WO2007031089A1

WO2007031089A1 - A method for secure communication in a wireless communication system

Info

Publication number: WO2007031089A1
Application number: PCT/DK2006/000509
Authority: WO
Inventors: Petar Popovski; Patrick Eggers; Hiroyuki Yomo; Frank Fitzek; Persefoni Kyritsi
Original assignee: Aalborg Universitet
Priority date: 2005-09-15
Filing date: 2006-09-15
Publication date: 2007-03-22

Abstract

The invention relates to a method for secure communication in a wireless communica tion system comprising at least a first access point (AP) having at least a first antenna (52) and a second antenna (53), at least a first terminal (B) having at least one terminal antenna (51 ), and a number of subcarriers for communication between the access point (AP) and the terminal (B). The method comprises the steps of: i)the first terminal (B) transmitting at least one terminal pilot signal using the at least one terminal antenna (51 ) to the access point (AP) via M subcarriers, so as to provide individual terminal pilot signals, said at least one terminal pilot signal having a coherence time, ii) the access point (AP) detecting at least first signals at the first antenna (52) and second signals at the second antenna (53) for each of the individual terminal pilot signals, iii) the access point within the coherence time of the at least one terminal pilot signals generating and transmitting at least one new pilot signal to the terminal (B) via the M subcarriers, so as to provide individual new pilot signals, said at least one new pilot signal being gener ated based on the first signals and the second signals detected in step ii) and carrying a secret key, which can be recovered by the access point locally, and iv) the terminal (B) detecting the individual new pilot signals and extracting the secret key shared by the terminal (B) and the access point (AP) based on the detected individual new pilot signals.

Description

Title: A method for secure communication in a wireless communication system

Technical Field

The following invention relates to a method for secure communication in a wireless communication system.

Background Art

The considered scenario will in the following be described as a system consisting of an access point and terminals that communicate with the access point. However, in general, the access point and terminals can be any type of terminal or communication node.

Let B be a terminal, which tries to communicate with an access point AP. Let E be another terminal, which attempts to eavesdrop on the communication between the access point AP and the terminal B. It is assumed that the communication takes part in a dispersive radio environment, such that the channel between the access point AP and any terminal is frequency selective due to the multipath delay spread. The multipath delay spread causes randomization of the channel impulse response, and this randomization is accordingly reflected in the randomized fading patterns in the frequency domain.

One principle used for providing a secure communication between the access point AP and the terminal B, and which is not intercepted by the eavesdropper E is the utilization of the channel reciprocity. It is for the moment assumed that the access point AP and the terminal B have one antenna each and that the channel estimation is perfect. Then, due to the channel reciprocity, the impulse response that the access point AP observes from the transmission from the terminal B is identical to the impulse response that the terminal B observes from the transmission of the access point AP. Clearly, in the pres- ence of channel estimation errors, the impulse responses of the access point AP and the terminal β are highly correlated. Under very practical circumstances, it can be assumed that the eavesdropper E is sufficiently (many wavelengths) separated from both the access point AP and the terminal B. This implies that the impulse responses of the channels AP-E, B-E and AP-S are completely uncorrelated. Hence, the so-called shared randomness of the channel between the access point AP and the terminal B can serve as a means to generate random secret key, which cannot be uncovered by the eavesdropper E

The usage of the channel reciprocity for enabling secure communications has already been applied in H. Koorapaty, A. A. Hassan, and S. Channakeshu, "Secure information transmission for mobile radio," IEEE Commun. Lett, vol. 4, no. 2, pp. 52-55, February 2000 and in H. Mori, H. Sasaoka and T. Ohira, "Performance estimation of secret key agreement system exploiting an ESPER antenna and a received signal strength indicator," in Proc. ISSSE2004, August 2004. September 13, 2005.

The method proposed by Koorapaty et al. uses a single antenna at both the access point AP and the terminal B. The communication between the access point AP and the terminal or node B is achieved in two steps. The first step involves a transmission of M sinusoids f_λ,f₂,:.,f_M with equal energy from the access point AP to the terminal B. The sinusoids are orthogonal and separated by the coherence bandwidth of the channel. The terminal B observes the phase of each sinusoid 0_v0₂,...,0_M and estimates M-

1 phase differences #₂ -O₁, O₁₁ -O₁,...Θ_M -O₁. It is now assumed that the terminal B wants to send the following X-PSK symbols: 0_x,0₂,...0_M , where ψ_i ε {0,f ,ψ,...^ψ?-} . Then the signal at /-th subcarrier has a phase ψ_i - {θ_i - O₁) . Since the eavesdropper E does not know(<9₍. - O₁) , it will with high probability detect the message erroneously.

