A Multihop Key Agreement Scheme for Wireless Ad Hoc Networks Based on Channel Characteristics

Abstract

A number of key agreement schemes based on wireless channel characteristics have been proposed recently. However, previous key agreement schemes require that two nodes which need to agree on a key are within the communication range of each other. Hence, they are not suitable for multihop wireless networks, in which nodes do not always have direct connections with each other. In this paper, we first propose a basic multihop key agreement scheme for wireless ad hoc networks. The proposed basic scheme is resistant to external eavesdroppers. Nevertheless, this basic scheme is not secure when there exist internal eavesdroppers or Man-in-the-Middle (MITM) adversaries. In order to cope with these adversaries, we propose an improved multihop key agreement scheme. We show that the improved scheme is secure against internal eavesdroppers and MITM adversaries in a single path. Both performance analysis and simulation results demonstrate that the improved scheme is efficient. Consequently, the improved key agreement scheme is suitable for multihop wireless ad hoc networks.

1. Introduction

Network security (see, e.g., [1, 2]) has been studied extensively. In wireless networks, security problems are especially critical, because wireless channels are inherently broadcast channels. When a pair of nodes communicate with each other, nearby nodes within the communication range may be able to overhear their messages. In order to prevent eavesdropping, messages are often encrypted before being sent. Hence, key agreement is of great importance for security of wireless networks.

Recently, Mathur et al. [3] propose a novel key agreement scheme for wireless networks, which is based on the secrecy of the wireless channel itself. In their scheme, the two communicating nodes send probe signals to each other and measure the channels. Then, they extract secret bits from the channel measurements using a level-crossing algorithm. Because of the reciprocity of the channel, the two nodes can extract the same key from their own channel measurements. Any eavesdroppers that are more than half a wavelength away from both nodes can get no knowledge of the key, because their experienced channels are independent of the channel between the two communicating nodes. The broad applicability of this security alternative has been validated by Jana et al. [4], through a series of experiments in real environments.

However, both Mathur et al.’s and Jana et al.’s schemes require that two nodes are within the communication range of each other in order to establish a key. This requirement cannot always be satisfied. In many realistic scenarios, intermediate nodes are needed for relaying messages, because the end nodes cannot communicate directly.

In this paper, we show that it is feasible to build key agreement schemes based on wireless channel measurements in multihop wireless networks. We show that, by extracting secrets from the phase characteristics (it is feasible to extract secrets from phase characteristics—please see Section 3 for details) of channels, two end nodes that are more than one hop away from each other can establish a key between them. We propose a basic key agreement scheme for this purpose and show that it is secure against external eavesdroppers (i.e., eavesdroppers out of the paths connecting the two nodes). After that, we show that the basic scheme is subject to internal eavesdropping and Man-in-the-Middle (MITM) attacks. Therefore, we propose an improved key agreement scheme to prevent these two attacks. The improved scheme is based on the assumption that the network is biconnected. The secrets are extracted from two disjoint paths between the two end nodes. The improved scheme is secure against internal eavesdroppers and MITM adversaries in a single path. (Please see Section 5.3, Remark 7 for the possibility that adversaries control more than a single path.) In both the basic and the improved schemes, we follow the standard assumption [3–6] that adversaries are more than half a wavelength away from all the participating nodes. We give a theoretical analysis of the key agreement probability and show that it is affected by communication SNRs, sampling rates, and quantization parameters. We simulate the improved scheme in GlomoSim [7] and show that the established key has strong randomness and the key agreement efficiency is high.

In summary, we have the following contributions. (i)We propose a basic multihop key agreement scheme and prove that it is secure against external eavesdroppers. (ii)Since the basic scheme is not secure against internal eavesdroppers or MITM adversaries, we propose an improved multihop key agreement scheme, and prove that this improved scheme is secure against internal eavesdroppers and MITM adversaries in a single path between the two nodes. (iii)We give both performance analysis and simulation results of the improved scheme. The results show that the improved scheme is very efficient and the established key has strong randomness.

The rest of this paper is organized as follows. In Section 2, we review the related work. In Section 3, we present technical preliminaries. In Section 4, we present the basic multihop key agreement scheme and give a security analysis. In Section 5, we describe the improved multihop key agreement scheme and prove its security. In Sections 6 and 7, we show that the improved scheme is efficient by both theoretical analysis and simulation results. Finally, we conclude in Section 8.

2. Related Work

Key agreement based on channel characteristics is firstly proposed in Hershey et al. [8], in which the secret key is extracted from the phase differences of continuous waves. After that, Hassan et al. [9] propose to use phase differences between two orthogonal subcarriers as extracted secrets. Tope and McEachen [10] propose a key generation scheme based on polarity of power envelope differences. Recently, a lot of schemes [3–6, 11–22] are proposed to enhance the security and/or improve the performance. In particular, Mathur et al. [3] propose a scheme to extract secret bits from wireless channel measurements. They design a level-crossing algorithm to increase the bit consistency rate. They do experiments using both customized 802.11 platform and off-the-shelf 802.11 network cards. In order to validate the effectiveness of the key extraction schemes based on signal strengths, Jana et al. [4] carry out extensive experiments in various environments. They propose adaptive quantization method to improve the performance. Patwari et al. [6] propose a high-rate uncorrelated bit extraction scheme based on fractional interpolation, decorrelation transformation and multibit adaptive quantization. Ye et al. [5] propose a secret key extraction approach that is suited for more general channel state distributions. Zhang et al. [21] find that mobility patterns have important impact on the correlation of channel measurements at the end nodes. They show that more diffusion in the mobility brings less correlation in the measured channel impulse responses. Gollakota and Katabi [23] propose a secret communication method based on receiver’s jamming. Their method eliminates the reliance on channel variance and has high secret communication speed.

There are also many analytical works [24–27] that provide theoretical analysis of secret key exchange protocols and propose improved algorithms. In addition, secret key extraction schemes from UWB (Ultra-WideBand) channels are proposed in [28–31]. Croft et al. [32] propose a secret bit extraction scheme for wireless sensors, while Ali et al. [33] develop a key extraction approach in body area networks.

It is important to note that all the previous approaches focus on one single channel between two nodes. Therefore, they have the requirement that the two nodes are within the communication range of each other. In contrast, in this paper, we propose schemes that are suitable for multihop networks, in which nodes can be out of the communication range of each other. Consequently, our proposed schemes can be used for key agreement in multihop wireless networks.

Recently Wang et al. [34] propose a group key agreement scheme in wireless networks. Wang et al.’s scheme is based on the phase characteristics of wireless channels. They use phase randomness for bit generation and remove the reliance on the node mobility. According to Ren et al. [35], phase-based methods [8, 9, 16, 34] have three advantages compared to RSS-based methods [3–6], including having uniform distribution, providing high resolution phase estimation, and enabling phase accumulation across multiple nodes. Similar to [34], the schemes proposed in this paper are also based on channel phase randomness. However, our proposed schemes consider a completely different setting, in which the involved nodes can be more than one hop away from each other. In fact, allowing nodes to be multiple hops away from each other is a major technical challenge addressed in this paper. Hence, our schemes are independent from, and complementary to, the results in [34].

3. Technical Preliminaries

In a typical multihop mobile ad hoc network, there are no infrastructures. Each node is both an end host and a router. Denote the nodes in the network by {𝑁₁,𝑁₂,…,𝑁_𝑎}. If node 𝑁_𝑖 is within the communication area of 𝑁_𝑘, then we say 𝑁_𝑖 is a neighbor of 𝑁_𝑘. Without loss of generality, we assume that wireless channels are symmetric; that is, whenever a node 𝑁_𝑖 is a neighbor of 𝑁_𝑘, 𝑁_𝑘 is also a neighbor of 𝑁_𝑖. Just as in previous work [3, 4], we assume the channel between any two neighboring nodes to be reciprocal. (This assumption implies that our work is most suitable for a homogeneous network. If the network is heterogeneous, then our work needs to be modified before it can be applied.) Denote the channel from 𝑁_𝑖 to 𝑁_𝑘 by ℎ_𝑖𝑘(𝑡), and denote the channel from 𝑁_𝑘 to 𝑁_𝑖 by ℎ_𝑘𝑖(𝑡). Then the channel reciprocity indicates that ℎ_𝑖𝑘(𝑡)=ℎ_𝑘𝑖(𝑡) for any time 𝑡.

