A OFDM communication attack method based on reconfigurable metasurface

Abstract

The present invention discloses a method for attacking OFDM communications based on a reconfigurable metasurface: Step 1, constructing a database for storing the phases and amplitudes of multiple state transition sequences and their corresponding harmonics; Step 2, compressing the database; Step 3, determining the type of attack. If an indiscriminate attack is required, proceed to Step 4; if a targeted attack is required, proceed to Step 5; Step 4, designing the metasurface configuration required for indiscriminate attacks using the metasurface, proceed to Step 7; Step 5, designing the metasurface configuration for all directional combinations of targeted attacks using the metasurface; Step 6, selecting the metasurface configuration corresponding to the corresponding directional combination; Step 7, controlling the working state of the metasurface meta-atom according to the metasurface configuration to implement the metasurface attack. The method of the present invention utilizes a metasurface device that originally enhances the signal as an attack device, inducing a legitimate OFDM signal to generate a frequency-deviation signal, destroying the key orthogonality of the OFDM subcarriers and severely degrading communication performance.

Description

Technical Field

[0001] The present invention relates to the field of communication security, and in particular to an OFDM communication attack method based on a reconfigurable metasurface. Technical Background

[0002] Orthogonal frequency division multiplexing (OFDM) reigns supreme in wireless communications. OFDM divides the bandwidth into multiple narrowband subcarriers, each of which is less susceptible to fading caused by obstacles or multipath propagation, allowing for robust data transmission in a variety of complex environments. As a result, OFDM has become the cornerstone of numerous wireless systems that permeate every aspect of our daily lives, from cellular networks that provide seamless mobile connectivity to Wi-Fi that delivers internet access in our homes and offices.

[0003] Reconfigurable metasurfaces (RIS), on the other hand, are typically composed of multiple identical meta-atoms. When a signal reaches a meta-atom, a phase shift is introduced before the signal is reflected. Actual meta-atoms are typically implemented using microelectronic components such as varactor diodes, which typically offer only a limited set of discrete phase shift states. For example, in a 2-bit metasurface, each meta-atom is effectively a 2-bit phase shifter with four possible phase shifts. A metasurface controller, typically a microcontroller or FPGA, acts as the metasurface's brain, dynamically manipulating the incident wave. Metasurfaces are becoming a powerful tool for manipulating wireless signals. Composed of countless equally spaced, programmable meta-atoms, their reflective properties can be dynamically altered to achieve beamforming, providing the ability to enhance signals or even focus them on specific users. This technology offers exciting possibilities for overcoming the limitations of existing wireless systems and enabling entirely new capabilities.

[0004] The combination of reconfigurable metasurfaces and OFDM-based communication systems has become a game-changer in wireless communications. This powerful combination unlocks significant performance improvements for existing systems, such as cellular networks and Wi-Fi, and paves the way for widespread deployment of metasurfaces and OFDM-based systems. Consequently, reconfigurable metasurfaces are commonly used to enhance the signal quality of OFDM-based communication systems, while technologies that exploit metasurfaces to attack OFDM-based communication systems are rarely found.

[0005] Due to the extensiveness and overlapping nature of wireless channels, jamming attacks can intentionally damage wireless communication networks. Jammer attacks based on network nodes can be divided into the following three categories:

[0006] Category 1: Brute-force suppression attack methods. Brute-force suppression jammers can disrupt packet reception by introducing high-power interference. Alternatively, they can prevent legitimate receivers from accessing the channel by constantly occupying it. While these methods offer good attack performance, they are less efficient.

[0007] The second category: channel-aware jamming attacks. Channel-aware jamming attacks, also known as reactive jamming attacks, involve malicious jammers sending jamming signals upon detecting legitimate data packets being transmitted over the air. However, this approach requires detailed prior knowledge of the network and channel information, making it challenging to implement in real-world wireless networks.

[0008] The third category: Off-tone attack methods. Off-tone attacks destroy the orthogonality of OFDM signals by injecting frequency-offset signals, but these systems require the generation of malicious signals, making them covert and easy to detect.

[0009] In summary, existing OFDM attack technologies have shortcomings in terms of concealment and efficiency. Summary of the Invention

[0010] The purpose of this invention is to provide a method for attacking OFDM communications based on a reconfigurable metasurface, addressing the shortcomings of existing OFDM attack techniques in terms of stealth and efficiency. This method leverages the metasurface, originally designed to amplify wireless signals, to achieve a more stealthy and efficient attack.

[0011] In order to achieve the above tasks, the present invention adopts the following technical solutions:

[0012] A method for attacking OFDM communications based on a reconfigurable metasurface includes the following steps:

[0013] Step 1: construct a database for storing multiple state transition sequences and their corresponding harmonic phases and amplitudes;

[0014] Step 2: compress the database obtained in step 1 to obtain a compressed database;

[0015] Step 3: Determine the attack type based on the attack requirements. If an indiscriminate attack is required, proceed to step 4; if a targeted attack is required, proceed to step 5.

