Iulia Tunaru

Alain Sibille Professeur

Matthieu Bloch

Maria-Gabriella Di

Claude Castelluccia

Davide Dardari

Moe Z Win Professeur

Benoît Denis

Bernard Uguen

Physical layer secret key generation for decentralized wireless networks

Keywords:

Physical layer secret key generation for decentralized wireless networks by Iulia Tunaru

impression that you finally understand your subject, the second year you are worried about the results, and the third year you realize that you were a bit too optimistic at the end of the first year. On the contrary, when writing the acknowledgement section, you realize that three years of your life have passed and this seems an awfully long time.

After the first moments of panic caused by the freshly renewed acknowledgement of the unforgiving passage of time, not only are you genuinely happy about the new inspiring people that you met but also about the older still-standing bonds that reinforce your internal structure. Besides an edifying scientific experience, PhD is also a major human experience. I am therefore happy to be able to thank all the persons that have supported and encouraged me in different ways and circumstances over the last years.

My first thought goes to Benoît Denis, my supervisor from CEA-Leti, who has been actively and passionately involved in the research studies presented in this dissertation.

From the first contact we had by e-mail in April 2012, I am sincerely grateful for his striving commitment to everything he said and wrote. From this point of view, I can only hope that I have managed to reply in similar terms. Scientifically, I have felt extremely fortunate to be supervised by Benoît Denis because of his skills, openness, and pedagogical nature, which allowed me to have both the freedom I was searching for and the guidance that I needed. Moreover, his optimism and especially, his patience towards my rather pessimistic nature (for which I apologize) have encouraged me and have largely contributed to keeping a serene atmosphere during the rough times that inevitably occurred. In the end, Benoît was not only my supervisor but also somebody who understood that a PhD is a human experience and offered me the subtle ingredient that everyone needs to enjoy their PhD: trust in a healthy, enriching, and productive student-supervisor relationship.

Then, I would like to express my sincere appreciation for all the efforts that Prof.

Bernard Uguen has made in order to follow this work from a distance of 652 km. The regular discussions we had with him and the two work visits that I made in Rennes have been moments of great inspiration for my work and boosting remedies for my moral thanks to his enthusiastic nature. Finally, I would also like to warmly thank Prof. Bernard Uguen for both the financial support during these years and the highly appreciated help concerning the defense formalities.

Besides my two supervisors, I would also like to mention a few other persons that have contributed to my initiation to research or with whom I have had valuable discussions regarding my PhD subject. Fabrice Valois and Hervé Rivano have been my research vii Contents viii project supervisors while I was in my final year of school. I am particularly thankful to them for having taught me how to "think" and "speak" in research terms and having introduced me to Latex. I will always value the help I received from Paul Ferrand, who has encouraged me to keep looking for interesting things to study and has patiently explained to me highly useful aspects of information theory. Similarly, I am happy to be able to mention a couple of pleasant discussions with Sharvil Patil on quantization and companding, which have later led to one of the first results of this PhD. Last but not least, I wish to thank Régis Perrier for sharing his passion for Bayesian methods most often during the coffee breaks, having insisted that I write the EM equations, and having verified them.

I would also like to sincerely thank my defense committee for accepting to review this work as well as for their remarks, especially those of Dr. Bloch, who was kind enough to send me his detailed comments. Furthermore, I thank CEA and the line management for giving me the opportunity to do this PhD as well as to participate in diverse conferences and trainings. I am particularly thankful to Sandrine Bertola, our laboratory secretary, for her availability, understanding, and genuine care when dealing with my administrative questions or demands.

The time spent in CEA would have been at least weary and grim without people like my office colleagues, Marco and Nicolas, who taught me a set of tricks from French expressions to subtle interior decoration, "I'm-awesome-and-I-know-it" Mickael, the spiritual guide of all PhD students, and my personal social life coach Matthias. I also sincerely thank all my LESC colleagues for their warm welcome, help, and well-intended advice regarding my work.

Outside the badge-only area, I had the opportunity to make new friends and enjoy an indecent amount of laughs in their company. Despite any kind of distance, my friends from school have also offered me invaluable support during my whole time in Grenoble.

For this, I can only feel lucky that I know them. Special thanks to my brother Marius and my friend Safeer for being there and for offering me homemade food supplies.

And finally, I would like to thank the persons that have shown unconditional trust in my abilities since two decades ago: my mother, who went from tricking me to supporting me and finally watching me do my studies and my father, who is the main "responsible" for my coming to France.

