Wireless optical communication physical layer authentication system and method

Abstract

The invention belongs to the technical field of wireless optical communication, and relates to a wireless optical communication physical layer authentication system and method. The system comprises at least three receivers and a master controller, each receiver comprises a photoelectric detection module, a distance measurement module, a data processing module and an authentication module, and the master controller is in communication connection with each receiver and a transmitting end and comprises a key update storage and watermark superposition setting module and a decision module. According to the wireless optical communication physical layer authentication system provided by the invention, the legality of a signal can be efficiently verified at the same time from the aspects of position information and watermark information by fusing authentication parameters of at least three receivers and checking authentication test statistics of fusing the position information and the watermark information by utilizing a master controller; through one-time comprehensive analysis and judgment, the simulation attack for tampering the signal and the replay attack for not tampering the signal can be synchronously and accurately identified, the authentication efficiency and robustness are improved, and the security and reliability of the wireless optical communication system are fully ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of wireless optical communication, and in particular to a wireless optical communication physical layer authentication system and method. Background Art

[0002] Wireless optical communication is a secure data access method for the next generation of data access and the Internet of Things, but the openness of its transmission medium makes it vulnerable to attacks such as spoofing. Specifically, attackers can forge users and access the network to obtain further illegal benefits, resulting in privacy leakage and data injection, and even causing the entire wireless optical communication system to be damaged. Therefore, when conducting wireless optical communication, it is necessary to verify whether the received message is sent by a legitimate device to ensure the legitimacy of both parties in communication. Unlike upper-layer authentication that relies on encryption algorithms, physical layer authentication utilizes the unique physical layer characteristics of wireless signals, making it difficult for attackers to observe and imitate, providing higher security for wireless optical systems.

[0003] Physical layer authentication methods can be divided into two categories: active physical layer authentication methods and passive physical layer authentication methods. Passive physical layer authentication methods are based on the inherent characteristics of the physical layer. The transmitter does not need to perform additional processing on the transmitted signal, nor does it need to generate additional relevant identity information. However, the early stage of authentication requires a large amount of data and a certain amount of time. The RF fingerprint database of the legitimate transmitter is pre-established or the model is trained for the features. The authentication accuracy depends on the number of features used. Active physical layer authentication artificially superimposes watermark information on the transmitted signal. The receiver verifies the identity of the transmitter by checking whether there is a watermark in the received signal. Its authentication result is relatively more accurate and has stronger robustness.

[0004] In the existing active physical layer authentication method, the legitimate transmitter superimposes watermark information on the transmitted signal. The receiving end can effectively identify imitation attacks by checking whether there is a legitimate watermark in the received signal. That is, when the attacker tampers with the transmitted information and then sends it again, by comparing the watermark information in the signal received by the receiving end with the estimated watermark generated by the receiver, it can be determined whether the information is sent by the legitimate transmitter. However, for replay attacks, that is, the attacker only eavesdrops on the signal superimposed with the watermark information and then forwards it, since the attacker does not tamper with the signal, it is impossible to determine whether the signal is sent by the legitimate transmitter based on the received signal.

[0005] However, since imitation attacks and replay attacks are related to each other, for example, an attacker may first perform a replay attack to obtain the identity information or signal of the legitimate transmitter, and then use this information to launch an imitation attack. If the replay attack occurs before the imitation attack is identified, the attacker may complete the disguise without the system noticing, resulting in data leakage. In addition, the identification of each attack method requires a certain amount of time. The attacker may perform a replay attack during the identification process of the imitation attack, or perform an imitation attack during the identification process of the replay attack; therefore, in addition to being able to identify imitation attacks and replay attacks, it is also necessary to be able to synchronously identify imitation attacks and replay attacks to fully ensure the security and reliability of wireless optical communication systems.

[0006] In summary, how to design a wireless optical communication physical layer authentication system and method that can simultaneously identify imitation attacks and replay attacks, thereby improving the security and reliability of the wireless optical communication system, is a problem that needs to be solved urgently. Summary of the invention

[0007] To this end, the technical problem to be solved by the present invention is to overcome the problem that the physical layer authentication method in the prior art cannot synchronously identify the replay attack and imitation attack of the attacker, thereby affecting the security of the wireless communication system.

[0008] In order to solve the above technical problems, the present invention provides a wireless optical communication physical layer authentication system, comprising:

[0009] At least three receivers, each receiver comprising:

[0010] The photoelectric detection module is used to receive a message transmission request sent by the transmitting end in the handshake phase, convert the message transmission request into a first electrical signal and send it to the master control; receive a watermark superposition signal in the message transmission phase, and convert the watermark superposition signal into a second electrical signal;

[0011] a distance measuring module, configured to calculate a first distance between a receiver and a transmitting end and a first channel parameter based on the pilot signal strength in the first electrical signal; and to calculate a second distance between a receiver and a transmitting end of a watermark superimposed signal and a second channel parameter based on the pilot signal strength in the second electrical signal;

[0012] a data processing module, configured to obtain a restored watermark superimposed signal based on the second electrical signal and the second estimated channel, obtain a source signal based on the restored watermark superimposed signal, and obtain a residual signal based on the restored watermark superimposed signal, the source signal and a power allocation factor;

