STAR-RIS-assisted key generation method in quasi-static environment

Abstract

In this paper, we introduce a new method to solve the low-entropy problem in a quasi-static environment. We utilize a simultaneous transmission and reflection reconfigurable intelligent surface (STAR-RIS) that transmits and reflects incoming signals to users located on different sides of the surface. Specifically, we design the flow of multi-user channel probing when STAR-RIS is assisted, analyze and derive the analytical expression of the secret key capacity (SKC) of STAR-RIS-assisted system from the perspective of information theory, and finally analyze how to maximize the SKC and sum of all users under three different working protocols of STAR-RIS. The simulation results show that: (1) STAR-RIS can achieve better SKC performance than the conventional reflection/transmission RIS; and (2) the SKC is determined by the number of STAR-RIS elements, correlation coefficient, pilot length and RIS-reflected channel quality, and the time switching protocol can obtain higher SKC than the energy splitting protocol and mode switching protocol.

1 Introduction

Physical layer key generation can achieve information-theoretical security by using the characteristics of the wireless channel, such as reciprocity and randomness of the wireless channel [1] [2]. A legitimate user can safely generate a pair of shared keys after four main steps: channel probing, quantization, information reconciliation and privacy amplification [3]. Currently, the foundational theory of physical layer key generation has achieved a relatively comprehensive status. However, practical implementation faces certain challenges, particularly in terms of security and performance constraints imposed by the natural environment [4]. In other words, key generation performance depends on the channel fluctuations caused by the movement of the surrounding environment.

However, in quasi-static environments, the key generation rate (KGR) is greatly limited due to the low entropy that can be extracted from the channel [5]. To overcome the constraints of the natural environment, reconfigurable intelligent surface (RIS) is usually used in quasi-static environments to assist communication [6]. RIS can manipulate electromagnetic waves through its numerous reflecting elements [7]. When the signal is illuminated on the reflecting elements, the elements can efficiently modify the amplitude, phase and frequency of electromagnetic waves, thus realizing the real-time reconfiguration of the electromagnetic environment and the dynamic programming of the wireless channel [8]. Since RIS can be viewed as a passively reflected planar array, this intelligent reconstruction of the electromagnetic space by RIS does not consume additional energy [9]. The low hardware cost and energy consumption of RIS makes it an ideal assistant in the formation of fluctuating channels between legitimate users, therefore providing artificial randomness for the generation of keys. Jin et al. minimized transmit power while guaranteeing KGR [10]. Jiao et al. proposed a reconfiguration strategy to improve the KGR in slow-fading scenarios [11]. Yang maximized the achievable rate by jointly optimizing the transmit power allocation and the RIS passive array reflection coefficients [12]. Tan et al. studied joint optimization about beam-forming, RIS phase shift and energy harvesting of IoT devices for maximizing EE of the multiple-input single-input downlink system with multiple IoT devices and an energy harvesting device [13]. Lu et al. obtained performance improvement through the joint design of precoding and phase shift matrix [14]. Ji et al. explored the lower limit of secret key capacity (SKC) for RIS-assisted physical layer key generation when there are multiple non-collusion eavesdroppers, and the derived analytical expression accurately describes the influence of channel correlation among legitimate users, eavesdroppers and RIS on key capacity [15]. In Ref. [16], a four-step channel probing protocol was designed for RIS-assisted key generation by utilizing the randomness of direct and reflected channels, and lower and upper bounds of key capacity expressions were derived in the presence of eavesdrops. Li et al. derived the expression of key capacity and optimizes the configuration of RIS to maximize the total key capacity on independent fading channels and related fading channels in the presence of multiple users [17].

Although RIS-assisted physical layer key generation technology has made a great success, RIS can only reflect or transmit the incident signal, which reduces the flexibility of the system [18]. In order to obtain the channel environment for each device in the system after RIS reconstruction in channel probing, it is necessary for all devices to be located on the same side of RIS, or to extend the coverage by deploying multiple RIS [19]. Xiao investigated the physical layer security (PLS) of a simultaneously transmitting and reflecting reconfigurable intelligent surface (STAR-RIS)-aided rate-splitting multiple access (RSMA) systems in the presence of an eavesdropper [20]. Liu put forward the simultaneous transmission and reflection reconfigurable intelligent surface (STAR-RIS) which can not only reflect the incident signal but also transmit the incident signal to the other side through the new RIS, thereby improving the coverage of the RIS to create a controllable channel environment [21]. This innovative approach is further supported by the findings presented in Ref. [22], which proves that STAR-RIS elements with scalar surface impedance exhibit the same transfer and reflection coefficients on both sides, demonstrating reciprocity similar to traditional RIS. However, at present, the relevant analysis and solution of STAR-RIS in physical layer key generation have not been studied, so we will focus on the feasibility, technical ideas, implementation ways and implementation effects of STAR-RIS in assisting the physical layer key generation.