We use the phase characteristics of both the initial signals and the channel as a random source to extract the shared secret key from. (Note that using the channel phase characteristics as a source of randomness is a feasible approach, which has been adopted in existing work, e.g., [34]. A possible way to implement this can be found in [35].) From the channel reciprocity, we know that within the channel coherence time, the channel between two nodes can be assumed to be invariant. We divide the channel coherence time to equal time slots: 𝑇₁,𝑇₂,…,𝑇_𝑑. Let the length of each time slot be 𝑇𝑆, and denote the coherence time of the channel by 𝐶𝑇. Let 𝑑=⌊𝐶𝑇/𝑇𝑆⌋.

During one time slot 𝑇_𝑘, when 𝑁_𝑖 sends the initial signal to 𝑁_𝑗, we denote the signal sent from 𝑁_𝑖 by 𝑠_𝑖(𝑡). 𝑠_𝑖(𝑡) has the following representation: 𝑠_𝑖(𝑡)=𝐶_𝑖(𝑡)𝑒^{𝑗(𝜔𝑐(𝑡−𝑡0)+𝜙(𝑡))}. (1) In (1), 𝐶_𝑖(𝑡) is the amplitude of 𝑠_𝑖(𝑡). 𝜔_𝑐 and 𝜙(𝑡) are the center frequency and the initial phase of 𝑠_𝑖(𝑡), respectively. We emphasize that it is feasible to send a signal with a given phase 𝜙(𝑡)—in fact, some existing schemes like [34] already include such operations. In order to implement such an operation, one can use analog-to-digital converters [35].

Definition of Adversaries.  In this paper, we consider three different kinds of adversaries: internal eavesdropper, external eavesdropper, and MITM adversary. Here both internal eavesdroppers and external eavesdroppers refer to passive adversaries that eavesdrop messages and attempt to figure out the established key. The difference between these two types of adversaries is that an internal eavesdropper is an intermediate node in a path selected for transmitting messages for key agreement, while an external eavesdropper is not an intermediate node in any such path. Unlike these two types of passive adversaries, an MITM adversary is an active adversary who controls one or more node in a path selected for transmitting messages for key agreement and carries out an MITM attack. A little more formally, we have the following definitions.

Definition 1. A multihop key agreement scheme is secure against a set of external eavesdroppers if, assuming all involved nodes follow the protocol faithfully, all signals overheard by this set of eavesdroppers are statistically independent from the final key generated by this scheme.

Definition 2. A multihop key agreement scheme is secure against a set of internal eavesdropper if, assuming all involved nodes follow the protocol faithfully, all packets received by this set of eavesdroppers, together with all signals overheard by this set of eavesdropper, are statistically independent from the final key generated by this scheme.

Definition 3. A multihop key agreement scheme is secure against a set of MITM adversaries if, assuming all involved nodes except this set of MITM adversaries follow the protocol faithfully, the final keys different nodes obtain are consistent; furthermore, all packets received by this set of MITM adversaries, together with all signals overheard by this set of adversary, are statistically indepedent from the final key generated by this scheme.

4. The Basic Multihop Key Agreement Scheme

In this section, we propose a basic multihop key agreement scheme. The basic scheme is built on one selected path between the two nodes that want to agree on a secret key. It is secure against any external eavesdroppers as long as those eavesdroppers are more than half a wavelength away from all the nodes in the selected path.

4.1. Scheme Outline

The basic idea of this multihop key agreement scheme is to use both the channel phase characteristics of the selected path and the randomly selected initial phases to extract common secrets (i.e., secrets known only to 𝐴 and 𝐵). By using quantization, these common secrets are quantized into common secret bits. After that, information reconciliation and privacy amplification are used [36–38] on the common secret bits, so that a secret key can be generated. When the external eavesdroppers are more than half a wavelength away, they will experience channels that are independent of the channels in the selected path [3, 4].

In order to have 𝑘 common secret bits, the two parties (denoted by 𝐴 and 𝐵) need to interact with each other for ⌈𝑘/𝑞⌉ rounds, assuming in each round that they can get 𝑞 bits from quantization. In each round, 𝐴 picks a random phase value, and sends an initial signal with this initial phase value to 𝐵 using the selected path. Each intermediate node in this path estimates the phase of the signal received from its antecedent node and sends a new signal with this estimated phase to its subsequent node. Note that 𝐴 is the first node in the path, and 𝐵 is the last node in the path. Hence, 𝐴 has a subsequent node only, and 𝐵 has an antecedent node only. After 𝐵 receives the signal from its antecedent node, it picks a random phase value and sends an initial signal with this initial phase value back to 𝐴, along the reverse path. Each intermediate node estimates the phase of the signal received from its subsequent node, and sends a new signal with the estimated phase to its antecedent node. Finally 𝐵 (resp., 𝐴) estimates the phase of the signal received from its antecedent (resp., subsequent) node and adds the estimated phase with its randomly generated initial phase. The sums generated by 𝐴 and 𝐵 both reflect characteristics of all the channels in the path and the random initial phase values picked by 𝐴 and 𝐵. In order to make sure that they are highly correlated, each round is completed within the channel coherence time. The random initial phase values picked by 𝐴 and 𝐵 are sources of randomness of the extracted common secrets.

After extracting common secrets from the channels and the random initial phase values, 𝐴 and 𝐵 perform independent quantization on these secrets and get common secret bits. The discrepancies between common secret bits of 𝐴 and 𝐵 are corrected by information reconciliation. The lost entropy of performing the information reconciliation is reduced by privacy amplification. In the following, we give detailed descriptions of these steps. After that, we give analysis of the basic scheme.

4.2. Common Secret Extraction

The common secret extraction consists of ⌈𝑘/𝑞⌉ rounds, and each round contains (2𝑚+2) time slots. Figure 1 illustrates the signal transmission involved in one round.

Figure 1 

Illustration of signal transmission in one round.

In the following, we describe steps involved in one round.(1) In the time slot 𝑇₁=[0,0+𝑇𝑆], 𝐴 sends the initial signal 𝑠_𝑎(𝑡) with phase 𝜙₁ to 𝑅₁, where the value of 𝜙₁ is randomly picked by 𝐴 from [0,2𝜋) (and thus known to 𝐴). Without loss of generality, we assume that 𝑠_𝑎(𝑡) has a unit power level. Denote the signal received at 𝑅₁ by 𝑟_𝐴,𝑅1. Then we get that 𝑟_𝐴,𝑅1(𝑡)=𝛼_𝐴,𝑅1(𝑡)𝑒^{𝑗(𝜔𝑐𝑡+𝜙1𝐴,𝑅)}+𝑛_𝑅1(𝑡), where 𝛼_𝐴,𝑅1(𝑡) and 𝜙_𝐴,𝑅1 denote the amplitude and phase of the signal received from 𝐴, and 𝑛_𝑅1(𝑡) denotes the receiver noise at 𝑅₁. (2) The phase of 𝑟_𝐴,𝑅1(𝑡) is 𝜙_𝐴,𝑅1=𝜙₁+𝜓_𝐴,𝑅1, in which 𝜓_𝐴,𝑅1 denotes the phase offset of the channel between 𝐴 and 𝑅₁. 𝑅₁ computes the estimate of 𝜙_𝐴,𝑅1, which we denote by 𝜙_𝐴,𝑅1. After that in 𝑇₂, 𝑅₁ sends a unit signal to 𝑅₂ whose phase is tuned to 𝜙_𝐴,𝑅1. (3) For 𝑖=2,3,…,𝑚−1, in the time slot 𝑇_𝑖+1, 𝑅_𝑖 computes the phase estimate of the signal received from 𝑅_𝑖−1 and sends a new unit signal with this phase estimate to 𝑅_𝑖+1. In 𝑇_𝑚+1, 𝑅_𝑚 sends the signal 𝑒^{𝑗(𝑤𝑐(𝑡−𝑚⋅𝑇𝑆)+}𝜙_{𝑚𝐴,𝑅)} to 𝐵. (4) In the time slot 𝑇_𝑚+2, 𝐵 sends the initial signal 𝑠_𝑏(𝑡) with phase 𝜙₂ to 𝑅_𝑚, where 𝑠_𝑏(𝑡) also has a unit power level, and 𝜙₂ is picked randomly by 𝐵 from [0,2𝜋) (and thus known to 𝐵). Denote the signal received at 𝑅_𝑚 by 𝑟_{𝐵,𝑅𝑚}. Then 𝑟_{𝐵,𝑅𝑚}(𝑡)=𝛼_{𝐵,𝑅𝑚}(𝑡)𝑒^{𝑗(𝜔𝑐(𝑡−(𝑚+1)⋅𝑇𝑆)+𝜙𝑚𝐵,𝑅)}+𝑛_𝑅𝑚(𝑡). The phase of 𝑟_{𝐵,𝑅𝑚}(𝑡) is 𝜙_{𝐵,𝑅𝑚}=𝜙₂+𝜓_{𝐵,𝑅𝑚}, in which 𝜓_{𝐵,𝑅𝑚} denotes the phase of the channel between 𝐵 and 𝑅_𝑚. (5) For 𝑖=𝑚+3,𝑚+4,…,2𝑚+1, in 𝑇_𝑖,  𝑅_{2𝑚+3−𝑖} sends the signal 𝑒^{𝑗(𝑤𝑐(𝑡−(𝑖−1)⋅𝑇𝑆)+}𝜙_{𝐵,𝑅2𝑚+3−𝑖)} to 𝑅_{2𝑚+2−𝑖}. In 𝑇_2𝑚+2, 𝑅₁ sends the signal 𝑒^{𝑗(𝑤𝑐(𝑡−(2𝑚+1)⋅𝑇𝑆)+}𝜙_1𝐵,𝑅) to 𝐴. (6) From the previous steps 𝐵 receives 𝑟_{𝑅𝑚,𝐵}, and 𝐴 receives 𝑟_𝑅1,𝐴. It is easy to see that 𝑟_{𝑅𝑚,𝐵}(𝑡)=𝛼_{𝑅𝑚,𝐵}(𝑡)𝑒^{𝑗(𝑤𝑐(𝑡−𝑚⋅𝑇𝑆)+𝜙𝐴,𝐵,1)}+𝑛_𝐵(𝑡),𝑟_𝑅1,𝐴(𝑡)=𝛼_𝑅1,𝐴(𝑡)𝑒^{𝑗(𝑤𝑐(𝑡−(2𝑚+1)⋅𝑇𝑆)+𝜙𝐵,𝐴,1)}+𝑛_𝐴(𝑡), (2) where 𝜙_𝐴,𝐵,1 and 𝜙_𝐵,𝐴,1 denote the signal phases of 𝑟_{𝑅𝑚,𝐵} and 𝑟_𝑅1,𝐴, respectively. 𝐵 computes 𝐼_𝐵=(𝜙_𝐴,𝐵,1+𝜙₂)𝗆𝗈𝖽2𝜋, and 𝐴 computes 𝐼_𝐴=(𝜙_𝐵,𝐴,1+𝜙₁)𝗆𝗈𝖽2𝜋. From 𝐼_𝐵 and 𝐼_𝐴, 𝐵 and 𝐴 extract common secret bits.

