# Secure Rate Control and Statistical QoS Provisioning for Cloud-Based IoT Networks

Authors: Irfan Muhammad; Hirley Alves; Onel Alcaraz López; Matti Latva-aho
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The Internet of Things (IoT) facilitates physical things to detect, interact, and execute activities on-demand, enabling a variety of applications such as smart homes and smart cities. However, it also creates many potential risks related to data security and privacy vulnerabilities on the physical layer of cloud-based Internet of Things (IoT) networks. These can include different types of physical attacks such as interference, eavesdropping, and jamming. As a result, quality-of-service (QoS) provisioning gets difficult for cloud-based IoT. This paper investigates the statistical QoS provisioning of a four-node cloud-based IoT network under security, reliability, and latency constraints by relying on the effective capacity model to offer enhanced QoS for IoT networks. Alice and Bob are legitimate nodes trying to communicate with secrecy in the considered scenario, while an eavesdropper Eve overhears their communication. Meanwhile, a friendly jammer, which emits artificial noise, is used to degrade the wiretap channel. By taking advantage of their multiple antennas, Alice implements transmit antenna selection, while Bob and Eve perform maximum-ratio combining. We further assume that Bob decodes the artificial noise perfectly and thus removes its contribution by implementing perfect successive interference cancellation. A closed-form expression for an alternative formulation of the outage probability, conditioned upon the successful transmission of a message, is obtained by considering adaptive rate allocation in an ON-OFF transmission. The data arriving at Alice’s buffer are modeled by considering four different Markov sources to describe different IoT traffic patterns. Then, the problem of secure throughput maximization is addressed through particle swarm optimization by considering the security, latency, and reliability constraints. Our results evidence the considerable improvements on the delay violation probability by increasing the number of antennas at Bob under strict buffer constraints.


---

## Body

## 1. Introduction

Recent advancements in communication technologies and antenna design have drastically increased the amount of data collected from Internet of Things (IoT) environments. They have also catalyzed the growing trend towards big data, where data acquisition and posterior data processing are actionable and trigger intelligent decision-making [1]. Although IoT devices are advancing in terms of their sensing functions, enhanced decision-making capabilities and ubiquitous processing are still not possible as they require a higher quantum of computer power. Cloud-based IoT infrastructure is a potential setup that can offer such capabilities and provide higher reliability as cloud computing can collect, process, and store huge amounts of data. However, before such a system can be fully realized, they need to ensure data security and privacy and handle the heterogeneity of IoT devices and networks. In particular, cloud-based IoT networks currently suffer from physical attacks that include interference, eavesdropping, and jamming, making quality-of-service (QoS) provisioning complicated for cloud-based IoT.The newly launched fifth generation new radio (5G NR) facilitates the digital transformation of communication infrastructure and particularly increases the overall performance of various vertical sectors. It is apparent that 5G networks are not able to sufficiently meet most of the stringent specifications of communication technologies. In turn, the continued growth of the community through 2030 would lead to new and more strict demands on wireless communications [2]. With the rise of the sixth generation (6G) of cellular systems, which targets a fully digitized and hyperconnected society for the coming years, IoT would play a predominant role. However, IoT imposes a large variety of critical challenges since it differs significantly from traditional human-type communications. Therefore, the transmission schemes and traffic management strategies for IoT networks must consider their unique traffic characteristics [3]. For instance, different IoT applications may have different requirements, such as priority and delay constraints; thus, there is a need for considering mixed traffic models with event-driven and periodic traffics. The different traffic pattern properties of IoT devices demand the study of accurate traffic models that can capture their behaviour. A traffic model for automotive IoT, considering the spatially and temporally correlated bursty traffic, was proposed in [4]. Such a model is based on a coupled Markovian arrival process (CMAP) and can capture burstiness and multimodality of arrival rates. In [5], authors examined IoT traffic using traditional Markovian arrival processes since they are able to capture the traffic burstiness inherent to many IoT use cases. Moreover, authors in [6] analyzed different types of traffic generated by IoT devices through effective rate transmission and the effective capacity for single-antenna point-to-point communication systems.Due to enormous growth in IoT devices, an increasing requirement of private and confidential data transmission has made security a critical issue for cloud-based IoT networks. Traditionally, security is realized via cryptography techniques, i.e., public key infrastructure (PKI) [7]. However, cryptography and its associated techniques have shown vulnerability to secure information as they rely on an assumption of infinite computational capability available at the adversary side for their operation. Furthermore, they require high bandwidth and computational complexity. Different challenges in key management schemes for decentralized wireless networks have been identified in [8]. Therefore, physical layer (PHY) security (or in other words, information-theoretic security) has become an attractive candidate to offer alternative security solutions by adding an extralayer of security [9]. While security issues in the physical layer are typically addressed by reducing the risk of information leakage to an external bad actor [10], the more alarming threat to user privacy from the discovery of the existence of a message has not been mitigated yet. Therefore, this paper addresses this threat by considering rate control and quality-of-service (QoS) provisioning to minimize the outage secrecy probability and mitigate privacy leakage in IoT networks. A fundamental issue lies in efficiently providing QoS guarantees in wireless channels, which are drastically affected with the randomness induced by the environment. Therefore, it is imperative to model a wireless channel for satisfying certain QoS metrics such as data rate, delay, and delay violation probability. In that sense, statistical QoS provisioning, where many applications or services can tolerate a small probability of QoS violation [11,12], is a viable tool for characterizing and satisfying delay bound QoS guarantees in real-time wireless traffic [13]. Authors in [14] proposed to move the channel model from PHY to the link layer by introducing a link-layer performance metric called effective capacity that captures a link-level capacity notion of the fading channel in the presence of statistical QoS limitations. Furthermore, effective capacity is defined as the maximum constant arrival rate that the service rate can support to guarantee the specified statistical delay-bounded requirement over a wireless channel. Thus, effective capacity is equivalent to effective bandwidth that helps in analyzing the resources needed for supporting different time-varying arrival processes. Recently, the effective capacity theory has been used as a relevant cross-layer designing tool that allows to link PHY to the statistical QoS performance of upper layers in several different scenarios [15–17], while ensuring high security fidelity.For instance, two resource allocation algorithms based on effective capacity for multiple-input multiple-output (MIMO) networks serving multiple users with different statistical QoS requirements were proposed in [15]. A detailed analysis of the effective capacity for a MIMO wireless system with low-power, wideband, and high signal-to-noise ratio (SNR) regimes was carried out in [16], where statistical queuing constraints were imposed as a limitation on buffer violation probabilities in the large-queue-length regime. Meanwhile, the authors in [17] investigated the throughput and energy efficiency of a MIMO system subject to a statistical QoS constraint. However, as the traffic originated from IoT devices is massive due to the large number of devices in a IoT network, such networks require the support of per-link bit rate, delay and reliability, and security, which is not addressed in the above works. IoT devices also have additional constraints with respect to limited computational and energy capabilities [18]. Specifically, challenges regarding privacy and secrecy are highly critical in IoT as these networks are prone to eavesdropping due to the large-scale deployment of vulnerable devices. Hence, providing security and reliability in this context proves to be a challenging and demanding task.


### 1.1. Motivation and Contribution

In order to fill in the gap above in the literature, herein we propose the use of PHY security, which has emerged as a promising way to achieve security against any level of computational power [19], thus being attractive to safeguarding future networks. The basic idea behind PHY security is to provide secure communications by taking advantage of fading and interference phenomena. We obtained a novel exact expression for the secrecy outage probability conditioned upon a message being transmitted for the considered wiretap system with CSI at the transmitter. In this work, inspired by [20–22], we rely on the effective capacity theory in order to examine the joint impact of security, latency, and reliability constraints of cloud-based IoT networks for the four-node multiantenna scenario. To the best of our knowledge, traffic models with secure effective capacity and jamming have not been yet analyzed under security, reliability, and latency constraints in the literature. As novel contributions, herein(i)
A novel and exact closed-form expression for the secrecy outage probability is provided for the proposed scenario, conditioned upon a message actually being transmitted. As a byproduct, we also provide a simpler closed-form expression of secrecy outage probability when all nodes are equipped with a single antenna.(ii)
We further extend [21] to the multiantenna wiretap channel and analyze the secure effective capacity for an ON-OFF transmission under jamming while analyzing the traffic originated by a massive number of IoT devices through Markovian sources.(iii)
We solve the design problem of maximizing the secure throughput by considering both security and reliability constraints for an adaptive rate allocation scheme in an ON-OFF fashion through particle swarm optimization (PSO).(iv)
We show that the number of antennas at Bob as compared with Alice and Wiley plays a significant role in meeting stringent requirements of reliability and security, while it also decreases delay violation probability under strict QoS exponent.The remainder of this paper is organized as follows. Section2 discusses the related work. Section 3 introduces the system model and our main assumptions. Section 4 presents the secrecy outage probability analysis. Section 5 provides the traffic models and statistical QoS provisioning. Section 6 presents the analysis of the source models, while Section 7 shows the secure effective capacity maximization. Section 8 discusses the numerical results, and Section 9 concludes the paper.Notation. Hereafter, we denote scalar variables by italic symbols, while vectors and matrices are denoted by lower-case and upper-case boldface symbols, respectively. Given a complex vector x, x denotes the Euclidean norm, while xT and x† denote transpose and conjugate transpose operations, respectively. The m×m identity matrix is represented as Im. The probability density function (PDF) and cumulative distribution function (CDF) of a given random variable X are denoted as fXx and FXx, respectively, while the expectation operator is denoted as E⋅. The gamma function is denoted as Γz (see Section 6, Equation 6.1.1 in [23]), while the regularized lower incomplete gamma function is denoted as Ps,z=γs,z/Γz (see Section 6, Equation 6.5.1 in [23]), and the regularized upper incomplete gamma function is represented as Qs,z=Γs,z/Γz (see Equation 26.4.19 in [23]), where γs,z and Γs,z are the lower and upper incomplete gamma functions (see Section 6, Equation 6.5 in [23]), respectively. The Gauss hypergeometric function is denoted as 2F1a,b;c;z (see Equation 15.1.1 in [23]), while the inverse of the generalized regularized incomplete gamma function is represented as P−1s,z [24]. We also use the common notation z+=max0,z, while the probability of event A is represented as PrA.


