Wireless communication system

Abstract

The present invention relates to a method for transmitting a payload in a secure manner, the method comprising: an initiator generating an initiation message, the initiator performing a first modification of one or more physical characteristics of the initiation message, and the initiator transmitting the modified initiation message to a responder; the responder receives the modified initiation message from the initiator; the responder measuring one or more incoming physical characteristics of the received modified initiation message; the responder creates a response message to be sent back to the initiator; the responder modifying one or more physical characteristics of the response message based on a second modification comprising a combination of the measured incoming physical characteristics and the payload, transmitting the modified response message to the initiator; the initiator receives the modified response message; the initiator modifies the received modified response message based on the first modification, and extracts the payload from the received modified response message.

Description

Technical Field

[0001] The present invention relates to a method for transmitting messages in a secure manner and a corresponding device and system. The present invention is particularly relevant to wired communication systems and wireless communication systems (e.g., cellular systems such as 5G or 6G, or Wifi systems, or ad hoc systems, satellite communication systems, or optical fiber communication systems). Background Art

[0002] In a communication network, messages are exchanged between different stations, e.g. mobile stations (or user equipment (UE) in a 5G example), base stations (gNBs in a 5G system), relays. In order to ensure the authenticity of the different stations and / or to prevent others from eavesdropping on the exchanged message(s), it is known to use encryption (e.g. using a shared encryption key or some kind of authenticity signature).

[0003] However, sharing the encryption key also needs to be done in a secure manner so that the security of future communications is not compromised. In some systems, the keys are pre-stored in each device so that this step can be skipped. However, this limits the possibility of more robust dynamic keys and reduces the risk of compromising the entire system. Moreover, this may raise privacy issues. Therefore, in many systems, dynamic shared keys (i.e., keys generated for the current communication) are preferred. Because there is no shared encryption secret between the two parties, distributing the keys is a very critical step.

[0004] Key exchange methods may indeed have many problems, such as the reliability of the exchanged key (can it be intercepted, or can it be strong enough due to its limited length), or the lack of authentication between the initiator and the responder. In addition, specific methods need to be found that are compatible with communication systems such as 5G. Due to the lack of protection of the initial message and L1 and L2 signaling messages in 5G, 5G is vulnerable to certain attacks, such as:

[0005] Sparrow attacks, where UEs that are not registered with the network are able to communicate with each other via the base station;

[0006] Unprotected exchange of certain fields in the initial message, e.g. priority access;

[0007] Unprotected exchange of low-layer signaling messages allows attacks such as IP spoofing and SUPI capture;

[0008] Unprotected RRC connection setup, e.g., no sensitive information can be shared with the network or base station.

[0009] Furthermore, wireless systems such as cellular networks can support a variety of low-power devices, such as IoT tags, powerful mobile user equipment (UE) (e.g., smartphones, V2X-connected vehicles, etc.), or infrastructure devices (e.g., fixed and / or mobile gNBs, V2X roadside units, etc.) with various capabilities in terms of processing power, energy consumption, storage space, etc. Therefore, the key exchange method also needs to consider these limitations. For example, while having the same security requirements as other devices (e.g., identity authentication, data protection, privacy protection, etc.), ambient (or passive) IoT are micro-computing devices that rely on energy harvesting from ambient radio waves to power themselves. Therefore, it is necessary to find a method that can be supported by such devices to meet their security needs. Summary of the invention

[0010] The object of the present invention is to alleviate the above mentioned problems.

[0011] Another object of the present invention is to provide a protocol to exchange messages (e.g., data, such as a network identity assigned to a device, encryption keys or other encryption / authentication material) between two entities of a network in a secure manner.

[0012] Another object of the present invention is to provide a communication system that is capable of exchanging payloads in a secure manner without requiring prior exchange of cryptographic material or pre-shared storage keys.

[0013] Another object of the present invention is to provide a device having means for securely sending a payload (eg an encryption key or a secret used in subsequent stages of the communication) in a secure manner when establishing a connection.

[0014] These objects are achieved by a method, a communication device, a computer program product and a system as defined in the appended claims.

[0015] Therefore, according to a first aspect of the present invention, a method for transmitting a payload in a secure manner is proposed, the method comprising:

[0016] The responder receives the initiation message from the initiator.

[0017] The responder measures one or more incoming physical characteristics of the received initiation message,

[0018] creating a response message to be sent back to the initiator,

[0019] modifying one or more physical characteristics of the response message based on a combination of the measured incoming physical characteristics and the payload,

[0020] The modified response message is transmitted to the initiator.

[0021] Thus, the invention defined in the first aspect enables a bit stream (e.g. a payload) determined by a responder device to be encapsulated by means of the physical characteristics of a message received from an initiator. This set of physical characteristics is thus linked to the initiator and the path link through which the received message propagates. It then enables the initiating device to decapsulate it in a secure manner. The bit stream may be a key, which (or a value derived therefrom) can then be used for security purposes (e.g. encryption in a later operational phase of the communication). Since the bit stream is completely determined by the responder, the bit stream may be a key including some redundant information (e.g. error correction) to improve the reliability of the scheme.

[0022] In a first variation of the first aspect, the combination of the measured incoming physical signal characteristic and the payload comprises:

[0023] encoding the payload into a codeword comprising a set of bits, and mapping the set of bits of the codeword to a set of mapped physical property values,

[0024] The combination is generated as a difference between the measured incoming physical signal characteristic and the set of mapped physical characteristic values.

[0025] In a second variant of the first aspect which can be combined with the first variant, the payload is an encryption key used by the initiator for secure communication with the responder.

[0026] In a third variant of the first aspect that can be combined with the first variant, the payload can be a radio network identifier (e.g., RNTI), a preamble (e.g., a RACH preamble), or any data to be used by the initiator and the responder (e.g., for communication).

[0027] In a fourth variant of the first aspect that can be combined with the first and / or second and / or third variants, the physical characteristics of the initiation message and the physical characteristics of the response message respectively include one or more of the following: the phase of each carrier, or the phase difference of each carrier relative to a reference carrier, or the gain of each carrier, or the gain difference of each carrier relative to a reference carrier, or the polarization of each beam relative to a reference beam, or a modulation symbol, or a gain value applied to each beam, or an OAM mode, or a phase pattern in an OAM mode.

[0028] In a fifth variant, which can be combined with other variants, the payload comprises a useful payload and one or more of: one or more groups of parity check bits, one or more groups of cyclic redundancy check bits, or a reliability bit string known to the initiator.

[0029] In a sixth variation, which can be combined with any of the previous variations, the payload is obtained by applying a forward error correction algorithm to a set of information bits.

[0030] In a seventh variation of the first aspect, which can be combined with any of the previous variations, the payload is obtained by interleaving a set of information bits with a corresponding string of reliability bits known to the initiator.

[0031] In an eighth variation of the first aspect which can be combined with the previous variations, the payload comprises an encapsulation key for protecting data encoded (eg QAM encoded) in the signal carrier (eg encrypting the data using the encapsulation key).

[0032] In a ninth variation of the first aspect which can be combined with the eighth variation, the encapsulation key is concatenated or interleaved with the encrypted data or the encapsulated data.

[0033] According to a second aspect of the present invention, a method for exchanging payloads in a secure manner is proposed, the method comprising:

[0034] an initiator generates an initiation message, the initiator performs a first modification of one or more physical characteristics of the initiation message, and the initiator transmits the modified initiation message to a responder,

[0035] The responder receives a modified initiation message from the initiator,

[0036] The responder measures one or more incoming physical characteristics of the received modified initiation message,

[0037] The responder creates a response message to be sent back to the initiator,

[0038] the responder modifying one or more physical characteristics of the response message based on a second modification comprising a combination of the measured incoming physical characteristic and the payload,

[0039] transmitting the modified response message to the initiator,

[0040] The initiator receives the modified response message,

[0041] The initiator modifies the received modified response message based on the first modification and extracts the payload from the received modified response message.

