# Scramble-Based Secret Key Generation Algorithm in Physical Layer Security

Authors: Dan Wang; Feng Chen; Yongtai Chen; Mingjie Zheng; Jingui Zheng
Journal: Mobile Information Systems
 (2022)

---

## Abstract

As a new way to enhance wireless communication security, secret key generation based on physical layer channel characteristics has emerged. In this paper, we propose a novel secret key generation algorithm based on wireless channel characteristics for orthogonal frequency division multiplexing (OFDM) communication systems. The mean quantization algorithm is applied to quantize the real part and imaginary part of OFDM subcarriers, respectively, which can significantly increase the length of the generated secret key in the OFDM system. To reduce the consistency between the secret keys generated by the eavesdropper and the legitimate communication nodes, a processing method by taking the subcarrier phase as initialization of a scrambling code and scrambling the quantized result is proposed. The simulation and test results show that compared with the existing research, the proposed algorithm can improve the key generation rate (KGR), reduce the key mismatch rate (KMR) and complexity, maintain high randomness, and disturb the eavesdroppers.


---

## Body

## 1. Introduction

Secret key generation technology is becoming increasingly popular in wireless communication devices, especially smartphones and other smart devices. It plays an increasingly important role in people’s daily lives. To ensure the confidentiality and security of wireless communication, classical encryption-based techniques are used in the upper layers [1]. Unlike traditional upper-layer keys, physical layer secret key generation techniques do not require complicated hash calculations or any infrastructure for distribution or management [2]. This technique can be used in wireless communication devices with limited computing power, or even by eavesdroppers with unlimited computing power. Furthermore, in a multipath scattering environment, if the distance between the eavesdropper (Eve) and the legitimate node (Alice/Bob) is greater than half a wavelength, they will experience uncorrelated channels [3]. As a result, the eavesdropper (Eve) is unable to obtain the same as the one obtained by the legitimate node (Alice/Bob). As well as the above-given advantages, physical layer secret key generation has been gaining attention as a lightweight security tool, especially in applications such as V2X, IoT, and smart homes. The physical layer secret key generation techniques based on the randomness and reciprocity of wireless channels are gradually becoming more effective as a complement to upper layer encryption methods.Numerous physical layer secret key generation schemes have been proposed for orthogonal frequency division multiplexing (OFDM)-based systems. These schemes generally used channel impulse responses (CIR), phase, or amplitude of the received signal to generate secret keys [4]. The authors of [5] proposed an OFDM subcarrier index selection (OFDM-SIS) which maximized the signal-to-noise ratio at legitimate receivers and an adaptive subcarrier interleaving scheme that reduced the correlations among subcarriers. The authors of [6] proposed channel status information (CSI) based key generation for OFDM indoor and outdoor systems. In [7], signal space diversity is used to separate the in-phase and orthogonal components of complex modulated symbols to increase diversity gain over Eve, thereby improving the confidentiality of OFDM systems. The authors of [8] studied key generation for OFDM systems with the phase variation of channel frequency response based on time-varying channels.The legitimate communication nodes in the above schemes mainly use CIR, index, or received signal strength (RSS) to generate the same random secret key. However, all these methods have some limitations [9]. For example, a faster channel probing rate will produce a higher key generation rate but may reduce temporal redundancy and randomness, while a higher quantization level will produce a higher key generation rate but a higher key mismatch rate, especially in a low signal-to-noise environment it could become more obvious. On the one hand, some of the above-mentioned literature can take into consideration the key generation rate and key mismatch rate, but the computational complexity increases as a result. On the other hand, while pursuing high performance in key generation rate and key mismatch rate, the randomness of secret keys cannot be compromised and must be maintained at a high level.In general, most of the current secret key generation techniques are based on received signal strength (RSS) and channel state information (CSI), where channel impulse response (CIR) is one of the most commonly used CSI. The RSS is a coarse-grained channel information indicator, where only one RSS value can be obtained per packet, which imposes a limitation on the KGR. The CSI is a fine-grained channel parameter that provides detailed channel information, CSI-based systems are able to provide high KGR, and CIR has been shown to be ideal for a key generation [10]. In addition, RSS is vulnerable to predictable channel attacks in some cases, but there is experimental evidence that CSI is immune to predictable channel attacks [11]. To further improve the key generation rate of the secret key generation method as well as to reduce the key mismatch rate while maintaining the key randomness. We choose to use the real and imaginary parts of CIR to generate secret keys. In addition, in order to enhance the confidentiality of the key, the phase is used to quantize the initial value of the scrambled code and to facilitate subsequent quantization. In this paper, a novel key generation algorithm for the OFDM system is proposed. The work in this paper is summarized as follows:(1)
Generates initial secret keys by comparing the imaginary and real parts of each subcarrier with the mean of the real and imaginary parts of the entire OFDM block, respectively. It can increase the key generation rate by a large amount compared with it based on the magnitude of CIR.(2)
After the initial secret key generation, the entire OFDM block is divided into multiple subblocks. The mean phase of the subcarriers within each subblock is used as an initial value and a scrambling sequence is generated with it. Then, the secret key is scrambled with that sequence, which can effectively reduce the key leakage at the eavesdropper and improve the confidentiality of the key.(3)
We analyze the proposed algorithm’s reliability and security by using results derived from information-theoretic security theory. Simulation results show that the algorithm can significantly improve the key generation rate, further reduce key mismatch rate both in high and low SNR environments, also it passes the NIST randomness test. Finally, its computational complexity is analyzed and compared with existing algorithms.