[0013] An authentication module is used to calculate the upper and lower limits of the authentication threshold of the receiver based on the standard Gaussian cumulative distribution function of the theoretical authentication test statistic of the receiver, the noise standard deviation of the receiver, the first channel parameter and the first distance; generate an expected watermark based on the key sent by the master control, the encryption function for generating the watermark and the source signal, and calculate the actual authentication test statistic of the receiver based on the expected watermark, the residual signal, the second channel parameter and the second distance;

[0014] The master control communicates with each receiver and transmitter, including:

[0015] A key update storage and watermark superposition setting module, used to generate a key and an encryption function for generating a watermark based on the first electrical signal, and send the key and the encryption function for generating the watermark to each receiver and transmitter;

[0016] The decision module is used to calculate the authentication parameters of each receiver based on the actual authentication test statistics and the upper and lower limits of the authentication threshold, and determine whether the watermark superimposed signal transmitter is legal based on the authentication parameters of all receivers.

[0017] Preferably, the calculation formula of the actual authentication test statistic of the receiver is:

[0018]

[0019]

[0020] in, represents the actual authentication test statistic of the i-th receiver; D i ′ represents the second distance between the i-th receiver and the watermark superimposed signal transmitter; h i ′ represents the second channel parameter between the i-th receiver and the watermark superimposed signal transmitting end; represents the expected watermark generated by the i-th receiver; (·) H represents the conjugate transpose; ρ t represents the power allocation factor of the watermark superimposed signal power on the watermark signal; ρ s represents the power allocation factor of the watermark superimposed signal power on the message signal; ρ t ≤1,ρ s ≥0,ρ t 2 +ρ s 2 =1; represents the watermark superimposed signal recovered by the i-th receiver; represents the source signal obtained by the i-th receiver; r irepresents the residual signal obtained by the i-th receiver; i∈[1,m], m represents the number of receivers.

[0021] Preferably, the calculation formula for the upper limit of the authentication threshold of the receiver is:

[0022]

[0023] in, represents the upper limit of the authentication threshold of the i-th receiver; θ i represents the theoretical validation test statistic for the ith receiver; represents the standard Gaussian cumulative distribution function of the theoretical certification test statistic of the i-th receiver; D i represents the first distance between the i-th receiver and the transmitter; h i represents the first channel parameter between the i-th receiver and the transmitter; L represents the length of the watermark superimposed signal; represents the upper limit of the false alarm probability of the i-th receiver; σ wi represents the noise standard deviation of the i-th receiver; ρ t represents the power allocation factor of the watermark superimposed signal power on the watermark signal; i∈[1,m], m represents the number of receivers;

[0024] The receiver's authentication lower threshold is calculated as:

[0025]

[0026] in, represents the lower authentication threshold of the i-th receiver.

[0027] Preferably, the authentication parameters of the receiver are expressed as:

[0028]

[0029] Among them, δ i represents the authentication parameters of the i-th receiver; represents the actual authentication test statistic of the i-th receiver; represents the upper limit of the authentication threshold of the i-th receiver; represents the lower limit of the authentication threshold of the i-th receiver; i∈[1,m], m represents the number of receivers.

[0030] Preferably, determining whether the watermark superimposed signal transmitter is legitimate based on the authentication parameters of all receivers includes:

[0031] If the cumulative product of the authentication parameters of all receivers is 1, the transmitter of the watermark superimposed signal is determined to be a legitimate transmitter;

[0032] If the cumulative product of the authentication parameters of all receivers is 0, the watermark superimposed signal transmitter is determined to be an illegal transmitter.

[0033] Preferably, when the number of receivers is greater than 3, the master control further comprises:

[0034] an authentication receiver selection module, configured to select n receivers closest to the transmitting end as authentication receivers based on a first distance between each receiver and the transmitting end; wherein 3≤n≤m, m represents the number of receivers;

[0035] The authentication enabling module is used to control n authentication receivers to receive the watermark superimposed signal.

[0036] Preferably, the key update storage and watermark superposition setting module updates the key and the encryption function for generating the watermark at preset intervals, and sends the updated key and the encryption function for generating the watermark to each receiver and transmitter.

[0037] Preferably, the master control also includes a sink, which is used to control each receiver to refuse to receive the signal sent by the transmitter when the transmitter is determined to be an illegal transmitter.

[0038] Preferably, each receiver further includes a distance measurement compensation calibration module, which is used to calibrate the first distance and the second distance between the receiver and the transmitter by using a distance measurement compensation algorithm.

