# A Channel State Information-Based Key Generation Scheme for Internet of Things

Authors: Muhammad Usman; Saud Althunibat; Marwa Qaraqe
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Internet-of-Things (IoT) networks generally contain resource-constrained devices that require an energy-efficient key generation procedure to producing secure keys at a faster rate. The physical characteristics of the wireless channel can be exploited to secure communication within IoT networks. In particular, secret keys can be generated by leveraging on the randomness of the wireless physical channel between two communicating parties. The conventional mechanism of generating keys at the physical layer, i.e., using channel probing, quantization, information reconciliation, and privacy amplification, may not be preferable for IoT devices. In addition, in some cases IoT devices may be deployed in static environments, wherein the channel coherence time is too high to generate keys at a faster rate and with the desired randomness. This study proposes a mapping table-based key distribution scheme for IoT environments, wherein multiple characteristics of the random channel are combined to improve not only the key generation rate (KGR) but also the key agreement rate (KAR) and bit error rate (BER). In the proposed scheme, both the channel magnitude and the phase are exploited in the key generation process. The proposed scheme is immune to channel estimation errors while providing sufficient randomness in the static environment. Additionally, the scheme is thoroughly investigated for different scenarios including the case of a smarter eavesdropper, which attempts to estimate the channel between the legitimate nodes. This case verifies the robustness of the proposed scheme in different settings and attack models.


---

## Body

## 1. Introduction

The use of Internet-of-Things (IoT) devices has been steadily increasing and is only projected to increase. However, security is a key challenge in IoT, where securing a small sensor node communicating with the gateway node possesses a real challenge. IoT devices are sometimes deployed in critical environments, wherein any leakage of information to eavesdropper or infiltration of the network can become serious, particularly on the internet of military things (IoMT) or the internet of medical things (IoMeT). In computer networks and general wireless networks, cryptographic techniques are mainly used to provide security. One possible way is to share a secret key (common key) with both parties a priori or on a secure channel. This technique is generally known as one-key private cryptography or data encryption standard (DES) [1]. However, when a common key is not shared, a public key cryptography (PKC) can be used, which is too computationally complex and energy hungry to be run on resource-constrained IoT devices [2].Although the aforementioned digital key-based cryptography schemes have been efficient in protecting computer networks and general wireless networks, their performance in many emerging resource-constrained scenarios, such as IoT networks, is limited. First, the timely sharing of digital keys is becoming a challenge in highly dynamic heterogeneous networks where devices are supposedly different in terms of mobility and computational capabilities. Second, the high computational cost of digital key exchange and management protocols produces large latencies in larger networks, such as massive IoT. In particular, the computational overhead becomes intolerable for IoT devices, which are generally small in size and battery powered.To overcome these challenges, physical layer security (PLS) has gained serious investigation as it provides means to provide security through the physical layer in resource-constrained networks. In particular, PLS comes with inherited benefits of low energy consumption, low network overhead, and low computational requirements [3–5]. The characteristics of wireless channels depend on the environment layout, such as scatterer materials, their mobility, and their distributions. These characteristics make the channel between legitimate nodes unique, random, and unpredictable to eavesdroppers. Secure key distribution schemes exploiting the physical layer characteristics of the radio channel of communicating devices have been proposed in the literature. These physical layer characteristics generally include received signal strength (RSS) and channel state information (CSI). A combination of the aforementioned attributes can be adopted to enhance security levels.However, despite the aforementioned benefits, PLS faces several challenges related to the time-varying nature of the physical channel and imperfect estimates at communication parties. Although several works in the literature propose schemes that generate keys from physical layer attributes [6–11], only a few implement methods to mitigate the effects of imperfect channel estimates [12, 13]. In addition, most of the proposed physical layer-based key generation strategies are designed for general wireless environments, which may not be directly applicable to many IoT environments.In addition to the aforementioned channel asymmetries that significantly impact the performance of secret bit rate, the performance of most of the proposed solutions mainly depends on the current state of the wireless channel. The rate of the generated bits is usually a function of the channel attribute fluctuations, which makes such solutions unusable in flat-fading scenarios.This work, for the first time in the literature, solves the aforementioned challenges by presenting a mapping table-based solution, where instead of directly translating the received signal attributes to bits using quantization, bit mapping tables are constructed for the magnitude and the phase of the received signal. The solution is suitable for both channel conditions, namely, fast and flat fading. To this aim, a span of magnitude and phase of the received signal is assigned a unique bit sequence. This provides some flexibility to combat channel variations and estimation errors. The aim behind this bit mapping is (i) to provide robustness against channel estimation error and (ii) to make the key distribution process faster. In addition, the proposed scheme is equally suitable for the static environments since randomness is deliberately induced at the transmitter in terms of randomly selecting a bit sequence from the mapping table. The proposed secrete generation scheme results in higher values of key generation rate (KGR) and key agreement rate (KAR) while keeping the bit error rate (BER) under a desired range.The remainder of this study is organized as follows. Section2 summarizes the state of the art in this field. The system model is presented in Section 3. Section 4 discusses the proposed scheme and its working details. The performance analysis in terms of simulation results is presented in Section 5. Finally, Section 6 provides some concluding remarks.


## 2. Related Work

Figure1 presents the general key generation process exploiting physical layer attributes of the wireless channel. The key is generated into four different stages using (i) channel probing, (ii) quantization, (iii) information reconciliation, and (iv) privacy amplification [14]. From the physical layer perspective, most of the work is focused on improving the channel probing [6–8] or quantization stages [9–11]. Channel probing is the key element of key generation protocols that captures the randomness of the channel by measuring the channel parameters, such as CSI or RSS. The legitimate nodes at both ends transmit probing signals with a time difference less than the coherence time of the channel such that the channel response measured at each end of the link remains ideally the same and symmetric. This property of the wireless channel is generally known as channel reciprocity. However, the actual measurements are generally nonsymmetric mainly due to asynchronous measurements and independent noise at both ends. To this end, some works in the literature focus on mitigating the noise and nonsimultaneous measurement effects using filtering [7, 8, 15] and interpolation techniques [6, 11].Figure 1
Physical layer-based key generation scheme.The second important element of key generation protocols is the quantization stage, wherein the received signal is converted into binary values. In this regard, the signal sensed through channel probing is converted to binary values using different quantization techniques. The performance here is the number of bits generated from a single measurement. The quantization thresholds are defined in order to reduce the KDR. For instance, the work presented in [14] measures the performance of two different quantizers, absolute value-based quantizer and differential value-based quantizer, on an RSS-based channel probing key generation system. Absolute value-based quantizer works on the principle of an analog-to-digital converter, while absolute value-based quantizer compares the difference between consecutive measurements to translate the received signal into digital bits. Another work exploits multibit quantization to improve the KGR [11], while authors in [9] propose to drop all the bits that are on the same side of the quantization threshold to decrease the KDR.A common aspect of all the related work is the channel estimation and exploitation of various channel characteristics, such as CSI (amplitude, phase, mulitpath, etc.) and RSS to generate a secret key. In this regard, most of the works in the literature focus on one of the aforementioned characteristics of the channel. For instance, a key generation protocol from multipath features of the wireless channel is presented in [16, 17]. While the RSS-based key generation protocol is presented in [14, 18–22], the works in [12, 23–27] consider the phase randomness to generate a secret key. In particular, the work in [18] proposes a key distribution scheme exploiting the magnitude of the estimated channel. Indeed, a unique demodulation scheme is selected at the receiver based on the channel magnitude. Similarly, the authors in [19] propose a RSS-based key generation scheme for the moving nodes in the context of body area networks, whereas the authors in [23] propose a phase-based adaptive modulation scheme to secure the communication between legitimate parties. In particular, based on the channel phase a unique modulation type is selected. Although the proposed scheme provides sufficient robustness against channel estimation errors, its performance is unclear in the static environments. This is a major downside of most of the works proposed in the literature [12, 18–20, 23–26]. A relevant work for the static environments is presented in [28], wherein the authors propose to induce a local randomness at the legitimate nodes. However, the proposed scheme requires a postprocessing stage, which makes their solution impractical for IoT networks. Moreover, other than the induced randomness, their scheme follows the conventional key generation steps, i.e., channel probing, quantization, reconciliation, and privacy amplification, which makes their solution less efficient for the environments characterized by fast fading.The work presented in this study expands on the state of the art in the following ways.(i)
First of all, multiple attributes of the wireless channel are considered to make the system more robust against eavesdropper.(ii)
The proposed scheme is immune to imperfect channel estimations. Hence, small variations in the channel do not affect the key generation process.(iii)
The self-induced randomness at the transmitter makes the proposed solution suitable for static environments.(iv)
The KGR in the proposed scheme is higher due to the feature of exploiting multiple attributes of the channel, which makes our system ideal for IoT environments.(v)
The robustness of the proposed scheme is verified by considering different attack models including the one when the eavesdropper can intelligently sense the channel between legitimate nodes.