### 1.1. Notations

The transpose is represented by⋅T.


## 1.1. Notations

The transpose is represented by⋅T.


## 2. System Model and the Proposed Algorithm

### 2.1. System Model

As shown in Figure1, the channel model is assumed to be a Rayleigh fading channel with N exponentially fading taps. The communication system model is assumed to be SISO-OFDM with time-division duplexing (TDD). The legitimate nodes are Alice and Bob who try to communicate securely with each other by using CIR to generate secret keys in the presence of a passive eavesdropper (Eve). In addition, the CIR between Alice and Bob is denoted as hABt1∈C1×N, the CIR between Bob and Alice is denoted as hBAt2∈C1×N, and the CIR between Alice and Eve is denoted as hAEt3∈C1×N, when the interval time between t1 and t2 are shorter than the coherence time τt1−t2<τ, according to the characteristic of short-time reciprocity of wireless channels [12], the radio channels experienced by both are closely correlated between hABt1 and hBAt2, i.e., hABt1≈hBAt2.Figure 1
System model.Furthermore, we consider an eavesdropper, who tracks the legitimate nodes involved in secret key extraction. It could eavesdrop on all open discussions in the key generation process and the secret key generation algorithm with the corresponding key generation parameters. Because of the differences in location and environment, it is assumed that the distance between Alice/Bob and Eve is greater than or equal to half a wavelength. Hence the wireless channels experienced by both are uncorrelated in the multipath fading environment, resulting in independent observations at the legitimate nodes and the eavesdropper.Taking Alice as the transmitter, the frequency domain OFDM symbols (pilots) can be expressed as=a1,a2,...,aMT∈CM×1 , where M denotes the number of the pilots. The pilots are processed first, then sent to Bob and Eve through the wireless channel. In the frequency domain, the received signal yi∈CM×1 of Bob or Eve can be written as follows:(1)yi=Hifa+Zif,where the subscripts i=b,e denote the receiver`s parameters for Bob or Eve, and the vectors Zif denote the Fourier transform of the additive white Gaussian noise (AWGN) with mean 0 and variance of σ2 , Furthermore, Hif∈CM×M is the channel frequency response diagonal matrix.