We denote such a round by Round(𝐴,𝐵,𝑚). Apparently Round(𝐴,𝐵,𝑚) needs to take (2𝑚+2) time slots.

From the previous protocol process, we can get that 𝐼_𝐵=(𝜙_𝐴,𝐵,1+𝜙₂)𝗆𝗈𝖽2𝜋={𝖾𝗌𝗍(𝜙₁+𝜓_𝐴,𝑅1+∑^𝑚−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_{𝑅𝑚,𝐵})+𝜙₂}𝗆𝗈𝖽2𝜋 and 𝐼_𝐴=(𝜙_𝐵,𝐴,1+𝜙₁)𝗆𝗈𝖽2𝜋={𝖾𝗌𝗍(𝜙₂+𝜓_{𝐵,𝑅𝑚}+∑^𝑚−1_𝑖=1𝜓_{𝑅𝑖+1,𝑅𝑖}+𝜓_𝑅1,𝐴)+𝜙₁}𝗆𝗈𝖽2𝜋. From the channel reciprocity, 𝐼_𝐵 and 𝐼_𝐴 are highly correlated if the measurements are within the channel coherence time. Hereafter, suppose that 𝐴 and 𝐵 carry out 𝑧 rounds of Round(𝐴,𝐵,𝑚), and denote the extracted secret vectors by [𝐼_𝐴,1,𝐼_𝐴,2,…,𝐼_𝐴,𝑧] and [𝐼_𝐵,1,𝐼_𝐵,2,…,𝐼_𝐵,𝑧], respectively.

4.3. Quantization

After 𝑧 rounds of common secret extraction, 𝐴 has got the secret vector [𝐼_𝐴,1,𝐼_𝐴,2,…,𝐼_𝐴,𝑧], and 𝐵 has got the secret vector [𝐼_𝐵,1,𝐼_𝐵,2,…,𝐼_𝐵,𝑧]. For 𝑍∈{𝐴,𝐵}  and  𝑘=1,2,…,𝑧,  𝐼_𝑍,𝑘 is in the range of [0,2𝜋). Now 𝐴 and 𝐵 quantize each value in their vectors into common secret bits. Specifically, we divide the interval [0,2𝜋) into 𝑞 equal subintervals. Denote these subintervals by [0,2𝜋/𝑞),[2𝜋/𝑞,4𝜋/𝑞),…,[2(𝑞−1)𝜋/𝑞,2𝜋). We quantize each subinterval into 𝗅𝗈𝗀₂(𝑞) bits using the Gray code [39]. By using Gray code, adjacent subintervals have only one bit discrepancy after quantization, which reduces the number of bit errors caused by estimation errors.

Denote the length of the targeted secret key by 𝑘. In order to generate the key, 𝐴 and 𝐵 need to interact with each other for at least ⌈𝑘/𝑞⌉ rounds.

4.4. Information Reconciliation and Privacy Amplification

Because there exist noises and interferences at the receivers, 𝐴 and 𝐵 can get discrepancies at some common secret bits. They can achieve secret bits reconciliation by transmitting error correcting information through a public channel, which is called information reconciliation [40, 41]. We use the classic Cascade protocol [40] to perform reconciliation between the extracted secret bits. For completeness we briefly review the Cascade protocol.

Denote the two secret bit strings at 𝐴 and 𝐵 by 𝐵𝑆_𝐴 and 𝐵𝑆_𝐵. In the Cascade protocol, each of the two bit strings are divided into disjoint blocks. One party sends the parity values of all the blocks to the other party. If an odd number of errors are found within any block, 𝐴 and 𝐵 perform an interactive binary error search on that block, until one bit error is corrected. The Cascade protocol consists of several rounds, depending on the rate of bit discrepancies between 𝐵𝑆_𝐴 and 𝐵𝑆_𝐵. If in the 𝑘th (𝑘≥2) round, one error is corrected at the 𝑖th bit, and then any other block that contains the 𝑖th bit also contain an odd number of errors, which need to be corrected subsequently. Only minimal information gets leaked out if the number of rounds and the block size are selected appropriately.

After the information reconciliation, privacy amplification [36–38] is used to reduce the side information leaked during information reconciliation. We use the following 2-universal hash family [4]: 𝑔_𝑎,𝑏(𝑥)=(𝑎𝑥+𝑏)𝗆𝗈𝖽𝑝_𝑀,ℎ_𝑎,𝑏(𝑥)=𝑔_𝑎,𝑏(𝑥)𝗆𝗈𝖽𝑚,𝑥∈{1,2,…,𝑀},𝑎∈1,𝑝_𝑀−1,𝑏∈0,𝑝_𝑀−1, (3) where 𝑝_𝑀 is a prime number that satisfies 𝑝_𝑀>𝑀. This 2-universal hash family consists of all the functions ℎ that map from {1,2,…,𝑀} to {0,1}^𝑚. One party randomly selects 𝑎 and 𝑏 and sends them to the other party. We divide the secret bits after reconciliation into blocks of 𝗅𝗈𝗀₂(𝑀) bits, and 𝑚 is decided based on the required secret key length.

After these two processes, the generated keys at 𝐴 and 𝐵 are cryptographic secure keys. 𝐴 and 𝐵 can use the generated key for secret communications.

4.5. Security Analysis of the Basic Scheme

In this section, we present a security analysis of the basic scheme. Firstly we argue that the basic scheme is secure against any external eavesdroppers that are more than half a wavelength away from all the nodes in the selected path. Secondly we show that threats from internal adversaries can affect the security of the scheme. Finally we show that MITM attack is possible in the basic scheme. (Recall that internal eavesdroppers, external eavesdroppers, and MITM adversary are defined at the end of Section 3.)

4.5.1. Security against Any External Eavesdropper

If all the external eavesdroppers are more than half a wavelength away from all the nodes in the selected path, then their experienced channels are independent of channels between nodes in the selected path.

In the following we analyze the security of the basic scheme when there exists only one external eavesdropper. The analysis can be similarly extended to the case in which there are more than one eavesdroppers. In Figure 2, denote the eavesdropper by 𝐸. From Round(𝐴,𝐵,𝑚), 𝐸 gets the following estimated phases from its received signals: 𝖾𝗌𝗍𝜙₁+𝜓_𝐴,𝐸𝖾𝗌𝗍𝜙₁+𝜓_𝐴,𝑅1+^𝑘−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_{𝑅𝑘,𝐸}[]𝜙,𝑘∈1,𝑚𝖾𝗌𝗍₂+𝜓_𝐵,𝐸𝖾𝗌𝗍𝜙₂+𝜓_{𝐵,𝑅𝑚}+^𝑚−1_𝑖=𝑘𝜓_{𝑅𝑖+1,𝑅𝑖}+𝜓_{𝑅𝑘,𝐸},𝑘∈[1,𝑚]. (4)

Figure 2 

Illustration of one external eavesdropper in the basic scheme.

