Man-in-the-Middle and Denial of Service Attacks in Wireless Secret Key Generation
Miroslav Mitev Arsenia Chorti E. Veronica Belmega Martin Reed
cs.CR cs.IT math.IT




Man-in-the-Middle and Denial of Service Attacks in Wireless Secret Key Generation
    Miroslav Mitev

School of CSEE 

University of Essex

Colchester, UK 

mm17217@essex.ac.uk
Arsenia Chorti
ETIS, Université Paris Seine, ENSEA  

Université Cergy-Pontoise,  CNRS

 Cergy-Pontoise, France 

arsenia.chorti@ensea.fr
E. Veronica Belmega
ETIS, Université Paris Seine, ENSEA  

Université Cergy-Pontoise, CNRS

 Cergy-Pontoise, France 

belmega@ensea.fr
Martin Reed
School of CSEE 

University of Essex

Colchester, UK 

mjreed@essex.ac.uk

    December 30, 2023
======================================================================================================================================================================================================================================================================================================================================================================================================================================================================


Wireless secret key generation (W-SKG) from shared randomness (e.g., from the wireless channel fading realizations), is a well established scheme that can be used for session key agreement.  W-SKG approaches can be of particular interest in delay constrained wireless networks and notably in the context of ultra reliable low latency communications (URLLC) in beyond fifth generation (B5G) systems. However W-SKG schemes are known to be malleable over the so called “advantage distillation” phase, during which observations of the shared randomness are obtained at the legitimate parties. As an example, an active attacker can act as a man-in-the-middle (MiM) by injecting pilot signals and/or can mount denial of service attacks (DoS) in the form of jamming.  This paper investigates the impact of injection and reactive jamming attacks in W-SKG. First, it is demonstrated that injection attacks can be reduced to – potentially less harmful – jamming attacks by pilot randomization; a novel system design with randomized QPSK pilots is presented. Subsequently, the optimal jamming strategy is identified in a block fading additive white Gaussian noise (BF-AWGN) channel in the presence of a reactive jammer, using a game theoretic formulation. It is shown that the impact of a reactive jammer is far more severe than that of a simple proactive jammer.



Wireless secret key agreement, shared randomness, injection attack, man-in-the-middle, denial of service attack, jamming.




§ INTRODUCTION

In the past two decades a large number of studies and patents appeared on the topic of wireless secret key generation (W-SKG) schemes that exploit channel reciprocity as the source of shared randomness (see <cit.> for a comprehensive review and <cit.> for a  tutorial on physical layer security including W-SKG). Additionally, W-SKG over unauthenticated channels has been proposed in <cit.>. To overcome trivial higher-layer man-in-the-middle (MiM) attacks, as with MiM attacks on unauthenticated Diffie-Hellman schemes, physical layer security technologies have been combined with standard authentication and encryption (AE) schemes <cit.>. Furthermore, a large number of practical demonstrators have  provided “proof of concept” <cit.>, <cit.>. A resurgence of interest in W-SKG has been witnessed recently as these technologies could be considered for application in B5G systems <cit.>, in particular in the context of Internet of things (IoT) <cit.> and – potentially – URLLC applications. W-SKG could be a good fit in these systems as the limited computational resources and strict delay constraints can render challenging the use of standard security protocols such as the transport layer security protocol (TLS) protocol and it's IoT friendly version, the datagram transport layer security (DTLS) protocol.



In recent works it has been shown that building semantically secure AE protocols using the W-SKG procedure is straightforward, as long as the channel probing phase of the scheme is robust against active attacks <cit.>, <cit.>. Therefore, an important next step is to study MiM and denial of service (DoS) attacks during the channel excitation phase of the W-SKG protocol, commonly referred to as “advantage distillation” <cit.>.

In this paper, two such active attacks, during channel probing are discussed. 