### 2.2. Proposed Algorithms

In this section, we present the detailed steps of the proposed Real and Imaginary parts-based Scrambled Key Generation (RISKG) algorithm. Among them, we use the real and imaginary parts of CSI to generate the initial secret key, and it is proved that the real and imaginary parts always have better performance than the amplitude and phase in generating the secret key. In addition, we use the mean phase of the subblock for quantization as a scrambling code initialization in order to enhance the key confidentiality, since the phase has a higher amount of mutual information between the channel of Alice to Bob and Bob to Alice compared to the amplitude and is easier to quantize [10].The specific steps of the algorithm are as follows:(1)
During the coherence timeτ of the channel, Alice and Bob send the pilots a=a1,a2,...,aMT∈CM×1 and b=b1,b2,...,bMT∈CM×1 to each other for channel estimation. Taking the example of Alice sending pilots a to Bob, the channel estimate at Bob/Eve can be expressed in the frequency domain as Hif∈CM×M,(2)
The diagonal matrixΗif obtained at Bob/Eve is converted into a row vector hi, and the procedure can be described as hi=diagHifT∈C1×M.(3)
After that, the vectorhi is evenly divided into s subblocks, i.e., hi=hi1,hi2,...,hij,...,his, where j=1,2,...,s. Each subblock contains l elements that =M/s, hij=hij,1,hij,2,...,hij,k,...,hij,l, where k=1,2,...,l,(4)
Next, compute its real and imaginary part values for each elementhij,k in each subblock hij, which can be indicated by Rhij,k and Ihij,k respectively. Calculate the real part mean and the imaginary part mean of all elements in the vector hi:(2)meanR=∑j=1s∑k=1lRhij,kM,meanI=∑j=1s∑k=1lIhij,kM.(5)
Extract the mean phaseθj for each subblock hij:(3)θj=∑k=1lθij,kl,whereθij,k is the phase of each element hij,k.(6)
The initial secret key generation rule corresponding to each elementhij,k within each subblock hij is shown as follows:(4)KeyRij,k=0,meanR>Rhij,k,1,meanR≤Rhij,k,KeyIij,k=0,meanI>Ihij,k,1,meanI≤Ihij,k.For each subblockhij, the real part key and imaginary part key are respectively generated by KeyRij=KeyRij,1,KeyRij,2,...,KeyRij,l and KeyIij=KeyIij,1,KeyIij,2,...,KeyIij,l, The initial secret key of the real part and the imaginary part of the whole vector hi can be expressed as KeyRi=KeyRi1,KeyRi2,...,KeyRij,...,KeyRis and KeyIi=KeyIi1,KeyIi2,...,KeyIij,...,KeyIis.(7)
The acquired phaseθj is quantified as follows:(5)C1j=0,π>θj≥0,1,2π>θj≥π,whereC1 denotes the mean phase quantization of all the elements within each subblock, C1=C11,...,C1j,...,C1s.(8)
For the sequenceC1=C11,...,C1j,...,C1s, To obtain a 31-length scramble initialization sequence C2, only the first 31 bits are remain when s≥31; or 31−s bits of 0 are added to C1 when s<31. The generation process of the scramble initial sequence C2=C21,...,C2j,...,C231∈C1×31 can be expressed as follows:(6)C2=C11,...,C1j,...,C131∈C1×31,s≥31,C11,...,C1j,...,C1s,0,...,0∈C1×31,s<31.(9)
Referring to the scrambling generation in 3GPP physical layer standard [13]. Generating a Gold sequence C3 of length M. The first m-sequence p shall be initialized with p1=1,pn=0,n=2,3,...,31. The initialization of the second m-sequence q is denoted by qn′=C2n′, where n′=1,2,...,31. When the length of the m-sequence is greater than 31, the calculation is performed as follows:(7)pn+31=pn+3+pnmod2,qn+31=qn+3+qn+2+qn+1+qnmod2.The Gold sequenceC3 of length M is generated as a scrambled sequence as follows:(8)C3n=pn+NC+qn+NCmod2,whereNc=1600. The Gold sequence C3 is used to scramble the real initial key KeyRi and the imaginary initial key KeyIi of the entire vector hi , The final real part key KRi and imaginary part key KIi can be expressed as KRi=KRi1,KRi2,...,KRij,...,KRis and KIi=KIi1,KIi2,...,KIij,...,KIis ,(10)
The generated final real part keyKRi and the final real part key KIi of each subblock hij are arranged in Figure 2 to generate the final secret key K [14].The final secret keyK can be given as K=KRi1,KIi1,KRi2,...,KRij,KIij,...,KRis,KIis.Figure 2
Key arrangement.


## 2.1. System Model

As shown in Figure1, the channel model is assumed to be a Rayleigh fading channel with N exponentially fading taps. The communication system model is assumed to be SISO-OFDM with time-division duplexing (TDD). The legitimate nodes are Alice and Bob who try to communicate securely with each other by using CIR to generate secret keys in the presence of a passive eavesdropper (Eve). In addition, the CIR between Alice and Bob is denoted as hABt1∈C1×N, the CIR between Bob and Alice is denoted as hBAt2∈C1×N, and the CIR between Alice and Eve is denoted as hAEt3∈C1×N, when the interval time between t1 and t2 are shorter than the coherence time τt1−t2<τ, according to the characteristic of short-time reciprocity of wireless channels [12], the radio channels experienced by both are closely correlated between hABt1 and hBAt2, i.e., hABt1≈hBAt2.Figure 1
System model.Furthermore, we consider an eavesdropper, who tracks the legitimate nodes involved in secret key extraction. It could eavesdrop on all open discussions in the key generation process and the secret key generation algorithm with the corresponding key generation parameters. Because of the differences in location and environment, it is assumed that the distance between Alice/Bob and Eve is greater than or equal to half a wavelength. Hence the wireless channels experienced by both are uncorrelated in the multipath fading environment, resulting in independent observations at the legitimate nodes and the eavesdropper.Taking Alice as the transmitter, the frequency domain OFDM symbols (pilots) can be expressed as=a1,a2,...,aMT∈CM×1 , where M denotes the number of the pilots. The pilots are processed first, then sent to Bob and Eve through the wireless channel. In the frequency domain, the received signal yi∈CM×1 of Bob or Eve can be written as follows:(1)yi=Hifa+Zif,where the subscripts i=b,e denote the receiver`s parameters for Bob or Eve, and the vectors Zif denote the Fourier transform of the additive white Gaussian noise (AWGN) with mean 0 and variance of σ2 , Furthermore, Hif∈CM×M is the channel frequency response diagonal matrix.


