# A Lightweight Key Generation Scheme for Secure Device-to-Device (D2D) Communication

Authors: Chunwei Lou; Mingsheng Cao; Rongchun Wu; Dajiang Chen; Hua Xu
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

Key agreement is one the most essential steps when applying cryptographic techniques to secure device-to-device (D2D) communications. Recently, several PHY-based solutions have been proposed by leveraging the channel gains as a common randomness source for key extraction in wireless networks. However, these schemes usually suffer a low rate of key generation and low entropy of generated key and rely on the mobility of devices. In this paper, a novel secret key extraction protocol is proposed by using interference in wireless D2D fading channel. It establishes symmetrical keys for two wireless devices by measuring channel gains and utilizing artificial jamming sent by the third party to change the measured value of channel gains. We give a theoretically reachable key rate of the proposed scheme from the viewpoint of the information theory. It shows that the proposed scheme can make hundred times performance gain than the existing approaches theoretically. Experimental results also demonstrate that the proposed scheme can achieve a secure key distribution with a higher key rate and key entropy compared with the existing schemes.


---

## Body

## 1. Introduction

Because of the broadcast and open-air nature of a wireless channel, device-to-device (D2D) communications [1, 2] are vulnerable to message eavesdropping and node impersonation [3–6]. To resist these attacks, an effective method is to encrypt sensitive data with secret session keys and send encrypted data via wireless channels. However, it is necessary to agree on a common secret session key between two communicating parties beforehand. Most of traditional protocols (e.g., Diffie-Hellman method [7]) rely on the computing capability of adversary, which have high computational complexity. Since a lot of wireless devices (e.g., miniature sensors) have limited computing ability, the existing cryptographic methods need to overcome the contradictions between high computational complexity and limited computing ability [8].Some popular research works leverage the channel randomness between two wireless devices. Many theoretical results (e.g., [9, 10]) show that multiple legitimate nodes can agree on a key unknown to an eavesdropper due to the high overhead of random coding. Recently, several radio channel features (i.e., temporal variations, spatial variations, and reciprocity of radio wave propagation) have been utilized for key extraction in wireless networks [11–13].However, existing approaches still suffer from reliance on mobile environments, low key generation rate and key entropy [14]. To address these problems, a number of solutions have been proposed [15–19]. In [15], iJam is proposed to increase the channel change rate. Unfortunately, it decreases the throughout due to the retransmission-based self-protection procedure in the scheme. A key extraction scheme is proposed by exploiting multiantenna diversity [16]. However, it leads to an increase in the complexity of the transceivers. In [17], a key generation scheme is designed by using the randomness of channel phase. In [18], a secret key extraction protocol is proposed by leveraging the received signal strength (RSS). In [19], a secure key distribution scheme with artificial interference is designed. However, due to the inefficient bit extraction method and the low efficiency of artificial jamming, the key generation rate of the protocol is relatively low.In this paper, a new secure key distribution approach is designed for key extraction in D2D communications. In our scenarios, a symmetrical key is aimed to be generated between two devices named Alice and Carol (Alice and Carol are called keying nodes) in the presence of an eavesdropper Eve. We also assume that there exists an assistance device Bob. The main contributions of the works are as follows:(1)
A new key generation scheme is designed for D2D communication by leveraging the artificial jamming to change the channel gains. Unlike existing approaches [8, 11], in the proposed scheme, the legitimate users can obtain multiple different channel measurements in each coherence time(2)
A new bit extraction method is proposed to improve the key generation rate and key entropy, which includes low entropy measurement elimination, random permutation, and adaptive multiple-bit extraction(3)
Extensive experiments are conducted to evaluate the performance of the proposed scheme with both theoretical analysis and simulation. Experimental results show that the proposed scheme can achieve a higher key generation rate and key entropy compared with existing schemes.The reminder of this paper is organized as follows. Section2 reviews the related work. In Section 3, the details of the proposed scheme and the theoretical analysis are presented. Section 4 details the experimental results and discussions. We finally conclude this work in Section 5.


## 2. The Literature Reviews

Recently, leveraging artificial jamming to improve the security of a wireless networking has drawn increasing attention [20–27]. In [20], Liu et al. proposed a secure communication scheme in a distributed relay networks, in which the destination transmits jamming signals to confuse the eavesdropper at first hop and the source and a particular relay jam eavesdropper cooperatively without jamming the destination at second hop. In [21], a two-stage cooperative scheme for secure communication with multiple helpers has been proposed. After that, Zheng et al. considered the secure communication scenario that the destination is with two antennas and only a single antenna is equipped in eavesdropper [22]. In this work, one antenna of destination receives the signals, and the other one transmits jamming to confuse the adversary. However, it requires a FD receiver and cannot guarantee the security when the adversary has multiple antennas. In [23], Li et al. studied the optimization problem for secrecy rate in a relay wiretap channel network, where the multiple multiantenna nodes act as the relaying nodes as well as the artificial jamming generation nodes. However, in a direct source-to-eavesdropper link case, it may be difficult to achieve a positive secrecy rate. In [24], an opportunistic relay-based secure communication scheme has been proposed to improve the secrecy rate for a relay network with two-hop. Specifically, a node (named opportunistic relay node) is used to forward the confidential signals and another node (named the jamming nodes) sends jamming signals to confuse the adversary. The multiantenna secure transmission by using beam-forming techniques to confuse multiple antenna eavesdroppers with limited feedback constraints has been studied in [25, 26]. However, these works only focused on optimizing the secrecy rate theoretically and could not be directly applied for secret key distribution in practice. For more information about improving secrecy rate with friendly jamming, please refer to the survey in [27]. The related work about jamming attack also includes [28].Key generation with artificial interference has been analyzed in [19]. Different from [19], this paper has the following advantages: (1) The theoretical results about key rate are different. The lower bound of key rate in [19] is 1/2Tclnb+3ln2πe−e−1, while, in this paper, a lower bound of key rate is 1/2Tclnπeb2−e−1. Thus, the new bound is at least L times over the bound in [19], where L=Tcfs/2M∗ is the number of rounds in the coherence time Tc, M is the length of probe vector for each measurement value, fs is the sampling rate, and b2 is the average power at keying node Alice and helper node Bob. In other words, the proposed scheme can measure L channel state information measurements for a secure key extraction in each coherence time. (2) The bit quantization method is different. Two-level bit quantization scheme is adopted in [19], while this paper presents an adaptive multiple-level bit extraction scheme. Moreover, the simulation results show that a larger jamming power may contribute to more bits extracted from each measurement (please refer to Section 4). (3) The approach to increasing the key bit entropy is different. In [19], there is no any added method to pretreat the measurements before bit quantization, while this paper proposed a low entropy measurement elimination algorithm and random permutation algorithm to eliminate the low entropy measurements and to increase the randomness of measurements, respectively.


## 3. The Proposed Solution

In this section, the network model and adversary model are first described. Then, we describe the proposed scheme. A random variable (RV) and its realization are denoted by an uppercase letter (e.g.,X and Y) and a lowercase letter (e.g., x and y), respectively; a random vector is denoted by an hollow bold uppercase letter (e.g., X and Y). Let Hij be a RV of channel gains between device i and device j, Tc be the coherence time (i.e., the time interval over which the channel gain may be considered coherent), fs be the sampling rate, M be the sample number by fully exploiting the coherence time interval, and M∗ be the length of probe vector for each measurement at Alice and Carol.In the system model, two devices, Alice and Carol, are aimed at building a common secret key for secure D2D communication by measuring the channel gains from the channel between them, and a trusted third party Bob (helper), who changes the state channel information of channel between Alice and Carol by broadcasting jamming signals. Alice and Carol can reconcile their measurements by sending some error-correcting information through a public channel, and a secure channel exists between Alice and Bob. Of course, there is an eavesdropper Eve who plans to break the secret key.