[0016] Step 4: Use the database to design the metasurface configuration required for indiscriminate attacks using the metasurface, and then proceed to step 7.

[0017] Step 5: Using the database, design a metasurface configuration for all combinations of directions for targeted attack using the metasurface;

[0018] Step 6: Determine the target based on the BA frame of the target user performing Wi-Fi communication, and select the metasurface configuration corresponding to the corresponding direction combination in step 5 according to the target;

[0019] Step 7: Control the working state of the meta-atoms on the metasurface according to the metasurface configuration designed in step 4 or step 6 to achieve metasurface attack.

[0020] Compared with the prior art, the OFDM communication attack method based on reconfigurable metasurface of the present invention has the following beneficial effects:

[0021] The method of the present invention uses a metasurface device that originally enhances the signal as an attack device, inducing the legitimate OFDM signal to generate a frequency-shifted signal, destroying the key orthogonality of the OFDM subcarriers and severely reducing the communication performance. This attack is achieved by controlling the metasurface to generate frequency-shifted reflections / harmonics of the original OFDM signal. It can simultaneously beamform multiple frequency-shifted reflection signals generated by the metasurface without the need to introduce additional malicious signals. The attack is more covert and can achieve a more feasible attack. At the same time, a large number of experiments conducted in indoor, outdoor, 3D and office environments have shown that this method can reduce the throughput by 90% in targeted attack scenarios and by 43% in indiscriminate attack scenarios. The method of the present invention was used to verify the 802.11 protocol and the 5GNR protocol, respectively, proving the feasibility and effectiveness of the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1(a) shows a schematic diagram of the meta-atom modeling of a single-target metasurface, with a pitch angle of 0° and an azimuth angle of 30° in the target direction. Figure 1(b) shows the simulated energy distribution of the ±1st harmonics, and Figure 1(c) shows the measured energy distribution of the ±1st harmonics.

[0023] Figure 2(a) shows a schematic diagram of the meta-atom modeling of a dual-target metasurface, with the target directions at an elevation angle of 0° and azimuth angles of 20° and -40°. Figure 2(b) shows the simulated energy distribution, and Figure 2(c) shows the measured energy distribution of ±1st harmonics.

[0024] Figure 3 It is a diagram of the system's targeted effective attack field of view, which gives the confusion matrix of the throughput degradation percentage (TDP) results between -90 degrees and 90 degrees.

[0025] Figure 4 shows the performance of the distance between the transmitter (Tx) and the target user's receiver (Rx) under two attack scenarios. Figure 4(a) shows the performance of the distance between the transmitter and the target user's receiver under an indiscriminate attack scenario, and Figure 4(b) shows the performance of the distance between the transmitter and the target user's receiver under a targeted attack scenario.

[0026] Figure 5 shows the performance of the distance between the transmitter (Tx) and the metasurface (RIS) under two attack scenarios. Figure 5(a) shows the performance of the distance between the transmitter and the metasurface under an indiscriminate attack scenario, and Figure 5(b) shows the performance of the distance between the transmitter and the metasurface under a targeted attack scenario.

[0027] Figure 6 shows the performance of two attack modes in three different physical environments. Figure 6(a) is a non-line-of-sight layout diagram, where Figure 6(b) is the experimental results of indiscriminate attack and targeted attack performance in non-line-of-sight conditions; Figure 6(c) is a line-of-sight layout diagram, where Figure 6(d) is the experimental results of indiscriminate attack and targeted attack performance in line-of-sight conditions; Figure 6(e) is a 3D complex space layout diagram, where Figure 6(f) is the experimental results of indiscriminate attack and targeted attack performance in 3D complex space.

[0028] Figure 7 These are the attack effect diagrams under different protocols.

[0029] FIG8 shows the effectiveness of using a block acknowledgement frame to identify the receiving direction, where FIG8(a) is a static identification result and FIG8(b) is a dynamic identification result.

[0030] The present invention will be described in further detail below with reference to the accompanying drawings and embodiments. DETAILED DESCRIPTION

[0031] First, the idea of ​​the present invention is analyzed and verified from a theoretical perspective as follows:

[0032] Modeling of malicious frequency-deviation signals: After the legitimate signal is reflected by the metasurface, it is modeled as a malicious frequency-deviation signal with a frequency offset:

[0033] x s (t) = x(t)e j2πΔft

[0034] Where Δf is the frequency offset, is the time domain subcarrier signal, a k is the data symbol on the kth subcarrier, f k is the frequency of the kth subcarrier.

[0035] The superimposed signal received by the receiver, including the original OFDM signal and the frequency-shifted reflected signal, is:

[0036] y(t)=h(t)*x(t)+h R (t)*x S (t)+z(t)

[0037] h(t) is the channel impulse response of the original signal, h R (t) represents the channel impulse response of the frequency-shifted signal, and z(t) is Gaussian noise.