[0039] The present invention also provides a wireless optical communication physical layer authentication method, which is applied to the above-mentioned wireless optical communication physical layer authentication system, comprising:

[0040] In the handshake phase, each receiver receives a message transmission request sent by the transmitter, converts the message transmission request into a first electrical signal and sends it to the master control; each receiver calculates a first distance and a first channel parameter between the receiver and the transmitter based on the pilot signal strength in the first electrical signal;

[0041] The master control generates a key and an encryption function for generating a watermark based on the first electrical signal, and sends the key and the encryption function for generating the watermark to each receiver and transmitter;

[0042] In the message transmission stage, each receiver receives the watermark superimposed signal and converts the watermark superimposed signal into a second electrical signal; and calculates a second distance and a second channel parameter between the receiver and the watermark superimposed signal transmitting end based on the pilot signal strength in the second electrical signal;

[0043] Each receiver obtains a restored watermark superimposed signal based on the second electrical signal and the second estimated channel, obtains a source signal based on the restored watermark superimposed signal, and obtains a residual signal based on the restored watermark superimposed signal, the source signal and a power allocation factor;

[0044] Each receiver calculates the upper and lower limits of the authentication threshold of the receiver based on its theoretical authentication test statistic standard Gaussian cumulative distribution function, noise standard deviation, first channel parameter and first distance; generates an expected watermark based on the key sent by the master control, the encryption function for generating the watermark and the source signal, and calculates the actual authentication test statistic of the receiver based on the expected watermark, the residual signal, the second channel parameter and the second distance;

[0045] The master control calculates the authentication parameters of each receiver based on the actual authentication test statistics and the upper and lower limits of the authentication threshold, and determines whether the watermark superimposed signal transmitter is legal based on the authentication parameters of all receivers.

[0046] The wireless optical communication physical layer authentication system provided by the present application includes at least three receivers and a master control; in the handshake stage, the receiver converts the message transmission request sent by the transmitter into a first electrical signal, and uses the ranging module to obtain the first distance and the first channel parameter between the current transmitter and the receiver; in the signal transmission stage, the receiver converts the received watermark superposition signal into a second electrical signal, and obtains the second distance and the second channel parameter between the receiver and the transmitter of the watermark superposition signal; at the same time, the receiver obtains the recovered watermark superposition signal, source signal and residual signal based on the received watermark superposition signal and the second estimated channel, and then generates the expected watermark based on the key, the encryption function for generating the watermark and the source signal, and calculates the actual authentication test statistic of the receiver based on the expected watermark, the residual signal, the second channel parameter and the second distance, and finally calculates the receiver based on the theoretical authentication test statistic standard Gaussian cumulative distribution function of the receiver, the noise standard deviation of the receiver, the first channel parameter and the first distance the upper and lower limits of the authentication threshold of the receiver; since the actual authentication test statistic of the receiver includes the distance information between the watermark superposition signal transmitter and the receiver, and also integrates the residual signal and the expected watermark, and the upper and lower limits of the authentication threshold include the distance information between the receiver and the transmitter, finally, the master control obtains the authentication parameters of the receiver for the transmitter by judging whether the actual authentication test statistic of each receiver is within the authentication threshold range, so as to judge whether the distance between the watermark superposition signal transmitter and the receiver has changed, and whether the watermark information in the transmitted watermark superposition signal has changed. Since at least three reference points are required to determine the position of the transmitter in the two-dimensional plane in the optical wireless positioning system, the master control can simultaneously and accurately identify the imitation attack of tampering with the signal and the replay attack of not tampering with the signal by integrating the authentication parameters of at least three receivers and checking the authentication test statistic of the integrated position information and the watermark information, so as to fully ensure the security and reliability of the wireless optical communication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to make the content of the present invention more clearly understood, the present invention is further described in detail below according to specific embodiments of the present invention in conjunction with the accompanying drawings, wherein:

[0048] Figure 1 Schematic diagram of the wireless optical communication physical layer authentication system model provided for this application;

[0049] Figure 2 A schematic diagram of the structure of the wireless optical communication physical layer authentication system provided for this application;

[0050] Figure 3 Flowchart of the wireless optical communication physical layer authentication method provided for this application;

[0051] Figure 4 This is a schematic diagram of the effect of the distance between the replay attacker and the legitimate transmitter on the distribution of the authentication test statistics of the receiver when the power allocation factor provided in this application has different values; wherein, Figure 4 (a) is the distribution of the authentication test statistic of the distance between the attacker and the legitimate transmitter on the receiver when the power allocation factor is 0.05. Figure 4 (b) is the distribution of the authentication test statistic of the receiver based on the distance between the attacker and the legitimate transmitter when the power allocation factor is 0.1;

[0052] Figure 5 A schematic diagram of the false detection probability of the wireless optical communication physical layer authentication method provided in this application for imitation attacks and replay attacks;

[0053] Figure 6 : is a schematic diagram of the false detection probability of the first receiver, the second receiver, the third receiver and the master control obtained by the method provided by the present application as the position of the replay attacker changes within the plane of the legitimate transmitting end; wherein, Figure 6 (a) is a schematic diagram of the probability of false authentication detection by the first receiver against a replay attack. Figure 6 (b) is a schematic diagram of the probability of false authentication detection of the second receiver against a replay attack. Figure 6 (c) in the figure is a schematic diagram of the probability of misdetection of authentication by the third receiver against a replay attack. Figure 6 (d) in the figure is a schematic diagram of the probability of false authentication detection for replay attacks after the master control makes a comprehensive decision. DETAILED DESCRIPTION

[0054] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0055] See also Figure 1 , Figure 1 The figure shows a schematic diagram of a wireless optical communication physical layer authentication system model provided by the present application. Figure 2 The figure shows a schematic diagram of the structure of a wireless optical communication physical layer authentication system; the wireless optical communication physical layer authentication system includes:

[0056] At least three receivers, each receiver comprising:

[0057] The photoelectric detection module is used to receive a message transmission request sent by the transmitting end in the handshake phase, convert the message transmission request into a first electrical signal and send it to the master control; receive a watermark superposition signal in the message transmission phase, and convert the watermark superposition signal into a second electrical signal;

[0058] a distance measuring module, configured to calculate a first distance between a receiver and a transmitting end and a first channel parameter based on the pilot signal strength in the first electrical signal; and to calculate a second distance between a receiver and a transmitting end of a watermark superimposed signal and a second channel parameter based on the pilot signal strength in the second electrical signal;

[0059] a data processing module, configured to obtain a restored watermark superimposed signal based on the second electrical signal and the second estimated channel, obtain a source signal based on the restored watermark superimposed signal, and obtain a residual signal based on the restored watermark superimposed signal, the source signal and a power allocation factor;

[0060] An authentication module is used to calculate the upper and lower limits of the authentication threshold of the receiver based on the standard Gaussian cumulative distribution function of the theoretical authentication test statistic of the receiver, the noise standard deviation of the receiver, the first channel parameter and the first distance; generate an expected watermark based on the key sent by the master control, the encryption function for generating the watermark and the source signal, and calculate the actual authentication test statistic of the receiver based on the expected watermark, the residual signal, the second channel parameter and the second distance;

[0061] The master control communicates with each receiver and transmitter, including:

[0062] A key update storage and watermark superposition setting module, used to generate a key and an encryption function for generating a watermark based on the first electrical signal, and send the key and the encryption function for generating the watermark to each receiver and transmitter;

[0063] The decision module is used to calculate the authentication parameters of each receiver based on the actual authentication test statistics and the upper and lower limits of the authentication threshold, and determine whether the watermark superimposed signal transmitter is legal based on the authentication parameters of all receivers.

[0064] In the handshake phase of the wireless optical communication physical layer authentication system provided by the present application, the receiver converts the message transmission request sent by the transmitter into a first electrical signal, and uses the ranging module to obtain the first distance and the first channel parameter between the current transmitter and the receiver; in the signal transmission phase, the receiver converts the received watermark superposition signal into a second electrical signal, and obtains the second distance and the second channel parameter between the receiver and the transmitter of the watermark superposition signal; at the same time, the receiver obtains the recovered watermark superposition signal, the source signal and the residual signal based on the received watermark superposition signal and the second estimated channel, and then generates the expected watermark based on the key, the encryption function for generating the watermark and the source signal, and calculates the actual authentication test statistic of the receiver based on the expected watermark, the residual signal, the second channel parameter and the second distance, and finally calculates the standard Gaussian cumulative distribution function based on the theoretical authentication test statistic of the receiver , the noise standard deviation of the receiver, the first channel parameter and the first distance to calculate the upper and lower limits of the authentication threshold of the receiver; since the actual authentication test statistic of the receiver includes not only the distance information between the watermark superimposed signal transmitter and the receiver, but also the residual signal and the expected watermark, and the upper and lower limits of the authentication threshold include the distance information between the receiver and the transmitter, finally, the master control obtains the authentication parameters of the receiver for the transmitter by judging whether the actual authentication test statistic of each receiver is within the authentication threshold range. Since at least three reference points are required to determine the position of the transmitter in the two-dimensional plane in the optical wireless positioning system, the master control can simultaneously and accurately identify the imitation attack of tampering with the signal and the replay attack without tampering with the signal by fusing the authentication parameters of at least three receivers and checking the authentication test statistic of the fused position information and watermark information.

[0065] For example, when the number of receivers is less than 3, if the watermark superimposed signal transmitter and the transmitter are located on a circle with the receiver as the center, the calculated first distance and the second distance are the same, resulting in the receiver being unable to determine whether the position of the transmitter has changed, and thus unable to determine whether the watermark superimposed signal transmitter is a legitimate transmitter. Therefore, it is necessary to fuse the position information calculated by at least 3 receivers to determine the specific location of the transmitter; in addition, each receiver will restore the received signal to obtain the expected watermark to determine whether there is an imitation attack. The more receivers there are, the more accurate the recognition result of the imitation attack will be.

[0066] Specifically, the transmitter includes:

[0067] A signal source, used to generate a source signal;

[0068] A coding and modulation module, used for processing source signals;

[0069] The key update storage and watermark superposition setting module is used to obtain the key generated by the receiving end master control and the encryption function for generating the watermark;

[0070] A watermark generation module, used to generate a watermark signal based on a key and a processed source signal after encryption by an encryption function for generating a watermark, and to make the watermark signal consistent with the length of the processed source signal;

[0071] A watermark superposition module, used for superimposing the watermark signal on the processed source signal according to the power allocation factor to obtain a watermark superposition signal;

[0072] A light source driving module, used to convert the modulated signal into an electrical signal that enables the light source to work;

[0073] Light source, used to convert electrical signals into optical signals for emission.