### 3.1. The Proposed Key Generation Protocol

The artificial-jamming-based secret key extraction consists of five components: (1) collection of random source, (2) low entropy measurements elimination, (3) random permutation, (4) adaptive multiple-bit extraction, and (5) information reconciliation and privacy amplification.


#### 3.1.1. Collection of Random Source

LetΛ be a Gaussian distribution with mean of 0 and variance of b2 and M∗ be the probe vector length of measurement. The time is divided into slots t1,t2,···.Step (1) Int1, Alice and Bob random choose λA1 and λB1 from Λ∼G0,b2, respectively. Then, Alice transmits probe signals λA1s→A with length s→A=M∗ to Carol, and Bob broadcasts jamming signals λB1s→B with length s→B=M∗ simultaneously. The signal received by Carol is y→C1=λA1hAC1s→A+λB1hBC1s→B+n→C1, where n→C is the noise vector at Carol, and s→A and s→B are the known probe signals. In t2, Carol transmits probe signals s→C with length s→C to Alice. The signals received by Alice and Bob are y→A1=hAC1s→C+n→A1 and y→B1=hBCs→C1+n→B1, respectively, where s→A=s→B=s→C=s→.Step (2) Repeat Step (1)N times. Then, Alice, Bob, and Carol have the N vectors as follows:
(1)y→Ai=hACis→C+n→Ai,(2)y→Bi=hBCis→C+n→Bi,(3)y→Ci=λAihACis→A+λBihBCis→B+n→CiStep (3) Bob estimateshBCi by using the following equation:
(4)h→BCi≜y→Bis→Ts→2=hBCi+n→Bis→Ts→2Step (4) Bob sendsh→BCi and λBi to Alice over the secure channel between them.Step (5) Alice first computes(5)y→~Ai≜λAiy→Ai+λBih→BCis→=λAihACi+λBih→BCis→+λAin→Ai.Then, Alice obtains the following equality:(6)y^Ai≜y→~Ais→Ts→2=λAihACi+λBih~BCi+λAin→Ais→Ts→2Step (6) Carol computes(7)y^Ai≜y→Ais→Ts→2=λAihACi+λBihBCi+n→Cis→Ts→2After the above steps, Alice and Carol have theN vectors y^A→≜<y^Aii=1N> and y^C→≜<y^Cii=1N>, respectively.


#### 3.1.2. Low Entropy Measurement Elimination

When the absolute values ofhAC and hBC are small in a coherence time, the absolute values λAhAC+λBhBC are also small. Thus, these measurements have low entropy during the coherence time. For example, Figure 1(a) plots the first 104 measurements at Alice, where there are 50 measurement values in each coherence time. We can see that the measurements with sample number between 800 and 850 have low entropy.Figure 1
Reprocessing of measurements before bit quantization.
(a)
The first 104 measurements at Alice(b)
The first 500 measurements at Alice with low entropy measurements elimination(c)
The first 500 measurements at Alice with random permutationTo obtain a high key entropy, we must eliminate the low entropy measurements. The elimination method is described as follows: Alice and Carol drop instances of their measurements if there are at leastβ successive measurements lied between −α and α. Then, they exchange index set of dropped measurements between them, and only keep the measurements that both two devices decide not to drop, where α≥0 and β≥0 are the carefully chosen constants. We still denote the obtained vector after low entropy measurement elimination at Alice and Carol by y^Aii=1N1 and y^Cii=1N1, respectively.Figure1(b) shows the first two hundred measurements at Alice with low entropy measurement elimination.


#### 3.1.3. Random Permutation

Since the values of channel gains are similar during each coherence time, the measurement valuesy^A (and y^C) at Alice (and Carol) has a certain correlation in the coherence time (Figure 1(b)). In the proposed scheme, we break that correlation by using random permutation. In practical experiments, a simple algorithm Knuth shuffle [29] is applied to generate a permutation uniformly at random without retries, in the practical experiments. Specifically, after obtaining y^Cii=1N1, Alice runs the algorithm Knuth shuffle to generate a permutation g:1,⋯,N1→1,⋯,N1 and then transmits it to Carol. Finally, Alice and Carol compute z→A=y^Agii=1N1 and z→C=y^Cgii=1N1, respectively.For example, ify^A→=<−1,0,1> and g=2,1,3, then z→A=<0,−1,1>. Figure 1(c) plots the measurements at Alice with random permutation.


#### 3.1.4. Adaptive Multiple-Bit Extraction

In the implementation, we presentadaptive multiple-bit extraction scheme (as shown in Figure 2) which is described as follows:
(1)
Alice and Carol select a positive integerω as the bitnumber extracted for each channel measurement and choose two positive integers γ (named the valid zone width) and △γ (called the shield zone width)(2)
Letκ=γ+△γ, where κ is called the block size. They divide z→A and z→C into small blocks with length κ, respectively(3)
For any block,(8)z→ξi=<z→ξi−1κ+1,⋯,z→ξiκ>ξ∈A,Cthey (1) sort the elements of a sequence in ascending order; (2) for any j∈1,⋯,2ω, map the rank from j−1γ+△γ+1 to j−1γ+△γ+γ elements (named level j−1) into j−1; (3) drop the remainder of channel measurements; and (4) exchange their dropped measurements list and keep the valid indices
(4)
Alice and Carol obtain the corresponding bit streams by using theω-bit Gary code g:0,⋯,2ω−1→0,1ω, respectively. The bit streams after bit quantization is denoted as KAq and KCqFigure 2
Adaptive multiple-bit extraction withω=2, γ=10, and Δγ=4.


#### 3.1.5. Information Reconciliation and Privacy Amplification

Because of the half-duplex beacon transmission and hardware variations, a small number of bit inconsistencies may exist between their bit streams. There are two ways to realize information reconciliation: interactive information reconciliation (IIR) scheme [30] or error-correcting codes (ECC) [31]. In the implementation, we use ECC-based information reconciliation (i.e., [127,85,13]-BCH code).Moreover, as the reconciliation information is sent over a public and insecure channel, the adversary can leverage such information to obtain knowledge of the generated key. Privacy amplification protocols [32, 33] can be used to recover such entropy loss. In the proposed scheme, the keying hash function SHA1 [32] is leveraged for privacy amplification.


### 3.2. Theoretical Analysis

#### 3.2.1. Theoretical Result

For mathematical simplicity, we denote the sample numberM in Tc by
(9)M=fsTcL=M2M∗=fsTc2M∗,where L is the number of rounds in Tc and r is the largest integer equal or less than to real number r.LetT be the total measurement time (e.g., the sum of all of the probing time). As shown in Figure 3, we divide T as follows. First dividing T to L∗ parts, where each part equals to coherence time Tc (i.e., L∗=T/Tc). Then, splitting Tc into L parts: t1,⋯,tL equally. In time slot ti, Alice, Bob, and Carol follow the first step of the presented protocol. All the RVs of obtained measurement values at Alice and Carol are
(10)Y^Ai≜ΛAiHAC+ΛBiH~BC+ΛAiℕAs→Ts→2,Y^Ci≜ΛAiHAC+ΛBiHBC+ℕCs→Ts→2,where i∈1,⋯,L×L∗, H~BC=HBC+ℕBs→T/s→2, Njj∈A,B,C is the additive noise, and Nj is independent and identically distributed of random variable Njj∈A,B,C. In addition, the random vector of received signals at Eve are
(11)YE⟵ABi≜ΛAiHAEs→+ΛBiHBEs→+ℕE,YE⟵Ci≜HCEs→+ℕE,where i∈1,⋯,L×L∗, ℕE the additive noise vector.Figure 3
Time division, whereT is the total measurement time (e.g., the sum of all of the probing time) and Tcl=Tcl=1,⋯,L∗.After obtainingYE←ABi and YE←Ci, the optimal strategy of Eve is to compute
(12)Y^AEi≜YE⟵ABis→Ts→2=ΛAiHAE+ΛBiHBE+ℕCs→Ts→2,Y^CEi≜YE⟵Cis→Ts→2=HCE+ℕEs→Ts→2,where i∈1,⋯,L×L∗.Based on the measurements at Alice, Carol, and Eve, the theorem is shown as follows.Theorem 1.
LetδAC2=δBC2=1. If the gains of channel between two devices is i.i.d. across coherence periods and the number of sampling M∗ in tii=1,2,⋯,N is large enough, then the maximum key generation rate RM of the presented protocol can be bounded by
(13)RM≥L2TClnπeb2−e−1,where Tc is the coherence time, M∗ is the length of probe signals for each measurement value, fs is the sampling rate, L=Tcfs/2M∗ is the number of rounds in Tc, and b2 is the average power at Alice and Bob.Proof.
Please refer to the Appendix.