In this paper, we derive the key capacity expressions of STAR-RIS under three different protocols and analyze the optimization model for key capacity within the system. STAR-RIS-assisted solutions aim to maximize the key capacity of the system by addressing the diverse needs of different users. Through simulation tests, we demonstrate that STAR-RIS can provide more powerful, rich and fine-grained auxiliary capabilities for physical layer key generation.

Symbols: Lowercase letters, bold lowercase letters and bold uppercase letters represent scalars, vectors and matrices, respectively. $\mathcal{C}\mathcal{N}\left( \mu ,\sigma ^2\right)$represents the circularly symmetric complex Gaussian distribution (CSCG) with mean $\mu$ and standard deviation $\sigma$. $\left( \cdot \right) ^{-1}$, $\bar{\left( \cdot \right) }$, $\left( \cdot \right) ^T$ and $\left( \cdot \right) ^H$ represent the inverse transformation, conjugate, transpose and conjugate transpose operations, respectively.

2 Methods

In this section, we first propose our system model. Meanwhile, we analyze the upper and lower bounds of the key capacity and propose an optimization scheme.

2.1 STAR-RIS-assisted system model

In this section, the system model is presented by considering the STAR-RIS-assisted key generation under the attack of multiple eavesdroppers.

Fig. 1

STAR-RIS-assisted key generation system model

As shown in Fig. 1, a STAR-RIS-assisted multi-user key generation system is constructed in this chapter, which consists of a wireless base station (Alice), a STAR-RIS, K user terminals (UT)s and K eavesdroppers (Eves). All participants, including Alice, UTs and Eves, are equipped with a single antenna, p legal user UTs are located in the reflection space of STAR-RIS, q legal user UTs are located in the transmission space of STAR-RIS, and $K=p+q$. Alice’s task is to generate the key $\kappa =\left\{ \kappa _1,\kappa _2,\cdots ,\kappa _K\right\}$ based on the wireless channel between the base station and UTs. The multi-user key generation in this chapter is different from the group key generation because the key generated between Alice and each UT is not the same.

The communication between Alice and UTs is based on time-division duplex (TDD) mode, and Ref. [22] states that when the surface element impedance of STAR-RIS can be characterized by scalars, STAR-RIS can exert the same effect on signals incident from different surfaces (that is, upstream and downstream), thus ensuring the reciprocity of upstream and downstream cascaded channels in a single-channel probing. As shown in Fig. 2, signals $x_a$ and $x_b$ are incoming signals from space A and space B, respectively; $T_m^{A,B}$ and $T_m^{B,A}$ are the transmission coefficients of the mth element when the signal enters space B from space A and space A from space B; and $R_m^A$ and $R_m^B$ are the reflection coefficients of the mth element on side A and side B of space, respectively. In this case, $T_m^{A,B}=T_m^{B,A}$ and $R_m^A=R_m^B$.

Fig. 2

Model when the signal is incident from both sides of the STAR-RIS

The Eves do not initiate active attacks, and Eves do not exchange information with each other. Each eavesdropper Eve eavesdrops on the keys in the collective $\kappa$ based on her own observations of the channel information and all the information exchanged over the common channel. In addition, UTs in the system are treated as curious users, but each UT does not intend to eavesdrop on other users’ keys, and they do not collude with other UTs or Eves.

In Fig. 1, STAR-RIS operates under mode switching (MS) protocol, and the reflection coefficient matrix and transmission coefficient matrix of STAR-RIS can be expressed as

$$\begin{aligned} \Theta _r^{\textrm{MS}} = \text {diag}\left( \sqrt{\beta _1^r}e^{j\theta _1^r},\sqrt{\beta _2^r}e^{j\theta _2^r},\ldots ,\sqrt{\beta _M^r}e^{j\theta _M^r}\right) \end{aligned}$$

(1)

and

$$\begin{aligned} \Theta _t^{\textrm{MS}} = \text {diag}\left( \sqrt{\beta _1^t}e^{j\theta _1^t},\sqrt{\beta _2^t}e^{j\theta _2^t},\ldots ,\sqrt{\beta _M^t}e^{j\theta _M^t}\right) \end{aligned}$$

(2)

where $\beta _m^r,\beta _m^t\in \left\{ 0,1\right\}$, $\beta _m^r+\beta _m^t=1$ and $\theta _m^r,\theta _m^t\in \left[ 0,2\pi \right)$, $\forall m\ \in M$. The mode switching protocol divides the elements to reflect and transmit signals. In the optimization scheme, we also consider the other two operating protocols of STAR-RIS, that is, energy splitting protocol and time switching protocol, as shown in Fig. 3.