The method proposed by Mori et al. uses an ESPAR antenna and OFDM transmission in order to generate a secret key. In a key generation mode, the access point AP equipped with the ESPAR antenna forms a beam pattern and sends a packet for measurement. The terminal receives that packet with an omni-directional pattern and acquires a Received Signal Strength Indication (RSSI) value after averaging in order to equalize the influence of noise. Next, a packet for measurement is transmitted using the omnidirectional pattern by the regular user. The access point AP receives that packet by a pattern, which is identical to the original pattern, and acquires the RSSI value after averaging. There are K different RSSI values acquired by repeating the measurement of the RSSI K times and changing the beam pattern of the AP. An iteration K is simply set according to key length. Next, a threshold value is set up for the RSSI value of the K pieces, and it becomes 1, if it is higher than a threshold value and 0 if it is under the threshold value. After binarization, the same key is generated in the access point AP and the regular user and key agreement can be achieved. Even if an eavesdropper tries to generate a key, the same key shared by the AP and the regular user cannot theoretically be generated by an eavesdropper, since the RSSI value, which is measured in places different to the AP or the regular user, is a different one. In order to reduce the probability of key disagreement due to noise errors, a forward error correcting (FEC) code can be applied. This code is agreed in advance by the nodes and it reduces the number of generated random bits to /C₁, where -§- is the code rate of the FEC code.

The object of the invention is to provide a new and improved method for establishing secure communication between an access point and a terminal in a wireless communication system.

Disclosure of Invention

According to the invention, this is obtained by a method for secure communication in a wireless communication system, said system comprising:

- at least a first access point having at least a first antenna and a second antenna,

- at least a first terminal having at least one terminal antenna, and - a number of subcarriers for communication between the access point and the terminal, said method comprising the steps of: i) the first terminal transmitting at least one terminal pilot signal using the at least one terminal antenna to the access point via M subcarriers, so as to provide individual terminal pilot signals, said at least one terminal pilot signal having a coherence time, ii) the access point detecting at least first signals at the first antenna and second signals at the second antenna for each of the individual terminal pilot signals, iii) the access point within the coherence time of the at least one terminal pilot signals generating and transmitting at least one new pilot signal to the terminal via the

M subcarriers, so as to provide individual new pilot signals, said at least one new pilot signal being generated based on the first signals and the second signals detected in step ii) and carrying a secret key, which can be recovered by the access point locally, and iv) the terminal detecting the individual new pilot signals and extracting the secret key shared by the terminal and the access point based on the detected individual new pilot signals. Since the impulse response measured, i.e. the signals detected at the antennas of the access point, is different from the impulse response measured by an eavesdropper, the impulse response measured can be used to generate a random key, which is known only to the access point and the terminal. The access point has essentially two ways of generating random secret key: (1) generate the secret key and based on that decide the linear combinations of the transmitted subcarriers, and (2) generate randomized linear combinations of subcarriers and extract a random key from them in a predefined way. The use of two or more antennas at the access point makes the secret key ex- tremely difficult to decode by an eavesdropper. It should be noted that the access point can be a regular terminal or communication node, i.e. the terminal (or Bob), the access point (or Alice) and the eavesdropper (or Eve) can all be terminals or communication nodes.

According to a preferred embodiment of the method according to the invention, the access point in step ii) detects the amplitudes and/or the phases of the individual terminal pilot signals. This provides a simple method for providing variables for generation of the secret key.

According to a preferred embodiment, the communication between the terminal and the access point is based on the OFDM protocol. The method for generating the secret key is especially suited for this type of communication.

According to another preferred embodiment, the detected individual terminal pilot sig- nals in step ii) are randomly generated signals. This can be achieved, since the impulse response of the transmission system is random due to the different path lengths of the different subcarriers.

In a preferred embodiment of the method according to the invention, the access point in step iii) generates the new pilot signals by making a linear combination of the first signals and the second signals. The linear combination can be a simple addition of the individual signals, which may be complex. According to a preferred embodiment, the first signals and the second signals are linearly combined by the first and the second antenna retransmitting the detected first and second signal, respectively, to the termi- nal. According to another preferred embodiment, the terminal uses a predefined power level for transmitting the terminal pilot signal so as to generate a received power distribution across the antennas of the access point. Preferably, the individual new pilot signals are additionally multiplied with coefficients that correspond to the received power distribution.

