Abstract From Quantum to Wireless A Step Towards Physical-Layer Security

From Quantum to Wireless:A Step Towards Physical-Layer SecurityJo˜a o BarrosInstituto de Telecomunicac¸˜o esDepartamento de Ciˆe ncia de ComputadoresFaculdade de Ciˆe ncias da Universidade do PortoRua do Campo Alegre,1021/1055,4169-007Porto,PortugalURL:http://www.dcc.fc.up.pt/˜barrosAbstractQuantum information theory is widely recognized as an arguably powerful paradigm for physically secure commu-nications.In general,any attack that an eavesdropper,say Eve,perpetrates in order to gain access to messages or keys exchanged by the legitimate parties,say Alice and Bob,will result in disturbances to quantum states that can be detected with overwhelming probability—security is guaranteed by exploiting the fundamental laws of quantum physics.Once a quantum channel is established,Alice and Bob can generate common randomness and use a mix of public communication and privacy amplification to distill a secret key from the correlated random bit strings they possess.Consider now a common wireless communications scenario in which Alice and Bob exchange messages by sending electromagnetic signals over the ether.Since the laws of physics governing such a communication system belong to the realm of classical physics,Eve may listen to the transmitted signals without being detected and it is not immediately clear how Alice and Bob can exploit the physical properties of the wireless channel to ensure secure communication.Answering this question requires us to go back to the foundations of information-theoretic security,which builds on Shannon’s notion of perfect secrecy[1].In seminal papers,Wyner[2]and later Csisz´a r and K¨o rner[3]prove that(quite remarkably)there exist channel codes guaranteeing both robustness to transmission errors and a prescribed degree of data confidentiality.A general setup for the so called wiretap channel is shown in Figure1.In the original version,proposed by Wyner in[2],two legitimate users communicate over a main channel and an eavesdropper has access to degraded versions of the channel outputs that reach the legitimate receiver.In[4]it was shown that if both the main channel and the wiretap channel are additive white Gaussian noise(AWGN)channels,and the latter has less capacity than the former,the secrecy capacity(i.e.the maximum transmission rate at which the eavesdropper is unable to decode any information)is equal to the difference between the two channel capacities.Consequently,confidential communication is not possible unless the Gaussian main channel has a better signal-to-noise ratio(SNR)than the Gaussian wiretap channel.In the seventies and eighties,the impact of these works was limited,partly because practical wiretap codes were not available,but mostly due to the fact that a strictly positive secrecy capacity in the classical wiretap channel setup requires the legitimate sender and receiver to have some advantage(a better SNR)over the attacker.Moreover,almost at the same time,Diffie and Hellman[5]published the basic principles of public-key cryptography,which was to be adopted by nearly all contemporary security schemes.Figure1:In the wiretap channel problem,the goal of the legitimate users,Alice and Bob,is to communicate reliably over the noisy main channel,while ensuring that an eavesdropper,say Eve,is unable to obtain any information from the outputs of the wiretap channel.More recently,information-theoretic security witnessed a renaissance arguably due to the work of Maurer[6], who proved that even when the legitimate users have a worse channel than the eavesdropper,it is possible for them to generate a secret key through public communication over an insecure yet authenticated channel.In[7]Maurer and Wolf showed that a stronger(and technically more convincing)secrecy condition for discrete memoryless channels yields the same secrecy rates as the weaker condition in[2]and[3].In the context of our secure wireless communications problem,we can formulate the problem as one in which two legitimate partners communicate over a quasi-static fading channel and an eavesdropper observes their transmis-sions through another independent quasi-static fading channel.By defining the secrecy capacity in terms of outage probability,it is possible to provide a complete characterization of the maximum transmission rate at which the eaves-dropper is unable to decode any information.In sharp contrast with known results for Gaussian wiretap channels (without feedback),the results for wireless channels show that,in the presence of fading,information-theoretic se-curity is achievable even when the eavesdropper has a better average signal-to-noise ratio(SNR)than the legitimate receiver[8].This fundamental insight motivates the development of a practical security scheme by which two terminals can exploit the randomness of wireless fading channels to exchange data in an information-theoretically secure way.To ensure that a potential eavesdropper is unable to decode any useful information,Alice sends useful symbols to Bob only when the instantaneous secrecy capacity is strictly positive.In the remaining time,a specially designed class of LDPC codes is used for reconciliation,thus allowing the extraction of a secret key,which can be distilled using privacy amplification[9].Thus,we show that a basic set of techniques that are very similar to those employed in quantum key distribution can,with the help of the physical properties of fading wireless channels and a special class of channel codes,be used to enable secret key agreement—without the need for public discussion over a feedback channel. AcknowledgementsThe author gratefully acknowledges useful discussions with Miguel Rodrigues,Matthieu Bloch,Steve McLaughlin, Anderson Nascimento,Prakash Narayan and J.Nicholas Laneman.References[1]C.E.Shannon,“Communication theory of secrecy systems,”Bell System Technical Journal,vol.29,pp.656–715,1949.[2]A.D.Wyner,“The wire-tap channel,”Bell System Technical Journal,vol.54,pp.1355–1387,1975.[3]I.Csisz´a r and J.Korner,“Broadcast channels with confidential messages,”IEEE Transactions on InformationTheory,vol.24,no.3,pp.339–348,1978.[4]S.K.Leung-Yan-Cheong and M.E.Hellman,“The gaussian wiretap channel,”IEEE Transactions on InformationTheory,vol.24,no.4,pp.451–456,July1978.[5]W.Diffie and M.Hellman,“New directions in cryptography,”IEEE Transactions on Information Theory,vol.22,no.6,pp.644–652,Nov.1976.[6]Ueli M.Maurer,“Secret key agreement by public discussion from common information,”IEEE Transactions onInformation Theory,vol.39,no.3,pp.733–742,1993.[7]Ueli Maurer and Stefan Wolf,“Information-theoretic key agreement:From weak to strong secrecy for free,”Eurocrypt2000,Lecture Notes in Computer Science,vol.1807,pp.351+,2000.[8]J.Barros and M.R.D.Rodrigues,“Secrecy capacity of wireless channels,”in Proc.of the IEEE InternationalSymposium on Information Theory(ISIT’06),Seattle,W A,July2006.[9]Matthieu Bloch,Jo˜a o Barros,Miguel R.D.Rodrigues,and Steven W.McLaughlin,“An opportunistic physical-layer approach to secure wireless communications,”in Proc.44th Allerton conference on Communication Control and Computing,Allerton,USA,September2006.。