#### 3.2.2. Numerical Analysis

The impact of the parameterM∗ on the key rate of the proposed scheme is first discussed. On the one hand, the larger the value of M∗ means the more accurate measurement, the more accurate measurement represents the less information loss in information reconcile and hence the higher key rate. An experiment is conducted in MATLAB as follows. We generate a random vector G=Gii=1M∗ by using a random number generator with zero mean and variance 1. That is, G is the i.i.d. variable obeying standard normal distribution G0,1. Figure 4 plots the statistical average value of G in 104 independent experiments under different values of M∗ (i.e., the length of G). On the other hand, the smaller the value of M∗ is, the more the number L of measurements of coherence time will be, yet the higher key rate.Figure 4
The mean of i.i.d. random variablesG with standard normal distribution in 104 independent experiments under different length M∗.Then, we discuss the impact of the value ofb on the key rate. From Theorem 1, the key generation rate rises when the value of b increases. Furthermore, the key rate converges to infinite when b goes to infinite. As an example, for the parameters Tc=50ms, Figure 5(a) plots the achievable key rate when b increases under different values of L. Note that the jamming power of helper Bob is denoted by PI=b2. Thus, the key generation rate rises when the jamming PI increases, and the key rate converges to infinite when PI goes to infinite. However, due to the logarithmic relationship between the achievable key rate and the value of b, the key rate growth is slow with the value of b increase. It can also be obtained from Figure 5(a).Figure 5
(a) The theoretical achievable key rate versus the upper boundb of Λ under different value of L. (b) The theoretical achievable key rate versus the upper bound b of Λ under different value of L.
(a)(b)Lastly, we compared the proposed scheme with traditional schemes. By [34], the maximum key generation rate of traditional methods is 1/TcHHAC=1/2Tcln2πeδAC2. Take Tc=50ms, fs=4GHz, 104≤M∗≤105, and δAC=δBC=1. Figure 5(b) plots the performance of traditional methods versus the proposed scheme. Moreover, if we fixed M∗ and fs, then, from L=Tcfs/2M∗, we have L is proportional to Tc. Specially, if we take Tc=200 (the coherence time Tc can be up to 100-500 ms in static environment), fs=4GHz (the sampling frequency of off-shelf-802.11 can achieve 20GHz) and M∗=104, then L=100. That is to say, the key generation rate of the proposed scheme is at least 100× better than that of traditional methods.


## 3.1. The Proposed Key Generation Protocol

The artificial-jamming-based secret key extraction consists of five components: (1) collection of random source, (2) low entropy measurements elimination, (3) random permutation, (4) adaptive multiple-bit extraction, and (5) information reconciliation and privacy amplification.


### 3.1.1. Collection of Random Source

LetΛ be a Gaussian distribution with mean of 0 and variance of b2 and M∗ be the probe vector length of measurement. The time is divided into slots t1,t2,···.Step (1) Int1, Alice and Bob random choose λA1 and λB1 from Λ∼G0,b2, respectively. Then, Alice transmits probe signals λA1s→A with length s→A=M∗ to Carol, and Bob broadcasts jamming signals λB1s→B with length s→B=M∗ simultaneously. The signal received by Carol is y→C1=λA1hAC1s→A+λB1hBC1s→B+n→C1, where n→C is the noise vector at Carol, and s→A and s→B are the known probe signals. In t2, Carol transmits probe signals s→C with length s→C to Alice. The signals received by Alice and Bob are y→A1=hAC1s→C+n→A1 and y→B1=hBCs→C1+n→B1, respectively, where s→A=s→B=s→C=s→.Step (2) Repeat Step (1)N times. Then, Alice, Bob, and Carol have the N vectors as follows:
(1)y→Ai=hACis→C+n→Ai,(2)y→Bi=hBCis→C+n→Bi,(3)y→Ci=λAihACis→A+λBihBCis→B+n→CiStep (3) Bob estimateshBCi by using the following equation:
(4)h→BCi≜y→Bis→Ts→2=hBCi+n→Bis→Ts→2Step (4) Bob sendsh→BCi and λBi to Alice over the secure channel between them.Step (5) Alice first computes(5)y→~Ai≜λAiy→Ai+λBih→BCis→=λAihACi+λBih→BCis→+λAin→Ai.Then, Alice obtains the following equality:(6)y^Ai≜y→~Ais→Ts→2=λAihACi+λBih~BCi+λAin→Ais→Ts→2Step (6) Carol computes(7)y^Ai≜y→Ais→Ts→2=λAihACi+λBihBCi+n→Cis→Ts→2After the above steps, Alice and Carol have theN vectors y^A→≜<y^Aii=1N> and y^C→≜<y^Cii=1N>, respectively.


### 3.1.2. Low Entropy Measurement Elimination

When the absolute values ofhAC and hBC are small in a coherence time, the absolute values λAhAC+λBhBC are also small. Thus, these measurements have low entropy during the coherence time. For example, Figure 1(a) plots the first 104 measurements at Alice, where there are 50 measurement values in each coherence time. We can see that the measurements with sample number between 800 and 850 have low entropy.Figure 1
Reprocessing of measurements before bit quantization.
(a)
The first 104 measurements at Alice(b)
The first 500 measurements at Alice with low entropy measurements elimination(c)
The first 500 measurements at Alice with random permutationTo obtain a high key entropy, we must eliminate the low entropy measurements. The elimination method is described as follows: Alice and Carol drop instances of their measurements if there are at leastβ successive measurements lied between −α and α. Then, they exchange index set of dropped measurements between them, and only keep the measurements that both two devices decide not to drop, where α≥0 and β≥0 are the carefully chosen constants. We still denote the obtained vector after low entropy measurement elimination at Alice and Carol by y^Aii=1N1 and y^Cii=1N1, respectively.Figure1(b) shows the first two hundred measurements at Alice with low entropy measurement elimination.


### 3.1.3. Random Permutation

Since the values of channel gains are similar during each coherence time, the measurement valuesy^A (and y^C) at Alice (and Carol) has a certain correlation in the coherence time (Figure 1(b)). In the proposed scheme, we break that correlation by using random permutation. In practical experiments, a simple algorithm Knuth shuffle [29] is applied to generate a permutation uniformly at random without retries, in the practical experiments. Specifically, after obtaining y^Cii=1N1, Alice runs the algorithm Knuth shuffle to generate a permutation g:1,⋯,N1→1,⋯,N1 and then transmits it to Carol. Finally, Alice and Carol compute z→A=y^Agii=1N1 and z→C=y^Cgii=1N1, respectively.For example, ify^A→=<−1,0,1> and g=2,1,3, then z→A=<0,−1,1>. Figure 1(c) plots the measurements at Alice with random permutation.


### 3.1.4. Adaptive Multiple-Bit Extraction

In the implementation, we presentadaptive multiple-bit extraction scheme (as shown in Figure 2) which is described as follows:
(1)
Alice and Carol select a positive integerω as the bitnumber extracted for each channel measurement and choose two positive integers γ (named the valid zone width) and △γ (called the shield zone width)(2)
Letκ=γ+△γ, where κ is called the block size. They divide z→A and z→C into small blocks with length κ, respectively(3)
For any block,(8)z→ξi=<z→ξi−1κ+1,⋯,z→ξiκ>ξ∈A,Cthey (1) sort the elements of a sequence in ascending order; (2) for any j∈1,⋯,2ω, map the rank from j−1γ+△γ+1 to j−1γ+△γ+γ elements (named level j−1) into j−1; (3) drop the remainder of channel measurements; and (4) exchange their dropped measurements list and keep the valid indices
(4)
Alice and Carol obtain the corresponding bit streams by using theω-bit Gary code g:0,⋯,2ω−1→0,1ω, respectively. The bit streams after bit quantization is denoted as KAq and KCqFigure 2
Adaptive multiple-bit extraction withω=2, γ=10, and Δγ=4.