## 3. System Model

A wireless communication system-based IoT network involving three entities,A (alice), ℬ (bob), and E (eve). A and ℬ are considered to be the legitimate nodes, while E is an illegitimate node trying to guess the key A distributes to ℬ. Both A and ℬ are assumed to be resource-constrained devices who cannot resort to a standard crypto-based key establishment protocol, such as Diffie-Hellman or public key encryption. Considering a Raleigh fading channel between A and ℬ, the received signal at ℬ, yb, can be modeled by the following expression:(1)yb=xahab×ptPLab+wab,where xa is the input signal, pt is transmitted electrical power at A, PLab is the path loss between A and ℬ, wab is the additive white Gaussian noise (AWGN) at ℬ with 0 mean and variance σ2, and hab is the channel fading coefficient between A and ℬ. Similarly, the received signal at E, ye, can be modeled by the following expression:(2)ye=xahae×ptPLae+wae,where PLae is the path loss between A and E, wae is the AWGN at Ewae0,σ2, and hae is the channel fading coefficient between A and E. Both yb and ye are complex Gaussian random variables in the form of ℜ+ℑi whose magnitude can be calculated by ℜ2+ℑ2, and the phase (φ∈0,360) is given by the following arg function(3)φR=argℜ+ℑi=tan−1ℑℜ.The probability density function (PDF) of the Rayleigh fading channel denoted byfhh is given as(4)fhh=hσ2e−h22σ2.∀h≥0.The average path loss betweenA-ℬ and A-E in dB is given by PLab=PL0+10γlogdab/d0 and PLae=PL0+10γlogdab/d0, respectively, where d0 is the reference distance, PL0 is the path loss at the reference distance d0, dab and dae are the distances between A-ℬ and A-E, respectively, and γ is the path loss factor, which depends on several environmental factors such as indoor, outdoor, and obstructing entities [29]. The distribution of Aℬ and E is represented in Figure 2.Figure 2
System configuration:A and ℬ are at a distance of dab to each other, while E can take different locations represented by ° in the figure.


## 4. Proposed CSI-Based Key Generation Scheme

In order to generate a secret key from the RSS and the phase of the received signal atℬ, A generates two tables, namely, (i) RSS-lookup table and (ii) φ-lookup table. RSS-lookup table contains an expected range of signal strength received at ℬ, while φ-lookup table represents a range of expected φ at ℬ. It is worth mentioning that RSS represents the magnitude of the received signal.


### 4.1. RSS-Lookup Table Generation

Let there beN number of entries in the RSS-lookup table denoted by eℛ0,eℛ1,eℛ2,…,eℛN−1. Depending on the initial value of RSS eℛ0, the rest of the entries in the RSS-lookup table can be generated by the following relation(5)eℛi=eℛ0,i=0,eℛi−1+Δℛ,∀i=1,2,…,N−1,where Δℛ is the RSS interval length, which is the difference between any two consecutive entries in the RSS-lookup table, and eℛ0 is the initial value of RSS lookup table. The value of Δℛ decides the number of entries in the lookup table. Here, a binary sequence is assigned to each entry of the table in a way that the span between any two consecutive entries is assigned a single sequence with two extra assignments, one if RSS <eℛ0 and the second if RSS ≥eℛN−1. An example of the RSS-lookup table is shown in Figure 3, where the function Gr represents the Gray code representation of the integer r.Figure 3
An example of RSS-lookup table.


