Method for key matching in physical-layer key generation

Abstract

The invention relates to a method for key matching in physical-layer key generation for matching the key bit patterns obtained by measurements of parameters of a physical channel. The channel parameters are ideally characterised by reciprocity, which, after quantisation, would result in identical key bit sequences on both sides of a communication link. Different properties of the communication devices and uncorrelated noise result in deviations that can be corrected using the method according to the invention, wherein the method maximizes efficiency and minimizes the error rate. This is made possible without having to introduce security intervals instead of quantisation boundaries or having to resort to code-supported methods (Slepian-Wolf coding). The method according to the invention determines shift values by public communication of certain values and finally the shift distance without compromising security. A further embodiment of the method allows the shifting to be carried out in any quantization intervals by changing the shift distance, whereby a uniform distribution of the key bit sequences can be achieved. This also does not impair security.

Description

[0001] Method for key matching during key generation in the physical layer (Physical-Layer Key Generation)

[0002]

[0001] The invention relates to a method for key matching during physical-layer key generation to align the key bit patterns obtained by measuring parameters of a physical channel.

[0003]

[0002] Many passive channels or their parameters exhibit reciprocity properties. This is already the case for two-ports through Zi2=Z2i, Yi2=Y2i, det(A)=1, Si2=S2i, furthermore in the transfer function of TDD (time division duplex) systems, in Direction-of-Arrival=Direction-of-Departure in FDD systems and in cable transmission functions (e.g. power lines).

[0004] [3] The reciprocal parameters are quantized on both sides of the transmission path, i.e., at both communication partners (Alice and Bob), and then assigned to a key segment (e.g., a binary sequence). This is usually done using Gray coding.

[0005]

[0004] Slightly different characteristics of the transmission technology and uncorrelated noise on both sides of the transmission path can lead to deviations in the key sequences (measured by the Key Disagreement Rate, KDR). Without countermeasures, this would be particularly the case when the measurements are close to the quantization limits. [5] A common approach is to introduce safety intervals instead of quantization limits in which measurements are discarded, which reduces efficiency.

[0006]

[0006] These safety intervals are suggested, for example, in the following literature references:

[0007]

[0007] JW Wallace and RK Sharma, "Automatic secret keys from reciprocal MIMO wireless channels: measurement and analysis," IEEE Transactions on Information Forensics and Security, Vol. 5, No. 3, Sept. 2010, pp. 381-392.

[0008]

[0008] O. Graur, N. Islam, and W. Henkel, "Quantization for physical layer security," IEEE Global Communications Conference (GLOBECOM), Workshop on Trusted Communications with Physical Layer Security, Washington DC, 2016.

[0009]

[0009] Alternatively, Slepian-Wolf Coding can be used, which requires the detection and transfer of redundancy and thus also measures such as privacy amplification, which also reduces efficiency.

[0010]

[0010] Slepian-Wolf Coding with LDPC Codes has been investigated by us in the following publications:

[0011]

[0011] O. Graur, W. Henkel, N. Islam and A. Filip, "Quantization aspects in LDPC key reconciliation for physical layer security," 10th International ITG Conference on Systems, Communications, and Coding (SCC 2015), Hamburg,

[0012] N. Islam, O. Graur, A. Filip and W. Henkel, "LDPC code design aspects for physical-layer key reconciliation," IEEE International Global Communications Conference (Globecom), San Diego, California, 2015.

[0012]

[0013] An earlier publication on the use of LDPC codes is, for example:

[0013]

[0014] X. Sun,

[0014]

[0015] Polar coding is used in the following publications:

[0015]

[0016] R. A. Chou, M. R. Bloch and E. Abbe, " Polar coding for secret-key generation, " IEEE Transactions on Information Theory, vol. 61, no. 11, S. 6213- 6237, Nov. 2015.

[0016]

[0017] J. M. Renes, D. Sutter, F. Dupuis and R. Renner, " Ef ficient quantum Polar Codes requiring no preshared entanglement, " IEEE Transactions on Information Theory, vol. 61, no. 11, S. 6395- 6414, Nov. 2015.