Fig. 3

Three working protocols of STAR-RIS

During the downlink channel probing, Alice broadcasts the pilot signal $x_{dl}$, while in the upstream channel probing, user UTs simultaneously send the pilot signal $x_{ul,k}\in \mathcal {C}^{1\times K},k\in \{1,2,\cdots ,K\}$ to Alice. For Alice to distinguish each user, each user’s pilot signal satisfies the orthogonal condition:

$$\begin{aligned} {{x}_{ul,k}}{{\left( {{x}_{ul,{{k}^{\prime }}}} \right) }^{H}}=\left\{ \begin{matrix} 1,~k={k}' \\ 0,~k\ne {k}' \\ \end{matrix} \right. . \end{aligned}$$

(3)

The signals received by users k and Alice can be expressed as

$$\begin{aligned} y_k^{dl}&=\left( h_{ak}+\sum _{m=1}^{M}{h_{rk}^m\sqrt{\beta _m}}e^{j\theta _m}h_{ar}^m\right) x_{dl}+n_{dl,k}^\prime , \end{aligned}$$

(4)

$$\begin{aligned} y_{ul}&=\sum _{k=1}^{K}{\left( h_{ka}+\sum _{m=1}^{M}{h_{ra}^m\sqrt{\beta _m}}e^{j\theta _m}h_{kr}^m\right) x_{ul,k}}+n_{ul}, \end{aligned}$$

(5)

where $n_{dl,k}^\prime$ is the additive white Gaussian noise, whose mean value is 0 and variance is $\sigma ^2;\ h_{rk}=g_{rk}$ if the user k is in the reflection region and $h_{rk}=s_{rk}$ if the user k is in the transport region. $h_{ak}$ is a direct channel between Alice and the user k; ${h}_{ar}\in \mathcal {C}^{(M\times 1)}$ is a channel between Alice and STAR-RIS; ${g}_{rk}\in \mathcal {C}^{(M\times 1)}$ is a channel between STAR-RIS and the user k in the reflection area; and ${s}_{rk}\in \mathcal {C}^{(M\times 1)}$ is a channel between STAR-RIS and the user k in the transmission area. We consider a narrow-band quasi-static block-fading channel. Within a block, $h_{ak}$, ${h}_{ar}$, ${g}_{rk}$ and ${s}_{rk}$ do not change. The system obtains randomness by changing the phase shift matrix.

Then, the user k and Alice estimate the combined channel by least-squares method:

$$\begin{aligned} h_k^{dl}&=y_k^{dl}x_{dl}^*=h_{ak}+\sum _{m=1}^{M}{h_{rk}^m\sqrt{\beta _m}}e^{j\theta _m}h_{ar}^m+n_{dl,k}, \end{aligned}$$

(6)

$$\begin{aligned} h_k^{ul}&=h_{ka}+\sum _{m=1}^{M}{h_{ra}^m\sqrt{\beta _m}}e^{j\theta _m}h_{kr}^m+n_{ul,k}. \end{aligned}$$

(7)

The link between Alice-STAR-RIS-UT can be defined as $r_{uv}=\left[ r_{uv}^1,\ldots ,r_{uv}^M\right]$, where $\{u,v\}\ =\ \{a,k\}$. Specifically, if the user k is in the reflection region, then $r_{uv}^m=g_{rk}^mh_{ur}^m$, where $r_{uv}^m$ stands for mth sub-reflection channel. If the user k is in the transport zone, then $r_{uv}^m=s_{rk}^mh_{ur}^m$, where $r_{uv}^m$ represents the mth sub-transport channel. Therefore, the downward CSI derived from formula (4) can be rewritten as

$$\begin{aligned} h_k^{dl}=h_{ak}+\Theta ^{MS}r_{ak}^T+n_{dl,k}. \end{aligned}$$

(8)

Similarly, the ascending CSI derived from formula (5) can be rewritten as

$$\begin{aligned} h_k^{ul}=h_{ka}+\Theta ^{MS}r_{ka}^T+n_{ul,k}. \end{aligned}$$

(9)

After Q rounds of pilot exchange between Alice and UTs, the acquired combined channel vector can be expressed as

$$\begin{aligned} \widetilde{h}_D = \left[ \widetilde{h}_D\left( 1\right) ,\widetilde{h}_D\left( 2\right) ,\cdots ,\widetilde{h}_D\left( Q\right) \right] , D\in \{A,k,E\}. \end{aligned}$$

(10)