In (4), 𝐸 gets 𝖾𝗌𝗍(𝜙₁+𝜓_𝐴,𝐸) at 𝑇₁ from 𝐴 and gets 𝖾𝗌𝗍(𝜙₁+𝜓_𝐴,𝑅1+∑^𝑘−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_{𝑅𝑘,𝐸}) at 𝑇_𝑘+1 from 𝑅_𝑘,  𝑘∈[1,𝑚]. On the other hand, 𝐸 gets 𝖾𝗌𝗍(𝜙₂+𝜓_𝐵,𝐸) at 𝑇_𝑚+2 from 𝐵 and gets 𝖾𝗌𝗍(𝜙₂+𝜓_{𝐵,𝑅𝑚}+∑^𝑚−1_𝑖=𝑘𝜓_{𝑅𝑖+1,𝑅𝑖}+𝜓_{𝑅𝑘,𝐸}) at 𝑇_𝑚+2+𝑘 from 𝑅_{𝑚+1−𝑘},  𝑘∈[1,𝑚].

Because 𝜙₁ and 𝜙₂ are randomly selected by 𝐴 and 𝐵, respectively, these estimated phases are also random. Because 𝜓_𝐴,𝐸 is independent of 𝜓_𝐴,𝑅1, 𝐸 cannot get any knowledge of (𝜙₁+𝜓_𝐴,𝑅1) from 𝖾𝗌𝗍(𝜙₁+𝜓_𝐴,𝐸). Similarly, 𝐸 cannot get any knowledge of (𝜙₁+𝜓_𝐴,𝑅1+∑^𝑘−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_{𝑅𝑘,𝐵}),  𝑘∈[1,𝑚] from 𝖾𝗌𝗍(𝜙₁+𝜓_𝐴,𝑅1+∑^𝑘−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_{𝑅𝑘,𝐸}),  𝑘∈[1,𝑚]. Finally, during the channel coherence time, no probe signals are transmitted between the nodes in the selected path, so 𝜓_𝐴,𝐸, 𝜓_{𝑅𝑘,𝐸}, 𝑘∈[1,𝑚] and 𝜓_𝐵,𝐸 are unknown to 𝐸. Therefore, from these estimated phase values, 𝐸 gets no knowledge of the extracted secrets at 𝐴 or 𝐵.

We stress that it is realistic to assume that the external eavesdroppers are at least half a wavelength away. When the carrier frequency is 2.437 GHz (one of the frequency band of 802.11 b), the wavelength of the carrier is (3⋅10⁸m/s)/(2.437⋅10⁹Hz)≈0.12m. Half a wavelength is only about 6 centimeters. Within such a distance, it is hard for an eavesdropper to avoid being detected.

4.5.2. Threats of Internal Adversaries

In the basic scheme, each of the internal nodes can get the complete knowledge of the extracted secrets at 𝐴 and 𝐵. If one of them is corrupted, then the scheme is not secure. For example, if 𝑅_𝑘 is corrupted, based on its received signals from 𝑅_𝑘−1 and 𝑅_𝑘+1, it gets 𝜙_{𝐴,𝑅𝑘}=𝖾𝗌𝗍(𝜙₁+𝜓_𝐴,𝑅1+∑^𝑘−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1}) and 𝜙_{𝐵,𝑅𝑘}=𝖾𝗌𝗍(𝜙₂+∑^𝑚−1_𝑖=𝑘𝜓_{𝑅𝑖+1,𝑅𝑖}+𝜓_{𝐵,𝑅𝑚}). By adding up these two values, 𝑅_𝑘 gets an estimate, which is highly correlated to both 𝐼_𝐵 and 𝐼_𝐴. Therefore, if one of the intermediate nodes is corrupted, the basic scheme is not secure.

4.5.3. MITM Attack

Because there are 𝑚 intermediate nodes between 𝐴 and 𝐵, any of them can carry out an MITM attack. Suppose that 𝑅_𝑘 intends to carry out an MITM attack and establish two different keys with 𝐴 and 𝐵, respectively. Specifically, 𝑅_𝑘 agrees on one key with 𝐴, based on the subpath 𝐴→𝑅₁→⋯→𝑅_𝑘; 𝑅_𝑘 agrees on another key with 𝐵, based on the other subpath 𝑅_𝑘→𝑅_𝑘+1→⋯→𝐵. The MITM attack consists of the following steps:(1) In each round, 𝑅_𝑘 performs the following steps: (a) When 𝑅_𝑘 receives the signal 𝑟_{𝑅𝑘−1,𝑅𝑘}=𝛼_{𝑅𝑘−1,𝑅𝑘}(𝑡)𝑒^{𝑗(𝑤𝑐(𝑡−(𝑘−1)⋅𝑇𝑆)+𝜙𝑘𝐴,𝑅)} from 𝑅_𝑘−1, it picks a random value 𝜙_𝑘,1∈[0,2𝜋) and sends 𝑠_𝑘,1(𝑡)=𝑒^{𝑗(𝑤𝑐(𝑡−𝑘⋅𝑇𝑆)+𝜙𝑘,1)} to 𝑅_𝑘+1. (b) When 𝑅_𝑘 receives the signal 𝑟_{𝑅𝑘+1,𝑅𝑘}=𝛼_{𝑅𝑘+1,𝑅𝑘}(𝑡)𝑒^{𝑗(𝑤𝑐(𝑡−(2𝑚+1−𝑘)⋅𝑇𝑆)+𝜙𝑘𝐵,𝑅)} from 𝑅_𝑘+1, it picks a random value 𝜙_𝑘,2∈[0,2𝜋) and sends 𝑠_𝑘,2(𝑡)=𝑒^{𝑗(𝑤𝑐(𝑡−(2𝑚+2−𝑘)⋅𝑇𝑆)+𝜙𝑘,2)} to 𝑅_𝑘−1. (c)𝑅_𝑘 computes the estimates of 𝜙_{𝐴,𝑅𝑘} and 𝜙_{𝐵,𝑅𝑘}. Denote these two estimates by 𝜙_{𝐴,𝑅𝑘} and 𝜙_{𝐵,𝑅𝑘}, respectively. (d)𝑅_𝑘 computes 𝐼_𝑘,𝐵=𝜙_{𝐵,𝑅𝑘}+𝜙_𝑘,1 and 𝐼_𝑘,𝐴=𝜙_{𝐴,𝑅𝑘}+𝜙_𝑘,2. 𝑅_𝑘 then quantizes 𝐼_𝑘,𝐵 and 𝐼_𝑘,𝐴 to generate secret bit strings 𝑄_𝑘,𝐵 and 𝑄_𝑘,𝐴. Denote the length of 𝑄_𝑘,𝐵 and 𝑄_𝑘,𝐴 by 𝑞 bits. (2) After 𝑧 rounds, 𝑅_𝑘 gets 𝑆𝑇_𝑘,𝐵=𝑄_𝑘,𝐵,1‖𝑄_𝑘,𝐵,2‖⋯‖𝑄_{𝑘,𝐵,𝑧} and 𝑆𝑇_𝑘,𝐴=𝑄_𝑘,𝐴,1‖𝑄_𝑘,𝐴,2‖⋯‖𝑄_{𝑘,𝐴,𝑧}, in which ‖ denotes the string concatenation operation. Both 𝑆𝑇_𝑘,𝐵 and 𝑆𝑇_𝑘,𝐴 have a length of (𝑧⋅𝑞) bits. 𝑅_𝑘 uses 𝑆𝑇_𝑘,𝐵 to agree on a secret key KEY_𝑘,𝐵 with 𝐵, and uses 𝑆𝑇_𝑘,𝐴 to agree on a secret key KEY_𝑘,𝐴 with 𝐴.