### 4.2.φ-Lookup Table Generation

LetM represent the maximum number of entries in the φ-lookup table denoted by eφ0,eφ1,eφ2,…,eφM. The φ-lookup table can be generated by the following relation(6)eφj=eφ0,j=0,eφj−1+Δφ,∀j=1,2,…,M,where Δφ represents the φ interval length, i.e., the difference between any two consecutive entries in the φ-lookup table, and eφ0 is the initial value of the φ-lookup table. Similar to the RSS table, the φ-lookup table can be generated by assigning a unique binary sequence to the range between two consecutive entries. An example of the φ-lookup table is shown in Figure 4. The difference between the RSS and φ-lookup tables lies in the fact that RSS can take values between −∞ and ∞, while φ varies from 0 to 360 degrees. Hence without loss of generality, eφ0 is considered 0360 in this case.Figure 4
An example ofφ-lookup table.To generate the key,ℬ is assumed to have knowledge of the same lookup table at their end. In this regard, having values of eℛ0, N, Δℛ, and Δφ, ℬ can generate the same lookup tables (RSS and φ) using equations (5) and (6). It is important to note that the value of eφ0 is universal (i.e., 0360) and does not need to be shared. Similarly, M can be calculated by the known value of Δφ using M=360/Δφ−1, where eφM=360−Δφ. It is assumed that E can also generate the same tables while listening to the communication between A and ℬ over the nonsecure wireless channel.TheA randomly selects a sequence from both lookup tables and marks the corresponding RSS and φ range that would be desired at ℬ. Now, to make sure that the received signal at ℬ, yb has the same RSS and φ, A has to estimate the channel between A and ℬ, hab. This channel estimation is necessary at A in order to calculate the magnitude hab and the phase φchab of the channel, which is then used to compute the desired transmit power pt and phase φt to allow ℬ generate the same sequence as A. In particular, the channel estimation at A can be given by(7)hAest=hab+ξ,where hAest is the estimated channel at A, and ξ is a complex Gaussian random variable with 0 mean and variance ς2, representing the channel estimation error at A.The transmitted signal power is generated in terms of magnitude,pt, and the phase φt as follows:(8)pt=RSS!D2xa‖hAest2dab/d0−γ,where RSS!D is the desired RSS at ℬ, and hAest is the estimated channel at A. It is important to note that RSS!D is chosen in such a way that it exactly represents the middle value of the RSS range. For instance, in Figure 3, if a desired sequence of G2 is selected, the corresponding RSS!D is computed as eℛ1+eℛ2/2. Similarly, the desired transmitted phase φt can be computed as(9)φt=φD−φhAest,where φD is desired phase at ℬ, which in principle should be same as φ once ℬ receives the signal, and φhAest is the phase of the estimated channel hEest. Similar to RSS-table, the value of φD is chosen in a way that it represents the mean of the φ-table entry. For instance, in Figure 4, if a desired sequence of G2 is selected, the corresponding φD is computed as eφ2+eφ3/2. The details of the proposed scheme are presented in Figure 5. Three different key generation scenarios are considered in this work. The first scenario investigates key generation using only RSS only, the second scenario investigates generating a secret key using only the φ of the channel, and the last scenario generates a secret key by leveraging on both RSS and φ.Figure 5
Flow diagram:A selects a key from the RSS and φ-lookup tables and estimates the corresponding pt and φ at A that will be the desired RSS and φ at ℬ. After receiving the signal yb, ℬ calculates its magnitude and phase and checks the corresponding lookup tables to get the key. For longer key sizes, the transmission process is repeated for K number of times and the resultant bits are concatenated.For the RSS-only scenario, the key sequences atA and ℬ can be represented by the following expressions (using Figure 3):(10)Sℬℛss=Gℬℛss0,∀RSS!ℬ=yb∈−∞,eℛ0,Gℬℛssr,∀RSS!ℬr,i=yb∈eℛi−1,eℛi,r,i∈1,2,…,N−1,GℬℛssN,∀RSS!ℬ=yb∈eℛN,∞,SAℛss=GAℛssR,R∈0,1,…,N,where SA is the selected binary sequence (key) at A, Sℬ is the generated binary sequences at ℬ, R is a random variable following the discrete uniform distribution over the set 0,1,…,N, and the function GAℛssr is the Gray code representation of the integer r. It is important to note that SA is randomly selected at A, while Sℬ is generated from the RSS-lookup table (Figure 3) at ℬ using the magnitude of the received signal, i.e., yb.Similarly, for theφ-only scenario, the selected and generated sequences are represented by the following expressions:(11)Sℬφ=Gℬφ0,∀φℛℬ=argyb∈eφ0,eφ1,Gℬφp,∀φℛℬp,j=argyb∈eφj−1,eφj,p∈1,…,M−1,j∈1,…,M,GℬφM,∀φℛℬ=argyb∈eφM,eφ0,SAφ=GAφP,P∈0,1,…,M,where function Gp is the Gray code representation of integer p, and φℛℬ is the phase of the received signal at ℬyb.Similarly, for the combined scenario (RSS andφ), the selected and generated sequences are presented by(12)Sℬcom=Sℬℛss++Sℬφ,SAcom=SAℛss++SAφ,where ++ is a concatenation operator to combine the bits from RSS and φ. The size of the sequences SA and Sℬ for all the aforementioned scenarios is very small as compared to the key sizes used in actual communication. For instance, for the φ-only scenario, an interval length of 11.250Δφ=11.25o produces 32 360/11.25 entries in the φ-lookup tables M=31, which can be covered by a sequence length SAφ of 5 bits only. Similarly, an equivalent size N=31 of RSS-lookup table produces SAℛss=5 bits as well. Combining both RSS and φ scenarios produces a key length of SAboth=10 bits only. Thus, to extend the key length, the key transmission process is repeated multiple times and the generated sequences are concatenated to form the final secret key. For instance, repeating the simulations 13 times can produce a key length of SEboth=130 bits. The details of the proposed protocol are presented in Algorithm 1.Algorithm 1: Pseudocode of the proposed scheme for the combined scenario.
(1)
lethAest be estimated channel between A and ℬ.(2)
letxa is the transmitted signal with power, pt, and phase, φt.(3)
letyb is the received signal with power, RSS!act, and phase, φact.(4)
for each transmission do(5)
A selects a sequence from RSS and φ lookup tables.(6)
A estimates the channel hAest.(7)
Using (8) and (9), A calculates pt and φt of xa and transmits the signal.(8)
ℬ extracts the phase, φact, and magnitude, RSS!act, of the received signal, yb.(9)
ℬ selects the sequences from RSS and φ lookup tables based on RSS!act and φact.(10)
end


## 4.1. RSS-Lookup Table Generation

Let there beN number of entries in the RSS-lookup table denoted by eℛ0,eℛ1,eℛ2,…,eℛN−1. Depending on the initial value of RSS eℛ0, the rest of the entries in the RSS-lookup table can be generated by the following relation(5)eℛi=eℛ0,i=0,eℛi−1+Δℛ,∀i=1,2,…,N−1,where Δℛ is the RSS interval length, which is the difference between any two consecutive entries in the RSS-lookup table, and eℛ0 is the initial value of RSS lookup table. The value of Δℛ decides the number of entries in the lookup table. Here, a binary sequence is assigned to each entry of the table in a way that the span between any two consecutive entries is assigned a single sequence with two extra assignments, one if RSS <eℛ0 and the second if RSS ≥eℛN−1. An example of the RSS-lookup table is shown in Figure 3, where the function Gr represents the Gray code representation of the integer r.Figure 3
An example of RSS-lookup table.