List of Figures

Introduction

From over-the-air to paper and wires and then back to over-the-air. Telecommunications, or the sharing of information between two spatially distant entities, includes any form of communication from smoke signals (17 th century BC) to paper messages (2 nd century BC), telegraphs, land-line telephones (19 th century), and wireless communications, which have known a tremendous development in the last century. Although the term "wireless" strictly refers to the communication medium, wireless communications are popularly assimilated to the communications using the radio spectrum (i.e., electromagnetic waves between 9 kHz and 300 GHz), which is just one of the possible resources for transmitting information wirelessly, together with, e.g., electromagnetic optical communications or sound waves.

Between centralized and decentralized. Once the transmission technologies were in place, networks started to appear and two main architectures evolved in parallel: the centralized paradigm, implemented for example in cellular networks, 1 and the decentralized one represented by the Internet 2 and more recently by mobile ad hoc networks (MANET).

Nowadays, the two trends are becoming interleaved in the context of new concepts such as the Internet of Things, ad-hoc device-to-device (D2D) communications, Cloud services linked to decentralized wireless sensor networks (WSN), vehicular ad-hoc communications (VANET) or wireless personal area networks (WPAN), including body area networks (WBAN). However, the decentralized characteristic remains representative at least under short-range connectivity in these emerging networks.

The What and The How. Telecommunications usages have also evolved across decades from military, professional or convenience-oriented to entertainment-focused (i.e., a data smartphones). The choice of this radio localization technology is justified by the unique properties of the corresponding channel impulse responses (CIRs), as illustrated in Section 1.3. Moreover, typical decentralized networks will require capabilities for providing context-aware services, which will probably encourage the proliferation of IR-UWB in such networks.

This first introductory chapter begins with a progressive state of the art on security issues. Section 1.1 describes general security schemes, including a case study on WSN, and introduces the notion of physical layer security. Section 1.2 delves into informationtheoretic models for key agreement and physical layer key generation models and methods. Finally, we provide an overview of IR-UWB in Section 1.3 and present the structure as well as the main contributions of the thesis in Section 1.4.

Communications security

Historically, security systems can be classified in three categories [START_REF] Shannon | Communication theory of secrecy systems[END_REF]: concealment systems (e.g., steganography), privacy systems that require a physical device to recover the message, and secrecy systems that hide the information using codes or ciphers. Nowadays, information security has extended to a set of measures to counteract certain types of attacks (e.g., eavesdropping, message modification, replays, denial of service, intrusion etc.). This led to the development of a set of security goals or principles: confidentiality, integrity, availability (also known as the CIA triad), extensions of data integrity (origin authentication, non-repudiation, freshness [2]), and even accountability and assurance [3].

Security solutions follow the aforementioned general principles but they are usually defined with respect to the application constraints and to the communication protocols.

In current communication systems following the layered OSI model, security is implemented separately at each layer as a supplementary cryptographic feature (e.g., IPSec or SSL protocols). In TCP/IP-alternative architectures, such as the Recursive Internetwork Architecture (RINA) [START_REF] Boddapati | Assessing the Security of a Clean-Slate Internet Architecture Layer[END_REF], security is considered as part of the network design and cryptographic tools are only needed for reinforcement.

Overall, the majority of these security mechanisms involve the use of cryptographic primitives such as symmetric/asymmetric cryptography, hash functions, digital signatures. In the following, a short historical review of encryption is presented, followed by an illustration of classical security schemes for decentralized networks, and finishing with physical layer security and its two main approaches: secrecy capacity and secret key generation, the focus of this thesis.

A historical perspective

Since its early beginnings, the evolution of encryption has been an iterative process alternating between designing more powerful ciphers and breaking them. Starting with the ancient transposition and substitution ciphers, namely the "scytale" cipher (6 th century B.C.) and Caesar's cipher (1 st century B.C.), respectively, continuing in the Middle Ages with more sophisticated examples like the poly-alphabetic Vigenère cipher, and until the end of World War II, the encryption of communications remained a matter of political and military interest [START_REF]History of Cryptography[END_REF]. The only paradigm shift over this period happened at the beginning of the 20 th century with the arrival of encryption and cryptanalysis machines. This also led to the invention and popularization of computers, which found their way in the private sector and created the need for publicly available encrypting methods.