Firstly, MiM attacks, referred to as “injection” attacks, are investigated in Section <ref>: an active adversary tries to control part of the generated secret key by spoofing the channel estimation phase of the W-SKG scheme. Existing works have considered jamming attacks and formulate these in game-theoretic form <cit.>, <cit.>. However, they have not considered the close relationship between injection and jammming. Here we propose a simple approach to mount such a MiM attack, assuming that the adversary has one additional antenna with respect to the legitimate users. This is a very mild assumption with respect to the adversary's capabilities and reveals a critical  vulnerability of W-SKG, that needs to be addressed. As a countermeasure, we propose a concrete pilot randomization scheme using quadrature amplitude phase shift keying (QPSK) modulated random pilots. We prove that the source of shared randomness remains Gaussian and that the adversary can no longer mount the MiM attack. An interesting conclusion of our analysis is that the MiM injection attack is reduced to a jamming attack when pilot randomization is employed.

Motivated by this result, in Sections <ref> and IV,  DoS in the form of reactive jamming is studied for BF-AWGN channels – used as an abstraction for orthogonal frequency division multiplexing (OFDM) modulation systems. The attacker's optimal strategies are derived. In the present contribution we  assume that the legitimate users blindly adopt a uniform power allocation policy, the level of which we optimally identify; the more general case of an arbitrary power allocation for the legitimate parties will be investigated in the future. 
Our study demonstrates that a reactive jammer can have a far more serious impact on the W-SKG process compared to a simple proactive jammer. In the future, frequency hopping as well as energy harvesting approaches to mitigate the impact of reactive jammers <cit.> will be explored. 

Finally, conclusions and further work are discussed in Section V.



§ MIM IN W-SKG SYSTEMS: INJECTION ATTACKS


MiM in the form of injection attacks constitutes one of the most critical limitations in W-SKG systems that extract secret keys from received signal strength (RSS) measurements <cit.>. 
Recently, various possible approaches for injection attacks have been published: in <cit.>, the attacker controlled the movement of  objects in an indoor wireless network, thus generating predictable changes in the RSS, (e.g., by obstructing, or not, a line-of-sight). In <cit.>, whenever similar channel envelope measurements in the links to the legitimate nodes were observed, the MiM spoofed the W-SKG process by injecting a strong signal.  
In the following we will prove that – even when full CSI is used to extract the keys – it suffices that the adversary has one additional antenna with respect to the legitimate users to be able to mount an injection MiM attack. 



To capture the main components of MiM attacks in W-SKG systems, we employ the system model depicted in Fig. <ref>, comprising three nodes: a legitimate transmitter, its intended receiver, and a MiM, referred to as Alice, Bob and Mallory, respectively. Alice and Bob are assumed to have a single antenna each for simplicity, while Mallory has two transmit antennas.[It is straightforward to see that the scenario can easily be generalized to a multi-antenna setting in which Mallory has one more antenna than Alice and Bob.]
The fading channel realization in the link Alice-Bob is denoted by the complex circularly symmetric Gaussian random variable H∼𝒞𝒩(0, σ^2). To obtain estimates of H, Alice and Bob exchange pilot signals X with E[|X|^2]≤ P. Furthermore, following <cit.>, we assume Mallory has perfect knowledge of the channel vectors in the multiple input single output (MISO) links Mallory-Alice and Mallory-Bob. The channel coefficients are assumed to be independent and identically distributed (i.i.d.), i.e., 𝐇_𝐀=[H_A1, H_A2]^T, 𝐇_𝐁=[H_B1, H_B2]^T with (H_A1, H_A2, H_B1, H_B2) ∼𝒞𝒩(0, σ_J^2/2 𝐈_4); this assumption is realistic since Mallory can estimate the channel vectors while Alice and Bob exchange pilot signals, as long as the channel's coherence time is respected (a plausible scenario in slow fading, low mobility environments).  

To mount the attack, Mallory transmits a signal X_J, suitably precoded as 𝐏X_J. The precoding matrix 𝐏=[P_1, P_2]^T is chosen such that the same signal is “injected” at both Alice and Bob, i.e.,

    𝐇_𝐀^T𝐏 X_J   =𝐇_𝐁^T𝐏X_J
        ⇒
     P_1   =H_B2-H_A2/H_A1-H_B1P_2,

where, due to the i.i.d. assumption and to the continuous distribution of the channels, H_A1≠ H_B1 almost surely.
As a result, Mallory can select a suitable precoding matrix (among infinite possibilities). Assuming a total power constraint E[|𝐏X_J|^2]≤Γ for Mallory's transmission, P_2 should be chosen as

    P_2≤√(Γ)/|H_B2-H_A2/H_A1-H_B1|.