## 4.2.φ-Lookup Table Generation

LetM represent the maximum number of entries in the φ-lookup table denoted by eφ0,eφ1,eφ2,…,eφM. The φ-lookup table can be generated by the following relation(6)eφj=eφ0,j=0,eφj−1+Δφ,∀j=1,2,…,M,where Δφ represents the φ interval length, i.e., the difference between any two consecutive entries in the φ-lookup table, and eφ0 is the initial value of the φ-lookup table. Similar to the RSS table, the φ-lookup table can be generated by assigning a unique binary sequence to the range between two consecutive entries. An example of the φ-lookup table is shown in Figure 4. The difference between the RSS and φ-lookup tables lies in the fact that RSS can take values between −∞ and ∞, while φ varies from 0 to 360 degrees. Hence without loss of generality, eφ0 is considered 0360 in this case.Figure 4
An example ofφ-lookup table.To generate the key,ℬ is assumed to have knowledge of the same lookup table at their end. In this regard, having values of eℛ0, N, Δℛ, and Δφ, ℬ can generate the same lookup tables (RSS and φ) using equations (5) and (6). It is important to note that the value of eφ0 is universal (i.e., 0360) and does not need to be shared. Similarly, M can be calculated by the known value of Δφ using M=360/Δφ−1, where eφM=360−Δφ. It is assumed that E can also generate the same tables while listening to the communication between A and ℬ over the nonsecure wireless channel.TheA randomly selects a sequence from both lookup tables and marks the corresponding RSS and φ range that would be desired at ℬ. Now, to make sure that the received signal at ℬ, yb has the same RSS and φ, A has to estimate the channel between A and ℬ, hab. This channel estimation is necessary at A in order to calculate the magnitude hab and the phase φchab of the channel, which is then used to compute the desired transmit power pt and phase φt to allow ℬ generate the same sequence as A. In particular, the channel estimation at A can be given by(7)hAest=hab+ξ,where hAest is the estimated channel at A, and ξ is a complex Gaussian random variable with 0 mean and variance ς2, representing the channel estimation error at A.The transmitted signal power is generated in terms of magnitude,pt, and the phase φt as follows:(8)pt=RSS!D2xa‖hAest2dab/d0−γ,where RSS!D is the desired RSS at ℬ, and hAest is the estimated channel at A. It is important to note that RSS!D is chosen in such a way that it exactly represents the middle value of the RSS range. For instance, in Figure 3, if a desired sequence of G2 is selected, the corresponding RSS!D is computed as eℛ1+eℛ2/2. Similarly, the desired transmitted phase φt can be computed as(9)φt=φD−φhAest,where φD is desired phase at ℬ, which in principle should be same as φ once ℬ receives the signal, and φhAest is the phase of the estimated channel hEest. Similar to RSS-table, the value of φD is chosen in a way that it represents the mean of the φ-table entry. For instance, in Figure 4, if a desired sequence of G2 is selected, the corresponding φD is computed as eφ2+eφ3/2. The details of the proposed scheme are presented in Figure 5. Three different key generation scenarios are considered in this work. The first scenario investigates key generation using only RSS only, the second scenario investigates generating a secret key using only the φ of the channel, and the last scenario generates a secret key by leveraging on both RSS and φ.Figure 5
Flow diagram:A selects a key from the RSS and φ-lookup tables and estimates the corresponding pt and φ at A that will be the desired RSS and φ at ℬ. After receiving the signal yb, ℬ calculates its magnitude and phase and checks the corresponding lookup tables to get the key. For longer key sizes, the transmission process is repeated for K number of times and the resultant bits are concatenated.For the RSS-only scenario, the key sequences atA and ℬ can be represented by the following expressions (using Figure 3):(10)Sℬℛss=Gℬℛss0,∀RSS!ℬ=yb∈−∞,eℛ0,Gℬℛssr,∀RSS!ℬr,i=yb∈eℛi−1,eℛi,r,i∈1,2,…,N−1,GℬℛssN,∀RSS!ℬ=yb∈eℛN,∞,SAℛss=GAℛssR,R∈0,1,…,N,where SA is the selected binary sequence (key) at A, Sℬ is the generated binary sequences at ℬ, R is a random variable following the discrete uniform distribution over the set 0,1,…,N, and the function GAℛssr is the Gray code representation of the integer r. It is important to note that SA is randomly selected at A, while Sℬ is generated from the RSS-lookup table (Figure 3) at ℬ using the magnitude of the received signal, i.e., yb.Similarly, for theφ-only scenario, the selected and generated sequences are represented by the following expressions:(11)Sℬφ=Gℬφ0,∀φℛℬ=argyb∈eφ0,eφ1,Gℬφp,∀φℛℬp,j=argyb∈eφj−1,eφj,p∈1,…,M−1,j∈1,…,M,GℬφM,∀φℛℬ=argyb∈eφM,eφ0,SAφ=GAφP,P∈0,1,…,M,where function Gp is the Gray code representation of integer p, and φℛℬ is the phase of the received signal at ℬyb.Similarly, for the combined scenario (RSS andφ), the selected and generated sequences are presented by(12)Sℬcom=Sℬℛss++Sℬφ,SAcom=SAℛss++SAφ,where ++ is a concatenation operator to combine the bits from RSS and φ. The size of the sequences SA and Sℬ for all the aforementioned scenarios is very small as compared to the key sizes used in actual communication. For instance, for the φ-only scenario, an interval length of 11.250Δφ=11.25o produces 32 360/11.25 entries in the φ-lookup tables M=31, which can be covered by a sequence length SAφ of 5 bits only. Similarly, an equivalent size N=31 of RSS-lookup table produces SAℛss=5 bits as well. Combining both RSS and φ scenarios produces a key length of SAboth=10 bits only. Thus, to extend the key length, the key transmission process is repeated multiple times and the generated sequences are concatenated to form the final secret key. For instance, repeating the simulations 13 times can produce a key length of SEboth=130 bits. The details of the proposed protocol are presented in Algorithm 1.Algorithm 1: Pseudocode of the proposed scheme for the combined scenario.
(1)
lethAest be estimated channel between A and ℬ.(2)
letxa is the transmitted signal with power, pt, and phase, φt.(3)
letyb is the received signal with power, RSS!act, and phase, φact.(4)
for each transmission do(5)
A selects a sequence from RSS and φ lookup tables.(6)
A estimates the channel hAest.(7)
Using (8) and (9), A calculates pt and φt of xa and transmits the signal.(8)
ℬ extracts the phase, φact, and magnitude, RSS!act, of the received signal, yb.(9)
ℬ selects the sequences from RSS and φ lookup tables based on RSS!act and φact.(10)
end


## 5. Performance Analysis

In this section, the performance of the proposed scheme in Figure2 is analyzed through simulation and discussed in detail. In particular, the performance of the proposed scheme is investigated in terms of KGR, BER, and KAR for different simulation scenarios and environments. The simulations were performed in MATLAB, where each experiment was run for 100 K times to achieve reliable results. The section is divided into three subsections, where subsection A considers the case of perfect channel estimation, subsection B analyzes the case of imperfect channel estimation at A, and subsection C investigates the performance of the proposed scheme against a smart E, which attempts to estimate the channel between A and ℬ. Finally, a detailed assessment of RSS-only, φ-only, and the combined scheme is presented for all the scenarios.Before discussing the performance of the proposed scheme in the abovementioned scenarios, it seems logical to investigate the BER atE while moving between A and ℬ. To this aim, Figure 6 represents the BER performance of E at different distances from A and ℬ when considering the scenario of RSS only. The distance between A and ℬ is kept as 50 m, and E moves between them. It can be noted from the figure that E experiences the worst performance while they are very close to A (dea = 1 m, deb = 49 m). The BER performance of E improves as they move closer to ℬ and becomes the best when they are very near to ℬ (dea = 49 m, deb = 1 m). This is due to the reason that while E is very close to ℬ the channel state information (CSI) of A-ℬ channel chae and A-E channel chae becomes closer to each other. For the remainder of the results and simulations, E is considered to be in the immediate proximity of ℬ, which is the best-case scenario for E. The simulation results verify the robustness of the proposed algorithm against the E at their best location.Figure 6
The BER atE at different distances from A and ℬ, dea and deb, respectively. (RSS-only scenario, SNR = 32 dB, dab = 50 m, Δℛ = 1 dBm, and key length = 140 bits).Figure7 illustrates the KGR for the three considered scenarios of RSS-only, φ-only, and combined scenarios. It can be observed that smaller interval lengths in all cases produce a larger number of bits in a single transmission. For instance, for RSS-only scenario (Figure 7(a)), an interval length of 1 dBm, produces seven bits in a single transmission. While for the same scenario, an interval length of 8 dBm produces only four bits. Similarly, for the φ-only scenario (Figure 7(b)), an interval length of 1.40625° produces eight bits in a single transmission, while an interval length of 22.5° produces four bits only. Collectively, the combined scenario (Figure 7(c)) produces double bits in a single transmission as compared to their corresponding intervals in RSS-only and φ-only scenarios. In particular, in the combined scenario, the interval lengths of 1 dBm and 2.81 25° produce fourteen bits in a single transmission, providing a KGR double of that to the RSS-only and φ-only scenarios.Figure 7
Key generation rate (KGR) for RSS-only,φ-only, and combined scenarios. (a) RSS-only, (b) φ -only, and (c) combined.
(a)(b)(c)