[0017]

[0018] S. Zhang, L. Jin, S. Zhu, K. Huang and Z. Zhong, " Information reconciliation based on systematic secure Polar Code for secret key generation, " 2018 IEEE 88th Vehicular Technology Conference (VTC-Fall ), Chicago, IL, USA, 2018.

[0018]

[0019] BCH-Codes werden verwendet in:

[0020] P. Treeviriyanupab, P. Sangwongngam, K. Sripimanwat and 0. Sangaroon, " BCH-based Slepian-Wolf coding with feedback syndrome decoding for quantum key reconciliation, " 2012 9th International Conference on Electrical Engineering / Electronics, Computer, Telecommunications and Information Technology, Phetchaburi, Thailand, 2012.

[0019]

[0021] Turbo-Codes werden verwendet in:

[0020]

[0022] Sungsik Yoon and Jun Heo, " Efficient information reconciliation with turbo codes over the quantum channel, " 2013 International Conference on ICT Convergence ( ICTC), Jeju, Korea (South), 2013, S. 1091-1092.

[0021]

[0023] RS codes werden verwendet in:

[0022]

[0024] M. Fernando, D. Jayalath, S. Camtepe and E. Foo, " Reed Solomon Codes for the reconciliation of wireless PHY layer based secret keys, " 2017 IEEE 86th Vehicular Technology Conference (VTC-Fall), Toronto, ON, Canada, 2017.

[0023]

[0025] Privacy Amplification is described, for example, in the following standard work:

[0024]

[0026] M. Bloch and J. Barros, Physical-Layer Security: From Information Theory to Security Engineering, Cambridge University Press, 2011.

[0025]

[0027] One of our earlier methods shifts a measurement at Alice or Bob to the middle of the quantization interval. The shift can be publicly transmitted without compromising security.

[0028] This procedure is described in the following publications:

[0026]

[0029] W. Henkel, A. Turjman, HY Kim, and H. Qanadilo, "Common randomness for physical layer key generation in power-line transmission," IEEE International Conference on Communications, ICC 2020 (CISS), Dublin, Ireland, 2020.

[0027]

[0030] E. Olyaei Torshizi and W. Henkel, " Exploiting FDD channel reciprocity for physical layer secret key generation in loT networks," IEEE Communications Letters, vol. 28, no. 6, pp. 1268-1272, June 2024.

[0028]

[0031] E. Olyaei Torshizi and W. Henkel, "Pairwise physical layer secret key generation for FDD systems," IEEE Transactions on Information Forensics and Security, vol.

[0029] 19, pp. 9518-9533, 2024.

[0030]

[0032] A related proposal with a selection of alternative quantization intervals, based on halving the intervals for selection, can be found in the following publication and is referred to there as "Channel Quantization Alternating (CQA)":

[0031]

[0033] J. Wallace, "Secure physical layer key generation schemes: performance and information theoretical limits," 2009 IEEE International Conference on Communications, Dresden, Germany, 2009.

[0032]

[0034] In DE 10 2017 211 215 Al, a method for generating a key in a first network participant is disclosed, in which the first network participant determines physical properties of a transmission channel between the first network participant and a second network participant by means of a channel measurement, quantizes measurement results of the channel measurement using a quantization method, compares the quantized measurement results in an information comparison with the second network participant and generates a key depending on the compared quantized measurement results.

[0033]

[0035] The method according to the invention minimizes potential key deviations by utilizing the entire quantization interval (except for a small value E) to correct deviations. For this purpose, one measurement (e.g., by Alice) is positioned near a quantization limit at a distance of E, so that the other measurement (e.g., by Bob) remains within the same interval as closely as possible. To achieve this, it must first be determined which of the two measurements, Alice's and Bob's, is larger.

[0034]

[0036] For this purpose, secondary parameters are generated from measurements and random values. These are:

[0035]

[0037] XA = m A - n A at Alice and x B = m B - n B at Bob's,

[0036]

[0038] where mA and m B the measurements, nA and n B random positive values ​​for Alice and Bob, respectively.

