Physical Layer Authentication for Non-coherent Massive SIMO-Based Industrial IoT Communications

The fast development of the Internet of Things (IoT) has promoted innovations in many fields. The application of the IoT in the industrial sector, referred to as industrial IoT (IIoT), has recently attracted tremendous attention from researchers and engineers owing to its ability to improve the efficiency and productivity of industry. Compared with traditional industrial networks mainly based on wired cables, wireless communications are more suitable for the IIoT due to low maintenance expenditure, flexible deployment, and higher long-term reliability [1]. However, ultra-reliable, low-latency and secure requirements of the IIoT represent main challenges for wireless design [2] [3]. Wireless channels suffer from path-loss, shadowing, fading and interference, thus it is very challenging to design wireless networks to achieve the ultra-reliable transmission[4]. Moreover, the broadcast characteristic of wireless channels makes the IIoT systems more vulnerable to attacks [5]. Non-coherent massive multiple-input multiple-output (MIMO) has recently been proposed as a promising methodology to meet ultra-reliable and low-latency requirements of IIoT communications [6], which uses multiple receive antennas to reduce the effects of fading and uncorrelated noise in wireless channels and boost system reliability. Besides, non-coherent massive MIMO uses energy-based modulation to achieve low latency by avoiding channel estimation and by applying fast non-coherent detection [7] [8]. Two security services have been commonly considered in the IIoT, including integrity and authenticity, which are essential in IIoT systems. Message authentication code (MAC) is a prevalent mechanism to provide these two services. Conventional systems realize message authentication by attaching a MAC to the message and this authentication process is completed above the physical layer [9], e.g., transport layer security (TLS) protocol in the transport layer and Wi-Fi protected access II (WPA2) protocol in the network layer. However, these conventional mechanisms may not be able to meet the stringent low-latency requirement of IIoT communications. Because short packet transmission is one of the characteristics of the IIoT, the transmission overhead for the MAC can be large and excessive in the short packet transmission with small payload, occurring relatively large delay. In addition, the authentication process can only be completed after the data has been transferred to upper layers, which leads to low efficiency. Therefore, we aim to propose a message authentication method at the physical layer which can also reduce transmission overhead.

Physical layer security, according to its implementation method, can be divided into two categories. The first category is based on the information-theoretic approach, which was proposed by Shannon [10] and further developed by Wyner with the wiretap channel model [11]. This kind of approach only guarantees data confidentiality by preventing eavesdropper from understanding the information, but other security services like data integrity and authenticity are not considered. The second category is based on the signal and channel features, which aims to provide authenticity and data integrity. In the IIoT scenario, active attacks (e.g., modification, masquerade or replay attack) are much more harmful than passive attacks (e.g., eavesdropping)[12]. Therefore, we consider physical layer authentication (PLA) from the perspective of the second category. Existing PLA methods have two forms: passive and active [13]. Passive PLA utilizes the intrinsic features of communication systems to authenticate the transmitter, such as radio signal strength indicator, channel state information (CSI) and radio frequency fingerprints [5]. These features were thoroughly analyzed in [14] with a theoretical model and experimental validation. The results of [14] revealed that the intrinsic features are not reliable in practical scenarios due to the device mobility, wireless fading channels and indistinguishable RF fingerprints. In contrast, active PLA refers to the methods in which the transmitter sends additional information (normally referred to as tag) for authentication at the physical layer. Active PLA features embedding a tag in the message information and does not take extra time to transmit the tag. Thanks to its potential to meet the low-latency requirement, active PLA has advantages over conventional authentication methods sending a message and its tag separately [15].