### 5.1. Perfect Channel Estimation

In what follows, the BER performance atℬ and E under perfect channel estimation is presented. In the perfect channel estimation case, A estimates the A-ℬ channel without any errors, i.e., ξ = 0 in equation (7); thus, the source of error in the perfect channel estimation case is the noise present at ℬ. Figure 8 depicts the BER performance at ℬ and E for all the considered scenarios, i.e., RSS-only, φ-only, and combined. Particularly, Figure 8(a) illustrates the effect of different RSS interval lengths Δℛ on the BER at E and ℬ. It is observed from the figure that BER at both E and ℬ decrease as Δℛ increases. For instance, the BER at ℬ for Δℛ = 1 dBm becomes 10−4 at SNR value of 38 dB, while the same BER is achieved at a lower SNR of 27 dB once an interval length Δℛ of 8 dBm is considered. This gives around 92% improvement in terms of the required SNR at ℬ to achieve the same BER. However, increasing Δℛ does not bring the BER at E to an acceptable point. For instance, E’s best BER is around 0.06 for Δℛ = 8 dBm at an SNR value of 48 dB. With this performance, it becomes practically impossible for E to get the same key as ℬ. Hence, the RSS-only scenario provides sufficient resilience against the E for the perfect channel estimation case.Figure 8
BER performance for perfect channel estimation (ξ = 0, dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) The effect of Δℛ for RSS-only scenario. (b) The effect of Δφ for φ-only scenario. (c) The combined effect of Δℛ and Δφ (SNR = 32 dBm). (d) The comparison of effect of Δℛ and Δφ on the BER for RSS-only, φ-only, and combined scenarios (key length = 140 bits).
(a)(b)(c)(d)Figure8(b) presents the BER at E and ℬ for φ-only scenario. Similar to the RSS-only scenario, the BER in φ-only scenario is inversely proportional to Δφ. The BER at ℬ and E improves with the interval length Δφ. Having said that, in the φ-only scenario a BER of 10−4 is achieved at an SNR value of 33 dB when Δφ=45°, which is possible only at an SNR of 48 dBm when Δφ becomes 1.40625°. However, for φ-only scenario, E experiences the worst performance. Although the E’s performance improves with increasing Δφ (see zoomed in-plot of Figure 8(b)), the best BER value is 0.49 for Δφ=45°, which is nowhere near to an acceptable performance. To this end, almost half the data received by E are inaccurate. Hence, φ-only scenario provides a significant resilience against E.Figure8(c) demonstrates the BER results at ℬ and E for the combined scenario. The figure is a three-dimensional (3D) plot where one axis represents the RSS interval in dBm and the second represents φ interval in degrees, and the z-axis represents the BER. All combinations of Δℛ and Δφ are considered, wherein the best performance is achieved for larger interval lengths. Figure 8(c) is plotted for an SNR value of 32 dBm. It is observed that BER reaches to 10−4 for the intervals’ combinations of Δℛ = 4 dBm and Δφ=45°, Δℛ = 8 dBm and Δφ=22.5°, and Δℛ = 8 dBm and Δφ=45°. The BER at ℬ will further improve the graph plotted for higher values of SNR. However, the best BER performance at E is 0.25, which is nowhere near to the performance of ℬ for any interval combination.Figure8(d) presents the comparison between all of the aforementioned scenarios, i.e., RSS-only, φ-only, and combined scenarios. In order to have a fair comparison, the selection of interval lengths in all scenarios is based on the number of bits they generate in a single transmission. For instance, Δℛ = 1 dBm, Δφ=2.8125°, and Δℛ = 8 dBm, Δφ=45° are chosen for RSS-only, φ-only, and combined scenarios, respectively. All these values produce seven bits in a single transmission (refer Figure 7) and a key length of 140 bits for 20 repetitive transmissions. It can be noted from the figure that the combined scenario performs better than others (RSS only and φ only) for BER at ℬ. However, comparing RSS-only and φ-only scenarios, RSS-only scenario performs better than φ-only scenario for BER at ℬ while providing the lowest BER at E. Having said that, the combined scenario is the best for BER at ℬ and is slightly better than RSS-only scenario at E. Although the φ-only scenario is the best to keep BER at E the worst, the combined scenario is also sufficient to keep E well away from BER at ℬ for any value of the required SNR. Comparing the RSS-only and combined scenarios, at an SNR value of 32 dB combined scenario performs 5% better than RSS-only scenario at E (E performs worse for the combined scenario) while improving the BER at ℬ by 99.95%. This is due to the reason that for the combined scenario interval lengths of Δℛ and Δφ are bigger than RSS-only and φ-only scenarios, giving ℬ a privilege to accommodate more errors (source is only noise here). Although the same is true for the E as well, but E has two sources of errors, that is, one is the channel, and the second is the noise at E. Due to this reason, the BER at E for the combined scenario is lower than φ-only scenario and a bit higher than RSS-only scenario. This makes the combined scenario a perfect choice both from the perspective of ℬ and E.Figure9 demonstrates the KAR between A-ℬ and A-E. It can be noted from the figure that larger values of Δℛ and Δφ generate better KAR at ℬ. For instance, for RSS-only scenario (Figure 9(a)), a KAR of 1 is achieved at an SNR value of 42 dBm when Δℛ= = 1 dBm, while the same rate of 1 can be achieved at an SNR of 32 dBm when Δℛ = 8 dBm. This means that Δℛ = 8 dBm is 2.16 times more power efficient than Δℛ = 1 dB. It is important to note that the combined scenario produces the best results for KAR at ℬ (see Figure 9(c)) as compared to separate scenarios. The results in Figure 9 are promising in a sense that the KAR at E for all the considered scenarios remains very poor even for high SNR values.Figure 9
Key agreement rate (KAR) betweenA-ℬ and A-E at different SNR values for all scenarios (ξ = 0, dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) RSS-only, (b) φ -only, and (c) combined.
(a)(b)(c)


### 5.2. Imperfect Channel Estimation

A more realistic case is now assumed whenA’s estimation of the A-ℬ channel is not perfect. The imperfection in the channel estimation is modeled by ξ in equation (7) of Section 3, where ξ is a complex Gaussian random variable with 0 mean and variance ς2. In particular, two different values of ς are considered, (i) 25 ×No and (ii) 50 ×No, where No is considered as 5 ×10−6. The performance of imperfect channel estimation for the scenarios of RSS only, φ only, and combined is investigated.Figure10 compares the BER performance at ℬ for different values of Δℛ, when A does not perfectly estimate the channel. In particular, Figure 10(a) illustrates the case of Δℛ = 1 dBm. It can be noted from the figure that the more imperfectly A estimates the channel hab, and the worse performance ℬ experiences in terms of BER. In particular, ς=50×No produces the worst result. For instance, at an SNR of 38 dBm ℬ experiences 10 times more BER when channel estimation error A is 50×No. This is due to the reason that the interval length Δℛ = 1 dBm has to accommodate two kinds of errors, that is, one is the noise at ℬwab, and the second is channel estimation error ξ.Figure 10
RSS-only scenario: BER performance atℬ and E for imperfect channel estimation at A (dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) ΔR=1 dBm and (b) ΔR=8 dBm.
(a)(b)Similarly, Figure10(b) demonstrates the BER performance at ℬ for Δℛ = 8 dBm. It is observed from the figure that BER at ℬ increases with channel estimation error. However, this increase is almost negligible due to higher value of Δℛ, which gives ℬ an ability to accommodate more errors in the channel estimation. For instance, at an SNR value of 24 dBm only 1.24% BER degradation is observed for ς=50×No compared with the perfect channel estimation. This justifies the claim of our algorithm’s superiority over the state of the art.Figure11 illustrates the effect of channel estimation error at ℬ for different values of Δφ. It can be observed from the figures that while Δφ starts increasing, BER at ℬ improves irrespective of value of ς. Similar to RSS-only scenario, larger intervals Δφ=45o in φ-only scenario provide more resilience against channel estimation error while keeping the BER at E in a controlled range. For instance compared with the perfect channel estimation, at an SNR value of 32 dBm, ℬ experiences only 66% BER degradation when Δφ=45o. This BER degradation is around 177.2% when Δφ=1.40625o for the same value of SNR.Figure 11
φ-only scenario: BER performance at ℬ and E for imperfect channel estimation at A (dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) Δφ=1.40625°, (b) Δφ=11.25°, and (c) Δφ=45°.
(a)(b)(c)Figure12 highlights the effect of channel estimation error on the combined scenario. All combinations of Δℛ and Δφ are considered in Figure 12(a), plotting Δℛ on one axis, Δφ second axis, and BER on the third axis for an SNR of 32 dBm. It is observed from Figure 12(a) that higher interval lengths have the ability to accommodate more channel estimation error. For instance in case of ς=50×No, the BER at ℬ was still as low as 10−4 for two different combinations of Δℛ and Δφ (Δℛ = 4 dBm, Δφ=45o, Δℛ = 8 dBm, and Δφ=45o).Figure 12
Combined scenario: BER performance atℬ and E for imperfect channel estimation at A (dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) BER performance for all combinations of ΔR and Δφ (SNR = 32 dBm). (b) Comparison between RSS-only, φφ-only, and combined scenarios (key length = 140 bits).
(a)(b)Figure12(b) illustrates the comparison between RSS-only, φ-only, and combined scenarios in terms of their resiliency against channel estimation errors. Again, similar to perfect channel estimation case, for a fair comparison same key length (140 bits) is considered for all three scenarios. It can be observed from the figure that combined scenario performs better than individual scenarios (RSS only and φ only).


