Secure performance analysis and pilot spoofing attack detection in cell-free massive MIMO systems with finite-resolution ADCs

Abstract

In this article, the secure communication in cell-free massive multiple-input multiple-output system with low-resolution analog-to-digital converters is investigated in the presence of an active eavesdropper. Specifically, in this article, the deterioration caused by the analog-to-digital converter imperfections on the accuracy of the channel estimation and secure transmission performance is studied. Besides, the additive quantization noise model is utilized to analyze the impacts of the low-resolution analog-to-digital converters. The minimum mean square error channel estimation results show that there is a nonzero floor caused by the coarse analog-to-digital converters. Then, the closed-form expressions for both the legitimate users achievable ergodic rate and the information leakage to the eavesdropper are derived, respectively. Moreover, tight approximated ergodic secrecy rate expression is also presented with respect to analog-to-digital converters quantization bits, number of antennas, pilot power, and so on. To degrade the impacts of the pilot spoofing attack, an active attack detection approach based on random matrix theory is proposed which can only be operated at one access point. Simulation results are provided to corroborate the obtained results and analyze the impacts of various parameters on system secrecy performance. Also, the superiority of the proposed active attacks detection method is confirmed via simulation results.

Introduction

Massive multiple-input multiple-output (MIMO) is regarded as a promising wireless access technology for 5G and B5G wireless communication which can provide high spectral efficiency and high energy efficiency with simple signal processing.^1,2 Cellular massive MIMO equips the large number of the antennas on a single base station (BS) which has been analyzed widely and deeply on various respects, such as performance analysis, beamforming, power control, secure communication, and so on.^2–4 However, the performance of such cellular system is inevitably limited by the intercell interferences and channel correlation. One practical alternative is to install several antenna sets onto distributed physical locations which is also called distributed massive MIMO.^5,6 As a scalable distributed massive MIMO concept, cell-free massive MIMO has been proved to be a promising wireless network architecture which can provide coherent service by geographically distributed access points (APs) for future wireless communication systems. ⁷ Since its proposal, various works on performance evaluations and transmission schemes over cell-free massive MIMO have been investigated.^8–10 Due to the broadcast nature of wireless channels, facilitating secure and reliable wireless transmission is a critical topic for future wireless communication systems.^11–13 Despite the robustness of massive MIMO against passive eavesdropping, the active eavesdropping attacks are more relevant.^14,15

Currently, most related literatures merely focused on the secure transmission in co-located massive MIMO systems,^16–18 while secrecy provisions for cell-free massive MIMO have not been well explored. Hoang et al. ¹⁹ discussed the secrecy performance and power allocation for cell-free massive MIMO with active eavesdropper. The effect of hardware impairments over secure cell-free massive MIMO system with active spoofing attack has been investigated in Zhang et al. ²⁰ However, all aforementioned works are based on adopting high-resolution analog-to-digital converters (ADCs) in massive MIMO systems. To reduce energy consumption and physical hardware costs, implementing finite-resolution ADCs in massive MIMO systems has been regarded as an effective approach. Several researchers have devoted to the implementation of finite-resolution ADCs in cell-free massive MIMO systems recently.^21–23 Besides, the secure co-located massive MIMO with finite-resolution ADCs has been studied in Teeti. ²⁴ Nevertheless, the impact of ADCs quality on secrecy performance in cell-free massive MIMO has not been considered in existing research.

In a time-division duplex (TDD) massive MIMO system, the BS always acquires the channel state information (CSI) of the legitimate users via uplink training based on the reciprocity of the downlink and uplink channels. All legal users are required to send the redesigned and assigned pilot (training) signals to the BS in uplink training phase. Since all pilot signals are repeatedly used and publicly known by the BS and all users, a smart malicious eavesdropper can easily learn the target user’s pilot signals and transmit an identical pilot signal as that of a legitimate target user which is also called spoofing attack. ²⁵ Due to the spoofing attack operated by the active eavesdropper, the adversary could manipulate the CSI estimation which is the weighted sum of the target legitimate user and the eavesdropper’s channels. Consequently, the beamforming based on the estimated CSI during the data transmission results in information leakage to the eavesdropper. Some existing literatures show that the massive MIMO is robust against passive eavesdropping while the secrecy performance of the massive MIMO system is dramatically degraded by active attacks.^14,15,26 Thus, detection of the active eavesdropper can be considered as an effective countermeasure to weaken the influence of active spoofing attacks. Kapetanović et al. ²⁷ proposed a detection scheme via random training pilots for massive MIMO system. However, some special pilot sequences are required to do the detection in this proposed method. Then, different schemes for active attack detection have been presented in Kapetanović et al. ²⁸ which are operated at different locations and based on different system parameters. It is noted that the precoder normalization is crucially important for these active eavesdropper detection schemes. Moreover, a simple detection protocol based on the statistical properties of the channel estimation has been provided in Al-Nahari, ¹⁵ which is also determined by the correctness of the channel estimation. Besides, the minimum description length (MDL) source enumeration algorithm has been utilized for active eavesdropper detection in Tugnait,^29,30 which can greatly improve the detection performance using short pilot sequences. According to Kritchman and Nadler ³¹ and Tugnait, ³² the random matrix theory (RMT) detection approach can achieve more precise results compared with MDL algorithm and has been proved to be highly effective in traditional MIMO system.

