# A Secure Communication Scheme Based on Equivalent Interference Channel Assisted by Physical Layer Secret Keys

Authors: Xiaoyan Hu; Liang Jin; Kaizhi Huang; Keming Ma; Changcheng Song; Shuaifang Xiao
Journal: Security and Communication Networks
 (2020)

---

## Abstract

Due to the channel estimation error, most of the physical layer secret key generation schemes need information reconciliation to correct error key bits, resulting in reduced efficiency. To solve the problem, this work proposes a novel secure communication scheme based on a equivalent interference channel. Different keys generated from imperfect channel state information are directly applied to signal scrambling and descrambling, which is equivalent to the process of a signal passing through an interference channel. Legitimate communication parties can reduce interference with the help of similar keys and channel coding without sending additional signals, while the eavesdropper channel is deteriorated due to the spatial decorrelation. For this kind of schemes, we first establish a discrete memoryless broadcast channel model to derive the expressions of bit error rate (BER), channel capacity, and security capacity for performance analysis. Simulation results verify the derivations that the proposed scheme achieves secure communication with a correlated eavesdropping channel and has a higher upper bound of transmission rate. Furthermore, we design a new metric to evaluate the efficiency and the result shows that the proposed scheme has superior performance on error reconciliation efficiency, despite its slight increase in BER.


---

## Body

## 1. Introduction

With the rapid popularization of the 5th generation wireless systems (5G), the confidentiality of wireless communications is also receiving extensive attention. The mainstream approach to information protection is the modern cryptography based on preagreed key [1]. Most of the cryptographic protocols are implemented in two ways: public-key encryption [2] and symmetric-key encryption (e.g., AES [3]). The theoretical basis of both works on the same implicit assumption that eavesdroppers have insufficient computational capabilities of solving a certain mathematical problem in feasible time. However, quantum computers may break this principle because of their powerful computing capabilities. On the other hand, complex key distribution protocols may be limited by the hardware conditions of the low-power terminals, such as wireless sensors [4, 5]. To address the above challenges, physical layer secure transmission (ST) [6] and physical layer secret key generation (SKG, also called secret key distribution) [7] emerge and have caused a wide concern. Based on information theoretic security, the two methods can ensure unconditional security even if the eavesdropper has unlimited computational power [8]. Thus, they can be examined as an alternative complement to traditional cryptography for wireless communication security.


### 1.1. Related Works

The realization of information theoretic security, i.e., one-time-pad encryption, was first proposed by Shannon in [8], which requires that the information rate cannot exceed the secret key rate. On this basis, Wyner proposed a secure transmission approach based on wiretap channel model on the condition that the channel capacity of the legal channel must be larger than that of the eavesdropping channel [9]. After that seminal work, many studies focused on how to create the above-mentioned favourable conditions for achieving information theoretic security. The source model based SKG exploits inherent characteristics of wireless channels (i.e., reciprocity, spatial decorrelation, and temporal variation) to provide security solutions [10]. The statistics of channel state information (CSI), such as Received Signal Strength (RSS) [11], Channel Impulse Response (CIR) [12], and Channel Frequency Response (CFR) [13], can be utilized as common random source to extract secret keys. In those studies, the two legal parties simultaneously measure the same noise channel to obtain highly correlated but not completely consistent CSI samples and then quantize them into secret bits. Due to the asymmetric noise and the evaluated error in half-duplex mode, legal parties have to correct the disagreement bits through the information reconciliation process [14] and then eliminate the influence of key leakage caused by sending reconciliation signals through privacy ampliﬁcation [15].Although research on physical layer security has been conducted for several years, there are still few applications because most schemes cannot meet the requirement of low-cost implementation. As proved in [16, 17], ST have strict requirements for the number of antennas to inject artificial interference while transmitting confidential information, which inevitably increases energy consumption. As for SKG, interactively sending reconciliation signal is necessary for both legal parties to reduce the negative impact of imperfect CSI and correct error key bits, which also results in large overhead [18]. The authors in [19, 20] try to reduce the estimation error of random sources by common signal processing techniques, such as PCA or Kalman filter. But these algorithms have higher requirements on computational ability of the communication devices. The authors in [13, 21] improved the quantization algorithm to reduce the key bit mismatch rate (BMR) with lower complexity, but they must send additional signals to transmit the quantization information. Moreover, sending additional reconciliation signals not only consumes resources originally used for normal wireless communication but also may leak some key information.


### 1.2. Motivation and Contributions

To address this challenge, we focus on developing more efficient physical layer security solutions. Our previous work [22] first proposed the notion of equivalent channel for authentication and key distribution. The equivalent channel is built by asymmetric physical layer secret keys generated from CSI. It is a cascade channel composed of encryption, decryption, and noiseless public channel. The scheme in [22] guarantees a secure and reliable transmission of private information without information or artificial noise, but it still needs to send additional hash signals to verify the message, and the assumption of noiseless channel is too ideal. Recent studies have applied similar ideas to physical layer authentication in [23, 24] and to ST in [25, 26]. But they still need to send additional signals for secret key quantization or verification, thus increasing overhead. In addition, although research studies such as [10, 27] have done a lot of work in key generation and secure channel capacity, the analysis of these new solutions that directly scramble signals by asymmetric secret keys is still rare, which makes it difficult to evaluate or optimize system performance. Furthermore, the impact of correlated eavesdropping channel on the security capacity is not considered.Based on the previous work, this paper proposes a novel secure communication scheme based on equivalent interference channel (EIC). Specifically, legal parties first generate physical layer secret keys and then scramble encoded signals according to the keys to establish the equivalent scrambling channel. The legal receiver can generate similar keys to reduce the interference due to channel reciprocity. However, because of the spatial decorrelation of the wireless channel, the bit mismatch rate (BMR) of the keys of illegal eavesdropper in different location is much higher than that of the legal parties, so that the interference cannot be eliminated.The main contributions of this paper are as follows:(i)
The physical layer keys in proposed scheme are used to scramble the encoded signal instead of encrypting original confidential information, and the error bits in received signals can be corrected by channel coding. Therefore, we save the overhead of sending additional signals for quantization, information reconciliation, or key verification.(ii)
We first establish a discrete memoryless broadcast channel (DMBC) model for this kind of schemes to evaluate the performance. The entire process of scrambling, descrambling, and noisy public channel is equivalent to an equivalent interference channel, and the expressions of BER, channel capacity, and security capacity are derived. Based on the deductions, we jointly design the SKG and secure communication method to optimize the channel capacity. The numerical and simulation results verify our theoretical analysis that the proposed scheme has a higher upper bound of transmission rate.(iii)
A new metric is proposed for defining and evaluating the efficiency of different schemes. The simulation results show that the efficiency of this scheme is higher than existing SKG and encrypted transmission schemes.


### 1.3. Organization and Notation

The rest of this paper is organized as follows. Section2 describes the typical wireless channel model of SKG scheme. Section 3 outlines the existing schemes and the proposed scheme. The detailed description of the program flow is in Section 4. Section 5 presents the performance evaluation and optimization of the scheme. Section 6 presents the numerical and simulation results. The concluding remarks of this paper are given in Section 7. The corresponding proofs are deferred to the Appendix. The notations used in this paper are shown in Table 1.Table 1
Glossary of symbols.
SymbolDefinitionhAB,hAEChannel complex gains of Alice-Bob and Alice-EveρCorrelation coefficient betweenhAB and hAEMConfidential informationXEncoded information of AliceXsSignal after scrambling of AliceYsReceived signal of BobYSignal after descrambling of BobZsReceived signal of EveZSignal after descrambling of EveKA,KB,KESecret key sequences of Alice, Bob, and EveHA,HB,HECommon random source of Alice, Bob, and EveqQuantization precisiontsAcquisition time of estimated channel gainPAB,PAEBMR between Alice and Bob keys and between Alice and Eve keysPxy,PxzBER of Bob and Eve in equivalent interference channelPr⋅Traditional probabilityζError reconciliation efficiency


