A New Fuzzy Key Generation Method Based on PHY-Layer Fingerprints in Mobile Cognitive Radio Networks

Abstract

Classical key generation is complicated to update and key distribution generally requires fixed infrastructures. In order to eliminate these restrictions researchers have focused much attention on physical-layer (PHY-layer) based key generation methods. In this paper, we present a PHY-layer fingerprints based fuzzy key generation scheme, which works to prevent primary user emulation (PUE) attacks and spectrum sensing data falsification (SSDF) attacks, with multi-node collaborative defense strategies. We also propose two algorithms, the EA algorithm and the TA algorithm, to defend against eavesdropping attacks and tampering attacks in mobile cognitive radio networks (CRNs). We give security analyses of these algorithms in both the spatial and temporal domains, and prove the upper bound of the entropy loss in theory. We present a simulation result based on a MIMO-OFDM communication system which shows that the channel response characteristics received by legitimates tend to be consistent and phase characteristics are much more robust for key generation in mobile CRNs. In addition, NIST statistical tests show that the generated key in our proposed approach is secure and reliable.

1. Introduction

With the successive emergence in recent years of Bluetooth, ZigBee, UWB, RFID, Wibree, Z-Wave, and NFC, demand for more spectral resources has been growing significantly. However, according to recent studies, the utilization of the licensed radio spectrum is extremely low [1,2]. To address this problem, researchers have proposed cognitive radio networks (CRNs) to increase the efficiency of spectrum utilization by enabling unlicensed, secondary users (SUs) equipped with CR functionality to co-exist with licensed, primary users (PUs). SUs have different features in terms of expenditure, communication distance, and networking capacity, but one problem with all the SUs is common: security of these users in CRNs. For example, due to the open nature of wireless communications—there is no physical boundary in CRNs—networks are susceptible to various attacks including eavesdropping, tampering, man-in-the-middle (MITM), and denial of service (DoS). One popular attack is called a primary user emulation (PUE) attack, in which the attacker may transmit with high power or emulation the specific features of a PU’s signal and occupy the whole available spectrum by themselves, or waste the whole available spectrum when PUs are sleeping in CRNs. Another typical type of attack is the Spectrum Sensing Data Falsification (SSDF) attacks, in which the malicious attackers send a modified spectrum sensing result to the central combiner in a multi-node collaborative spectrum sensing strategy. Researchers have intensively studied both PUE attacks and SSDF attacks in the past few years [3-6].

Use of physical-layer security techniques can efficiently reduce the probability of a successful PUE attack to fill these gaps. R. Chen et al. [3] proposed a RSS-based method to detect the location of the attacker by deploying an additional sensor network. In order to enhance the positioning accuracy, L. Huang et al. [7] proposed a joint position verification method using the theories of both time difference of arrival (TDOA) and frequency difference of arrival (FDOA). Y. Liu et al. [8] introduced a helper node to defend against PUE attacks. The helper node acts as a “bridge” to enable SUs to verify cryptographic signatures carried by the helper node’s signals using its private key, then learn the helper node’s authentic link signatures, and finally verify the primary users’ link signatures. However, the helper node’s private key is not assumed to be secure across a long storage time. Furthermore, if the keys of cryptographic signatures are captured by PUE attackers, they will mimic the cryptographic signatures of the helper node to authenticate themselves such that an SU cannot distinguish them from a legitimate PU. Thus, updating the private key of cryptographic signatures is better. Z. Yuan et al. [9] proposed a defense strategy against the PUE attack in CRNs using belief propagation based on RSS. They assume that information can be exchanged without errors or falsified data. However, information exchanged between SUs is susceptible to modification or forgery, both in PUE attacks and SSDF attacks. This results in a lower detection rate.

The PHY-layer key generation algorithms solve these problems very effectively. Unlike traditional key generation algorithms such as Diffie-Hellman, which depend on mathematical problems, wireless physical-layer key generation algorithms use the principles of channel reciprocity and channel randomness to extract an identical secret key of two wireless users. This technique does not need to share the secret key beforehand, and its security is influenced by neither the attacker’s computing power nor algorithm complexity, and is thus an important method for achieving perfect secrecy as defined by Shannon. [10].