Motivated by the aforementioned observations, this article presents the first study of the security problem in cell-free massive MIMO system with finite-resolution ADCs against active eavesdropper. Furthermore, the tight asymptotic lower bound of achievable secrecy rate has been provided to enable the effects of ADC resolution, number of APs, each AP’s antenna number, and so on. Also, an active eavesdropping detection algorithm based on RMT is presented. And the proposed detection algorithm can be operated at one AP which only needs a simple procedure. The specific contributions of this article can be summarized as follows:

• To capture the aggregate impacts of low-resolution ADCs, the additive quantization noise model (AQNM) is utilized to analyze the performance of the secure cell-free massive MIMO system. Specifically, this article operates the channel estimation via uplink training under minimum mean square error (MMSE) criterion. Moreover, the results show that the low-quality ADCs lead to a nonzero floor on the channel estimation. Also, more pilot power of the eavesdropper would bring larger damnification for channel estimation.

• The downlink secrecy communication has been considered with the low-resolution ADCs. Based on the AQNM and the imperfect CSI, the closed-form expression of the secrecy rate has been derived with respect to key system parameters, including the quantization bits of the ADCs, the number of the total antennas, the pilot and data transmission power, and so on. These novel results can provide a effective tool to quantitatively analyze the impacts of system parameters on system secrecy performance.

• To weaken the impacts taken by the active eavesdropping, an active attacks detection scheme based on the pilot self-contamination has been proposed which can only be operated at one AP. The detection is employed via determining the signal subspace rank which is estimated by RMT source enumeration approach. Also, the proposed detection approach has been illustrated accurate and effective via simulations.

The outline of the article is organized as follows. Section “System model” introduces the considered secure cell-free massive MIMO system model. Section “Uplink training” details the procedure of the uplink MMSE channel estimation. Section “Secrecy performance analysis” derives the achievable secrecy rate of the considered system. The RMT-based active eavesdropping detection is discussed in section “RMT-based pilot spoofing attack detection.” Simulation results are presented in section “Numerical results.” Finally, the article is concluded in section “Conclusion.”

Notation

Throughout this article, boldface lower case and upper case letters are utilized to represent vectors and matrices, for example, $\mathbf{y}$ , $\mathbf{Y}$ . The superscript $(·{)}^{*}$ , $(·{)}^T$ , and $(·{)}^H$ stand for the conjugate, transpose and Hermitian transpose operation, respectively. In addition, the Euclidean norm of a vector $\mathbf{g}$ and the absolute value of a scalar $g$ can be denoted as $\Vert \mathbf{g}\Vert$ and $\left|g\right|$ , respectively. $\mathbb{E}\{·\}$ , $\mathrm{V}\mathrm{ar}\{·\}$ , $\mathrm{r}\mathrm{ank}\{·\}$ , and $\mathrm{E}\mathrm{ig}\{·\}$ represent operations of expectation, variance, rank, and eigenvalue of a matrix, respectively. $\mathbf{x}~\mathcal{C}\mathcal{N}(\mathbf{m},\mathbf{A})$ stands for a complex Gaussian random vector $\mathbf{x}$ with mean $\mathbf{m}$ and covariance matrix $\mathbf{A}$ . ${\mathbf{I}}_M$ and ${\mathbb{C}}^{M\times N}$ are $M-$ dimensional identity matrix and $M\times N$ dimensional complex space. Besides, independent and identically distributed is abbreviated as i.i.d. Finally, $[x{]}^{+}=max\{0,x\}$ .

System model

As illustrated in Figure 1, the cell-free massive MIMO system comprising $M$ APs, $K$ one-antenna legitimate users, and an active eavesdropper (Eve) is considered in this article. Each AP is equipped with $N$ antennas. All APs are connected to a CPU through backhaul for sharing information. The Eve is equipped with single antenna and intends to contaminate the uplink training by pilot spoofing attack. ¹⁹ The system is assumed operated in TDD mode, where the downlink and uplink channels are assumed to be reciprocal. Rayleigh block-fading channels are assumed between the APs and different terminals, where the channels remain constant in one time slot and vary independently afterward. Then, the channels between the $m\mathrm{t}\mathrm{h}$ AP and $k\mathrm{t}\mathrm{h}$ user (the Eve) can be denoted by^7–9

$${\mathbf{g}}_{\mathrm{mk}}=\sqrt{{\beta }_{\mathrm{mk}}}{\mathbf{h}}_{\mathrm{mk}}\in {\mathbb{C}}_{N\times 1}$$

(1)

$${\mathbf{g}}_{\mathrm{mk}}=\sqrt{{\beta }_{\mathrm{mk}}}{\mathbf{h}}_{\mathrm{mk}}\in {\mathbb{C}}_{N\times 1}$$

(2)

where ${\beta }_{\mathrm{mk}}$ ( ${\beta }_{\mathrm{mE}}$ ) represents the large-scale fading, ${\mathbf{h}}_{\mathrm{mk}}$ ( ${\mathbf{h}}_{\mathrm{mE}}$ ) models the small-scale fading vector with elements being independent and identically distributed (i.i.d) $\mathcal{C}\mathcal{N}(0,1)$ random variables (RVs).

Figure 1.

The architecture of the considered secure cell-free massive MIMO transmission system.

Since secure downlink transmission is investigated in this article, each time slot consists of uplink training and downlink transmission phases.