## 1.1. Related Works

The realization of information theoretic security, i.e., one-time-pad encryption, was first proposed by Shannon in [8], which requires that the information rate cannot exceed the secret key rate. On this basis, Wyner proposed a secure transmission approach based on wiretap channel model on the condition that the channel capacity of the legal channel must be larger than that of the eavesdropping channel [9]. After that seminal work, many studies focused on how to create the above-mentioned favourable conditions for achieving information theoretic security. The source model based SKG exploits inherent characteristics of wireless channels (i.e., reciprocity, spatial decorrelation, and temporal variation) to provide security solutions [10]. The statistics of channel state information (CSI), such as Received Signal Strength (RSS) [11], Channel Impulse Response (CIR) [12], and Channel Frequency Response (CFR) [13], can be utilized as common random source to extract secret keys. In those studies, the two legal parties simultaneously measure the same noise channel to obtain highly correlated but not completely consistent CSI samples and then quantize them into secret bits. Due to the asymmetric noise and the evaluated error in half-duplex mode, legal parties have to correct the disagreement bits through the information reconciliation process [14] and then eliminate the influence of key leakage caused by sending reconciliation signals through privacy ampliﬁcation [15].Although research on physical layer security has been conducted for several years, there are still few applications because most schemes cannot meet the requirement of low-cost implementation. As proved in [16, 17], ST have strict requirements for the number of antennas to inject artificial interference while transmitting confidential information, which inevitably increases energy consumption. As for SKG, interactively sending reconciliation signal is necessary for both legal parties to reduce the negative impact of imperfect CSI and correct error key bits, which also results in large overhead [18]. The authors in [19, 20] try to reduce the estimation error of random sources by common signal processing techniques, such as PCA or Kalman filter. But these algorithms have higher requirements on computational ability of the communication devices. The authors in [13, 21] improved the quantization algorithm to reduce the key bit mismatch rate (BMR) with lower complexity, but they must send additional signals to transmit the quantization information. Moreover, sending additional reconciliation signals not only consumes resources originally used for normal wireless communication but also may leak some key information.


## 1.2. Motivation and Contributions

To address this challenge, we focus on developing more efficient physical layer security solutions. Our previous work [22] first proposed the notion of equivalent channel for authentication and key distribution. The equivalent channel is built by asymmetric physical layer secret keys generated from CSI. It is a cascade channel composed of encryption, decryption, and noiseless public channel. The scheme in [22] guarantees a secure and reliable transmission of private information without information or artificial noise, but it still needs to send additional hash signals to verify the message, and the assumption of noiseless channel is too ideal. Recent studies have applied similar ideas to physical layer authentication in [23, 24] and to ST in [25, 26]. But they still need to send additional signals for secret key quantization or verification, thus increasing overhead. In addition, although research studies such as [10, 27] have done a lot of work in key generation and secure channel capacity, the analysis of these new solutions that directly scramble signals by asymmetric secret keys is still rare, which makes it difficult to evaluate or optimize system performance. Furthermore, the impact of correlated eavesdropping channel on the security capacity is not considered.Based on the previous work, this paper proposes a novel secure communication scheme based on equivalent interference channel (EIC). Specifically, legal parties first generate physical layer secret keys and then scramble encoded signals according to the keys to establish the equivalent scrambling channel. The legal receiver can generate similar keys to reduce the interference due to channel reciprocity. However, because of the spatial decorrelation of the wireless channel, the bit mismatch rate (BMR) of the keys of illegal eavesdropper in different location is much higher than that of the legal parties, so that the interference cannot be eliminated.The main contributions of this paper are as follows:(i)
The physical layer keys in proposed scheme are used to scramble the encoded signal instead of encrypting original confidential information, and the error bits in received signals can be corrected by channel coding. Therefore, we save the overhead of sending additional signals for quantization, information reconciliation, or key verification.(ii)
We first establish a discrete memoryless broadcast channel (DMBC) model for this kind of schemes to evaluate the performance. The entire process of scrambling, descrambling, and noisy public channel is equivalent to an equivalent interference channel, and the expressions of BER, channel capacity, and security capacity are derived. Based on the deductions, we jointly design the SKG and secure communication method to optimize the channel capacity. The numerical and simulation results verify our theoretical analysis that the proposed scheme has a higher upper bound of transmission rate.(iii)
A new metric is proposed for defining and evaluating the efficiency of different schemes. The simulation results show that the efficiency of this scheme is higher than existing SKG and encrypted transmission schemes.


## 1.3. Organization and Notation

The rest of this paper is organized as follows. Section2 describes the typical wireless channel model of SKG scheme. Section 3 outlines the existing schemes and the proposed scheme. The detailed description of the program flow is in Section 4. Section 5 presents the performance evaluation and optimization of the scheme. Section 6 presents the numerical and simulation results. The concluding remarks of this paper are given in Section 7. The corresponding proofs are deferred to the Appendix. The notations used in this paper are shown in Table 1.Table 1
Glossary of symbols.
SymbolDefinitionhAB,hAEChannel complex gains of Alice-Bob and Alice-EveρCorrelation coefficient betweenhAB and hAEMConfidential informationXEncoded information of AliceXsSignal after scrambling of AliceYsReceived signal of BobYSignal after descrambling of BobZsReceived signal of EveZSignal after descrambling of EveKA,KB,KESecret key sequences of Alice, Bob, and EveHA,HB,HECommon random source of Alice, Bob, and EveqQuantization precisiontsAcquisition time of estimated channel gainPAB,PAEBMR between Alice and Bob keys and between Alice and Eve keysPxy,PxzBER of Bob and Eve in equivalent interference channelPr⋅Traditional probabilityζError reconciliation efficiency


## 2. Wireless Channel Model

Figure1 shows the correlated eavesdropping channel model of SKG. The wireless channel between Alice and Bob is assumed to be an insecure Rayleigh fading channel with an eavesdropper denoted by Eve. All of them are equipped with a single antenna and work in time-division duplex (TDD) mode. Channel gains hAB, hBA, and hAE are identically distributed random variables that satisfy h∼CN0,σh2. We consider two types of eavesdroppers: the uncorrelated eavesdropper is far away from Alice or Bob but can receive signals from them; the correlated eavesdropper not only can receive all signals but also attempts to approach Bob in order to eavesdrop more information. As shown in Figure 1, the channel between Alice and Eve (or Alice-Eve channel for short) is correlated with the Alice-Bob channel, and ρ is the correlation coefficient between the channel gains hAB and hAE. In Rayleigh fading channel, ρ can be calculated in Jakes model as(1)ρ=EhAB†hAEσh2=J02πdλ,where J0⋅ is a zeroth-order Bessel function of the first kind; d is the distance between Eve and Bob; and λ is the length of waveform. For an uncorrelated eavesdropper, ρ=0.Figure 1
Wireless channel model.


## 3. Overview of Existing and Proposed Schemes

In the above wireless channel model, the process of existing physical layer secret key generation and encrypted transmission scheme is shown in Figure2. First, Alice and Bob send pilot signals to estimate CSI to generate secret keys KA and KB, where ψq⋅ denotes the generation algorithm. Due to channel estimation errors, KA and KB are not consistent. Therefore, Alice and Bob need information reconciliation to correct wrong bits. Without loss of generality, we consider that Alice calculates the reconciliation signal VA according to the preagreed generation matrix of linear block code and its own key KA, where ϕ⋅ is the calculation function of reconciliation information. Then, Alice sends VA to Bob through the public channel. Based on KB and VA, Bob decodes the reconciliation signal to get KA. Finally, Alice and Bob encrypt and decrypt the original confidential information M by a pair of identical keys. For most existing schemes, sending reconciliation information to obtain a consistent key is an essential step. However, this method has the following adverse effects: (i) sending additional quantization and reconciliation signals VA will increase the overhead; (ii) the extra coding and decoding process will also increase the calculation cost; (iii) since coding method is overt, transmitting VA on a public channel may reveal some key information. These shortcomings motivate us to develop a new secret key generation and application method.Figure 2
Process of the existing physical layer secret key generation and encrypted transmission scheme.The secure communication process of this scheme is shown in Figure3. The main difference is that we directly use different keys to scramble the encoded signal instead of encrypting M with the same key. We perform channel decoding after descrambling to correct all wrong bits caused by different keys and noise. Instead of sending hash information, we verify the message with CRC check bits. Furthermore, apart from adding the key generation and scrambling module, we do not change the existing communication process. The specific steps of the scheme are detailed in Section 4.Figure 3
Process of secure communication scheme based on equivalent interference channel.Based on this scheme, an equivalent interference channel model is established to derive performance evaluation functions. As shown in the black-dashed frame in Figure3, we refer to the entire process between scrambling and descrambling as an equivalent interference channel, which is a DMBC denoted by X,py,zx,Y×Z, where py,zx denotes channel transition probability, x∈X denotes encoded message of Alice, and y∈Y and z∈Z denote the received codewords of Bob and Eve, respectively, after descrambling. The data transmission channels of Alice-Bob and Alice-Eve are discrete memoryless channels (DMC) denoted by Xs,pysxs,Ys and Xs,pzsxs,Zs, where xs∈Xs denotes the data signals sent by Alice after scrambling and ys∈Ys and zs∈Zs denote the received signals of Bob and Eve, respectively. Note that we estimate CSI in Rayleigh channel and evaluate the system in DMC model. The derivation results guide the design and optimization of the scheme, so there is no need to transmit signals for quantization or information verification like [22, 26]. The details of the performance analysis are presented in Section 5.