According to a preferred embodiment, the new individual pilot signals are phase shifted by a value corresponding to the phase difference of the first and the second signals. Generally, the access point can by phase shifting control how the received signals at the terminal are superposed, and thereby it can determine the received amplitude at each subcarrier. According to another preferred embodiment, the phase shift corresponding to the phase difference of the detected first and second signals are applied to the retransmitted signal of the first antenna or the retransmitted signal of the second antenna. The access point can in general control the phase and amplitude of each re- ceived subcarrier at the terminal through the proper choice of appropriate linear combination.

According to a particularly preferred embodiment, the access point in step iii) multiplies a power coefficient and/or applies a phase shift to the retransmitted signal and/or the retransmitted signal of the second antenna, said power coefficient and phase shift being chosen randomly. These coefficients and phase shifts create a linear combination whose product is a complex number with a resulting amplitude and resulting phase. The access point can extract a secret random key from the resulting amplitudes/phases of the M subcarriers, said extraction being done in a publicly known, pre- defined manner for generation of random integer (string of random bits) out of an ordered set of M complex numbers. Due to the randomness of the channel, it is ensured that the random key is known only to the access point, which sent the secret key, and the terminal, which detects and extracts the secret key using the shared reciprocity of the communication channel as well as the said predefined manner for generation of random numbers, such as a string of random bits.

According to another particularly preferred embodiment, the secret key is first generated by the access point as a string of random bits, the string subsequently being used to decide scaling factors and phase shifts for the individual new pilot signals so as to produce a desired received response at the terminal. In this case, the terminal applies a predefined procedure for generation of bit string out of an ordered set of M complex numbers. Since the access point knows the desired received response at the terminal, this can be used to generate a secret key, which is known only by the terminal and the access point.

According to a particularly preferred embodiment, the manner to obtain a secret random key from the ordered set of M complex numbers is to convert each complex symbol into a number of K bits. In one embodiment, the amplitude of each complex number is compared to a single threshold level, and a bit 1 is generated if the amplitude is larger than the threshold and bit 0 is generated otherwise. In another embodiment, the amplitude of each complex number is compared to 2^K-1 thresholds and thus each complex number generates K bits for the secret key. In another embodiment, each complex number can be compared against 2^K predefined decision regions in the complex plane and thus be interpreted as a K-QAM signal or K-PSK signal and thus be used to generate K bits.

In yet another embodiment, the M complex numbers can be used to produce M-1 new complex numbers by dividing the adjacent complex numbers and then use the said M-1 complex numbers. In this case the secret key can be generated out of the set of M-1 complex numbers by using the identical methods described in the above paragraph.

According to a preferred embodiment, the individual new pilot signals each have a correlation bandwidth, and the compared subcarrier pilot signals of the new set of pilot signals are at least the correlation bandwidth apart. This can be necessary, since two adjacent subcarriers can be correlated, where the randomness of the transmission sys- tern only is achieved if using subcarriers that are separated by more than the correlation bandwidth. Therefore, generally the number of pilot subcarriers is less than the total number of subcarriers available for communication.

According to a preferred embodiment, a forward error correction (FEC) code is applied to the secret key. If the secret key is generated such that the access point first generates randomly power coefficients and phases and extracts a string of random bits out of them, then the publicly known FEC decoder is applied to that string of random bits in order to produce a secret key with a shorter length than the string of random bits. Note that in this case only an FEC decoder (and not an FEC encoder) is used by both the terminal and the access point. According to an alternative embodiment, the access point comprises an error-control encoder, and the terminal comprises a corresponding error-control decoder, where the error-control encoder adds redundant bits to the secret key, and the error-control decoder decodes the new individual pilot signals with redundant bits. These two embodiments ensure that the secret key agreement between the access point and the terminal is further improved.

According to a preferred embodiment, the terminal comprises two or more terminal antennas, and the terminal sends pilot signals from said two or more terminal antennas sequentially. Thereby, more tunable parameters are added, thereby increasing the secrecy of the secret key. In general, the secrecy is scalable with the number of terminal antennas and access point antennas. For instance if there are M subcarriers, each subcarrier carries information of a complex number with an amplitude and a phase parameter, the terminal has two antennas and the access point has two antennas, then the total number of available complex random numbers to generate secret key is 2M, whereas the total number of available complex numbers is only M if using one terminal antenna and two access point antennas.