### 5.3. Smart Eavesdropper (E)

This subsection highlights the performance when considering a more intelligent or smarter ofE by allowing E the ability to estimate the channel between A and ℬ. In this scenario, the channel estimation at E can be represented by(13)hEest=hab+ε,where ε is a complex Gaussian random variable 0,ζ2 representing the channel estimation error at E. Two different values of ζ are considered for simulations, (i) ζ = 0.1 and (ii) ζ = 0.01. The BER performance at a smarter E for RSS-only, φ-only, and combined scenarios is investigated.In particular, Figure13 represents the BER at E against different values of ζ for an RSS-only scenario. It is evident from Figure 13(a) that Δℛ = 1 dBm keeps the BER at E under the control range (away from ℬ) even if she tries to estimate A-ℬ channel with lesser error (ζ = 0.01). This is due to the reason that a smaller interval length does not accommodate more errors and hence keeps the BER of E apart from ℬ. On the other hand, in the case of larger intervals (Δℛ = 8 dBm), E starts getting better results when ζ = 0.01, but the improvement is not comparable to ℬ. For instance, for Δℛ = 8 dBm and SNR = 32 dBm, the BER at the smarter E is 20 times more than what is at ℬ even though the ζ = 0.01. In addition, ζ = 0.01 is itself a very small value, which makes the A-E channel comparable with A-ℬ channel. In order to realize such a small value of ζ, E has to be very smart and somehow sit over ℬ, which is not practically possible. A very small interval value is chosen for the sole purpose of evaluating the robustness of the proposed approach against E.Figure 13
RSS-only scenario: BER performance for a smarterE. (a) ΔR=1 dBm. (b) ΔR = 8 dBm.
(a)(b)Figure14 illustrates the BER at E for φ-only scenario. Similar to RSS-only scenario, here as well both the smaller and larger intervals provide resilience against smarter E. Although smaller intervals are more resilient as compared to larger intervals, the larger intervals still keep BER at smarter E well apart from what ℬ has at the same SNR value. For instance, for Δφ=45° and SNR = 32 dBm, a smart E (with ζ = 0.01) experiences 40 times higher BER than ℬ.Figure 14
φ-only scenario: BER performance for a smarter E. (a) Δφ=1.40625°. (b) Δφ=11.25°. (c) Δφ=45°.
(a)(b)(c)Figure15(a) represents the BER at E and ℬ for different combinations of Δℛ and Δφ. The figure is plotted at an SNR of 32 dBm. It can be observed from the figure that E’s BER never becomes comparable with the BER at ℬ even when E is assumed as a smarter node (ζ = 0.01), and A does not perfectly estimate the A-ℬ channel (ς = 50 ×No). In the case of smarter E (ζ = 0.01), the lowest BER is 0.008 when Δℛ = 8 dbm and Δφ=45°, while for the same combination of interval length ℬ experiences a BER of 2.07 ×10−6. Hence, E BER is 375 times lower than BER of ℬ even when E is a smarter device.Figure 15
Combined scenario: BER performance for a smarterE. (a) BER performance for all combinations of ΔR and Δφ (SNR = 32 dBm). (b) Comparison between RSS-only, φ -only, and combined scenarios. (Key length = 140 bits).
(a)(b)Figure15(b) compares the BER at ℬ and E for all the three scenarios. It can be noted from the figure that φ-only scenario performs better in order to keep BER at E well above the BER at ℬ even though the E becomes a smarter node. The lowest BER at E is observed for the combined scenario. However, for this scenario the BER at ℬ is also very low as compared to the other two scenarios. Keeping in view the ability of combined scenario to provide ℬ resilience against channel estimation error and noise, and given a low value of ς (0.01) in the case of smarter E, the choice of combing RSS and φ seems logical.Lastly, a comparison between BER atℬ and the length of generated secret against the no. of transmissions is presented in Figure 16. It can be observed from the figure that for each scenario (RSS only (Δℛ = 1 dBm), φ only Δφ=1.40625°, and combined), the BER remains unaffected by the number of transmissions. However, the RSS-only scenario gives the lowest BER, followed by the combined and then the φ-only scenario with the highest BER. At the same time, the RSS-only scenario gives the lowest KGR, followed by the φ-only and then the combined scenarios, which produce a key of the length of as mush bits as produced by RSS-only and φ-only scenarios together. For instance, 20 transmissions generate 140 bits for the RSS-only scenario, 160 bits for the φ-only scenario, and 300 bits for the combined scenario.Figure 16
A comparison of BER and key length for different no. of transmissions. (dab = 50 m, dae = 49 m, deb = 1 m, and SNR = 32 dB).In short, given the ability of the combined scenario of producing more bits in a single transmission and at the same time giving promising results in terms of BER atℬ, it seems logical to exploit both RSS and φ of the channel. Furthermore, in order to control the BER at ℬ, the values of Δℛ and Δφ should be chosen in a way that it accommodates more errors stemming from imperfect channel estimation ξ and the receiver’s noise wab, while keeping the BER at E under control range even if E tries to estimate the channel between A and ℬ.


### 5.4. NIST Test Suite Evaluations

Finally, the generated keys are evaluated using the widely used randomness statistical test suite designed by the National Institute of Standards and Technology (NIST) [30]. The randomness evaluation results of all 100 K generated sequences, SAcom with a key length of 140 bits, are presented in Table 1. It is evident from the table that the secret keys, SAcom, generated through the proposed scheme passed all the tests. Hence, the keys are hard to forge as P-values returned from all tests are well greater than the significance level of 0.01.Table 1
Randomness evaluation of generated secrets using NIST test suite.
NIST statistical test suiteP-valueBlock frequency test0.484105Long-run test0.475302Monobit test0.492563Key entropy0.299363Maurer universal statistical test0.138716Discrete Fourier transform (spectral) test0.458082Overlapping template matching test0.484105