2.2 Secret key capacity and system optimization

The secret key capacity can be defined as the maximum achievable rate at which Alice and a single user can successfully establish a key through a sufficient number of channel probes while ensuring that the information obtained by Eve remains sufficiently limited and secure [23]. When the distance between Eve and Alice and a user exceeds half wavelength [24], Eve cannot obtain information about the legitimate channel from its detection value of the legitimate channel, and the secret key capacity at this time is the mutual information of the channel sampling value between Alice and the user $\ I\left( \widetilde{h}_A;\widetilde{h}_k\right)$. When Eve is less than half a wavelength away from a user, Eve may obtain information about the legitimate channel from its detection value of the legitimate channel. In Ref. [25], the secret key capacity is defined as an interval value with upper and lower bounds:

$$\begin{aligned} C_{sk}&\ge I\left( \widetilde{\textbf{h}}_A;\widetilde{\textbf{h}}_k\right) -\min \left[ I\left( \widetilde{\textbf{h}}_A;\widetilde{\textbf{h}}_E\right) ,I\left( \widetilde{\textbf{h}}_k;\widetilde{\textbf{h}}_E\right) \right] , \end{aligned}$$

(11)

$$\begin{aligned} C_{sk}&\le \textrm{min}\left[ I\left( \widetilde{\textbf{h}}_A;\widetilde{\textbf{h}}_k\right) ,I\left( \widetilde{\textbf{h}}_A;\widetilde{\textbf{h}}_k\big |\widetilde{\textbf{h}}_E\right) \right] . \end{aligned}$$

(12)

Take Alice as an example, the channel measurement $h_k^{ul}$ follows the distribution $h_k^{ul}\sim \mathcal{C}\mathcal{N}\left( 0,\sigma _{h_k^{ul}}^2\right)$, where $\sigma _{h_k^{ul}}^2$ can be expressed as $\sigma _{h_k^{ul}}^2=\sigma _{h_{ka}}^2+\sum _{m=1}^{M}{\beta _m\sigma _{r_{ka}^m}^2}$. Because the channels are reciprocal in coherence time, that is, $h_{ak} = h_{ka}, r_{ak}^m=r_{ka}^m, m=1,...,M$. Therefore, it can be obtained that $\sigma _{h_k^{dl}}^2=\sigma _{h_k^{ul}}^2$, so the channel estimation variance of legitimate users is expressed as $\sigma _{h_{au}}^2$, that is, $\sigma _{h_k^{dl}}^2=\sigma _{h_k^{ul}}^2=\sigma _{h_{au}}^2$. Since noise is usually independent and uniformly distributed, the estimated noise variance for each user is set to $\sigma _z^2$. Therefore, the mutual information between Alice and the user can be expressed as

$$\begin{aligned} I\left( h_k^{dl};h_k^{ul}\right) =\log _2{\left( 1+\frac{\left( \sigma _{h_{ak}}^2+\sum _{m=1}^{M}{\beta _m\sigma _{r_{ak}^m}^2}\right) ^2/\sigma _z^4}{1+2\left( \sigma _{h_{ak}}^2+\sum _{m=1}^{M}{\beta _m\sigma _{r_{ak}^m}^2}\right) /\sigma _z^2}\right) }. \end{aligned}$$

(13)

When each Eve is located less than half a wavelength away from base station Alice or user UT, the lower bound of the secret key capacity can be expressed as

$$\begin{aligned} C_{LB}\ge \log _2{\left( 1+\frac{\sigma _{h_{au}}^4/\sigma _z^4}{1+2\sigma _{h_{au}}^2/\sigma _z^2}\right) }-\log _2{\left( 1+\frac{\left| \rho \right| ^2\sigma _{h_{au}}^4/\sigma _z^4}{1+\left( 1-\left| \rho \right| ^2\right) \sigma _{h_{au}}^4/\sigma _z^4+2\sigma _{h_{au}}^2/\sigma _z^2}\right) }, \end{aligned}$$

(14)

The upper bound of the secret key capacity can be expressed as

$$\begin{aligned} C_{UB}\le \log _2{\left( \frac{\left[ \left( 1-\left| \rho \right| ^2\right) \sigma _{h_{au}}^4/\sigma _z^4+2\sigma _{h_{au}}^2/\sigma _z^2+1\right] ^2}{\left( 1+\sigma _{h_{au}}^2/\sigma _z^2\right) \left[ 2\left( 1-\left| \rho \right| ^2\right) \sigma _{h_{au}}^4/\sigma _z^4+3\sigma _{h_{au}}^2/\sigma _z^2+1\right] }\right) } \end{aligned}$$

(15)

As shown in the analytical expression of the secret key capacity, it is affected by the correlation coefficients between the legitimate and eavesdropping channels, the channel quality and the estimation noise.