[0042] In a first variation of the second aspect, the combination of the measured incoming physical signal characteristic and the payload comprises:

[0043] encoding the payload into a codeword comprising a set of bits, and mapping the bit groups of the codeword to a set of mapped physical characteristic values,

[0044] The combination is generated as a difference between the measured incoming physical signal property value and the set of mapped physical property values.

[0045] In a second variant of the second aspect which can be combined with the first variant, the payload is an encryption key used by the initiator for secure communication with the responder.

[0046] In a third variant of the second aspect that can be combined with the first variant, the payload can be a radio network identifier (e.g., RNTI), a preamble (e.g., a RACH preamble), or any data to be used by the initiator and the responder (e.g., for communication).

[0047] In a fourth variation of the second aspect, which can be combined with any of the previous variations, the first modification is a random variation of one or more physical characteristics of the initiation message.

[0048] In a fifth variation of the second aspect that can be combined with any of the preceding variations, the physical characteristics of the initiation message and the physical characteristics of the response message respectively include one or more of the following: the phase of each carrier, or the phase difference of each carrier relative to a reference carrier, or the gain of each carrier, or the gain difference of each carrier relative to a reference carrier, or the polarization of each beam relative to a reference beam, or a modulation symbol, or a gain value applied to each beam, or an OAM mode, or a phase pattern in an OAM mode.

[0049] In a sixth variation of the second aspect which can be combined with any of the preceding variations, the payload comprises a useful payload and one or more of: one or more groups of parity bits, one or more groups of cyclic redundancy check bits, or a reliability bit string known to the initiator.

[0050] In a seventh variation of the second aspect, which can be combined with any of the previous variations, the payload is obtained by applying a forward error correction algorithm to a group of information bits.

[0051] In an eighth variation of the second aspect which can be combined with any of the previous variations, the payload is obtained by interleaving a set of information bits with a corresponding string of reliability bits known to the initiator.

[0052] In a ninth variation of the second aspect which can be combined with any of the preceding variations, the payload comprises an encapsulation key for protecting data encoded (eg, QAM encoded) in the signal carrier (eg, encrypting the data using the encapsulation key).

[0053] In a tenth variation of the second aspect which can be combined with the ninth variation of the second aspect, the encapsulation key is concatenated or interleaved with the encrypted data and / or the encapsulated data.

[0054] According to a third aspect of the present invention, a computer program product is proposed comprising code means for producing the steps of the first aspect or the second aspect of the present invention (possibly including any of their respective variations) when run on a computer device.

[0055] According to a fourth aspect of the present invention, a method for receiving a payload in a secure manner is proposed, the method comprising:

[0056] The initiator generates an initiation message.

[0057] The initiator performs a first modification of one or more physical characteristics of the initiation message,

[0058] The initiator transmits the modified initiation message to the responder,

[0059] The initiator receives the response message,

[0060] modifying the response message based on the first modification, and

[0061] The payload is extracted from the modified response message.

[0062] In a first variant of the fourth aspect of the invention, the payload corresponds to an encryption key, and the initiator uses the encryption key to decrypt additional data transmitted in the received message.

[0063] Any variation of the first aspect or the second aspect of the present invention may be combined with the fourth aspect of the present invention or its first variation.

[0064] The following variants can be combined with any variant of the aspects described above. First, the initiator and the responder can be terminal devices and / or relays (e.g., UE-to-UE relay or UE-to-network relay) that communicate by means of a sidelink communication link. In addition, the initiator can be a UE (e.g., V2X UE, ProSe UE, etc.) or an access device (e.g., gNB), and the responder is a passive / environmental IoT device. In addition, the first responder plays the role of a second initiator that exchanges a payload with the second responder, thereby combining the initiator role with the responder role and implementing each role function in a separate communication link. In addition, when the device (terminal UE and / or UE-to-UE relay) is not provided with discovery security material and / or has an expired long-term certificate, the established secret key is used as a backup option.

[0065] Additionally, the established secret key may be combined with the established or provided security material to derive a cryptographic key or MIC or a scrambling sequence or an encryption sequence by means of a cryptographic function, which may be a key derivation function, an encryption algorithm or an integrity algorithm.

[0066] According to a fifth aspect of the present invention, a communication device for transmitting a payload in a secure manner is provided, the communication device comprising:

[0067] Receiver,

[0068] Transmitter,

[0069] controller, and

[0070] A memory for storing instructions for causing the following operations:

[0071] The receiver receives an initiation message from an initiator,

[0072] The controller measures one or more incoming physical characteristics of the received initiation message,

[0073] The controller creates a response message to be sent back to the initiator,

[0074] The controller modifies one or more physical characteristics of the response message based on a combination of the measured incoming physical characteristics and the payload,

[0075] The transmitter transmits the modified response message to the initiator.

[0076] According to a sixth aspect of the present invention, a communication device for receiving a payload in a secure manner is provided,

[0077] The communication device includes a controller, a transmitter, a receiver, and a memory, wherein the memory includes instructions for causing the following operations:

[0078] - the controller generates an initiation message and performs a first modification of one or more physical characteristics of the initiation message,

[0079] - the transmitter transmits the modified initiation message to the responder, and the receiver receives the modified response message,

[0080] - The controller modifies the received modified response message based on the first modification and extracts the payload from the received modified response message.

[0081] According to a seventh aspect of the present invention, a communication system for exchanging payloads in a secure manner is proposed,

[0082] The communication system includes an initiator and a responder.

[0083] The initiator includes an initiator controller, an initiator transmitter, an initiator receiver, and an initiator memory, wherein the initiator memory includes instructions, and the instructions are used to cause the following operations:

[0084] - the initiator controller generates an initiation message and performs a first modification of one or more physical characteristics of the initiation message,

[0085] - the initiator transmitter transmits the modified initiation message to the responder, and

[0086] - the initiator receiver receives the modified response message,

[0087] - the initiator controller modifies the received modified response message based on the first modification and extracts the payload from the received modified response message,

[0088] The responder includes a responder receiver, a responder transmitter, a responder controller, and a responder memory, wherein the responder memory includes instructions for causing the following operations:

[0089] - the responder receives a modified initiation message from the initiator,

[0090] - the responder controller measures one or more incoming physical characteristics of the received modified initiation message,

[0091] - the responder controller modifies one or more physical characteristics of the response message based on a second modification comprising a combination of the measured incoming physical characteristic and the payload, thereby creating a modified response message,

[0092] - The responder transmitter transmits the modified response message to the initiator.

[0093] Note that the above-mentioned apparatus may be implemented based on an arrangement of discrete hardware circuits, integrated chips or chip modules having discrete hardware components, or based on a signal processing device or chip controlled by a software routine or program stored in a memory, written on a computer-readable medium or downloaded from a network such as the Internet.

[0094] It should be understood that the method according to claim 1, the method according to claim 8, the method according to claim 17, the computer program product according to claim 19, the communication device according to claim 20, the communication device according to claim 21 and the communication system according to claim 22 may have similar and / or identical preferred embodiments, in particular as defined in the dependent claims.

[0095] It shall be understood that a preferred embodiment of the invention can also be any combination of the dependent claims or of the above-described embodiments with the respective independent claim.