## 1.1. Motivation and Contribution

In order to fill in the gap above in the literature, herein we propose the use of PHY security, which has emerged as a promising way to achieve security against any level of computational power [19], thus being attractive to safeguarding future networks. The basic idea behind PHY security is to provide secure communications by taking advantage of fading and interference phenomena. We obtained a novel exact expression for the secrecy outage probability conditioned upon a message being transmitted for the considered wiretap system with CSI at the transmitter. In this work, inspired by [20–22], we rely on the effective capacity theory in order to examine the joint impact of security, latency, and reliability constraints of cloud-based IoT networks for the four-node multiantenna scenario. To the best of our knowledge, traffic models with secure effective capacity and jamming have not been yet analyzed under security, reliability, and latency constraints in the literature. As novel contributions, herein(i)
A novel and exact closed-form expression for the secrecy outage probability is provided for the proposed scenario, conditioned upon a message actually being transmitted. As a byproduct, we also provide a simpler closed-form expression of secrecy outage probability when all nodes are equipped with a single antenna.(ii)
We further extend [21] to the multiantenna wiretap channel and analyze the secure effective capacity for an ON-OFF transmission under jamming while analyzing the traffic originated by a massive number of IoT devices through Markovian sources.(iii)
We solve the design problem of maximizing the secure throughput by considering both security and reliability constraints for an adaptive rate allocation scheme in an ON-OFF fashion through particle swarm optimization (PSO).(iv)
We show that the number of antennas at Bob as compared with Alice and Wiley plays a significant role in meeting stringent requirements of reliability and security, while it also decreases delay violation probability under strict QoS exponent.The remainder of this paper is organized as follows. Section2 discusses the related work. Section 3 introduces the system model and our main assumptions. Section 4 presents the secrecy outage probability analysis. Section 5 provides the traffic models and statistical QoS provisioning. Section 6 presents the analysis of the source models, while Section 7 shows the secure effective capacity maximization. Section 8 discusses the numerical results, and Section 9 concludes the paper.Notation. Hereafter, we denote scalar variables by italic symbols, while vectors and matrices are denoted by lower-case and upper-case boldface symbols, respectively. Given a complex vector x, x denotes the Euclidean norm, while xT and x† denote transpose and conjugate transpose operations, respectively. The m×m identity matrix is represented as Im. The probability density function (PDF) and cumulative distribution function (CDF) of a given random variable X are denoted as fXx and FXx, respectively, while the expectation operator is denoted as E⋅. The gamma function is denoted as Γz (see Section 6, Equation 6.1.1 in [23]), while the regularized lower incomplete gamma function is denoted as Ps,z=γs,z/Γz (see Section 6, Equation 6.5.1 in [23]), and the regularized upper incomplete gamma function is represented as Qs,z=Γs,z/Γz (see Equation 26.4.19 in [23]), where γs,z and Γs,z are the lower and upper incomplete gamma functions (see Section 6, Equation 6.5 in [23]), respectively. The Gauss hypergeometric function is denoted as 2F1a,b;c;z (see Equation 15.1.1 in [23]), while the inverse of the generalized regularized incomplete gamma function is represented as P−1s,z [24]. We also use the common notation z+=max0,z, while the probability of event A is represented as PrA.


## 2. Literature Review

The idea of using artificial noise to degrade further the wiretap channel was initially introduced by [25]. Several works have been shown to be effective for enhancing the secrecy of wireless networks at the PHY [20,26–29]. In [27], the throughput of securely transmitted delay-sensitive data originated from random sources was analyzed while the secrecy capacity for MIMO wiretap channel in the low-SNR regime was studied in [28]. Moreover, multiantenna diversity techniques have been shown to enhance the secrecy performance in [20, 29]. Particularly, the MIMO multiple eavesdropper (MIMOME) scenario has renewed attention in the last years [30–32]. In [30], the impact of transmit antenna selection (TAS) over a massive MIMO scenario by considering no information about Eve’s channel state information (CSI) at the transmitter was studied. In [32], authors carried out secrecy performance of MIMOME scenario using TAS at the transmitter and either maximum-ratio combining (MRC) or selection combining (SC) at the receiver and an eavesdropper with perfect feedback. While in [31], the effect of imperfect feedback on secrecy performance was studied using TAS/MRC-based PHY security scheme for MIMO wiretap channels. Furthermore, the authors in [33] utilized jamming strategy for the MIMOME system using TAS/MRC schemes over κ-μ fading channels.Regarding IoT QoS constraints, the authors in [34] proposed the concept of effective secure throughput based on effective capacity metric in order to take into account security and reliability issues, while satisfying certain buffer or delay constraints. Furthermore, authors in [27] extended the results of [34] by analyzing the energy efficiency and the throughput of secure transmissions by looking into the delay-sensitive data that are generated by Markovian sources. Although the work in [27] is designed for broadband applications, its results are also applicable to IoT as Markovian processes can incorporate the properties of IoT devices traffic [21].Despite the recent advances, the works above focused on the classical secrecy outage probability metric for evaluating the secrecy performance, i.e., the probability that the instantaneous secrecy capacity is less than a target secrecy rate [35]. Such formulation fails to capture the actual security level alone as it does not reflect the failure to attain perfect secrecy. An alternative formulation is presented in [22] which takes into account the rate of the transmitted code words as well as the condition under which message transmissions take place; thus, it is able to differentiate between a failure on attaining a secrecy transmission from a failure on attaining reliability. While authors in [22, 36] study the trade-off between security and reliability, the trade-off among security, latency, and reliability has not been studied yet. Moreover, a secure effective capacity metric was analyzed in [21] without considering friendly jammer, inspired on [27, 34]. The scenario comprises a single-antenna legitimate pair of IoT devices communicating in the presence of an eavesdropper and using an ON-OFF transmission where secrecy is conditioned on the actual transmission. The metric captures the impact of the source’s arrival traffic, where security, latency, and reliability constraints were considered to evaluate the optimal secure communication rates.


## 3. System Model

We consider a four-node wiretap system as illustrated in Figure1, where legitimate nodes, namely, Alice (transmitter) and Bob (receiver), communicate confidentially in the presence of a passive eavesdropper Eve, who intends to overhear the confidential communication between them. Additionally, we assume a friendly jammer named Wiley is deployed to transmit artificial noise, aiming to worsen the eavesdropper’s channel quality.Figure 1
System model shows that Alice employs TAS while Bob and Eve resort to MRC. Herein,r is the arrival rate at source, L is queue length at the Alice, while hAB and hAE are channel coefficients of legitimate and wiretap channels.All system nodes are equipped with multiple antennas, whereNA, NB, NE, and NW denote the number of antennas at Alice, Bob, Wiley, and Eve, respectively. We assume that Bob and Eve can perfectly estimate their individual CSI, while Alice knows Bob’s channel perfectly (we assume there is a separate and reliable mechanism to accurately acquire the CSI, for instance, by assuming channel reciprocity in time-division duplex (TDD) systems or by using dedicated pilot sequences [37]) but has just a statistical knowledge of Eve’s CSI. Additionally, Bob and Alice share an open error-free feedback channel, which Bob utilizes to send back the index of Alice’s antenna that allows achieving the best SNR at Bob, along with its corresponding value to enable ON-OFF transmissions, i.e., Alice transmits only when Bob’s SNR exceeds some SNR threshold μ. Alice utilizes the index sent by Bob to implement TAS. Since legitimate and eavesdropper channels are not correlated, Eve is not able to exploit such information and cannot attain any diversity gain. Moreover, we consider a cloud (or centralized) radio access network (C-RAN) architecture, wherein Alice is connected to the edge cloud, as illustrated in Figure 1. It should be noted, in the C-RAN architecture, a common baseband processing unit (BBU) performs all the digital signal processing functionalities, while Alice implements limited radio operations [38]. Such centralized processing provides more processing capabilities and thus enables more effective implementation of cloud-based IoT networks. Besides, all channels in this system undergo block Rayleigh fading; thus, the channels coefficients remain unchanged over the block interval, and they vary independently for the subsequent block. We further assume that Bob decodes the artificial noise perfectly and thus removes its contribution by implementing perfect successive interference cancellation (SIC). The channel coefficients are represented by hij, with i∈1,…,NA and j∈1,…,NX, with X∈B,E,W.Hence, the index received by Alice from Bob is given by(1)i∗=argmax1≤i≤NAhiB,where hiB=hi1,hi2,…,hiNBT is the NB×1 legitimate channel vector between the i−th transmit antenna at Alice and the NB antennas at Bob. After TAS, Alice transmits the encoded message x=x1,x2,…,xn to Bob. The power of the transmitted message is limited by an average power constraint, that is, 1/n∑j=1nExj2≤PA, where PA represents the transmit power of Alice. Then, Bob employs MRC, and the received signal becomes(2)yB=hiB†hiBx+hiB†niB,where niB is the NB×1 additive white Gaussian noise vector at Bob such that EniBniB†=IiBσB2 and σB2 is the noise variance at each antenna. Thus, the instantaneous received SNR at Bob is given by(3)γB=hiB2γ¯AB,where γ¯AB=PA/σB2 is the average SNR of legitimate link. The PDF and CDF of γB are, respectively, as follows [36]:(4)fγBγ=NAγNB−1ΓNBγ¯ABNBexp−γγ¯ABPNB,γγ¯ABNA−1,(5)FγBγ=PNB,γγ¯ABNA.Meanwhile, the received signal at Eve is given by(6)yE=hiE†hiEx++hiw†hiEV+hiE†niE,where hiE is the NE×1 eavesdropper channel vector, niE is the NE×1 additive white Gaussian noise vector at Eve such that EniEniE†=IiEσE2, and σE2 is the noise variance at each antenna. hiW is the NW×1 artificial noise channel, and v is the artificial noise signal. Thus, the instantaneous received SNR at Eve is given by(7)γE=hiE2γ¯AE1+hiW2γ¯WE,where γ¯AE=PA/σE2 is the average SNR of Alice to Eavesdropper link and γ¯WE=1−PA/σWE2. The PDF and CDF of γE are given, respectively, by(8)fγEγ=γENe−1exp−γE/γ¯AEΓNeγ¯AENeγ¯WENwγEγ¯AE+1γ¯WE−Nw∑d=0NeNedΓNw+dΓNwγEγ¯AE+1γ¯WE−d,(9)FγEγ=∑d=0NeNedΓNw+dΓNwexp−γE/γ¯AEΓNeγ¯WENw∑J=0Ne−1Ne−1J−1γ¯WENe−1−JΓ1+J−Nw−d,1γ¯WE−Γ1+J−Nw−d,γγ¯AE+1γ¯WE.This work aims to provide secure throughput maximization under security, reliability, and latency constraints. For that purpose, we consider the effective capacity model to link PHY with QoS constraints. We analyze the secure throughput for an ON-OFF transmission where secrecy is conditioned on actual transmission. Therefore, we first derive the secrecy outage probability for an adaptive rate allocation scheme to take security and reliability constraints into account as described in Section4. Then, we assume Markovian arrivals at Alice, and we characterize the effective bandwidth under statistical QoS constraints such that we are able to capture the effects of latency and reliability in the secure throughput as discussed in Section 5.