This procedure, illustrated in Fig. 1, shows that it is possible to generalize the injection attack presented in  <cit.>, in which an attacker injected a strong signal whenever the RSS in the Mallory-Alice and Mallory-Bob links were similar. More importantly, the presented injection attack accounts not only for the RSS but for the full CSI, i.e., it includes the signal phase.

The observations at Alice and Bob, denoted by Z_A and Z_B, are

    Z_A=XH+W+N_A 
    
    Z_B=XH+W+N_B,

where W=𝐇_𝐀^T𝐏 X_J=𝐇_𝐁^T𝐏X_J denotes the observed injected signal at Alice and Bob which is identical at both due the precoding matrix 𝐏; and, N_A, N_B denote zero-mean unit variance i.i.d. complex circularly symmetric Gaussian random noise variables, i.e., N_A, N_B ∼ 𝒞𝒩( 0, 1 ). 
The secret key rate controlled by Mallory is upper bounded by <cit.>

    L ≤ I(Z_A, Z_B; W).

 Identifying the optimal injection signal W, corresponds to finding the capacity achieving input signal of the two-look Gaussian channel in (<ref>)-(<ref>). This signal is known to be Gaussian <cit.>; hence, a good choice for X_J is to be constant, so that, the overall injected signal is an optimal complex zero-mean circularly symmetric Gaussian signal, W∼𝒞𝒩(0, σ_J^2Γ).


A countermeasure to injection attacks can be built by randomizing the pilot sequence exchanged between Alice and Bob  <cit.>, <cit.>. Here, we propose to randomize the pilots by drawing them from a (scaled) QPSK modulation, as follows: 
instead of transmitting the same probing signal X, Alice and Bob transmit independent, random probe signals X and Y, respectively, drawn from i.i.d. zero-mean discrete uniform distributions 𝒰({± r ± jr}),  where  j=√(-1), r=√(P/2), so that, E[X]=E[Y]=0,  E[|X|^2]=E[|Y|^2]=P and E[XY]=0, i.e., the pilots are randomly chosen  QPSK signals. Alice's  observation Z_A is modified accordingly as 

    Z_A   =   YH+W+N_A,

while Bob's observation is given in (<ref>).
To establish shared randomness in spite of the pilot randomization, Alice and Bob post-multiply Z_A and Z_B by their randomized pilots, obtaining local observations Z̃_A and Z̃_B (unobservable by Mallory), expressed as:

    Z̃_A   =   X Z_A=XYH+XW+XN_A,
    Z̃_B   =   YZ_B=XYH+YW+YN_B.


 The source of shared randomness, when the pilots are randomized QPSK symbols, is a circularly symmetric zero mean Gaussian random variable, XYH ∼ C𝒩(0, P^2σ^2).


We treat the two orthogonal axes (real and imaginary) independently. Looking only at the real values of the pilots and of the channel coefficient X,Y, H denoted here by X_R=Re(X), Y_R=Re(Y) and H_R=Re(H), we express the underlying discrete uniform pdf f_X_R(x) and f_Y_R(y) and the continuous pdf f_H_R(h) as 

    f_X_R(x)   =   1/2δ(x-r)+1/2δ(x+r),
    
        f_Y_R(y)   =   1/2δ(y-r)+1/2δ(y+r),
    
        f_H_R(h)   =   1/√(π)σe^-h^2/σ^2.



The pdf of the product X_R H_R is given as

    f_X_R H_R(z)   =   ∫_-∞^∞f_X_R(x)f_H_R(z/x)1/|x|dx
       =   ∫_-∞^∞1/2√(π)σ |x|δ(x-r)e^-(z/x)^2/σ^2dx
       +   ∫_-∞^∞1/2√(π)σ |x|δ(x+r)e^-(z/x)^2/σ^2dx
       =   √(2)e^-2z^2/Pσ^2/√(π P)σ

by substituting r=√(P/2) at the last derivation, i.e., X_RH_R∼𝒩(0, Pσ^2/4). A similar result holds for the products involving also the imaginary parts of X and H: X_I H_I, X_I H_R and X_R H_I, so that XH∼𝒞𝒩(0, Pσ^2). Extending this result, we find that XHY∼𝒞𝒩(0, P^2σ^2). 


