-correlate over a distance of $\lambda/2$. The figure shows that, in all scenarios, the average value of Eve's mismatch is independent from $Q$ and $N$ and remains constant close to 50%. However, it can be seen that the standard deviation increases for smaller values. This shows that if less bits are produced per frame, i.e., $Q$ and $N$ are small, Eve has higher chances of observing similar bit sequence to the legitimate one.
<figure><img src="image_9.png" /><figcaption>Figure 1.8: Frame error rate (FER) at Alice and Bob after reconciliation.</figcaption></figure>

Figures 1.8 and 1.9 illustrate the results from the information reconciliation step. Polar codes as in [33] are implemented to perform this step.

Figure 1.8 shows the frame error rate (FER) at Alice and Bob for different values of $Q$ and $N$. It can be seen that the number of quantization levels $Q$ has a higher impact on the FER as compared to the number of filters $N$. In particular, if Alice and Bob harvest the entropy of the channel using 32 filter and 4 (64 bits per channel use) levels the FER is smaller compared to 16 filter and 16 levels (also 64 bits per channel use). Similarly to Figure 1.7, it is observed that the performance at the legitimate users decreases when a LoS path is not present. This is an expected result, as this naturally decreases the SNR between the two parties. Another important parameter for the success of this step is the code rate. At lower code rate the FER is negligible, however, this corresponds to a larger syndrome $s_A$.
<figure><img src="image_10.png" /><figcaption>Figure 1.9: Frame error rate (FER) at Eve after reconciliation.</figcaption></figure>

The syndrome is sent over a public channel, hence, Eve also has access to it. Therefore, a lower code rate gives her a better chance to arrive at the correct sequence. This is illustrated in Figure 1.9. The figure shows the FER at Eve after she observes the syndrome information. It can be seen that at low code rates, i.e., 0.1, her probability to decode the correct sequence becomes higher, hence, impacting the security of the system. Important observations from this figure is that, similarly to Alice and Bob, Eve performance becomes better if more filters are used as opposed to more quantization levels. Therefore, while increasing the number of bits by increasing *N* (instead of *Q*) might be beneficial for the legitimate users, this might increase the potential leakage to Eve. This is examined next.

We evaluate $H_{\infty}(\mathbf{r}_A|\mathbf{r}_E, \mathbf{s}_A)$ using the FBLEAU numerical estimator [31]. The estimator takes as input the three vectors $\mathbf{r}_A, \mathbf{r}_E$ and $\mathbf{s}_A$ and provides
<figure><img src="image_11.png" /><figcaption>Figure 1.10: Conditional min entropy for different *N*, *Q* and code rates.</figcaption></figure>

an evaluation on the conditional min-entropy. Results are illustrated in Figure 1.10. The figure gives the estimated values for different code rates and different values of *Q* and *N*. Due to computational constraints, i.e., evaluation over large dimensions of bit sequences, the figure shows only combinations up to 32 filters with 4 quantization levels. This limit comes from a problem known as the curse of dimensionality [35] which is an open research area. It increases the time of convergence non-linearly with each new dimension.

The first observation is that increasing the code rate increases the conditional min-entropy. This effect is due to the fact that a higher code rate corresponds to a shorter syndrome, hence, less information is leaked to Eve. Furthermore, as the randomness of the generated bits rely on the variation of the channel we can see that the conditional min-entropy is low for static scenarios. In contrast dynamic environments are good source of randomness for Alice and Bob. Finally, controversially to the results for reconciliation we
<figure><img src="image_12.png" /><figcaption>Figure 1.11: Average key rate (per channel use) over different N, Q and code rate.</figcaption></figure>

see that capturing the small variations in the channel by increasing Q provides higher randomness as opposed to increasing N. However, to execute the full SKG protocol successfully, both reconciliation and conditional min-entropy must be respected.

The average key rate per channel use, R per channel use is a function of several parameters: i) frame rate F, equal to the number of bits generated per frame (varies accordingly with Q and N); ii) the FER after reconciliation; iii) conditional min-entropy $H_\infty(\mathbf{r}_A|\mathbf{r}_E, \mathbf{s}_A)$. The key rate is denoted as:

$$R = F \times (1 - \text{FER}) \times H_\infty(\mathbf{r}_A|\mathbf{r}_E, \mathbf{s}_A). \quad (1.10)$$

Results on the rate are given in Figure 1.11.