The Received Signal Strength Indicator (RSSI) method is an attractive approach for key generation because it is more intuitive to measure than other physical layer information such as channel phase [11,12]. The RSSI value of real-time channels can be measured by SUs; with these values, we can generate a key for encryption. Wilson. R [13] presented numerical results and simulated the key lengths possible for indoor, ultra-wide-band channels. Madiseh. M G et al. [14] used the properties of Hamming (7,3) binary codes to ensure key agreement between the two UWB transceivers. However the UWB signal power is limited, and its envelope is hard to detect. Moreover, the Hamming error correcting code is invalid when the mismatch bit rate is too high. Chen C, Wallace. J. W et al. [15,16] used a MIMO system to generate key. In this literature, the key generation rate can be greatly improved with the increase of the number of antennas. Aono. T et al. [17] proposed an improved scheme for the secret key generation. According to the controllability of the ESPAR antenna, they can artificially speed up the channel fluctuation and improve the rate at which key update. In order to improve the identity of the key, Azimi-Sadjadi. B et al. [18] applied an ad hoc communication node to generate key from the depth of the envelope and proposed a SFIR scheme. However, this scheme stays at the theoretical level and lacks practical application. Yasukawa. S et al. [19] proposed multi-level quantization, which used the extracted key as both a verify sequence and a candidate sequence. This scheme can improve the identity of the key, but it reduces the extract rate of the effective key. Huyen N T T, Jo M et al. [20] used the theory of the signal range and deployment error knowledge to analyze sensor nodes location information and proposed a polynomial-based key pre-distribution scheme. This scheme provides high connectivity and secure communication with better communication overhead.

Compared to the other key generation algorithms and applications in previous work, our proposed approach has the following advantages and usages:

The rest of this paper is organized as follows. Section 2 is the preliminary work. Section 3 proposes two constructions of fuzzy extractor based on channel response characteristics in the Hamming metric. In Section 4, we present two algorithms to defend against eavesdropping attacks and tampering attacks in CRNs. We also present the complete scheme and demonstrate algorithm security in both spatial and temporal domains. Section 5 analyzes the results of the experimental performance. Finally, in Section 6, we summarize this paper.

 

2. Related Work

In this section, we introduce the preliminaries of key generation on PHY-+layer and fuzzy extraction. The security of our scheme is described as follows: Two legitimate secondary users in two different locations (SUl (l ∈ {a,b})) have strongly correlated information due to the principle of channel reciprocity and the high unpredictability of the generated key for attackers. In fact, an eavesdropper (SUe) at a third location more than a few wavelengths from (SUl) will measure a different, uncorrelated radio channel [24,25].

2.1 Background

Radio signals propagation from the transmitter to the receiver is generally affected by terrain or obstacles. This results in reflection, diffraction and other phenomena. Different paths have different signal amplitudes and phases. As a result, receivers usually receive multi-path copies of the transmitted signal. Due to multi-path fading, different paths of waves will be strengthened or weakened at the receiver’s end. In addition, the Doppler effect makes wireless channel characteristics change distinctly. The received signal, which is the sum of signal copies, provides a wealth of information for key extraction. This behavior is captured by the the wireless channel response characteristics, following the equation

where L is the number of paths; βk(t) = αk(t)ej(2πfcτk(t)+Φ(t,τ)); αk(t) is a random process, which is a function of path loss and shadowing; the phase term ej(2πfcτk(t) +Φk(t,τ)) is a random process, which represents the phase shift due to the k-th path component’s Doppler effect plus any additional phase shifts which are encountered in the channel，fc is the carrier frequency. Typically, it is assumed that these two random processes are independent.

Many works on key generation from noisy observations of a common random process have been proposed in the cryptography community. In our case, the random processes are mobile wireless channels, which provide a large number of stochastic information. Fig. 1 illustrates an interesting physical scenario. Set HSUa, HSUb, as channel response characteristics of SUa, SUb, respectively. The illegitimate user SUe wants to guess a portion of channel response characteristic values between SUa and SUb, which denote as HSUe. Thus, the minimum entropy is defined as

Fig. 1.The difference of channel response characteristics

The predictability of a legitimate random variable HSUl is correspondingly, the average case minimum entropy is defined as

Legitimate users SUl communicate via a wireless channel and generate a shared key based on their respective channel response. However, illegitimate SUe cannot capture the channel response that legitimate users receive. In this case, wireless channel response characteristics which called a PHY-layer fingerprints denotes as

where ε is a negligibly small number greater than zero. In other words, we expect that the maximum entropy loss of the extracted key between legitimate users is strictly small.