## 4. Secrecy Outage Probability Analysis

We present the formulation for the secrecy outage probability proposed in [22], by considering an adaptive rate allocation scheme. For that purpose, we consider Wyner’s encoding scheme, where the rate of transmitted code words is Rb and the secrecy rate is Rs. The resulting capacity of the legitimate and eavesdropping link is Cb=log21+γB and Ce=log21+γE, respectively. Thus, Cs=Cb−Ce+ is the secrecy capacity, and Re=Rb−Rs represents the rate penalty for securing the transmission against eavesdropping. Moreover, Cb>Rb is the requirement for Bob to decode the information correctly. The probability of successful transmissions for this system is as follows:(10)Ptxμ=PrCb>Rb=PrγB>μ=1−FγBμ,where FγB⋅ is given in (5). It is assumed that μ≥2Rs−1 since the transmission will only occur whenever Cb>Rs. Then, the secrecy outage probability given that the transmission is successful on the legitimate channel can be expressed as follows [22]:(11)Poutμ,Rs=PrCe>Cb−Rs|γB>μ=aPrμ<γB<2Rs1+γE−1psμ=b∫1+μ/2Rs−1∞FγB2Rs1+γE−1fγEγEdγE1−FγBμ−1−FγE1+μ/2Rs−1FγBμ1−FγBμ,where step (a) comes from Equation (7) in [22] and step b is obtained by assuming independent random variables. A closed-form expression for the secrecy outage probability for the proposed scenario is presented next.Theorem 1.
The secrecy outage probability, conditioned upon a successful transmission, for the considered wiretap system, where Alice employs TAS while Bob and Eve perform MRC, is(12)Poutμ,Rs1=1Ptxμ∑K=0NANAK−1KexpK2Rsγ¯AE+γ¯AB−γ¯WEK2Rs−1γ¯ABγ¯WE×∑s0+s1+⋯+sNB−1=KKs0,s1,…,sNB−1∏t=0NB−11t!st×∑p=0ααp2Rs−1γ¯ABα−p2Rsγ¯ABp1ΓNEγ¯AENEγ¯WENw,∑d=0NeNedΓNw+dΓNwγ¯AEp+NE∑J=0P+Ne−1p+Ne−1J−1γ¯WEp+Ne−1−J,K2Rsγ¯AE+γ¯ABγ¯AB−1−p+d+NwΓ1+p−Nw−d,K2Rsγ¯AE+γ¯ABγ¯AB1+μ−2Rs2Rsγ¯AE+1γ¯WE−1PtxμPNB,μγ¯ABNA1−∑d=0NeNedΓNw+dΓNwexp1/γ¯WEΓNeγ¯WENw∑J=0Ne−1Ne−1J−1γ¯WENe−1−JΓ1+J−Nw−d,1γ¯WE−Γ1+J−Nw−d,1+μ−2Rs2Rsγ¯AE+1γ¯WE.Proof.
See Appendix A.
We are aware that the formulation shown in Theorem1 is quite intricate. Therefore, in the following, we provide simpler and easy to evaluate single-antenna case closed-form expression of secrecy outage probability when all nodes have a single antenna:(13)Poutμ,Rs=exp−μ+1−2Rsγ¯AE/2Rsγ¯AEγ¯AE+μ+1−2Rsγ¯WE/2Rs−1γ¯WEexpμ+1−2Rsγ¯WE+γ¯AB+2Rsγ¯AEγ¯ABγ¯WE2Rsγ¯WEμ+1−2Rsγ¯AEγ¯WE+2Rsexp−γ¯AB+2Rsγ¯AEγ¯ABμ+1−2Rsγ¯AEγ¯WE+2Rsγ¯WE2Rs−2Rsγ¯ABγ¯AEE1γ¯AB+2Rsγ¯AEγ¯ABμ+1−2Rsγ¯AEγ¯WE+2Rs2Rsγ¯WE.


### 4.1. Special Case

Now, we suppose the case where no CSI is available at Alice, such scheme is known as nonadaptive rate allocation [22]. In this scheme, the transmitted code words Rb are constant over time (but require to be selected optimally). Unlike, adaptive scheme which demands the feedback of instantaneous SNR, this scheme only needs the feedback of log2NA bits to enable on-off transmission. The secrecy outage probability for given values of μ, Rs, and Rb is given as follows:(14)PoutRb,Rs=PrCe>Rb−Rs|γB>μ=PrCe>Rb−Rs=∫2Rb−Rs−1∞fγeγdγe.Theorem 2.
The secrecy outage probability of nonadaptive scheme for the considered wiretap system, where Alice employs TAS while Bob and Eve perform MRC, is(15)PoutRb,Rs=exp1/γ¯WEΓNEγ¯WENW∑s=0NENEsΓNW+sΓNW∑v=0NE−1NE−1v−1γ¯WENe−1−vΓ1−NW−s+v,2Rb−Rs−1γ¯AE+1γ¯WE.Proof.
See Appendix B.
Note that when all nodes are equipped with a single antenna, (15) simplifies to the following:(16)PoutRb,Rs=γ¯AEexp2Rb−Rs−1/γ¯AE2Rb−Rs−1γ¯WE+γ¯AE.
In the next section, in order to investigate the impact of the arrival and service processes at Alice, we assume that the information to be transmitted is stored in a buffer before actual transmission as shown in Figure1. Then, the statistical QoS guarantees are considering by relying on the effective capacity model.


## 4.1. Special Case

Now, we suppose the case where no CSI is available at Alice, such scheme is known as nonadaptive rate allocation [22]. In this scheme, the transmitted code words Rb are constant over time (but require to be selected optimally). Unlike, adaptive scheme which demands the feedback of instantaneous SNR, this scheme only needs the feedback of log2NA bits to enable on-off transmission. The secrecy outage probability for given values of μ, Rs, and Rb is given as follows:(14)PoutRb,Rs=PrCe>Rb−Rs|γB>μ=PrCe>Rb−Rs=∫2Rb−Rs−1∞fγeγdγe.Theorem 2.
The secrecy outage probability of nonadaptive scheme for the considered wiretap system, where Alice employs TAS while Bob and Eve perform MRC, is(15)PoutRb,Rs=exp1/γ¯WEΓNEγ¯WENW∑s=0NENEsΓNW+sΓNW∑v=0NE−1NE−1v−1γ¯WENe−1−vΓ1−NW−s+v,2Rb−Rs−1γ¯AE+1γ¯WE.Proof.
See Appendix B.
Note that when all nodes are equipped with a single antenna, (15) simplifies to the following:(16)PoutRb,Rs=γ¯AEexp2Rb−Rs−1/γ¯AE2Rb−Rs−1γ¯WE+γ¯AE.
In the next section, in order to investigate the impact of the arrival and service processes at Alice, we assume that the information to be transmitted is stored in a buffer before actual transmission as shown in Figure1. Then, the statistical QoS guarantees are considering by relying on the effective capacity model.