[0038] Derive the frequency domain data symbol Y(f k ):

[0039]

[0040] in is the normalized carrier frequency deviation, f sc is the subcarrier spacing, H(f k ) represents the channel frequency response of the kth subcarrier. Ideally, in the absence of interference from frequency-shifted signal reflections and inter-subcarrier interference, the received data symbols should maintain orthogonality:

[0041] Y(f k )=H(f k )*a k

[0042] Thus, the channel H(f k ) to demodulate data symbol a k However, due to the introduction of the frequency offset signal, the data symbol contains two additional components. Specifically, the first part P1(f k ):

[0043] P1(f k )=H R (f k )sinc(ε)*a k

[0044] is the interference of the frequency shift signal reflection; the second part P2(f k ):

[0045]

[0046] The performance of inter-subcarrier interference is described. According to the formula, injecting malicious frequency-shifted signal reflections through the metasurface will destroy the orthogonality of OFDM, thereby introducing significant interference.

[0047] Based on the above theoretical analysis, the method of the present invention is designed using the technical idea of ​​generating malicious frequency-deviation signal reflections through the metasurface to attack the OFDM communication system.

[0048] Example

[0049] The OFDM communication attack method based on the reconfigurable metasurface provided in this embodiment specifically includes the following steps:

[0050] Step 1: Build a database for storing multiple state transition sequences and the phases and amplitudes of their corresponding harmonics.

[0051] Specifically, in the database, each state transition sequence is a sequence of M phase values, where M is the length of the state transition sequence; the phase value θ m It is obtained by dividing 0 to 2π into n equal parts. For example, if it is divided into 4 equal parts, the phase value θ mis 0, π / 2, π or 3π / 2; if it is divided into 2 equal parts, the phase value θ m is 0 or π; when the length M of the state transition sequence and the equal number n are determined, there are n M Different state transition sequences.

[0052] For each state transition sequence in the database, the composite attenuation factor of the corresponding k-th order harmonic is calculated, and the phase and amplitude are determined according to the obtained composite attenuation factor.

[0053] The calculation formula of the composite attenuation factor is as follows:

[0054]

[0055] Among them, α k Composite attenuation factor; m = 0 ~ M-1; M is 4, 6 or 8; the value of n depends on the hardware design of the meta-atom of the metasurface. The larger n is, the more possibilities of phase and amplitude, the more corresponding state transition sequences, and the greater the possibility of finding the corresponding state transition sequence in the subsequent steps. n is preferably 2 or 4; k represents the order of the harmonic, which is a non-zero integer. Its value will affect the attenuation of the amplitude. The larger the absolute value of k, the greater the attenuation value. In this embodiment, k can be 1 or -1; Composite attenuation factor α k It can be divided into two parts, is a scalar component that affects only the amplitude;

[0056]

[0057] As a vector component, it is the superposition of M unit vectors and can simultaneously affect the composite attenuation factor α k The final amplitude and phase.

[0058] To achieve controllability of phase and amplitude by adjusting vector superposition, the present invention exhaustively iterates all possible state transition sequences with M = 4 (generating 256 sequences), M = 6 (generating 4096 sequences), and M = 8 (generating 65536 possible sequences). We note that as the number of states in the state transition sequence increases, the control of phase and amplitude becomes more refined. However, larger values ​​of M only result in an increase in the search space of possible sequences. To balance the search space and controllability, M = 6 is selected in this embodiment.

[0059] Step 2: compress the database obtained in step 1 to obtain a compressed database.

[0060] Step 21 , removing state transition sequences in the database whose sum of amplitudes of harmonics with orders k=1 and k=−1 is less than a threshold (preferably 1), to obtain a preliminarily compressed database.

[0061] In this step, a strategy is proposed to eliminate the state transition sequence that produces the frequency shift signal with weak energy. Specifically, it focuses on finding the sequence of the first-order harmonics (k=1 and k=-1) with high energy, that is, only the sum of the amplitudes of these harmonics (α1+α -1 ) sequences that exceed a predefined threshold. Based on this analysis, the threshold is set to 1 and only these selected sequences are searched.

[0062] Step 22: Remove the mutually symmetrical and mutually rotatable state transition sequences from the initially compressed sequence until only one is left, thereby obtaining a final compressed database.

[0063] In this step, we found that when an M-bit state transition sequence, such as (1, 0, 0, 0, 0) is shifted right by one position to become (0, 1, 0, 0, 0, 0), the amplitude of the generated harmonic remains unchanged, and the phase difference is a fixed value related to the length M of the state transition sequence and the corresponding order k of the harmonic. In addition, when an M-bit state transition sequence, such as (1, 0, 1, 2, 1, 0) is changed to (0, 1, 2, 1, 0, 1), the amplitude of the generated harmonic remains unchanged, and the ±k-order phases are exactly opposite. Inspired by Polya's counting theorem and this law, we can consider rotationally symmetrical bracelets as a type, just like "stringing beads", to further compress the existing storage space.

[0064] Step 3: Determine the attack type based on the attack requirements. If an indiscriminate attack is required, proceed to step 4; if a targeted attack is required, proceed to step 5.

[0065] Step 4: Design the metasurface configuration required to conduct indiscriminate attacks using the metasurface, and proceed to step 7.