[0074] Specifically, the calculation formula of the actual authentication test statistic of the receiver is:

[0075]

[0076]

[0077] in, represents the actual authentication test statistic of the i-th receiver; D i ′ represents the second distance between the i-th receiver and the watermark superimposed signal transmitter; h i ′ represents the second channel parameter between the i-th receiver and the watermark superimposed signal transmitting end; represents the expected watermark generated by the i-th receiver; (·) H represents the conjugate transpose; ρ t represents the power allocation factor of the watermark superimposed signal power on the watermark signal; ρ s represents the power allocation factor of the watermark superimposed signal power on the message signal; ρ t ≤1,ρ s ≥0,ρ t 2 +ρ s 2 =1; represents the watermark superimposed signal recovered by the i-th receiver; represents the source signal obtained by the i-th receiver; r i represents the residual signal obtained by the i-th receiver; i∈[1,m], m represents the number of receivers.

[0078] The calculation formula for the receiver's authentication threshold upper limit is:

[0079]

[0080] in, represents the upper limit of the authentication threshold of the i-th receiver; θ i represents the theoretical validation test statistic for the ith receiver; represents the standard Gaussian cumulative distribution function of the theoretical certification test statistic of the i-th receiver; D i represents the first distance between the i-th receiver and the transmitter; h i represents the first channel parameter between the i-th receiver and the transmitter; L represents the length of the watermark superimposed signal; represents the upper limit of the false alarm probability of the i-th receiver; σ wi represents the noise standard deviation of the i-th receiver; ρ t represents the power allocation factor of the watermark superimposed signal power on the watermark signal; i∈[1,m], m represents the number of receivers;

[0081] The receiver's authentication lower threshold is calculated as:

[0082]

[0083] in, represents the lower authentication threshold of the i-th receiver.

[0084] The receiver's authentication parameters are expressed as:

[0085]

[0086] Among them, δ i represents the authentication parameters of the i-th receiver; represents the actual authentication test statistic of the i-th receiver; represents the upper limit of the authentication threshold of the i-th receiver; represents the lower limit of the authentication threshold of the i-th receiver; i∈[1,m], m represents the number of receivers.

[0087] Furthermore, the master control determines whether the watermark superimposed signal transmitter is legitimate based on the authentication parameters of all receivers, including:

[0088] If the cumulative product of the authentication parameters of all receivers is 1, the transmitter of the watermark superimposed signal is determined to be a legitimate transmitter;

[0089] If the cumulative product of the authentication parameters of all receivers is 0, the watermark superimposed signal transmitter is determined to be an illegal transmitter.

[0090] The formula for calculating the cumulative product of the authentication parameters of all receivers is:

[0091]

[0092] Where δ represents the product of the authentication parameters of all receivers.

[0093] Specifically, as the number of receivers increases, since each receiver will process and restore the received signal, it can more accurately determine whether the signal has been tampered with, thereby increasing the accuracy of the authentication result. However, it will also increase the complexity of the authentication process and reduce the authentication efficiency. Therefore, when the number of receivers is greater than 3, the energy-saving mode or the security mode can be selected through the master control. Specifically, the energy-saving mode only controls 3 receivers to participate in the authentication, and the security mode controls all receivers to participate in the authentication, so as to increase the accuracy of the authentication result.

[0094] Optionally, in some embodiments of the present application, the master control further includes:

[0095] an authentication receiver selection module, configured to select n receivers closest to the transmitting end as authentication receivers based on a first distance between each receiver and the transmitting end; wherein 3≤n≤m, m represents the number of receivers;

[0096] The authentication enabling module is used to control n authentication receivers to receive the watermark superimposed signal.

[0097] Since the distance between the transmitter and the receiver will affect the accuracy of signal transmission, in the embodiment of the present application, the three receivers closest to the transmitter are selected to participate in the authentication, which can save resources and improve the authentication efficiency while also taking into account the accuracy of the authentication results.

[0098] Optionally, in order to further improve the security of wireless optical communication, the key update storage and watermark superposition setting module in the master control updates the key and the encryption function for generating the watermark at preset intervals, and sends the updated key and the encryption function for generating the watermark to each receiver and transmitter, so that the transmitter generates a watermark superposition signal based on the updated key and the encryption function for generating the watermark.

[0099] In some embodiments of the present application, the encryption function for generating the watermark can choose to use a hash function, and at the same time set the power allocation factor of the watermark superposition according to security, concealment and robustness to ensure the effectiveness of the authentication watermark in the wireless optical communication environment without causing too much impact on the signal quality.

[0100] For example, according to the update time interval of the key and the encryption function for generating watermark, the key update storage and watermark superposition module can be divided into economical, conventional and enhanced types; the economical key update storage and watermark superposition module updates the key and the encryption function for generating watermark once every week, and its watermark superposition power allocation factor is set to 0.05; the conventional key update storage and watermark superposition module updates the key and the encryption function for generating watermark once every day, and its watermark superposition power allocation factor is set to 0.1; the enhanced key update storage and watermark superposition module updates the key and the encryption function for generating watermark once every hour, and its watermark superposition power allocation factor is set to 0.2.

[0101] Optionally, the master control also includes a sink, which is used to control each receiver to refuse to receive the signal sent by the transmitter when the transmitter is determined to be an illegal transmitter.

[0102] Optionally, in some embodiments of the present application, each receiver further includes a ranging compensation calibration module, which is used to calibrate the first distance and the second distance between the receiver and the transmitter by using a ranging compensation algorithm.