## 5. Statistical QoS Provisioning

### 5.1. Preliminaries

We assume that the data to be transmitted are originated from random sources, and it is accumulated in a buffer prior to transmission. It is also assumed that the queue length is constrained, and then the buffer overflow probability of a queue with finite buffer sizeq satisfies the following [39]:(17)limq⟶∞lnPrL≥qq=−θ,where the length of the stationary queue is represented by L, θ denotes the decay rate, and q is the buffer threshold. For a large q⟶qmax, the probability of buffer overflow can be approximated as PrL≥q≈ζe−θq, where ζ=PrL>0 is the probability of nonempty buffer. It can be observed that for a large enough q, the probability of buffer overflow can be estimated as an exponentially decay at rate θ, which is also known as QoS exponent.In this sense, strict QoS limitations are applied for large values ofθ, while small values of θ mean that looser QoS constraints are imposed [39]. The range of θ goes from 0 to ∞. Additionally, D indicates the queue delay in the buffer at a steady state and the maximum tolerated delay is d, then the delay violation probability is given by [14] as PrD≥d≈ζe−θaθd, where aθ is the effective bandwidth, which is defined as follows.


### 5.2. Effective Bandwidth

The effective bandwidth models asymptotically the stochastic behaviour of a source traffic process, by describing the minimum constant service rate that can be sustained by a random arrival process while satisfying the statistical queuing constraints. Therefore, by assuming a sequence of nonnegative random arrival ratesak,k=1,2,3,… and letting At=∑k=1tak be the accumulated arrival process at time t, the effective bandwidth is aθ=△limt⟶∞1/θtlnEeθAt [39].


### 5.3. Effective Capacity

The effective capacity is a dual concept of the effective bandwidth that can be used to model a relation between the source rate and the service by considering both link layer and PHY layer parameters. This model defines the maximum constant arrival rate that the wireless channel supports (service rate) while satisfying a delay constraint requirement as given byθ. Let sk,k=1,2,… be the discrete-time stationary and ergodic stochastic service process, while St=△∑k=1tsk be the time accumulated service process. Then, we represent the effective capacity for a given QoS exponent by the following [14]:(18)ECθ,γ=−limt⟶∞1θtlnEe−θSt=a−limt⟶∞1θtlnEe−θR.Here,θ is related to delay outage probability as in probability of buffer overflow [40]. Step a comes from using the maximum service rate R since the service process depends on the fading coefficients that vary independently every block. We are interested in finding the maximum average arrival rate of Markovian sources that can support a certain fading channel while satisfying the QoS requirement in (17). Regarding this, the QoS requirements are satisfied when the effective bandwidth of the arrival process becomes equal to the effective capacity of the service process, i.e., aθ,γ=ECθ,R [39]. Therefore,(19)aθ,r=ECθ,R.Herein, we focus on a secure communication; thus, in the following, instead ofR in (18) we will consider the secrecy rate Rs, thus defining the secure effective capacity as in [21].


## 5.1. Preliminaries

We assume that the data to be transmitted are originated from random sources, and it is accumulated in a buffer prior to transmission. It is also assumed that the queue length is constrained, and then the buffer overflow probability of a queue with finite buffer sizeq satisfies the following [39]:(17)limq⟶∞lnPrL≥qq=−θ,where the length of the stationary queue is represented by L, θ denotes the decay rate, and q is the buffer threshold. For a large q⟶qmax, the probability of buffer overflow can be approximated as PrL≥q≈ζe−θq, where ζ=PrL>0 is the probability of nonempty buffer. It can be observed that for a large enough q, the probability of buffer overflow can be estimated as an exponentially decay at rate θ, which is also known as QoS exponent.In this sense, strict QoS limitations are applied for large values ofθ, while small values of θ mean that looser QoS constraints are imposed [39]. The range of θ goes from 0 to ∞. Additionally, D indicates the queue delay in the buffer at a steady state and the maximum tolerated delay is d, then the delay violation probability is given by [14] as PrD≥d≈ζe−θaθd, where aθ is the effective bandwidth, which is defined as follows.


## 5.2. Effective Bandwidth

The effective bandwidth models asymptotically the stochastic behaviour of a source traffic process, by describing the minimum constant service rate that can be sustained by a random arrival process while satisfying the statistical queuing constraints. Therefore, by assuming a sequence of nonnegative random arrival ratesak,k=1,2,3,… and letting At=∑k=1tak be the accumulated arrival process at time t, the effective bandwidth is aθ=△limt⟶∞1/θtlnEeθAt [39].


## 5.3. Effective Capacity

The effective capacity is a dual concept of the effective bandwidth that can be used to model a relation between the source rate and the service by considering both link layer and PHY layer parameters. This model defines the maximum constant arrival rate that the wireless channel supports (service rate) while satisfying a delay constraint requirement as given byθ. Let sk,k=1,2,… be the discrete-time stationary and ergodic stochastic service process, while St=△∑k=1tsk be the time accumulated service process. Then, we represent the effective capacity for a given QoS exponent by the following [14]:(18)ECθ,γ=−limt⟶∞1θtlnEe−θSt=a−limt⟶∞1θtlnEe−θR.Here,θ is related to delay outage probability as in probability of buffer overflow [40]. Step a comes from using the maximum service rate R since the service process depends on the fading coefficients that vary independently every block. We are interested in finding the maximum average arrival rate of Markovian sources that can support a certain fading channel while satisfying the QoS requirement in (17). Regarding this, the QoS requirements are satisfied when the effective bandwidth of the arrival process becomes equal to the effective capacity of the service process, i.e., aθ,γ=ECθ,R [39]. Therefore,(19)aθ,r=ECθ,R.Herein, we focus on a secure communication; thus, in the following, instead ofR in (18) we will consider the secrecy rate Rs, thus defining the secure effective capacity as in [21].


## 6. Analysis of the Source Models

Since Markovian processes can incorporate the typical characteristics of the traffic generated by IoT devices, which is comprised of small and burst packets [5, 21, 41], herein we present the models for four different types of Markov arrival sources. The Markovian described herein are (i) discrete-time Markov source (DTMS), (ii) fluid Markov source (FMS), (iii) discrete-time Markov modulated Poisson source (DMMPS), and (iv) continuous-time Markov modulated Poisson source (CMMPS).


### 6.1. Discrete Markov Source

This model describes a discrete-time data arrival, which is modeled as a discrete-time Markov chain. Data arrive atr bits/block during ON state, while no arrivals occur during OFF state. The transition probability matrix J for this source is J=p11p12p21p22, where p11 indicates the probability of staying in the OFF state from one block to another. Similarly, p22 is the probability of staying in ON state, while the transition probabilities are p21=1−p22 and p12=1−p11. The probability of ON state in the steady state is PON=1−p11/2−p11−p22.The effective bandwidth for this two-state (ON-OFF) model is as follows:(20)aθ,r=1θln12p11+p22eθr+p11+p22eθr2−4p11+p22−1eθr=a1θln1−s+seθr,where a comes from using p11=1−s and p22=s. Hence, pON=s, which becomes the measure of burstiness, and it is relevant to model different IoT devices traffic patterns. The maximum average arrival rate is r¯maxθ,Rs=rPON. By using (19), we obtain the average arrival rate that supports secure transmissions at given SNR γ and θ as follows:(21)r=1θln1seθECθ,R−1−s.Then, we getr¯max, in terms of θ and Rs, for discrete-time Markov source as follows:(22)r¯maxθ,Rs=sθln1seθECθ,Rs−1−s.


### 6.2. Markov Fluid Source

The arrival process of a Markov fluid source is considered as a continuous-time Markov process, where the generating matrix for a two-state (ON-OFF) case isG=−ααβ−β, and the transition rates from one state to another state are denoted by α and β. During ON state, r bits arrive, while no bits arrive during OFF state. The effective bandwidth for this source is defined as follows [39]:(23)aθ,r=12θθr−α+β+θr−α+β2+4αθr.The steady state probability for ON and OFF states isPON=α/α+β and POFF=β/α+β, respectively. Then, by using (19) and (23), we obtain r as follows:(24)r=θECθ,R+α+βθECθ,R+αECθ,R.Then, we are able to stater¯maxθ,Rs for an ON-OFF fluid Markov source model as follows:(25)r¯maxθ,Rs=PONθECθ,Rs+α+βθECθ,Rs+αECθ,Rs.


### 6.3. Discrete-Time Markov Modulated Poisson Source

A source is modeled as a discrete-time Markov modulated Poisson process (MMPP), whenever the data arrival is modeled as a Poisson process in which the intensity is determined by a discrete Markov chain. The discrete-time MMPP is the same as a discrete Markov process; however, the data rate of instantaneous arrival in every Markov state is Poisson distributed rather than being fixed. MMPP is able to capture burstiness or uncertainity. In MMPP, the arrival intensity isr during ON state, while no data arrive during OFF state (intensity is equal to zero). This model presents the same transition probability matrix J, as in Section 6.1, and the effective bandwidth for this source is given as follows [27]:(26)aθ,r=a1θln1−s+sereθ−1.which is similar to (20) except that we replace the term erθ by ereθ−1; as in the previous case, we attain a after considering p11=1−s and p22=s; hence, PON=s. Now, we proceed similar as before to obtain the average arrival rate r for this source as(27)r=1eθ−1ln1seθECθ,R−1−s.Then, the maximum average arrival rater¯maxθ,Rs is given by(28)r¯maxθ,Rs=seθ−1ln1seθECθ,Rs−1−s.