## 2.2. Proposed Algorithms

In this section, we present the detailed steps of the proposed Real and Imaginary parts-based Scrambled Key Generation (RISKG) algorithm. Among them, we use the real and imaginary parts of CSI to generate the initial secret key, and it is proved that the real and imaginary parts always have better performance than the amplitude and phase in generating the secret key. In addition, we use the mean phase of the subblock for quantization as a scrambling code initialization in order to enhance the key confidentiality, since the phase has a higher amount of mutual information between the channel of Alice to Bob and Bob to Alice compared to the amplitude and is easier to quantize [10].The specific steps of the algorithm are as follows:(1)
During the coherence timeτ of the channel, Alice and Bob send the pilots a=a1,a2,...,aMT∈CM×1 and b=b1,b2,...,bMT∈CM×1 to each other for channel estimation. Taking the example of Alice sending pilots a to Bob, the channel estimate at Bob/Eve can be expressed in the frequency domain as Hif∈CM×M,(2)
The diagonal matrixΗif obtained at Bob/Eve is converted into a row vector hi, and the procedure can be described as hi=diagHifT∈C1×M.(3)
After that, the vectorhi is evenly divided into s subblocks, i.e., hi=hi1,hi2,...,hij,...,his, where j=1,2,...,s. Each subblock contains l elements that =M/s, hij=hij,1,hij,2,...,hij,k,...,hij,l, where k=1,2,...,l,(4)
Next, compute its real and imaginary part values for each elementhij,k in each subblock hij, which can be indicated by Rhij,k and Ihij,k respectively. Calculate the real part mean and the imaginary part mean of all elements in the vector hi:(2)meanR=∑j=1s∑k=1lRhij,kM,meanI=∑j=1s∑k=1lIhij,kM.(5)
Extract the mean phaseθj for each subblock hij:(3)θj=∑k=1lθij,kl,whereθij,k is the phase of each element hij,k.(6)
The initial secret key generation rule corresponding to each elementhij,k within each subblock hij is shown as follows:(4)KeyRij,k=0,meanR>Rhij,k,1,meanR≤Rhij,k,KeyIij,k=0,meanI>Ihij,k,1,meanI≤Ihij,k.For each subblockhij, the real part key and imaginary part key are respectively generated by KeyRij=KeyRij,1,KeyRij,2,...,KeyRij,l and KeyIij=KeyIij,1,KeyIij,2,...,KeyIij,l, The initial secret key of the real part and the imaginary part of the whole vector hi can be expressed as KeyRi=KeyRi1,KeyRi2,...,KeyRij,...,KeyRis and KeyIi=KeyIi1,KeyIi2,...,KeyIij,...,KeyIis.(7)
The acquired phaseθj is quantified as follows:(5)C1j=0,π>θj≥0,1,2π>θj≥π,whereC1 denotes the mean phase quantization of all the elements within each subblock, C1=C11,...,C1j,...,C1s.(8)
For the sequenceC1=C11,...,C1j,...,C1s, To obtain a 31-length scramble initialization sequence C2, only the first 31 bits are remain when s≥31; or 31−s bits of 0 are added to C1 when s<31. The generation process of the scramble initial sequence C2=C21,...,C2j,...,C231∈C1×31 can be expressed as follows:(6)C2=C11,...,C1j,...,C131∈C1×31,s≥31,C11,...,C1j,...,C1s,0,...,0∈C1×31,s<31.(9)
Referring to the scrambling generation in 3GPP physical layer standard [13]. Generating a Gold sequence C3 of length M. The first m-sequence p shall be initialized with p1=1,pn=0,n=2,3,...,31. The initialization of the second m-sequence q is denoted by qn′=C2n′, where n′=1,2,...,31. When the length of the m-sequence is greater than 31, the calculation is performed as follows:(7)pn+31=pn+3+pnmod2,qn+31=qn+3+qn+2+qn+1+qnmod2.The Gold sequenceC3 of length M is generated as a scrambled sequence as follows:(8)C3n=pn+NC+qn+NCmod2,whereNc=1600. The Gold sequence C3 is used to scramble the real initial key KeyRi and the imaginary initial key KeyIi of the entire vector hi , The final real part key KRi and imaginary part key KIi can be expressed as KRi=KRi1,KRi2,...,KRij,...,KRis and KIi=KIi1,KIi2,...,KIij,...,KIis ,(10)
The generated final real part keyKRi and the final real part key KIi of each subblock hij are arranged in Figure 2 to generate the final secret key K [14].The final secret keyK can be given as K=KRi1,KIi1,KRi2,...,KRij,KIij,...,KRis,KIis.Figure 2
Key arrangement.