From the attack process we can see that 𝐼_𝑘,𝐵=𝜙_{𝐵,𝑅𝑘}+𝜙_𝑘,1=𝖾𝗌𝗍(𝜙₂+𝜓_{𝐵,𝑅𝑚}+∑^𝑚−1_𝑖=𝑘𝜓_{𝑅𝑖+1,𝑅𝑖})+𝜙_𝑘,1, and 𝐼_𝐵=𝖾𝗌𝗍(𝜙_𝑘,1+∑^𝑚−1_𝑖=𝑘𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_{𝑅𝑚,𝐵})+𝜙₂. Both 𝐼_𝑘,𝐵 and 𝐼_𝐵 can be viewed as estimates of 𝜙_𝑘,1+∑^𝑚−1_𝑖=𝑘𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_{𝑅𝑚,𝐵}+𝜙₂. By using follow-up quantization, information reconciliation and privacy amplification techniques, 𝑅_𝑘 and 𝐵 can agree on a secret key KEY_𝑘,𝐵. Similarly, both 𝐼_𝑘,𝐴 and 𝐼_𝐴 can be viewed as estimates of 𝜙_𝑘,2+∑^𝑘−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_𝐴,𝑅1+𝜙₁. So 𝑅_𝑘 and 𝐴 can also agree on a secret key KEY_𝑘,𝐴. In this way, 𝑅_𝑘 carries out the MITM attack successfully.

4.6. Possible Reduction of Estimation Errors

Given the basic scheme we have designed, there are possible ways to reduce the estimation errors. For instance, the intermediate nodes between 𝐴 and 𝐵 may append fix phase delay on forward and backward paths; that is, let Ψ_{𝑅𝑖,𝑅𝑖+1}=Ψ_{𝑅𝑖+1,𝑅𝑖}. This would not reduce secrecy because 𝜙₁ and 𝜙₂ are random and unknown to the intermediate nodes.

5. The Improved Multihop Key Agreement

Because the basic scheme suffers from threats of internal adversaries and the MITM attack, in this section, we propose an improved multihop key agreement scheme.

5.1. Scheme Outline

In the improved multihop key agreement scheme, we assume that the network is biconnected. Therefore, between any pair of nodes, we can find at least two disjoint paths. The basic scheme suffers from threats from internal adversaries and the MITM attack because the signals are only transmitted in one path. Any node in that path can get knowledge of the extracted common secret bits and can perform the MITM attack. We design the improved multihop key agreement scheme to make it impossible for nodes in one path to get knowledge of the secret key or control it.

We emphasize that the previous goal of security is nontrivial to achieve. In particular, we consider a simple protocol, which we call SMPP hereafter. Assume that there are two disjoint paths Path_𝐴 and Path_𝐵 between 𝐴 and 𝐵. SMPP starts by letting 𝐴 and 𝐵 generate key 𝐾_𝐴 over Path_𝐴 and key 𝐾_𝐵 over Path_𝐵. Then, 𝐴 generates two random sequences 𝑆_𝐴 and 𝑆_𝐵, respectively, and sends 𝐾_𝐴⊕𝑆_𝐴 over Path_𝐵 to 𝐵 and 𝐾_𝐵⊕𝑆_𝐵 over Path_𝐴 to 𝐵. Finally, 𝐵 computes 𝑆_𝐴 by XORing his received value of 𝐾_𝐴⊕𝑆_𝐴 with 𝐾_𝐴; similarly, he computes 𝑆_𝐵. The final key agreed by 𝐴 and 𝐵 is the 𝑆_𝐴‖𝑆_𝐵.

Note that SMPP cannot really work against MITM attacks. For example, suppose that there is a node 𝑁_Adv controlled by the adversary in the middle of Path_𝐴. When 𝐴 and 𝐵 try to generate 𝐾_𝐴 over Path_𝐴, 𝑁_Adv launches an MITM attack and makes them disagree on the value of 𝐾_𝐴. (This is very easy in general, because 𝑁_Adv can simply play 𝐵’s role when talking to its neighbor on 𝐴’s side and play 𝐴’s role when talking to its neighbor on 𝐵’s side. In this way, 𝐴 and 𝑁_Adv agree on one value of 𝐾_𝐴, while 𝑁_Adv and 𝐵 agree on another value of 𝐾_𝐴.) Hence, 𝐴 believes that the value of 𝐾_𝐴 is 𝐾^𝐴_𝐴, while 𝐵 believes that the value of 𝐾_𝐴 is 𝐾^𝐵_𝐴. Both values (𝐾^𝐴_𝐴 and 𝐾^𝐵_𝐴) are private against nodes in path 𝐵. Also suppose that all nodes in Path_𝐵 are honest and so 𝐴 and 𝐵 agree on the value of 𝐾_𝐵, which is private against nodes in Path_𝐴. Next, 𝐴 generates 𝑆_𝐴 and 𝑆_𝐵 and sends 𝐾^𝐴_𝐴⊕𝑆_𝐴 over path 𝐵 and 𝐾_𝐵⊕𝑆_𝐵 over path 𝐴. Assume that 𝑁_Adv does not tamper with these transmitted values. Therefore, 𝐵 receives these values correctly. However, since 𝐵 has a different belief about the value of 𝐾_𝐴, when 𝐵 tries to recover the value of 𝑆_𝐴, he will get 𝐾^𝐴_𝐴⊕𝑆_𝐴⊕𝐾^𝐵_𝐴 instead of 𝑆_𝐴. In other words, 𝐴 and 𝐵 will disagree on the value of 𝑆_𝐴, which is part of the final key.

In order to achieve our goal of security, we use a better approach. We send the initial signals along two disjoint paths between 𝐴 and 𝐵, perform estimation, and forwarding at intermediate nodes and add up the estimated phases of received signals from two paths at the two end nodes. In this way, the sum of phases contain not only the initial random values picked for phases, but also channel phase characteristics of both the two paths. Any adversaries within one single path can neither get the established secret key nor carry out a successful MITM attack.

In the improved multihop key agreement scheme, 𝐴 and 𝐵 jointly discover two disjoint paths between them. Denote the lengths of the two paths by 𝑚 and 𝑛, respectively. After that, 𝐴 and 𝐵 carry out Round(𝐴,𝐵,𝑚) along the first path and Round(𝐴,𝐵,𝑛) along the second path. They interact with each other for sufficient rounds in order to get the targeted common secret bits. In each round, they add up extracted secrets from both rounds together. Finally, 𝐴 and 𝐵 perform quantization, information reconciliation and privacy amplification to get the secret key.

When performing the first step, existing node-disjoint routing discovery protocols [42, 43] can be used. In the improved scheme, we do not assume that there are any preloaded keys or public key infrastructures in the network. Secure routing protocols based on malicious node detection and trust based routing protocols [44–46] can meet this requirement. Using one of these protocols, 𝐴 can find two disjoint paths to 𝐵. After that, 𝐴 and 𝐵 perform the rest of the multihop key agreement protocol by using the two paths.

5.2. The Improved Scheme—Detailed Description

Denote the two disjoint paths between 𝐴 and 𝐵 by 𝐴→𝑅₁→𝑅₂→⋯→𝑅_𝑚→𝐵 and 𝐴→𝑆₁→𝑆₂→⋯→𝑆_𝑛→𝐵, as shown in Figure 3.

Figure 3 

Disjoint routes between 𝐴 and 𝐵.

The improved scheme consists of the following steps.(1)For 𝑖=1 to 𝑧, 𝐴 and 𝐵 perform Round(𝐴,𝐵,𝑚) along the first path and perform Round(𝐴,𝐵,𝑛) along the second path. Without loss of generality, let 𝐴 (resp., 𝐵) use the same initial phase 𝜙_1,𝑖 (resp., 𝜙_2,𝑖) for Round(𝐴,𝐵,𝑚) and Round(𝐴,𝐵,𝑛). We reset the starting time to 0 after each round. From Round(𝐴,𝐵,𝑚), 𝐴 and 𝐵 get 𝐼⁽¹⁾_𝐴,𝑖 and 𝐼⁽¹⁾_𝐵,𝑖 as their extracted common secrets; from Round(𝐴,𝐵,𝑛), 𝐴 and 𝐵 get 𝐼⁽²⁾_𝐴,𝑖 and 𝐼⁽²⁾_𝐵,𝑖 as their extracted common secrets. 𝐴 and 𝐵 get their final common secrets by computing 𝐼_𝐴,𝑖=𝐼⁽¹⁾_𝐴,𝑖+𝐼⁽²⁾_𝐴,𝑖𝗆𝗈𝖽2𝜋 and 𝐼_𝐵,𝑖=𝐼⁽¹⁾_𝐵,𝑖+𝐼⁽²⁾_𝐵,𝑖𝗆𝗈𝖽2𝜋, respectively. Denote their extracted secret vectors by [𝐼_𝐴,1,𝐼_𝐴,2,…,𝐼_𝐴,𝑧] and [𝐼_𝐵,1,𝐼_𝐵,2,…,𝐼_𝐵,𝑧], respectively. (2)𝐴 quantizes each value in the vector [𝐼_𝐴,1,𝐼_𝐴,2,…,𝐼_𝐴,𝑧], and 𝐵 quantizes each value in the vector [𝐼_𝐵,1,𝐼_𝐵,2,…,𝐼_𝐵,𝑧]. Denote their generated bit strings by 𝐵𝑆_𝐴 and 𝐵𝑆_𝐵, respectively. (3)𝐴 and 𝐵 perform information reconciliation and privacy amplification on 𝐵𝑆_𝐴 and 𝐵𝑆_𝐵. After these two processes, they get the secret key.