Furthermore, due to the fact that X and Y are independent and have zero mean, the variables XW and YW are uncorrelated, circularly symmetric zero-mean Gaussian random variables, and, therefore independent, while the same holds for XN_A, YN_B, i.e., (XW, YW) ∼𝒞𝒩(0, σ_J^2PΓ𝐈_2) and (XN_A, YN_B) ∼𝒞𝒩(0, P𝐈_2). Alice and Bob extract the common key from the modified source of common randomness XYH as opposed to XH. On the other hand, since XW, YW, X N_A, Y N_B are i.i.d. complex circularly symmetric Gaussian random variables, the proposed scheme reduces injection attacks to uncorrelated jamming attacks, i.e., using Lemma 1 we get that 
    L≤ I(Z̃_A, Z̃_B; W   )=0.




§ JAMMING ATTACKS ON W-SKG

Building on the results of the previous section, we next examine in detail the scenario in which Mallory acts as a reactive jammer. Reactive jamming is a stealthy jamming approach in which the jammer first senses the spectrum and jams only when she detects an ongoing transmission. Due to the effectiveness and difficulty to be detected, reactive jammers are considered as  the most harmful <cit.>. Furthermore, as OFDM is used in many actual systems (and will be used at least in the first deployments of 5G), in our analysis we assume a BF-AWGN channel as in <cit.>. 
In this context, we assume that Alice and Bob perform W-SKG over a BF-AWGN channel with N parallel blocks (referred to as subcarriers for clarity). The notation introduced in Section II is extended with the introduction of a carrier index i∈{1,…,N}, i.e., X_i, Y_i denote the randomized pilots on the i-th subcarrier, H_i denotes the channel coefficient in the link Alice-Bob,  W_i the signal injected by Mallory on the i-th subcarrier and N_A,i, N_B,i noise variables.
As a reactive jammer, Mallory senses the spectrum and jams a specific subcarrier only when the power on it exceeds a certain threshold p_th. Two scenarios are considered: i) when p_th is fixed (determined in essence by the carrier sensing capability of Mallory's receiver); ii) when p_th is variable (its choice forms part of her strategy). 

 
We can reformulate the expressions of Alice's and Bob's local observations on the i-th W-SKG subcarrier as follows:

    Z̃_A,i   =   X_iY_iH_i + X_iW_i+X_iN_A,i
    Z̃_B,i   =   X_iY_iH_i + Y_iW_i+Y_iN_B,i

for i=1, …, N with H_i  ∼𝒞𝒩(0, σ^2), W_i∼𝒞𝒩(0, σ_J^2γ_i), N_A,i∼𝒞𝒩(0, 1), N_B,i∼𝒞𝒩(0, 1). In this work, we assume that Alice and Bob use the same power p on all pilots, in agreement with common practice during the advantage distillation phase; the more general scenario of an arbitrary power allocation across the subcarriers will be investigated in the future. 
Based on this assumption we have that E[|X_i|^2]=E[|Y_i|^2]=p with p ∈ [0,P]. 

On the other hand, we let Mallory choose the power allocation vector to maximize the impact of her attack. The power Mallory uses on the i-th subcarrier is denoted by γ_i, so that E[|W_i|^2]=σ_J^2γ_i. Denoting the average available power for jamming by Γ and the power allocation of the jammer by γ=(γ_1, …, γ_N), we assume the following short-term power constraint:

    γ∈ℝ_+^N,    ∑_i=1^N γ_i ≤ NΓ.



Assuming that
H_i is uncorrelated with
H_A,i, H_B,i, i=1,…,N and that the pilot randomization approach proposed in Section II is employed, the W-SKG rate R(p , γ_i)=I (Z̃_A,i; Z̃_B,i) on the i-th subcarrier, can be expressed as a function of p and γ_i, i=1,…,N as <cit.>:  

    R(p , γ_i)= log_2(1+ p σ^2/2(1+γ_iσ_J^2)+(1+γ_iσ_J^2)^2/p σ^2).