[0103] By using an algorithm to compensate for the ranging error caused by environmental factors and using the mean smoothing method to process the signal strength indication value, the measurement fluctuation is reduced. Considering that the attacker may not use the standard transmission power, but instead modify the transmission power to forge the location information, the ranging compensation algorithm is used to use the arrival time difference to verify the location information, which can further improve the accuracy of the measured location information.

[0104] Based on the above wireless optical communication physical layer authentication system, the present application embodiment also provides a wireless optical communication physical layer authentication method, such as Figure 3 As shown, the authentication method specifically includes:

[0105] S10: In the handshake phase, each receiver receives a message transmission request sent by the transmitter, converts the message transmission request into a first electrical signal and sends it to the master control; each receiver calculates a first distance and a first channel parameter between the receiver and the transmitter based on the pilot signal strength in the first electrical signal.

[0106] Specifically, the handshake phase is considered a secure communication phase.

[0107] S20: The master control generates a key and an encryption function for generating a watermark based on the first electrical signal, and sends the key and the encryption function for generating a watermark to each receiver and transmitter.

[0108] Specifically, the receiving end master control uses the existing upper layer protocol authentication scheme to authenticate the message transmission request from the transmitting end. If the authentication is successful, it sends a message transmission permission Acknowledge (ACK) to the transmitting end, and generates a key and an encryption function for generating a watermark at the same time;

[0109] The specific process of the transmitter obtaining the watermark superimposed signal based on the key and the encryption function that generates the watermark includes:

[0110] The source at the transmitting end generates a source signal m and performs corresponding coding and modulation on it to obtain a signal s, obtains a hash value S = f(m, k) of the source signal and the key k, converts the hash value S from a string into data of the same specification as the message and performs corresponding modulation to obtain a watermark signal t;

[0111] The watermark superposition power is set according to the watermark superposition power allocation factor negotiated in the handshake phase, and the watermark superposition signal x is generated based on the signal s, the watermark signal t and the watermark superposition power allocation factor, x = ρ s s+ρ t t, where ρ t represents the power allocation factor of the watermark superimposed signal power on the watermark signal; ρ s represents the power allocation factor of the watermark superimposed signal power on the message signal; ρ t ≤1,ρ s ≥0,ρ t 2 +ρ s 2 =1;

[0112] The light source driving module converts the watermark superimposed signal x into an electrical signal that enables the light source to work, and converts the electrical signal into an optical signal for transmission through the light source.

[0113] S30: During the message transmission phase, each receiver receives a watermark superimposed signal, converts the watermark superimposed signal into a second electrical signal, and calculates a second distance between the receiver and a transmitting end of the watermark superimposed signal and a second channel parameter based on the pilot signal strength in the second electrical signal.

[0114] S40: Each receiver obtains a restored watermark superimposed signal based on the second electrical signal and the second estimated channel, obtains a source signal based on the restored watermark superimposed signal, and obtains a residual signal based on the restored watermark superimposed signal, the source signal and a power allocation factor.

[0115] Specifically, the receiver can obtain the second channel parameter through the pilot signal in the signal sent by the transmitter and the pilot signal in the received signal, and then obtain the restored watermark superposition signal based on the second channel parameter and the watermark superposition signal part in the received signal, and finally obtain the source signal based on the restored watermark superposition signal and the corresponding decoding and demodulation method. The source signal is the signal without watermark sent by the transmitter that is restored by the receiver based on the received signal;

[0116]

[0117] in, represents the watermark superimposed signal recovered by the i-th receiver; y i represents the watermark superimposed signal received by the i-th receiver; h i ′ represents the second channel parameter obtained by the i-th receiver.

[0118] S50: Each receiver calculates the upper and lower limits of the authentication threshold of the receiver based on its theoretical authentication test statistic standard Gaussian cumulative distribution function, noise standard deviation, first channel parameter and first distance; generates an expected watermark based on the key sent by the master control, the encryption function for generating the watermark and the source signal, and calculates the actual authentication test statistic of the receiver based on the expected watermark, the residual signal, the second channel parameter and the second distance.

[0119] S60: The master control calculates the authentication parameters of each receiver based on the actual authentication test statistics and the upper and lower limits of the authentication threshold, and determines whether the watermark superimposed signal transmitter is legal based on the authentication parameters of all receivers.

[0120] In order to evaluate the performance of the receiving end and authentication method of the wireless optical communication physical layer authentication system provided by this application, this application considers a physical layer authentication system in a specific two-way indoor wireless optical scenario, where data is transmitted through infrared light in the uplink channel, and visible light is used for lighting and communication in the downlink channel. The room size is 5m×5m×3m, and there are 3 receivers at the receiving end. Receiver-1 is located at (1,2,3), receiver-2 is located at (4,2,3), and receiver-3 is located at (2,4,3). The output power of the transmitting light source is 1W, the message length is 1024, and the SHA-256 encryption function is used. The authentication mode selects the secure mode. It is assumed that the legal transmitter is located at (3,1,0.85) and the illegal transmitter is located at any position in the same plane as the legal transmitter. The illegal transmitter (ie, the attacker) will launch imitation attacks and replay attacks, and the upper limit of the acceptable false alarm probability of each receiver is set. is 0.01.