The key issue of implementing active PLA is how to embed a tag in message information at the physical layer. Several methods dealing with this issue have been published. The tag was added as noise in [16]: different additional angle offsets to normal quadrature phase shift keying (QPSK) indicate different tag bits. 4/16 hierarchical quadrature amplitude modulation (QAM) was applied in [17] to transmit a message and its tag simultaneously, where a 4-QAM tag constellation is superimposed on a 4-QAM message constellation. Challenge response PLA was introduced in [18] and the authentication information was embedded during a “challenge and response” process. Although these active PLA methods transmit a tag and a message at the same time, they all need to send separate pilots for channel estimation to acquire the instantaneous CSI. In [19], a tag is embedded in the original pilot to form a new pilot, and the tag detection is completed by a correlation operation. Then the new pilot signal is used to estimate CSI for message recovery. Note that these existing active PLA methods are not suitable for non-coherent massive MIMO-based IIoT systems, in which no estimation of the instantaneous CSI is performed. To our best knowledge, how to perform active PLA for non-coherent systems is still an open problem.

As the first attempt to fill this gap, we focus on designing an active PLA mechanism for non-coherent massive single-input multiple-output (SIMO) IIoT systems. As elaborated in [20], non-negative pulse amplitude modulation (PAM) is a favorable scheme for the considered system. In the system, the variance of the received signal power increases as the transmitted signal amplitude increases. In this context, the tag embedding constellation pattern is not necessary to be uniform as in the existing methods, but needs to be optimized according to the message constellation. The tag embedding design becomes a nontrivial problem as the increased tag signal power reduces the error rate of tag while increasing the error rate of message, leading to the error performance trade-off between message and tag. In this paper, we manage to find an optimal 1-bit tag embedding design based on a given message constellation. Then for a fixed average system power, we attain the optimal power allocation of message and tag signals to characterize the trade-off between message and tag error performance, which can provide useful insights for practical system design.

In this paper, we consider the PLA in a massive SIMO-based IIoT communication system, where multiple sensors transmit data to a controller with $N$ antennas. Each sensor has one single antenna and these sensors send data to the controller with time-division multiple access (TDMA) manner. An attacker is within the range of this wireless communication system, who can receive the signal from sensors and send malicious signals to the controller. To meet the low-latency requirement of the IIoT, we adopt non-negative PAM at the transmitter and non-coherent maximum likelihood (ML) detector at the receiver [6, 7, 8]. Since only statistics of the channel are needed in this method, the channel estimation process is not required and the authentication can be executed faster. To realize PLA, the transmitter embeds the tag signal in the message signal at the physical layer, as illustrated in Fig. 1. MAC is denoted by $M$, which is generated by message bits $b$ and secret key $k$ with a hash function, and it is given by

The modulated signal of $b$ and $M$ are denoted by $m$ and $t$, which are termed message signal and tag signal, respectively. The transmitted signal $x$ is then determined by

where $m\in\mathcal{M}=\{m_{i}|i=1,\cdots,L_{m}\}$ and $t\in\mathcal{T}=\{t_{i,j}|i=1,\cdots,L_{m};\ j=1,\cdots,L_{t}\}$. $L_{m}$ and $L_{t}$ are the number of constellation points of message signal and tag signal, respectively. The transmitted signal that involves message signal $m_{i}$ is denoted as $x_{i}$. The average power of message signal $E_{m}$ and the average power of tag signal $E_{t}$ are constrained by the total average system power $E_{tot}$

where $E_{m}=\frac{1}{L_{m}}\sum\limits_{i=1}^{L_{m}}|m_{i}|^{2}$ and $E_{t}=\frac{1}{L_{m}L_{t}}\sum\limits_{i=1}^{L_{m}}\sum\limits_{j=1}^{L_{t}}|t_{i,j}|^{2}$.

The received signal $\bf{y}$ at the controller in the considered massive SIMO system can be represented by

where ${\bf{h}}=[h_{1},\cdots,h_{N}]^{T}$ is the SIMO channel vector and ${\bf{n}}=[n_{1},\cdots,n_{N}]^{T}$ is the noise vector between the sensor and controller. We assume that $\bf{h}$ is a circularly symmetric complex Gaussian random vector, specifically, each element of $\bf{h}$ is independently and identically distributed with zero mean and unit variance (i.e., Rayleigh fading). Another assumption is that $\bf{n}$ is a circularly symmetric complex Gaussian random vector which is independent of $\bf{h}$. The mean vector of $\bf{n}$ is a zero vector and its covariance matrix is $\sigma^{2}{\bf I}_{N}$ . $\sigma^{2}$ is assumed to be known and ${\bf I}_{N}$ is an $N$-dimensional unit matrix.