[0037]

[0039] This is how both communication partners define the differences:

[0038]

[0040] d A = m A n A - m A x B and d B = m B n B - m B x A .

[0041] The size relationships regarding m A and m B are determined as follows:

[0039]

[0042] d A > d B => m A > m B

[0040] d A < d B => m A < m B

[0041] d A = d B => m A = m B .

[0042]

[0043] If Alice determines the shift, she obtains it by:

[0043]

[0044] 6 A = bi-i + E - m A if m A < m B or

[0044] 6 A = b± - E - m A if m B <m A .

[0045]

[0045] If both measurements are equal (m A =m B ), no postponement is required.

[0046]

[0046] bi-i and bi denote the quantization limits below and above the measured value m A .

[0047]

[0047] E is a small value that indicates the distance achieved from the quantization limit after displacement.

[0048]

[0048] If Bob determines the displacement, he obtains d A publicly by Alice and definitely 6 B = bi-i + E - m B if m B < m A or 6 B = bi - E - m B if m A < m B 6 B Alice will be publicly informed.

[0049]

[0049] In this case, bi-1 and bi denote the quantization limits below and above the measurement value m. B .

[0050]

[0050] If Alice determines the displacement, she receives d BBob publicly transmits the shift 6A, and he himself publicly transmits it. Neither of the publicly transmitted parameters provides any information about the actually measured quantization interval and the associated key sequence.

[0051]

[0051] In the following, we describe the proof steps from which it can be concluded that the introduced differences ÜA = m A n A - m A x B and dß = m B n B - m B x A allow the size relationship between mA and ms to be determined.

[0052] d Alice — d Bob = (m A n A — m A x B ) — (m B n B — m B x A )

[0053] (m A n A - m A (m B - n B )) - (m B n B - m B (m A - n A ))

[0054] m A n A - mA m B + m A n B - m B n B + m B m A - m B n A

[0055] m

[0056]

[0057] A (n A + n B ) - m B (n A + n B )(n A + n B )(m A - m B ).

[0058]

[0052] If d A > d B , then d A - d B > 0.

[0059]

[0053] Since n A and n B When dealing with positive numbers, the term (n A + n B ) always positive.

[0060]

[0054] It follows that m A - m B must be positive, from which in turn m A > m B follows.

[0061]

[0055] If d A = d B , then d A - d B = 0.

[0062]

[0056] Since (n A + n B) is not equal to zero, it follows that m A - m B must be zero, accordingly m A = m B .

[0057] If d A < d B , then d A - d B < 0.

[0063]

[0058] Since (n A + n B ) is positive, must m A - m B be negative, from which m A < m B follows.

[0064]

[0059] Figure 1 summarizes the aforementioned steps again as a flowchart. Here, the case where Alice calculates the necessary displacement is shown. The functionality is also explained using two example cases, which are shown in Figure 2.

[0065]

[0060] Under "Example 1" are shown in black widely separated measurements by Alice and Bob (square vs. circle), which nevertheless lie in the same quantization interval and therefore would in principle not require any further processing.

[0066]

[0061] The method according to the invention shifts the measurements so that one of them (circle or square) approaches the quantization limit (shown in red or blue). Both measurements remain within the same interval even after shifting.

[0067]

[0062] “Example 2” now shows the case where the original measurements lie in two different, adjacent quantization intervals (in black).

[0068]

[0063] By shifting the measurements to their limits, it is now possible to ensure that both measurements lie within the same quantization interval. This avoids a key error when the intervals are one epsilon smaller than the quantization interval width.

[0064] This often eliminates the need for code-based methods. Previous methods that relied on half quantization intervals would have placed the two measurements in different intervals for both examples.

[0069]

[0065] Figure 3 shows the probability of key bit deviations (KDR) depending on the noise margin.

[0070]

[0066] “Non-reconciled” (10) refers to deviations without any measures being taken, “OSC” (20) refers to our own earlier method with shifting to the midpoint of the quantization interval, and “proposed” (30) refers to the method according to the invention. Consider that the method according to the invention can correct twice as many key deviations as earlier methods that were based on half quantization intervals.