2.2 Attack Model

We assume two attack models in CRNs, which are an eavesdropping attack and a tampering attack. SUe is a cognitive radio node equipped with attack functionality, which knows the algorithm of the key generation. Details are described as

 

3. Extractor with Channel Response

3.1 Strong Extractor

Let DSUa and DSUb be two key distributions on the same domain K. The statistical distance between these two probability distributions is

Furthermore, we can also implement the statistical distance to evaluate the randomness of the generated key by

where DSUl is the key distribution of SUl, Du is uniform distribution on space K, respectively. The distribution of DSUl is called E-quasi-random on K [26]. The quantized channel response characteristic values of two legitimate users can be written as and randomness as

Definition 1: Let Ext: {0,1}ωn → {0,1}ℓ be a polynomial-time probabilistic function which uses r bits of randomness. We call that Ext is an efficient average case (ωn, ωm, ℓ, E)-strong extractor if for all pairs of random variables (QSUl, QSUe) such that QSUl on {0,1}ωn where we obtain where r is uniform on {0,1}ωk.

Strong extractors are E -quasi-random, if they can extract at most bits [21].

Lemma 1: Assume a family of functions {Hx : {0,1}ωn → {0,1}ℓ}x∈X is universal: we call Hx the generalized leftover hash functions if for all a ≠ b ∈ {0,1}ωn, Prx∈X[Hx(a) = Hx(b)] = 2-ℓ. Then, for any random variables QSUl and QSUe,

Universal hash functions are (ωn, ωm, ℓ, E)-strong extractors whenever

3.2 Secure Sketch

We assume that Ω is a finite set, and will concentrate on the space Ω = Fn under the Hamming metric. A metric space can be defined as an ordered pair (Ω, d), where Ω is a set and d is a distance function on Ω × Ω → R+.

Definition 2: An average case -secure sketch is a pair of randomized procedures, “sketch” (SS) and “recover” (Rec), with the following properties:

The upper bound of entropy loss in the secure sketch can be defined as

Lemma 2: For a known algorithms of SS, Rec of a secure model with a known value t, and the output of SS has size at most 2λ, then for any min-entropy threshold m, the value of entropy loss

Proof: If SS has size at most 2λ values, for any (qSUli, qSUei),

We obtain

3.3 Fuzzy Extractor with Channel Response Characteristics

Well-known techniques from fuzzy commitment scheme [22] and channel response characteristics are combined to achieve a new type of PHY-layer key generation primitive that we refer to as a fuzzy key generation scheme. It is hard for an attacker to learn the encoded value, and also for the decoder to decode a value in more than one way. In order to reduce the error rate, if you want to extract B length bits, rounds of negotiation are required. We assume the randomized procedures SS, Gen for SUa’s end and randomized procedures Rec, Rep for SUb’s end. The i th-round quantization value of the channel response characteristics are qSUli ⊆ QSUl, and neighbors of SUl share a random number r0 in advance. In the eavesdropping attack model, the construction of secure sketch under the Hamming metric satisfied

where f ( · ) is the error correction function of codeword c, qSUai and qSUbi are approximate channel response characteristics, both of them are n-bit strings.

In the tampering attack model, we employ a one-way hash chain r0 → r1 ⋯ → rω, where ri = Hash(ri-1). Considering SUl’s costs, for each hash chain, they will only verify ri = Hash(ri-1) to confirm whether Fi has been tampered with or not. The construction of secure sketch under the Hamming metric satisfied

The Fi representing the generated witness, if ri = Hash(ri-1), then the received message has been successfully decoded. Otherwise, Fi is a tampering witness.