[0096] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] In the following drawings:

[0098] Figure 1 is a block diagram showing a network for implementing an embodiment of the present invention,

[0099] Figure 2 is a block diagram representing a mobile station operating in accordance with an embodiment of the present invention,

[0100] Figure 3 is a block diagram showing a base station operating in accordance with an embodiment of the present invention,

[0101] Figure 4 is a flow chart showing communication according to a first embodiment of the present invention,

[0102] Figure 5 is a flow chart representing communications according to an embodiment of the present invention,

[0103] Figure 6 is a flow chart representing communications according to an embodiment of the present invention,

[0104] Figure 7 is a flow chart representing communications according to an embodiment of the present invention,

[0105] Figure 8 is a block diagram showing operations in a communication unit of a physical layer according to an embodiment of the present invention,

[0106] Fig. 9 is a diagram showing an encoding / decoding process according to an embodiment of the present invention,

[0107] Fig.10 is a flow chart showing communication according to a second embodiment of the present invention suitable for a 5G network,

[0108] Fig.11 is a block diagram schematically showing a network and devices involved in sidelink communication in an embodiment of the present invention,

[0109] Fig.12 is a flow chart showing communications according to a third embodiment of the present invention suitable for 5G sidelink communications,

[0110] Fig.13 is a flow chart showing communications according to a variation of the third embodiment of the present invention suitable for 5G sidelink communications. DETAILED DESCRIPTION

[0111] Embodiments of the present invention will now be described with reference to the accompanying drawings. As mentioned above, embodiments of the present invention can be implemented in different types of networks (particularly in wireless networks, or in optical fiber networks or satellite-based communication networks or visible light communications). Figure 1 In the specific example shown, a cellular network is depicted. Such a cellular network may be a 3g, 4g or 5g network or even a Wifi network. Each cell 10 is served by a base station 100 (e.g. a gNB in ​​5G). A plurality of secondary stations are located in the vicinity of the cell 10 and the base station 100. At least some of these secondary stations 120 are capable of communicating directly with the base station 100. In addition, some of the secondary stations are capable of acting as relay stations in that they include functionality to relay communications between the base station 100 and another secondary station 110. This relay functionality helps, for example, to extend the coverage of the cell 10 to a secondary station 110 that is out of coverage (OoC). The relay station may be a mobile station (e.g. a UE) or may be a different type of device. Since 4G and 5G networks include the possibility of relaying by a UE including a sidelink functionality, in this example, Figure 1 The relay station and the secondary station 110 may be UEs including a sidelink function.

[0112] Embodiment 1: Physical layer key encapsulation scheme

[0113] According to this first embodiment and with reference to Figure 2, the mobile station 120 typically includes an antenna 21 or an antenna array (e.g., for a MIMO-compatible wireless terminal). The antenna 21 is coupled to a communication unit 22 including a receiver 221 and a transmitter 222. The communication unit 22 may be compatible with 3GPP standards such as UMTS, LTE, or NR, and operates accordingly according to the current connection. In one embodiment, a controller 23 such as a microprocessor is included to control the communication unit and its receiver 221 and transmitter 222. It should be noted that the controller 23 may be dedicated to the communication unit 22 or even included in the communication unit 22. The controller 23 may also operate other systems, not just dedicated to the communication unit 22. Typically, some or all of the processes involved may be operated by software stored in a memory 24 (e.g., ROM or EEPROM) of the mobile station 120. However, it is also possible that the entire invention is included in the hardware of the components.

[0114] Similarly, in Figure 3 As can be seen above, the base station 100 typically includes an antenna 31 or an antenna array (e.g., for a MIMO-compatible wireless terminal). The antenna 31 is coupled to a communication unit 32 including a receiver 321 and a transmitter 322. The communication unit 32 may be compatible with 3GPP standards such as UMTS, LTE, or NR, and operates accordingly according to the current connection. In one embodiment, a controller 33 such as a microprocessor is included to control the communication unit and its receiver 321 and transmitter 322. It should be noted that the controller 33 may be dedicated to the communication unit 32 or even included in the communication unit 32. The controller 33 may also operate other systems, not just dedicated to the communication unit 32. Typically, some or all of the processes involved may be operated by software stored in a memory 34 (e.g., ROM or EEPROM) of the base station 100. However, it is also possible that the entire invention is included in the hardware of the component.

[0115] According to a first embodiment of the present invention, a mobile station 120 (the initiator) that wishes to initiate a connection begins by generating a request message. Figure 4 As can be seen from the figure, the physical characteristics of the request message are modified, and this modification may be random. In this example, at step 1, the initiator may assign, for example, a random phase to the subcarrier carrying the request message to form a modified request message S I Then, at step 2, the modified request message S I is transmitted to the responder (eg, base station 100). Figure 4 Only the phase θ of the i-th subcarrier is shown in I,I However, the modification may be performed on all carriers or a subset of carriers.

[0116] These random phases can be applicable to carriers in, for example, orthogonal frequency division multiplexing (OFDM) systems. The use of randomized physical properties in this and other embodiments can also be applicable to other physical properties in OFDM systems, for example, physical properties related to the amplitude of the carrier. If different types of digital transmission systems or modulations are applied, the physical properties of the modified message can also be of different natures, for example, in the case of a digital transmission system that relies on orbital angular momentum (OAM), the physical properties can refer to the OAM mode or the initial phase of the OAM mode. For example, in the case of a system that relies on a digital transmission system based on polarization division multiplexing, the physical properties can refer to phase shift or polarization sensing. For example, in a spatial modulation system, the physical property can be a phase shift randomized constellation mapping.

[0117] At step 3, the responder receives S I , and its controller estimates the equivalent channel phase φ I@R,i , which is affected by the noise due to the channel response and phase estimation error, so that φ I@R,I＝ φ h,i +φ I,i +φ ε,i Therefore, in addition to the first phase modification generated by the initiator, other perturbations occur that are related to the specific propagation path between the initiator and the responder.

[0118] Then, at step 4: the responder generates a message, for example, a random key K to be used between the initiator and the responder for future secure communication. In addition to the key, it can also be another private data, for example, identity authentication, or a message K dedicated only to the initiator.

[0119] At step 5, the secret message K is encoded (or transformed) into a set of phases on different carriers. For example, the message K can be mapped to the following secret phases:

[0120] Let m be the number of bits for encoding each phase, and K = [K seq,1 ,K seq,2 ...K seq,N ] is a randomly generated secret key K, such that K seq,i is a bit sequence of length m. Let F be a mapping function also known by the initiator:

[0121]

[0122] where D(s) can be the decimal equivalent of reflected binary code (RBS)s, which will be described in detail later. For this reason, the responder will seq,i Each of them is mapped to its corresponding phase.

[0123] At step 6: Use the channel phase estimate from step 3 to encapsulate the secret phase φ as follows K,i :φ R,i =φ K,i -φ I@R,i Encapsulation can be viewed as a form of encryption, whereby only one party in the same channel knows φ I,I The correct key K can be extracted because the "encryption" is associated with the message propagation path between the initiator and the responder.

[0124] In step 7, the responder sends S R , the S R The secret message is encapsulated within the phase of its subcarrier.

[0125] In step 8, similar to step 3, the initiator R Estimate the equivalent channel phase, S R is given as: R@I,i =φ h,i +φ R,i +φ εε′,i .

[0126] In step 9, φ I,i Add to φ R@I,i , thus K,i In fact, it can be seen from the following that by adding an initial random set of physical properties (here the phase), the initiator is allowed to obtain a phase φ with some residual error K,I .

[0127] In particular, it can be shown that:

[0128] φ R@I,i =φ h,i +φ R,i +φ′ ε,i

[0129] =φ h,i +φ K,i -φ I@R,i +φ′ ε,I (Use φ R,i Replace it with its equivalent in step 6)

[0130] =φ h ,i+φ K,i -(φ h ,i+φ I,i +φ ε,i )+φ ε′,i (Use φ I@R,i Replace it with its equivalent in step 3)

[0131] =φ K,i -φ I,i-φ ε,i +φ ε′,i

[0132] φ R@I,i +φ I,i =φ K,i -φ I ,i-φ ε,i +φ ε′,i +φ I ,i(add φ I,i To φ K,i Demasking)

[0133] =φ K,i -φε,i+φε′,i

[0134] Then, at step 10: the initiator can K,i are decoded to retrieve the bit sequences to which they are mapped. Ideally, these bit sequences will be equivalent to K seq,i , thus finally reconstructing the secret message K. The extraction process can be described as follows:

[0135] Let m be the agreed number of bits for encoding each phase, and φ' K,i =φ K,i -φ ε,i +φ ε′,i .

[0136] The interval [0, 2π] is divided into 2 m equal subintervals, each of which is mapped to a bit sequence following RBC ordering. The jth subinterval is defined as:

[0137]

[0138] Among them, 0≤j≤2 m -1.