Uplink training

Due to the channel reciprocity, the CSI can be only acquired by uplink training. During this phase, all legitimate users send mutually orthogonal pilot sequences of length ${\tau }_p$ symbols for channel estimation at the APs, where ${\tau }_p\ge K$ . Let $\sqrt{{\tau }_p{p}_p}{\mathit{\phi }}_k\in {\mathbb{C}}^{{\tau }_p\times 1}$ be the pilot vector sending by the $k\mathrm{t}\mathrm{h}$ user, where $\Vert {\mathit{\phi }}_k{\Vert }^2=1$ , $p_p$ represents the normalized pilot signal power. Since the pilot signals are repeatedly utilized and publicly predesigned, an intelligent eavesdropper can pretend to be a legitimate user by transmitting the identical pilot signals as the target user. No loss of generality, assuming that the Eve aims to eavesdrop the confidential information sending to the $k\mathrm{t}\mathrm{h}$ user, Eve’s pilot sequence can be denoted by $\sqrt{{\tau }_p{p}_E}{\mathit{\phi }}_E$ , where ${\mathit{\phi }}_E={\mathit{\phi }}_k$ , $p_E$ is the normalized transmit power of Eve. The $N\times {\tau }_p$ received pilot matrix at the $m\mathrm{t}\mathrm{h}$ AP is given by

$${\mathbf{Y}}_{p,m}=\sqrt{{\tau }_p{p}_p}\sum _{k=1}^K{\mathbf{g}}_{\mathrm{mk}}{\mathit{\phi }}_k^H+\sqrt{{\tau }_p{p}_E}{\mathbf{g}}_{\mathrm{mE}}{\mathit{\phi }}_E^H+{\mathbf{W}}_{p,m}$$

(3)

where ${\mathbf{W}}_{p,m}\in {\mathbb{C}}^{N\times {\tau }_p}$ denotes the additive white Gaussian noise matrix, whose elements are i.i.d $\mathcal{C}\mathcal{N}(0,1)$ RVs. By utilizing the additive quantization noise model (AQNM), the resulting signal after finite-resolution ADCs at $m\mathrm{t}\mathrm{h}$ AP can be given by^21,22

$${\tilde{\mathbf{Y}}}_{p,m}={\gamma }_m{\mathbf{Y}}_{p,m}+{\tilde{\mathbf{W}}}_{p,m}$$

(4)

where ${\gamma }_m\le 1$ is scaling factor with respect to the ADC quantization bits $b_m$ , whose accurate values are shown in Table 1.

Table 1.

Corresponding scaling factors for different ADC quantization bits.

b	1	2	3	4	5
${\gamma }_m$	0.6366	0.8825	0.96546	0.990503	0.997501

Also, ${\tilde{\mathbf{W}}}_{p,m}$ is the quantization noise matrix with covariance matrix as

$$\mathbf{R}\left({\tilde{\mathbf{W}}}_{p,m}\right)={\gamma }_m(1-{\gamma }_m)\mathrm{d}\mathrm{iag}\left(\mathbb{E}\left\{{\mathbf{Y}}_{p,m}{\mathbf{Y}}_{p,m}^H\right\}\right)$$

(5)

Then, projecting ${\tilde{\mathbf{Y}}}_{p,m}$ onto ${\mathit{\phi }}_l$ , the post-processing signal can be rewritten as

$$\begin{array}{c}\multicolumn{1}{c}{{\tilde{\mathbf{y}}}_{p,m,l}={\gamma }_m(\sqrt{{\tau }_p{p}_p}{\mathbf{g}}_{\mathrm{ml}}+\sqrt{{\tau }_p{p}_E}{\mathbf{g}}_{\mathrm{mE}}{\mathit{\phi }}_E^H{\mathit{\phi }}_l+{\mathbf{w}}_{p,m})}\\ +{\tilde{\mathbf{w}}}_{p,m}\hfill \end{array}$$

(6)

where ${\mathbf{w}}_{p,m}={\mathbf{W}}_{p,m}{\mathit{\phi }}_l$ , ${\tilde{\mathbf{w}}}_{p,m}={\tilde{\mathbf{W}}}_{p,m}{\mathit{\phi }}_l$ .

By utilizing the MMSE estimation, the estimated channels can be written by^16,21

$${\mathbf{g}}_{\mathrm{ml}}={\hat{\mathbf{g}}}_{\mathrm{ml}}+{\tilde{\mathbf{g}}}_{\mathrm{ml}}$$

(7)

$${\mathbf{g}}_{\mathrm{mE}}={\hat{\mathbf{g}}}_{\mathrm{mE}}+{\tilde{\mathbf{g}}}_{\mathrm{mE}}$$

(8)

where the estimate ${\hat{\mathbf{g}}}_{\mathrm{ml}}$ ( ${\hat{\mathbf{g}}}_{\mathrm{mE}}$ ) and estimation error ${\tilde{\mathbf{g}}}_{\mathrm{ml}}$ ( ${\tilde{\mathbf{g}}}_{\mathrm{mE}}$ ) are mutually independent, whose elements are zero mean i.i.d. RVs with variances ${\lambda }_{\mathrm{ml}}$ ( ${\lambda }_{\mathrm{mE}}$ ) and ${\beta }_{\mathrm{ml}}-{\lambda }_{\mathrm{ml}}$ $({\beta }_{\mathrm{ml}}-{\lambda }_{\mathrm{ml}})$ .

Moreover, the channel estimation ${\hat{\mathbf{g}}}_{\mathrm{ml}}$ can be expressed as

$${\hat{\mathbf{g}}}_{\mathrm{ml}}^H=\frac{\mathbb{E}\left\{{\mathbf{g}}_{\mathrm{ml}}^H{\tilde{\mathbf{y}}}_{p,m,l}\right\}}{\mathbb{E}\left\{{\tilde{\mathbf{y}}}_{\mathrm{ml}}^H{\tilde{\mathbf{y}}}_{p,m,l}\right\}}{\tilde{\mathbf{y}}}_{p,m,l}^H$$

(9)

Then, one important theorem can be given as follows.