[0066] Specifically, step 4 includes the following sub-steps:

[0067] Step 41: Construct multiple sets of metasurface configurations. Each set of metasurface configurations is constructed by determining the number of meta-atoms contained in the metasurface based on its size (in this embodiment, the size of the metasurface is 16*16, meaning the number of meta-atoms is 16*16 = 256). For each meta-atom, a state transition sequence is randomly selected from all state transition sequences in the database obtained in step 1 (each meta-atom has 4096 possible selections). Different meta-atoms are allowed to select the same state transition sequence. In this embodiment, a total of 50 sets of metasurface configurations are constructed.

[0068] Step 42, constructing an objective function based on the overall energy intensity and variance of the k-order harmonics;

[0069] In step 43, based on the constructed objective function, a genetic algorithm is used to process the multiple sets of metasurface configurations constructed in step 41 to obtain multiple sets of processed metasurface configurations. The metasurface configuration with the lowest objective function value is used as the metasurface configuration required for the indiscriminate attack. During each iteration of the genetic algorithm, the objective function value is calculated for each set of metasurface configurations constructed in step 41. The overall energy intensity and variance required for the objective function value calculation are calculated by querying a database.

[0070] Specifically, for each state transition sequence in each group of metasurface configurations constructed in step 41, the phase and amplitude of the corresponding k-order harmonic are queried according to the database, and then the overall energy intensity and variance of the directional pattern of the k-order harmonic generated by the metasurface configuration are calculated based on the phase and amplitude of all state transition sequences in the metasurface configuration.

[0071] In this step, in order to achieve an indiscriminate attack, it is necessary to determine a suitable metasurface configuration to effectively generate diffuse reflection so that any user in the attack area will receive multiple reflections from the metasurface, each with a different frequency shift, thereby achieving the attack effect. However, due to the huge search space, a simple exhaustive search algorithm is impractical. For example, assuming that the length of the state transition sequence M = 6, each meta-atom on the metasurface can be selected from 4096 (n = 4, in the case of M = 6) in the database. M =4096) state transition sequence is randomly selected, so the operation of all meta-atoms on the metasurface is converted into a 4096 256 The search space is not feasible from a computational point of view. Based on the above reasons, the present invention uses the crossover and mutation operations in the genetic algorithm to achieve uniform reflection of harmonics in all directions. During each iteration of the genetic algorithm, a composite objective function based on variance and overall energy intensity is adopted as shown below. The uniformity is evaluated by calculating the energy variance of the directional pattern of the k-order harmonic in all directions. The smaller the energy variance, the better the uniformity. At the same time, keeping the overall energy intensity of the k-order harmonic as large as possible, the better the indiscriminate destruction effect.

[0072]

[0073] Among them, α and β are the weights of uniformity and energy intensity, which can be set according to needs. In this embodiment, α and β are 1 and 10 respectively. 7 Variance k is the energy variance of the k-order harmonic pattern in each direction, representing a uniform situation. The smaller the better. Total k is the overall energy intensity of the k-order harmonic, the larger the better. k is the order of the harmonic, and z is the range of k. In this embodiment, k is 1 or -1, and the range of z is [-1, 1];

[0074] The strategy in step 4 doesn't target a specific target, but rather attempts to affect all possible targets. In this case, using metasurface technology allows for a single optimization configuration before the attack, ensuring the attack's breadth and effectiveness. Once the optimal metasurface configuration is determined, it can be fixed during the actual attack, eliminating the need for real-time adjustments. This reduces system complexity and energy consumption while maintaining the desired attack effectiveness.

[0075] Indiscriminate attacks aim to reduce throughput within the coverage area. Experiments show that throughput significantly decreases in all directions, from -90 degrees to 90 degrees. Specifically, after implementing the hypersurface attack strategy, throughput plummeted to 121 Mbps. The average throughput reduction was 43%.

[0076] Step 5: Design a metasurface configuration that can be used to target all directions of the metasurface. This includes the following sub-steps:

[0077] In step 51, beamforming technology is used to determine the optimal phase shift of the k-th harmonic of the beam in multiple directions. The optimal phase shift of each harmonic in each direction is used as a target phase. In this embodiment, the elevation angle is 0°, the azimuth angle range is ±60°, the step size is 10°, and there are 13 directions in total. Since the number of harmonics is 2, there are 26 target phases.

[0078] Step 52: Copy each of the above-mentioned multiple directions into two as a direction combination to obtain multiple first-type direction combinations, and at the same time, arbitrarily combine the above-mentioned multiple directions in pairs to obtain multiple second-type direction combinations, and the two directions in each obtained direction combination each correspond to a harmonic; and determine a set of metasurface configurations for each first-type direction combination and each second-type direction combination.

[0079] Specifically, the process of determining a set of metasurface configurations for each direction combination is: determining the number of meta-atoms contained in the metasurface according to the size of the metasurface (in this embodiment, the size of the metasurface is 16*16, that is, the number of meta-atoms is 16*16=256), and selecting a state transition sequence for each meta-atom from the database obtained in step 1 or 2 to obtain the state transition sequence of all meta-atoms on the metasurface as a set of metasurface configurations determined by the current direction combination.