3 Secret key capacity optimization under different protocols

In this section, the secret key capacity is analyzed under mode switching (MS), time switching (TS) and energy switching (ES) protocols. Besides, three optimization problems are formulated to improve the secret key rate of the STAR-RIS-assisted system.

3.1 Secret key capacity optimization under MS protocol

In the MS protocol that operates STAR-RIS, in addition to the reflection and transmission coefficient matrix as expressed in Sect. 2, the reflection and transmission coefficient matrix under the MS protocol can also be expressed as

$$\begin{aligned} \Theta _r^{\textrm{MS}} = \text {diag}\left( e^{j\theta _1^r},e^{j\theta _2^r},\ldots ,e^{j\theta _{M_r}^r}\right) \end{aligned}$$

(16)

and

$$\begin{aligned} \Theta _t^{\textrm{MS}} = \text {diag}\left( e^{j\theta _{M_r+1}^t},e^{j\theta _{M_r+2}^t},\ldots ,e^{j\theta _M^t}\right) \end{aligned}$$

(17)

In this representation, the reflection coefficient matrix contains only $M_r$ elements that work in the reflection mode, and these elements are numbered with $1,2,\ldots ,M_r$; the transmission coefficient matrix contains only $M-M_r=M_t$ elements working in the transmission mode, and these elements are numbered with $M_r+1,M_r+2,\ldots ,M$. Therefore, when the eavesdropping channel is not related to the legitimate channel, the secret key capacity of Alice and the user in the reflected region can be expressed as

$$\begin{aligned} I_r\left( h_k^{dl};h_k^{ul}\right) =\log _2{\left( 1+\frac{\left( \sigma _{h_{ak}}^2+\sum _{m=1}^{M_r}\sigma _{r_{ak}^m}^2\right) ^2/\sigma _z^4}{1+2\left( \sigma _{h_{ak}}^2+\sum _{m=1}^{M_r}\sigma _{r_{ak}^m}^2\right) /\sigma _z^2}\right) }. \end{aligned}$$

(18)

The secret key capacity between Alice and the user in the transport area can be expressed as

$$\begin{aligned} I_t\left( h_k^{dl};h_k^{ul}\right) =\log _2{\left( 1+\frac{\left( \sigma _{h_{ak}}^2+\sum _{m=M_r+1}^{M}\sigma _{r_{ak}^m}^2\right) ^2/\sigma _z^4}{1+2\left( \sigma _{h_{ak}}^2+\sum _{m=M_r+1}^{M}\sigma _{r_{ak}^m}^2\right) /\sigma _z^2}\right) }. \end{aligned}$$

(19)

It can be seen from Eq. (10), Eq. (13) and Eq. (14) that the secret key capacity between Alice and the user can be changed by adjusting the coefficient $\beta _m$ of STAR-RIS element, or it can be concluded that the key capacity between Alice and the user will be affected by the number of reflection mode elements $M_r$ and the number of transmission mode elements $M_t$. In this section, it is necessary to effectively adjust the coefficient $\beta _m$ of STAR-RIS elements to change the number of reflection mode elements $M_r$ and the number of transmission mode elements $M_t$ to maximize the secret key capacity in the entire system. Thus, the original problem can be further transformed into

$$\begin{aligned} OP_{1-1}:\max {C}_{sum}&=\sum _{k=1}^{p}{I_r\left( h_k^{dl};h_k^{ul}\right) }+\sum _{k=1}^{q}{I_t\left( h_k^{dl};h_k^{ul}\right) } \nonumber \\ \text {s.t.}&~{M}_r+M_t\le \ M. \end{aligned}$$

(20)

In addition, assigning an attribute value $\eta _k$ [26] to each user, where $\sum _{k=1}^{K}\eta _k=1$, the weighted secret key capacity sum in the whole system can be obtained by

$$\begin{aligned} OP_{1-2}:\max {C}_{sum}&=\sum _{k=1}^{p}\eta _k{I_r\left( h_k^{dl};h_k^{ul}\right) }+\sum _{k=1}^{q}\eta _k{I_t\left( h_k^{dl};h_k^{ul}\right) } \nonumber \\ \text {s.t.}&~{M}_r+M_t\le \ M. \end{aligned}$$

(21)

When the eavesdropping channel is related to the legitimate channel, the lower bound of the secret key capacity $C_{LB}$ can be optimized to improve the “short board” of the overall secret key capacity of the system.

$$\begin{aligned} {OP}_{1-3}:\max {C}_{sum}&=\sum _{k=1}^{p}C_{LB,k}^r+\sum _{k=1}^{q}C_{LB,k}^t \nonumber \\ \text {s.t.}&~{ M}_r+M_t\le \ M. \end{aligned}$$

(22)

where $C_{LB,k}^r$ represents the lower bound of the secret key capacity between Alice and the user k located in the reflection region and $C_{LB,k}^t$ represents the lower bound of the secret key capacity between Alice and the user k located in the transport region.