### 3.1.5. Information Reconciliation and Privacy Amplification

Because of the half-duplex beacon transmission and hardware variations, a small number of bit inconsistencies may exist between their bit streams. There are two ways to realize information reconciliation: interactive information reconciliation (IIR) scheme [30] or error-correcting codes (ECC) [31]. In the implementation, we use ECC-based information reconciliation (i.e., [127,85,13]-BCH code).Moreover, as the reconciliation information is sent over a public and insecure channel, the adversary can leverage such information to obtain knowledge of the generated key. Privacy amplification protocols [32, 33] can be used to recover such entropy loss. In the proposed scheme, the keying hash function SHA1 [32] is leveraged for privacy amplification.


## 3.1.1. Collection of Random Source

LetΛ be a Gaussian distribution with mean of 0 and variance of b2 and M∗ be the probe vector length of measurement. The time is divided into slots t1,t2,···.Step (1) Int1, Alice and Bob random choose λA1 and λB1 from Λ∼G0,b2, respectively. Then, Alice transmits probe signals λA1s→A with length s→A=M∗ to Carol, and Bob broadcasts jamming signals λB1s→B with length s→B=M∗ simultaneously. The signal received by Carol is y→C1=λA1hAC1s→A+λB1hBC1s→B+n→C1, where n→C is the noise vector at Carol, and s→A and s→B are the known probe signals. In t2, Carol transmits probe signals s→C with length s→C to Alice. The signals received by Alice and Bob are y→A1=hAC1s→C+n→A1 and y→B1=hBCs→C1+n→B1, respectively, where s→A=s→B=s→C=s→.Step (2) Repeat Step (1)N times. Then, Alice, Bob, and Carol have the N vectors as follows:
(1)y→Ai=hACis→C+n→Ai,(2)y→Bi=hBCis→C+n→Bi,(3)y→Ci=λAihACis→A+λBihBCis→B+n→CiStep (3) Bob estimateshBCi by using the following equation:
(4)h→BCi≜y→Bis→Ts→2=hBCi+n→Bis→Ts→2Step (4) Bob sendsh→BCi and λBi to Alice over the secure channel between them.Step (5) Alice first computes(5)y→~Ai≜λAiy→Ai+λBih→BCis→=λAihACi+λBih→BCis→+λAin→Ai.Then, Alice obtains the following equality:(6)y^Ai≜y→~Ais→Ts→2=λAihACi+λBih~BCi+λAin→Ais→Ts→2Step (6) Carol computes(7)y^Ai≜y→Ais→Ts→2=λAihACi+λBihBCi+n→Cis→Ts→2After the above steps, Alice and Carol have theN vectors y^A→≜<y^Aii=1N> and y^C→≜<y^Cii=1N>, respectively.


## 3.1.2. Low Entropy Measurement Elimination

When the absolute values ofhAC and hBC are small in a coherence time, the absolute values λAhAC+λBhBC are also small. Thus, these measurements have low entropy during the coherence time. For example, Figure 1(a) plots the first 104 measurements at Alice, where there are 50 measurement values in each coherence time. We can see that the measurements with sample number between 800 and 850 have low entropy.Figure 1
Reprocessing of measurements before bit quantization.
(a)
The first 104 measurements at Alice(b)
The first 500 measurements at Alice with low entropy measurements elimination(c)
The first 500 measurements at Alice with random permutationTo obtain a high key entropy, we must eliminate the low entropy measurements. The elimination method is described as follows: Alice and Carol drop instances of their measurements if there are at leastβ successive measurements lied between −α and α. Then, they exchange index set of dropped measurements between them, and only keep the measurements that both two devices decide not to drop, where α≥0 and β≥0 are the carefully chosen constants. We still denote the obtained vector after low entropy measurement elimination at Alice and Carol by y^Aii=1N1 and y^Cii=1N1, respectively.Figure1(b) shows the first two hundred measurements at Alice with low entropy measurement elimination.


## 3.1.3. Random Permutation

Since the values of channel gains are similar during each coherence time, the measurement valuesy^A (and y^C) at Alice (and Carol) has a certain correlation in the coherence time (Figure 1(b)). In the proposed scheme, we break that correlation by using random permutation. In practical experiments, a simple algorithm Knuth shuffle [29] is applied to generate a permutation uniformly at random without retries, in the practical experiments. Specifically, after obtaining y^Cii=1N1, Alice runs the algorithm Knuth shuffle to generate a permutation g:1,⋯,N1→1,⋯,N1 and then transmits it to Carol. Finally, Alice and Carol compute z→A=y^Agii=1N1 and z→C=y^Cgii=1N1, respectively.For example, ify^A→=<−1,0,1> and g=2,1,3, then z→A=<0,−1,1>. Figure 1(c) plots the measurements at Alice with random permutation.


## 3.1.4. Adaptive Multiple-Bit Extraction

In the implementation, we presentadaptive multiple-bit extraction scheme (as shown in Figure 2) which is described as follows:
(1)
Alice and Carol select a positive integerω as the bitnumber extracted for each channel measurement and choose two positive integers γ (named the valid zone width) and △γ (called the shield zone width)(2)
Letκ=γ+△γ, where κ is called the block size. They divide z→A and z→C into small blocks with length κ, respectively(3)
For any block,(8)z→ξi=<z→ξi−1κ+1,⋯,z→ξiκ>ξ∈A,Cthey (1) sort the elements of a sequence in ascending order; (2) for any j∈1,⋯,2ω, map the rank from j−1γ+△γ+1 to j−1γ+△γ+γ elements (named level j−1) into j−1; (3) drop the remainder of channel measurements; and (4) exchange their dropped measurements list and keep the valid indices
(4)
Alice and Carol obtain the corresponding bit streams by using theω-bit Gary code g:0,⋯,2ω−1→0,1ω, respectively. The bit streams after bit quantization is denoted as KAq and KCqFigure 2
Adaptive multiple-bit extraction withω=2, γ=10, and Δγ=4.


## 3.1.5. Information Reconciliation and Privacy Amplification

Because of the half-duplex beacon transmission and hardware variations, a small number of bit inconsistencies may exist between their bit streams. There are two ways to realize information reconciliation: interactive information reconciliation (IIR) scheme [30] or error-correcting codes (ECC) [31]. In the implementation, we use ECC-based information reconciliation (i.e., [127,85,13]-BCH code).Moreover, as the reconciliation information is sent over a public and insecure channel, the adversary can leverage such information to obtain knowledge of the generated key. Privacy amplification protocols [32, 33] can be used to recover such entropy loss. In the proposed scheme, the keying hash function SHA1 [32] is leveraged for privacy amplification.