[0080] Preferably, for each meta-atom, a state transition sequence that minimizes the loss function value is selected from the database obtained in step 1 or 2 as the state transition sequence corresponding to the meta-atom. The fitness function for minimizing the loss function is shown as follows:

[0081]

[0082] Wherein, w1 and w2 are weighting coefficients, which can be set according to requirements. In this embodiment, they are set to 1 and 2 respectively; k is the difference between the phase of the k-order harmonic corresponding to the state transition sequence and the target phase of the k-order harmonic obtained in step 51 in the corresponding direction in the current direction combination, A k is the amplitude of the kth order harmonic corresponding to the state transition sequence, k is the order of the harmonic, and z is the range of k. In this embodiment, k is 1 or -1, and the range of z is [-1, 1];

[0083] In each subsequent targeted attack, the appropriate metasurface configuration can be directly obtained through the combination of directions to be attacked, saving the repetitive time of designing the metasurface configuration.

[0084] Based on the analysis of step 5 in this embodiment: First, the beamforming problem of the harmonics (k = ± 1) needs to be solved independently. Step 51 determines the optimal phase shift that the meta-atom should introduce to achieve beamforming. Figure 1 (a) is a schematic diagram of the meta-atom modeling of a single target metasurface. The pitch angle of the target direction is 0°, the azimuth angle is 30°, and two harmonics are beamformed in the same direction. Given the phase of the incident signal Solving the beamforming problem can obtain the phase of the reflected signal of the k-order harmonic Thus, the desired phase shift that the meta-atom should introduce is obtained

[0085] Figure 2(a) is a schematic diagram of the meta-atom modeling of a dual-target metasurface. The target direction has an elevation angle of 0°, and azimuth angles of 20° and -40°, sending two harmonics in two different directions. We search for a state transition sequence that achieves the optimal phase shift for each harmonic (k = ±1), matching the beamforming solution for a single harmonic. This sequence approximates the beamforming target phase by searching a database, and each meta-atom minimizes the loss function fitness to obtain the optimal state transition sequence configuration. The generated state transition sequence is configured to have the largest possible amplitude while maintaining close proximity to the target phase. This approach enables us to effectively achieve targeted manipulation of multiple frequency-shifted signals.

[0086] Figures 1(b) and (c) plot the simulated and measured energy distributions of the metasurface for this single-target attack. The results confirm that the two harmonics indeed form beams in the desired direction (i.e., one target). The simulated and measured energy distributions for the dual-target attack in Figures 2(b) and (c) further demonstrate that the two harmonics indeed form beams in different directions (i.e., two targets). In summary, the strategy in Step 5 ensures the accurate direction of the targeted attack.

[0087] Step 6: Determine the target according to the BA frame of the target user performing Wi-Fi communication, and select the corresponding metasurface configuration corresponding to the corresponding direction combination in step 5 according to the target.

[0088] Step 6 includes the following sub-steps:

[0089] In step 61, if there is one target user, execute steps 62-64; if there are two target users, execute steps 62-64 for each of the two target users. The number of target users is limited by the optional range of the harmonic order k. In this embodiment, k can be 1 or -1, so the maximum number of target users is 2.

[0090] Step 62: Based on the MAC address of the target user, a Wi-Fi receiver is used to intercept the BA frame.

[0091] Step 63: Use a network protocol analysis tool (WireShark is used in this embodiment) to filter the data packets containing the target user's MAC address, and perform statistical analysis on the bitmap in the BA frame.

[0092] The bitmap uses "0" and "1" to mark the unaccepted and accepted packet sequences respectively.

[0093] Step 64: Select the metasurface configuration corresponding to each direction combination in the first category of direction combinations and perform a short (optionally 1ms) targeted attack in turn, calculate the packet loss rate of the direction corresponding to each first category of direction combination, and thereby determine the direction of the target user.

[0094] Specifically, the process of calculating the packet loss rate in the direction corresponding to each first-category direction combination is: calculating the percentage of "0" in the current direction in the bitmap, and determining the packet loss rate of users in the direction according to the percentage.

[0095] Specifically, the direction corresponding to the maximum packet loss rate is selected as the direction of the target user.

[0096] Step 65 , based on the direction of the target user (ie, targeting), select the metasurface configuration of the corresponding direction combination obtained in step 5 .

[0097] For example, when there is one target user (i.e., the targeting is one direction), the corresponding direction combination is the first type of direction combination; when there are two target users (i.e., the targeting is one direction), the corresponding direction combination is the second type of direction combination.

[0098] In step 6, users periodically send BA frames during Wi-Fi communication. The fundamental mechanism of the Wi-Fi protocol is to confirm the successful reception of consecutive data packets and to indicate data loss. Therefore, by selecting the metasurface configuration corresponding to each direction combination in the first category and performing a short 1ms targeted attack, the target user's direction can be determined by calculating the packet loss rate without alerting the target user.