## 4. Process of the Proposed Scheme

### 4.1. Secret Key Generation

For TDD wireless system, there are two mainstream approaches for legal partners to obtain relevant common random source to generate secret key. One is to estimate the CSI by the received pilot signal; the other is sending random signals to mix the random signals and the channel gains [28]. The former is selected in this scheme.


#### 4.1.1. Extraction of Common Random Source

As shown in Figure3, Alice and Bob send pilot signals to each other for estimating CSI. Similarly, Eve obtains the CSI without sending pilot. When they measure the channel gain of the i-th received pilot signal with zero forcing (ZF) algorithm, the results can be expressed as follows:(2)h^A,i=hBA,i+nA,i,h^B,i=hAB,i+nB,i,h^E,i=hAE,i+nE,i,where nA,i, nB,i, and nE,i are the estimated errors of ZF algorithm. They are independent and identically distributed (i.i.d.) complex Gaussian random variables. Let σa2 and σb2 denote the pilot signal powers of Alice and Bob, respectively, and let σn2 denote the noise power. Then, according to the channel estimation error model in [29, 30], the probability distributions of nB,i and nE,i are CN0,σn2/σa2σp2 and nA,i∼CN0,σn2/σb2σp2. For a correlated eavesdropper, hAE,i can be rewritten as(3)hAE,i=ρhAB,i+1−ρ2nh,i,where nh,i is independent of hAB,i, which satisfies nh,i∼CN0,σh2. To ensure the maximum independence of random sources, Alice and Bob send pilot signals to each other only once in each coherent time. Assume that the Alice-Bob channel in the same coherent time remains unchanged because of the reciprocity. Then it can be inferred that hAB,i=hBA,i. After N coherent times, Alice, Bob, and Eve hold N channel estimation results as samples of common random source, i.e., HB=h^B,i,1≤i≤N and HE=h^E,i,1≤i≤N.


#### 4.1.2. Quantization

In general, the purpose of quantization algorithm for Alice and Bob is to quantize the common random source into more secret key bits, while the probability of keeping key mismatch between them and the probability of key being successfully predicted by Eve are both low. Since different key bits can be corrected in the next channel decoding process, we pay more attention to increasing the obstacle of the key being predicted by the eavesdropper. This is different from the traditional quantization algorithm in SKG, which focuses more on key consistency. Therefore, we selectq-bit equal-probability quantization algorithm to generate secret keys, where q represents quantization precision. Assume that the secret keys of Alice, Bob, or Eve are denoted by Ku, where u=A,B or E. As for the shared random source with complex Gaussian distribution, let Fs be the probability distribution function, and let F−1z,z∈0,1 be its inverse function. To obtain more keys, the real part and the imaginary part of the channel gains are quantized, respectively. The quantization algorithm is shown in Table 2.Table 2
Equal-probability quantization algorithm.
InputHu,Fs, and qOutputSecret keyKuInitialization(1) CalculateF−1z and the variance of Hu(2) Set2q quantization partitions, where the lth partition is expressed as Ql=F−1l−1/2q,F−1l/2qQuantification(3) Ifsu,i∈Ql, then ku,i=l(4) Convert quantized keyku,i into gray code ku,qi−1+1′,ku,qi−1+2′,…,ku,qi′ with length q(5) Repeat steps 3 and 4 untili=N, and then output Ku=ku,i,1≤i≤N=ku,j′,1≤j≤NqAfter converting the quantized key into binary gray code, the length of the output secret keys isNq bits. To evaluate the BMR of the secret keys KA, KB, and KE, we take 1-bit quantization as an example to deduce the following theorem.Theorem 1.
If we perform 1-bit equal-probability quantization algorithm on the complex Gaussian random vectorsHA and HB, the BMR between the outputs KA and KB denoted by PABγa,γb,q is as follows:(4)PABγa,γb,1=12−12π∫0∞erfγas22erfγbs22exp−s22ds,where γa=σa2σh2/σn2 and γb=σb2σh2/σn2 are the normalized SNR of pilot signals of Alice and Bob, respectively. For the random sources of Alice and Eve, that is, HA and HE, PAEγa,γb,q,ρ is as follows:(5)PAEγa,γb,1,ρ=12−12π∫0∞erfγbs22×erfγaρ2s22γa−ρ2γa+1exp−s22ds.
The following relationship is satisfied:(6)PAEγa,γb,1,ρ≥PABγa,γb,q=PAEγa,γb,1,1.Proof:.
see AppendixA.
From (4), one can see that PABγa,γb,1 decreases with the increase of γa and γb, and this conclusion is still valid on multibit quantization [31]. This shows that we can obtain more consistent keys by increasing the power of the pilot signal, thereby improving the robustness of our scheme. From (5) and (1), it is clear that PAEγa,γb,1,ρ increases when Eve and Bob get farther. If we let d⟶∞, then ρ≈0 and PAEγa,γb,1,ρ≈0.5. This conclusion is consistent with most of the SKG experiments; that is, the channels of Alice-Bob and Alice-Eve can be considered approximately independent when d>0.5λ in a scattering-rich channel environment. Therefore, in most cases, spatial decorrelation of the wireless channel protects the legal party’s secret key from being predicted by Eve. In practice, PABγa,γb,q and PAEγa,γb,q,ρ can be solved by statistical counting. In Section 6, we get the statistical value of multibit quantization BER from the simulation result.
Assuming that the average acquisition time of each channel estimated sample ists and the processing delay is ignored, the secret key generation rate of the proposed scheme is(7)Rs=2qts.
Note that the choice ofq is crucial to BMR and secret key generation rate. In Section 5, we will introduce a method for dynamically selecting q according to SNR.


### 4.2. Construction of the Equivalent Interference Channel

Unlike encrypting information with the same keys, scrambling and descrambling are performed to construct interference channel based on different keys. The interference can be injected in multiple steps of the signal processing, including spread spectrum, precoding, or changing constellation diagram in modulation like [32]. To facilitate hardware implementation, we XOR the key bits with the signal we want to scramble. As shown in Figure 3, the message M after encoding is denoted by X, and the codeword after scrambling is expressed as Xs. Then, Alice sends Xs via the Alice-Bob data channel. After that, Bob receives Ys and descrambles it by KB. Finally, Bob performs decoding to recover M. The reception capabilities of Bob and Eve in EIC will be discussed in Section 5.Note that the proposed scheme is similar to ST schemes based on artificial noise [33]. For the latter, the interference in the received signal arises because the artificial noise injected into the null space is not eliminated completely. For this scheme, the reason for the increase of BER is that estimation error of CSI cannot be eliminated completely. The commonality is to deteriorate the eavesdropping channel. Then, the legal party can use the advantage of signal-to-noise ratio and well-designed channel coding to transmit large amounts of information without leaking to eavesdroppers. Therefore, the careful design of channel coding is also necessary. It must fulfill the requirement that the error bits in Bob’s received signal can be corrected while preventing Eve from effectively correcting them during the channel decoding. As shown in Figure 3, Alice first adds CRC check bits to the message M and then encodes it as X=encodeM. To prevent Eve from recovering M, Alice should encode M with the highest possible code rate on the premise of meeting the system BER requirements. We analyzed the BER of Bob and Eve after decoding in Section 6. After decoding and getting M′, if Bob’s CRC does not match M′, the retransmission of M shall be carried out in accordance with ARQ protocol. Thus, the proposed scheme does not need to send verification information as [22].


## 4.1. Secret Key Generation

For TDD wireless system, there are two mainstream approaches for legal partners to obtain relevant common random source to generate secret key. One is to estimate the CSI by the received pilot signal; the other is sending random signals to mix the random signals and the channel gains [28]. The former is selected in this scheme.


### 4.1.1. Extraction of Common Random Source

As shown in Figure3, Alice and Bob send pilot signals to each other for estimating CSI. Similarly, Eve obtains the CSI without sending pilot. When they measure the channel gain of the i-th received pilot signal with zero forcing (ZF) algorithm, the results can be expressed as follows:(2)h^A,i=hBA,i+nA,i,h^B,i=hAB,i+nB,i,h^E,i=hAE,i+nE,i,where nA,i, nB,i, and nE,i are the estimated errors of ZF algorithm. They are independent and identically distributed (i.i.d.) complex Gaussian random variables. Let σa2 and σb2 denote the pilot signal powers of Alice and Bob, respectively, and let σn2 denote the noise power. Then, according to the channel estimation error model in [29, 30], the probability distributions of nB,i and nE,i are CN0,σn2/σa2σp2 and nA,i∼CN0,σn2/σb2σp2. For a correlated eavesdropper, hAE,i can be rewritten as(3)hAE,i=ρhAB,i+1−ρ2nh,i,where nh,i is independent of hAB,i, which satisfies nh,i∼CN0,σh2. To ensure the maximum independence of random sources, Alice and Bob send pilot signals to each other only once in each coherent time. Assume that the Alice-Bob channel in the same coherent time remains unchanged because of the reciprocity. Then it can be inferred that hAB,i=hBA,i. After N coherent times, Alice, Bob, and Eve hold N channel estimation results as samples of common random source, i.e., HB=h^B,i,1≤i≤N and HE=h^E,i,1≤i≤N.