A fuzzy extractor of Gen and Rep can be obtained based on the secure sketch introduced above. We write the expressions as

 

4. Defending Against PUE Attacks and SSDF Attacks in CRNs

In this section, we present the complete fuzzy key generation scheme based on channel response characteristics. Firstly, we describe the fuzzy key generation algorithm combined with the circumstances of CRN channels. Secondly, we design a fuzzy key generation scheme for defending against eavesdropping attacks and tampering attacks. Finally, we summarize the complete scheme and demonstrate security both in spatial and temporal domains.

4.1 Fuzzy Key Generation Algorithm to Defend Against Eavesdropping Attacks

In CRNs, the SUl will, most likely, group together as a defense to detect the location of the PUEs. No matter how much data is exchanged between the neighboring users, the data which is used as a “belief” to detect the PUE attacks is assumed to also be eavesdropped by SUe, which is equipped with eavesdropping functionality. Consequently, the accuracy of the PUE attack’s detection will be somewhat reduced. Therefore, it is necessary to use an independent key generate-update strategy to encrypt this “belief” data against eavesdropping attacks. We now provide the details of our scheme.

We assume that when the scheme is executed, SUl alternately measure the channel response between them. After a period of time, SUa stores a sufficiently large number of channel response characteristic values qSUai, and SUb employs the secure sketch to recover qSUai from qSUbi. Once the bits extracted are adequate to generate the key, an (ωn, ωm, ℓ, E)-strong extractor is applied to generate the final key. The fuzzy key generation algorithm for defending against eavesdropping attacks we abbreveate as EA algorithm and summarize in Algorithm 1.

4.2 Fuzzy Key Generation Algorithm to Defend Against Tampering Attacks

The details of the algorithm for defending against tampering attacks are the same as the EA algorithm in the first few steps. The difference is that in multi-node collaborative detection against PUE attacks or SSDF attacks, malicious SUe have ability to tamper with information exchanging between legitimate users. If SUe listens to the communication between their legitimate neighbors and tampers with the information which is negotiation between them, Then SUe will send the “fake” information, spoofing a legitimate user and disrupting the protocol without revealing his presence, which makes it difficult to precisely detect attacks. In this case, SUa will employ the key generation algorithm proposed here to generate a key through a one-way hash chain from ri to form a data origin authentication and use the key to encrypt “belief” data for attack detection. Furthermore, without use of the same key as the legitimate sides, the “fake” information send by the malicious SUe will be rejected. Fuzzy key generation algorithm to defend against tampering attacks we abbreviate as TA algorithm and summarize in Algorithm 2.

4.3 Complete Scheme

Our fuzzy key generation scheme consists of two components, namely quantization and fuzzy generation. In our scheme, SUa is the initiator of the channel measurements. The fuzzy key generation scheme for SUa and SUb is shown in Fig. 2.

Fig. 2.The complete scheme flow used in fuzzy key generation

SUa transmits probing sequences to SUb. After receiving the probing sequences, SUb can collect the channel response’s characteristic values on his antennas, then vice versa. Each pair of neighbor nodes SUl use the secure sketch under the Hamming metric to reconcile information. When both sides have collected enough data, SUa and SUb will utilize an (ωn, ωm, ℓ, E) - strong extractor to complete the key generation.

4.4 Security Analysis

The spatial security of the scheme is guaranteed based on the previous assumption that the SUe at a third location whose distance is more than a few wavelengths from either legitimate endpoint will measure a different, uncorrelated radio channel. This spatial security assumption is applied in most PHY-layer security scheme and has been proven correct by practical experience, such as [24,25]. For example, in view of a mobile CRN system with a moving speed v = 72 km/h, average SUl distance d = 150 m, and carrier frequency fc = 900 MHz, if SUe is located more than 16cm away from SUa and SUb, his observations qSUei do not reveal enough correlating information with qSUai or qSUbi.

The temporal security is guaranteed based on the fuzzy commitment scheme. A fuzzy commitment scheme allows one to extract some randomness K from QSUa and then successfully reproduce K from any string QSUb that is close to QSUa. The reproduction utilizes the helper string Fi, which is produced during the initial extraction, yet F does not need confidentiality, because K looks truly random even given F so long as any two values Fj, Fk are independent.