[0139] Based on φ K′,i Which interval does it fall into? The secret bit sequence is retrieved as:

[0140] F -1 (φ' K,i )=RBC(j)

[0141] If there is no error, then F -1 (φ' K,i )=K seq,i ,assumed

[0142] Therefore, by retrieving the bit sequence of the phases of all subcarriers, the initiator is able to reconstruct the secret message K.

[0143] In this and other embodiments, Figure 4, Figure 5 , Figure 6 and Figure 7 The Greek letter φ used in Fig. 9 and Fig.10 The Greek letter θ used in θ represents the same physical property of a signal (eg, phase). This notation can be adapted to represent other physical properties.

[0144] exist Fig. 9 The following is an example of how the secret key bit sequence K can be encoded and decoded. seq,i Mapped to its corresponding phase θ K,i , and then extract the samples at the receiving end.

[0145] exist Fig. 9 On the left side, for m = 2, K seq,i ∈{00, 01, 10, 11}, the bit sequence is mapped to the phase as follows, F(K seq,i )produce:

[0146]

[0147] That is why, Fig. 9 The bit sequence 11 shown in the left part of is mapped to, for example, π. Fig. 9 The right side of , extracts the bit sequence from the secret phase as follows:

[0148]

[0149] Because of this, θ' K,i ≈10π / 9, which falls within the third subinterval (j=2), yielding Seq i = 11. In this case, the extracted bit sequence is equivalent to the expected K seq,i .

[0150] In the above examples, the following references are noted:

[0151] Two communicating parties may be using the same channel h, which is assumed to remain unchanged during the handshake or communication establishment process. It is further defined as follows:

[0152] ·S I , S R : Signals transmitted by the initiator and responder to each other respectively.

[0153] ·φ I,i ,φ R,i : The phase of the i-th subcarrier transmitted by the initiator and the responder respectively; φ I,i Can be random and the responder does not know it.

[0154] ·φε,i ,φ ε ′, i: Phase estimation error of the phase extracted from the received signal.

[0155] ·φ I@R,i ,φ R@I,i : The equivalent channel phase estimated when the responder and the initiator receive respectively.

[0156] ·φ K,i : The secret phase derived from the randomly generated key K.

[0157] It should be noted that in this example, the initiator is the mobile station 120, and the responder is the base station 100. However, like the following embodiments, this embodiment can be applied to the case where the initiator is the base station 100 and the responder is the mobile station 120. These embodiments are also applicable to the case where the initiator and the responder are the same type of devices (for example, two mobile stations 120 or two base stations 100, or two wireless stations). In addition, in the embodiment shown, the initiating medium (for example, bandwidth) and the responding medium are completely the same (or related to each other) (here is channel h). However, the present invention can also be implemented for the case where the responding medium is narrower but, for example, is included in the initiating medium or at least related medium (for example, when their respective carrier groups are not too far apart).

[0158] Thus, in this first embodiment, as in the following embodiments, two parties are involved: an initiator and a responder. These two parties may be, for example:

[0159] o UE and base station (or vice versa)

[0160] o The first UE and the second UE

[0161] o Base station and smart repeater (or vice versa)

[0162] o A first wireless repeater and a second wireless repeater (eg, two IAB nodes or two satellites)

[0163] o WiFi Stations and WiFi Access Points (or vice versa)

[0164] oTransmitters and receivers in optical communication links (e.g., fiber optic communication links).

[0165] The initiator sends an initial probe message whose physical properties are first modified, which is received by the responder. The responder can determine or select a key K or generate a message K, encapsulating K by modifying the physical properties based on the estimation results. The responder then sends a reply message containing the encapsulated message K.

[0166] Finally, the initiator receives the reply message and decapsulates it by applying the same modifications as the initial phase.

[0167] This first embodiment can be supplemented with the following modifications.

[0168] The secret message may be an encapsulated FEC codeword. This allows for a more robust transmission and increases the number of bits m encoded per phase (or other physical property). Figure 5 This variation is shown. This second embodiment is similar to the first embodiment with respect to steps 1-4. At step 5, a forward error correction (FEC) algorithm is applied to the randomly generated secret message K to obtain a codeword C.

[0169] At step 6, the codeword C is converted into a phase φ C,i , for example following a mapping of Gray code / Reflected Binary Code (RBC) to phase. RBC is an ordering of binary sequences such that two consecutive values ​​differ by only one bit. Therefore, by using RBC, the bit error rate is reduced during decoding because only one bit changes between the sequence mapped to interval j and the sequence mapped to intervals j+1 and j-1. Steps 7-11 are similar to Figure 4 Steps 6-10 of the first embodiment of . Finally, at step 12, the secret message K is retrieved using the received codeword.

[0170] Additionally or as a variant, it is possible to include a reliability bit string and / or CRC in the encoded secret. For steps 1-4, Figure 6 The third embodiment shown is similar to the first embodiment. At step 5, a reliability bit string (RBS), also known to the initiator, is concatenated with the randomly generated secret message K. Alternatively, the RBS can be interleaved with K.

[0171] Steps 6-10 are similar to Figure 4 Steps 5-9 of the first embodiment.

[0172] At step 11, depending on whether the RBS and the secret message K are concatenated or interleaved, Extract(φ' K,i ) produces the following result:

[0173]

[0174] *: [a, b] and [c, d] represent the binary sequence K' seq,i and the starting and ending positions of the substring of RBS' so that (ba) + (dc) is equal to the number of bits encoded for each phase.

[0175] At step 12, regardless of whether RBS and K are concatenated or interleaved, the initiator can only decode all φ' K,iOnly then is the known RBS compared to RBS'. If RBS ≠ RBS', then the initiator knows that K is likely to contain flipped bits, otherwise, K is likely to be reliable.

[0176] It should be noted that the responder may calculate the CRC in step 5, and the initiator may check the CRC in step 12, instead of agreeing on a predefined string of reliability bits. As an alternative to RBS, a cyclic redundancy check (CRC) can be used for error detection in the transmission of the secret key K; CRC is widely used in communication protocols and integrated in almost all devices (both software and hardware).

[0177] In a variant embodiment, at step 5, the randomly generated secret key K can be divided into j equal bit sequences K of length l. i , where 0≤i≤j-1. For each K i , calculate the CRC c consisting of m parity bits i And append it to K i To form a codeword CW with a length of l+m bits i =[K i , c i ]. These j codewords are then concatenated to form K. Before transmission, a total of m*j overhead bits are added to the secret message K. In step 11, due to c i Bit and K i The bit sequence is interleaved, depending on how many bits are encoded per phase, Extract(φ' K,i ) produces K' seq,i ,c' i or K' seq,i [a,b]|c' i [c, d]. In step 12, as in the RBS scenario, after retrieving K' i and c' i After these two parts, errors in transmission are checked.

[0178] Optionally, in the aforementioned embodiment variant, the initiator may determine the required reliability level (RL) in the previous step 0 and signal it together with the request message in step 2. Figure 7 As shown, in steps 5 and 11, different FECs may be applied based on the received RL.

[0179] This embodiment and other embodiments described further can also be applied to other schemes for establishing keys at the physical layer. These embodiments can be combined to use other options:

[0180] • Use multiple carrier waves to exchange a single key bit (to increase reliability).

[0181] like Figure 4 As shown, the enhancements are as follows:

[0182] • In step 5, each key bit j of the code is mapped to a number of carriers i.

[0183] • In step 6, multiple carriers carry information about a single key bit.

[0184] • In step 10, the extraction function uses the phase information of multiple carriers to reconstruct a single key bit.

[0185] Variations of this embodiment and other embodiments described further may also be characterized by using / modifying more than one physical characteristic (e.g., phase), i.e., they may use / modify multiple physical characteristics (e.g., phase and amplitude). This can increase the data rate when securely exchanging or encapsulating data.