In a preferred embodiment according to the invention, the secret key is generated via an explicit communication phase dedicated to the generation of the secret key. This is the simplest way for communication, where the random key first is generated, and the access point and terminal subsequently start data communication encrypted with the agreed key.

According to an alternative embodiment, the secret key is transmitted together with data, which is to be sent between the access point and the terminal. Thereby a secret key can be generated for each data packet transmission without interrupting the data communication process. This can for instance be achieved by using one type of modulation, such as Amplitude Shift Keying (ASK), for the data and a second type of modulation, such as Phase Shift Keying (PSK), for the secret key.

The secret key can also be generated from data, which is to be sent between the access point and the terminal. That is, the random key is generated from at least a part of the user data, which inherently is random. Thereby, a throughput loss is avoided, since the secret key itself carries useful data.

Brief Description of the Drawings The invention is explained in detail below with reference to the drawings, in which

Fig. 1 shows communication between two terminals with channel reciprocity,

Fig. 2 communication between two terminals with channel reciprocity and a third terminal trying to eavesdrop on the communication,

Figs. 3a and 3b communication between an access point and a terminal in a communication system according to the invention,

Fig. 4 the detected signal strength at the terminal and the eavesdropper as a function of the subcarrier number,

Fig. 5a the generated key based on the detected signal at the terminal,

Fig. 5b the generated key based on the detected signal at the eavesdropper,

Fig. 5c the difference between the two generated keys,

Fig. 6 code symbols as a function of the ratio between subcarrier signals,

Fig. 7 subcarriers being divided into subchannels,

Fig. 8 a flow chart for generation of a secret key in a data-parallel operation mode, and

Fig. 9 a flow chart for generation of a secret key using a part of a data packet.

Best Modes for Carrying out the Invention

Figs. 1 and 2 show the principle of communication between terminals or nodes with channel reciprocity and how this can be used for generating a key or code shared only between these terminals. Alice has an antenna and tries to communicate with Bob. Bob also has an antenna. Alice transmits a first signal 10, which has a certain amplitude and/or phase. The first signal 10 is transmitted through a first communication channel 11 via a number of subcarriers to Bob. If the first signal 10 transmitted from Alice is a short burst, the signals 12 detected at Bob in effect correspond to the impulse re- sponse of the communication channel 11 between Alice and Bob. The impulse response is randomized, since the subcarriers have different path length due to different paths caused by reflections, refractions and the like.

If Bob within the coherence time of the first signal 10 transmitted from Alice transmits a new signal 20 having identical amplitude and/or phase as the first signal 10 through a second communication channel 21 , then signals 22 detected by Alice will be identical to the signals 12 detected by Bob due to channel reciprocity. The signals 22 detected by Alice once again correspond to the impulse response of the communication channel 21. The impulse responses of the first communication channel 21 and the second communication channel 22 will be substantially identical, since Alice and Bob are unlikely to have moved much between transmitting the first signal 10 and the new signal 20. Therefore, the path lengths of the different subcarriers for the first and the second communication channel 21 , 22 will be substantially identical.

Since the communication between Alice and Bob is wireless, it is possible for other terminals or nodes to eavesdrop on the communication. In Fig. 2 Eve is a terminal having an antenna and eavesdrops on the communication between Alice and Bob via a third communication channel 31 and fourth communication channel 41. Eve uses the third communication channel 31 to eavesdrop on the communication from Alice to Bob. However, since the third communication channel 31 is not identical to the first communication 11 , Eve measures a different impulse response 32 due to the path lengths of the various subcarriers being different. Eve uses the fourth communication channel 41 to eavesdrop on the communication from Alice to Bob. However, since the fourth com- munication channel 41 is not identical to the first communication 11 , Eve measures a different impulse response 42 due to the path lengths of the various subcarriers being different. Since Alice and Bob have different positions relative to the position of Eve, there is no correlation between the two measured impulse responses 32, 42 and Eve will in principle not be able to derive the impulse response of the communication chan- nel between Alice and Bob. Therefore the impulse response between Alice and Bob can be used to generate a secret code or key, which is shared only by Alice and Bob.

Figs. 3a and 3b illustrate a communication system according to the invention. The communication comprises a terminal or node S having at least one terminal antenna 51 , an access point AP having at least a first antenna 52 and a second antenna 53, and an eavesdropper E having an eavesdropper antenna 54. In order to illustrate the proposed approach, we will treat the simplest case, in which the access point AP has two antennas 52, 53, while the eavesdropper E and the terminal B have one antenna each. The total number of subcarriers is N, while N_c denotes the coherence bandwidth in terms of number of subcarriers. However, as later ex- plained in more detail, typically only a number of the subcarriers is used as pilot subcarriers. The number of pilot subcarriers is M.