Theorem 1

The variances ${\lambda }_{\mathrm{ml}}$ and ${\lambda }_{\mathrm{mE}}$ can de denoted by

$${\lambda }_{\mathrm{ml}}=\{\begin{array}{c}\multicolumn{1}{c}{\frac{{\gamma }_m{\tau }_p{p}_p{\beta }_{\mathrm{mk}}^2}{1+{\tau }_p{p}_p{\beta }_{\mathrm{mk}}+{\tau }_p{p}_E{\beta }_{\mathrm{mE}}},l=k}\\ \multicolumn{1}{c}{\frac{{\gamma }_m{\tau }_p{p}_p{\beta }_{\mathrm{ml}}^2}{1+{\tau }_p{p}_p{\beta }_{\mathrm{ml}}},l\ne k}\end{array}$$

(10)

$${\lambda }_{\mathrm{mE}}=\frac{{\gamma }_m{\tau }_p{p}_E{\beta }_{\mathrm{mE}}^2}{1+{\tau }_p{p}_p{\beta }_{\mathrm{mk}}+{\tau }_p{p}_E{\beta }_{\mathrm{mE}}}$$

(11)

Proof

Please see Appendix 1.

Since the downlink beamformer is based on the estimated CSI via uplink training, the accuracy of the channel estimation is crucially important. Then, the normalized minimum square error (NMSE) of the target user can be used to evaluate the estimation performance which is defined as

$$\mathrm{N}\mathrm{MSE}=\frac{\sum _{m=1}^M\mathbb{E}\left\{{\Vert {\tilde{\mathbf{g}}}_{\mathrm{mk}}\Vert }^2\right\}}{\sum _{m=1}^M\mathbb{E}\left\{{\Vert {\mathbf{g}}_{\mathrm{mk}}\Vert }^2\right\}}=\frac{\sum _{m=1}^M({\beta }_{\mathrm{mk}}-{\lambda }_{\mathrm{mk}})}{\sum _{m=1}^M{\beta }_{\mathrm{mk}}}$$

(12)

To achieve some valuable insights, one limit behavior of the NMSE can be considered as follows. As $p_d\to +\infty$ , we can get the limit value of ${\lambda }_{\mathrm{mk}}$ as

$$\begin{array}{c}\underset{p_d\to +\infty }{lim}{\lambda }_{\mathrm{mk}}=\underset{p_d\to +\infty }{lim}\frac{{\gamma }_m{\tau }_p{p}_p{\beta }_{\mathrm{mk}}^2}{1+{\tau }_p{p}_p{\beta }_{\mathrm{mk}}+{\tau }_p{p}_E{\beta }_{\mathrm{mE}}}\hfill \\ \multicolumn{1}{c}{={\gamma }_m{\beta }_{\mathrm{mk}}}\end{array}$$

(13)

Thus, there is a nonzero floor on the channel estimation error NMSE caused by the ADCs imperfection. Besides, this zero floor cannot be compensated by increasing the pilot power of the legitimate users.

Secrecy performance analysis

In this section, we will focus on the performance analysis as a measure to evaluate the performance of the considered secure communication system.^33–37 All APs perform conjugate beamforming to simultaneously transmit data to all users with the same time-frequency resource. Then, the signal transmitted by the $m\mathrm{t}\mathrm{h}$ AP can be represented by

$${\mathbf{x}}_m=\sqrt{p_d}\sum _{l=1}^K\sqrt{{\eta }_{\mathrm{ml}}}{\hat{\mathbf{g}}}_{\mathrm{ml}}^{*}{q}_l$$

(14)

where $q_l$ denotes the normalized signal intended to the $l\mathrm{t}\mathrm{h}$ user with $\left|q_l\right|=1$ , ${\eta }_{\mathrm{ml}}$ is the power control coefficient satisfying the power constraint as

$$\sum _{l=1}^K{\eta }_{\mathrm{ml}}{\lambda }_{\mathrm{ml}}\le p_d$$

(15)

Then, the received signal at the $k\mathrm{t}\mathrm{h}$ user and the Eve can be denoted by

$$y_k=\sum _{m=1}^M{\mathbf{g}}_{\mathrm{mk}}^T{\mathbf{x}}_m+w_k$$

(16)

$$y_E=\sum _{m=1}^M{\mathbf{g}}_{\mathrm{mE}}^T{\mathbf{x}}_m+w_E$$

(17)

where $w_k~\mathcal{C}\mathcal{N}(0,1)$ and $w_E~\mathcal{C}\mathcal{N}(0,1)$ represent received noise elements at the target user and the Eve, respectively. Operated by the low-resolution ADCs at the users, the output signal can be given by

$${\tilde{y}}_k={\gamma }_u{y}_k+{\tilde{w}}_k$$

(18)

where ${\gamma }_u$ denotes the scaling factor of the ADCs at the users. Also, ${\tilde{w}}_k$ is the quantization noise with the variance as

$$R_{{\tilde{w}}_k}={\gamma }_u(1-{\gamma }_u)\mathbb{E}\left\{{\left|y_k\right|}^2\right\}$$

(19)

We consider the realistic case that the target user cannot obtain its instantaneous CSI. Hence, the $k\mathrm{t}\mathrm{h}$ user will detect its desired signal $q_k$ by using the statistical CSI. Considering a pessimistic case, we assume that the Eve can obtain the perfect instantaneous CSI and has been equipped with high-quality hardware. Based on these settings, the lower bound on the target user’s achievable rate and the upper bound for the Eve’s ergodic capacity can be achieved. Furthermore, the signals at the $k\mathrm{t}\mathrm{h}$ user and the Eve can be rewritten as

$$\{\begin{array}{c}{\tilde{y}}_k={\gamma }_u\sqrt{p_d}\mathbb{E}\left\{\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{mk}}}{\mathbf{g}}_{\mathrm{mk}}^T{\hat{\mathbf{g}}}_{\mathrm{mk}}^{*}\right\}{q}_k+w_k^{\mathrm{eff}}\hfill \\ \multicolumn{1}{c}{y_E=\sqrt{p_d}\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{mk}}}{\mathbf{g}}_{\mathrm{mE}}^T{\hat{\mathbf{g}}}_{\mathrm{mk}}^{*}{q}_k+w_E^{\mathrm{eff}}}\end{array}$$