## 3.2. Theoretical Analysis

### 3.2.1. Theoretical Result

For mathematical simplicity, we denote the sample numberM in Tc by
(9)M=fsTcL=M2M∗=fsTc2M∗,where L is the number of rounds in Tc and r is the largest integer equal or less than to real number r.LetT be the total measurement time (e.g., the sum of all of the probing time). As shown in Figure 3, we divide T as follows. First dividing T to L∗ parts, where each part equals to coherence time Tc (i.e., L∗=T/Tc). Then, splitting Tc into L parts: t1,⋯,tL equally. In time slot ti, Alice, Bob, and Carol follow the first step of the presented protocol. All the RVs of obtained measurement values at Alice and Carol are
(10)Y^Ai≜ΛAiHAC+ΛBiH~BC+ΛAiℕAs→Ts→2,Y^Ci≜ΛAiHAC+ΛBiHBC+ℕCs→Ts→2,where i∈1,⋯,L×L∗, H~BC=HBC+ℕBs→T/s→2, Njj∈A,B,C is the additive noise, and Nj is independent and identically distributed of random variable Njj∈A,B,C. In addition, the random vector of received signals at Eve are
(11)YE⟵ABi≜ΛAiHAEs→+ΛBiHBEs→+ℕE,YE⟵Ci≜HCEs→+ℕE,where i∈1,⋯,L×L∗, ℕE the additive noise vector.Figure 3
Time division, whereT is the total measurement time (e.g., the sum of all of the probing time) and Tcl=Tcl=1,⋯,L∗.After obtainingYE←ABi and YE←Ci, the optimal strategy of Eve is to compute
(12)Y^AEi≜YE⟵ABis→Ts→2=ΛAiHAE+ΛBiHBE+ℕCs→Ts→2,Y^CEi≜YE⟵Cis→Ts→2=HCE+ℕEs→Ts→2,where i∈1,⋯,L×L∗.Based on the measurements at Alice, Carol, and Eve, the theorem is shown as follows.Theorem 1.
LetδAC2=δBC2=1. If the gains of channel between two devices is i.i.d. across coherence periods and the number of sampling M∗ in tii=1,2,⋯,N is large enough, then the maximum key generation rate RM of the presented protocol can be bounded by
(13)RM≥L2TClnπeb2−e−1,where Tc is the coherence time, M∗ is the length of probe signals for each measurement value, fs is the sampling rate, L=Tcfs/2M∗ is the number of rounds in Tc, and b2 is the average power at Alice and Bob.Proof.
Please refer to the Appendix.


### 3.2.2. Numerical Analysis

The impact of the parameterM∗ on the key rate of the proposed scheme is first discussed. On the one hand, the larger the value of M∗ means the more accurate measurement, the more accurate measurement represents the less information loss in information reconcile and hence the higher key rate. An experiment is conducted in MATLAB as follows. We generate a random vector G=Gii=1M∗ by using a random number generator with zero mean and variance 1. That is, G is the i.i.d. variable obeying standard normal distribution G0,1. Figure 4 plots the statistical average value of G in 104 independent experiments under different values of M∗ (i.e., the length of G). On the other hand, the smaller the value of M∗ is, the more the number L of measurements of coherence time will be, yet the higher key rate.Figure 4
The mean of i.i.d. random variablesG with standard normal distribution in 104 independent experiments under different length M∗.Then, we discuss the impact of the value ofb on the key rate. From Theorem 1, the key generation rate rises when the value of b increases. Furthermore, the key rate converges to infinite when b goes to infinite. As an example, for the parameters Tc=50ms, Figure 5(a) plots the achievable key rate when b increases under different values of L. Note that the jamming power of helper Bob is denoted by PI=b2. Thus, the key generation rate rises when the jamming PI increases, and the key rate converges to infinite when PI goes to infinite. However, due to the logarithmic relationship between the achievable key rate and the value of b, the key rate growth is slow with the value of b increase. It can also be obtained from Figure 5(a).Figure 5
(a) The theoretical achievable key rate versus the upper boundb of Λ under different value of L. (b) The theoretical achievable key rate versus the upper bound b of Λ under different value of L.
(a)(b)Lastly, we compared the proposed scheme with traditional schemes. By [34], the maximum key generation rate of traditional methods is 1/TcHHAC=1/2Tcln2πeδAC2. Take Tc=50ms, fs=4GHz, 104≤M∗≤105, and δAC=δBC=1. Figure 5(b) plots the performance of traditional methods versus the proposed scheme. Moreover, if we fixed M∗ and fs, then, from L=Tcfs/2M∗, we have L is proportional to Tc. Specially, if we take Tc=200 (the coherence time Tc can be up to 100-500 ms in static environment), fs=4GHz (the sampling frequency of off-shelf-802.11 can achieve 20GHz) and M∗=104, then L=100. That is to say, the key generation rate of the proposed scheme is at least 100× better than that of traditional methods.


## 3.2.1. Theoretical Result

For mathematical simplicity, we denote the sample numberM in Tc by
(9)M=fsTcL=M2M∗=fsTc2M∗,where L is the number of rounds in Tc and r is the largest integer equal or less than to real number r.LetT be the total measurement time (e.g., the sum of all of the probing time). As shown in Figure 3, we divide T as follows. First dividing T to L∗ parts, where each part equals to coherence time Tc (i.e., L∗=T/Tc). Then, splitting Tc into L parts: t1,⋯,tL equally. In time slot ti, Alice, Bob, and Carol follow the first step of the presented protocol. All the RVs of obtained measurement values at Alice and Carol are
(10)Y^Ai≜ΛAiHAC+ΛBiH~BC+ΛAiℕAs→Ts→2,Y^Ci≜ΛAiHAC+ΛBiHBC+ℕCs→Ts→2,where i∈1,⋯,L×L∗, H~BC=HBC+ℕBs→T/s→2, Njj∈A,B,C is the additive noise, and Nj is independent and identically distributed of random variable Njj∈A,B,C. In addition, the random vector of received signals at Eve are
(11)YE⟵ABi≜ΛAiHAEs→+ΛBiHBEs→+ℕE,YE⟵Ci≜HCEs→+ℕE,where i∈1,⋯,L×L∗, ℕE the additive noise vector.Figure 3
Time division, whereT is the total measurement time (e.g., the sum of all of the probing time) and Tcl=Tcl=1,⋯,L∗.After obtainingYE←ABi and YE←Ci, the optimal strategy of Eve is to compute
(12)Y^AEi≜YE⟵ABis→Ts→2=ΛAiHAE+ΛBiHBE+ℕCs→Ts→2,Y^CEi≜YE⟵Cis→Ts→2=HCE+ℕEs→Ts→2,where i∈1,⋯,L×L∗.Based on the measurements at Alice, Carol, and Eve, the theorem is shown as follows.Theorem 1.
LetδAC2=δBC2=1. If the gains of channel between two devices is i.i.d. across coherence periods and the number of sampling M∗ in tii=1,2,⋯,N is large enough, then the maximum key generation rate RM of the presented protocol can be bounded by
(13)RM≥L2TClnπeb2−e−1,where Tc is the coherence time, M∗ is the length of probe signals for each measurement value, fs is the sampling rate, L=Tcfs/2M∗ is the number of rounds in Tc, and b2 is the average power at Alice and Bob.Proof.
Please refer to the Appendix.


## 3.2.2. Numerical Analysis

The impact of the parameterM∗ on the key rate of the proposed scheme is first discussed. On the one hand, the larger the value of M∗ means the more accurate measurement, the more accurate measurement represents the less information loss in information reconcile and hence the higher key rate. An experiment is conducted in MATLAB as follows. We generate a random vector G=Gii=1M∗ by using a random number generator with zero mean and variance 1. That is, G is the i.i.d. variable obeying standard normal distribution G0,1. Figure 4 plots the statistical average value of G in 104 independent experiments under different values of M∗ (i.e., the length of G). On the other hand, the smaller the value of M∗ is, the more the number L of measurements of coherence time will be, yet the higher key rate.Figure 4
The mean of i.i.d. random variablesG with standard normal distribution in 104 independent experiments under different length M∗.Then, we discuss the impact of the value ofb on the key rate. From Theorem 1, the key generation rate rises when the value of b increases. Furthermore, the key rate converges to infinite when b goes to infinite. As an example, for the parameters Tc=50ms, Figure 5(a) plots the achievable key rate when b increases under different values of L. Note that the jamming power of helper Bob is denoted by PI=b2. Thus, the key generation rate rises when the jamming PI increases, and the key rate converges to infinite when PI goes to infinite. However, due to the logarithmic relationship between the achievable key rate and the value of b, the key rate growth is slow with the value of b increase. It can also be obtained from Figure 5(a).Figure 5
(a) The theoretical achievable key rate versus the upper boundb of Λ under different value of L. (b) The theoretical achievable key rate versus the upper bound b of Λ under different value of L.
(a)(b)Lastly, we compared the proposed scheme with traditional schemes. By [34], the maximum key generation rate of traditional methods is 1/TcHHAC=1/2Tcln2πeδAC2. Take Tc=50ms, fs=4GHz, 104≤M∗≤105, and δAC=δBC=1. Figure 5(b) plots the performance of traditional methods versus the proposed scheme. Moreover, if we fixed M∗ and fs, then, from L=Tcfs/2M∗, we have L is proportional to Tc. Specially, if we take Tc=200 (the coherence time Tc can be up to 100-500 ms in static environment), fs=4GHz (the sampling frequency of off-shelf-802.11 can achieve 20GHz) and M∗=104, then L=100. That is to say, the key generation rate of the proposed scheme is at least 100× better than that of traditional methods.