The trend in the figure is clear. To increase the key rate, F must be increased, preferably by increasing Q as opposed to N and the code rate should be
decreased. Based on the system parameters used in our measurement campaign the values from Fig. 1.11 can also be expressed in [b/s/Hz] or [b/s]. Given the fact that a two-way transmission between Alice and Bob takes approximately 35 µs and $B = 70$ MHz we present the results in Table 1.1. The table shows only the maximum achievable rate based on Fig. 1.11, i.e., considering code rate 0.1, $N = Q = 16$.

<table><caption>Table 1.1: Achievable secret key generation rates.</caption><thead><tr><th>Scenario</th><th>NLoS Dynamic</th><th>NLoS Static</th><th>LoS Dynamic</th><th>LoS Static</th></tr></thead><tbody><tr><td>Rate [b/s/Hz]</td><td>0.0121</td><td>0.0034</td><td>0.0102</td><td>0.0005</td></tr><tr><td>Rate [b/s]</td><td>848220</td><td>240131</td><td>713940</td><td>31614</td></tr></tbody></table>

To conclude, our experimental results show that the information available for SKG could vary greatly depending on both channel and system parameters. We have shown that chirp signals can capture the channel variations over different frequencies and provide a valid source for SKG. The evolution of wireless systems and the introduction of sensing at the edge of the system can provide valuable information regarding the environment. This provides the required context information and makes SKG a viable technique for key distribution. As a future work, the authors plan to further investigate the results presented in this chapter, by considering multiple antenna scenarios and work on adaptive SKG solutions. Furthermore, the proposed chirp-based approach will be experimentally compared with waveforms with high spectral efficiency waveforms (e.g., OFDM).
Acknowledgement

This work is financed on the basis of the budget passed by the Saxon State
Parliament, and partially funded by Hexa-X-II project, receiving funding from
the Smart Networks and Services Joint Undertaking (SNS JU) under the Euro-
pean Union's Horizon Europe research and innovation programme under Grant
Agreement No 101095759. A. Chorti was supported by INEX funding (Project
PHEBE and ENIGMA). The authors would like to acknowledge the help from
Dr. Mahdi Shakiba-Herfeh who provided us with a Slepian-Wolf implementa-
tion of Polar codes.

Bibliography

[1] T. Wild, V. Braun, and H. Viswanathan. Joint design of communication and sensing for beyond 5G and 6G systems. *IEEE Access*, 9, 2021.

[2] J. A. Zhang, Md. L. Rahman, K. Wu, X. Huang, Y. J. Guo, S. Chen, and J. Yuan. Enabling joint communication and radar sensing in mobile networks—a survey. *IEEE Commun. Surv. Tut.*, 2022.

[3] A. N. Barreto, T. M. Pham, S. George, P. Sen, and G. Fettweis. Analysis of a chirp-based waveform for joint communications and radar sensing (JC&S) using non-linear components. In *15th Eur. Conf. on Antennas Propag. (EuCAP)*, 2021.

[4] A. Hassanien, M. Amin, E. Aboutanios, and B. Himed. Dual-function radar communication systems: A solution to the spectrum congestion problem. *IEEE Signal Process. Mag.*, 2019.
[5] A. Teniou and B. Bensaber. Efficient and dynamic elliptic curve qu-vanstone implicit certificates distribution scheme for vehicular cloud networks. *J. Sec. Priv.*, 2018.

[6] Junqing Zhang, Guyue Li, Alan Marshall, Aiqun Hu, and Lajos Hanzo. A new frontier for IoT security emerging from three decades of key generation relying on wireless channels. *IEEE Access*, 8, 2020.

[7] M. Mosca. Cybersecurity in an Era with Quantum Computers: Will We Be Ready? *IEEE Secur. & Priv.*, 16(5), September 2018.

[8] Matti L. and Kari L. Key drivers and research challenges for 6G ubiquitous wireless intelligence. University of Oulu, Oct 2019.

[9] U. M. Maurer. Secret key agreement by public discussion from common information. *IEEE Trans. Inf. Theory*, 1993.

[10] R. Ahlswede and I. Csiszar. Common randomness in information theory and cryptography. i. secret sharing. *IEEE Trans. Inf. Theory*, 1993.

[11] M. Zoli, A. Barreto, S. Köpsell, P. Sen, and G. Fettweis. Physical-layer-security box: a concept for time-frequency channel-reciprocity key generation. *Eurasip J. Wirel. Commun. Netw.*, 2020.