## 5.1. Perfect Channel Estimation

In what follows, the BER performance atℬ and E under perfect channel estimation is presented. In the perfect channel estimation case, A estimates the A-ℬ channel without any errors, i.e., ξ = 0 in equation (7); thus, the source of error in the perfect channel estimation case is the noise present at ℬ. Figure 8 depicts the BER performance at ℬ and E for all the considered scenarios, i.e., RSS-only, φ-only, and combined. Particularly, Figure 8(a) illustrates the effect of different RSS interval lengths Δℛ on the BER at E and ℬ. It is observed from the figure that BER at both E and ℬ decrease as Δℛ increases. For instance, the BER at ℬ for Δℛ = 1 dBm becomes 10−4 at SNR value of 38 dB, while the same BER is achieved at a lower SNR of 27 dB once an interval length Δℛ of 8 dBm is considered. This gives around 92% improvement in terms of the required SNR at ℬ to achieve the same BER. However, increasing Δℛ does not bring the BER at E to an acceptable point. For instance, E’s best BER is around 0.06 for Δℛ = 8 dBm at an SNR value of 48 dB. With this performance, it becomes practically impossible for E to get the same key as ℬ. Hence, the RSS-only scenario provides sufficient resilience against the E for the perfect channel estimation case.Figure 8
BER performance for perfect channel estimation (ξ = 0, dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) The effect of Δℛ for RSS-only scenario. (b) The effect of Δφ for φ-only scenario. (c) The combined effect of Δℛ and Δφ (SNR = 32 dBm). (d) The comparison of effect of Δℛ and Δφ on the BER for RSS-only, φ-only, and combined scenarios (key length = 140 bits).
(a)(b)(c)(d)Figure8(b) presents the BER at E and ℬ for φ-only scenario. Similar to the RSS-only scenario, the BER in φ-only scenario is inversely proportional to Δφ. The BER at ℬ and E improves with the interval length Δφ. Having said that, in the φ-only scenario a BER of 10−4 is achieved at an SNR value of 33 dB when Δφ=45°, which is possible only at an SNR of 48 dBm when Δφ becomes 1.40625°. However, for φ-only scenario, E experiences the worst performance. Although the E’s performance improves with increasing Δφ (see zoomed in-plot of Figure 8(b)), the best BER value is 0.49 for Δφ=45°, which is nowhere near to an acceptable performance. To this end, almost half the data received by E are inaccurate. Hence, φ-only scenario provides a significant resilience against E.Figure8(c) demonstrates the BER results at ℬ and E for the combined scenario. The figure is a three-dimensional (3D) plot where one axis represents the RSS interval in dBm and the second represents φ interval in degrees, and the z-axis represents the BER. All combinations of Δℛ and Δφ are considered, wherein the best performance is achieved for larger interval lengths. Figure 8(c) is plotted for an SNR value of 32 dBm. It is observed that BER reaches to 10−4 for the intervals’ combinations of Δℛ = 4 dBm and Δφ=45°, Δℛ = 8 dBm and Δφ=22.5°, and Δℛ = 8 dBm and Δφ=45°. The BER at ℬ will further improve the graph plotted for higher values of SNR. However, the best BER performance at E is 0.25, which is nowhere near to the performance of ℬ for any interval combination.Figure8(d) presents the comparison between all of the aforementioned scenarios, i.e., RSS-only, φ-only, and combined scenarios. In order to have a fair comparison, the selection of interval lengths in all scenarios is based on the number of bits they generate in a single transmission. For instance, Δℛ = 1 dBm, Δφ=2.8125°, and Δℛ = 8 dBm, Δφ=45° are chosen for RSS-only, φ-only, and combined scenarios, respectively. All these values produce seven bits in a single transmission (refer Figure 7) and a key length of 140 bits for 20 repetitive transmissions. It can be noted from the figure that the combined scenario performs better than others (RSS only and φ only) for BER at ℬ. However, comparing RSS-only and φ-only scenarios, RSS-only scenario performs better than φ-only scenario for BER at ℬ while providing the lowest BER at E. Having said that, the combined scenario is the best for BER at ℬ and is slightly better than RSS-only scenario at E. Although the φ-only scenario is the best to keep BER at E the worst, the combined scenario is also sufficient to keep E well away from BER at ℬ for any value of the required SNR. Comparing the RSS-only and combined scenarios, at an SNR value of 32 dB combined scenario performs 5% better than RSS-only scenario at E (E performs worse for the combined scenario) while improving the BER at ℬ by 99.95%. This is due to the reason that for the combined scenario interval lengths of Δℛ and Δφ are bigger than RSS-only and φ-only scenarios, giving ℬ a privilege to accommodate more errors (source is only noise here). Although the same is true for the E as well, but E has two sources of errors, that is, one is the channel, and the second is the noise at E. Due to this reason, the BER at E for the combined scenario is lower than φ-only scenario and a bit higher than RSS-only scenario. This makes the combined scenario a perfect choice both from the perspective of ℬ and E.Figure9 demonstrates the KAR between A-ℬ and A-E. It can be noted from the figure that larger values of Δℛ and Δφ generate better KAR at ℬ. For instance, for RSS-only scenario (Figure 9(a)), a KAR of 1 is achieved at an SNR value of 42 dBm when Δℛ= = 1 dBm, while the same rate of 1 can be achieved at an SNR of 32 dBm when Δℛ = 8 dBm. This means that Δℛ = 8 dBm is 2.16 times more power efficient than Δℛ = 1 dB. It is important to note that the combined scenario produces the best results for KAR at ℬ (see Figure 9(c)) as compared to separate scenarios. The results in Figure 9 are promising in a sense that the KAR at E for all the considered scenarios remains very poor even for high SNR values.Figure 9
Key agreement rate (KAR) betweenA-ℬ and A-E at different SNR values for all scenarios (ξ = 0, dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) RSS-only, (b) φ -only, and (c) combined.
(a)(b)(c)


## 5.2. Imperfect Channel Estimation

A more realistic case is now assumed whenA’s estimation of the A-ℬ channel is not perfect. The imperfection in the channel estimation is modeled by ξ in equation (7) of Section 3, where ξ is a complex Gaussian random variable with 0 mean and variance ς2. In particular, two different values of ς are considered, (i) 25 ×No and (ii) 50 ×No, where No is considered as 5 ×10−6. The performance of imperfect channel estimation for the scenarios of RSS only, φ only, and combined is investigated.Figure10 compares the BER performance at ℬ for different values of Δℛ, when A does not perfectly estimate the channel. In particular, Figure 10(a) illustrates the case of Δℛ = 1 dBm. It can be noted from the figure that the more imperfectly A estimates the channel hab, and the worse performance ℬ experiences in terms of BER. In particular, ς=50×No produces the worst result. For instance, at an SNR of 38 dBm ℬ experiences 10 times more BER when channel estimation error A is 50×No. This is due to the reason that the interval length Δℛ = 1 dBm has to accommodate two kinds of errors, that is, one is the noise at ℬwab, and the second is channel estimation error ξ.Figure 10
RSS-only scenario: BER performance atℬ and E for imperfect channel estimation at A (dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) ΔR=1 dBm and (b) ΔR=8 dBm.
(a)(b)Similarly, Figure10(b) demonstrates the BER performance at ℬ for Δℛ = 8 dBm. It is observed from the figure that BER at ℬ increases with channel estimation error. However, this increase is almost negligible due to higher value of Δℛ, which gives ℬ an ability to accommodate more errors in the channel estimation. For instance, at an SNR value of 24 dBm only 1.24% BER degradation is observed for ς=50×No compared with the perfect channel estimation. This justifies the claim of our algorithm’s superiority over the state of the art.Figure11 illustrates the effect of channel estimation error at ℬ for different values of Δφ. It can be observed from the figures that while Δφ starts increasing, BER at ℬ improves irrespective of value of ς. Similar to RSS-only scenario, larger intervals Δφ=45o in φ-only scenario provide more resilience against channel estimation error while keeping the BER at E in a controlled range. For instance compared with the perfect channel estimation, at an SNR value of 32 dBm, ℬ experiences only 66% BER degradation when Δφ=45o. This BER degradation is around 177.2% when Δφ=1.40625o for the same value of SNR.Figure 11
φ-only scenario: BER performance at ℬ and E for imperfect channel estimation at A (dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) Δφ=1.40625°, (b) Δφ=11.25°, and (c) Δφ=45°.
(a)(b)(c)Figure12 highlights the effect of channel estimation error on the combined scenario. All combinations of Δℛ and Δφ are considered in Figure 12(a), plotting Δℛ on one axis, Δφ second axis, and BER on the third axis for an SNR of 32 dBm. It is observed from Figure 12(a) that higher interval lengths have the ability to accommodate more channel estimation error. For instance in case of ς=50×No, the BER at ℬ was still as low as 10−4 for two different combinations of Δℛ and Δφ (Δℛ = 4 dBm, Δφ=45o, Δℛ = 8 dBm, and Δφ=45o).Figure 12
Combined scenario: BER performance atℬ and E for imperfect channel estimation at A (dab = 50 m, dae = 49 m, deb = 1 m, and K (no. of transmissions) = 20). (a) BER performance for all combinations of ΔR and Δφ (SNR = 32 dBm). (b) Comparison between RSS-only, φφ-only, and combined scenarios (key length = 140 bits).
(a)(b)Figure12(b) illustrates the comparison between RSS-only, φ-only, and combined scenarios in terms of their resiliency against channel estimation errors. Again, similar to perfect channel estimation case, for a fair comparison same key length (140 bits) is considered for all three scenarios. It can be observed from the figure that combined scenario performs better than individual scenarios (RSS only and φ only).