### 4.1.2. Quantization

In general, the purpose of quantization algorithm for Alice and Bob is to quantize the common random source into more secret key bits, while the probability of keeping key mismatch between them and the probability of key being successfully predicted by Eve are both low. Since different key bits can be corrected in the next channel decoding process, we pay more attention to increasing the obstacle of the key being predicted by the eavesdropper. This is different from the traditional quantization algorithm in SKG, which focuses more on key consistency. Therefore, we selectq-bit equal-probability quantization algorithm to generate secret keys, where q represents quantization precision. Assume that the secret keys of Alice, Bob, or Eve are denoted by Ku, where u=A,B or E. As for the shared random source with complex Gaussian distribution, let Fs be the probability distribution function, and let F−1z,z∈0,1 be its inverse function. To obtain more keys, the real part and the imaginary part of the channel gains are quantized, respectively. The quantization algorithm is shown in Table 2.Table 2
Equal-probability quantization algorithm.
InputHu,Fs, and qOutputSecret keyKuInitialization(1) CalculateF−1z and the variance of Hu(2) Set2q quantization partitions, where the lth partition is expressed as Ql=F−1l−1/2q,F−1l/2qQuantification(3) Ifsu,i∈Ql, then ku,i=l(4) Convert quantized keyku,i into gray code ku,qi−1+1′,ku,qi−1+2′,…,ku,qi′ with length q(5) Repeat steps 3 and 4 untili=N, and then output Ku=ku,i,1≤i≤N=ku,j′,1≤j≤NqAfter converting the quantized key into binary gray code, the length of the output secret keys isNq bits. To evaluate the BMR of the secret keys KA, KB, and KE, we take 1-bit quantization as an example to deduce the following theorem.Theorem 1.
If we perform 1-bit equal-probability quantization algorithm on the complex Gaussian random vectorsHA and HB, the BMR between the outputs KA and KB denoted by PABγa,γb,q is as follows:(4)PABγa,γb,1=12−12π∫0∞erfγas22erfγbs22exp−s22ds,where γa=σa2σh2/σn2 and γb=σb2σh2/σn2 are the normalized SNR of pilot signals of Alice and Bob, respectively. For the random sources of Alice and Eve, that is, HA and HE, PAEγa,γb,q,ρ is as follows:(5)PAEγa,γb,1,ρ=12−12π∫0∞erfγbs22×erfγaρ2s22γa−ρ2γa+1exp−s22ds.
The following relationship is satisfied:(6)PAEγa,γb,1,ρ≥PABγa,γb,q=PAEγa,γb,1,1.Proof:.
see AppendixA.
From (4), one can see that PABγa,γb,1 decreases with the increase of γa and γb, and this conclusion is still valid on multibit quantization [31]. This shows that we can obtain more consistent keys by increasing the power of the pilot signal, thereby improving the robustness of our scheme. From (5) and (1), it is clear that PAEγa,γb,1,ρ increases when Eve and Bob get farther. If we let d⟶∞, then ρ≈0 and PAEγa,γb,1,ρ≈0.5. This conclusion is consistent with most of the SKG experiments; that is, the channels of Alice-Bob and Alice-Eve can be considered approximately independent when d>0.5λ in a scattering-rich channel environment. Therefore, in most cases, spatial decorrelation of the wireless channel protects the legal party’s secret key from being predicted by Eve. In practice, PABγa,γb,q and PAEγa,γb,q,ρ can be solved by statistical counting. In Section 6, we get the statistical value of multibit quantization BER from the simulation result.
Assuming that the average acquisition time of each channel estimated sample ists and the processing delay is ignored, the secret key generation rate of the proposed scheme is(7)Rs=2qts.
Note that the choice ofq is crucial to BMR and secret key generation rate. In Section 5, we will introduce a method for dynamically selecting q according to SNR.


## 4.1.1. Extraction of Common Random Source

As shown in Figure3, Alice and Bob send pilot signals to each other for estimating CSI. Similarly, Eve obtains the CSI without sending pilot. When they measure the channel gain of the i-th received pilot signal with zero forcing (ZF) algorithm, the results can be expressed as follows:(2)h^A,i=hBA,i+nA,i,h^B,i=hAB,i+nB,i,h^E,i=hAE,i+nE,i,where nA,i, nB,i, and nE,i are the estimated errors of ZF algorithm. They are independent and identically distributed (i.i.d.) complex Gaussian random variables. Let σa2 and σb2 denote the pilot signal powers of Alice and Bob, respectively, and let σn2 denote the noise power. Then, according to the channel estimation error model in [29, 30], the probability distributions of nB,i and nE,i are CN0,σn2/σa2σp2 and nA,i∼CN0,σn2/σb2σp2. For a correlated eavesdropper, hAE,i can be rewritten as(3)hAE,i=ρhAB,i+1−ρ2nh,i,where nh,i is independent of hAB,i, which satisfies nh,i∼CN0,σh2. To ensure the maximum independence of random sources, Alice and Bob send pilot signals to each other only once in each coherent time. Assume that the Alice-Bob channel in the same coherent time remains unchanged because of the reciprocity. Then it can be inferred that hAB,i=hBA,i. After N coherent times, Alice, Bob, and Eve hold N channel estimation results as samples of common random source, i.e., HB=h^B,i,1≤i≤N and HE=h^E,i,1≤i≤N.


## 4.1.2. Quantization

In general, the purpose of quantization algorithm for Alice and Bob is to quantize the common random source into more secret key bits, while the probability of keeping key mismatch between them and the probability of key being successfully predicted by Eve are both low. Since different key bits can be corrected in the next channel decoding process, we pay more attention to increasing the obstacle of the key being predicted by the eavesdropper. This is different from the traditional quantization algorithm in SKG, which focuses more on key consistency. Therefore, we selectq-bit equal-probability quantization algorithm to generate secret keys, where q represents quantization precision. Assume that the secret keys of Alice, Bob, or Eve are denoted by Ku, where u=A,B or E. As for the shared random source with complex Gaussian distribution, let Fs be the probability distribution function, and let F−1z,z∈0,1 be its inverse function. To obtain more keys, the real part and the imaginary part of the channel gains are quantized, respectively. The quantization algorithm is shown in Table 2.Table 2
Equal-probability quantization algorithm.
InputHu,Fs, and qOutputSecret keyKuInitialization(1) CalculateF−1z and the variance of Hu(2) Set2q quantization partitions, where the lth partition is expressed as Ql=F−1l−1/2q,F−1l/2qQuantification(3) Ifsu,i∈Ql, then ku,i=l(4) Convert quantized keyku,i into gray code ku,qi−1+1′,ku,qi−1+2′,…,ku,qi′ with length q(5) Repeat steps 3 and 4 untili=N, and then output Ku=ku,i,1≤i≤N=ku,j′,1≤j≤NqAfter converting the quantized key into binary gray code, the length of the output secret keys isNq bits. To evaluate the BMR of the secret keys KA, KB, and KE, we take 1-bit quantization as an example to deduce the following theorem.Theorem 1.
If we perform 1-bit equal-probability quantization algorithm on the complex Gaussian random vectorsHA and HB, the BMR between the outputs KA and KB denoted by PABγa,γb,q is as follows:(4)PABγa,γb,1=12−12π∫0∞erfγas22erfγbs22exp−s22ds,where γa=σa2σh2/σn2 and γb=σb2σh2/σn2 are the normalized SNR of pilot signals of Alice and Bob, respectively. For the random sources of Alice and Eve, that is, HA and HE, PAEγa,γb,q,ρ is as follows:(5)PAEγa,γb,1,ρ=12−12π∫0∞erfγbs22×erfγaρ2s22γa−ρ2γa+1exp−s22ds.
The following relationship is satisfied:(6)PAEγa,γb,1,ρ≥PABγa,γb,q=PAEγa,γb,1,1.Proof:.
see AppendixA.
From (4), one can see that PABγa,γb,1 decreases with the increase of γa and γb, and this conclusion is still valid on multibit quantization [31]. This shows that we can obtain more consistent keys by increasing the power of the pilot signal, thereby improving the robustness of our scheme. From (5) and (1), it is clear that PAEγa,γb,1,ρ increases when Eve and Bob get farther. If we let d⟶∞, then ρ≈0 and PAEγa,γb,1,ρ≈0.5. This conclusion is consistent with most of the SKG experiments; that is, the channels of Alice-Bob and Alice-Eve can be considered approximately independent when d>0.5λ in a scattering-rich channel environment. Therefore, in most cases, spatial decorrelation of the wireless channel protects the legal party’s secret key from being predicted by Eve. In practice, PABγa,γb,q and PAEγa,γb,q,ρ can be solved by statistical counting. In Section 6, we get the statistical value of multibit quantization BER from the simulation result.
Assuming that the average acquisition time of each channel estimated sample ists and the processing delay is ignored, the secret key generation rate of the proposed scheme is(7)Rs=2qts.
Note that the choice ofq is crucial to BMR and secret key generation rate. In Section 5, we will introduce a method for dynamically selecting q according to SNR.