Note that the rate in (<ref>) is independent of the instantaneous realizations of the fading coefficients; instead, the variations of the channel gains expressed through the variances σ^2, σ_J^2 determine the rate of the secret keys that can be extracted from the wireless medium.
The overall W-SKG sum-rate can then be simply expressed as follows:

    C_K(p, γ)=∑_i=1^N R(p , γ_i).





§ OPTIMAL POWER ALLOCATION STRATEGIES

Alice and Bob's common objective is to maximize C_K(p, γ) with respect to (w.r.t.) p, while Mallory wants to  minimize C_K(p, γ) w.r.t. γ. Given the opposed objectives, a non-cooperative zero-sum game can be formulated to study the strategic interaction between the legitimate users and the jammer: 𝒢 = ( {L,J}, {𝒜_L , 𝒜_J(p) }, C_K(p, γ) ). The game  𝒢 has three components. Firstly, there are two players: player L representing the legitimate users (Alice and Bob are considered to act as a single player) and player J representing the jammer (Mallory). Secondly, player L has a set of possible actions 𝒜_L=[0,P] while player J's set of actions is


    𝒜_J(p)  = {[                {(0, …, 0 )} ,                if  p ≤  p_th,; {γ∈ℝ_+^N | ∑_i=1^N γ_i ≤ NΓ},                  if  p> p_th. ].

At last, C_K(p, γ), denotes the payoff function of player L. 

Due to the fact that Mallory first observes the transmit power of the legitimate users on the subcarriers and then decides which strategy to choose (a consequence of player J being a reactive jammer), we study a hierarchical game in which player L is the leader and player J is the follower. In this hierarchical game, the solution is the Stackelberg equilibrium (SE) – rather than Nash – defined as a strategy profile (p^SE,γ^SE) where player L chooses his optimal strategy first, by anticipating the strategic reaction of player J (i.e., its best response). This can be rigorously written as:

    p^SE≜ p ∈𝒜_L max∑_i=1^N R(p , γ^*(p)), and γ^SE≜γ^*(p^SE),

where γ^*(p) denotes the jammer's best response (BR) function to any strategy p ∈𝒜_L chosen by player L, defined as follows:

    γ^*(p) ≜γ∈𝒜_J(p) min∑_i=1^N R(p , γ).

We also denote by γ_i^*(p) the i-th component of γ^*(p). 



 §.§ Stackelberg equilibrium
with fixed p_th


In the following, we evaluate the SE of the game 𝒢 assuming that the threshold p_th is predefined and fixed. The case P ≤ p_th is trivial as  γ^SE=(0, …, 0), whereas, the legitimate users will optimally use the maximum available power so that (p^SE=P). Indeed, because of the badly chosen threshold or low sensing capabilities of Mallory, the legitimate transmission will never be detected on any of the subcarriers and hence will not be jammed. In the following, we assume that: P>p_th.

 
The BR of the jammer for any p∈𝒜_L chosen by the leader defined in (<ref>) is the uniform power allocation, such that:

    γ^*(p)  ≜{[ (Γ, …, Γ ) , if  p> p_th,;   (0, …, 0), if  p≤ p_th. ].



Note that R(p, γ_i) is a monotonically decreasing convex function w.r.t γ_i,  i=1,…, N for any p>0. We show that the jamming power should be equally distributed on all of the subcarriers. To prove this, we apply Jensen's inequality using δ_i>0,  ∑_i=1^Nδ_i =1, so that 

R(p, ∑_i=1^Nδ_ix_i)≤∑_i=1^Nδ_iR(p, x_i). 
 
Substituting δ_i=1/N,  x_i=Γ/b_i, we get:

    R(p, ∑_i=1^NΓ/N b_i) ≤∑_i=1^N1/N R (p, Γ/b_i) ⇒
       NR(p,  1/N∑_i=1^NΓ/b_i) ≤∑_i=1^N R (p, Γ/b_i).

Applying the power constraint ∑_i=1^NΓ/b_i ≤ NΓ on the LHS of (<ref>), for any p>p_th we have:

    NR(p, Γ)   <∑_i=1^N R (p, Γ/b_i) ⇒
        C_K(p, (Γ, …, Γ))≤ C_K (p, γ),

which shows that in order to minimize C_K, Mallory has to distribute her power equally on all subcarriers.