[0186] Example 2: Physical layer key encapsulation integrated into the 5G initial access process

[0187] In a second embodiment, the first embodiment may be adapted to a 5G network and can be used during link establishment between a UE and a gNB. The 5G NR initial access procedure is a form of handshake between a user equipment (UE) and a base station (gNB) for synchronizing DL and UL, authorizing access to the system, and assigning a unique identifier (e.g., C-RNTI) to the UE prior to an authentication procedure. The following sections describe how the proposed key encapsulation scheme can be integrated with the 5G NR initial access procedure, where the data to be protected corresponds to a random preamble. It may also be integrated in other similar procedures for initially establishing a communication link, such as in a cellular system.

[0188] The gNB can be defined as the initiator and the UE can be defined as the responder (i.e., the UE is the party that generates the secret key K), defined as follows:

[0189] ·θ SS,i : Random and secret phase of the synchronization signal transmitted by the gNB.

[0190] ·θ SS@UE,i : θ estimated by UE SS,i The equivalent phase of , where 1≤i≤N, N is the number of subcarriers.

[0191] ·θ RP,i : The phase of the random preamble to be transmitted to the gNB.

[0192] ·θ P,i : Random preamble phase after encapsulation (minus θ SS@UE,i ).

[0193] ·θP@gNB,i : θ estimated by gNB P,i Equivalent phase.

[0194] refer to Fig.10 , the NR initial access can be described as follows:

[0195] In steps 1 and 2, the gNB broadcasts a synchronization signal (SS) with a secret random phase. This refers to the synchronization signal including the MIB and PCI of the cell. Steps 3 to 5 are similar to the first embodiment, except that instead of generating a random key in step 4, the UE selects a random preamble to transmit in the random access channel (RACH); this random preamble is not encoded with the help of QAM symbols as usual, but is used as a payload and is encoded into the phase θ RP,i Then the signal is transmitted in step 6.

[0196] In step 7, the gNB is able to estimate the equivalent subchannel phase, similar to the process performed by the UE in step 3. Then, by using the same mechanism described in the first embodiment, the gNB de-masks the random preamble phase and finally extracts the random preamble bits. This approach ensures that an eavesdropper cannot access data that is considered private.

[0197] In another variant, instead of encapsulating the data (e.g., random preamble), encryption keys can be exchanged between the gNB and the UE (e.g., as in one of the above embodiments). The key can then be used to encrypt / decrypt the data (e.g., random preamble) modulated by QAM in the subcarriers.

[0198] The above variations can be combined, for example, if sufficient subcarriers are available, then the responder can send the encapsulated key (embodiment 1) and the encrypted or encapsulated data value (a variation of the previous embodiment) in the same message. Note that the ratio of subcarriers allocated to encrypted data to subcarriers allocated to encapsulated secret keys will vary depending on the size of the secret key, the number of bits encoded per phase, and the size of the encapsulated / encrypted data. In any case, the current description assumes that the secret key and data can be transmitted simultaneously and across the available subcarriers.

[0199] In another variation of 5G based on time division duplex (TDD) mode, the secret key and the encapsulated or encrypted data can be sent separately. That is, the secret key is initially encapsulated and sent to the initiator. Then, the data can be encapsulated, or alternatively encrypted, and then sent. At the receiving end, first, according to Example 1, the encapsulation key is received, the encapsulation key is demasked and decoded. Then, a second message containing the data is received. If the message is encrypted, the secret key extracted from the first message is used to decrypt the message (e.g., a demodulated QAM symbol), otherwise, the encapsulated data is demasked and decoded according to Example 1.

[0200] In another variation based on 5G, at the transmitter, the bit stream can be enhanced by adding FEC and interleaving the bit stream, and then the bits can be mapped to modulation symbols (e.g., QAM symbols). The chunks of N QAM symbols can then be used as input to an IDFT (IFFT) using N different subcarriers. At the receiving end, the reverse process can be run.

[0201] It should be noted that the following aspects may be combined with any other embodiment and may be applicable to other schemes of physical layer security that enable secure exchange of data or keys:

[0202] It is possible to create a probe signal by generating sufficiently long randomized input data. This randomized data is then mapped to (randomized) QAM symbols. If 2 m -QAM, the randomized input data may have k len / m bits in length, where k len is the number of bits required for the key + FEC or RBS / CRC, as in the first, second, and third embodiments. FEC or CRC may be Figure 8 Additional cases of FEC or CRC are shown.

[0203] • The probing signal may be created by generating subcarriers with initial random phases (eg, in an FFT module).

[0204] In the previous embodiment, step 3 can be done before cyclic prefix removal during the synchronization phase for phase and frequency offset correction. In addition, step 6 can be introduced by setting the output of the QAM modulation to the phase in step 6 or by setting the initial phase of the generated subcarrier to the calculated phase. Figure 4 ).

[0205] • Additionally, the magnitude of the vector may be set to its maximum value (eg, in QAM-64) to ensure maximum distance between the resulting constellation points.

[0206] In the first embodiment (for example, corresponding to Figure 4 ), steps 8, 9, 10 may be done before cyclic prefix removal during the synchronization phase for phase and frequency offset correction.

[0207] Example 3: Physical layer key encapsulation integrated in 5G sidechain communication

[0208] In the third embodiment and with respect to Fig.11 , wherein 110 plays the role of a base station (e.g., gNB), 120 plays the role of a 5G ProSe user-to-network relay or a UE-to-UE relay within coverage, 130 plays the role of a pair of 5G ProSe terminal UEs, and 140 plays the role of a 5G ProSe UE-to-UE relay outside coverage. The first embodiment may be suitable for 5G sidelink (or device-to-device) communication and used during secure link establishment between 5G ProSe UEs (e.g., terminal UE and / or between terminal UE and relay UE), wherein the initiator and the responder may be:

[0209] 1. Two 5G ProSe UEs attempt to establish a direct PC5 communication link (e.g., 130 terminal UE1 and 130 terminal UE2).

[0210] 2. 5G ProSe remote UE and 5G ProSe UE to network relay (e.g., 130 terminals UE1 and 120).

[0211] 3. 5G ProSe source UE and 5G ProSe UE-to-UE relay (in the first hop-by-hop link, for example, 130 terminals UE1 and 140), and 5G ProSe UE-to-UE relay and 5G ProSe target UE (in the second hop-by-hop link, for example, 140 and 130 terminals UE2).

[0212] 4. 5G ProSe UE-to-UE relay and one or more 5G ProSe terminal UEs.

[0213] In the first scenario, specifically in the 5G ProSe direct discovery process based on Model A and consistent with TS33.503 Figure 6 .1.3.2.2.1-1, the notifying UE may play the role of the initiator, while the monitoring UE may play the role of the responder. In step 11 of the figure, the notifying UE notifies the ProSe restriction code; this message may be used as S I , the monitoring UE (responder) can use the S ITo encapsulate the payload (e.g., the randomly generated key K). Following the same steps described in the first embodiment, the second embodiment, or the third embodiment, the responder (i.e., the monitoring UE) may transmit the encapsulated payload (e.g., K) to the announcing UE, and establish a security context based on K and / or keys derived therefrom, for example, as a fallback in the event that the UE is not configured with discovery security material (e.g., DUIK and / or DUSK and / or DUCK). Alternatively, if the monitoring UE is required to perform a match reporting procedure for a MIC check, it may only transmit the encapsulated secret key K to the announcing UE in the event that the MIC check is successful.

[0214] In the first scenario (specifically in the 5G ProSe direct discovery process based on Model B and consistent with TS33.503 Figure 6 .1.3.2.2.2-1 related), the discovering UE can play the role of the initiator, and the discovered UE plays the role of the responder. In step 12 of the figure, the discoverer UE sends a query code, which can play the role of S I role (as described in the first embodiment). When processing the query code in step 13, the discoverer UE (e.g., responder) can use the channel phase estimation result of the received signal / message to encapsulate the payload (e.g., a randomly generated key K), and then transmit it together with the response code in step 14, or encapsulate the response code, or encrypt the response code using the randomly generated K or a key derived therefrom, and then transmit it together with the encrypted payload (as described in the second embodiment). The discoverer UE can then process the received message to retrieve the secret key K and the response code. The previous embodiments related to transmitting the secret key and data in the same transmission or separately can also be applied to this scenario.