[0099] After using the single target and dual target (targeting) determined in step 6, conduct the following attack experiment:

[0100] Metasurfaces can generate frequency-shifted reflections / harmonics of the original OFDM signal, destroying the critical orthogonality of OFDM subcarriers and severely degrading communication performance.

[0101] For a single-target attack, the target is located at 30 degrees. The metasurface uses ±1st-order harmonic beamforming to simultaneously interfere with the target user, resulting in a communication interruption of approximately 192Mbps, a 90% reduction compared to the baseline scenario of normal communication (average throughput of 214Mbps).

[0102] For dual-target attacks, the +1st and -1st order harmonic beamforming directions were 20 degrees and -40 degrees, corresponding to the azimuths of the desired attack targets. Compared to the baseline, the throughput was significantly reduced, with 20 degrees achieving approximately 161 Mbps (a 75% reduction) and -40 degrees achieving approximately 170 Mbps (a 79% reduction).

[0103] Step 7: Control the working state of the meta-atoms on the metasurface according to the metasurface configuration designed in step 4 or step 6 to enable the metasurface to attack.

[0104] Preferably, step 7 specifically includes the following sub-steps:

[0105] Step 71, design the specific frequency offset f generated by the metasurface Δ , determine the duration T0 of the state transition sequence:

[0106] T0=1 / f Δ

[0107] Among them, f Δ is the frequency offset of the harmonic. In this example, f Δ is 200k. The frequency can be offset by f Δ The duration T0 of the corresponding state transition sequence is obtained, and the duration T0 of the state transition sequence is adjusted through hardware to generate expected harmonics.

[0108] In step 72 , the state of each unit of the metasurface is controlled according to the metasurface configuration designed in step 4 or 6 and the duration T0 of the state transition sequence determined in step 71 .

[0109] The hardware design in this embodiment is as follows: each meta-atom on the metasurface uses two SMP1340-040LFPIN diodes as adjustable electronic components. By using different DC voltages (0V or 5V) to activate or deactivate the PIN diodes, each meta-atom can provide four phase shift states, namely 0 ("00" state), π / 2 ("01" state), π ("10" state) and 3π / 2 ("11" state). In order to independently control each meta-atom, the present invention uses a XILINX XC7K325T FPGA and is equipped with 64 SN74LV595 shift registers to provide the bias voltage of the PIN diode. Specifically, the entire metasurface is divided into two areas, each area is divided into 8 channels, each channel includes 4 SN74LV595 shift registers connected in sequence, and transmits a 32-bit data stream to control 32 PIN diodes (i.e., 16 meta-atoms). The circuit design of this hardware allows the controller to independently set the PIN diode state of each meta-atom and achieve a switching rate of up to 300kHz. Because the metasurface only reflects existing signals during an attack, rather than receiving and regenerating them, power consumption is low, at the milliwatt level. This hardware design allows the metasurface to enter an attack state based on the corresponding phase encoding configuration.

[0110] Comparison of experimental results:

[0111] The experimental deployment of this embodiment is as follows: the transmitter (Tx) is a commercial WLAN router Asus RT-AC68U equipped with 2 antennas (MIMO channel number is 2). The router operates in the 802.11n / ac mixed band, 5.825GHz, with a bandwidth of 40MHz. The target user receiver (Rx) is a laptop with an Intel Wireless-AC 8265 network card and 2 antennas (MIMO channel number is 2). We use the iperf3 toolbox to collect throughput measurements. In the default settings, the transmitter is deployed in the normal direction of the metasurface, and the distance between the transmitter and the metasurface is kept at 1m. The target user receiver is arranged along a semicircle (5m radius) from -90° to 90°, with an interval of 10°, while the transmitter remains in the center. The height of all devices is 1m.

[0112] The OFDM communication attack method based on the reconfigurable metasurface given in this embodiment is evaluated from the following six aspects:

[0113] (1) Targeted effective attack field of view:

[0114] To evaluate the system’s targeted effective attack field of view, we measure the throughput and calculate the throughput degradation percentage (TDP) for each attack direction in the range of -90 degrees to 90 degrees, with an interval of ±10 degrees. Figure 3Figure 2 shows the system's effective attack field of view, along with a confusion matrix showing the throughput reduction percentage. Within a wide 120-degree range (i.e., [-60 degrees, 60 degrees]), the throughput reduction percentage exceeds 80%, clearly demonstrating that this invention can conduct highly destructive targeted attacks. For user directions outside the effective attack field of view, multiple metasurfaces can be deployed to expand the attack range.

[0115] (2) Attack range results:

[0116] In an outdoor environment, we evaluate the performance of our method under indiscriminate and targeted attack scenarios with respect to the distance between the transmitter (Tx) and the target user receiver (Rx).