## 4.2. Construction of the Equivalent Interference Channel

Unlike encrypting information with the same keys, scrambling and descrambling are performed to construct interference channel based on different keys. The interference can be injected in multiple steps of the signal processing, including spread spectrum, precoding, or changing constellation diagram in modulation like [32]. To facilitate hardware implementation, we XOR the key bits with the signal we want to scramble. As shown in Figure 3, the message M after encoding is denoted by X, and the codeword after scrambling is expressed as Xs. Then, Alice sends Xs via the Alice-Bob data channel. After that, Bob receives Ys and descrambles it by KB. Finally, Bob performs decoding to recover M. The reception capabilities of Bob and Eve in EIC will be discussed in Section 5.Note that the proposed scheme is similar to ST schemes based on artificial noise [33]. For the latter, the interference in the received signal arises because the artificial noise injected into the null space is not eliminated completely. For this scheme, the reason for the increase of BER is that estimation error of CSI cannot be eliminated completely. The commonality is to deteriorate the eavesdropping channel. Then, the legal party can use the advantage of signal-to-noise ratio and well-designed channel coding to transmit large amounts of information without leaking to eavesdroppers. Therefore, the careful design of channel coding is also necessary. It must fulfill the requirement that the error bits in Bob’s received signal can be corrected while preventing Eve from effectively correcting them during the channel decoding. As shown in Figure 3, Alice first adds CRC check bits to the message M and then encodes it as X=encodeM. To prevent Eve from recovering M, Alice should encode M with the highest possible code rate on the premise of meeting the system BER requirements. We analyzed the BER of Bob and Eve after decoding in Section 6. After decoding and getting M′, if Bob’s CRC does not match M′, the retransmission of M shall be carried out in accordance with ARQ protocol. Thus, the proposed scheme does not need to send verification information as [22].


## 5. Performance Evaluation

In this section, we evaluate the performance of the scheme based on the equivalent interference channel model by deriving BER, channel capacity, security capacity, and error reconciliation efficiency of the scheme. Such metrics are commonly used in the performance analysis of physical layer security technologies.


### 5.1. Channel Capacity

First, we take the Alice-Bob channel as an example to calculate the channel capacityCxy, which characterizes the limit of transmission rate. Note that it incorporates the effect of modulation and signal processing methods. The equivalent interference channel of Alice-Bob denoted by X,pyx,Y with input X, output Y, and the transition probability matrix is as follows:(8)where Pxyγd,γa,γb,q is the bit error rate of Y with respect to X and γd is the SNR of the received data signal. As shown in the dashed box in Figure 3, it contains the transmission channel of the data signal. Similarly, assume that the BER of transmission channel Xs,pysxs,Ys is denoted by Pdγd. To deduce Pxyγd,γa,γb,q and Cxy, the following theorem is stated.Theorem 2.
For an equivalent interference channelX,pyx,Y, it is equivalent to a cascade channel composed of Xs,pysxs,Ys and a virtual binary symmetric channel with bit error rate PABγa,γb,q. Pxyγd,γa,γb,q is given as(9)Pxyγd,γa,γb,q=Pdγd+PABγa,γb,q−2PABγa,γb,qPdγd.
When the inputX satisfies Prx=0=Prx=1=0.5, the channel capacity is as follows:(10)Cxy=1−HPxyγd,γa,γb,qbit/channel use,where H⋅ is the entropy function.Proof:.
see AppendixB.
Cxy defines the upper limit of the amount of information transmitted on the Alice-Bob channel each time. From (9) and (10), we can find an obvious relationship that the effects of Pdγd and PABγa,γb,q are the same for Cxy, which inspires us to equate the processes of scrambling and descrambling with different keys to an equivalent interference channel. Obviously, the solution of capacity of Alice-Eve channel Cxz is the same as Cxy:(11)Cxz=1−HPxzγd,γa,γb,q,ρbit/channel use,where Pxzγd,γa,γb,q,ρ is the bit error rate of Z with respect to X.


### 5.2. Security Capacity

Security capacity represents the theoretical upper limit of secure transmission rate [9]. It indicates the advantage of the legal parties in channel capacity compared with Eve. For DMBC channel model, it is expressed as follows [34]:(12)Cs=Cxy−Cxz+,where ⋅+ denotes max0,⋅. We derive security capacity in the following two different eavesdropping scenarios.


#### 5.2.1. Uncorrelated Eavesdropping Scenario

In an uncorrelated eavesdropping scenario, Eve is far away from Alice and Bob. Based on previous analysis, this makesρ approach zero and makes PAEγa,γb,q,ρ approach 0.5. Therefore, Eve randomly generates KE to reduce interference in the Alice-Eve channel without any prior knowledge about common random source. Let Pu=Pu,0,Pu,1,…,Pu,q denote the probability distribution of the random variables ku∈0,1,…,q, which are shown in Table 2. Then we give Corollary 1 to illustrate the probability of Eve successfully predicting Alice key.Corollary 1.
For two independent and identically distributed sequences ofN random variables samples KA=kA,i,1≤i≤N and KE=kE,i,1≤i≤N generated by the quantization algorithm shown in Table 2, the probability distribution of each quantized output ku is Pu=Pu,0,Pu,1,…,Pu,q. Then, the following inequality holds:(13)PrKA=KE≥2−HkuN.
And if and only ifPu,0=Pu,1=⋯=Pu,q, the equal sign holds.Proof:.
see AppendixC.
From (13), it can be inferred that when Pu,0=Pu,1=⋯=Pu,q and Hku=q, we can minimize the possibility of Eve successfully predicting KA. It is our motivation for choosing equal q-bit equal-probability quantization algorithm. After converting ku into gray code ku′ of length Nq, (13) can be rewritten as(14)PrKA=KE=2−qN=PrkA′=kE′Nq,and the bit error rate is given by PrkA′=kE′=0.5. Therefore, the capacity of Alice-Eve equivalent interference channel is given by Cxz=0 according to (11), and the security capacity is given by Cs=Cxy+.


#### 5.2.2. Correlated Eavesdropping Scenario

In a more dangerous scenario with an correlated eavesdropper, Eve increases the correlation betweenhAB and hAE by approaching Bob. In this way, Eve may obtain random source samples similar to the legal parties and generate KE as consistent as possible with KA. According to Theorem 2 and (12), Cs can be rewritten as(15)Cs=Cxy−Cxz+=HPxzγd,γa,γb,q,ρ−HPxyγd,γa,γb,q+≥0.Due to the fact that the entropy functionH⋅ is a rigid monotony increasing convex function at 0,0.5, we can infer that Cs>0 when PAEγa,γb,q,ρ>PABγa,γb,q. Benefiting from the spatial decorrelation, the inequality PAEγa,γb,q,ρ>PABγa,γb,q holds in most environments with multipath scattering even if Eve is extremely close to Bob [7]. Therefore, our scheme can obtain a positive upper bound of secure transmission rate with correlated eavesdropping channel.