[0215] In the second scenario (the remote UE attempts to establish a PC5 link with the 5G ProSe UE to network relay), the second embodiment may be adapted to establish a secret key between the 5G ProSe remote UE playing the role of the initiator and the 5G ProSe UE to network relay playing the role of the responder, wherein the direct communication request or discovery message may play the role of the S IThe responder may encapsulate the randomly generated key K and send it back to the remote UE (i.e., the initiator) after processing the DCR message or discovery message and performing the necessary checks (e.g., authorization to use the UE to network services). Similar to the previous embodiments, the encapsulated secret key (or a key derived therefrom) may be a backup option for protecting the PC5 communication link between the remote UE and the UE to network relay (e.g., in the case where the UE is not configured with a code to send / receive security material (e.g., DUIK, DUSK, and DUCK) and / or lacks a valid long-term certificate).

[0216] In the third scenario (the UE may be outside of 3GPP coverage), when, for example, the UE does not have a valid long-term certificate and / or if the UE lacks discovery security material (e.g., DUIK, DUSK, DUCK), the physical layer key encapsulation scheme may provide an alternative to establishing a secure PC5 communication link between UEs (e.g., terminal UE and UE-to-UE relay).

[0217] In a variant embodiment that can be combined with other embodiments or used independently, the key (represented as KE in this variant embodiment) exchanged by means of a physical layer key encapsulation scheme may not be used independently, but in combination with the discovery security material. This meets the following requirements: (1) ensuring a higher level of security in the event that the security material (DUIK, DUSK, DUCK) is leaked or compromised by an attacker, because the discovery security material is typically shared by multiple devices. The key KE can be combined with the DUIK, DUSK or DUCK by using the key KE as an input to a cryptographic function (e.g., a key derivation function) for deriving the final integrity / scrambling / encryption key or MIC / scrambling / encryption sequence. For example, the MIC can be calculated as the least significant bit of the output of the key derivation function, which takes the DUIK, the message to be integrity protected, a UTC-based counter and KE as input. In this example, this ensures that outsiders (at least not in the link) do not interfere with the communication.

[0218] In a related embodiment variant that can be combined with other embodiments or used independently, the key (denoted as KE in this embodiment variant) exchanged by means of the physical layer key encapsulation scheme may not be used independently, but may be used in combination with the discovery security material or other established keys (e.g., symmetric keys) as needed (when these established keys are used for integrity protection, confidentiality protection, or scrambling, for example). For example, KE can be used as an input in MIC generation, where the MIC is generated based on a pre-established or pre-configured integrity key Kinc. For example, as KDF(Kinc, message|KE), where KDF(a, b) refers to: a key derivation function (KDF) of b with a as input cryptographic function, where KDF can be, for example, HMAC-SHA256, and where a|b refers to the concatenation of a and b. Whether KE is used at a specific point in time or for a specific message, or how KE is obtained (e.g., which physical characteristics (e.g., carrier) are used to determine KE, or which parameters are used to determine KE), these issues can be determined by communication devices A and B or a third device. This determination can be performed randomly using a secure random generation process. When the KE is to be used, it will be exchanged between A and B in a secure manner (i.e., in a complete and protected manner), configured by a third device, etc., so that an eavesdropper or middleman does not know when the KE is used as an input in MIC generation or combined with other established keys. By doing this, the communicating devices A and B are able to ensure that there is no MitM between them.

[0219] In the third scene and Fig.12 In a related embodiment, where the source UE plays the role of an initiator (e.g., Initiator 1), the UE-to-UE relay plays the role of both a responder and an initiator (Responder 1 in a first hop-by-hop link and Initiator 2 in a second hop-by-hop link), and the target UE plays the role of a responder (e.g., Responder 2), for these two hop-by-hop links, the first embodiment may be adapted to establish secret keys and / or exchange or relay payloads based on physical layer key encapsulation, wherein:

[0220] - Steps 1, 2 and 3 and 4, 5 and 6 are similar to the initial steps in the first embodiment.

[0221] - Steps 7, 8, 9 and 10, where the responder 2 (ie the target UE) encapsulates the randomly generated key and transmits the randomly generated key to the initiator 2 / responder 1 (ie the UE to UE relay).

[0222] - Steps 11, 12 and 13, wherein the UE-to-UE relay decapsulates and extracts the payload (e.g., the secret key transmitted by the target UE). As described in previous embodiments (e.g., as a fallback option if other security material is lacking / not provided), the key (e.g., K) and / or keys derived therefrom may be used to protect the second hop-by-hop link.

[0223] - Steps 14, 15, 16 and 17 (similar to steps 7, 8, 9 and 10), where the UE-to-UE relay encapsulates the payload (e.g., the randomly generated key) and transmits the payload (e.g., the randomly generated key) to the initiator 1 (i.e., the source UE).

[0224] - Steps 18, 19 and 20 (similar to steps 11, 12 and 13), in which the source UE decapsulates and extracts the payload (e.g., secret key K'). This key (e.g., K') and / or keys derived therefrom can be used to protect the first hop-by-hop link.

[0225] It should be noted that the Fig.12 For example, and as a variation of this embodiment, step 14 may be skipped, and instead, the UE-to-UE relay extracts the payload (e.g., data / keys transmitted by the target UE), encapsulates it and transmits it to the source UE. As such, the payload (e.g., secret keys and / or keys derived therefrom) may be used as the basis for securing the hop-by-hop link.

[0226] In another embodiment variant, step 17 may be performed at an earlier stage (eg before step 10) to establish a secret key ensuring the security of the first hop-by-hop link independently of the exchange in the second hop-by-hop link.

[0227] In another embodiment variation that can be combined with other embodiments, the proposed scheme can be used not only to establish secret keys, but also to encapsulate data (e.g., RSC or PRUK-ID) that is transmitted to another UE (e.g., UE to UE or UE to network relay) and needs to be protected. For example, in the case where no code is provided at the remote UE to send / receive security material, physical layer key encapsulation can provide an alternative solution to protect RSC and PRUK-ID in a remote UE to UE to network link establishment scenario.

[0228] In the fourth scenario, and about Fig.13 UEs that may lack valid discovery security material and / or long-term credentials may rely on notification messages broadcast by UE-to-UE relays (playing the role of the initiator) (playing the role of the S described in the first embodiment). I ) (e.g., Fig.13 1 and 1' in steps 1 and 1') to encapsulate the randomly generated key (e.g., k and k' generated in steps 3 and 3' and encapsulated in steps 5 and 5') and (e.g., Fig.13 6 / 6' in the example above) transmits them to the UE-to-UE relay. As described in the above embodiments, the UE-to-UE relay processes the response signals received from steps 6 and 6' to extract the payload (e.g., k and k' in this example). k and k' (or keys derived from them) can then be used to protect the PC5 communication link between the terminal UE and the UE-to-UE relay.

[0229] In a variation of the embodiment related to the fourth scenario, the UE-to-UE relay may broadcast an announcement message periodically (e.g., every T seconds) and process the response signal received from the ProSe terminal UE within the time window to establish a secret key with the terminal UE. This has the advantage that several secret keys may be established to protect multiple sidechain PC5 communication links using a single broadcast signal / announcement message.

[0230] In a variant of the embodiment that can be combined with other embodiments or used independently, instead of discovery and / or direct communication messages, if applicable, if the initiator UE (e.g., the discoverer UE or the notifying UE) transmits sidelink synchronization signals (e.g., the sidelink primary synchronization signal (S-PSS) and the sidelink secondary synchronization signal (S-SSS)), then the responder UE (e.g., the monitoring UE or the discoverer UE) can use these signals as S I (as described in the first embodiment) to encapsulate the payload (e.g., data, secret key) and respond to the initiator UE. This has the following advantages: security keys are established before or during the transmission of the initial discovery or direct communication message (e.g., when the payload is a secret key), thereby providing a means of protecting such messages in combination with the provided discovery security material and / or long-term certificates, and / or providing a fallback option in the event that these upper layer security materials are not provided to the UE or have expired.