## 3. Security Analysis

In this section, we analyze quantitative measurements of security. The metric of security is usually based on information theory, in which one of the metrics is the amount of mutual information between the key generated at the legitimate node and eavesdropper.Since the distance between Eve and Bob is assumed to be smaller than the distance between Eve and Alice, only the mutual information between Alice to Bob and the mutual information between Alice to Eve is taken into consideration. Equation (13) can be used to calculate the Pearson correlation coefficient of the channel fading coefficient at two locations separated by d [15].(9)ρ=J0kd2,where J0⋅ is the first kind of Bessel function, k is the wavenumber. As shown in Figure 3 that is the image of the function.Figure 3
The bessel function of the first kind.At thep-th subcarrier, the fading coefficients of the Alice to Bob and Alice to Eve channels are determined as hbp and hep. In addition, the correlation coefficient between hbp and hep is shown in equation (13) that is ρ. The amount of mutual information between hbp and hep is minded to be expressed as Ihbp;hep. hbp and hep can be denoted as follows:(10)hbp=hbp,R+ihbp,I,hep=hep,R+ihep,I.Bothhbp,R and hbp,I are independent identical distributions and obey N0,σb2/2. As well, hep,R and hep,I are independent identical distributions and obey N0,σe2/2. Ihbp;hep can be calculated by the following equation (16):(11)Ihbp;hep=Ihbp,R+ihbp,I;hep,R+ihep,I=Ihbp,R,hbp,I;hep,R,hep,I,=Hdhbp,R,hbp,I+Hdhep,R,hep,I−Hdhbp,R,hbp,I,hep,R,hep,I,where Hd⋅ is the entropy. The real and imaginary parts of the Alice to Bob and Alice to Eve channel coefficients are related to the parameter ρ. Alternatively, the covariance matrix can be shown as follows:(12)∑1=σb2/200σb2/2,∑2=σe2/200σe2/2,∑3=σb2200σb22ρσbσe200ρσbσe2ρσbσe200ρσbσe2σe2200σe22.After introducing equation (12), equation (11) can be written as follows:(13)Ihbp;hep=Hdhbp,R,hbp,I+Hdhep,R,hep,I−Hdhbp,R,hbp,I,hep,R,hep,I=12logdet2πe∑1+12logdet2πe∑2p−12logdet2πe∑3=logπeσb2+logπeσe2−logπeσbσe21−ρ2=−log1−ρ2.Whenρ approaches 0, the amount of mutual information Ihbp;hep approaches 0. In the worst-case situation, Eve and Bob are separated by half a wavelength. Half a wavelength is 5 cm when the frequency band is assumed to be 3 GHz.(14)ρ=J0kd2=J02πλd2=2πcfd2=J020πd2,where c is the speed of light. As shown in Figure 4, at this time we can obtain the correlation coefficient ρ≈0.09 and the amount of mutual information Ihbp;hep≈0.01bit.Figure 4
Correlation coefficient versus distance in the 3 GHz band.


## 4. Simulation Performance Analysis

In this section, numerical results are given to illustrate the performance of the RISKG algorithm. The RISKG algorithm is compared with three algorithms including the conventional key generation (CKG) algorithm, index-based key generation (IKG) algorithm, and joint key generation (JKG) algorithm. The CKG algorithm generates the key by comparing each subcarrier amplitude with the mean of the subcarrier amplitudes within the entire OFDM block [6]; the IKG algorithm divides the whole OFDM block into subblocks, which generates the corresponding secret keys according to the index positions of the strongest and second strongest subcarriers within the subblocks; the JKG algorithm combines CKG and IKG to generate the corresponding secret keys [16].We assume that there areN=9 pathways in the Rayleigh fading channel between any two communication nodes, where the exponentially fading power delay distribution is taken into consideration [17]. To make a fair comparison with the other above-mentioned three algorithms, the parameters related to the simulation performance analysis of all algorithms are uniformly set (according to Table 1).Table 1
Simulation parameters set.
ItemNumberNumber of subcarriers of the OFDM blockM=128Total number of sub blockss=32Number of subcarriers per sub blockl=M/s=4In addition, the effects of nonideal channel reciprocity and nonideal channel estimation due to noise, interference, and synchronization errors are considered [18]. Due to the influence of the channel estimation, the channel between Alice and Bob can be expressed as H^a/bf=Hif+ΔH^a/bf and H^b/af=Hif+ΔH^b/af. ΔH^a/bf and ΔH^b/af is modeled as an independent complex Gaussian noise with mean 0 and variance σa/b2=e×10−SNRdB/10, it should be emphasized that the error variance value of the estimated channel depends on the quality of the adopted estimator, which is highly affected by the length of the training sequence and its power. Thus, we use a similar scale e∈0.01,0.001,0.0001 referred to all secret key generation algorithms [19].