[0117] For indiscriminate attacks, the distance between the transmitter and the target user receiver ranged from 1 to 40 meters, with a step size of 5 meters. We measured the average throughput at each distance between the transmitter and the target user receiver, ranging from -90 degrees to 90 degrees. Figure 4(a) shows the performance of the indiscriminate attack scenario at a range of 40 meters, showing that the attack remains effective at a range of 40 meters, although the throughput degradation decreases gradually. Specifically, the throughput degradation decreases from 43% at 5 meters to less than 20% at 40 meters, demonstrating the trade-off between the attack range and distance of indiscriminate attacks due to the dispersion of the attack signal throughout the area. This limitation can be easily alleviated by using larger metasurfaces equipped with more atoms.

[0118] For the targeted attack, the target attack user's receiver (Rx) is located 30 degrees from the metasurface. Figure 4(b) shows the performance of the targeted attack scenario as the distance between the transmitter and the target user's receiver changes. At a distance of 10m, the throughput drops significantly, from 212Mbps to 52.2Mbps (a 75% reduction). Even at 150m, the throughput drops from 45Mbps to 21.4Mbps (a 52% reduction). From 0 to 160 meters, the throughput drop remains above 40%, demonstrating that this attack method can be used effectively and accurately at distances of several hundred meters.

[0119] (3) Impact of the distance between the transmitter (Tx) and the metasurface (RIS):

[0120] To evaluate the impact of the distance between the transmitter and the metasurface on the effectiveness of the attack, we extended the distance between the transmitter and the metasurface from 1m to 10m, measuring the throughput and calculating the throughput degradation percentage under both indiscriminate and targeted attack scenarios. Figures 5(a) and 5(b) represent the performance of the distance between the transmitter (Tx) and the metasurface (RIS) under both indiscriminate and targeted attack scenarios, respectively. They show that regardless of the attack scenario, the attack remains effective when the distance between the transmitter and the metasurface increases to 10m, and the throughput degradation percentage decreases with increasing distance. This is because the attack method does not generate attack signals but reflects them from legitimate signals, and the energy of the attack signal decreases with increasing distance from the transmitter. Overall, these results demonstrate that the attack method remains viable even when the metasurface is farther away from the transmitter.

[0121] (4) Attack performance in different environments:

[0122] In order to evaluate the attack effects in different environments, we conducted experiments in three different environments: 110m 2 The residential space is divided into four rooms, representing a non-line-of-sight (NLoS) scenario, 180m 2 Open offices represent line-of-sight (LoS) scenarios, as well as 3D complex space settings. Figure 6 shows the attack performance under different channel conditions. Figure 6(a) shows a non-LoS layout, while Figure 6(b) shows the experimental results of indiscriminate and targeted attacks in the non-LoS scenario. Figure 6(c) shows a LoS layout, while Figure 6(d) shows the experimental results of indiscriminate and targeted attacks in the LoS scenario. Figure 6(e) shows a 3D complex space layout, while Figure 6(f) shows the experimental results of indiscriminate and targeted attacks in the 3D complex space. The results show that: first, in the indiscriminate attack scenario, the attack's effectiveness remains high in all directions. Second, when the target user is aligned with the beamforming direction, the attack is consistently successful regardless of the distance between the attacker and the target user, and regardless of LoS or NLOS conditions. This demonstrates the robustness and effectiveness of both indiscriminate and targeted attack modes in various physical environments.

[0123] (5) Attack performance under different protocols:

[0124] The metasurface in this attack method is transparent to existing IoT communication standards. This property was verified using four protocols: 802.11n, 802.11n / ac, 802.11ax, and 5GNR. The 802.11ax protocol has two modes: 40MHz and 80MHz. Figure 7The attack effects on different protocols are shown, with the throughput of the metasurface turned "on" and "off" in both targeted and indiscriminate attack scenarios. We can see that when using the metasurface attack, the throughput of all protocols will continue to drop significantly (up to 90%).

[0125] (6) Validity of BA frame:

[0126] To evaluate the effectiveness of BA frames in accurately locating the beamforming direction when the user location or the location of a mobile user is unknown, we conducted packet loss statistics tests in static and mobile scenarios. The transmitter is located at a fixed position. The target user is in a static scenario with a pitch angle of 0° and an azimuth angle of 30°, and moves along a predefined trajectory. In the static recognition results of Figure 8(a), we can see that the packet loss rate in a specific direction has a peak, which confirms that the present invention can use BA frames to accurately identify the location of the attacking user. In addition, in the dynamic recognition results of Figure 8(b), the packet loss rate is always high, proving that the present invention can perform harmonic beamforming attacks on moving users. These results confirm that the present invention can use BA frames to identify the direction of the attacking user and maintain good performance in a dynamic environment.

[0127] In general, the present invention transforms the metasurface, which is supposed to enhance the signal, from a communication enhancer to an attacker. The metasurface is controlled to generate frequency-shifted reflections / harmonics of the original OFDM signal, destroying the key orthogonality of the OFDM subcarriers and severely degrading the communication performance. This allows for a more efficient attack in a more covert manner.