## 4. Experimental Results and Discussions

### 4.1. Experiment Setting

In the random source collection phase, it is assumed that both the artificial jamming and probes aresingle-tone signals. The probe signals are sτ=a0cosω0τ+θ0 (τ∈0,T), where a0 is the amplitude, θ0 is the initial phase, and ω0 is the angular frequency. Specifically, the probing signals are based on λA (or λB) at jamming slots (i.e., Alice sends λAsτ and Bob sends λBsτ,τ∈0,T, at time slot t1). It is also assumed that the coherence time is Tc=80ms, the sampling rate is fs=2.7GHz, and the single-tone signal’s carrier frequency is 0.9 GHz.In the information reconciliation phase, we assume that [127,85,13]-BCH code is used in our system. It is clear that the error tolerance of the code isET=Δ6/127≈0.047 (i.e., error threshold). Specifically, Alice (resp., Carol) divides the quantized bits KAq (resp. KCq) into small blocks KAq1,⋯,KAqi,⋯ (resp. KCq1,⋯,KCqi,⋯) with block length 127, respectively. For each block KAqi (i=1,2,⋯), Alice randomly chooses a codeword Ci from [127,85,13]-BCH codebook and sends KAq⊕Ci to Carol. After receiving KAqi⊕Ci, Carol computes Ci∗≜KCq⊕KAq⊕Ci (note that the position of “1” in bits KCq⊕KAq means the mismatch between Alice and Carol happens in corresponding position). Thus, if the number of “1” in KCq⊕KAq is less than 6, Carol can obtain Ci from Ci∗ with error-correcting code technical, and then, compute KAqi by computing Ci⊕Ci∗⊕KCq. If we denote the bits after information reconciliation as KAr and KCr. Then, the common randomness KA=KAr=KCr between Alice and Carol is established when the mismatch bit number of each block is less than 6.In the privacy amplification phase, we leverage the keying hash functionSHA1 [32]. Specifically, a keying hash function F:K0×K1→K, where F is the well-known hash function SHA1, K0=K1=0,1L, and K=0,1L′. One of keying nodes (say Alice) uniformly chooses K0 form K0 and public to the other node. Then, keying nodes compute the secret key by Kξ=FK0,Kξrξ∈A,C. Moreover, in order to verify whether the two values KA and KC are equal, Alice and Carol can interact as follows. Alice first randomly chooses a bitstream RA and then sends RA and its tig TigA=SHA1KA,RA to Carol. After receiving RA and TigA, Carol computes TigB=SHA1KB,RA, and verify TigA=TigB or not, if so, KA and KC are equal; if not, KA≠KC.


### 4.2. Correlations between Keying Nodes and Eve

The statistic independence of the measurements of channel between Alice, Carol, and Eve is the hinge on the security of generated key. Figure6 plots Pearson correlation coefficients of the measurements at the Alice and Eve against α under different values of β (β=5,10,⋯,50), where b=2 and M=2000. The result shows that, with a fixed α=0.09, the correlation coefficients is at a very low level. Take α=0.09, Figure 7 shows the valid index rate (i.e., the ratio of the number of valid index after the phase of low entropy measurements elimination to the number of measurements at Alice) and the correlation coefficients against β. We can see that, with a fixed β=10, the valid index rate is greater than 0.7 and the correlation coefficients keep to a minimum. In the system, we set α=0.09 and β=10. Figure 8 plots the measurments at Alice and Eve by taking SNR=0 dB and b=2. It is obvious that Eve measures significantly different values from Alice (i.e., spatial variations of wireless channel). The result shows that the proposed scheme can resist predictable channel attacks.Figure 6
Correlation coefficients againstα under different values of β, where M∗=2000 and b=2.Figure 7
Valid index rate and correlation coefficients againstβ, where where SNR=0 dB, M∗=2000, b=2, and α=0.09.Figure 8
Measurements at Alice and Eve, whereSNR=0 dB, M∗=2000, and b=2.


### 4.3. Mismatch Rate and Conditional Entropy

The impact of system parameterω on the mismatch rate and the number of matched bits before the information reconciliation and privacy amplification phase is first considered. Figures 9 and 10 plot the mismatch rate and the number of matched bits versus Δγ under different values of b, where SNR=0 dB, M=2000, γ=20, and Δγ=10. The results show that (1) a larger ω increases the number of matched bits but increases the mismatch rate; and (2) a larger b increases the number of matched bits and decreases the mismatch rate, in other words, a larger b can contribute to more bits extracted from each measurement. In particular, if b=2, then the mismatch rate is less than the error threshold when ω=2 and is larger than error threshold when ω=3. Thus, if we take b=2 in the system, then ω=2 is the optimal choice to maximize the key rate.Figure 9
The mismatch rate versusω under different values of b, where SNR=0 dB and M∗=2000.Figure 10
The number of matched bits versusω under different values of b, where SNR=0 dB and M∗=2000.Then the impact of the parametersγ and Δγ on mismatch rate and number of matched bits are discussed. Figures 11 and 12 plot the mismatch rate and the number of matched bits versus Δγ under different values of M∗, where SNR=0dB, b=2, ω=2, and γ=20. Figures 13 and 14 show mismatch rate and match number versus Δγ under different values of b, where SNR=0dB, M∗=2000. The experimental results show that (i) the increase of M∗ and Δγ decrease the mismatch rate and the matched bits number. However, less mismatch rate means higher key rate, and fewer match number implies lower key generation rate. Thus, the value of M∗ and Δγ should be chosen carefully. (ii) The increase of b decreases the mismatch rate and increases the match rate, and hence, the higher key rate is guaranteed.Figure 11
The mismatch rate versusΔγ under different values of M∗.Figure 12
The number of matched bits versusΔγ under different values of M∗.Figure 13
The mismatch rate versusΔγ under different values of b.Figure 14
The number of matched bits versusΔγ under different values of b.The next, the impact of the system parametersγ and Δγ on the conditional entropy HKAq∣KEq are discussed, where KAq and KEq are the bit streams at Alice and Eve after quantizing, respectively, and HKAq∣KEq=∑i,jPrAEi,jlog1/PrA∣Ei∣j for i,j∈0,1. Figure 15 plots the relationship between the value of Δγ, M∗ and the conditional entropy. For instance, the conditional entropies are larger than 0.68 and less than 0.7. Figure 16 shows the conditional entropy against Δγ under different values of b. In particular, all of the conditional entropies are larger than 0.68 and less than 0.7. The results show that Δγ, M∗, and b cause little impact to conditional entropy.Figure 15
The correlation between conditional entropy andΔγ under different values of M∗.Figure 16
The correlation between conditional entropy andΔγ under different values of b.