(20)

where $w_k^{\mathrm{eff}}$ and $w_E^{\mathrm{eff}}$ denote the effective noise at the $k\mathrm{t}\mathrm{h}$ user and the Eve which are given by

$$\begin{array}{c}{w}_k^{\mathrm{eff}}={\gamma }_u\sqrt{p_d}\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{mk}}}{\mathbf{g}}_{\mathrm{mk}}^T{\hat{\mathbf{g}}}_{\mathrm{mk}}^{*}{q}_k\hfill \\ -{\gamma }_u\sqrt{p_d}\mathbb{E}\left\{\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{mk}}}{\mathbf{g}}_{\mathrm{mk}}^T{\hat{\mathbf{g}}}_{\mathrm{mk}}^{*}\right\}{q}_k\hfill \\ +{\gamma }_u\sqrt{p_d}\sum _{l\ne k}^K\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{ml}}}{\mathbf{g}}_{\mathrm{mk}}^T{\hat{\mathbf{g}}}_{\mathrm{ml}}^{*}{q}_l+{\gamma }_u{w}_k+{\tilde{w}}_k\hfill \end{array}$$

(21)

$$w_E^{\mathrm{eff}}=\sqrt{p_d}\sum _{l\ne k}^K\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{ml}}}{\mathbf{g}}_{\mathrm{mE}}^T{\hat{\mathbf{g}}}_{\mathrm{ml}}^{*}{q}_l+w_E$$

(22)

In this article, the ergodic secrecy rate is chosen to evaluate the secrecy performance of the considered system. By considering the difference of the channel capacities between the target user and the Eve, the ergodic secrecy rate is given by

$$\begin{array}{c}{R}_k^{\sec }={[R_k-R_k^{\mathrm{Eve}}]}^{+}\hfill \\ ={[{\log }_2(1+{\zeta }_k)-{\log }_2(1+{\zeta }_k^{\mathrm{Eve}})]}^{+}\hfill \end{array}$$

(23)

where $R_k$ ( $R_k^{\mathrm{Eve}}$ ) and ${\zeta }_k$ ( ${\zeta }_k^{\mathrm{Eve}}$ ) denote the achievable ergodic rate and signal-to-interference-noise ratio (SINR) at the $k\mathrm{t}\mathrm{h}$ user (the Eve). Then, we can get that

$${\zeta }_k=\frac{{\gamma }_u^2{p}_d{\left|\mathbb{E}\left\{\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{mk}}}{\mathbf{g}}_{\mathrm{mk}}^T{\hat{\mathbf{g}}}_{\mathrm{mk}}^{*}\right\}\right|}^2}{\mathbb{E}\left\{{\left|w_k^{\mathrm{eff}}\right|}^2\right\}}$$

(24)

$${\zeta }_k^{\mathrm{Eve}}=\frac{p_d\mathbb{E}\left\{{\left|\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{mk}}}{\mathbf{g}}_{\mathrm{mE}}^T{\hat{\mathbf{g}}}_{\mathrm{mk}}^{*}\right|}^2\right\}}{\mathbb{E}\left\{{\left|w_E^{\mathrm{eff}}\right|}^2\right\}}$$

(25)

Subsequently, the closed-form expressions of $R_k$ and $R_k^{\mathrm{Eve}}$ can be given in the following theorem.

Theorem 2

In the considered cell-free massive MIMO system, the SINRs at the $k\mathrm{t}\mathrm{h}$ user and the Eve can be given by equations (26) and (27) shown at the top of the next page

$${\zeta }_k=\frac{{\gamma }_u{\left(\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{mk}}}{\lambda }_{\mathrm{mk}}\right)}^2}{\frac{1}{N^2{p}_d}+\frac{1}{N}\sum _{l=1}^K\sum _{m=1}^M{\eta }_{\mathrm{ml}}{\lambda }_{\mathrm{ml}}{\beta }_{\mathrm{mk}}+(1-{\gamma }_u){\left(\sum _{m=1}^M\sqrt{{\eta }_{\mathrm{mk}}}{\lambda }_{\mathrm{mk}}\right)}^2}$$

(26)

$${\zeta }_k^{\mathrm{Eve}}=\frac{p_d\sum _{m=1}^M{\eta }_{\mathrm{mk}}(\frac{N^2{p}_E{\beta }_{\mathrm{mE}}^2}{p_p{\beta }_{\mathrm{mk}}^2}{\lambda }_{\mathrm{mk}}^2+N{\beta }_{\mathrm{mE}}{\lambda }_{\mathrm{mk}})}{1+N{p}_d\sum _{l\ne k}^K\sum _{m=1}^M{\eta }_{\mathrm{ml}}{\lambda }_{\mathrm{ml}}{\beta }_{\mathrm{mE}}}$$

(27)

Proof

Please refer to Appendix 2.