### 6.4. Continuous-Time Markov Modulated Poisson Source

In continuous-time Markov modulated Poisson source, the data arrival rate has Poisson distribution and the intensity changes according to a continuous-time Markov chain. Similar to the other sources, it is also assumed that this source uses the simple ON-OFF model, wherer is the Poisson arrival density during ON state, but there is zero Poisson arrival intensity during OFF state. For the continuous-time Markov chain, the same generator matrix can be employed as in Section 6.2 to obtain the following:(29)aθ,r=12θeθ−1r−α+β+12θeθ−1r−α+β2+4αeθ−1r.Then,r¯maxθ,Rs is given by(30)r¯maxθ,Rs=PONθθECRs,θ+α+βeθ−1θECRs,θ+αECRs,θ.


## 6.1. Discrete Markov Source

This model describes a discrete-time data arrival, which is modeled as a discrete-time Markov chain. Data arrive atr bits/block during ON state, while no arrivals occur during OFF state. The transition probability matrix J for this source is J=p11p12p21p22, where p11 indicates the probability of staying in the OFF state from one block to another. Similarly, p22 is the probability of staying in ON state, while the transition probabilities are p21=1−p22 and p12=1−p11. The probability of ON state in the steady state is PON=1−p11/2−p11−p22.The effective bandwidth for this two-state (ON-OFF) model is as follows:(20)aθ,r=1θln12p11+p22eθr+p11+p22eθr2−4p11+p22−1eθr=a1θln1−s+seθr,where a comes from using p11=1−s and p22=s. Hence, pON=s, which becomes the measure of burstiness, and it is relevant to model different IoT devices traffic patterns. The maximum average arrival rate is r¯maxθ,Rs=rPON. By using (19), we obtain the average arrival rate that supports secure transmissions at given SNR γ and θ as follows:(21)r=1θln1seθECθ,R−1−s.Then, we getr¯max, in terms of θ and Rs, for discrete-time Markov source as follows:(22)r¯maxθ,Rs=sθln1seθECθ,Rs−1−s.


## 6.2. Markov Fluid Source

The arrival process of a Markov fluid source is considered as a continuous-time Markov process, where the generating matrix for a two-state (ON-OFF) case isG=−ααβ−β, and the transition rates from one state to another state are denoted by α and β. During ON state, r bits arrive, while no bits arrive during OFF state. The effective bandwidth for this source is defined as follows [39]:(23)aθ,r=12θθr−α+β+θr−α+β2+4αθr.The steady state probability for ON and OFF states isPON=α/α+β and POFF=β/α+β, respectively. Then, by using (19) and (23), we obtain r as follows:(24)r=θECθ,R+α+βθECθ,R+αECθ,R.Then, we are able to stater¯maxθ,Rs for an ON-OFF fluid Markov source model as follows:(25)r¯maxθ,Rs=PONθECθ,Rs+α+βθECθ,Rs+αECθ,Rs.


## 6.3. Discrete-Time Markov Modulated Poisson Source

A source is modeled as a discrete-time Markov modulated Poisson process (MMPP), whenever the data arrival is modeled as a Poisson process in which the intensity is determined by a discrete Markov chain. The discrete-time MMPP is the same as a discrete Markov process; however, the data rate of instantaneous arrival in every Markov state is Poisson distributed rather than being fixed. MMPP is able to capture burstiness or uncertainity. In MMPP, the arrival intensity isr during ON state, while no data arrive during OFF state (intensity is equal to zero). This model presents the same transition probability matrix J, as in Section 6.1, and the effective bandwidth for this source is given as follows [27]:(26)aθ,r=a1θln1−s+sereθ−1.which is similar to (20) except that we replace the term erθ by ereθ−1; as in the previous case, we attain a after considering p11=1−s and p22=s; hence, PON=s. Now, we proceed similar as before to obtain the average arrival rate r for this source as(27)r=1eθ−1ln1seθECθ,R−1−s.Then, the maximum average arrival rater¯maxθ,Rs is given by(28)r¯maxθ,Rs=seθ−1ln1seθECθ,Rs−1−s.


## 6.4. Continuous-Time Markov Modulated Poisson Source

In continuous-time Markov modulated Poisson source, the data arrival rate has Poisson distribution and the intensity changes according to a continuous-time Markov chain. Similar to the other sources, it is also assumed that this source uses the simple ON-OFF model, wherer is the Poisson arrival density during ON state, but there is zero Poisson arrival intensity during OFF state. For the continuous-time Markov chain, the same generator matrix can be employed as in Section 6.2 to obtain the following:(29)aθ,r=12θeθ−1r−α+β+12θeθ−1r−α+β2+4αeθ−1r.Then,r¯maxθ,Rs is given by(30)r¯maxθ,Rs=PONθθECRs,θ+α+βeθ−1θECRs,θ+αECRs,θ.


## 7. Secure Effective Capacity Maximization

Herein, we assess the maximum average arrival rate that Alice can support while transmitting with secrecy. This can be accomplished by maximizing the secure throughput while determining the effect of burstiness on the performance of the system. Since we use an ON-OFF transmission model, the transmission service can be as well modeled as an ON-OFF Markov chain. Hence,Ptxμ can be described as the steady probability of ON state, which is given as a probability of successful transmission in (10). Notice that V11 and V22 are the probabilities of being in OFF and ON state, respectively. Meanwhile, V21=1−V22 and V12=1−V11 are transition probabilities. The probability of ON state in the steady state is PON=1−V11/2−V11−V22. Then, the secure effective capacity is as follows:(31)ECθ,Rs=−limt⟶∞1θtlnEe−θR=−Λ−θθ.Meanwhile, for the ON-OFF model, we have that (see Ch.7 in [42])(32)ECθ,Rs=−1θln12V11+V22eθr+V11+V22eθr2+4V11+V22−1eθr.Note that in our model,V11=1−w, V22=w, and V11+V22=1; hence, PON=w and (31) becomes(33)SECθ,Rs=−1θln1−w+we−θRs=−1θln1−Ptxμ1−e−θRs=−1θln1−1−PNB,μγ¯BNA1−e−θRs.Remark 1.
According to (31), note that(34)limθ⟶0SECθ,Rs=PtxμRs,limθ⟶∞SECθ,Rs=0.
The novel secure effective capacity formulation in (33) gives the security level of each transmission, and it also enables the legitimate pair to have higher effective capacity at secure rate Rs. Moreover, for NA=1, NB=1, NW=0, and NE=1, SECθ,Rs in (33) reduces to Equation (9) in [21]. This metric is different than Section 4 in [27], which considers no CSI at Alice, while we assume that Alice knows the legitimate link CSI and can adapt transmission rate accordingly. It enables us model the services as an ON-OFF Markov chain as we conditioned security on the actual transmission. Later, we will see that large arrival rates are not served by wireless fading channels, thus increasing the queue length and delay of the network. This effect can be minimized by maximizing the secure effective capacity in terms of secrecy rate under security and reliability constraints, which also maximizes the maximum average arrival rate r¯max since the latter is an increasing function of the secure effective capacity. Besides this, all Markovian sources have the same optimal secure rate, which consequently maximizes r¯max of each source.
The problem of maximizing the secure effective capacity given the reliability constraintσ and security constraint ϵ for a positive secrecy rate Rs>0 is presented next.


### 7.1. Constrained Optimization

We consider the adaptive rate transmission scheme in [22]. The adaptive scheme relies on the knowledge of the legitimate channel’s CSI at Alice in order to adapt its secure rate according to the quality of the channel. The encoder adapts the transmit rate Rb to an arbitrary value close to Cb according to the instantaneous CSI of the legitimate channel. It is pertinent to observe that the constraint μ≥2Rs−1 is always satisfied since transmission only occurs whenever Cb≥Rs. We determine the values of μ and Rs that maximize the secure throughput, which is given by T=SECθ,Rs under a reliability constraint σ∈0,1 and security constraint ϵ∈0,1. Therefore, the design problem is given by(35)argmaxRs,μSECθ,Rs,s.t.Poutμ,Rs≤ϵ,Ptxμ≥σ,μ≥2Rs−1,Rs>0.Due to the complexity of this optimization problem, a closed-form solution cannot be obtained. However, we solve this problem through the population-based stochastic optimization algorithm, known as particle swarm optimization (PSO). PSO is simple to implement and already present in many standard mathematical software. Note that we verify our results through numerical solvers as those available in Matlab such as Fmincon, wherein we resort to interior point algorithm that converts the original problem into a sequence of approximate problems as described in [43–45] (Algorithm 1).Algorithm 1: Particle swarm optimization.
(1)
Initialization: flag = 0, ϵ=10−4, σ=99%, θ=10−3, GBestCost = –∞, pBest = 0, particles = 10,000, iter = 10,000, w = 0.8, c1 = 1.5, and c2 = 2;(2)
fori from 1 to particles do(3)
while flag ⟵ 0 do(4)
Rs,μ⟵ U(1,50), U(1,100)(5)
ifμ≥2Rs−1then(6)
flag⟵ 1(7)
end if(8)
end while(9)
p.v.Rs, p.v.μ⟵ 0,0;        ⊳ Initialize particle Velocity for Rs, μ(10)
cost,Pout, Ptx⟵ compute (28), (12), (10)(11)
ifPout<ϵ AND Ptx>σthen(12)
Rs∗⟵ Rs, μ∗⟵μ(13)
end if(14)
pBest.Rs⟵Rs∗ , pBest. μ⟵μ∗, pBest.cost ⟵cost∗        ⊳ Set Personal Best(15)
end for(16)
fori from 1 to particles do(17)
if pBest.cost >rbin GBestCost then        ⊳ Set Global Best(18)
GBest.Rs⟵ pBest.Rs, GBest. μ⟵ pBest. μ, GBest.cost ⟵ pBest.cost(19)
end if(20)
end for(21)
fori from 1 to iter do(22)
forj from 1 to particles do(23)
p.v.Rs =w∗p.v.Rs + c1∗rand∗(pBest.Rs - Rs∗)+c2∗rand∗(GBest.Rs- Rs∗)(24)
p.v.μ  = w∗p.v. μ +c1∗rand(1)∗(pBest. μ - μ∗)+c2∗rand∗(GBest. μ - μ∗)        ⊳ Update Velocity(25)
Rs∗⟵Rs∗ + p.v.Rs, μ∗⟵μ∗ + p.v. μ        ⊳ Update Position(26)
cost∗⟵ compute (28) based on Rs∗ & μ∗        ⊳ Evaluation(27)
ifcost∗< pBest.Cost then(28)
pBest.Rs =Rs∗, pBest. μ  =  μ∗, pBestCost =  cost∗         ⊳ Update Personal Best(29)
if pBest.Cost >rbin GBest.Cost then(30)
Gbest = pBest         ⊳ Update Global Best(31)
end if(32)
end if(33)
end for(34)
BestCost = GBest.Cost(35)
end for