In light of this result, the W-SKG sum rate can have two forms:

    C_K(p,γ^*(p))= {[    NR(p,Γ) , if  p> p_th,;     NR(p,0), if  p≤ p_th, ].

which simplifies the players' options.
Next, we address the question of how Alice and Bob should choose their power p optimally by considering the actions available to the players in the game at the key points i.e. at P and p_th.
 
Depending on the available power P for W-SKG, player L will either transmit at P or p_th on all subcarriers. The SE point of the game is unique when P ≠ p_th(σ_J^2Γ  + 1) and is given by

    (p^SE, γ^SE) =  {[       {(p_th,(0, …, 0))}, if  P<p_th(σ_J^2Γ  +  1),;          {(P,(Γ, …, Γ))}, if  P>p_th(σ_J^2Γ  +  1). ].

When P=p_th(σ_J^2Γ  + 1), the game 𝒢 has two SEs: (p^SE, γ^SE) ∈{(p_th,(0, …, 0)) , (P,(Γ, …, Γ)) }.






Given the BR in (<ref>) and the simplification in (<ref>), player L wants to find the optimal p ∈𝒜_L that maximizes: 

    R(p,γ_i^*(p)) =  {[       R(p,0), if  p ≤ p_th,;       R(p,Γ), if  p > p_th. ].

Given that R(p,γ) is monotonically increasing with p for fixed γ, two cases are distinguished: a) p∈ [0,p_th], b) p∈ (p_th, P]. The optimal p in each case is given by

 a) 

 p ∈[0, p_th] max   R(p , γ_i^*(p))= p ∈[0, p_th] max   R(p , 0) =p_th,


 b) 

 p ∈(p_th, P ] max  R(p , γ_i^*(p))= p ∈(p_th, P ] max   R(p , Γ)=P.


From a) and b), we conclude that the overall solution is p^SE=

    p ∈𝒜_L max  R(p,γ_i^*(p)) =  {[                    p_th,  if  R(P,Γ) < R(p_th,0),;                       P, if   R(P,Γ) > R(p_th,0),;                {p_th,P},  if  R(P,Γ) = R(p_th,0). ].


To simplify the three possibilities, we focus on the case when transmitting at full power R(P,Γ) (hence being sensed and jammed) is equal to the case when player L is transmitting at threshold p_th (the jammer is silent) i.e., R(P,Γ) = R(p_th,0). Using this equality, and by substituting appropriately into (<ref>), we obtain a quadratic equation in P:

    P^2(2 σ^2 p_th+1)-P(2p_th^2 σ^2+2σ_J^2Γp_th^2 σ^2)-(1+σ_J^2Γ)^2 p_th^2 = 0,

which has a unique positive root equal to p_th(σ_J^2Γ+1). Given that, the leading coefficient of (<ref>): (2 σ^2 p_th+1)≥0 and that P>0, we can say that the inequalities R(P,Γ) > R(p_th,0) and R(P,Γ) < R(p_th,0) are equivalent to P>p_th(σ_J^2Γ+1) and P<p_th(σ_J^2Γ+1), respectively.




 
 

Some numerical results are presented in Fig. <ref> for a total number of SKG subcarriers N=10 (pertinent to narrowband IoT applications),  p_th=2,  Γ=4, and σ^2=σ_J^2=1. The top figure compares the achievable rates of the SE strategy and of two alternative strategies consisting in transmitting with fixed p=P or p=p_th. The bottom figure depicts the following quantities:

    F   =C_K(p^SE,γ^SE)-C_K(P,(Γ, , Γ))/C_K^SE,
    
    D   =C_K(p^SE,γ^SE)-C_K(p_th,(0, , 0))/C_K^SE,

where F and D represent the jammer's  gain (or legitimate users' loss) if player L deviates from the SE point (indeed, if player L transmits at P>p_th, the jammer will jam at γ_i^*(P)=Γ; and if player L transmits at p_th the jammer will not detect it and will remain silent). Both figures show that deviating from the SE point can decrease the achievable sum-rates by up to 85%.