### 5.3. Optimization of the Proposed Scheme

Note that the unit in (10) and (11) is bit per channel use, and the utilization frequency (i.e., the scrambling rate) of the equivalent scrambling channel is determined by the scrambling method. The same as one-time-pad encryption, we have HX=HKU. Assuming that the newly generated key is immediately used to scramble X, the utilization frequency denoted by Rf is equal to the bit rate of X, which can be given as(16)Rf=HXNts=HKuNts=a2NHkuNts=Rs,where (a) holds due to the equal probability quantization and Hku=q. Then, according to (7), (10) and (11) can be rewritten in bits per second as(17)CAB=RfCxy=2qts1−HPxyγd,γa,γb,qbit/s,(18)CAE=RfCxz=2qts1−HPxzγd,γa,γb,q,ρbit/s.Obviously, in order to maximize security capacity,q should be adjusted dynamically according to current γa, γb, and γd of Alice, Bob, and Eve. However, knowing Eve’s SNR, BER or decoding method may not be easy. Thus, in this paper, we only discuss the optimization of CAB. For given γd, γa, γb, and ts, this problem can be described as(19)q∗=argmaxq∈N+CAB=argmaxq∈N+2qts1−HPxyγd,γa,γb,q.Equation (19) provides a reference for the design of signal power and quantization precision of the scheme. From the simulation results in the next section, we find that the optimal value usually satisfies q∗≤5 in an actual environment (e.g., γd≤10dB and γa=γb≤30dB). Therefore, (19) is solved by one-dimensional search.Figure 4
BER of Bob's received signal.


### 5.4. Error Reconciliation Efficiency

Channel coding is a common technique for correcting error bits in different schemes, although it reduces efficiency. However, the comparison of the efficiency in different schemes was rarely discussed in previous works, which inspires us to measure it with a new and unified metric. The error reconciliation efficiency denoted byζ∈0,1 is expressed as follows:(20)ζ=LML,where LM is the length of initial information M transmitted by Alice; L is the total number of bits sent by both legal parties for the purpose of transmitting M safely and correctly. For ease of analysis, it is assumed that the channel for transmitting confidential data or reconciliation signals is noiseless, while the pilot channel is noisy. The schemes in Figures 2 and 3 use the same linear block code ns,ks, and η=ks/ns denotes the code rate.For our proposed scheme, the error bits in received signal will be corrected in the process of channel decoding. Therefore,L is the length of codeword after encoding, and the error reconciliation efficiency is equal to the code rate; i.e., ζEIC=η.For existing schemes in Figure2, information reconciliation is a necessary step to obtain the same keys. The mainstream is to use channel coding in two different ways. One is described in [35–37]. Assume that Alice calculates parity check bits based on the generator matrix of systematic linear block code and its keys of length ks. Then, Alice sends them to Bob through the public channel. Since the generator matrix is well known, it divulges ns−ks bits secret keys [17], so the length of available secret keys Lkey1 after information reconciliation is(21)Lkey1=ks−ns−ks,forη∈0.5,1,Lkey1=0,forη∈0,0.5.Under the condition of one-time-pad encryption, we haveLM=Lkey1, and the error reconciliation efficiency is(22)ζk1=Lkey1ns−ks+Lkey1=min2−1η,0.The other method is described in [38–40]. Supposing that Alice creates the check information by XOR a series of encoded random number with its keys of length ns and sends them to Bob, the length of available secret keys is Lkey2=ks. Therefore, we have(23)ζk2=ksns+ks.According to (20)–(23), it can then be inferred that the error reconciliation efficiency of the above three methods satisfies(24)ζEIC>ζk1>ζk2,forη∈5−12,1,ζEIC>ζk2>ζk1,forη∈0,5−12.


## 5.1. Channel Capacity

First, we take the Alice-Bob channel as an example to calculate the channel capacityCxy, which characterizes the limit of transmission rate. Note that it incorporates the effect of modulation and signal processing methods. The equivalent interference channel of Alice-Bob denoted by X,pyx,Y with input X, output Y, and the transition probability matrix is as follows:(8)where Pxyγd,γa,γb,q is the bit error rate of Y with respect to X and γd is the SNR of the received data signal. As shown in the dashed box in Figure 3, it contains the transmission channel of the data signal. Similarly, assume that the BER of transmission channel Xs,pysxs,Ys is denoted by Pdγd. To deduce Pxyγd,γa,γb,q and Cxy, the following theorem is stated.Theorem 2.
For an equivalent interference channelX,pyx,Y, it is equivalent to a cascade channel composed of Xs,pysxs,Ys and a virtual binary symmetric channel with bit error rate PABγa,γb,q. Pxyγd,γa,γb,q is given as(9)Pxyγd,γa,γb,q=Pdγd+PABγa,γb,q−2PABγa,γb,qPdγd.
When the inputX satisfies Prx=0=Prx=1=0.5, the channel capacity is as follows:(10)Cxy=1−HPxyγd,γa,γb,qbit/channel use,where H⋅ is the entropy function.Proof:.
see AppendixB.
Cxy defines the upper limit of the amount of information transmitted on the Alice-Bob channel each time. From (9) and (10), we can find an obvious relationship that the effects of Pdγd and PABγa,γb,q are the same for Cxy, which inspires us to equate the processes of scrambling and descrambling with different keys to an equivalent interference channel. Obviously, the solution of capacity of Alice-Eve channel Cxz is the same as Cxy:(11)Cxz=1−HPxzγd,γa,γb,q,ρbit/channel use,where Pxzγd,γa,γb,q,ρ is the bit error rate of Z with respect to X.


## 5.2. Security Capacity

Security capacity represents the theoretical upper limit of secure transmission rate [9]. It indicates the advantage of the legal parties in channel capacity compared with Eve. For DMBC channel model, it is expressed as follows [34]:(12)Cs=Cxy−Cxz+,where ⋅+ denotes max0,⋅. We derive security capacity in the following two different eavesdropping scenarios.


### 5.2.1. Uncorrelated Eavesdropping Scenario

In an uncorrelated eavesdropping scenario, Eve is far away from Alice and Bob. Based on previous analysis, this makesρ approach zero and makes PAEγa,γb,q,ρ approach 0.5. Therefore, Eve randomly generates KE to reduce interference in the Alice-Eve channel without any prior knowledge about common random source. Let Pu=Pu,0,Pu,1,…,Pu,q denote the probability distribution of the random variables ku∈0,1,…,q, which are shown in Table 2. Then we give Corollary 1 to illustrate the probability of Eve successfully predicting Alice key.Corollary 1.
For two independent and identically distributed sequences ofN random variables samples KA=kA,i,1≤i≤N and KE=kE,i,1≤i≤N generated by the quantization algorithm shown in Table 2, the probability distribution of each quantized output ku is Pu=Pu,0,Pu,1,…,Pu,q. Then, the following inequality holds:(13)PrKA=KE≥2−HkuN.
And if and only ifPu,0=Pu,1=⋯=Pu,q, the equal sign holds.Proof:.
see AppendixC.
From (13), it can be inferred that when Pu,0=Pu,1=⋯=Pu,q and Hku=q, we can minimize the possibility of Eve successfully predicting KA. It is our motivation for choosing equal q-bit equal-probability quantization algorithm. After converting ku into gray code ku′ of length Nq, (13) can be rewritten as(14)PrKA=KE=2−qN=PrkA′=kE′Nq,and the bit error rate is given by PrkA′=kE′=0.5. Therefore, the capacity of Alice-Eve equivalent interference channel is given by Cxz=0 according to (11), and the security capacity is given by Cs=Cxy+.


### 5.2.2. Correlated Eavesdropping Scenario

In a more dangerous scenario with an correlated eavesdropper, Eve increases the correlation betweenhAB and hAE by approaching Bob. In this way, Eve may obtain random source samples similar to the legal parties and generate KE as consistent as possible with KA. According to Theorem 2 and (12), Cs can be rewritten as(15)Cs=Cxy−Cxz+=HPxzγd,γa,γb,q,ρ−HPxyγd,γa,γb,q+≥0.Due to the fact that the entropy functionH⋅ is a rigid monotony increasing convex function at 0,0.5, we can infer that Cs>0 when PAEγa,γb,q,ρ>PABγa,γb,q. Benefiting from the spatial decorrelation, the inequality PAEγa,γb,q,ρ>PABγa,γb,q holds in most environments with multipath scattering even if Eve is extremely close to Bob [7]. Therefore, our scheme can obtain a positive upper bound of secure transmission rate with correlated eavesdropping channel.