The generation of the secret key is done in two phases. The terminal B as illustrated in Fig. 3a first transmits pilot signals (without any data) at all subcarriers. Let b^e¹** de- note the complex representation of the y-th subcarrier received at the /-th antenna of the access point AP, where / = 1, 2 and j = 1...N. If the access point AP within the coherence time of the pilot signals uses the same power at both antennas 52, 53 to retransmit the pilot signal detected at the first antenna 52 and second antenna 53 and at they- th subcarrier, then the received signal at B is:

where z* is the noise and C is a constant, which depends on the actual value of the transmitted power from the access point AP (Clearly, the access point AP can apply power control and achieve C = 1). However, since the access point AP knows the phases φ_ij and φ_2j of the detected signals, it can apply a phase shift of (φ_{J -φ_2j) t° the transmitted pilot at the first antenna 52, so that the received signal at B is:

More generally, by changing the phase of the transmitted signal at e.g. the first antenna 42, the access point AP can control how the received signals at B are superposed, and thereby it can determine the received amplitude at each subcarrier.

The individual pilot signals sent from the terminal B have a total power P₁, which is distributed across the antennas 52, 53 of the access point AP. When the access point AP retransmits the received signals the amplitude coefficient corresponds to the distribution of the power P₁ across the access point antennas 52, 53 - i.e. that b_λJ = ^P_xCC_1J and t b_2J = ^P_λcc_2J , where a_X] and a_2J both have values between 0 and

1 , and the sum of a_υ and a_2J is 1. a_υand α_2j \n other words indicate how the total power P₁ is distributed between the two access point antennas 52, 53 for the j'th subcarrier. Let us assume that the access point AP has generated randomly a set of N phases v_vv₂,...v_N . In the simplest case, v_} can have only two values, 0 or π . Then, the transmitted signal at the y-th subcarrier from the first antenna 52 is shifted by a phase (<A_j ~0_2j) ^{+ v} _j > ^{sucn tnat tne} received amplitude of they-th subcarrier at B is:

Note that the amplitude detected by the eavesdropper E at the eavesdropper antenna 54 and at the same subcarrier is uncorrelated with Gy. Hence, here secrecy is enhanced also due to the combination of the randomness achieved by the channel response from both antennas 52, 53 of the access point AP. Note that the access point AP can locally synthesize the value of Gy, so that the access point AP knows the amplitude of each subcarrier at the terminal β. Thereby, the access point AP and the terminal B can both generate identical keys or codes.

Now the N values G,- can be used to generate the random bits of the secret key shared between the access point AP and the terminal B. One way to generate a string of N - 1 bits a_va₂,...a_H__x can be as follows: ro tfβ_kΛ < β_t

"' -{I i/G_m > G_t ⁽⁴⁾ where the amplitudes of adjacent subcarriers are compared.

As a further generalization, it is possible to generate M bits by using the relation between the amplitudes G_k and G^₁ of adjacent subcarriers. To see how this can be achieved, the following value is observed:

T_k = log^- (5)

If the real axis is quantized with 7 - 1 thresholds (T levels), then the value T_k can be used to produce Iog2(7) bits. Clearly, with only one threshold set at T_k = 0, only one bit will be generated, equivalents to (4).

In general, the total received signal, d_}, at the terminal B will have a given amplitude \d_j\,

which can range from 0 to as well as an arbitrary phase, βy.

Hence, in general the value d_j e^β' can be a symbol of a K-QAM constellation that carries log2(K)>1 bits. Therefore, by using the random key, it is possible to choose the amplitudes a_λJ and a_2j as well as the phases T₁, and τ_2Jof the signals transmitted from the access point so as to map more bits per pilot subcarrier from the random key.

Similarly, the information can be encoded in a differential way, for instance by observ- d. e^βj ing that the ratio also be interpreted as a symbol of an K-QAM constella-

tion carrying log2(K) bits.

After obtaining a string of bits by appropriate mapping/thresholds of the M complex numbers, the access point can apply a FEC decoder in order to obtain the secret key from the random bits. The same FEC encoder is applied by the terminal. With such a procedure, the probability for the access point and the terminal generating identical secret keys is increased, thus enhancing the reliability of the system.