Two steps are required in the signal detection at the receiver side. First, following the ML detection rule, the estimated message signal $\hat{m}$ is obtained by solving the problem

where $f({\bf{y}}|m)$ is the probability density function (PDF) of $\bf{y}$ conditioned on $m$. Second, the estimated tag signal $\hat{t}$ is obtained based on $\hat{m}$ with the ML rule,

where $f({\bf{y}}|\hat{m},t)$ is the PDF of $\bf{y}$ conditioned on $\hat{m}$ and $t$.

After the detection, we can get the estimated message bits $b^{\prime}$ and the estimated MAC $M^{\prime}$ with the demodulation of $\hat{m}$ and $\hat{t}$, respectively. Then a new MAC $M_{n}$ is calculated with $b^{\prime}$ and $k$ by the same hash function, i.e., $M_{n}={\rm hash}(b^{\prime},k)$. The authentication process is completed by comparing $M^{\prime}$ with $M_{n}$. If $M^{\prime}$ and $M_{n}$ are identical, the message can be regraded as coming from a legitimate user¹¹1Note that time stamps or session identifiers are required to resist replay attacks. and not being tampered with. Otherwise, this message will be discarded because it is not authenticated successfully.

In this section, we first introduce preliminaries on non-negative PAM design for message constellation in the massive SIMO system, and then present the 1-bit tag embedding design when the message constellation points are given.

In this section, the message SER and tag SER are analyzed first as the performance metrics of the proposed PLA method. Then the optimization problem of signal design is formulated and solved according to the specific system requirements.

We carried out computer simulations to verify the theoretical results. In our simulations, we set $N=128$ and $\sigma^{2}=1$.

Firstly, to show the accuracy of the message and tag error performance analysis, the theoretical and simulation results of $P_{em}$ and $P_{et}$ are demonstrated in Fig. 3 and they match with each other.

$E_{tot}$ is set to be large enough because optimization has not yet been considered. The “Message-based Tag Modulation” scheme is compared with the “Uniform Embedding” scheme that embeds same tag power levels for all message symbols. For a fair comparison, we control the tag power of two embedding schemes to make sure they have the same message SER performance (i.e., less than $10^{-5}$) when the message SNR is $10$dB. The results show that the tag SER of the proposed embedding scheme decreases as the message SNR increases. However, the tag SER of the “Uniform Embedding” scheme is always above $90\%$. Therefore, “Uniform Embedding” scheme is not suitable for PLA in non-coherent massive SIMO communications.

Then we focus on the optimal performance by solving optimization problems in Section IV-B. The message SER upper bound threshold $\delta$ is set to $10^{-5}$. The results of optimization problem (36) and the search results for power allocation are provided in Fig. 4. The tag SER decreases as the total system average power increases and the optimal power allocation factor can be found from the results.

Finally, to understand the entire system performance, the trade-off between $P_{em}$ and $P_{et}$ is depicted in Fig. 5. We can observe from the trade-off curves that the tag SER decreases as the message SER requirement threshold increases. The results in Fig. 5 also show that both tag SER and message SER can be reduced when the total system average power increases. The trade-off curve presents the optimal tag SER performance under different system requirements for message SER, which can provide useful insights for practical PLA system design.

In this paper, we proposed an active PLA mechanism for non-coherent massive SIMO-based IIoT systems. This paper is the first to show that active PLA can be achieved without the need of pilot signal and channel estimation. We designed the optimal tag embedding scheme when the message constellation is given. Then we solved the power allocation problem to obtain the optimal tag SER performance. The trade-off curve between tag SER and message SER was depicted to offer a comprehensive understanding of the system performance. From the simulation results, we can conclude that “Message-based Tag Modulation” is necessary for the considered non-coherent system. Moreover, the proposed authentication method can meet the specific power and error rate requirements of IIoT system. As an initial effort, the tag embedding design was limited to 1-bit tag per message symbol in this paper. We will extend our work to multiple bits tag per message symbol for future work.