## 5.2.1. Uncorrelated Eavesdropping Scenario

In an uncorrelated eavesdropping scenario, Eve is far away from Alice and Bob. Based on previous analysis, this makesρ approach zero and makes PAEγa,γb,q,ρ approach 0.5. Therefore, Eve randomly generates KE to reduce interference in the Alice-Eve channel without any prior knowledge about common random source. Let Pu=Pu,0,Pu,1,…,Pu,q denote the probability distribution of the random variables ku∈0,1,…,q, which are shown in Table 2. Then we give Corollary 1 to illustrate the probability of Eve successfully predicting Alice key.Corollary 1.
For two independent and identically distributed sequences ofN random variables samples KA=kA,i,1≤i≤N and KE=kE,i,1≤i≤N generated by the quantization algorithm shown in Table 2, the probability distribution of each quantized output ku is Pu=Pu,0,Pu,1,…,Pu,q. Then, the following inequality holds:(13)PrKA=KE≥2−HkuN.
And if and only ifPu,0=Pu,1=⋯=Pu,q, the equal sign holds.Proof:.
see AppendixC.
From (13), it can be inferred that when Pu,0=Pu,1=⋯=Pu,q and Hku=q, we can minimize the possibility of Eve successfully predicting KA. It is our motivation for choosing equal q-bit equal-probability quantization algorithm. After converting ku into gray code ku′ of length Nq, (13) can be rewritten as(14)PrKA=KE=2−qN=PrkA′=kE′Nq,and the bit error rate is given by PrkA′=kE′=0.5. Therefore, the capacity of Alice-Eve equivalent interference channel is given by Cxz=0 according to (11), and the security capacity is given by Cs=Cxy+.


## 5.2.2. Correlated Eavesdropping Scenario

In a more dangerous scenario with an correlated eavesdropper, Eve increases the correlation betweenhAB and hAE by approaching Bob. In this way, Eve may obtain random source samples similar to the legal parties and generate KE as consistent as possible with KA. According to Theorem 2 and (12), Cs can be rewritten as(15)Cs=Cxy−Cxz+=HPxzγd,γa,γb,q,ρ−HPxyγd,γa,γb,q+≥0.Due to the fact that the entropy functionH⋅ is a rigid monotony increasing convex function at 0,0.5, we can infer that Cs>0 when PAEγa,γb,q,ρ>PABγa,γb,q. Benefiting from the spatial decorrelation, the inequality PAEγa,γb,q,ρ>PABγa,γb,q holds in most environments with multipath scattering even if Eve is extremely close to Bob [7]. Therefore, our scheme can obtain a positive upper bound of secure transmission rate with correlated eavesdropping channel.


## 5.3. Optimization of the Proposed Scheme

Note that the unit in (10) and (11) is bit per channel use, and the utilization frequency (i.e., the scrambling rate) of the equivalent scrambling channel is determined by the scrambling method. The same as one-time-pad encryption, we have HX=HKU. Assuming that the newly generated key is immediately used to scramble X, the utilization frequency denoted by Rf is equal to the bit rate of X, which can be given as(16)Rf=HXNts=HKuNts=a2NHkuNts=Rs,where (a) holds due to the equal probability quantization and Hku=q. Then, according to (7), (10) and (11) can be rewritten in bits per second as(17)CAB=RfCxy=2qts1−HPxyγd,γa,γb,qbit/s,(18)CAE=RfCxz=2qts1−HPxzγd,γa,γb,q,ρbit/s.Obviously, in order to maximize security capacity,q should be adjusted dynamically according to current γa, γb, and γd of Alice, Bob, and Eve. However, knowing Eve’s SNR, BER or decoding method may not be easy. Thus, in this paper, we only discuss the optimization of CAB. For given γd, γa, γb, and ts, this problem can be described as(19)q∗=argmaxq∈N+CAB=argmaxq∈N+2qts1−HPxyγd,γa,γb,q.Equation (19) provides a reference for the design of signal power and quantization precision of the scheme. From the simulation results in the next section, we find that the optimal value usually satisfies q∗≤5 in an actual environment (e.g., γd≤10dB and γa=γb≤30dB). Therefore, (19) is solved by one-dimensional search.Figure 4
BER of Bob's received signal.


## 5.4. Error Reconciliation Efficiency

Channel coding is a common technique for correcting error bits in different schemes, although it reduces efficiency. However, the comparison of the efficiency in different schemes was rarely discussed in previous works, which inspires us to measure it with a new and unified metric. The error reconciliation efficiency denoted byζ∈0,1 is expressed as follows:(20)ζ=LML,where LM is the length of initial information M transmitted by Alice; L is the total number of bits sent by both legal parties for the purpose of transmitting M safely and correctly. For ease of analysis, it is assumed that the channel for transmitting confidential data or reconciliation signals is noiseless, while the pilot channel is noisy. The schemes in Figures 2 and 3 use the same linear block code ns,ks, and η=ks/ns denotes the code rate.For our proposed scheme, the error bits in received signal will be corrected in the process of channel decoding. Therefore,L is the length of codeword after encoding, and the error reconciliation efficiency is equal to the code rate; i.e., ζEIC=η.For existing schemes in Figure2, information reconciliation is a necessary step to obtain the same keys. The mainstream is to use channel coding in two different ways. One is described in [35–37]. Assume that Alice calculates parity check bits based on the generator matrix of systematic linear block code and its keys of length ks. Then, Alice sends them to Bob through the public channel. Since the generator matrix is well known, it divulges ns−ks bits secret keys [17], so the length of available secret keys Lkey1 after information reconciliation is(21)Lkey1=ks−ns−ks,forη∈0.5,1,Lkey1=0,forη∈0,0.5.Under the condition of one-time-pad encryption, we haveLM=Lkey1, and the error reconciliation efficiency is(22)ζk1=Lkey1ns−ks+Lkey1=min2−1η,0.The other method is described in [38–40]. Supposing that Alice creates the check information by XOR a series of encoded random number with its keys of length ns and sends them to Bob, the length of available secret keys is Lkey2=ks. Therefore, we have(23)ζk2=ksns+ks.According to (20)–(23), it can then be inferred that the error reconciliation efficiency of the above three methods satisfies(24)ζEIC>ζk1>ζk2,forη∈5−12,1,ζEIC>ζk2>ζk1,forη∈0,5−12.


## 6. Numerical and Simulation Results

This section shows our Monte Carlo simulation results and theoretical results. The experiment was repeated 5,000 times in each simulation; and, for each experiment, 10,000 channel gain and noise samples are randomly generated. To simplify the analysis, we omit other processes except modulation and take BPSK for an instance to calculatePdγd, which is only affected by the SNR of the received data signal γd. For the Rayleigh data channel with h∼CN0,1, Pdγd can be calculated by the following formula:(25)Pdγd=121−γd1+γd.


### 6.1. Security and Reliability Verification

In this subsection, we prove the security and reliability of the scheme by calculating and simulating BER, channel capacity, and security capacity. Figure4 shows that the BER of Bob’s received signal is affected by quantization precision q, the SNR of the received pilot signal γa and γb, and the SNR of the received data signal γd. One can see that BER decreases with the increase of γa, γb, and γd. This phenomenon proves the inference based on Theorem 2 that the equivalent interference and the noise in data transmission channel have similar effects on reception capability. It also confirms that γa and γb described have the same effect on PABγa,γb,q, which implies that increasing either of them will reduce the BER of the received signal. Therefore, for ease of observation, in the following simulations, we let γp=γa=γb and γd=10dB.Figure 5
BER of Eve's received signal withyd = 10 dB.In Figure5, we analyze the BER of Eve. The trend of curves with respect to SNR is similar to that of the former. Note that, with the increase of d, the deterioration of Eve’s BER performance is highly significant. Especially when d=0.4λ, Eve’s received signal is almost all wrong. As a common channel environment in 2.4 GHz band, we can infer that d=0.4λ=0.4×3×108/2.4×109=5cm, and it is impractical for Eve to hide itself at such a close distance in our scheme. In Figures 4 and 5, the black-dashed lines represent the numerical results calculated by (4) and (5). As can be observed from the figures, the simulation and numerical results match very well.Figure 6
Channel capacity of Alice-Bob withyd = 10 dB and ts = 0.1 s.Figures6 and 7 show the channel capacity of equivalent interference channel of Alice-Bob and Alice-Eve, where CAB and CAE are calculated according to (17) and (18). According to Figure 6, one can see that the increase in γp significantly improves CAB, and, for different γp, q is different when CAB is the maximum. Therefore, to maximize CAB, q should be dynamically adjusted according to current γp and γd. Figure 7 is similar to Figure 5, where CAE is mainly affected by d. It can be inferred that the channel correlation of Alice-Bob and Alice-Eve is reduced due to larger d, which leads to a higher BER and a lower channel capacity of Eve. When d=0.4λ, the keys are almost completely different and more interference is added to the equivalent interference channel of Eve, which results in Eve not receiving any useful information from Alice. In addition, we can also find that even if Bob is in an extremely harsh environment, such as d=0.1λ, CAB is still larger than CAE.Figure 7
Channel capacity of Alice-Eve withγd=10dB and ts=0.1s.