## 7.1. Constrained Optimization

We consider the adaptive rate transmission scheme in [22]. The adaptive scheme relies on the knowledge of the legitimate channel’s CSI at Alice in order to adapt its secure rate according to the quality of the channel. The encoder adapts the transmit rate Rb to an arbitrary value close to Cb according to the instantaneous CSI of the legitimate channel. It is pertinent to observe that the constraint μ≥2Rs−1 is always satisfied since transmission only occurs whenever Cb≥Rs. We determine the values of μ and Rs that maximize the secure throughput, which is given by T=SECθ,Rs under a reliability constraint σ∈0,1 and security constraint ϵ∈0,1. Therefore, the design problem is given by(35)argmaxRs,μSECθ,Rs,s.t.Poutμ,Rs≤ϵ,Ptxμ≥σ,μ≥2Rs−1,Rs>0.Due to the complexity of this optimization problem, a closed-form solution cannot be obtained. However, we solve this problem through the population-based stochastic optimization algorithm, known as particle swarm optimization (PSO). PSO is simple to implement and already present in many standard mathematical software. Note that we verify our results through numerical solvers as those available in Matlab such as Fmincon, wherein we resort to interior point algorithm that converts the original problem into a sequence of approximate problems as described in [43–45] (Algorithm 1).Algorithm 1: Particle swarm optimization.
(1)
Initialization: flag = 0, ϵ=10−4, σ=99%, θ=10−3, GBestCost = –∞, pBest = 0, particles = 10,000, iter = 10,000, w = 0.8, c1 = 1.5, and c2 = 2;(2)
fori from 1 to particles do(3)
while flag ⟵ 0 do(4)
Rs,μ⟵ U(1,50), U(1,100)(5)
ifμ≥2Rs−1then(6)
flag⟵ 1(7)
end if(8)
end while(9)
p.v.Rs, p.v.μ⟵ 0,0;        ⊳ Initialize particle Velocity for Rs, μ(10)
cost,Pout, Ptx⟵ compute (28), (12), (10)(11)
ifPout<ϵ AND Ptx>σthen(12)
Rs∗⟵ Rs, μ∗⟵μ(13)
end if(14)
pBest.Rs⟵Rs∗ , pBest. μ⟵μ∗, pBest.cost ⟵cost∗        ⊳ Set Personal Best(15)
end for(16)
fori from 1 to particles do(17)
if pBest.cost >rbin GBestCost then        ⊳ Set Global Best(18)
GBest.Rs⟵ pBest.Rs, GBest. μ⟵ pBest. μ, GBest.cost ⟵ pBest.cost(19)
end if(20)
end for(21)
fori from 1 to iter do(22)
forj from 1 to particles do(23)
p.v.Rs =w∗p.v.Rs + c1∗rand∗(pBest.Rs - Rs∗)+c2∗rand∗(GBest.Rs- Rs∗)(24)
p.v.μ  = w∗p.v. μ +c1∗rand(1)∗(pBest. μ - μ∗)+c2∗rand∗(GBest. μ - μ∗)        ⊳ Update Velocity(25)
Rs∗⟵Rs∗ + p.v.Rs, μ∗⟵μ∗ + p.v. μ        ⊳ Update Position(26)
cost∗⟵ compute (28) based on Rs∗ & μ∗        ⊳ Evaluation(27)
ifcost∗< pBest.Cost then(28)
pBest.Rs =Rs∗, pBest. μ  =  μ∗, pBestCost =  cost∗         ⊳ Update Personal Best(29)
if pBest.Cost >rbin GBest.Cost then(30)
Gbest = pBest         ⊳ Update Global Best(31)
end if(32)
end if(33)
end for(34)
BestCost = GBest.Cost(35)
end for


## 8. Numerical Analysis

In this section, we analyze the performance of our system through some illustrative cases and validate our analytical results via Monte Carlo simulations. In Subsection8.1, we analyze the secrecy outage performance in terms of secrecy rate and average SNR of legitimate and eavesdropper channels under different antenna configurations. Meanwhile, in Subsection 8.2, we evaluate the impact of security, reliability, and latency constraints on maximum average arrival rate for IoT generated traffic.


### 8.1. On the Secrecy Outage Performance

Figure2 shows the secrecy outage probability as a function of the average SNR at Bob γ¯AB, for a fixed secrecy rate Rs=2 bits/s/Hz, γ¯AE = 0 dB, γ¯WE  = 5 dB, and different configurations of the number of antennas at each node. The SNR threshold is set to its minimum value of μ=2Rs−1. First, notice that simulations perfectly match with our analytical results, thus corroborating the correctness of our expressions. Note also that while an increase in NA or NB causes a significant decrease in the secrecy outage probability, an increase in NE degrades the system’s secrecy performance to a lesser extent. This can be explained due to the TAS technique, which prevents the eavesdropper from exploiting diversity from Alice. In addition, it can be observed that a greater number of receive antennas are more beneficial than a greater number of transmit antennas in the legitimate link. In fact, when NA>NB, it is required at least 2 dB gain of γ¯AB to attain the same secrecy performance while Figure 3 shows the comparison between adaptive and nonadaptive schemes. We also perform Monte Carlo simulation for the nonadaptive scenario, which matches exactly with analytical expression and corroborates its correctness. We notice that adaptive scheme outperforms its counterpart. Therefore, we only focus on adaptive scheme for the rest of numerical analysis.Figure 2
Conditioned secrecy outage probability as a function of average SNR at Bob for different number of antennas at Alice, Bob, Wiley, and Eve, forRs=2 bits/s/Hz, γ¯WE= 5 dB, and γ¯AE= 0 dB.Figure 3
Conditioned secrecy outage probability as a function of secure rateRs for different number of antennas at Alice, Bob, Wiley, and Eve, for Rb=2 bits/s/Hz, γ¯AB= 20 dB, γ¯WE= 5 dB, and γ¯AE= 0 dB.Figure4 shows the level curves of the secrecy outage probability as a function of NA and NE. For NB=2, NW=2, γ¯AB = 10 dB, γ¯WE = 5 dB, and γ¯AE = 0 dB, we see that by increasing the average SNR between legitimate and eavesdropper channel and the number of antennas at Alice, it is possible to achieve much lower secrecy outage probability, i.e., less than 0.1%, even if Eve has several antennas. Therefore, we conclude that increasing the power ratio between legitimate and Eve’s channel plays a crucial role in the performance of the network.Figure 4
Conditioned secrecy outage probability as a function ofNA and NE for NB=2, NW=2, Rs=2 bits/s/Hz, γ¯AB=10 dB, γ¯AE=0 dB, and γ¯WE=5 dB.