[0121] The calculation formulas for the theoretical false detection probabilities of the final imitation attack and replay attack are:

[0122]

[0123] in, represents the theoretical false detection probability of imitation attack; represents the theoretical false detection probability of the i-th receiver for the imitation attack; represents the second distance between the simulated attacker and the i-th receiver; represents the theoretical false detection probability of a replay attack; represents the theoretical false detection probability of the i-th receiver for replay attack; represents the second distance between the replay attacker and the i-th receiver; represents the second channel parameter between the i-th receiver and the replay attacker.

[0124] In order to compare the effects of different power allocations and the distance between the replay attacker and the legitimate transmitter on the distribution of the authentication test statistic, the upper limit of the acceptable false alarm probability on the receiver is set to 0.01, and the corresponding threshold is obtained. Figure 4 The figure shows the effect of the distance between the replay attacker and the legitimate transmitter on the distribution of the receiver's authentication test statistics when the power allocation factor has different values. Figure 4 (a) is the distribution of the authentication test statistic of the distance between the attacker and the legitimate transmitter on the receiver when the power allocation factor is 0.05. Figure 4 (b) in the figure is the distribution of the authentication test statistic of the receiver based on the distance between the attacker and the legitimate transmitter when the power allocation factor is 0.1. t =0.05, the imitation attacker is located at (3,1,0.85), and the replay attacker is located at (3,4,0.85); ρ t =0.1, the imitating attacker is located at (3,1,0.85), and the replay attacker is located at (3,1.5,0.85). It can be seen that the distribution of the authentication test statistic obtained after 100,000 Monte Carlo simulations is consistent with the theoretical distribution and presents a Gaussian distribution. The mean of the test statistic of the imitating attacker is 0. The closer the position of the replay attacker is to Alice, the closer the statistical distribution of the two is.

[0125] Verify the authentication performance of the method provided by this application against imitation attacks and replay attacks: the position of the illegal transmitter is (x, 1, 0.85), as x changes, the false detection probability is as follows Figure 5 As shown, in ρ t =0.05, when the distance between the replay attacker and the legitimate transmitter is greater than 0.5m, the false detection probability can reach nearly 0%. t=0.1, when the distance between the replay attacker and the legitimate transmitter is greater than 0.3m, the false detection probability can reach nearly 0%. In addition, for imitation attacks, the method provided by the present application can achieve 100% authentication accuracy.

[0126] Setting ρ t = 0.1, and the verification is performed in the plane where the legal transmitter is located. The authentication performance of the method provided by the present application for replay attacks is: the illegal transmitter position is (x, y, 0.85), and as x and y change, the false detection probability is as follows: Figure 6 As shown. Figure 6 As shown in (a), (b), and (c), when the replay attacker is located on a concentric circle centered on the projection of receiver-i in the plane, receiver-i cannot identify the replay attack. When the receiver's authentication results are jointly executed by the decision module provided by the receiving end through the master control, when the distance between the legitimate transmitter and the replay attacker exceeds 0.2m, the false detection probability is less than 5%, as shown in FIG. Figure 6 As shown in (d) in .

[0127] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0128] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0129] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0130] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0131] Obviously, the above embodiments are merely examples for the purpose of clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the present invention.

Claims

1. A wireless optical communication physical layer authentication system, characterized in that: include: At least three receivers, each receiver comprising: The photoelectric detection module is used to receive a message transmission request sent by the transmitting end in the handshake phase, convert the message transmission request into a first electrical signal and send it to the master control; receive a watermark superposition signal in the message transmission phase, and convert the watermark superposition signal into a second electrical signal; a distance measuring module, configured to calculate a first distance between a receiver and a transmitting end and a first channel parameter based on the pilot signal strength in the first electrical signal; and to calculate a second distance between a receiver and a transmitting end of a watermark superimposed signal and a second channel parameter based on the pilot signal strength in the second electrical signal; a data processing module, configured to obtain a restored watermark superimposed signal based on the second electrical signal and the second estimated channel, obtain a source signal based on the restored watermark superimposed signal, and obtain a residual signal based on the restored watermark superimposed signal, the source signal and a power allocation factor; The authentication module is used to calculate the upper and lower limits of the authentication threshold of the receiver based on the standard Gaussian cumulative distribution function of the theoretical authentication test statistic of the receiver, the noise standard deviation of the receiver, the first channel parameter and the first distance; generate an expected watermark based on the key sent by the master control, the encryption function for generating the watermark and the source signal, and calculate the actual authentication test statistic of the receiver based on the expected watermark, the residual signal, the second channel parameter and the second distance; the master control is connected to each receiver and the transmitter in communication, including: A key update storage and watermark superposition setting module, used to generate a key and an encryption function for generating a watermark based on the first electrical signal, and send the key and the encryption function for generating the watermark to each receiver and transmitter; The decision module is used to calculate the authentication parameters of each receiver based on the actual authentication test statistics and the upper and lower limits of the authentication threshold, and determine whether the watermark superimposed signal transmitter is legal based on the authentication parameters of all receivers.