[0071]

[0067] Another embodiment of the method does not restrict the shift of the measured values ​​to the original quantization interval, but selects an arbitrary one at random.

[0072]

[0068] This enables an even distribution of the selected quantization intervals and the associated key segments, even if this even distribution was not previously given.

[0073]

[0069] For this purpose, other arbitrary limits bj i and bj are used instead of the two quantization limits bi-i and bi.

[0070] In the case of a linear quantizer with constant quantization intervals, this is equivalent to an additional shift by multiples (positive or negative) of the quantization interval width.

[0074]

[0071] The following terms are explained:

[0075]

[0072] The term “first parameter” refers in particular to a shift range. The shift range can, in principle, be communicated as a real number and / or with limited accuracy, in particular with a limited number of decimal places. The transmission of the first parameter can be carried out using a transmission method.

[0076]

[0073] In particular, for Gaussian noise, a “probability” results from the Complementary Error Function (erfc), also called the Q-function. In other words, the probability corresponds to a part of the distribution that falls into a neighboring quantization interval and / or a neighboring interval.

[0077]

[0074] A “deviation” is understood in particular to mean a Hamming distance between the bit patterns that were determined on both sides (Alice and Bob). In other words, the Hamming distance corresponds to the number of different bits.

[0078]

[0075] “Minimizing the probability” means in particular that values ​​from a physical channel measurement are shifted in such a way as to minimize the chance that the measurement at the communication partner will be in a different interval.

[0079]

[0076] In other words, the “determination” of the values ​​XA = mA - RA for Alice and correspondingly XB = mB - nB for Bob is done by forming differences of real numbers.

[0080]

[0077] The “randomly chosen increment or decrement” is represented, in particular, by the addition of a positive or negative integer when quantization intervals of equal width are numbered with integers. The addition must, in particular, be implemented such that a predefined, permissible range of values ​​for the numbering of the quantization intervals is neither exceeded nor fallen below. Reference numeral list 10 Non-reconciled 20 OSC

[0081] 30 proposed

Claims

Patent claims:

1. Method for key matching during physical-layer key generation, characterized in that first parameters are publicly exchanged between two authorized communication partners (Alice and Bob), which allow the position of physical measurements relative to quantization limits to be shifted in such a way that the probability of deviation between the bit patterns resulting from quantization is minimized for both communication partners.

2. Method according to claim 1, characterized in that, for measured values ​​mA and m B and by means of randomly independently generated values ​​nA and n B The communication partners Alice and Bob are given the values ​​XA = mA - nA for Alice and correspondingly x B = m B - n BBob is determined, whereupon the differences dA = mAnA - mAxB and dB = mBnB - mBxA are calculated for Alice and Bob, and the communication partner responsible for a shift (Alice or Bob) receives the calculated difference publicly from the other side, from which they determine a magnitude relationship between dA and d. B , whereby this from dA >d B => m A > m B , from dA < d B => m A < m B and from dA = d B => m A = m B closes, and the one for both The required value shift for the communication partner is then given as mA:= mA + 6A and ms:= ms + 6A with 6A = bi-i + E - mA if mA < ms, otherwise 6A = bi - E - mA on Alice's side or with corresponding operations on Bob's side if the shift operation is controlled there, where bi-i and bi denote the two quantization limits below and / or above mA (or ms), E denotes a small constant, and the shift range 6A (or 6B) is publicly communicated to the communication partner.

3. Method according to claim 2, characterized in that the communication partner (Alice or Bob) who determines the shift range 6A (or 6B) adds a random increment or a random decrement before transmission, whereby the shifted measured value is placed in a random arbitrary quantization interval, wherein this is done in such a way that a relative position to quantization limits is maintained.

4. Method according to claim 3, characterized in that, to realize the random increment, bi-i and bi are replaced by any other adjacent quantization limits bj-i and bj.

5. Method according to claim 3 or 4, characterized in that, in the case of linear quantization with quantization intervals of equal width, the random increment or random decrement is a multiple of the quantization interval width.

6. A computer configured in such a way that a previously described procedure can be carried out.

Images