3.2 Secret key capacity optimization under ES protocol

Under the ES protocol, all elements work in both reflection and transmission modes, and the reflection and transmission coefficient matrix follows the definition in Sect. 2. According to Eq. (10), the secret key capacity of Alice and the user in the reflection region can be refined as

$$\begin{aligned} I_r\left( h_k^{dl};h_k^{ul}\right) =\log _2{\left( 1+\frac{\left( \sigma _{h_{ak}}^2+\sum _{m=1}^{M}{\beta _m^r\sigma _{r_{ak}^m}^2}\right) ^2/\sigma _z^4}{1+2\left( \sigma _{h_{ak}}^2+\sum _{m=1}^{M}{\beta _m^r\sigma _{r_{ak}^m}^2}\right) /\sigma _z^2}\right) }. \end{aligned}$$

(23)

The secret key capacity between Alice and the user in the transport area can be defined as

$$\begin{aligned} I_t\left( h_k^{dl};h_k^{ul}\right) =\log _2{\left( 1+\frac{\left( \sigma _{h_{ak}}^2+\sum _{m=1}^{M}{\beta _m^t\sigma _{r_{ak}^m}^2}\right) ^2/\sigma _z^4}{1+2\left( \sigma _{h_{ak}}^2+\sum _{m=1}^{M}{\beta _m^t\sigma _{r_{ak}^m}^2}\right) /\sigma _z^2}\right) }. \end{aligned}$$

(24)

When STAR-RIS is operating under the ES protocol, the reflection and transmission ratio of each element of STAR-RIS to the incident signal $\beta _m^r:\beta _m^t$ can be adjusted to maximize the sum of the secret key capacity in the whole system. The optimization problem of the sum of the secret key capacity in the whole system can be expressed as

$$\begin{aligned} OP_{2-1}: \max {C}_{sum}&=\sum _{k=1}^{p}{I_r\left( h_k^{dl};h_k^{ul}\right) }+\sum _{k=1}^{q}{I_t\left( h_k^{dl};h_k^{ul}\right) } \nonumber \\ \text {s.t.}&~\beta _m^r,\beta _m^t\in [0,1],\beta _m^r+\beta _m^t=1. \end{aligned}$$

(25)

3.3 Secret key capacity optimization under TS protocol

Fig. 4

Channel probing slot allocation for STAR-RIS auxiliary system under TS protocol

Under the TS protocol, a coherent time $T_c$ is divided into $L=T_c/T_s$ time slots, in which $L_r$ time slots STAR-RIS work in reflection mode and $L_t$ time slots STAR-RIS work in transmission mode: $L_r+L_t=L$. The time slot division in channel probing is shown in Fig. 4. STAR-RIS operates in $L_r$ time slots in reflection mode, and Alice can complete $b_r=L_r/2$ channel estimation with users in the reflected region (one time slot for downlink detection and one time slot for uplink detection). Similarly, Alice can perform $b_t=L_t/2$ channel estimation with users in the transport area. According to Eq. (10), the secret key capacity of Alice and the user in the reflection region and the transmission region can be expressed as

$$\begin{aligned} I(h_k^{dl};h_k^{ul})&=I_r(h_k^{dl};h_k^{ul})=I_t(h_k^{dl};h_k^{ul}) \nonumber \\&=\log _2\left( 1+\frac{(\sigma _{h_{ak}}^2+\sum _{m=1}^{M}\ \sigma _{r_{ak}}^2)^2/\sigma _z^4}{1+2(\sigma _{h_{ak}}^2+\sum _{m=1}^{M} \sigma _{r_{ak}}^2)/\sigma _z^2}\right) . \end{aligned}$$

(26)

When STAR-RIS is working under the TS protocol, the ratio of time slots between STAR-RIS working in the reflection mode and the transmission mode $L_r: L_t$ can be adjusted to maximize the sum of the secret key capacity in the whole system. The optimization problem of the sum of the secret key capacity in the whole system can be expressed as follows:

$$\begin{aligned} OP_{3-1}:\max {C}_{sum}&=\frac{1}{T_c}\left( b_r\sum _{k=1}^{p}{I_r\left( h_k^{dl};h_k^{ul}\right) } +\sum _{k=1}^{q}{b_t\left( z_k^{dl};z_k^{ul}\right) }\right) \nonumber \\ \text {s.t.}~~&b_r+b_t=\frac{T_c}{2T_s}. \end{aligned}$$

(27)