### 4.1. Performance Metrics

The key generation rate (KGR) describes the ratio of the number of secret keys generated to the number of channel characteristics in each measurement, and a higher bit rate indicates that a long secret key can be generated in a shorter period. When the key generation rate is faster, the keys are updated more frequently and the communication system is more secure. When the probing speed is given, the key generation rate is calculated as follows:(15)KGR=LMbits/sample,where L is the number of secret keys, M is the number of channel characteristics.The key mismatch rate (KMR) is mainly used to measure the mismatch between legitimate communication nodes, which is calculated as follows:(16)KMR=∑i=1LKAi−KBiL,where KA and KB denote the secret keys generated at Alice and Bob’s, respectively.The key leakage rate (KLR) is used to measure the matching rate of keys between legitimate communication nodes and eavesdroppers, which is calculated as follows:(17)KLR=1−∑i=1LKBi−KEiL,where KB and KE denote the secret keys generated at Bob and Eve, respectively. Lower KLG indicates less information has been leaked and better performance.Randomness is a measure of the security strength of the secret keys generated by Alice and Bob that determines whether the key generation scheme is secure or not. At present, most of the tests for secret key randomness in physical layer secret key research use the randomness test standard issued by the National Institute of Standards and Technology (NIST). The test items include: frequency, block frequency, cumulative sums, runs, longest run, rank, discrete Fourier transform, nonperiodic template matchings, overlapping template matchings, universal statistical, approximate entropy, random excursions, random excursions variant, serial, linear complexity [20]. Due to the limitation of the final key length, the key sequence generated by the RISKG algorithm meets 7 of 15 test items, and only 7 of them are selected for testing.


### 4.2. Simulation Performance

Figure5 shows KGR versus SNR for the RISKG, CKG, IKG, and JKG algorithms at Bob or Eve under the nonideal channel situation and imperfect channel estimation (e∈0.01,0.001,0.0001). It can be seen from the figure that as e decreases, the KGR of all algorithms increases to some extent. As the SNR rises, the KGR of all algorithms rises to some extent, gradually approaching the highest KGR in the ideal state at around 40 dB. The RISKG algorithm proposed in this paper greatly surpasses the other three algorithms in the performance of KGR, under the same SNR and e. It can also be seen that Eve’s KGR for different SNR cases is smaller than that of any algorithm used on Bob with all algorithms.Figure 5
KGR versus SNR performance under non-ideal channels and imperfect channel estimation for RISKG, CKG, IKG, JKG algorithms.Figure6 shows KMR versus SNR of RISKG, CKG, IKG, and JKG algorithms at Bob and Eve in the case of nonideal channels and imperfect channel estimation (e∈0.01,0.001,0.0001). It can be seen from the figure that the KMR of all algorithms decreases as e decreases. Simultaneously the KMR of all algorithms decreases as SNR increases. The proposed RISKG algorithm outperforms the other three algorithms. Due to the uncorrelation of the channel, there is a significant gap between the KMR on Eve and Bob compared to all cases on Bob, and it becomes more obvious as the SNR increases.Figure 6
KMR versus SNR performance under non-ideal channels and imperfect channel estimation for RISKG, CKG, IKG, JKG algorithms.In addition, Figure7 shows the KLG vs. SNR of keys generated at Eve using the RISKG algorithm, the IKG algorithm, and the RISKG algorithm without scrambling for e=0.001. From the three sets of data in Figure 7, the KLR is reduced by scrambling, which makes Eve steal less useful information. And RISKG algorithm also reduces the KLG at Eve compared to the IKG algorithm, which improves the security of the communication system.Figure 7
KLR versus SNR performance at eve for the RISKG algorithm, the IKG algorithm, and the RISKG algorithm without scrambling.The randomness test results of the keys generated by the RISKG algorithm are shown in Table2. The generated final secret key sequence is checked for randomness using the NIST statistical test suite in this paper. The NIST statistical test suite consists of 15 different test items, each test is given a P-value (P-value is a probability value between 0 and 1). If the P-value of each test is more than 0.01, the randomness tests are regarded to be passed. The 7 test items are randomly picked secret keys generated by the RISKG algorithm when the SNR is 10 dB, which tested under e∈0.01,0.001,0.0001 respectively are shown in Table 2.Table 2
NIST test suite results.
Test itemsP-values (RISKG)e = 0.01e = 0.001e = 0.0001Frequency0.58380.31150.2549Block frequency0.98520.03380.2888Cumulative sums0.87400.22760.45830.54460.56200.2915Runs0.65800.75190.0248Longest run0.31740.54420.3696Approximate entropy0.98250.97320.9814Serial0.49890.49890.15290.49850.23390.9855