The FEC encoding can also be applied in the other method for secret key generation, where the access point first generates a random secret key of U bits. In order to increase the probability that the terminal B will reproduce the same key as generated by the access point AP, then access point AP can contain an error-control encoder (ECC), in which case the terminal B has to contain the associated decoder. In this case, the ECC adds V redundant bits to the generated secret key of U bits and thus maps the U bits to a string of U+V bits

The U+V bits are used to determine the values a_υ , a_2J , τ_λJ and τ_2J and to map the U+V bits to the M subcarriers.

The following is an example of how to use generation of multiple bits per subcarrier, differential bit encoding across subcarriers and an ECC.

For each subcarrier j the following is carried out: (i) a_υ ^'\s selected randomly and (X₂J =l-a_iJ is determined, and (ii) τ_XJ andr_2Jare selected uniformly and randomly. In this case, the parameters a_xp a₁ , , τ_Xj andτ_2y are decided first, and then the secret key is determined at the access point AP side. This is done in the following way: By using the generated cc_υ , a_2j , τ_Xj and τ_2J and knowing d . e^Pj , the access point obtains d . e^β< log2(Q) bits from the complex value: — ^J and by putting that value into the deci-

sion regions of predefined M-QAM, M-ASK or M-PSK constellations (the constellations are publicly known). For example, in case of 4-ASK, the access point AP is comparing

to 3 thresholds in order to see, in which of the four regions of 4-ASK this value

falls as for instance shown in Fig. 6. Hence, Alice can generate Q=2 bits out of such a single comparison. After this, the access point AP has generated a string of (M-I )Q bits.

The decoder of a predefined error correction code with rate U/(U+V) is used to map the U+V=(M-1 )Q bits to a string of U bits, which represents the secret key. The terminal β is trying to retrieve the key using analogous procedure, but starting from the noised observations y_}.

In some situations, the channel responses of the adjacent subcarriers might be highly correlated. In such case, it is only possible to generate -$--1 bits according to (4) by picking only M = ^■$- subcarriers, where each pair of subcarriers is at least N_c subcaπϊ- ers apart. This is illustrated in Fig. 7. In this figure, the subcarriers are represented by arrows 71 and pilot subcarriers are represented by dashed arrows 72. Since the coherence bandwidth is equal to N_c subcarriers, the subcarriers are bundled into subchannels, and only one pilot subcarrier 72 is used per subchannel. This is illustrated for the case where N_c = 5 and therefore the pilot subcarriers are spaced 5 subcarriers apart.

Additionally, it can be agreed in advance that the terminal B applies some kind of forward error correction (FEC) code in order to increase the probability that the generated keys by the access point AP and the terminal B are identical.

Finally, the protocol of actual transmission from the antennas should be applied in such a way that the randomness of the generated key is preserved as much as possible. For example, in this scenario, the access point AP should transmit in a certain way so as to ensure the eavesdropper E is not able to determine the individual signals received from each antenna. That is, the eavesdropper E will receive a signal

C_e[c_υe^jβiJ + c_2Je^jβ2Jj+ Z_j , but it should not be enabled to observe the individual signals c_λJe^iβiJ and c_2Je^J^^2J , since it makes it easier for E to break the secret key agreed between the access point AP and the terminal β.

This approach can be made scalable in a sense that the introduction of more antennas at the access point AP or the terminal B can further increase the secrecy of the gener- ated key. To see why this is the case, let us assume that the AP has M^ antennas and the terminal S has M₂ antennas. Then the signal at the /7-th subcarrier that B receives at the /77₂-th receive antenna is:

Af₁ _{c =} V Λ g*w (R\

where b_mi_m2n and φ_m-ι_m2n are the amplitude and the phase, respectively, of the signal, which is transmitted at the /7-th subcarrier from the m-i-th antenna of the access point AP to the /77₂-th antenna of the terminal B. Now, since the access point AP knows

for all antennas /H₁, m₂ and all subcarriers n, it can control the value of the amplitude \c_m2n\ received at the terminal B. In this case \c_m2n\ is determined by several different variables and these variables can be controlled by the access point AP by multiplying the signals with phase shifts, as it has been done in the simpler example above. In addition, the receiver has M₂ > 1 different amplitudes \c_m2n\ for each subcarrier. This gives additional degrees of freedom to the design of the actual functions that are used in producing the secret key. To summarize, if the total number of subcarrier is M and the number of antennas at the terminal is M₂, then there are in total M M₂ complex numbers available for generating the secret key. Due to these additional degrees of freedom, the secrecy of the produced key is proportional to the number of antennas.