5.3. Security Analysis

In this section, we give a security analysis of the improved scheme. This security analysis is based on the assumption that all participating nodes are more than half a wavelength away from each other. Just as mentioned in Section 4.5.1, this is a reasonable assumption.

The security of the improved scheme is guaranteed against adversaries in a single path. Collusion attack from adversaries of both paths is not considered. In the following we first prove that the improved scheme is secure against any internal eavesdroppers in a single path. After that we prove that the improved scheme is secure against any MITM adversaries in a single path. (Recall that internal eavesdroppers and MITM adversary are defined at the end of Section 3.)

Theorem 4. Under the assumption that all nodes are more than half a wavelength away from each other, the improved multihop key agreement scheme is secure against any internal eavesdroppers in a single path.

Proof. In this proof we enumerate all the phase information that the routing nodes can extract and then point out that they cannot generate any useful information about 𝐴 and 𝐵’s secrets.
In the following we consider the collected phase information at an intermediate node in one round. Because the extracted common secrets at each round are quantized separately, they cannot be used for getting knowledge of secrets of other rounds. Consider 𝑅₁ in the first path 𝐴→𝑅₁→𝑅₂→⋯→𝑅_𝑚→𝐵. 𝑅₁ receives signals from both 𝐴 and 𝑅₂. From the signals received from 𝐴 and 𝑅₂, 𝑅₁ gets 𝜙_𝐴,𝑅1=𝜙₁+𝜓_𝐴,𝑅1 and 𝜙_𝐵,𝑅1=𝖾𝗌𝗍(𝜙₂+∑^𝑚−1_𝑘=1𝜓_{𝑅𝑘+1,𝑅𝑘}+𝜓_{𝐵,𝑅𝑚}), respectively. From these two phase estimates, 𝑅₁ can only get the value of 𝜙_𝐴,𝑅1+𝜙_𝐵,𝑅1. However, the secrets obtained by 𝐴 and 𝐵 also include the phase estimates through the other path 𝐴→𝑆₁→𝑆₂→⋯→𝑆_𝑛→𝐵. So we can see that 𝑅₁ can get no information about the secrets.
For each intermediate node 𝑅_𝑘 in the first path, we enumerate its estimated phases as follows: 𝜙_{𝐴,𝑅𝑘}=𝖾𝗌𝗍𝜙₁+𝜓_𝐴,𝑅1+^𝑘−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1},𝜙_{𝐵,𝑅𝑘}=𝖾𝗌𝗍𝜙₂+^𝑚−1_𝑖=𝑘𝜓_{𝑅𝑖+1,𝑅𝑖}+𝜓_{𝐵,𝑅𝑚}. (5) Because all the 𝑚 intermediate nodes are more than half a wavelength away from other nodes, they cannot get the phase information from the other path; that is, 𝜓_𝐴,𝑆1+∑^𝑛−1_𝑘=1𝜓_{𝑆𝑘,𝑆𝑘+1}+𝜓_{𝑆𝑛,𝐵}. No matter how many nodes in the first path combine their phase information, they cannot gain any knowledge about this value.
Therefore, we can see that the proposed protocol is secure against any internal eavesdroppers in one single path.

Remark 5. If an eavesdropper is not an intermediate node in either path, and he is more than half a wavelength away from all participating nodes, then he cannot gain any knowledge on the secret key either. This is similar to our analysis in Section 4.5.

Theorem 6. The improved multihop key agreement scheme is secure against any MITM adversaries in a single path.

Proof. Without loss of generality, suppose that 𝑅_𝑖 try to perform the MITM attack to 𝐴 and 𝐵. The purpose of MITM attack is to establish two different keys with 𝐴 and 𝐵, respectively, and after that to relay encrypted messages between them.
In Round(𝐴,𝐵,𝑚), in 𝑇_𝑖, 𝑅_𝑖 receives the signal 𝑟_{𝐴,𝑅𝑖}=𝛼_{𝑅𝑖−1,𝑅𝑖}(𝑡)𝑒^{𝑗(𝑤𝑐(𝑡−(𝑖−1)⋅𝑇𝑆)+}𝜙_{𝐴,𝑅𝑖−1+𝜓𝑅𝑖𝑖−1,𝑅)}+𝑛_𝑅𝑖(𝑡) from 𝑅_𝑖−1. If 𝑅_𝑖 is an honest node, it will perform the phase estimation of the signal received from 𝑅_𝑖−1 and send the signal 𝑒^{𝑗(𝑤𝑐(𝑡−𝑖⋅𝑇𝑆)+}𝜙_{𝑖𝐴,𝑅)} to 𝑅_𝑖+1. However, 𝑅_𝑖 wants to perform the MITM attack, so it generates 𝜙^𝑒₁ and sends a different signal 𝑒^{𝑗(𝑤𝑐(𝑡−𝑖⋅𝑇𝑆)+𝜙𝑒1)} to 𝑅_𝑖+1. If all other nodes in the first path are honest, then the signal received by 𝐵 should be 𝛼_{𝑅𝑚,𝐵}(𝑡)𝑒^{𝑗(𝑤𝑐(𝑡−𝑚⋅𝑇𝑆)+}𝜙^𝑒_{𝑅𝑖𝑚,𝑅+𝜓𝑅𝑚,𝐵)}+𝑛_𝐵(𝑡). (6)
In (6), 𝜙^𝑒_{𝑅𝑖,𝑅𝑚}=𝖾𝗌𝗍(𝜙^𝑒₁+∑^𝑚−1_𝑘=𝑖𝜓_{𝑅𝑘,𝑅𝑘+1}).
On the other hand, when 𝑅_𝑖 receives 𝑟_{𝑅𝑖+1,𝑅𝑖}(𝑡)=𝛼_{𝑅𝑖+1,𝑅𝑖}(𝑡)𝑒^{𝑗(𝑤𝑐(𝑡−(2𝑚+2−𝑖)⋅𝑇𝑆)+}𝜙_{𝐵,𝑅𝑖+1+𝜓𝑅𝑖𝑖+1,𝑅)}+𝑛_𝑅𝑖(𝑡) from 𝑅_𝑖+1 in 𝑇_{2𝑚+2−𝑖}, 𝑅_𝑖 generates another phase 𝜙^𝑒₂ and sends 𝑒^{𝑗(𝑤𝑐(𝑡−(2𝑚+3−𝑖)⋅𝑇𝑆)+𝜙𝑒2)} to 𝑅_𝑖−1. If 𝑅₁,𝑅₂,…,  and  𝑅_𝑖−1 behave honestly, and then the signal 𝐴 receives should be 𝛼_𝑅1,𝐴(𝑡)𝑒^{𝑗(𝑤𝑐(𝑡−(2𝑚+2)⋅𝑇𝑆)+}𝜙^𝑒_{𝑅𝑖1,𝑅+𝜓𝑅1,𝐴)}+𝑛_𝐵(𝑡). (7)
In (9),  𝜙^𝑒_{𝑅𝑖,𝑅1}=𝖾𝗌𝗍(𝜙^𝑒₂+∑^𝑖−1_𝑘=1𝜓_{𝑅𝑘+1,𝑅𝑘}).
Now 𝐵 can get his secret bits by quantizing 𝖾𝗌𝗍(𝜙^𝑒₁+∑^𝑚−1_𝑘=𝑖𝜓_{𝑅𝑘,𝑅𝑘+1}+𝜓_{𝑅𝑚,𝐵})+𝐼_𝐵⁽²⁾+𝜙₂. 𝐴 can get its secret bits by quantizing 𝖾𝗌𝗍(𝜙^𝑒₂+∑^𝑖−1_𝑘=1𝜓_{𝑅𝑘+1,𝑅𝑘}+𝜓_𝑅1,𝐴)+𝐼_𝐴⁽²⁾+𝜙₁. 𝑅_𝑖 has 𝖾𝗌𝗍(𝜙₂+𝜓_{𝐵,𝑅𝑚}+∑^𝑚−1_𝑘=𝑖𝜓_{𝑅𝑘+1,𝑅𝑘})+𝜙^𝑒₁ and 𝖾𝗌𝗍(𝜙₁+𝜓_𝐴,𝑅1+∑^𝑖−1_𝑘=1𝜓_{𝑅𝑘,𝑅𝑘+1})+𝜙^𝑒₂. However, 𝑅_𝑖 does not know 𝐼_𝐵⁽²⁾ and 𝐼_𝐴⁽²⁾ either, because 𝑅_𝑖 is more than half a wavelength from the other path.
From the previous analysis we know that 𝑅_𝑖 cannot agree on two different keys with 𝐴 and 𝐵. Therefore, it cannot carry out MITM attack successfully. This analysis can be directly extended to the case that any number of intermediate nodes in the first path carry out MITM attacks collaboratively. Because their experienced channels are statistically independent of channels of the second path, they cannot gain any information of 𝐼_𝐵⁽²⁾ or 𝐼_𝐴⁽²⁾.
We conclude that the improved protocol is secure against any MITM adversaries in a single path.

