Channel Reciprocity-based Key Generation (CRKG) exploits reciprocal channel randomness to establish shared secret keys between wireless terminals. This new security technique is expected to complement existing cryptographic techniques for secret key distribution of future wireless networks. In this paper, we present a new attack, reconfigurable intelligent surface (RIS) jamming, and show that an attacker can prevent legitimate users from agreeing on the same key by deploying a malicious RIS to break channel reciprocity. Specifically, we elaborate on three examples to implement the RIS-jamming attack: Using active nonreciprocal circuits, performing time-varying controls, and reducing the signal-to-noise ratio. The attack effect is then studied by formulating the secret key rate with a relationship to the deployment of RIS. To resist such RIS-jamming attacks, we propose a countermeasure that exploits wideband signals for multipath separation. The malicious RIS path is distinguished from all separated channel paths, and thus the countermeasure is referred to as contaminated path removal-based CRKG (CPR-CRKG). We present simulation results, showing that legitimate users under RIS jamming are still able to generate secret keys from the remaining paths. We also experimentally demonstrate the RIS-jamming attack by using commodity Wi-Fi devices in conjunction with a fabricated RIS prototype. In our experiments, we were able to increase the average bit disagreement ratio (BDR) of raw secret keys by 20%. Further, we successfully demonstrate the proposed CPR-CRKG countermeasure to tackle RIS jamming in wideband systems as long as the source of randomness and the RIS propagation paths are separable.

Reconfigurable intelligent surfaces (RIS) are a core component considered in sixth generation (6G) communications. By utilizing an RIS prototype system in the 5 GHz band, this paper provides a comprehensive dataset of channel measurements of various geometric arrangements of antennas and RIS. The dataset and the in-detail documentation is provided on IEEE DataPort and GitHub, respectively. Since only a few datasets with measurements of RIS prototypes are currently available, we try to fill an important gap in current research by providing this systematically measured dataset. Due to the consistent quality of the measurements that is ensured by the measurement chamber, the provided dataset is also well suited to be used as a basis for machine learning concepts.In order to provide a solid baseline for comparing and validating a wide range of applications in different scenarios, the measurements are taken in stationary scenarios. This includes different RIS-to-antenna distances with specular reflection angles, non-specular reflection angles and with the RIS placed on a rotary stage. The selected switching states of the RIS for each scenario are determined by two iterative algorithms, namely a greedy algorithm and a single-element optimization approach, as well as multiple model-based approaches. The evaluation of the data in this paper compares the overall performance for the maximization and minimization of an RIS-assisted communication link, which shows an increase in received power of up to 20 dB compared to a reference plate.

Intelligent reflecting surfaces (IRSs) are a key enabler of various new applications in 6G smart radio environments. This article aims to enhance self-interference (SI) cancellation for breath tracking with commodity WiFi devices by utilizing an IRS prototype system. SI suppression is a crucial requirement for breath tracking with a single antenna site, as the SI severely limits the radio sensing range by shadowing the received signal with its own transmit signal. To this end, we propose to assist SI cancellation by exploiting an IRS to form a suitable cancellation signal in the analog domain. Building upon a 256-element IRS prototype, we present results of breath tracking with IRS-assisted SI cancellation from a practical testbed. We use inexpensive WiFi hardware to extract the channel state information (CSI) in the 5-GHz band and analyze the phase change between a colocated transmitter and receiver with added local oscillator (LO) synchronization. As a result, we can track the breath of a test subject regardless of position in an indoor environment with a room-level range. The presented case study achieves promising performance in capturing the breath frequency and breathing patterns.

The intelligent reflecting surface (IRS) is a promising new paradigm in wireless communications for meeting the growing connectivity demands in next-generation mobile networks. IRS, also known as software-controlled metasurfaces, consist of an array of adjustable radio wave reflectors, enabling smart radio environments, e.g., for enhancing the signal-to-noise ratio (SNR) and spatial diversity of wireless channels. Research on IRS to date has been largely focused on constructive applications.

Reconfigurable intelligent surfaces (RIS) are a key enabler of various new applications in sixth generation (6G) smart radio environments. By utilizing an RIS prototype system, this paper aims to enhance self-interference cancellation (SIC) for in-band full-duplex (FD) communication systems. SI suppression is a crucial requirement for FD communication as the SI severely limits the performance of a node by shadowing the received signal from a distant node with its own transmit signal. To this end, we propose to assist SI cancellation by exploiting an RIS to form a suitable cancellation signal in the analog domain.Building upon a 256-element RIS prototype, we present results of RIS-assisted SIC from a practical testbed. Given an initial analog isolation of 44dB provided by the antenna design, we are able to cancel the leaked signal by an additional 59dB in the narrowband case, resulting in an overall SI suppression of 103dB without additional digital cancellation. The presented case study shows promising performance to build an FD communication system on this foundation.

Wireless radio channels are known to contain information about the surrounding propagation environment, which can be extracted using established wireless sensing methods. Thus, today’s ubiquitous wireless devices are attractive targets for passive eavesdroppers to launch reconnaissance attacks. In particular, by overhearing standard communication signals, eavesdroppers obtain estimations of wireless channels which can give away sensitive information about indoor environments. For instance, by applying simple statistical methods, adversaries can infer human motion from wireless channel observations, allowing to remotely monitor premises of victims. In this work, building on the advent of intelligent reflecting surfaces (IRSs), we propose IRShield as a novel countermeasure against adversarial wireless sensing. IRShield is designed as a plug-and-play privacy-preserving extension to existing wireless networks. At the core of IRShield, we design an IRS configuration algorithm to obfuscate wireless channels. We validate the effectiveness with extensive experimental evaluations. In a state-of-the-art human motion detection attack using off-the-shelf Wi-Fi devices, IRShield lowered detection rates to 5% or less.

Physical layer key generation is a promising candidate for cryptographic key establishment between two wireless communication parties. It offers information-theoretic security and is an attractive alternative to public-key techniques. Here, the inherent randomness of wireless radio channels is used as a shared entropy source to generate cryptographic key material. However, practical implementations often suffer from static channel conditions which exhibit a limited amount of randomness. In the past, considerable research efforts have been made to address this fundamental limitation. However, current solutions are not generic or require dedicated hardware extensions such as reconfigurable antennas. In this paper, we propose a novel wireless key generation architecture based on randomized channel responses from an intelligent reflecting surface (IRS). Due to its passive nature, a cooperative IRS is well-suited to provide randomness for conventional resource-constrained radios. We conduct the first practical studies to successfully demonstrate IRS-based physical-layer key generation with an OFDM system. In a static environment, using a single subcarrier only, our IRS-assisted prototype system achieves a key generation rate (KGR) of 97.39 bps with 6.5% key disagreement rate (KDR) after quantization, while passing standard randomness tests.