Claims

1. A method for attacking OFDM communication based on a reconfigurable metasurface, characterized in that: The specific steps include: Step 1: construct a database for storing multiple state transition sequences and their corresponding harmonic phases and amplitudes; Step 2: compress the database obtained in step 1 to obtain a compressed database; Step 3: Determine the attack type based on the attack requirements. If an indiscriminate attack is required, proceed to step 4; if a targeted attack is required, proceed to step 5. Step 4: Use the database to design the metasurface configuration required for indiscriminate attacks using the metasurface, and then proceed to step 7. The specific steps include the following: Step 41: construct multiple sets of metasurface configurations, wherein the construction of each set of metasurface configurations is specifically as follows: determining the number of meta-atoms contained in the metasurface according to the size of the metasurface, and randomly selecting a state transition sequence for each meta-atom from all state transition sequences in the database obtained in step 2. The state transition sequences selected by different meta-atoms are allowed to be the same; Step 42, constructing an objective function based on the overall energy intensity and variance of the k-order harmonics; Step 43: Based on the constructed objective function, a genetic algorithm is used to process the multiple sets of metasurface configurations constructed in step 41 to obtain multiple sets of processed metasurface configurations, and the metasurface configuration with the lowest objective function value is used as the metasurface configuration required for the indiscriminate attack. In each iteration of the genetic algorithm, the objective function value needs to be calculated for each set of metasurface configurations constructed in step 41. The overall energy intensity and variance required in the objective function value calculation process are respectively obtained by querying the database and calculating. Step 5: Using the database, design a metasurface configuration for all combinations of directions for targeted attack using the metasurface; It includes the following sub-steps: Step 51, determining the optimal phase shift of the k-th harmonic of the beam in multiple directions by using beamforming technology, and taking the optimal phase shift of each harmonic in each direction as a target phase; Step 52: Copy each of the multiple directions into two as a direction combination to obtain multiple first-type direction combinations, and simultaneously arbitrarily combine the multiple directions into two combinations to obtain multiple second-type direction combinations, wherein the two directions in each obtained direction combination each correspond to a harmonic; and determine a set of metasurface configurations for each first-type direction combination and each second-type direction combination. Specifically, the process of determining a set of metasurface configurations for each direction combination is as follows: determining the number of meta-atoms contained in the metasurface according to the size of the metasurface, selecting a state transition sequence for each meta-atom from the database obtained in step 2, and obtaining the state transition sequences of all meta-atoms on the metasurface as a set of metasurface configurations determined by the current direction combination; Step 6: Determine the target based on the BA frame of the target user performing Wi-Fi communication, and select the metasurface configuration corresponding to the corresponding direction combination in step 5 according to the target; Step 7: Control the working state of the meta-atoms on the metasurface according to the metasurface configuration designed in step 4 or step 6 to achieve metasurface attack.

2. The OFDM communication attack method based on a reconfigurable metasurface according to claim 1, characterized in that: In step 1, each state transition sequence in the database is a sequence consisting of M phase values, where M is the length of the state transition sequence and the value of M is 4, 6 or 8; the phase value Divide 0~2π into n equal parts, and there are n M Different state transition sequences; For each state transition sequence in the database, the composite attenuation factor of the corresponding k-order harmonic is calculated, and the phase and amplitude are determined according to the obtained composite attenuation factor; k represents the order of the harmonic, and k is 1 or -1.

3. The OFDM communication attack method based on reconfigurable metasurface according to claim 1, characterized in that: The step 2 includes the following sub-steps: Step 21, the order k in the database is and k= The state transition sequences whose sum of harmonic amplitudes is less than a threshold are removed to obtain a preliminary compressed database; Step 22: Remove the mutually symmetrical and mutually rotatable state transition sequences from the initially compressed sequence until only one is left, thereby obtaining a final compressed database.

4. The OFDM communication attack method based on a reconfigurable metasurface according to claim 1, characterized in that: Step 6 includes the following sub-steps: Step 61: If there is one target user, execute steps 62-64; if there are two target users, execute steps 62-64 for each of the two target users. Step 62: intercept the BA frame using a Wi-Fi receiver based on the target user's MAC address; Step 63: Filter the data packets containing the target user's MAC address and statistically analyze the bitmap in the BA frame; wherein the bitmap uses "0" and "1" to mark the unaccepted and accepted packet sequences respectively; Step 64: Select the metasurface configuration corresponding to each direction combination in the first category of direction combinations and perform a short targeted attack in sequence. Calculate the packet loss rate of the direction corresponding to each direction combination in the first category to determine the direction of the target user. In step 65, based on the direction of the target user, the metasurface configuration of the corresponding direction combination obtained in step 5 is selected; specifically, when there is one target user, the corresponding direction combination is the first type of direction combination; when there are two target users, the corresponding direction combination is the second type of direction combination.

5. The OFDM communication attack method based on reconfigurable metasurface according to claim 1, characterized in that: Step 7 specifically includes the following sub-steps: Step 71: Design the specific frequency deviation generated by the metasurface , determines the duration of the state transition sequence : in, is the frequency offset of the harmonic; Step 72, based on the metasurface configuration designed in step 4 or 6 and the duration of the state transition sequence determined in step 71 , realizing the control of the state of each unit of the metasurface.

Images