### 6.2. Performance Comparison

In this subsection, we compare the performance difference between the proposed scheme and the existing schemes through simulation. First, we compare the security capacity of the proposed method with the fixed quantization precision method in [22–26] in Figure 8. We assume that Eve fully knows the SNR of Alice and Bob and uses the same strategy to adjust or fix q. As shown in Figure 8, the dynamic q selection method according to (19) can obtain the largest Cs in the entire γp interval, while the existing methods can only obtain the maximum Cs within a certain SNR interval. This result means that even if our strategy is copied by Eve, it can still reach a higher upper for secure transmission rate because it is more adaptable to a real-time changing channel environment. In addition, although the decrease of Eve-Bob distance will slightly reduce Cs, it does not have a significant impact on our optimization method of CAB.Figure 8
Security capacity withγd=10dB and ts=0.1s.Then, we take polar code as an example to simulate the BER performance loss of the scheme in Figure9. The relevant codes refer to the application in MATLAB 5G Toolbox. In this simulation, Lm=100 and η=0.33. For comparison, we also simulate the decoded BER of Bob without applying the scrambling method. If we take decoded BER≤10−6 as the reference standard, one can see that, in the case of γp=30dB, the decoding BER performance deteriorates by less than one dB. In the case of γp=20dB, the decoding BER performance deteriorates by less than 3 dB. Overall, this kind of BER performance loss is acceptable for Bob. For Eve, the BER cannot be reduced by decoding because the initial receiving BER is too large to correct error bits.Figure 9
BER after decoding of Bob and Eve.For comparison, we analyze the error reconciliation efficiency. Figures10(a) and 10(b) show the trend of ζ versus various γp and η. As can be observed, the scheme based on EIC has higher error reconciliation efficiency because it does not send any additional reconciliation signals. Note that when η is less than 0.5, we have ζk1=0. This is because, for a linear block code such as BCH, when η≤0.5, there is a one-to-one mapping relationship between the check bits and the key bits. Sending the check bits under this condition will leak all key bits to Eve [18]. Moreover, the fixed mapping relationship between the check bits and the information bits always exists even if other channel coding methods are used. When η is close to 1, ζk1 is close to EIC-based scheme, but ζk2 approaches 0.5. This is because the condition of η=1 implies that no information reconciliation is needed to correct the key bits. At this time, sending a useless reconciliation signal of the same length as the confidential information will reduce the efficiency by half. Therefore, these results indicate that the scheme based on EIC is more cost-saving and has higher error reconciliation efficiency.Figure 10
Comparison of error reconciliation efficiency. (a)ζ for various γp when polar code is used and the decoded is BER≤10−6. (b)ζ for various η when linear block code is used
(a)(b)


## 6.1. Security and Reliability Verification

In this subsection, we prove the security and reliability of the scheme by calculating and simulating BER, channel capacity, and security capacity. Figure4 shows that the BER of Bob’s received signal is affected by quantization precision q, the SNR of the received pilot signal γa and γb, and the SNR of the received data signal γd. One can see that BER decreases with the increase of γa, γb, and γd. This phenomenon proves the inference based on Theorem 2 that the equivalent interference and the noise in data transmission channel have similar effects on reception capability. It also confirms that γa and γb described have the same effect on PABγa,γb,q, which implies that increasing either of them will reduce the BER of the received signal. Therefore, for ease of observation, in the following simulations, we let γp=γa=γb and γd=10dB.Figure 5
BER of Eve's received signal withyd = 10 dB.In Figure5, we analyze the BER of Eve. The trend of curves with respect to SNR is similar to that of the former. Note that, with the increase of d, the deterioration of Eve’s BER performance is highly significant. Especially when d=0.4λ, Eve’s received signal is almost all wrong. As a common channel environment in 2.4 GHz band, we can infer that d=0.4λ=0.4×3×108/2.4×109=5cm, and it is impractical for Eve to hide itself at such a close distance in our scheme. In Figures 4 and 5, the black-dashed lines represent the numerical results calculated by (4) and (5). As can be observed from the figures, the simulation and numerical results match very well.Figure 6
Channel capacity of Alice-Bob withyd = 10 dB and ts = 0.1 s.Figures6 and 7 show the channel capacity of equivalent interference channel of Alice-Bob and Alice-Eve, where CAB and CAE are calculated according to (17) and (18). According to Figure 6, one can see that the increase in γp significantly improves CAB, and, for different γp, q is different when CAB is the maximum. Therefore, to maximize CAB, q should be dynamically adjusted according to current γp and γd. Figure 7 is similar to Figure 5, where CAE is mainly affected by d. It can be inferred that the channel correlation of Alice-Bob and Alice-Eve is reduced due to larger d, which leads to a higher BER and a lower channel capacity of Eve. When d=0.4λ, the keys are almost completely different and more interference is added to the equivalent interference channel of Eve, which results in Eve not receiving any useful information from Alice. In addition, we can also find that even if Bob is in an extremely harsh environment, such as d=0.1λ, CAB is still larger than CAE.Figure 7
Channel capacity of Alice-Eve withγd=10dB and ts=0.1s.


## 6.2. Performance Comparison

In this subsection, we compare the performance difference between the proposed scheme and the existing schemes through simulation. First, we compare the security capacity of the proposed method with the fixed quantization precision method in [22–26] in Figure 8. We assume that Eve fully knows the SNR of Alice and Bob and uses the same strategy to adjust or fix q. As shown in Figure 8, the dynamic q selection method according to (19) can obtain the largest Cs in the entire γp interval, while the existing methods can only obtain the maximum Cs within a certain SNR interval. This result means that even if our strategy is copied by Eve, it can still reach a higher upper for secure transmission rate because it is more adaptable to a real-time changing channel environment. In addition, although the decrease of Eve-Bob distance will slightly reduce Cs, it does not have a significant impact on our optimization method of CAB.Figure 8
Security capacity withγd=10dB and ts=0.1s.Then, we take polar code as an example to simulate the BER performance loss of the scheme in Figure9. The relevant codes refer to the application in MATLAB 5G Toolbox. In this simulation, Lm=100 and η=0.33. For comparison, we also simulate the decoded BER of Bob without applying the scrambling method. If we take decoded BER≤10−6 as the reference standard, one can see that, in the case of γp=30dB, the decoding BER performance deteriorates by less than one dB. In the case of γp=20dB, the decoding BER performance deteriorates by less than 3 dB. Overall, this kind of BER performance loss is acceptable for Bob. For Eve, the BER cannot be reduced by decoding because the initial receiving BER is too large to correct error bits.Figure 9
BER after decoding of Bob and Eve.For comparison, we analyze the error reconciliation efficiency. Figures10(a) and 10(b) show the trend of ζ versus various γp and η. As can be observed, the scheme based on EIC has higher error reconciliation efficiency because it does not send any additional reconciliation signals. Note that when η is less than 0.5, we have ζk1=0. This is because, for a linear block code such as BCH, when η≤0.5, there is a one-to-one mapping relationship between the check bits and the key bits. Sending the check bits under this condition will leak all key bits to Eve [18]. Moreover, the fixed mapping relationship between the check bits and the information bits always exists even if other channel coding methods are used. When η is close to 1, ζk1 is close to EIC-based scheme, but ζk2 approaches 0.5. This is because the condition of η=1 implies that no information reconciliation is needed to correct the key bits. At this time, sending a useless reconciliation signal of the same length as the confidential information will reduce the efficiency by half. Therefore, these results indicate that the scheme based on EIC is more cost-saving and has higher error reconciliation efficiency.Figure 10
Comparison of error reconciliation efficiency. (a)ζ for various γp when polar code is used and the decoded is BER≤10−6. (b)ζ for various η when linear block code is used
(a)(b)


## 7. Conclusion and Future Work

This paper proposes a novel secure communication scheme based on equivalent interference channel assisted by physical layer secret keys to improve efficiency. The proposed scheme scrambles the encoded signal with asymmetric physical layer keys and uses channel coding to correct the error bits caused by the different keys and the traditional noise, so there is no need to send additional signals for information reconciliation. The quantization precision is adjusted according to the expected channel capacity, and the correctness of the confidential information is verified by CRC, so there is no need to send signals for quantization or consistency check. The expressions of BER, channel capacity, and security capacity were deduced and the simulation results prove that even when Eve is very close to the legal parties, our scheme is still available. Finally, results for the performance comparison are shown, which indicate that the proposed scheme has superior performance on the security capacity and the error reconciliation efficiency, although BER slightly increases.For future work, we will investigate the problem of maximizing the security capacity under limited transmission power and quantification precision. On the other hand, optimizing secure transmission rate under a certain channel coding condition can be considered. In addition, the single-antenna secure communication system in this paper can be extended to MIMO system.



---

*Source: 8840645-2020-10-21.xml*