Remark 7. If the adversary can place cheating nodes on two disjoint paths, there are straightforward ways to extend our protocol to achieve security. For example, we can consider using three disjoint paths between 𝐴 and 𝐵. In general, in order to prevent cheating nodes on 𝑘 disjoint paths, 𝐴 and 𝐵 can use 𝑘+1 disjoint paths between them for key extraction, as long as there exist 𝑘+1 disjoint paths between them. (If there are cheating nodes on all disjoint paths between 𝐴 and 𝐵, then no solution is possible because these nodes can choose to simply block all communications between 𝐴 and 𝐵.) This will lead to higher complexity of the protocol—so, there is a tradeoff between security and efficiency.

6. Performance Analysis

As the improved protocol has more than just a pair of nodes, the estimation errors at each intermediate node will aggregate. In this section we present performance analysis of the improved protocol. We mainly focus on the agreement probability of 𝐴 and 𝐵’s common secrets.

From the protocol description, we know that the ideal values of 𝐼_𝐴 and 𝐼_𝐵 are as follows: 𝐼_𝐴=2𝜙₂+𝜓_{𝐵,𝑅𝑚}+^𝑚_𝑖=2𝜓_{𝑅𝑖,𝑅𝑖−1}+𝜓_𝑅1,𝐴+𝜓_{𝐵,𝑆𝑛}+^𝑛_𝑖=2𝜓_{𝑆𝑖,𝑆𝑖−1}+𝜓_𝑆1,𝐴+2𝜙₁,𝐼_𝐵=2𝜙₁+𝜓_𝐴,𝑅1+^𝑚−1_𝑖=1𝜓_{𝑅𝑖,𝑅𝑖+1}+𝜓_{𝑅𝑚,𝐵}+𝜓_𝐴,𝑆1+^𝑛−1_𝑖=1𝜓_{𝑆𝑖,𝑆𝑖+1}+𝜓_{𝑆𝑛,𝐵}+2𝜙₂. (8)

From the channel reciprocity and the assumption that one protocol round is performed within the channel coherence time, we can see that 𝐼_𝐴=𝐼_𝐵. We denote this value by 𝐼; that is, 𝐼=𝐼_𝐴=𝐼_𝐵. However, due to the estimation errors of the phase information, there may be discrepancies between 𝐼_𝐴 and 𝐼_𝐵. In the following we analyze the probability of 𝐼_𝐴=𝐼_𝐵 during one protocol round. We denote this probability by 𝑃_𝑟.

When one node transmits signals to another node, they use the same frequency, so that the receiver does not need to do frequency estimation. Without loss of generality, the noises at the receivers are independent Gaussian noises with zero mean and variance 𝜎². The receiver samples the received signal and computes the phase estimate. When the sampling rate is high enough, the estimated phase is a Gaussian random variable whose variance is bounded by the Cramér-Rao bound [47].

From [47], when the signal frequency is known, the variance of the phase is bounded by 𝜎²𝜃≥𝜎²𝑏²₀𝑁. (9)

In (9), 𝑏₀ is the amplitude of the received signal. From (9), we can see that the lower bound of the phase variance depends on the signal to noise ratio (SNR) and the sampling rate. When the SNR is higher, the phase variance can achieve a smaller lower bound. When the sampling rate is increased at the receiver, the lower bound can be further decreased. This is in accordance with the intuition that we should get more precise estimation given a higher SNR and sampling rate. In the following we use the Cramér-Rao bound for our analysis.

The estimation error at each node is modeled as a Gaussian noise, with the zero mean and standard deviation relying on the SNR and the sampling rate. Without loss of generality, we assume that the SNR and the sampling rate are all the same at all the participating nodes. From the protocol execution process, we know that the accumulated estimation error at the source or the destination is the sum of all the intermediate estimation errors. We can write 𝐼_𝐵 as 𝐼_𝐵=𝐼_𝐵+𝑍_𝐵. (10)

𝑍_𝐵 represents the accumulated estimation error at 𝐵. According to the previous analysis, 𝑍_𝐵∼𝑁(0,(𝑚+𝑛+2)𝜎²𝜃). Because 𝐼_𝐵=𝐼,  𝐼_𝐵∼𝑁(𝐼,(𝑚+𝑛+2)𝜎²𝜃). For ease of analysis, let 𝜎²_𝐼=(𝑚+𝑛+2)𝜎²𝜃. From the protocol execution process, we know that 𝐼_𝐴∼𝑁(𝐼,𝜎²_𝐼). Because 𝐼∈[0,2𝜋), from the property of Gaussian distribution, the probability is much higher when 𝐼_𝐵 and 𝐼_𝐴 are close to 𝐼.

The probability 𝑃_𝑟 is a function of 𝐼. It can be computed using the following equation: 𝑃_𝑟=^𝑞−1_𝑖=0𝑃𝐼_𝐴∈2𝜋𝑖𝑞,2𝜋(𝑖+1)𝑞,𝐼_𝐵∈2𝜋𝑖𝑞,2𝜋(𝑖+1)𝑞. (11)

Because of the independent noise accumulations at 𝐴 and 𝐵, we can get 𝑃_𝑟=^𝑞−1_𝑖=0𝑃𝐼_𝐴∈2𝜋𝑖𝑞,2𝜋(𝑖+1)𝑞×𝑃𝐼_𝐵∈2𝜋𝑖𝑞,2𝜋(𝑖+1)𝑞. (12)

Denote the interval [2𝜋𝑖/𝑞,2𝜋(𝑖+1)/𝑞) by 𝑄_𝑖. Let 𝑃^𝑖(𝐴,𝐵)=𝑃[𝐼_𝐴∈𝑄_𝑖]𝑃[𝐼_𝐵∈𝑄_𝑖]. Then from the distribution function of Gaussian distribution, 𝑃^𝑖(𝐴,𝐵)=∫_{𝐼𝐴∈𝑄𝑖}(1/√2𝜋𝜎_𝐼)𝑒^{−(𝐼𝐴−𝐼)2/2𝜎2𝐼}∫_{𝐼𝐵∈𝑄𝑖}(1/√2𝜋𝜎_𝐼)𝑒^{−(𝐼𝐵−𝐼)2/2𝜎2𝐼}. Because 𝐼_𝐴 and 𝐼_𝐵 have the same distributions, 𝑃_𝑟 can be computed by the following expressions: 𝑃_𝑟=^𝑞−1_𝑖=0𝑃^𝑖(),𝑃𝐴,𝐵_𝑖(𝐴,𝐵)=_{𝐼𝐴∈𝑄𝑖}1√2𝜋𝜎_𝐼𝑒^{−(𝐼𝐴−𝐼)2/2𝜎2𝐼2}. (13)

From (13) we can see that 𝑃_𝑟 is the sum of the probability that 𝐼_𝐴 and 𝐼_𝐵 fall into the same quantization subinterval; that is, 𝑃^𝑖(𝐴,𝐵),  𝑖=1,2,…,𝑞. For each subinterval 𝑄_𝑖, the magnitude of 𝑃^𝑖(𝐴,𝐵) is affected by whether 𝐼∈𝑄_𝑖. Suppose that 𝐼∈𝑄_𝑖^∗, and then 𝑃^𝑖∗(𝐴,𝐵) will be larger than any other 𝑃^𝑖(𝐴,𝐵) for 𝐼∉𝑄_𝑖. This is because the Gaussian distribution function has a larger value when the variable value is closer to the mean (in this case, 𝐼). Therefore, 𝑃_𝑟 is dominated by 𝑃^𝑖∗(𝐴,𝐵), for 𝐼∈𝑄_𝑖^∗. On the other hand, 𝑃^𝑖∗(𝐴,𝐵) is affected by 𝐼’s position in 𝑄_𝑖^∗. If 𝐼 is close to the center of 𝑄_𝑖^∗, then 𝑃^𝑖∗(𝐴,𝐵) will be large; if 𝐼 is close to the end points of 𝑄_𝑖^∗, then 𝑃^𝑖∗(𝐴,𝐵) will be small. This is because when 𝐼 is close to the end points, the probability that 𝐼_𝐴 and 𝐼_𝐵 fall into two adjacent subintervals increases. In addition, the standard deviation 𝜎_𝐼 also has impact on 𝑃^𝑖∗(𝐴,𝐵). A smaller 𝜎_𝐼 will result in a larger 𝑃^𝑖∗(𝐴,𝐵), because when 𝜎_𝐼 is smaller, the probability of 𝐼_𝐴 or 𝐼_𝐵 being close to 𝐼 is larger.