RMT-based pilot spoofing attack detection

According to some existing papers, it is reasonable to operate the pilot spoofing attack detection based on the uplink training. Our proposed detection scheme is to perform source enumeration using RMT algorithm which is based on both the distribution of the signal eigenvalues and noise eigenvalues with the presence of noise. Also, to improve the detection accuracy, the uplink training can be divided into two phases: uplink training and uplink active attack detection. In the detection, it is set that only the legitimate target user send the pilot signal which can be designed that a fraction $0\le \alpha \le 1$ of the pilot power is allocated to a scalar random sequence ${\mathit{\phi }}_B$ . The superimposing random sequence ${\mathit{\phi }}_B$ is normalized ( $\Vert {\mathit{\phi }}_B{\Vert }^2=1$ ) and zero-mean whose elements can be chosen from finite alphabet: BPSK or QPSK. Therefore, instead of the pilot signal $\sqrt{{\tau }_p{p}_p}{\mathit{\phi }}_k$ , the pilot signal used for detection at the target user (the $k\mathrm{t}\mathrm{h}$ user) is given by

$${\mathbf{s}}_d=\sqrt{(1-\alpha ){\tau }_p{p}_p}{\mathit{\phi }}_k+\sqrt{\alpha {\tau }_p{p}_p}{\mathit{\phi }}_B$$

(28)

To keep the detection processing confidential, the random sequence ${\mathit{\phi }}_B$ is unknown to the APs and to the Eve in advance as it is designed randomly at the user terminal. The detection problem is in fact a binary statistical hypothesis testing problem framework, where the two hypotheses can be made with the null hypothesis ${\mathcal{H}}_0$ denoting no attacks and the alternative hypothesis ${\mathcal{H}}_1$ representing existing active eavesdropping. The two hypotheses can be presented as follows

$$\begin{array}{c}{\mathcal{H}}_0:{\mathbf{Y}}_{d,m}={\gamma }_m{\mathbf{g}}_{\mathrm{mk}}{\mathbf{s}}_d^H+{\mathbf{V}}_m\hfill \\ \multicolumn{1}{c}{{\mathcal{H}}_1:{\mathbf{Y}}_{d,m}={\gamma }_m{\mathbf{g}}_{\mathrm{mk}}{\mathbf{s}}_d^H+{\gamma }_m{\mathbf{g}}_{\mathrm{mE}}{\mathit{\phi }}_k^H+{\mathbf{V}}_m}\end{array}$$

(29)

where ${\mathbf{V}}_m\in C^{N\times {\tau }_p}$ is the effective noise component including the quantization noise matrix and additive noise matrix.

Obviously, the received signals under these two hypotheses can be modeled as Gaussian variable with different expectation. According to the existing literature,^29–32 the deterministic signals can be used for source enumeration to detect the existing active attacks.

Then, we can define that the correlation matrix of the received signal as

$$R_{y,i}={\tau }_p^{-1}\mathbb{E}\left\{{\mathbf{Y}}_{d,m}{\mathbf{Y}}_{d,m}^H|H_i\right\}$$

(30)

Furthermore, the correlation matrix of the source signals is given by

$$R_{s,i}={\tau }_p^{-1}\mathbb{E}\left\{({\mathbf{Y}}_{d,m}-{\mathbf{V}}_m){({\mathbf{Y}}_{d,m}-{\mathbf{V}}_m)}^H|H_i\right\}$$

(31)

As such, the matrix $R_{s,i}$ under the two hypotheses can be represented as

$$R_{s,0}={\tau }_p^{-1}{\gamma }_m^2{\mathbf{g}}_{\mathrm{mk}}\mathbb{E}\left\{{\mathbf{s}}_d^H{\mathbf{s}}_d\right\}{\mathbf{g}}_{\mathrm{mk}}^H$$

(32)

$$R_{s,1}={\tau }_p^{-1}{\gamma }_m^2\mathbf{G}·\mathbb{E}\left\{{\mathbf{S}}_d^H{\mathbf{S}}_d\right\}·{\mathbf{G}}^H$$

(33)

where the matrices $\mathbf{G}$ and ${\mathbf{S}}_d$ are defined as

$$\mathbf{G}=[\sqrt{1-\alpha }{\mathbf{g}}_{\mathrm{mk}}+{\mathbf{g}}_{\mathrm{mE}},\sqrt{\alpha }{\mathbf{g}}_{\mathrm{mk}}]\in {\mathbb{C}}^{N\times 2}$$

(34)

$${\mathbf{S}}_d=[\sqrt{{\tau }_p{p}_p}{\mathit{\phi }}_k,\sqrt{{\tau }_p{p}_p}{\mathit{\phi }}_B]\in {\mathbb{C}}^{{\tau }_p\times 2}$$

(35)

It is noted that $\mathrm{r}\mathrm{ank}({\mathbf{R}}_{s,0})=1$ . Due to the fact that ${\mathbf{g}}_{\mathrm{mk}}\ne {\mathbf{g}}_{\mathrm{mE}}$ , we can derive that $\mathrm{r}\mathrm{ank}({\mathbf{R}}_{s,1})=2$ with $\alpha >0$ .

Moreover, we can derive that

$${\mathbf{R}}_{y,i}={\mathbf{R}}_{s,i}+{\delta }_v^2{\mathbf{I}}_{{\tau }_p}$$

(36)

where ${\delta }_v^2$ is the variance of the noise matrix ${\mathbf{V}}_m$ . Let ${\varsigma }_{1,0}>0$ and ${\varsigma }_{1,1}>{\varsigma }_{2,1}>0$ denote the nonzero eigenvalues of correlation matrix ${\mathbf{R}}_{s,0}$ and ${\mathbf{R}}_{s,1}$ . Hence, the eigenvalues of ${\mathbf{R}}_{y,i}$ can be given by

$$\mathrm{Eig}\left\{{\mathbf{R}}_{y,0}\right\}=\left({\varsigma }_{1,0}+{\delta }_v^2,{\delta }_v^2,\dots ,{\delta }_v^2\right)$$

(37)

$$\mathrm{Eig}\left\{{\mathbf{R}}_{y,1}\right\}=\left({\varsigma }_{1,1}+{\delta }_v^2,{\varsigma }_{2,1}+{\delta }_v^2,{\delta }_v^2,\dots ,{\delta }_v^2\right)$$

(38)

