Search

Reconfigurable Intelligent Surfaces (RIS) have been identified as a potential ingredient to enhance the performance of contemporary wireless communication and sensing systems. Yet, most of the existing devices are either costly or not available for reproduction. To close this gap, a Reconfigurable Intelligent Surface for the frequency range of 5 GHz WiFi is presented in this work. We describe the designed unit cell, which is optimized for the full frequency range of 5.15 to 5.875 GHz. Standard FR4 substrate is used for cost optimization. The measured reflection coefficient of a rectangular RIS prototype with 256 elements is used for RF performance evaluation. Fabrication data and firmware source code are made open source, which makes RIS more available in real measurement setups.

Channel Reciprocity-based Key Generation (CRKG) exploits reciprocal channel randomness to establish shared secret keys between wireless terminals. This new security technique is expected to complement existing cryptographic techniques for secret key distribution of future wireless networks. In this paper, we present a new attack, reconfigurable intelligent surface (RIS) jamming, and show that an attacker can prevent legitimate users from agreeing on the same key by deploying a malicious RIS to break channel reciprocity. Specifically, we elaborate on three examples to implement the RIS jamming attack: Using active nonreciprocal circuits, performing time-varying controls, and reducing the signal-to-noise ratio. The attack effect is then studied by formulating the secret key rate with a relationship to the deployment of RIS. To resist such RIS jamming attacks, we propose a countermeasure that exploits wideband signals for multipath separation. The malicious RIS path is distinguished from all separated channel paths, and thus the countermeasure is referred to as contaminated path removal-based CRKG(CRP-CRKG). We present simulation results, showing that legitimate users under RIS jamming are still able to generate secret keys from the remaining paths. We also experimentally demonstrate the RIS jamming attack by using commodity Wi-Fi devices in conjunction with a fabricated RIS prototype. In our experiments, we were able to increase the average bit disagreement ratio (BDR) of raw secret keys by 20%. Further, we successfully demonstrate the proposed CRP-CRKG countermeasure to tackle RIS jamming in wideband systems as long as the source of randomness and the RIS propagation paths are separable., Comment: 15 pages, 14 figures

Intelligent reflecting surfaces (IRS) are a key enabler of various new applications in 6G smart radio environments. By utilizing an IRS prototype system, this paper aims to enhance self-interference (SI) cancellation for breath tracking with commodity WiFi devices. SI suppression is a crucial requirement for breath tracking with a single antenna site as the SI severely limits the radio sensing range by shadowing the received signal with its own transmit signal. To this end, we propose to assist SI cancellation by exploiting an IRS to form a suitable cancellation signal in the analog domain. Building upon a 256-element IRS prototype, we present results of breath tracking with IRS-assisted SI cancellation from a practical testbed. We use inexpensive WiFi hardware to extract the Channel State Information (CSI) in the 5~GHz band and analyze the phase change between a colocated transmitter and receiver with added local oscillator (LO) synchronization. We are able to track the breath of a test person regardless of the position in an indoor environment in a room-level range. The presented case study shows promising performance in both capturing the breath frequency as well as the breathing patterns., Comment: Submitted to IEEE Internet of Things Journal

Wireless radio channels are known to contain information about the surrounding propagation environment, which can be extracted using established wireless sensing methods. Thus, today's ubiquitous wireless devices are attractive targets for passive eavesdroppers to launch reconnaissance attacks. In particular, by overhearing standard communication signals, eavesdroppers obtain estimations of wireless channels which can give away sensitive information about indoor environments. For instance, by applying simple statistical methods, adversaries can infer human motion from wireless channel observations, allowing to remotely monitor premises of victims. In this work, building on the advent of intelligent reflecting surfaces (IRSs), we propose IRShield as a novel countermeasure against adversarial wireless sensing. IRShield is designed as a plug-and-play privacy-preserving extension to existing wireless networks. At the core of IRShield, we design an IRS configuration algorithm to obfuscate wireless channels. We validate the effectiveness with extensive experimental evaluations. In a state-of-the-art human motion detection attack using off-the-shelf Wi-Fi devices, IRShield lowered detection rates to 5% or less.

The intelligent reflecting surface (IRS) is a promising new paradigm in wireless communications for meeting the growing connectivity demands in next-generation mobile networks. IRS, also known as software-controlled metasurfaces, consist of an array of adjustable radio wave reflectors, enabling smart radio environments, e.g., for enhancing the signal-to-noise ratio (SNR) and spatial diversity of wireless channels. Research on IRS to date has been largely focused on constructive applications. In this work, we demonstrate for the first time that the IRS provides a practical low-cost toolkit for attackers to easily perform complex signal manipulation attacks on the physical layer in real time. We introduce the environment reconfiguration attack (ERA) as a novel class of jamming attacks in wireless radio networks. Here, an adversary leverages the IRS to rapidly vary the electromagnetic propagation environment to disturb legitimate receivers. The IRS gives the adversary a key advantage over traditional jamming: It no longer has to actively emit jamming signals, instead the IRS reflects existing legitimate signals. In addition, the adversary doesn't need any knowledge about the legitimate channel. We thoroughly investigate the ERA in wireless systems based on the widely employed orthogonal frequency division multiplexing (OFDM) modulation. We present insights into the attack through analytical analysis, simulations, as well as experiments. Our results show that the ERA allows to severely degrade the available data rates even with reasonably small IRS sizes. Finally, we implement an attacker setup and demonstrate a practical ERA to slow down an entire Wi-Fi network.

Reconfigurable intelligent surfaces (RIS) are a key enabler of various new applications in 6G smart radio environments. By utilizing an RIS prototype system, this paper aims to enhance self-interference (SI) cancellation for in-band full-duplex (FD) communication systems. SI suppression is a crucial requirement for FD communication as the SI severely limits the performance of a node by shadowing the received signal from a distant node with its own transmit signal. To this end, we propose to assist SI cancellation by exploiting an RIS to form a suitable cancellation signal in the analog domain. Building upon a 256-element RIS prototype, we present results of RIS-assisted SI cancellation from a practical testbed. Given an initial analog isolation of 44 dB provided by the antenna design, we are able to cancel the leaked signal by an additional 59 dB in the narrowband case, resulting in an overall SI suppression of 103 dB without additional digital cancellation. The presented case study shows promising performance to build an FD communication system on this foundation., Comment: 6 pages, 9 figures, Accepted for publication in IEEE International Conference on Communications (ICC) 2022

Physical layer key generation is a promising candidate for cryptographic key establishment between two wireless communication parties. It offers information-theoretic security and is an attractive alternative to public-key techniques. Here, the inherent randomness of wireless radio channels is used as a shared entropy source to generate cryptographic key material. However, practical implementations often suffer from static channel conditions which exhibit a limited amount of randomness. In the past, considerable research efforts have been made to address this fundamental limitation. However, current solutions are not generic or require dedicated hardware extensions such as reconfigurable antennas. In this paper, we propose a novel wireless key generation architecture based on randomized channel responses from an intelligent reflecting surface (IRS). Due to its passive nature, a cooperative IRS is well-suited to provide randomness for conventional resource-constrained radios. We conduct the first practical studies to successfully demonstrate IRS-based physical-layer key generation with an OFDM system. In a static environment, using a single subcarrier only, our IRS-assisted prototype system achieves a key generation rate (KGR) of 97.39 bps with 6.5% key disagreement rate (KDR) after quantization, while passing standard randomness tests.