7. Simulation Results

In order to measure the performance of the proposed scheme, we simulate the proposed scheme using GlomoSim [7]. By using the PARSEC programming language [48], we write programs for the proposed scheme in the physical layer of GlomoSim protocol stack. We simulate the proposed scheme for different SNRs. Because the receiver SNR is affected mainly by distances between adjacent nodes, we select a set of communication distances, which is {10 m, 20 m, 30 m, 40 m, 50 m, 100 m, 150 m, 200 m, 250 m, 300 m}. For each communication distance (denote it by 𝑙), we randomly generate a geometric distribution of 6 nodes. The distance between any pair of adjacent nodes is randomly generated in [0.7𝑙,1.3𝑙]. We denote these distances by {𝑙₁,𝑙₂,𝑙₃,𝑙₄,𝑙₅,𝑙₆}. Because we select 10 communication distances, we also generate 10 random distributions of nodes. One common node distribution for the simulation is shown in Figure 4. We measure average SNRs under different communication distances. The results are shown in Figure 5.

Figure 4 

One common node distribution of the simulation.

Figure 5 

Average SNRs under different communication distances.

To best simulate the wireless communication environment in reality, we set the center carrier frequency to be 2.437 GHz and the baseband bandwidth to be 11 MHz. This is one of the standard carrier band of 802.11 b. According to Nyquist-Shannon sampling theorem, the sampling rate should be no less than 22 MHz. We choose the sampling rate to be 25 MHz, so that the estimation at the receiver is more accurate. 𝑇𝑆 is chosen to be 10 μs. For the large scale signal propagation, we use the two-ray ground reflection model [49] which can be expressed by (14) 𝑃_𝑟(𝑑)=𝑃_𝑡𝐺_𝑡𝐺_𝑟ℎ²_𝑡ℎ²_𝑟𝑑⁴. (14) In (14), 𝑃_𝑡 is the transmission power, and 𝑃_𝑟(𝑑) is the received power at a distance 𝑑 away from the transmission antenna. 𝐺_𝑡 and 𝐺_𝑟 are the antenna gains at the transmitter and the receiver, respectively; ℎ_𝑡 and ℎ_𝑟 are the antenna heights at the transmitter and the receiver, respectively; 𝑑 is the distance between the transmitter and the receiver.

We use the Rayleigh distribution [49] for the small scale wireless fading model. Both the two-ray ground reflection model and the Rayleigh fading model are directly supported by the GlomoSim network simulator [7].

We measure the quantization agreement probability of 𝐴 and 𝐵 under different communication distances. We also measure the randomness of the secret key. In addition, we measure the key efficiency of the proposed scheme. The results are shown in Sections 7.1, 7.2, and 7.3.

7.1. Quantization Agreement Probability

Under different communication distances, we measure quantization agreement probabilities and bit error rates (BERs) of the quantized common secret bits. For the quantization step, we choose 𝑞=32. Therefore, the interval of [0,2𝜋) is divided into 32 subintervals of equal length. We use the Gray code to encode the quantization indices, so that only one bit discrepancy is introduced for adjacent intervals.

The results are shown in Figures 6 and 7, respectively. From Figures 6 and 7, we can see that when the communication distance is 50 m (approximately 38.23 dB SNR), the quantization agreement probability is 0.9535, and the BER is 0.0093. Even when the communication distance is increased to 300 m (approximately 10 dB SNR), the quantization agreement probability is still 0.906, and the BER is 0.019.

Figure 6 

Quantization agreement probabilities under different communication distances.

Figure 7 

Bit error rates under different communication distances.

7.2. Randomness of the Generated Key

We test the randomness of the generated key using the NIST randomness test suite [50]. We use the 8 tests in the NIST test suite to validate the randomness of one 1024-bit key. The results are shown in Table 1. From Table 1 we can see that the generated key passes all the 8 tests.

Table 1 

NIST statistical test results. To pass each test, the 𝑃 value needs to be greater than 0.01.

7.3. Key Efficiency

In this section, we focus on measuring how long it takes in order to generate a 256-bit key. In order to generate a 256-bit key, 𝐴 and 𝐵 need to get more common secret bits, because the Cascade protocol causes entropy loss. We compute the lost entropy rate of Cascade protocol according to the theoretical results in [40]. After that we measure the key efficiency under different Cascade parameters.

We have completely implemented the Cascade protocol and the privacy amplification method described in Section 4.4. We use the MIRACL library to implement the prime generation and large number arithmetics required for 2-universal hash family. We choose 4~5 rounds for the Cascade protocol, in order that the key agreement ratio is high. We compute the entropy loss rate when the Round-1 block size has different values. For each Round-(𝑖+1), its block size is two times the block size of Round-𝑖. The results are shown in Figure 8.

Figure 8 

Lost entropy rates under different SNRs and Round-1 cascade blocks.

As can be seen from Figure 8, when the Round-1 block of Cascade protocol increases, the lost entropy rate decreases. When the communication distance decreases, the lost entropy rate also decreases, because less bits need to be corrected. For example, when the communication distance is 50 m and the round-1 block size is 14, the lost entropy rate is 0.1925. Under such a lost entropy rate, in order to generate a 256-bit key, at least 317 common secret bits need to be collected. When the communication distance is 300 m and the round-1 block size is 10, the lost entropy rate is 0.3203. Under such a lost entropy rate, in order to generate a 256-bit key, at least 376 common secret bits need to be collected.

Under the 10 distributions generated for different communication distances, we measure the efficiency of generating a 256-bit key using the multihop key agreement protocol. Different combinations of Cascade rounds and Round-1 block sizes are used. The simulation is run at a laptop with Intel Core2 CPU of 2.33 GHz and 2.0 GB memory. For each different setting, we run the key agreement scheme for 100 times and measure the average time. In all these executions, 𝐴 and 𝐵 achieve successful key agreement. The efficiency results are shown in Figure 9.

Figure 9 

Efficiency of key generation under different communication distances. The measured time is for generating a 256-bit key.

From Figure 9, we can see that when the Cascade Round-1 block size is decreased, the key efficiency is also decreased. This is because the block number is increased, which increases transferred bits in each round. Furthermore, when the number of Cascade rounds is decreased, the key efficiency is increased. Specifically, for the Cascade parameter (Block=12,Round=4), when the communication distance is 50 m, the time of generating a 256-bit key is 0.0726 seconds. At this speed, the proposed key agreement scheme can achieve 3.5Kbps rate. Even when the communication distance is 300 m, the proposed scheme can still achieve 3.17 Kbps rate.

8. Conclusions and Discussions

In this paper, we propose two key agreement schemes as a novel physical-layer technique in multihop wireless networks. The proposed key agreement schemes enable secret key generation between nodes in multihop wireless networks, even if they cannot communicate with each other directly. The proposed basic scheme is secure against external eavesdroppers. And the improved two-path-based scheme is secure against external eavesdroppers, as well as internal eavesdroppers and MITM adversaries in a single path. The proposed scheme can achieve high key efficiency under different communication distances among nodes. The secret key generated by the proposed scheme has very strong randomness. By properly selecting the protocol parameters, the proposed scheme can achieve high success ratio. The proposed scheme is suitable for establishing secret keys for multihop wireless networks.

It is worth noting that our paper has covered only key agreement for unicast communications between two nodes. Broadcast and multicast communications may require different protocols for key agreement. In particular, key agreement for broadcast communications in a wireless network is relatively easy if there are only passive eavesdroppers. A straightforward solution is to establish key agreement between neighbor nodes and then transmit a global key in encrypted form throughout the network. If some nodes in the network are dishonest, then leaking the final global key is unavoidable.

For multicast communications, this problem becomes the pretty challenging problem of group key agreement. Existing solutions such as Wang et al.’s [34] are suitable for this case, but further improvement in security and/or efficiency is also possible.

Acknowledgments

This work was partly done while Zhuo Hao and Sheng Zhong were both with University at Buffalo and supported in part by NSF CNS-0845149 and CCF-0915374. Sheng Zhong is currently supported by RPGE and NSFC-61021062.