### 4.4. Key Rate and Randomness

Note that the bit streams after information reconciliation asKAr and KCr and denote the error-correcting information as Pub. Due to the fact that the conditional entropy HKAq∣KEq is less than 0.7, the conditional entropies HKAr∣KEq,Pub≤HKAq∣KEq,Pub≤HKAq∣KCq<0.7. To improve the key entropy, in privacy amplification phase of the simulation, we use F:K0×K1→K, where F is the keying hash function SHA1, K0=K1=0,1L, and K=0,1L/2.Takingα=0.09, β=10, γ=20, and b=2, the simulation is conducted in a variety of M∗ and Δγ under different SNRs to find the optimal value of Δγ and M∗ to maximize the key rate (as shown in Table 1).Table 1
The optimal value ofΔγ and M∗.
IndexSNRΔγM∗Mismatch rateBit rateA-10 dB18120000.036868B-5 dB2020000.0465198C0 dB1210000.0439970D5 dB202000.04611910E10 dB111000.04505640Moreover, the randomness of the generated key is the key for the proposed scheme to be widely used. To this end, a well-known randomness test suiteNIST is used to verify the generated key’s randomness. The p value from five kinds of tests is listed in Table 2. If the p value is greater than 0.01, then it means the bitstream passed the test. We conduct the simulation under different scenarios as shown in Table 1.Table 2
NIST statistical test suite results.
TestABCDERuns0.920.890.860.770.65FFT0.870.820.820.780.71Frequency0.890.840.790.730.64Approx. entropy0.910.870.760.670.63Longest run of ones0.830.840.810.780.69


### 4.5. Comparison of Key Extraction Approaches

Some famous key extraction approaches are mentioned (i.e., RKG [8], CSKE [18], and SG [19]) in Section 1. Now, we compare their performance with the proposed scheme under different scenarios: scenario A (SNR=−10 dB), scenario B (SNR=−10 dB), scenario C (SNR=0 dB), scenario D (SNR=5 dB), and scenario E (SNR=10 dB). In SKEAN, the parameter selection is based on the parameter selection in Table 1. In RKG, the quantization threshold is selected so that at most 10% of the whole measurements are discarded. In CSKE, we set m=5 (i.e., the measurements are quantized into 4 equally likely levels) and set the quantization threshold such that at most 30% of the measurements are dropped. In SG, we set the configurable parameters α=0.3, PB=2, and κ=30.The simulation results in Figure17 shows that the protocol has a significantly higher secret bit generation rate compared with the existing methods. This is because (1) RKG only uses the measurements that above or below the threshold, which leads to low utilization of measurements; (2) both RKG and SG only extract 1 bit for each measurement, which lead to low efficiency of quantization; (3) the channel state information in each coherence time are coherent in CSKE, which leads measurements in a coherence time are similar; and (4) the help node only sends fixed jamming signals in each coherence time in SG, which also leads to the measurements in a coherence time are alike.Figure 17
The key rate under different scenarios.


### 4.6. Discussions

The proposed scheme can be used in the typical application scenarios as follows.Let us first consider the scenario with busy wireless channels (e.g., multiple access points and multiple users exist in a conference room, enterprise, hotel, etc.,), in which we try to solve the key generation problem between access points and users (case shown in Figure18(a) where any two adjacent access points (A and B) are connected by Ethernet backbone). In this situation, we could assume that there exists a secure channel between A and B (e.g., Diffie-Hellman protocol can be used to produce a secure channel as the access points are not constrained by the energy and computing ability). Therefore, we can further generate the security key for access points and users by utilizing the proposed scheme with the secure channel.Figure 18
The application scenarios.
(a)
Scenario 1(b)
Scenario 2(c)
Scenario 3(d)
Scenario 4Then we consider the key extraction between two users in the scenario of typical busy wireless environments (scenario (2) shown in Figure 18(b)). Based on the previous case, we can have a secure channel between the access points and users. With the secure channel, we can use the proposed scheme to extract a security key for two users.Next, we consider another key generation problem in the scenario of MISO system (shown in Figure18(c)). When Alice and Bob are the antennas of a device, the “secure channel” exists between them. We can further use the presented protocol to generate a security key for two devices.In the case of group key generation, as shown in Figure18(d), we can use the key extraction scheme (like work [16, 17] to set up a secure channel, then use the proposed scheme for the others. As shown in Figure 18(d), the secure channel 1 is built by traditional protocols and the secure channel 2, 3, 4, ⋯ can be set up by KEI. With no doubt, the efficiency of group key generation can be improved.


## 4.1. Experiment Setting

In the random source collection phase, it is assumed that both the artificial jamming and probes aresingle-tone signals. The probe signals are sτ=a0cosω0τ+θ0 (τ∈0,T), where a0 is the amplitude, θ0 is the initial phase, and ω0 is the angular frequency. Specifically, the probing signals are based on λA (or λB) at jamming slots (i.e., Alice sends λAsτ and Bob sends λBsτ,τ∈0,T, at time slot t1). It is also assumed that the coherence time is Tc=80ms, the sampling rate is fs=2.7GHz, and the single-tone signal’s carrier frequency is 0.9 GHz.In the information reconciliation phase, we assume that [127,85,13]-BCH code is used in our system. It is clear that the error tolerance of the code isET=Δ6/127≈0.047 (i.e., error threshold). Specifically, Alice (resp., Carol) divides the quantized bits KAq (resp. KCq) into small blocks KAq1,⋯,KAqi,⋯ (resp. KCq1,⋯,KCqi,⋯) with block length 127, respectively. For each block KAqi (i=1,2,⋯), Alice randomly chooses a codeword Ci from [127,85,13]-BCH codebook and sends KAq⊕Ci to Carol. After receiving KAqi⊕Ci, Carol computes Ci∗≜KCq⊕KAq⊕Ci (note that the position of “1” in bits KCq⊕KAq means the mismatch between Alice and Carol happens in corresponding position). Thus, if the number of “1” in KCq⊕KAq is less than 6, Carol can obtain Ci from Ci∗ with error-correcting code technical, and then, compute KAqi by computing Ci⊕Ci∗⊕KCq. If we denote the bits after information reconciliation as KAr and KCr. Then, the common randomness KA=KAr=KCr between Alice and Carol is established when the mismatch bit number of each block is less than 6.In the privacy amplification phase, we leverage the keying hash functionSHA1 [32]. Specifically, a keying hash function F:K0×K1→K, where F is the well-known hash function SHA1, K0=K1=0,1L, and K=0,1L′. One of keying nodes (say Alice) uniformly chooses K0 form K0 and public to the other node. Then, keying nodes compute the secret key by Kξ=FK0,Kξrξ∈A,C. Moreover, in order to verify whether the two values KA and KC are equal, Alice and Carol can interact as follows. Alice first randomly chooses a bitstream RA and then sends RA and its tig TigA=SHA1KA,RA to Carol. After receiving RA and TigA, Carol computes TigB=SHA1KB,RA, and verify TigA=TigB or not, if so, KA and KC are equal; if not, KA≠KC.


## 4.2. Correlations between Keying Nodes and Eve

The statistic independence of the measurements of channel between Alice, Carol, and Eve is the hinge on the security of generated key. Figure6 plots Pearson correlation coefficients of the measurements at the Alice and Eve against α under different values of β (β=5,10,⋯,50), where b=2 and M=2000. The result shows that, with a fixed α=0.09, the correlation coefficients is at a very low level. Take α=0.09, Figure 7 shows the valid index rate (i.e., the ratio of the number of valid index after the phase of low entropy measurements elimination to the number of measurements at Alice) and the correlation coefficients against β. We can see that, with a fixed β=10, the valid index rate is greater than 0.7 and the correlation coefficients keep to a minimum. In the system, we set α=0.09 and β=10. Figure 8 plots the measurments at Alice and Eve by taking SNR=0 dB and b=2. It is obvious that Eve measures significantly different values from Alice (i.e., spatial variations of wireless channel). The result shows that the proposed scheme can resist predictable channel attacks.Figure 6
Correlation coefficients againstα under different values of β, where M∗=2000 and b=2.Figure 7
Valid index rate and correlation coefficients againstβ, where where SNR=0 dB, M∗=2000, b=2, and α=0.09.Figure 8
Measurements at Alice and Eve, whereSNR=0 dB, M∗=2000, and b=2.