### 8.2. Statistical QoS Evaluation

Figure5 illustrates the maximum average arrival rate r¯max and secrecy outage probability Pout as a function of a secure rate Rs, for different Markovian sources and two different configurations of antennas, where NA∈3,2, NB∈3,2, NE=2, and NW=2. We considered θ=1, i.e., strict QoS limitations, PON=0.5, γ¯AB = 10 dB, γ¯WE = 5 dB, and γ¯AE = 0 dB. The SNR threshold for ON-OFF transmission of the legitimate link is set to its minimum value of μ=2Rs−1. Increasing the number of antennas at Alice or Bob consequently increases the maximum average arrival rate and reduces the secrecy outage probability. Note that by increasing Rs, the maximum arrival rate also increases up to a maximal point, after which it starts to decrease. Therefore, there is an optimal Rs that maximizes r¯max. On the other hand, the secrecy outage probability increases always with Rs as expected. Besides, it is observed that all Markovian sources present the same optimal Rs, as shown by red triangular markers, while attainable secrecy outage probability at the optimal rate is indicated by blue triangular markers for three different settings of antennas. It can be also observed that for NB=3,r¯max is larger and Pout is smaller than in case of NA=3. The FMS experiences high Rmax, while DMMPS encounters lower r¯max.Figure 5
Maximum average arrival rate and conditioned secrecy outage probability as a function of secure rate for different configurations of antennas and different Markovian sources, forPON=0.5, γ¯AB=10 dB, γ¯AE=0 dB, γ¯WE=5 dB, and θ=1. Note that black lines shows r¯max and blue lines indicate ε, and red △ denotes optimum r¯max while blue △ represents ϵ corresponding to optimum r¯max at secure rate.In Figure6, we analyze the maximum average arrival rate as a function of the target reliability for different Markovian sources and different numbers of antennas at all nodes, where NA∈1,2, NB∈1,2, NW∈1, and NE∈1. We assume 20 dB gain, ϵ=1%, source’s burstiness PON=0.5, and QoS constraint θ=1. Notice that as θ⟶0, which implies longer delays, effective capacity will converge to capacity, which in this case is a fixed rate Rs. It is worth noticing that for the ultrareliable region, i.e., σ> 99.9% or stringent reliability requirement, r¯max along with optimal secure rate becomes very small for all Markovian sources, so for given parameters, it is impractical to operate in the ultrareliable region with secrecy. As previously mentioned, each setting of antennas has a unique optimal secure rate for all Markovian sources. r¯max along with the optimal secure rate tends to zero for σ> 99% in a scenario where Eve is equipped with more antennas than Alice and Bob. Note that higher r¯max can be maintained for loose reliability requirements for FMS, while DMMPS experiences more degradation in all cases.Figure 6
Maximum average arrival rate as a function of target reliabilityσ and optimal secure rate Rs for different Markov sources and different number of antennas at all nodes, for PON=0.5, ε=1%, γ¯AB=20 dB, γ¯WE=5 dB, γ¯AE=0 dB, and θ=1. Maximum average arrival rate is plotted on the left y-axis and optimal secure rate on the right y-axis.In Figure7, we fix the target reliability σ to 90%, and we focused on the variation of the threshold of secrecy outage probability and optimal Rs. Note that a higher r¯max and a higher optimal Rs can be attained for a loose security constraint. These results show the intuition that optimal Rs and r¯max are sacrificed to guarantee high reliability and security. Furthermore, this figure illustrates that even under strict requirement, i.e., ε=0.1%, σ=90%, and θ=1, a positive secrecy rate is still achievable. Moreover, a higher number of antennas at Bob provide significant gains to the system. It is also noticeable that DMMPS and CMMPS are less prone to strict reliability and security constraints.Figure 7
Maximum average arrival rate and optimal secure rate as a function of secrecy outage probabilityε for different Markovian sources and three different configurations of antennas, for PON=0.5, σ=99%, γ¯AB=20 dB, γ¯WE=5 dB, γ¯AE=0 dB, and θ=1. Black lines indicate the maximum average arrival rate while cyan color shows the optimum secure rate.After analyzing the impact of security and reliability constraints on the system performance, we next assess the effect of latency. In Figure8, we show the probability of delay violation versus maximum average arrival rate for θ∈0,2, PON = 0.5, different antenna settings, and distinct values of delay threshold d∈5,8. We examine the different Markovian sources to determine achievable security, latency, and reliability performance since this is an important issue in industrial control systems. Interestingly, for σ=90%, lower security constraints, ϵ=0.1%, delay threshold d=8, and 1% delay violation probability, r¯max is compromised for all Markovian sources and larger values of r¯max cannot be supported for larger values of θ. Besides this, in order to have low delay violation probability, the delay threshold d needs to be flexible. The larger delay threshold we have, the less delay violation probability a system can have, which consequently increases r¯max. Obviously, the delay violation probability is large in the SISOME and less in SIMOSE scenarios.Figure 8
Delay violation probability vs. maximum average arrival rate for different Markovian sources forθ∈0,2 with three distinct antenna arrangements and for two distinct delay thresholds d∈5,10, PON=0.5, ε=0.1%, σ=90%, α=50, β=50, γ¯AB=20 dB, γ¯WE=5 dB, γ¯AE=0 dB, and θ=1. Black lines are for d=5, and cyan lines are for d=8.Figure9 shows the maximum average arrival rate as a function of QoS exponent θ for different Markovian sources and distinct antenna arrangements. We set PON=0.5 with 90% reliability and 0.1% secrecy outage. We notice a degradation in r¯max when stricter buffer constraints are imposed. Consequently, it is observed that lower r¯max can be tolerated for stringent delay requirements θ≫0. We also observe that FMS and DTMS have better performance even under high QoS constraints, while CMMPS and DMMPS perform poorly at very tight buffer constraints (higher values of θ). Similar to previous intuitions, we see that the for higher number of antennas at Bob, cases attain high r¯max, while it reduces in when jammer is equipped with a single antenna.Figure 9
Maximum average arrival rate as a function of QoS exponentθ for different Markovian sources and different settings of antennas, for PON=0.5, σ=90%, ε=1%, γ¯AB=20 dB, γ¯WE=5, and γ¯AE=0 dB.In Figure10, we examine the effect of the source’s burstiness on arrival rate for different Markovian sources to sustain the optimal secure effective capacity for different antenna configurations at γ¯AB = 20 dB and γ¯AE = 0 dB. We set the reliability indicator σ to 90%, security constraint ϵ=0.1%, and θ=1. Note that the source’s burstiness (lesser values of PON) increases the arrival rate. In the case of DTMS and FMS, we notice that the arrival rate becomes equal to the optimal secure effective capacity when PON=1, which means the source is always ON and there is a constant arrival rate. The DMTS and FMS need larger arrival rates to sustain the optimal secure effective capacity. Furthermore, the NB=2 case also requires higher arrival rates as compared with NA=2. We further show that as PON reduces, the arrival rate in ON state needs to increase with a specific level to keep average arrival rate nondecreasing. When the source is bursty, the higher arrival rate is needed to attain secure effective capacity. Note that the DTMS and FMS are affected by the source’s burstiness, so to ensure QoS, these two sources need a significant adaptation of arrival rate. The CMMPS is suitable to model bursty traffic. Moreover, the probability of ON state is not the only measure of burstiness for FMS and CMMPS; the low values of α and β also show that the source is bursty as transition does not frequently occur between ON and OFF states, which also indicates that OFF state is more persistent. Large values of α and β indicate the fast transition between ON and OFF states, which minimizes the SNR requirement levels.Figure 10
Arrival rate as a function ofPon for secure effective capacity of Markovian sources for three combinations of antennas, for σ=90%, ε=0.1%, γ¯AB=20 dB, γ¯WE=5 dB, γ¯AE=0 dB, and θ=1: (a) DTMS, (b) FMS, (c) DMMPS, and (d) CMMPS.
(a)(b)(c)(d)


## 8.1. On the Secrecy Outage Performance

Figure2 shows the secrecy outage probability as a function of the average SNR at Bob γ¯AB, for a fixed secrecy rate Rs=2 bits/s/Hz, γ¯AE = 0 dB, γ¯WE  = 5 dB, and different configurations of the number of antennas at each node. The SNR threshold is set to its minimum value of μ=2Rs−1. First, notice that simulations perfectly match with our analytical results, thus corroborating the correctness of our expressions. Note also that while an increase in NA or NB causes a significant decrease in the secrecy outage probability, an increase in NE degrades the system’s secrecy performance to a lesser extent. This can be explained due to the TAS technique, which prevents the eavesdropper from exploiting diversity from Alice. In addition, it can be observed that a greater number of receive antennas are more beneficial than a greater number of transmit antennas in the legitimate link. In fact, when NA>NB, it is required at least 2 dB gain of γ¯AB to attain the same secrecy performance while Figure 3 shows the comparison between adaptive and nonadaptive schemes. We also perform Monte Carlo simulation for the nonadaptive scenario, which matches exactly with analytical expression and corroborates its correctness. We notice that adaptive scheme outperforms its counterpart. Therefore, we only focus on adaptive scheme for the rest of numerical analysis.Figure 2
Conditioned secrecy outage probability as a function of average SNR at Bob for different number of antennas at Alice, Bob, Wiley, and Eve, forRs=2 bits/s/Hz, γ¯WE= 5 dB, and γ¯AE= 0 dB.Figure 3
Conditioned secrecy outage probability as a function of secure rateRs for different number of antennas at Alice, Bob, Wiley, and Eve, for Rb=2 bits/s/Hz, γ¯AB= 20 dB, γ¯WE= 5 dB, and γ¯AE= 0 dB.Figure4 shows the level curves of the secrecy outage probability as a function of NA and NE. For NB=2, NW=2, γ¯AB = 10 dB, γ¯WE = 5 dB, and γ¯AE = 0 dB, we see that by increasing the average SNR between legitimate and eavesdropper channel and the number of antennas at Alice, it is possible to achieve much lower secrecy outage probability, i.e., less than 0.1%, even if Eve has several antennas. Therefore, we conclude that increasing the power ratio between legitimate and Eve’s channel plays a crucial role in the performance of the network.Figure 4
Conditioned secrecy outage probability as a function ofNA and NE for NB=2, NW=2, Rs=2 bits/s/Hz, γ¯AB=10 dB, γ¯AE=0 dB, and γ¯WE=5 dB.