Lemma 3: Assume (SS, Rec) is an -secure sketch, and let Ext be an average case (ωn, ωm, ℓ, E)-strong extractor. An -fuzzy extractor has two following parts (Gen, Rep):

Proof: From the definition 1, we can get Ext is an average case (ωn, ωm, ℓ, E)-strong extractor,

If (SS, Rec) is an -secure sketch and Ext is an (ωn, ωm, ℓ, E)-strong extractor given by universal hashing, then we can get lemma 4. Without loss of generality, we assume that min-entropy threshold is m in each round, the upper bound of the entropy loss is given as Lemma 4: For a known algorithms of SS, Rec of a secure sketch with a known value t, the output of SS has size at most 2λ. For any min-entropy threshold m, there exists an average case -fuzzy extractor for QSUl. The upper bound of the entropy loss is

Proof: If SS has size at most 2λ values, for any Ext(QSUl, r),

We obtain

 

5. Experimental Results and Analysis

The computer simulation is based on a 802.11n MIMO-OFDM communication system in Rayleigh fading environment, and gray code is utilized to reduce the bit error probability. In our simulation, the complex data are modulated onto subcarriers. The cyclic prefix (CP) is inserted at the beginning of each OFDM symbol to prevent inter-symbol interference (ISI) and to preserve the mutual orthogonality of subcarriers. Following a parallel to serial conversion, each OFDM symbol is finally transmitted from transmitter antennas through a multipath channel with uncorrelated taps.

In order to reconstructed the receive signal from receiver antennas, the sampling rate should be greater than or equal to the Nyquist rate Despite Doppler and time variation of the channel, SUa and SUb are observing highly correlated observations of the same phenomena, in other word, SUa and SUb each can generate Ns samples by fully exploiting the coherence time interval. Assuming that transmission delay is delay spread is τ, and coherence time is Tct, respectively if we neglect the processing delay, then the observation time is Furthermore, assuming transmission delay and delay spread τ are very small, then maximum observation time and samples can be approximated to respectively. Choosing a mobile CRN node with a movement velocity v = 72 km/h, we deduce fd = 60 Hz and Setting the observation time To = 150μs, one of two bits [19, 27] quantization method is used to extract B = 128 length bits with [32, 15, 8]2-BCH codes. Thus, the number of required negotiation rounds is Thus, the bit-extraction rate should reach 106 bit/s theoretically. The strong extractor uses an SHA-256 algorithm to generate the final key based on channel response characteristics from the quantized amplitude values and quantized phase values, respectively. Some experimental parameters and details are shown in Table 1.

Table 1.Experimental parameters based on 802.11n MIMO-OFDM communication system in Rayleigh fading environment

Fig. 3 plots the initial location of SUa, SUb and SUe in our simulation. We assume that there is only one SUe with the same transmission power as SUl and SUa moving at a speed of 72km/h. The initial location of SUe is at (-3.2m, 7.3m), and SUa, SUb are respectively at (0.91m, 3.66m), (3.2m, 5.5m).

Fig. 3.Simulation scenario of SUa, SUb and SUe in mobile CRNs.

Response Characteristics Correlation

Simulation results of amplitude values in signal-to-noise (SNR) of 25 dB between SUa and SUb, SUe and SUl are shown in Fig. 4. Correspondingly, simulation results of phase values in SNR of 25 dB between SUa and SUb, SUe and SUl have been shown in Fig. 5. The results show that the values of channel response characteristic observed by SUl are consistent. However, the values observed between SUl and SUe are significantly different.

Fig. 4.Amplitude values of channel response characteristics received by SUa, SUb, SUe in SNR of 25 dB.

Fig. 5.Phase values of channel response characteristics received by SUa, SUb, SUe in SNR of 25 dB.

Setting expectations of the quantized channel response characteristics of SUa and SUb, to have means of μSUa and μSUb and standard deviations σSUa and σSUb, respectively, the correlation coefficient can be expressed as

We calculated the simulation result of the channel response values received by SUa and SUb in SNR from -5 dB to 35 dB. The Doppler shift is fd = 60 Hz. Fig. 6 plots the correlation coefficients of neighbor SUl in different SNR.

Fig. 6.Correlation coefficients of quantized amplitude values vs quantized phase values between SUl in different SNR.