 §.§ Stackelberg equilibrium with strategic p_th

Finally, we investigate how Mallory could optimally adjust p_th and how her choice will impact Alice's and Bob's strategies. 
Allowing p_th to vary modifies the game under study as follows 𝒢̂=({L, J}, {𝒜_L , 𝒜̂_J(p)}, C_K(p,γ, p_th)), where:

    𝒜̂_J(p)  ≜{[              {((0,…, 0),p_th),  p_th≥ 0 },                              if  p_th≥  p,; { (γ, p_th) ∈ℝ_+^N+1 |  ∑_i=1^N γ_i ≤ NΓ},                               if  p_th< p. ].

The BR of jammer can then be defined as:

    (γ^*(p), p_th^*(p)) ≜ (γ, p_th) ∈𝒜̂_J(p) min  C_K(p,γ,p_th).


The BR of player J in this case is a set of strategies:

    (γ^*(p), p_th^*(p))∈{  ((Γ, …, Γ), ϵ),  ϵ∈ [0,p)}.



The problem that the jammer wants to solve is:

 (γ, p_th) ∈𝒜̂_J(p) min   C_K (p,γ,p_th),

which can be split as follows:

    p_th≥ 0min  γ∈𝒜̂_J(p) min   C_K (p,γ(p),p_th).

The solution of the inner minimization is already known from (<ref>). For the outer problem we have to find the optimal p_th≥ 0 that minimizes C_K(p,γ^*(p),p_th). Given that:

    p_th≥ 0min  C_K (p,γ^*(p),p_th)={[ NR(p,Γ,p_th)  ,     if  p_th<p,;   NR(p,0,p_th),    if  p_th≥ p, ].

and that R(p,Γ,p_th)<R(p,0,p_th) the jammer can optimally choose any threshold such that p_th=ϵ,   ∀ϵ < p. meaning, any ongoing transmission is sensed and jammed.

  

The game 𝒢̂ has an infinite number of SEs:

    (p^SE, γ^SE, p_th^SE)∈{ (P,(Γ, …, Γ),ϵ),   ∀ϵ < P}.



Given the BR of player J, we will now evaluate the SE of the game 𝒢̂. The definition for p^SE is given as:

    p^SE≜p ∈𝒜_Lmax C_K (p,γ^*(p),p_th(p)^*).

Since the jammer will act as in (<ref>), we have:

    C_K (p,γ^*(p),p_th(p)^*)=NR(p, Γ, ϵ),  ∀ϵ < p,

and the fact that R(p, Γ, ϵ) is monotonically increasing with p results in p^SE=P.


Fig. <ref> and Fig. <ref> illustrate the gain of the jammer (or the loss in W-SKG rate) when p_th is part of her strategy, with utility function C_K(p,γ,p_th), compared to the case when it is not, with utility function C_K(p,γ). We evaluate this gain by:

    E=C_K(p^SE,γ^SE)-C_K(p^SE,γ^SE,p_th^SE)/C_K(p^SE,γ^SE).

 As in Fig. <ref> the total number of subcarriers is N=10 and σ_J^2=1.
 The non-strategic threshold on Fig. <ref> is set to p_th=2 and the quantity E is evaluated for different values of σ^2 and Γ. The numerical results demonstrate that when p_th is part of Mallory's strategy, she can be a significantly more effective opponent, compared to the case when p_th is fixed, confirming that reactive jammers can indeed pose a serious threat. This is also confirmed by the results on Fig. <ref> where the relative gain of the jammer is presented for different p_th. As expected with decreasing the threshold her gain increases.



§ CONCLUSIONS

In this study, injection and reactive jamming attacks were analyzed in W-SKG systems and optimal power allocation policies were investigated in BF-AWGN channels. It was shown that pilot randomization can reduce injection MiM attacks to less harmful jamming attacks. An intelligent reactive jammer should optimally jam with equal power on the whole spectrum. Furthermore, a strategically chosen jamming threshold just below the power level used by the legitimate users, allows the adversary to launch a much more effective attack. In this case, the legitimate users have no choice but to transmit at full power.


§ ACKNOWLEDGEMENTS

M. Mitev is supported by the Doctoral Training Programme of CSEE, University of Essex, A. Chorti and E.V. Belmega are supported by the ELIOT ANR-18-CE40-0030 and FAPESP 2018/12579-7 project and M.J. Reed is supported by the project SerIoT which has received funding from the European Union's Horizon 2020 Research and Innovation programme under grant agreement No 780139.
IEEEtran