## 4.3. Mismatch Rate and Conditional Entropy

The impact of system parameterω on the mismatch rate and the number of matched bits before the information reconciliation and privacy amplification phase is first considered. Figures 9 and 10 plot the mismatch rate and the number of matched bits versus Δγ under different values of b, where SNR=0 dB, M=2000, γ=20, and Δγ=10. The results show that (1) a larger ω increases the number of matched bits but increases the mismatch rate; and (2) a larger b increases the number of matched bits and decreases the mismatch rate, in other words, a larger b can contribute to more bits extracted from each measurement. In particular, if b=2, then the mismatch rate is less than the error threshold when ω=2 and is larger than error threshold when ω=3. Thus, if we take b=2 in the system, then ω=2 is the optimal choice to maximize the key rate.Figure 9
The mismatch rate versusω under different values of b, where SNR=0 dB and M∗=2000.Figure 10
The number of matched bits versusω under different values of b, where SNR=0 dB and M∗=2000.Then the impact of the parametersγ and Δγ on mismatch rate and number of matched bits are discussed. Figures 11 and 12 plot the mismatch rate and the number of matched bits versus Δγ under different values of M∗, where SNR=0dB, b=2, ω=2, and γ=20. Figures 13 and 14 show mismatch rate and match number versus Δγ under different values of b, where SNR=0dB, M∗=2000. The experimental results show that (i) the increase of M∗ and Δγ decrease the mismatch rate and the matched bits number. However, less mismatch rate means higher key rate, and fewer match number implies lower key generation rate. Thus, the value of M∗ and Δγ should be chosen carefully. (ii) The increase of b decreases the mismatch rate and increases the match rate, and hence, the higher key rate is guaranteed.Figure 11
The mismatch rate versusΔγ under different values of M∗.Figure 12
The number of matched bits versusΔγ under different values of M∗.Figure 13
The mismatch rate versusΔγ under different values of b.Figure 14
The number of matched bits versusΔγ under different values of b.The next, the impact of the system parametersγ and Δγ on the conditional entropy HKAq∣KEq are discussed, where KAq and KEq are the bit streams at Alice and Eve after quantizing, respectively, and HKAq∣KEq=∑i,jPrAEi,jlog1/PrA∣Ei∣j for i,j∈0,1. Figure 15 plots the relationship between the value of Δγ, M∗ and the conditional entropy. For instance, the conditional entropies are larger than 0.68 and less than 0.7. Figure 16 shows the conditional entropy against Δγ under different values of b. In particular, all of the conditional entropies are larger than 0.68 and less than 0.7. The results show that Δγ, M∗, and b cause little impact to conditional entropy.Figure 15
The correlation between conditional entropy andΔγ under different values of M∗.Figure 16
The correlation between conditional entropy andΔγ under different values of b.


## 4.4. Key Rate and Randomness

Note that the bit streams after information reconciliation asKAr and KCr and denote the error-correcting information as Pub. Due to the fact that the conditional entropy HKAq∣KEq is less than 0.7, the conditional entropies HKAr∣KEq,Pub≤HKAq∣KEq,Pub≤HKAq∣KCq<0.7. To improve the key entropy, in privacy amplification phase of the simulation, we use F:K0×K1→K, where F is the keying hash function SHA1, K0=K1=0,1L, and K=0,1L/2.Takingα=0.09, β=10, γ=20, and b=2, the simulation is conducted in a variety of M∗ and Δγ under different SNRs to find the optimal value of Δγ and M∗ to maximize the key rate (as shown in Table 1).Table 1
The optimal value ofΔγ and M∗.
IndexSNRΔγM∗Mismatch rateBit rateA-10 dB18120000.036868B-5 dB2020000.0465198C0 dB1210000.0439970D5 dB202000.04611910E10 dB111000.04505640Moreover, the randomness of the generated key is the key for the proposed scheme to be widely used. To this end, a well-known randomness test suiteNIST is used to verify the generated key’s randomness. The p value from five kinds of tests is listed in Table 2. If the p value is greater than 0.01, then it means the bitstream passed the test. We conduct the simulation under different scenarios as shown in Table 1.Table 2
NIST statistical test suite results.
TestABCDERuns0.920.890.860.770.65FFT0.870.820.820.780.71Frequency0.890.840.790.730.64Approx. entropy0.910.870.760.670.63Longest run of ones0.830.840.810.780.69


## 4.5. Comparison of Key Extraction Approaches

Some famous key extraction approaches are mentioned (i.e., RKG [8], CSKE [18], and SG [19]) in Section 1. Now, we compare their performance with the proposed scheme under different scenarios: scenario A (SNR=−10 dB), scenario B (SNR=−10 dB), scenario C (SNR=0 dB), scenario D (SNR=5 dB), and scenario E (SNR=10 dB). In SKEAN, the parameter selection is based on the parameter selection in Table 1. In RKG, the quantization threshold is selected so that at most 10% of the whole measurements are discarded. In CSKE, we set m=5 (i.e., the measurements are quantized into 4 equally likely levels) and set the quantization threshold such that at most 30% of the measurements are dropped. In SG, we set the configurable parameters α=0.3, PB=2, and κ=30.The simulation results in Figure17 shows that the protocol has a significantly higher secret bit generation rate compared with the existing methods. This is because (1) RKG only uses the measurements that above or below the threshold, which leads to low utilization of measurements; (2) both RKG and SG only extract 1 bit for each measurement, which lead to low efficiency of quantization; (3) the channel state information in each coherence time are coherent in CSKE, which leads measurements in a coherence time are similar; and (4) the help node only sends fixed jamming signals in each coherence time in SG, which also leads to the measurements in a coherence time are alike.Figure 17
The key rate under different scenarios.


## 4.6. Discussions

The proposed scheme can be used in the typical application scenarios as follows.Let us first consider the scenario with busy wireless channels (e.g., multiple access points and multiple users exist in a conference room, enterprise, hotel, etc.,), in which we try to solve the key generation problem between access points and users (case shown in Figure18(a) where any two adjacent access points (A and B) are connected by Ethernet backbone). In this situation, we could assume that there exists a secure channel between A and B (e.g., Diffie-Hellman protocol can be used to produce a secure channel as the access points are not constrained by the energy and computing ability). Therefore, we can further generate the security key for access points and users by utilizing the proposed scheme with the secure channel.Figure 18
The application scenarios.
(a)
Scenario 1(b)
Scenario 2(c)
Scenario 3(d)
Scenario 4Then we consider the key extraction between two users in the scenario of typical busy wireless environments (scenario (2) shown in Figure 18(b)). Based on the previous case, we can have a secure channel between the access points and users. With the secure channel, we can use the proposed scheme to extract a security key for two users.Next, we consider another key generation problem in the scenario of MISO system (shown in Figure18(c)). When Alice and Bob are the antennas of a device, the “secure channel” exists between them. We can further use the presented protocol to generate a security key for two devices.In the case of group key generation, as shown in Figure18(d), we can use the key extraction scheme (like work [16, 17] to set up a secure channel, then use the proposed scheme for the others. As shown in Figure 18(d), the secure channel 1 is built by traditional protocols and the secure channel 2, 3, 4, ⋯ can be set up by KEI. With no doubt, the efficiency of group key generation can be improved.


## 5. Conclusion

In this paper, a novel PHY-based approach has been designed for secret key extraction in wireless networks. The proposed scheme leverages jamming to changes the channel states such that two keying nodes can obtain a large number of channel measurements in each coherence time. To further improve the key generation rate and key entropy, a new bit extraction method has been presented to eliminate the low entropy measurement, to break the correlation of measurements in the coherence time with random permutation, and to transform the measurements into bit stream with an adaptive multiple-bit extraction scheme. Theoretical analysis and simulation have been presented to show the performance of the proposed scheme. The results show that the proposed scheme generates secret bits at low mismatch bit rate, high key rate, and high entropy.



---

*Source: 6642605-2021-03-09.xml*