2. The wireless optical communication physical layer authentication system according to claim 1, characterized in that: The actual authentication test statistic for the receiver is calculated as: in, represents the actual authentication test statistic of the i-th receiver; D i ′ represents the second distance between the i-th receiver and the watermark superimposed signal transmitter; h i ′ represents the second channel parameter between the i-th receiver and the watermark superimposed signal transmitting end; represents the expected watermark generated by the i-th receiver; (·) H represents the conjugate transpose; ρ t represents the power allocation factor of the watermark superimposed signal power on the watermark signal; ρ s represents the power allocation factor of the watermark superimposed signal power on the message signal; ρ t ≤1,ρ s ≥0,ρ t 2 +ρ s 2 =1; represents the watermark superimposed signal recovered by the i-th receiver; represents the source signal obtained by the i-th receiver; r i represents the residual signal obtained by the i-th receiver; i∈[1,m], m represents the number of receivers.

3. The wireless optical communication physical layer authentication system according to claim 1, characterized in that: The calculation formula for the receiver's authentication threshold upper limit is: in, represents the upper limit of the authentication threshold of the i-th receiver; θ i represents the theoretical validation test statistic for the ith receiver; represents the standard Gaussian cumulative distribution function of the theoretical certification test statistic of the i-th receiver; D i represents the first distance between the i-th receiver and the transmitter; h i represents the first channel parameter between the i-th receiver and the transmitter; L represents the length of the watermark superimposed signal; represents the upper limit of the false alarm probability of the i-th receiver; σ wi represents the noise standard deviation of the i-th receiver; ρ t represents the power allocation factor of the watermark superimposed signal power on the watermark signal; i∈[1,m], m represents the number of receivers; The receiver's authentication lower threshold is calculated as: in, represents the lower authentication threshold of the i-th receiver.

4. The wireless optical communication physical layer authentication system according to claim 1, characterized in that: The receiver's authentication parameters are expressed as: Among them, δ i represents the authentication parameters of the i-th receiver; represents the actual authentication test statistic of the i-th receiver; represents the upper limit of the authentication threshold of the i-th receiver; represents the lower limit of the authentication threshold of the i-th receiver; i∈[1,m], m represents the number of receivers.

5. The wireless optical communication physical layer authentication system according to claim 1, characterized in that: Determining whether the watermark superimposed signal transmitter is legitimate based on the authentication parameters of all receivers includes: If the cumulative product of the authentication parameters of all receivers is 1, the transmitter of the watermark superimposed signal is determined to be a legitimate transmitter; If the cumulative product of the authentication parameters of all receivers is 0, the watermark superimposed signal transmitter is determined to be an illegal transmitter.

6. The wireless optical communication physical layer authentication system according to claim 1, characterized in that: When the number of receivers is greater than 3, the master control further includes: an authentication receiver selection module, configured to select n receivers closest to the transmitting end as authentication receivers based on a first distance between each receiver and the transmitting end; wherein 3≤n≤m, m represents the number of receivers; The authentication enabling module is used to control n authentication receivers to receive the watermark superimposed signal.

7. The wireless optical communication physical layer authentication system according to claim 1, characterized in that: The key update storage and watermark superposition setting module updates the key and the encryption function for generating the watermark at preset intervals, and sends the updated key and the encryption function for generating the watermark to each receiver and transmitter.

8. The wireless optical communication physical layer authentication system according to claim 1, characterized in that: The master control also includes a sink, which is used to control each receiver to refuse to receive the watermark superimposed signal when the watermark superimposed signal transmitting end is determined to be an illegal transmitting end.

9. The wireless optical communication physical layer authentication system according to claim 1, characterized in that: Each receiver also includes a distance measurement compensation calibration module, which is used to calibrate the first distance and the second distance using a distance measurement compensation algorithm.

10. A wireless optical communication physical layer authentication method, characterized in that: A wireless optical communication physical layer authentication system as claimed in any one of claims 1 to 9, comprising: In the handshake phase, each receiver receives a message transmission request sent by the transmitter, converts the message transmission request into a first electrical signal and sends it to the master control; each receiver calculates a first distance and a first channel parameter between the receiver and the transmitter based on the pilot signal strength in the first electrical signal; The master control generates a key and an encryption function for generating a watermark based on the first electrical signal, and sends the key and the encryption function for generating the watermark to each receiver and transmitter; In the message transmission stage, each receiver receives the watermark superimposed signal and converts the watermark superimposed signal into a second electrical signal; and calculates a second distance and a second channel parameter between the receiver and the watermark superimposed signal transmitting end based on the pilot signal strength in the second electrical signal; Each receiver obtains a restored watermark superimposed signal based on the second electrical signal and the second estimated channel, obtains a source signal based on the restored watermark superimposed signal, and obtains a residual signal based on the restored watermark superimposed signal, the source signal and a power allocation factor; Each receiver calculates the upper and lower limits of the authentication threshold of the receiver based on its theoretical authentication test statistic standard Gaussian cumulative distribution function, noise standard deviation, first channel parameter and first distance; generates an expected watermark based on the key sent by the master control, the encryption function for generating the watermark and the source signal, and calculates the actual authentication test statistic of the receiver based on the expected watermark, the residual signal, the second channel parameter and the second distance; The master control calculates the authentication parameters of each receiver based on the actual authentication test statistics and the upper and lower limits of the authentication threshold, and determines whether the watermark superimposed signal transmitter is legal based on the authentication parameters of all receivers.

Images