The generation of the secret key can be generated in two different modes of operation, viz. data-sequential and data-parallel modes.

In the data sequential mode the access point AP and the terminal B run an explicit communication phase dedicated to generation of the random key that will be used in the subsequent communication. After the random key is generated, the access point, AP and the terminal B start a phase of data communication, in which they send to each other data that is encrypted with the agreed key. The agreed key is used for time T_u, such that the time T₁₁ is sufficient to have at least one packet transmission from the ac- cess point AP to the terminal S. The actual value of T₁₁ is an overall protocol/system design issue and is out of scope of the present invention. After the time T_u, the access point AP and the terminal B can agree to run a new communication phase for key generation.

The idea behind the data-parallel mode is that while the secret key is transmitted across the pilot subcarriers, the rest of the subcarriers (or possibly all) are used for transmitting data at the same time. The principle is illustrated in Fig. 8.

First the secret key having U bits is generated. At the same time a packet containing user data and having L bits is being prepared for transmission. The secret key is transformed into L bits and is XOR'ed with the data packet, which thus is encrypted using the secret key. The encrypted data (in block E2) is then mapped to all the subcarrier except perhaps the pilot subcarriers in a way known per se from OFDM communication. The secret key (in block E1) is at the same time mapped to the pilot subcarriers and thus determines the phases/amplitudes of all subcarriers.

At the receiver side, the receiver (in block D1) extract the U bits of the secret key and (in block D2) decodes the encrypted data transmitted in the subcarriers. The U bits of the secret key are transformed to L bits and XOR'ed with the received data, thereby ex- tracting the original packet of user data.

The modulations used in blocks E1 and E2 are affecting each other as they are operating over the same set of subcarriers. Therefore, in principle, the two modulation methods used should be different. One viable pair of modulation schemes is that block E1 uses Amplitude Shift Keying (ASK) and block E2 using Phase Shift Keying (PSK). In that case, the secret key can be encoded over several consecutive symbols and in each symbol the information about the secret key is in the amplitude of the subcarriers, while the encrypted data is in the phases of the subcarriers. The total number of subcarriers S is usually larger than the number of pilot subcarriers M. If S>M, then the en- crypted data is transmitted in the usual OFDM manner either: (i) over all S subcarriers, (ii) only over S-M subcarriers, where the pilot subcarriers are not carrying encrypted data and the terminal B uses them in the usual OFDM manner (to estimated amplitudes/phases), or (iii) the transformation T1 (U to L bits) is publicly known.

As mentioned previously, the secret key is assumed to be a string of U random bits. However, if the random bits are generated by using arbitrary random generator, then the communication system will have a throughput loss, because the key is consuming part of the available throughput, since the access point AP has to send it to the terminal B by the wireless transmission. Note that the random key itself does not carry useful information for the user.

Instead, as shown in Fig. 9, it is possible to generate the random key by using the user data, which is inherently random. The user data D having a length of U+L bits is split into two parts. The first U bits of D is used for generating the secret key, which is then transformed into L bits, which are XOR'ed with the last L bits from D. Thereby, it is possible to avoid the throughput loss, as the secret key is also useful data. This method can be used both for data-sequential and data-parallel transmission.

Figs. 4 and 5 show an example of generation of random bits. Fig. 4 shows the absolute value of signals B_k and E_k received at the terminal B and the eavesdropper E in an OFDM system with 64 subcarriers. The graph shows the absolute value of the signals in arbitrary units as a function of the k-th pilot subcarrier.

Fig. 5a shows the binary code or key generated by the terminal S by a simple comparison of adjacent pilot subcarriers as a function of the subcarrier number k. Fig. 5b shows the corresponding binary code or key generated by the eavesdropper E by a simple comparison of adjacent pilot subcarriers as a function of the subcarrier number k. Fig. 5c shows the difference between the generated key and it shows that 26 of the 63 individual code symbols are different.

The invention has been described with reference to a preferred embodiment. However, the scope of the invention is not limited to the illustrated embodiment, and alterations and modifications can be carried out without deviating from said scope of the invention.