4 Results and discussion

4.1 Secret key capacity

This section presents some numerical results for secret key capacity and verifies the derived numerical results through Monte Carlo simulation experiments [27]. In the simulation experiment, we use the ITE toolbox [28] to calculate mutual information. For all the images in this section, the dotted line represents the numerical result and the solid line represents the simulation result. The channel variance is $\sigma _h^2=\beta _0\left( d/d_0\right) ^{-\zeta }$, where $\beta _0=30$ dB is the path loss at $d_0=1$ m, d is the link distance and $\zeta$ is the path loss coefficient (usually set to 4 in quasi-static environments). The transmitting power of the pilot signal is 20 dBm, the wavelength is 0.3 m, and the noise power is $-96$ dBm. There are 8 types of phase changes applied by STAR-RIS to the signal. This section also selected another two scenarios as the benchmark scheme, namely the RIS-assisted system [29] and the system [30] without RIS, as shown in Fig. 5. The RIS-assisted system is to increase the key capacity by RIS which can only reflect or transmit the incident signal. The primitive system does not use any auxiliary tools to generate keys.

Fig. 5

Three kinds of physical layer key generation system models

Fig. 6

Comparison of SKC variation with SNR in three systems

Figure 6 shows the secret key capacity of the three physical layer key generation systems under different signal-to-noise ratios (SNRs). In Fig. 6, a user $k_R$ is set in the reflection region with an attribute value $\eta _{k_R}=0.3$ and a user $k_T$ in the transmission region with an attribute value $\eta _{k_T}=0.7$. In MS protocol, the secret key capacity of the system is $\ C_{\textrm{sum}}=\eta _{k_R}I_r\left( h_{k_R}^{dl};h_{k_R}^{ul}\right) +\eta _{k_T}I_t\left( h_{k_T}^{dl};h_{k_T}^{ul}\right)$. The number of elements of both STAR-RIS and RIS M is 64. STAR-RIS works under the MS protocol. When a user is located in the reflection blind area of RIS (such as the scene in Fig. 5-b), then the user in the blind area cannot get the artificial randomness brought by RIS. RIS can only serve the user $k_R$ in the reflection area, while the user $k_T$ in the blind area can only conduct channel probing with Alice through a direct channel. Therefore, the secret key capacity of the whole system is reduced. For example, when SNR is set to 20 dB, the secret key capacity of STAR-RIS auxiliary system increases by 44.76% and 90.76%, respectively, compared with RIS auxiliary system and without RIS auxiliary system. It is also observed that because the user $k_R$ and the user $k_T$ have different attribute values, it is possible to assign the number of reflection mode elements $M_r$ and the number of transport mode elements $M_t$ by optimizing the $OP_{1-2}$ problem, thus obtaining a higher secret key capacity than the average allocation $(M_r=M_t=32)$ scheme.

Fig. 7

Comparison of SKC with the number of elements in three systems

Figure 7 compares the secret key capacity of each system under a different number of RIS elements. Here SNR is set to 10 dB, the attribute values of user $k_R$ and user $k_T$ are consistent with those set in Fig. 6, and STAR-RIS works under MS protocol. When the number of elements on the RIS rises, the secret key capacity of both the STAR-RIS auxiliary system and the RIS auxiliary system is increased. With the increase in the number of elements on the RIS, the number of available sub-channels increases, which can bring more secret key capacity. It should be noted that STAR-RIS-assisted systems are able to obtain the highest secret key capacity.

Figure 8 describes the secret key capacity of each system under different user numbers. SNR is set to 10 dB, the secret key capacity is calculated according to the expression defined in $OP_{1-1}$ optimization rule, the number of elements of both STAR-RIS and RIS is 64, and STAR-RIS works under the MS protocol. From the results, we can find that the STAR-RIS-assisted system achieves the highest secret key capacity. As can be seen in Figs. 7 and 8, for a higher number of elements and users, the gap between the STAR-RIS-assisted system and the other two schemes becomes larger. These results show that the advantages of STAR-RIS-assisted systems are more significant when the number of elements or users increases.