[0231] These embodiments may be combined with other enhancements to physical layer key encapsulation (eg, FEC, CRC / RBS), or used independently.

[0232] Example 4: Collocation of resource allocation

[0233] ·exist Figure 4 In the case of a key encapsulation, steps 2 and 7 need to be performed in a finite time using the same subcarrier so that the channel between the initiator and responder does not change. In addition, the message processing in these steps may be slightly different from that of messages not involving key encapsulation, so:

[0234] oIn Figure 4 In the embodiment of the present invention, step 2 may perform implicit resource allocation for step 7. In other words, the initiator device transmitting the message in step 2 may implicitly indicate to the receiving device which frequency subcarriers to use in / for the reply message.

[0235] o Prior to steps 2 and 7, a resource allocation message may be transmitted to the responder (and optionally to the initiator), indicating the resources allocated for steps 2 and 7.

[0236] o Prior to steps 2 and 7, a resource allocation message may be transmitted to the responder (and optionally to the initiator), indicating that the messages processed in steps 2 and 7 may need to be processed using the last embodiment (extended Figure 5 Normal processing of physical layer messages in ).

[0237] In all previous embodiments, it is possible to improve the transmission and retrieval of secret messages and messages. To this end, (e.g. Figure 4 The signal transmitted by the responder in step 7, which contains the secret key in its phase, is sufficient to retrieve the secret key and the content of the transmitted signal. This applies to the previous embodiment, for example, for protecting the initial 5G PRACH message.

[0238] In an embodiment related to the second embodiment, the message constructed by the UE in step 6 and sent in step 7 is constructed as in embodiment 1. K,j -θ SS@EU, i The value of is used to adjust the initial phase of subcarrier i, and the data is encoded in subcarrier i. At step 8, the gNB is able to measure the phase of subcarrier i when the signal is first received, thereby extracting the key as in embodiment 1. The data symbol can then be retrieved from the subcarrier.

[0239] In another embodiment related to the previous one, the extracted key is used to correct the phase shift of the received sub-carriers.

[0240] In another embodiment, to enable the initiator to retrieve secret keys and data:

[0241] oThe responder wraps the secret key,

[0242] o The responder encapsulates or encrypts the data before modulating it (e.g., in QAM symbols) and then transmits a signal containing the encapsulated secret key and data,

[0243] oThe initiator receives the signal,

[0244] - The initiator retrieves the secret key phase (e.g. Figure 4 9 and 10), and / or

[0245] - The initiator retrieves the data (e.g. Fig.10 8 and 9 (if the data is encapsulated), or decrypt the data after demodulation (if the data is encrypted).

[0246] In the third embodiment of the present invention, a similar protocol is applied to other schemes for establishing keys at the physical layer. Therefore, it is possible to provide one-way encryption as follows:

[0247] First, the responder receives the probe signal.

[0248] The responder then generates a key and a reply message.

[0249] The responder can use the key to encrypt selected fields in the reply message. For example, the responder can use the key at the application layer or at the L2 layer or at the L1 layer using a standard encryption algorithm such as AES in stream cipher mode (using, for example, counter mode).

[0250] The responder can then encode and encapsulate the key into the phase of the subcarrier, add the encrypted message (e.g., modulated as a QAM symbol) and build the signal as previously described.

[0251] Finally, on the initiator side, the initiator receives the signal and retrieves the secret key from the phase of the subcarrier. The initiator then uses the retrieved key to decrypt the selected encrypted fields of the message.

[0252] Example 5: Application to environmental IoT tags

[0253] In the above embodiments, it has been described how physical layer security can be used to protect data exchanged between an initiator and a responder. This flow may be of particular interest in the ambient IoT scenario described in TR 22.840, where a UE or access device may play the role of the initiator and the responder may be a resource-constrained device (e.g., an ambient IoT tag). As disclosed in other embodiments, the IoT tag may protect the information to be exchanged. This can make the design of the ambient IoT tag simpler, where expensive features may not be required.

[0254] In one embodiment, the IoT tag may receive a request from an initiator to retrieve data. The IoT tag may determine the information to be exchanged (e.g., a key or the data itself) and encode / encapsulate it in a response message (e.g., when OFDM modulation is used, encode / encapsulate it in the initial phase of the OFDM carrier), so that the initiator can securely retrieve the information.

[0255] In the examples of the above embodiments, the initiator / responder roles may be performed by different types of wireless devices, such as UE, access device (e.g., gNB), relay (UE to UE or UE to network relay), and the responder may be performed by any of the aforementioned entities or (environmental) IoT tags.

[0256] By studying the drawings, the disclosure and the appended claims, those skilled in the art will be able to understand and implement other variations of the disclosed embodiments when practicing the claimed invention. In the claims, the word "comprising" does not exclude other elements or steps, and the word "one" or "an" does not exclude multiple. A single processor or other unit can implement the functions of several items recorded in the claims. The fact that certain measures are recorded in mutually different dependent claims does not indicate that the combination of these measures cannot be used advantageously. The foregoing description describes certain embodiments of the present invention in detail. However, it should be understood that no matter how detailed the above appears in the text, the present invention can be practiced in a variety of ways and is therefore not limited to the disclosed embodiments. It should be noted that when describing certain features or aspects of the present invention, the use of a specific term should not be understood to imply that the term is redefined herein and is limited to any specific characteristics of the various features or aspects of the present invention associated with the term.

[0257] A single unit or device may fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0258] The described operations can be implemented as program code units of a computer program and / or dedicated hardware of a related communication device or access device, respectively. The computer program can be stored and / or distributed on a suitable medium (e.g., an optical storage medium or a solid-state medium), provided together with other hardware or as part of other hardware, but can also be distributed in other forms (e.g., via the Internet or other wired or wireless telecommunication systems).

Claims

1. A method for transmitting a payload in a secure manner, the method comprising: The responder receives the initiation message from the initiator. The responder measures one or more incoming physical characteristics of the received initiation message, creating a response message to be sent back to the initiator, modifying one or more physical characteristics of the response message based on a combination of the measured incoming physical characteristics and the payload, The modified response message is transmitted to the initiator.

2. The method according to claim 1, wherein: The combination of the measured incoming physical signal characteristic and the payload comprises: encoding the payload into a codeword comprising a set of bits, and mapping the set of bits of the codeword to a set of mapped physical property values, The combination is generated as a difference between the measured incoming physical signal characteristic and the set of mapped physical characteristic values.

3. A method according to any one of the preceding claims, wherein: The payload is an encryption key used by the initiator for secure communications with the responder.

4. A method according to any one of the preceding claims, wherein: The physical characteristics of the initiation message and the physical characteristics of the response message include one or more of the following: the phase of each carrier, or the phase difference of each carrier relative to a reference carrier, or the gain of each carrier, or the gain difference of each carrier relative to a reference carrier, or the polarization of each beam relative to a reference beam, or a modulation symbol, or a gain value applied to each beam respectively, or an OAM mode, or a phase pattern in an OAM mode, or polarization sensing.

5. A method according to any one of the preceding claims, wherein: The payload includes a useful payload and one or more of the following: one or more groups of parity check bits, one or more groups of cyclic redundancy check bits, or a reliability bit string known to the initiator.

6. A method according to any one of the preceding claims, wherein: The payload is obtained by applying a forward error correction algorithm to a group of information bits.

7. A method according to any one of the preceding claims, wherein: The payload is obtained by interleaving a group of information bits with at least one of: a corresponding reliability bit string known to the initiator, or a group of parity check bits, a cyclic redundancy check.

8. A method according to any one of the preceding claims, wherein: The initiator and the responder are terminal devices and / or relays (eg, UE-to-UE relay or UE-to-network relay) communicating via a sidelink communication link.

9. A method according to any one of the preceding claims, wherein: The initiator is a UE (e.g., V2X UE, ProSe UE, etc.) or an access device (e.g., gNB), and the responder is a passive / environmental IoT device.