## 8.2. Statistical QoS Evaluation

Figure5 illustrates the maximum average arrival rate r¯max and secrecy outage probability Pout as a function of a secure rate Rs, for different Markovian sources and two different configurations of antennas, where NA∈3,2, NB∈3,2, NE=2, and NW=2. We considered θ=1, i.e., strict QoS limitations, PON=0.5, γ¯AB = 10 dB, γ¯WE = 5 dB, and γ¯AE = 0 dB. The SNR threshold for ON-OFF transmission of the legitimate link is set to its minimum value of μ=2Rs−1. Increasing the number of antennas at Alice or Bob consequently increases the maximum average arrival rate and reduces the secrecy outage probability. Note that by increasing Rs, the maximum arrival rate also increases up to a maximal point, after which it starts to decrease. Therefore, there is an optimal Rs that maximizes r¯max. On the other hand, the secrecy outage probability increases always with Rs as expected. Besides, it is observed that all Markovian sources present the same optimal Rs, as shown by red triangular markers, while attainable secrecy outage probability at the optimal rate is indicated by blue triangular markers for three different settings of antennas. It can be also observed that for NB=3,r¯max is larger and Pout is smaller than in case of NA=3. The FMS experiences high Rmax, while DMMPS encounters lower r¯max.Figure 5
Maximum average arrival rate and conditioned secrecy outage probability as a function of secure rate for different configurations of antennas and different Markovian sources, forPON=0.5, γ¯AB=10 dB, γ¯AE=0 dB, γ¯WE=5 dB, and θ=1. Note that black lines shows r¯max and blue lines indicate ε, and red △ denotes optimum r¯max while blue △ represents ϵ corresponding to optimum r¯max at secure rate.In Figure6, we analyze the maximum average arrival rate as a function of the target reliability for different Markovian sources and different numbers of antennas at all nodes, where NA∈1,2, NB∈1,2, NW∈1, and NE∈1. We assume 20 dB gain, ϵ=1%, source’s burstiness PON=0.5, and QoS constraint θ=1. Notice that as θ⟶0, which implies longer delays, effective capacity will converge to capacity, which in this case is a fixed rate Rs. It is worth noticing that for the ultrareliable region, i.e., σ> 99.9% or stringent reliability requirement, r¯max along with optimal secure rate becomes very small for all Markovian sources, so for given parameters, it is impractical to operate in the ultrareliable region with secrecy. As previously mentioned, each setting of antennas has a unique optimal secure rate for all Markovian sources. r¯max along with the optimal secure rate tends to zero for σ> 99% in a scenario where Eve is equipped with more antennas than Alice and Bob. Note that higher r¯max can be maintained for loose reliability requirements for FMS, while DMMPS experiences more degradation in all cases.Figure 6
Maximum average arrival rate as a function of target reliabilityσ and optimal secure rate Rs for different Markov sources and different number of antennas at all nodes, for PON=0.5, ε=1%, γ¯AB=20 dB, γ¯WE=5 dB, γ¯AE=0 dB, and θ=1. Maximum average arrival rate is plotted on the left y-axis and optimal secure rate on the right y-axis.In Figure7, we fix the target reliability σ to 90%, and we focused on the variation of the threshold of secrecy outage probability and optimal Rs. Note that a higher r¯max and a higher optimal Rs can be attained for a loose security constraint. These results show the intuition that optimal Rs and r¯max are sacrificed to guarantee high reliability and security. Furthermore, this figure illustrates that even under strict requirement, i.e., ε=0.1%, σ=90%, and θ=1, a positive secrecy rate is still achievable. Moreover, a higher number of antennas at Bob provide significant gains to the system. It is also noticeable that DMMPS and CMMPS are less prone to strict reliability and security constraints.Figure 7
Maximum average arrival rate and optimal secure rate as a function of secrecy outage probabilityε for different Markovian sources and three different configurations of antennas, for PON=0.5, σ=99%, γ¯AB=20 dB, γ¯WE=5 dB, γ¯AE=0 dB, and θ=1. Black lines indicate the maximum average arrival rate while cyan color shows the optimum secure rate.After analyzing the impact of security and reliability constraints on the system performance, we next assess the effect of latency. In Figure8, we show the probability of delay violation versus maximum average arrival rate for θ∈0,2, PON = 0.5, different antenna settings, and distinct values of delay threshold d∈5,8. We examine the different Markovian sources to determine achievable security, latency, and reliability performance since this is an important issue in industrial control systems. Interestingly, for σ=90%, lower security constraints, ϵ=0.1%, delay threshold d=8, and 1% delay violation probability, r¯max is compromised for all Markovian sources and larger values of r¯max cannot be supported for larger values of θ. Besides this, in order to have low delay violation probability, the delay threshold d needs to be flexible. The larger delay threshold we have, the less delay violation probability a system can have, which consequently increases r¯max. Obviously, the delay violation probability is large in the SISOME and less in SIMOSE scenarios.Figure 8
Delay violation probability vs. maximum average arrival rate for different Markovian sources forθ∈0,2 with three distinct antenna arrangements and for two distinct delay thresholds d∈5,10, PON=0.5, ε=0.1%, σ=90%, α=50, β=50, γ¯AB=20 dB, γ¯WE=5 dB, γ¯AE=0 dB, and θ=1. Black lines are for d=5, and cyan lines are for d=8.Figure9 shows the maximum average arrival rate as a function of QoS exponent θ for different Markovian sources and distinct antenna arrangements. We set PON=0.5 with 90% reliability and 0.1% secrecy outage. We notice a degradation in r¯max when stricter buffer constraints are imposed. Consequently, it is observed that lower r¯max can be tolerated for stringent delay requirements θ≫0. We also observe that FMS and DTMS have better performance even under high QoS constraints, while CMMPS and DMMPS perform poorly at very tight buffer constraints (higher values of θ). Similar to previous intuitions, we see that the for higher number of antennas at Bob, cases attain high r¯max, while it reduces in when jammer is equipped with a single antenna.Figure 9
Maximum average arrival rate as a function of QoS exponentθ for different Markovian sources and different settings of antennas, for PON=0.5, σ=90%, ε=1%, γ¯AB=20 dB, γ¯WE=5, and γ¯AE=0 dB.In Figure10, we examine the effect of the source’s burstiness on arrival rate for different Markovian sources to sustain the optimal secure effective capacity for different antenna configurations at γ¯AB = 20 dB and γ¯AE = 0 dB. We set the reliability indicator σ to 90%, security constraint ϵ=0.1%, and θ=1. Note that the source’s burstiness (lesser values of PON) increases the arrival rate. In the case of DTMS and FMS, we notice that the arrival rate becomes equal to the optimal secure effective capacity when PON=1, which means the source is always ON and there is a constant arrival rate. The DMTS and FMS need larger arrival rates to sustain the optimal secure effective capacity. Furthermore, the NB=2 case also requires higher arrival rates as compared with NA=2. We further show that as PON reduces, the arrival rate in ON state needs to increase with a specific level to keep average arrival rate nondecreasing. When the source is bursty, the higher arrival rate is needed to attain secure effective capacity. Note that the DTMS and FMS are affected by the source’s burstiness, so to ensure QoS, these two sources need a significant adaptation of arrival rate. The CMMPS is suitable to model bursty traffic. Moreover, the probability of ON state is not the only measure of burstiness for FMS and CMMPS; the low values of α and β also show that the source is bursty as transition does not frequently occur between ON and OFF states, which also indicates that OFF state is more persistent. Large values of α and β indicate the fast transition between ON and OFF states, which minimizes the SNR requirement levels.Figure 10
Arrival rate as a function ofPon for secure effective capacity of Markovian sources for three combinations of antennas, for σ=90%, ε=0.1%, γ¯AB=20 dB, γ¯WE=5 dB, γ¯AE=0 dB, and θ=1: (a) DTMS, (b) FMS, (c) DMMPS, and (d) CMMPS.
(a)(b)(c)(d)


## 9. Conclusion

In this work, we investigated the statistical QoS provisioning for cloud-based IoT networks under security, reliability, and latency constraints. To do so, we relied on the secure effective capacity model and considered a wiretap channel, where the legitimate pair, Alice and Bob, communicates in the presence of an eavesdropper who attempts to breach the transmission originated from Alice, while a friendly jammer Wiley emits the artificial noise to degrade Eve’s channel. This is a relevant scenario in the context of massive IoT deployments where nodes have limited computational capabilities. Nodes are equipped with multiple antennas, which are exploited by Alice to perform TAS, while Bob and Eve employ MRC technique. Furthermore, we assumed that Bob applies perfect SIC to cancel out artificial noise coming from Wiley. Our model was inspired by the alternative secrecy outage formulation conditioned upon a successful transmission, which provides a more thorough measure of the system’s security since the conventional secrecy outage formulation fails to differentiate between the system’s security and reliability level. We derived exact closed-form expression for the secrecy outage probability for the proposed scenario. We examined the secure effective capacity for an ON-OFF transmission by analyzing the traffic generated by IoT devices through Markovian sources. This metric is capable of capturing the source’s burstiness. Furthermore, a secure throughput maximization was performed by considering an adaptive rate, according to Bob’s received SNR, subject to reliability and security constraints. The maximized secure throughput consequently enhanced the maximum average arrival rate. Simulation results showed that the number of antennas at Bob has a significant impact on security performance compared with that at Alice and Wiley. Moreover, higher average SNR at the legitimate link led to a greater security even if Eve is equipped with several antennas. It was also observed that secure throughput experiences reduction when stringent QoS requirements are imposed. Besides, the delay violation probability could be reduced by relaxing the delay threshold and also by increasing the number of antennas at Bob as compared with Alice. However, it gets seriously affected when Eve is equipped with more antennas than Alice and Bob. Finally, the legitimate link’s SNR gain plays a crucial role for system performance to meet the stringent security, reliability, and latency requirements.



---

*Source: 8650272-2021-10-29.xml*