[12] M. Zoli, M. Mitev, A. Barreto, and G. Fettweis. Estimation of the secret key rate in wideband wireless physical-layer-security. In *ISWCS*, 2021.

[13] M. Mitev, A. N. Barreto, T. M. Pham, M. Matthé, and G. Fettweis. Filterbank secret key generation rates in multipath channels. In *IEEE Global Commun. Conf. (GLOBECOM)*, 2022.
[14] M. Mitev, A. N. Barreto, T. M. Pham, and G. Fettweis. Secret key generation rates over frequency selective channels. In *IEEE Veh. Tech. Conf. (VTC)*, 2022.

[15] F. Liu, C. Masouros, A. Petropulu, H. Griffiths, and L. Hanzo. Joint radar and communication design: Applications, state-of-the-art, and the road ahead. *IEEE Trans. Commun.*, 2020.

[16] S. Dwivedi, M. Zoli, A. N. Barreto, P. Sen, and G. Fettweis. Secure joint communications and sensing using chirp modulation. In *6G Wireless Summit*, 2020.

[17] 3GPP TR 33.825 V2.0.0, Study on the Security for 5G URLLC (Release 16). 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects, 2019.

[18] NIST - Lightweight Cryptography Project, 2013. URL https://csrc.nist.gov/projects/lightweight-cryptography.

[19] NIST Selects 'Lightweight Cryptography' Algorithms to Protect Small Devices, 2023. URL https://www.nist.gov/news-events/news/2023/02/nist-selects-lightweight-cryptography-algorithms-protect-small-devices.

[20] Post-Quantum Cryptography - Selected Algorithms, 2022. URL https://csrc.nist.gov/projects/post-quantum-cryptography/selected-algorithms-2022.

[21] M. Mitev, A. Chorti, M. Reed, and L. Musavian. Authenticated secret key generation in delay-constrained wireless systems. *Eurasip J. Wirel. Commun. Netw.*, 2020.
[22] M. Mitev, A. Chorti, H. V. Poor, and G. Fettweis. What physical layer security can do for 6G security. *IEEE Open J. Veh. Technol.*, 2023.

[23] O. Günlü, M. Bloch, R. F. Schaefer, and A. Yener. Secure joint communication and sensing. In *IEEE Int. Symp. Inf. Theory (ISIT)*, 2022.

[24] N. Su, F. Liu, and C. Masouros. Sensing-assisted eavesdropper estimation: An ISAC breakthrough in physical layer security, 2022.

[25] M. Zoli, A. Barreto, and G. Fettweis. Investigating the eavesdropper attack in physical layer security wireless key generation: a simulation case study. In *IEEE Veh. Tech. Conf. (VTC-Spring)*, 2021.

[26] 3GPP TR 22.886 V2.0.0, Study on enhancement of 3GPP support for 5G V2X services (Release 16). 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects, 2018.

[27] D. Brown. Formally assessing cryptographic entropy. *IACR Cryptol. ePrint Arch.*, 2011.

[28] B. Espinoza and G. Smith. Min-entropy as a resource. *Inf. Comp.*, 226: 57-75, 2013. Special Issue: Information Security as a Resource.

[29] L. Reyzin. Some notions of entropy for cryptography. In *Information Theoretic Security*. Springer Berlin Heidelberg, 2011.

[30] G. Smith. On the foundations of quantitative information flow. In *Foundations of Software Science and Computational Structures*. Springer Berlin Heidelberg, 2009.

[31] G. Cherubin, K. Chatzikokolakis, and C. Palamidessi. F-BLEAU: Fast black-box leakage estimation. In *2019 IEEE Symp. Sec. Priv. (SP)*, 2019.
[32] T. Chothia, Y. Kawamoto, and C. Novakovic. A tool for estimating information leakage. In *Computer Aided Verification*. Springer Berlin Heidelberg, 2013.

[33] M. S. Herfeh and A. Chorti. Comparison of short blocklength Slepian-Wolf coding for key reconciliation. In *IEEE Statist. Signal Process. Workshop (SSP)*, 2021.

[34] W. Jakes. *Microwave Mobile Communications*. Wiley-IEEE Press, 1994.

[35] N. Kouiroukidis and G. Evangelidis. The effects of dimensionality curse in high dimensional kNN search. In *15th Panhellenic Conf. Inform.*, 2011.