10. The method according to any one of the preceding claims, wherein: The first responder plays the role of a second initiator exchanging payloads with the second responder, thereby combining the initiator role and the responder role and implementing each role function in a separate communication link.

11. A method according to any one of the preceding claims, wherein: The established secret key is used as a fallback option when the device (terminal UE and / or UE-to-UE relay) is not provisioned with discovery security material and / or has an expired long-term certificate.

12. A method according to any one of the preceding claims, wherein: The established secret key is combined with the established or provided security material to derive a cryptographic key or MIC or a scrambling sequence or an encryption sequence by means of a cryptographic function, which may be a key derivation function, an encryption algorithm or an integrity algorithm.

13. A method for exchanging payloads in a secure manner, the method comprising: - an initiator generates an initiation message, the initiator performs a first modification of one or more physical characteristics of the initiation message, and the initiator transmits the modified initiation message to a responder, - the responder receives a modified initiation message from the initiator, - the responder measures one or more incoming physical characteristics of the received modified initiation message, - the responder creates a response message to be sent back to the initiator, - the responder modifies one or more physical characteristics of the response message based on a second modification comprising a combination of the measured incoming physical characteristic and the payload, transmitting the modified response message to the initiator, - the initiator receives the modified response message, The initiator modifies the received modified response message based on the first modification and extracts the payload from the received modified response message.

14. The method according to claim 13, wherein: The combination of the measured incoming physical signal characteristic and the payload comprises: encoding the payload into a codeword comprising a set of bits, and mapping the bit groups of the codeword to a set of mapped physical characteristic values, The combination is generated as a difference between the measured incoming physical signal characteristic and the set of mapped physical characteristic values.

15. The method according to any one of claims 13 or 14, wherein: The payload is an encryption key used by the initiator for secure communications with the responder.

16. The method according to any one of claims 13 to 15, wherein: The first modification is a random change of one or more physical characteristics of the initiation message.

17. The method according to any one of claims 13 to 16, wherein: The physical characteristics of the initiation message and the physical characteristics of the response message respectively include one or more of the following: the phase of each carrier, or the phase difference of each carrier relative to a reference carrier, or the gain of each carrier, or the gain difference of each carrier relative to a reference carrier, or the polarization of each beam relative to a reference beam, or a modulation symbol, or a gain value applied to each beam, or an OAM mode, or a phase pattern in an OAM mode, or polarization sensing.

18. The method according to any one of claims 13 to 17, wherein: The payload includes a useful payload and one or more of the following: one or more groups of parity check bits, one or more groups of cyclic redundancy check bits, or a reliability bit string known to the initiator.

19. The method according to any one of claims 13 to 18, wherein: The payload is obtained by applying a forward error correction algorithm to a group of information bits.

20. The method according to any one of claims 13 to 19, wherein: The payload is obtained by interleaving a set of information bits with a corresponding string of reliability bits known to the initiator.

21. The method according to any one of claims 13 to 20, wherein: The payload includes: - the wrapped key, and - A random preamble selected by the responder, which is combined with the measured incoming physical signal characteristics or encrypted before modulation.

22. The method according to any one of claims 13 to 21, wherein: The initiator and the responder are terminal devices and / or relays (eg, UE-to-UE relay or UE-to-network relay) communicating via a sidelink communication link.

23. The method according to any one of claims 13 to 22, wherein: The initiator and the responder are terminal devices and / or relays (eg, UE-to-UE relay or UE-to-network relay) communicating via a sidelink communication link.

24. The method according to any one of claims 13 to 23, wherein: The initiator is a UE (e.g., V2XUE, ProSe UE, etc.) or an access device (e.g., gNB), and the responder is a passive / environmental IoT device.

25. The method according to any one of claims 13 to 24, wherein: The first responder plays the role of a second initiator exchanging payloads with the second responder, thereby combining the initiator role and the responder role and implementing each role function in a separate communication link.

26. The method according to any one of claims 13 to 25, wherein: The established secret key is used as a fallback option when the device (terminal UE and / or UE-to-UE relay) is not provisioned with discovery security material and / or has an expired long-term certificate.

27. The method according to any one of claims 13 to 26, wherein: The established secret key is combined with the established or provided security material to derive a cryptographic key or MIC or a scrambling sequence or an encryption sequence by means of a cryptographic function, which may be a key derivation function, an encryption algorithm or an integrity algorithm.

28. A method for receiving a payload in a secure manner, the method comprising: The initiator generates an initiation message. The initiator performs a first modification of one or more physical characteristics of the initiation message, and The initiator transmits the modified initiation message to the responder, The initiator receives the response message, modifying the response message based on the first modification, and The payload is extracted from the modified response message.

29. The method according to claim 28, wherein: The payload corresponds to an encryption key, and the initiator uses the encryption key to decrypt data transmitted in the received message.

30. The method according to claim 28 or 29, wherein: The initiator and the responder are terminal devices and / or relays (eg, UE-to-UE relay or UE-to-network relay) communicating via a sidelink communication link.

31. The method according to any one of claims 28 to 30, wherein: The initiator is a UE (e.g., V2XUE, ProSe UE, etc.) or an access device (e.g., gNB), and the responder is a passive / environmental IoT device.

32. The method according to any one of claims 28 to 31, wherein: The first responder plays the role of a second initiator exchanging payloads with the second responder, thereby combining the initiator role and the responder role and implementing each role function in a separate communication link.

33. The method according to any one of claims 28 to 32, wherein: The established secret key is used as a fallback option when the device (terminal UE and / or UE-to-UE relay) is not provisioned with discovery security material and / or has an expired long-term certificate.

34. A method according to any one of claims 28 to 33, wherein: The established secret key is combined with the established or provided security material to derive a cryptographic key or MIC or a scrambling sequence or an encryption sequence by means of a cryptographic function, which may be a key derivation function, an encryption algorithm or an integrity algorithm.

35. A computer program product comprising code means for producing the steps of claims 1-34 when run on a computer device.

36. A communication device for transmitting a payload in a secure manner, the communication device comprising: Receiver, Transmitter, controller, and A memory for storing instructions for causing the following operations: The receiver receives an initiation message from an initiator, The controller measures one or more incoming physical characteristics of the received initiation message, The controller creates a response message to be sent back to the initiator, The controller modifies one or more physical characteristics of the response message based on a combination of the measured incoming physical characteristics and the payload, The transmitter transmits the modified response message to the initiator.

37. A communication device for receiving a payload in a secure manner, The communication device includes a controller, a transmitter, a receiver, and a memory, wherein the memory includes instructions for causing the following operations: - the controller generates an initiation message and performs a first modification of one or more physical characteristics of the initiation message, - the transmitter transmits the modified initiation message to the responder, and the receiver receives the modified response message, - The controller modifies the received modified response message based on the first modification and extracts the payload from the received modified response message.

38. A communication device comprising the device according to claims 36 and 37.

39. A communication system for exchanging payloads in a secure manner, The communication system includes an initiator and a responder. The initiator includes an initiator controller, an initiator transmitter, an initiator receiver, and an initiator memory, wherein the initiator memory includes instructions, and the instructions are used to cause the following operations: - the initiator controller generates an initiation message and performs a first modification of one or more physical characteristics of the initiation message, - the initiator transmitter transmits a modified initiation message to the responder, and the initiator receiver receives a modified response message, - the initiator controller modifies the received modified response message based on the first modification and extracts the payload from the received modified response message, The responder includes a responder receiver, a responder transmitter, a responder controller, and a responder memory, wherein the responder memory includes instructions for causing the following operations: - the responder receives a modified initiation message from the initiator, - the responder controller measures one or more incoming physical characteristics of the received modified initiation message and creates a response message to be sent back to the initiator, - the responder controller modifies one or more physical characteristics of the response message based on a second modification comprising a combination of the measured incoming physical characteristic and the payload, and - The responder transmitter transmits the modified response message to the initiator.

Images