Thus, the two hypotheses can be distinguished by estimating the dimension $d=1$ or $d=2$ of the signal subspace which can be operated by the RMT estimator. Thus, the two hypotheses in equation (29) can be reformulated as

$$\begin{array}{c}{\mathcal{H}}_0:\mathrm{r}\mathrm{ank}\left({\mathbf{R}}_{s,0}\right)=d=1\hfill \\ \multicolumn{1}{c}{{\mathcal{H}}_1:\mathrm{r}\mathrm{ank}\left({\mathbf{R}}_{s,1}\right)=d>1}\end{array}$$

(39)

The RMT approach considers distribution of the noise eigenvalues of $R_{y,i}$ with the absence of signals, that is, ${\mathbf{Y}}_{d,m}={\mathbf{V}}_m$ . In particular, the distribution of the largest eigenvalue of a pure noise matrix based on a certain asymptotic limit of the distribution is used for matrix rank judgment. Then, we define the correction matrix as

$${\mathbf{R}}_v={\tau }_p^{-1}\mathbb{E}\left\{{\mathbf{V}}_m{\mathbf{V}}_m^H\right\}$$

(40)

The eigenvalues of ${\mathbf{R}}_v$ can be ordered as $l_1\ge l_2\ge \cdots \ge l_N$ . As the joint limit $N,{\tau }_p\to +\infty$ with $N/{\tau }_p\to c\ge 0$ , the largest eigenvalue $l_1$ converges to a Tracy-Widom distribution of order 2, that is

$$\begin{array}{c}\multicolumn{1}{c}{\underset{N,{\tau }_p\to +\infty ,N/{\tau }_p\to c\ge 0}{lim}P\{l_1<{\delta }_v^2({\mu }_{{\tau }_p,N}+z{\delta }_{{\tau }_p,N})\}}\\ =F_{\mathrm{TW},2}\left(z\right)\hfill \end{array}$$

(41)

where $F_{\mathrm{TW},2}(z)$ represents the Tracy-Widom probability distribution function of order 2. Besides, ${\mu }_{{\tau }_p,N}$ and ${\delta }_{{\tau }_p,N}$ denote the centering and scaling parameters which are only determined by $N$ and ${\tau }_p$ . Furthermore, the parameters ${\mu }_{{\tau }_p,N}$ and ${\delta }_{{\tau }_p,N}$ can be denoted by

$${\mu }_{{\tau }_p,N}=\frac{1}{{\tau }_p}{(\sqrt{{\tau }_p+0.5}+\sqrt{N+0.5})}^2$$

(42)

$${\delta }_{{\tau }_p,N}=\sqrt{\frac{{\mu }_{{\tau }_p,N}}{{\tau }_p}}{(\frac{1}{\sqrt{{\tau }_p+0.5}}+\frac{1}{\sqrt{N+0.5}})}^{1/3}$$

(43)

Then, we should consider the behavior of correlation matrix adding the signals. In this case, the eigenvalue of matrix ${\mathbf{R}}_{y,i}$ also follows a Tracy-Widom distribution. Hence, the signal dimension can be estimated by judging whether the largest eigenvalue is over some deterministic threshold. Motivated by the above analysis, the RMT algorithm for signal subspace rank estimation can be defined by

$$\begin{array}{c}{\hat{d}}_{\mathrm{RMT}}=\hfill \\ \arg \underset{k}{min}\{{\zeta }_k<{\hat{\delta }}_{v,k}^2({\mu }_{{\tau }_p,N}+z\left(P_{\mathrm{fa}}\right){\delta }_{{\tau }_p,N})\}-1\hfill \end{array}$$

(44)

where $k\in \{1,2,\dots ,min(N,{\tau }_p)-1\}$ , $z(P_{\mathrm{fa}})$ satisfies that $F_{\mathrm{TW},2}(z(P_{\mathrm{fa}}))=P_{\mathrm{fa}}$ , $P_{\mathrm{fa}}$ denotes the false alarm probability. In addition, with the assumption of $K$ signals, the noise variance can be estimated by maximum likelihood estimator as

$${\hat{\delta }}_{v,k}^2=\frac{1}{N-K}\sum _{i=K+1}^N{l}_i$$

(45)

The above RMT approach can be used for signal subspace rank estimation based on the fact whether ${\hat{d}}_{\mathrm{RMT}}=1$ or ${\hat{d}}_{\mathrm{RMT}}>1$ . Hence, the algorithm can only be performed in small set that is $k\in \{1,2\}$ . Furthermore, this detection algorithm can be only operated at one AP. To ensure the detection performance, we can choose the AP which is nearest to the user and the Eve for active attack detection. Therefore, the AP can achieve the largest SNR and can get a larger detection probability.

Numerical results

In the simulations, all APs, users, and the Eve are randomly located over a circle cell of radius 300 m. A simplified path-loss model has been used as $\beta =(d_0/d{)}^v$ , where $d$ , $d_0$ , and $v$ represent real geographical distance, reference distance, and loss coefficient, respectively. ³⁸ To quantitatively illustrate the results, key system parameters are set that $d_0=50\mathrm{m}$ , $v=2.4$ , $p_p=p_d=10\mathrm{d}\mathrm{BW}$ , ${\tau }_p=K=20$ , and $\mathrm{MN}=200$ . Besides, the average power allocation scheme has been used in the simulations. All shown results were averaged over 5000 independent Monte Carlo trials.

Figure 2 depicts the NMSE of the channel estimation versus the SNR of the legitimate user pilot signal as a function of the quantization bits and Eve’s pilot power. It is noted that NMSE is monotonically increasing for decreasing the quantization bits $b$ . As expected, increasing the power of the active eavesdropper has a negative effect on the MMSE channel estimation. The dashed horizontally lines in Figure 2 denote the asymptotic limits of the NMSE in high power regime. The results illustrate that the coarse low-resolution ADCs result in a nonzero floor on NMSE which cannot be compensated by increasing the pilot power. On the contrary, there are no nonzero floors with implementing perfect ADCs at the transceivers which illustrates that equipping perfect ADCs could achieve an error-free channel estimation with larger pilot power.