### 4.3. Computational Complexity

To fairly compare the complexity of the three algorithms, we uniformly assume that the key generation is performed for the diagonal matrixHif∈CM×M in the coherent time τ and the size of the subblock is uniformly assumed to be l. For the RISKG algorithm, a total of 3−1/lM−2 addition calculations, M/l+2 multiplication calculations, 7M+3200 bitwise exclusive-OR calculations and 3M comparisons are performed. Taken together, the RISKG algorithm has complexity OM, which implies that the proposed algorithm has linear complexity with respect to the length of key generation. For the IKG algorithm, because of its multiplication by the interleaving matrix R∈CM×M, it performs M3 multiplication calculations, M−13 addition calculations, and 1+logl/l−2/lM comparison calculations. The JKG algorithm performs more 1−1/lM addition calculations and M/l times multiplication on the base of the IKG algorithm, so the complexity of both the IKG and JKG algorithms is OM3 and greater than the proposed RISKG algorithm. The computational complexity of the three algorithms is shown in Table 3.Table 3
Computational complexity.
AlgorithmComplexityRISKGOMIKGOM3JKGOM3


## 4.1. Performance Metrics

The key generation rate (KGR) describes the ratio of the number of secret keys generated to the number of channel characteristics in each measurement, and a higher bit rate indicates that a long secret key can be generated in a shorter period. When the key generation rate is faster, the keys are updated more frequently and the communication system is more secure. When the probing speed is given, the key generation rate is calculated as follows:(15)KGR=LMbits/sample,where L is the number of secret keys, M is the number of channel characteristics.The key mismatch rate (KMR) is mainly used to measure the mismatch between legitimate communication nodes, which is calculated as follows:(16)KMR=∑i=1LKAi−KBiL,where KA and KB denote the secret keys generated at Alice and Bob’s, respectively.The key leakage rate (KLR) is used to measure the matching rate of keys between legitimate communication nodes and eavesdroppers, which is calculated as follows:(17)KLR=1−∑i=1LKBi−KEiL,where KB and KE denote the secret keys generated at Bob and Eve, respectively. Lower KLG indicates less information has been leaked and better performance.Randomness is a measure of the security strength of the secret keys generated by Alice and Bob that determines whether the key generation scheme is secure or not. At present, most of the tests for secret key randomness in physical layer secret key research use the randomness test standard issued by the National Institute of Standards and Technology (NIST). The test items include: frequency, block frequency, cumulative sums, runs, longest run, rank, discrete Fourier transform, nonperiodic template matchings, overlapping template matchings, universal statistical, approximate entropy, random excursions, random excursions variant, serial, linear complexity [20]. Due to the limitation of the final key length, the key sequence generated by the RISKG algorithm meets 7 of 15 test items, and only 7 of them are selected for testing.