Fig. 8

Comparison of SKC with the number of users in three systems

Figures 9 and 10 show the secret key capacity of STAR-RIS operating under the three protocols. The number of STAR-RIS elements in Fig. 9 is 64, SNR is set to 10 dB in Fig. 10, and in all the scenarios in Figs. 9 and 10, there are 2 users: 1 user in the reflection area and 1 user in the transmission area. When STAR-RIS is in ES protocol, the reflection and transmission ratio of elements to incident signal $\beta _m^r:\beta _m^t$ is set to 0.3:0.7. When STAR-RIS is in the TS protocol, the total time slot number L in a coherent time is set to 200, and the time slot ratio of STAR-RIS working in reflection mode and transmission mode $L_r:L_t$ is set to 60:140. In this case, the weighted secret key capacity of the system can be expressed as $C_{\textrm{sum}}=\left( \frac{L_r}{2}I_r\left( h_{k_R}^{dl};h_{k_R}^{ul}\right) +\frac{L_t}{2}I_t\left( h_{k_T}^{dl};h_{k_T}^{ul}\right) \right) /\frac{L}{2}$. The first thing that can be observed from the image is that the TS protocol can bring higher secret key capacity than the other two working protocols. In the TS protocol, all surface elements of STAR-RIS can serve themselves regardless of whether the user is in the reflection region or the transmission region through the time slot switching method. Unlike ES protocol or MS protocol, part of STAR-RIS resources are reserved for users in other areas, so TS protocol can bring the highest secret key capacity.

Fig. 9

Relationship between SKC and SNR of STAR-RIS under three working protocols

Fig. 10

Relationship between the SKC and the number of elements under three working protocols of STAR-RIS

Fig. 11

SKC of STAR-RIS system at different SNR (there is a correlation between eavesdropping and legitimate channel)

Finally, Fig. 11 shows the influence on the secret key capacity of STAR-RIS system when the eavesdropper is less than half wavelength away from the user, where the number of STAR-RIS elements M is 64, STAR-RIS works under the MS protocol, there is a user $k_R$ in the reflection area, its attribute value $\eta _{k_R}=0.3$, and there is a user $k_T$ in the transmission area and its attribute value $\eta _{k_T}=0.7$. In the figure, the mutual information between Alice and the user refers to the secret key capacity when the distance between the listener and the user is greater than half wavelength. The upper and lower bounds of the secret key capacity show the range of the secret key capacity when the distance between the listener and the user is less than half wavelength. The interception channel is modeled as $h_{ae}=\rho h_{ab}+\sqrt{1-\rho ^2}$, where $\rho =J_0(2\pi d_{be}/\lambda ), J_0 (\cdot )$ is the first zero-order Bessel function, $d_{be}$ is the distance between the antenna of Bob and Eve, $\omega \sim CN\left( 0,\sigma _{ae}^2\right)$, the correlation between the listening channel and the legitimate channel $\left| \rho \right|$=0.7. When the eavesdropper is 0.054m away from the user, the correlation between the eavesdropper channel and the legitimate channel decreases the secret key capacity by 0.95 bits/channel (11.54%). In addition, as can be seen from the graph, the upper and lower bounds of the secret key capacity almost fit together, especially the numerical results.

Fig. 12

Comparison of key inconsistency rates between users in STAR-RIS and traditional RIS systems

4.2 Key inconsistency rate

The key inconsistency rate is the ratio of bits number of Alice that differ from primary key bits string generated by users to the total length of bits string. Figure 12 shows the curve of key inconsistency rate between users in STAR-RIS and traditional RIS systems as a function of SNR, in which the number of elements of both STAR-RIS and RIS is 64 and the number of elements working under MS protocol and reflection and transmission modes are 32, respectively. Bob is the user in the reflection space, Carol is the user in the transmission space, and Eve is an eavesdropper in the transmission space. The distance between the antenna of Eve and Carol is $d_{be}$=0.073 m, and the correlation coefficient $\rho =0.5$. According to the results, traditional RIS can provide the lowest key inconsistency rate for user Bob, due to the fact that it provides twice the number of reflected channels compared to STAR-RIS. However, traditional RIS did not reduce Carol’s key inconsistency rate. In addition, the key inconsistency rate of users Bob and Carol on both sides of STAR-RIS is similar, so the use of STAR-RIS brings more equitable key generation performance improvement. In terms of the inconsistent rate of key generation between user Carol and eavesdropper Eve, the curve shows that STAR-RIS-based assisted systems are more secure than traditional RIS. Despite the poor channel conditions leading to a high key inconsistency rate between Alice and Carol, there still exists a significant gap between the key inconsistency rate between Alice and Carol and that of the eavesdropper Eve. Therefore, a STAR-RIS-based system can guarantee the security of all legitimate user-generated keys in a low-signal-to-noise-ratio environment.

5 Conclusion

In this paper, a physical layer key generation system with STAR-RIS is designed. The number of sub-channels in the electromagnetic space is increased by STAR-RIS elements, and the performance of key generation for all users is improved. Moreover, the secret key capacity expressions of STAR-RIS under three different protocols are derived, and the optimization model of the secret key capacity under STAR-RIS is further analyzed. The simulation results not only prove the feasibility of using STAR-RIS to assist physical layer key generation but also show that STAR-RIS can greatly improve the performance of physical layer key generation.