Claims

1. A method for secure communication in a wireless communication system, said system comprising: - at least a first access point (AP) having at least a first antenna (52) and a second antenna (53),

- at least a first terminal (B) having at least one terminal antenna (51), and

- a number of subcarriers for communication between the access point (AP) and the terminal (B), wherein said method comprises the steps of: i) the first terminal (B) transmitting at least one terminal pilot signal using the at least one terminal antenna (51) to the access point (AP) via M subcarriers, so as to provide individual terminal pilot signals, said at least one terminal pilot signal having a coherence time, ii) the access point (AP) detecting at least first signals at the first antenna (52) and second signals at the second antenna (53) for each of the individual terminal pilot signals, iii) the access point within the coherence time of the at least one terminal pilot signals generating and transmitting at least one new pilot signal to the terminal (B) via M subcarriers, so as to provide individual new pilot signals, said at least one new pilot signal being generated based on the first signals and the second signals detected in step ii) and carrying a secret key, which can be recovered by the access point locally, and iv) the terminal (B) detecting the individual new pilot signals and extracting the secret key shared by the terminal (B) and the access point (AP) based on the detected individual new pilot signals.

2. A method according to claim 1, wherein the access point in step ii) detects the amplitudes and/or the phases of the individual terminal pilot signals.

3. A method according to claim 1 or 2, wherein the communication between the terminal (B) and the access point (AP) is based on the OFDM protocol.

4. A method according to any of the preceding claims, wherein the detected individ- ual terminal pilot signals in step ii) are randomly generated signals.

5. A method according to any of the preceding claims, wherein the access point (AP) in step iii) generates the new pilot signals by making a linear combination of the first signals and the second signals.

6. A method according to claim 5, wherein the first signals and the second signals are linearly combined by the first (52) and the second antenna (53) retransmitting the detected first and second signals, respectively, to the terminal (B).

7. A method according to any of the preceding claims, wherein the new individual pi- lot signals are phase shifted by a value corresponding to the phase difference of the first and the second signals.

8. A method according to any of the preceding claims, wherein the terminal (B) uses a predefined power level for transmitting the terminal pilot signal so as to generate a received power distribution across the antennas of the access point (AP).

9. A method according to claims 7 and 8, wherein the new individual pilot signals additionally is multiplied with coefficients that correspond to the received power distribution.

10. A method according to claims 6 and 7 or claims 6 and 7 together with claim 8 or 9, wherein the phase shift corresponding to the phase difference of the detected first and second signals are applied to the retransmitted signal of the first antenna (52) or the retransmitted signal of the second antenna (53).

11. A method according to claim 6 or claim 6 together with any of claims 7-10, wherein the access point in step iii) multiplies a power coefficient and/or applies a phase shift to the retransmitted signal of the first antenna (52) and/or the retransmitted signal of the second antenna (53), said power coefficient and phase shift being chosen randomly.

12. A method according to any of the preceding claims, wherein the secret key is first generated by the access point (AP) as a string of random bits, the string subsequently being used to decide scaling factors and phase shifts for the individual new pilot signal so as to produce a desired received response at the terminal (B).

13. A method according to claim 12, wherein the secret key is digitised by the access point (AP) comparing the received response to a threshold level.

14. A method according to claim 12, wherein the secret key is converted to symbols by the access point (AP) comparing the received response to a number of threshold levels.

15. A method according to one of the preceding claims, wherein the secret key shared between the access point (AP) and the terminal (B) in step iv) is generated by using the information contained in the individual detected new pilot signals from the M subcarriers.

16. A method according to claim 15, wherein the M individual new pilot signals are used to generate M-1 complex numbers by comparing adjacent individual new pilot sig- nals.

17. A method according to claim 15, wherein the individual new pilot signals each have a correlation bandwidth (N_c), and wherein the M compared subcarrier pilot signals of the new set of pilot signals are at least the correlation bandwidth (N₀) apart.

18. A method according to any of the preceding claims, wherein a forward error correction (FEC) code is applied to the secret key.

19. A method according any of the preceding claims, wherein the access point (AP) comprises an error-control encoder, and the terminal (B) comprises a corresponding error-control decoder, and wherein the error-control encoder adds redundant bits to the secret key, and the error-control decoder decodes the new individual pilot signals with redundant bits.

20. A method according to any of the preceding claims, wherein the terminal (B) comprises two or more terminal antennas, and wherein the terminal sends pilot signals from said two or more terminal antennas sequentially.

21. A method according to any of the preceding claims, wherein the secret key is generated via an explicit communication phase dedicated to the generation of the secret key.

22. A method according to any of claims 1-22, wherein the secret key is transmitted together with data, which is to be sent between the access point (AP) and the terminal (B).

24. A method according to claim 22 or 23, wherein the secret key is generated from data, which is to be sent between the access point (AP) and the terminal (B).