Figure 2.

The NMSE versus the pilot power of the legitimate users.

Since the derived secrecy rate expression in Theorem 1 is an appropriate tool for secrecy performance measure, the tightness of expression (23) should be verified via numerical results. Figure 3 shows the analytical and numerical results versus the number of the APs $M$ where the results are achieved by averaging over 5000 channel realizations and randomly locations. It is observed that the analytical results can match exactly with the simulated values which can validate the correctness of the obtained analytical expressions. As can be readily noted, deploying more APs yields better secrecy performance which can be explained that both the channel responses and the diversity gains can be improved with deploying more APs. From Figure 1, another interesting observation is that the system suffers a trivial performance loss by low-resolution ADCs of the APs, but cannot tolerate low-quality ADCs at the users.

Figure 3.

Analytical and simulated results of the achievable secrecy rate versus the number of the APs.

Figure 4 shows the achievable ergodic secrecy rate versus different ADC quantization bits with $p_E=0\mathrm{d}\mathrm{BW}$ . Obviously, we can observe that the achievable ergodic secrecy rate increases with the ADC quantization bits. It can be explained that low-quality ADCs at APs and users bring larger channel estimation error and more signal quantization noise, which can cause a lower SINR (low achievable rate) at the target users. Besides, with the increase in the bits, the secrecy rate increases and converges to a finite rate limit (the dashed horizontally lines in Figure 4) which can be explained that the quantization distortion factor is very close to 1 when $b\ge 5$ . As expected, the considered cell-free massive MIMO system can obtain more secrecy rate with high-resolution ADCs at the users. Hence, low-resolution ADCs can be widely used at APs instead of the users.

Figure 4.

The achievable secrecy rates versus ADC quantization bits.

Figure 5 depicts the achievable secrecy rate as a function of the pilot power ratio between the Eve and the legitimate user, where $b_m$ and $b_u$ denote the quantization bits of low-resolution ADCs at APs and users, $+\infty$ represents perfect high-resolution ADC. Interestingly, the results in Figure 2 further confirm the conclusions in Figure 1. Besides, Figure 5 illustrates that the antenna configuration at APs brings a significant impact on system performance. With the fixed total number of antennas, more APs can provide better quality of service, which is consistent with the results in Hu et al. ²¹ Also, Figure 5 shows that the Eve can overhear information to one target user with a less power budget when the system exploits low-resolution ADCs. Hence, a trade-off between costs and performance is required in practical system design.

Figure 5.

The achievable secrecy rates versus pilot power difference.

In Figure 6, the active attacks detection probability versus the pilot power of the Eve with various parameters are depicted when $p_p=10\mathrm{d}\mathrm{BW}$ and $\alpha =0.5$ , where the results are obtained by 10,000 independent runs. The curves in Figure 6 illustrate that the detection performance improves with the increasing ADCs quantization bits and the antenna number of each AP. Moreover, it can be observed that the proposed RMT detector can detect active attacks at relative low power level. Also, we can note that the detection probability is over $95\mathrm{\%}$ when $p_E-p_p=-5\mathrm{d}\mathrm{B}$ for all parameter choices shown in Figure 6. Specifically, with more antennas at each AP ( $N\ge 10$ ), the detection probability can reach to 1 when the Eve’s pilot power is about $6\mathrm{d}B$ lower than that of the legitimate user.

Figure 6.

Probability of the active attack detection versus the pilot power of the Eve.

Figure 7 shows the detection probability of the proposed RMT-based approach versus the power allocation factor $\alpha$ with fixed total power $p_p=10\mathrm{d}\mathrm{BW}$ and $p_E=5\mathrm{d}\mathrm{BW}$ . At first, the results in Figure 7 indicate that the detection probability increases with the increasing $\alpha$ . This can be explained that the correlation between the two column vectors of matrix $\mathbf{G}$ defined in equation (47) decreases with increasing $\alpha$ which can lead to one relatively larger eigenvalue ${\varsigma }_{2,1}$ . It is propitious for promoting the RMT-based detection probability. The used pilot signal is publicly known and predesigned, while the detection signal is designed with adding a random sequence. Besides, a smart eavesdropper will wiretap and transmit the spoof pilot sequence. Thus, to make the detection procedure confidential and imperceptible, the power allocation factor should be as small as possible. For comparison, Figure 7 shows the detection performance under different $N$ and ADCs quantization bits $b_m$ , which illustrates that the required allocation power for random sequence decreases with increasing $N$ or $b_m$ with the fixed detection probability. These results are valuable and significant for practical detection algorithm design and application.

Figure 7.

Probability of the active attack detection versus the pilot power allocation ratio $\alpha$ .

Conclusion

This article adopted the well-established distortion model (AQNM) to reveal the secure performance of cell-free massive MIMO system with low-resolution ADCs. Uplink MMSE channel estimation has been operated in the presence of active eavesdropping attack which shows that there was a nonzero floor on the channel estimation error brought by the ADC impairments. Based on the imperfect CSI, conjugate beamforming has been performed for downlink transmission. Then, we derived the closed-form expression of the achievable ergodic secrecy rate. To weaken the influence of the active attacks, any effective resisting measure was to detect the presence of the active eavesdropper. This article exploited the RMT-based detection approach to detect the dimension of the signals embedded in noise space. Finally, numerical results have been presented to verify derived results and the effectiveness of the active attack detection scheme.