## 5.3. Smart Eavesdropper (E)

This subsection highlights the performance when considering a more intelligent or smarter ofE by allowing E the ability to estimate the channel between A and ℬ. In this scenario, the channel estimation at E can be represented by(13)hEest=hab+ε,where ε is a complex Gaussian random variable 0,ζ2 representing the channel estimation error at E. Two different values of ζ are considered for simulations, (i) ζ = 0.1 and (ii) ζ = 0.01. The BER performance at a smarter E for RSS-only, φ-only, and combined scenarios is investigated.In particular, Figure13 represents the BER at E against different values of ζ for an RSS-only scenario. It is evident from Figure 13(a) that Δℛ = 1 dBm keeps the BER at E under the control range (away from ℬ) even if she tries to estimate A-ℬ channel with lesser error (ζ = 0.01). This is due to the reason that a smaller interval length does not accommodate more errors and hence keeps the BER of E apart from ℬ. On the other hand, in the case of larger intervals (Δℛ = 8 dBm), E starts getting better results when ζ = 0.01, but the improvement is not comparable to ℬ. For instance, for Δℛ = 8 dBm and SNR = 32 dBm, the BER at the smarter E is 20 times more than what is at ℬ even though the ζ = 0.01. In addition, ζ = 0.01 is itself a very small value, which makes the A-E channel comparable with A-ℬ channel. In order to realize such a small value of ζ, E has to be very smart and somehow sit over ℬ, which is not practically possible. A very small interval value is chosen for the sole purpose of evaluating the robustness of the proposed approach against E.Figure 13
RSS-only scenario: BER performance for a smarterE. (a) ΔR=1 dBm. (b) ΔR = 8 dBm.
(a)(b)Figure14 illustrates the BER at E for φ-only scenario. Similar to RSS-only scenario, here as well both the smaller and larger intervals provide resilience against smarter E. Although smaller intervals are more resilient as compared to larger intervals, the larger intervals still keep BER at smarter E well apart from what ℬ has at the same SNR value. For instance, for Δφ=45° and SNR = 32 dBm, a smart E (with ζ = 0.01) experiences 40 times higher BER than ℬ.Figure 14
φ-only scenario: BER performance for a smarter E. (a) Δφ=1.40625°. (b) Δφ=11.25°. (c) Δφ=45°.
(a)(b)(c)Figure15(a) represents the BER at E and ℬ for different combinations of Δℛ and Δφ. The figure is plotted at an SNR of 32 dBm. It can be observed from the figure that E’s BER never becomes comparable with the BER at ℬ even when E is assumed as a smarter node (ζ = 0.01), and A does not perfectly estimate the A-ℬ channel (ς = 50 ×No). In the case of smarter E (ζ = 0.01), the lowest BER is 0.008 when Δℛ = 8 dbm and Δφ=45°, while for the same combination of interval length ℬ experiences a BER of 2.07 ×10−6. Hence, E BER is 375 times lower than BER of ℬ even when E is a smarter device.Figure 15
Combined scenario: BER performance for a smarterE. (a) BER performance for all combinations of ΔR and Δφ (SNR = 32 dBm). (b) Comparison between RSS-only, φ -only, and combined scenarios. (Key length = 140 bits).
(a)(b)Figure15(b) compares the BER at ℬ and E for all the three scenarios. It can be noted from the figure that φ-only scenario performs better in order to keep BER at E well above the BER at ℬ even though the E becomes a smarter node. The lowest BER at E is observed for the combined scenario. However, for this scenario the BER at ℬ is also very low as compared to the other two scenarios. Keeping in view the ability of combined scenario to provide ℬ resilience against channel estimation error and noise, and given a low value of ς (0.01) in the case of smarter E, the choice of combing RSS and φ seems logical.Lastly, a comparison between BER atℬ and the length of generated secret against the no. of transmissions is presented in Figure 16. It can be observed from the figure that for each scenario (RSS only (Δℛ = 1 dBm), φ only Δφ=1.40625°, and combined), the BER remains unaffected by the number of transmissions. However, the RSS-only scenario gives the lowest BER, followed by the combined and then the φ-only scenario with the highest BER. At the same time, the RSS-only scenario gives the lowest KGR, followed by the φ-only and then the combined scenarios, which produce a key of the length of as mush bits as produced by RSS-only and φ-only scenarios together. For instance, 20 transmissions generate 140 bits for the RSS-only scenario, 160 bits for the φ-only scenario, and 300 bits for the combined scenario.Figure 16
A comparison of BER and key length for different no. of transmissions. (dab = 50 m, dae = 49 m, deb = 1 m, and SNR = 32 dB).In short, given the ability of the combined scenario of producing more bits in a single transmission and at the same time giving promising results in terms of BER atℬ, it seems logical to exploit both RSS and φ of the channel. Furthermore, in order to control the BER at ℬ, the values of Δℛ and Δφ should be chosen in a way that it accommodates more errors stemming from imperfect channel estimation ξ and the receiver’s noise wab, while keeping the BER at E under control range even if E tries to estimate the channel between A and ℬ.


## 5.4. NIST Test Suite Evaluations

Finally, the generated keys are evaluated using the widely used randomness statistical test suite designed by the National Institute of Standards and Technology (NIST) [30]. The randomness evaluation results of all 100 K generated sequences, SAcom with a key length of 140 bits, are presented in Table 1. It is evident from the table that the secret keys, SAcom, generated through the proposed scheme passed all the tests. Hence, the keys are hard to forge as P-values returned from all tests are well greater than the significance level of 0.01.Table 1
Randomness evaluation of generated secrets using NIST test suite.
NIST statistical test suiteP-valueBlock frequency test0.484105Long-run test0.475302Monobit test0.492563Key entropy0.299363Maurer universal statistical test0.138716Discrete Fourier transform (spectral) test0.458082Overlapping template matching test0.484105


## 6. Conclusions

This study presents an efficient key distribution scheme that is ideal for resource-constrained networks, such as IoT networks, where conventional security methods are not applicable. Instead of implementing the conventional method of generating keys using channel probing, quantization, information reconciliation, and privacy amplification, this work proposes a mapping table-based secret key generation scheme wherein a span of channel characteristics produces a shared secret key between legitimate users. This span-based approach provides the proposed scheme with enough robustness against channel estimation errors. In addition, apart from channel randomness, the induced randomness atA in selecting a key from the table makes the proposed scheme ideal for static environments where channel randomness is not significant. Furthermore, the proposed scheme combines channel phase and magnitude to generate faster keys and improve KAR and reduce BER performances. The protection against a smarter E with capabilities of estimating the channel between A and ℬ further verifies the superiority of the proposed approach against many state-of-the-art schemes.



---

*Source: 7976319-2022-05-14.xml*