The experiment results show that the principle of channel reciprocity is obvious between a pair of neighbor nodes SUa and SUb in the coherence time. We can observe in Fig. 5 that when the SNR increases, correlation coefficient increases, and the correlation coefficient of amplitude values converge quickly to 1. We can also observe that the correlation of amplitude values is much better than the phase values. Fig. 7 shows that the correlation coefficient between SUl and SUe is low, furthermore, quantized amplitude values are positive correlation while quantized phase values are negative correlation.

Fig. 7.Correlation coefficient of quantized amplitude values vs quantized phase values between SUl and SUe in different SNR.

5.2 Bit Mismatch Rate

For the key generation scheme, the bit mismatch rate Pm can be used to estimate the success probability of bit extraction before information reconciliation. With a pair of SUl, the bit mismatch rate is defined as the proportion of the number of bits that do not match to the total number of bits extracted.

Fig. 8 provides the bit mismatch rate of quantized amplitude values and quantized phase values between SUl. The simulation results suggest that [32, 15, 8]2-BCH codes are enough to recover bits in our fuzzy key generation scheme. It shows a phenomenon that the bit mismatch rate of quantized amplitude values are higher than quantized phase values in low SNR. With the SNR increasing, the phenomenon is slightly obvious, when SNR changes from 5 dB to higher, the bit mismatch rate of quantized phase values are higher than quantized amplitude values. This proves that phase characteristics are better than amplitude characteristics to generate bits in a low SNR environment. It also proves that variation trend of Pm in phases is slower than amplitudes, which means that phase characteristics are much more robust for key generation in mobile environments. Fig. 9 shows that the range of the mismatch rate between SUl and SUe is about 40%-50% at different SNR.

Fig. 8.Bit mismatch rate Pm of quantized amplitude values vs quantized phase values between SUl in different SNR, one of two bits quantization method.

Fig. 9.Bit mismatch rate Pm of quantized amplitude values vs quantized phase values between SUl and SUe in different SNR, one of two bits quantization method.

5.3 Key Randomness

To evaluate that the key is adequately random in our scheme, the standard randomness test suite from NIST [28] is employed to demonstrate the effectiveness. Tests employed are the Block Frequency test, Frequency test, Runs test, FFT test, Approximate entropy test, Cumulative Sums test, and Serial test. Table 2 presents the randomness test results for the key generated from quantized amplitude characteristics, as well as the randomness test results for the key generated from quantized phase characteristics are shown in Table 3.

Table 2.NIST statistical test results of key generated from quantized amplitude characteristics. The P-VALUE for this test is much greater than 0.01

Table 3.NIST statistical test results of key generated from quantized phase characteristics. The P-VALUE for this test is much greater than 0.01

The NIST statistical test results show that all of the P-VALUE for the key generated are much greater than 0.01, which suggest that the key has great randomness. It is clarify that the fuzzy key generation scheme proposed in this paper can be used to generate secure key in mobile CRNs.

 

6. Conclusion

In this paper, we propose a novel fuzzy key generation scheme based on PHY-layer fingerprints in mobile CRNs. Our proposed approach is derived from biological fingerprints extraction methods; we use the unique wireless channel response characteristics as PHY-layer fingerprints to fuzzy-extract a key. Firstly, in the existing literatures, key agreement of PHY-layer based key generation is a pervasive problem. To address this problem, we constructed a new secure sketch in the Hamming metric space. Secondly, we provide the EA algorithm and the TA algorithm to defend against eavesdropping attacks and tampering attacks which are likely to occur in existing multi-node collaborative defense strategies against PUE attacks or SSDF attacks. Security analyses of these algorithms are given in both spatial and temporal domains, we also prove the upper bound of the entropy loss in theory. Finally, the simulation result indicates that our proposed scheme can effectively extract secret key in a coherence period. The bit mismatch rate is strikingly lower than existing work, which is very efficient and only requires a few seconds on general computers. In addition, simulation results prove that phase characteristics are better than amplitude characteristics to extract bits in low SNR, and phase characteristics are much more robust for key generation in mobile environments. NIST tests of the generated key demonstrate the randomness is excellent. Based on the fuzzy key generation scheme, we can update and distribute key to realize one-time pad communication and message authentication in mobile CRNs.