## 4.2. Simulation Performance

Figure5 shows KGR versus SNR for the RISKG, CKG, IKG, and JKG algorithms at Bob or Eve under the nonideal channel situation and imperfect channel estimation (e∈0.01,0.001,0.0001). It can be seen from the figure that as e decreases, the KGR of all algorithms increases to some extent. As the SNR rises, the KGR of all algorithms rises to some extent, gradually approaching the highest KGR in the ideal state at around 40 dB. The RISKG algorithm proposed in this paper greatly surpasses the other three algorithms in the performance of KGR, under the same SNR and e. It can also be seen that Eve’s KGR for different SNR cases is smaller than that of any algorithm used on Bob with all algorithms.Figure 5
KGR versus SNR performance under non-ideal channels and imperfect channel estimation for RISKG, CKG, IKG, JKG algorithms.Figure6 shows KMR versus SNR of RISKG, CKG, IKG, and JKG algorithms at Bob and Eve in the case of nonideal channels and imperfect channel estimation (e∈0.01,0.001,0.0001). It can be seen from the figure that the KMR of all algorithms decreases as e decreases. Simultaneously the KMR of all algorithms decreases as SNR increases. The proposed RISKG algorithm outperforms the other three algorithms. Due to the uncorrelation of the channel, there is a significant gap between the KMR on Eve and Bob compared to all cases on Bob, and it becomes more obvious as the SNR increases.Figure 6
KMR versus SNR performance under non-ideal channels and imperfect channel estimation for RISKG, CKG, IKG, JKG algorithms.In addition, Figure7 shows the KLG vs. SNR of keys generated at Eve using the RISKG algorithm, the IKG algorithm, and the RISKG algorithm without scrambling for e=0.001. From the three sets of data in Figure 7, the KLR is reduced by scrambling, which makes Eve steal less useful information. And RISKG algorithm also reduces the KLG at Eve compared to the IKG algorithm, which improves the security of the communication system.Figure 7
KLR versus SNR performance at eve for the RISKG algorithm, the IKG algorithm, and the RISKG algorithm without scrambling.The randomness test results of the keys generated by the RISKG algorithm are shown in Table2. The generated final secret key sequence is checked for randomness using the NIST statistical test suite in this paper. The NIST statistical test suite consists of 15 different test items, each test is given a P-value (P-value is a probability value between 0 and 1). If the P-value of each test is more than 0.01, the randomness tests are regarded to be passed. The 7 test items are randomly picked secret keys generated by the RISKG algorithm when the SNR is 10 dB, which tested under e∈0.01,0.001,0.0001 respectively are shown in Table 2.Table 2
NIST test suite results.
Test itemsP-values (RISKG)e = 0.01e = 0.001e = 0.0001Frequency0.58380.31150.2549Block frequency0.98520.03380.2888Cumulative sums0.87400.22760.45830.54460.56200.2915Runs0.65800.75190.0248Longest run0.31740.54420.3696Approximate entropy0.98250.97320.9814Serial0.49890.49890.15290.49850.23390.9855


## 4.3. Computational Complexity

To fairly compare the complexity of the three algorithms, we uniformly assume that the key generation is performed for the diagonal matrixHif∈CM×M in the coherent time τ and the size of the subblock is uniformly assumed to be l. For the RISKG algorithm, a total of 3−1/lM−2 addition calculations, M/l+2 multiplication calculations, 7M+3200 bitwise exclusive-OR calculations and 3M comparisons are performed. Taken together, the RISKG algorithm has complexity OM, which implies that the proposed algorithm has linear complexity with respect to the length of key generation. For the IKG algorithm, because of its multiplication by the interleaving matrix R∈CM×M, it performs M3 multiplication calculations, M−13 addition calculations, and 1+logl/l−2/lM comparison calculations. The JKG algorithm performs more 1−1/lM addition calculations and M/l times multiplication on the base of the IKG algorithm, so the complexity of both the IKG and JKG algorithms is OM3 and greater than the proposed RISKG algorithm. The computational complexity of the three algorithms is shown in Table 3.Table 3
Computational complexity.
AlgorithmComplexityRISKGOMIKGOM3JKGOM3


## 5. Conclusions

Taking the short-time reciprocity of the time-division duplex communication, this paper proposes a novel key generation algorithm under the OFDM system and Rayleigh fading channel by using the CIR of the wireless channel and gives the specific implementation steps of the algorithm. The algorithm first obtains the CIR of the wireless channel at the legitimate communicate node by the pilots. Moreover, the keys for the real and imaginary parts of each subcarrier are generated independently and arranged in front-to-back order to enhance the key generation rate, with the initial key being generated by comparing the mean value when generating the key for the corresponding subcarrier. Finally, to make it more difficult for Eve to obtain the secret key based on the CIR trend and improve secret key confidentiality, the mean phase of subcarriers within each subblock is used as the scrambling initialization to scramble the generated initial secret key that enhances security and lowers the KLR at Eve.In the security analysis section, the security is analyzed by information theory, and the results show that the proposed algorithm has high security in theory. In terms of simulation performance, compared with the CKG algorithm, IKG algorithm, and JKG algorithm, the RISKG algorithm significantly improves the performance in both KGR and KMR. Unlike the JKG algorithm, which enhances KGR by sacrificing a specific performance of KMR, the RISKG algorithm improves KGR without worsen KMR. Advanced the NIST statistical test suite is used to evaluate the randomness of the final key generated. The computational complexity of the algorithm is also analyzed. In summary, the secret key generated by the proposed algorithm can be used to encrypt and secure wireless communications.



---

*Source: 8422490-2022-10-04.xml*