If until the 1970's the encryption security relied on the secrecy of both the encryption algorithm and the key (i.e., symmetric key), the approval of the Data Encryption Standard (DES) in 1976 by the future National Institute of Standards and Technology (NIST) in the US, made the encryption algorithm public. DES is a block cipher using a 56-bit key and a mix of XOR operations, duplications, substitutions and permutations [START_REF] Katz | Introduction to Modern Cryptography[END_REF]. In consequence, it respects Shannon's practical security principle of "confusion" (i.e., a ciphered character depends on several parts of the key) and "diffusion" (i.e., a character change in the plaintext incurs several changes in the ciphered text). Since DES was broken for the first time in 1997, it has been replaced by Triple-DES (1999) and the Advanced Encryption Standard (AES, 2001), a substitution-permutation block cipher with a key of maximum 256 bits [START_REF] Katz | Introduction to Modern Cryptography[END_REF]. In parallel, faster stream ciphers based on linear/nonlinear shifting have also been developed (e.g., RC4, 1987) but they are currently considered less secure than block ciphers [START_REF] Katz | Introduction to Modern Cryptography[END_REF].

Since the standardization of DES, the security of symmetric cryptography relies on the secrecy of the encryption key and therefore, on its characteristics: length, randomness, distribution method. The concerns regarding symmetric key distribution catalyzed the adoption of public key cryptosystems after the invention of the key exchange protocol by Diffie, Hellman, and Merkle [START_REF] Diffie | New directions in cryptography[END_REF]. This led to the invention of Rivest-Shamir-Adleman (RSA) encryption algorithm (i.e., asymmetric cryptography) [START_REF] Katz | Introduction to Modern Cryptography[END_REF]. Contrary to the symmetric secret key approach, RSA relies on individual private and public keys with lengths between 1024 and 2048 bits and on the prime factorization of large numbers, which has not been yet proven to be efficiently solvable (i.e., they are considered computationally hard for the moment). More recent public key cryptosystems, such as Elliptic Curves [START_REF] Katz | Introduction to Modern Cryptography[END_REF],

have replaced the factorization problem with the Discrete Logarithm Problem (DLP).

Asymmetric cryptography shifts the challenge from the secret key distribution side to the certification of public keys, which is conceptually an easier task because of the inherent signature mechanism of public key cryptography (PKC). However, PKC is deemed to be more complex than symmetric cryptography regarding encryption and decryption operations, and it is thus employed mainly for symmetric key distribution and not for data encryption itself. The most prevalent example of synergy between symmetric and asymmetric cryptography is the Transport Layer Security protocol (TLS, 1999) initialized at the session layer, which allows an authenticated symmetric key exchange between a client and a server and subsequent symmetric encryption of the communications.

The symmetric key distribution problem, one of the main challenges of security implementations, has been studied from various angles and within various fields: cryptography, networking (e.g., key distribution protocols), quantum communications, and information theory. In the next section, several classical key distribution solutions will be presented and discussed through the case study of WSN.

Security in decentralized networks

The rapid development of wireless technologies has led to the emergence of several types of wireless ad-hoc networks such as mobile ad-hoc networks and wireless sensor networks [START_REF] Fang | Securing Resource-Constrained Wireless Ad Hoc Networks[END_REF]. While MANET are usually composed of easily replaceable mobile nodes, WSN are large networks consisting of resource-constrained nodes. The latter have sensing, processing and communication capabilities and are employed mainly in health, military, environmental or domestic applications [START_REF] Akyildiz | A Survey on Sensor Networks[END_REF]. The sensor nodes can be randomly deployed in an interest area in order to sense, eventually process, and route data through a multihop architecture to a gateway (the sink) connected to the Internet.

In the following, for illustration and discussion purposes, we will sometimes take WSN as an example of decentralized networks. WSN are subject to typical design constraints that ultimately impact the entire sensor network protocol stack. First of all, sensor networks should be fault tolerant and scalable because of the densely deployed low-cost and hardware-constrained nodes. Secondly, the network topology should be maintained in the absence of any infrastructure and in the event of node failure or node redeployment. Finally, sensor lifetime maximization can be critical in some WSN. The survey in [START_REF] Akyildiz | A Survey on Sensor Networks[END_REF] offers a summary of the main physical, data link and network protocols specific to sensor networks.

Security measures in WSN

Security measures in the WSN communication stack can be implemented at several layers: physical/link layers (e.g., jamming detection), link/routing layers (e.g., securing data dissemination by link authentication, route construction authentication etc.), routing/transport/application layers (e.g., securing data aggregation or the data itself).

Asymmetric or public key cryptography has the advantages of scalability of secure communications between any two nodes of the network and digital signature support implying an intrinsic authentication capability. However, it is deemed to be a solution of high computational complexity, which also relies on the cumbersome authentication of public certificates by third-party certification authorities.

As a partial solution, lower complexity variants of PKC have been implemented on lowpower sensor nodes for authentication and key distribution [START_REF] Watro | TinyPK: Securing Sensor Networks with Public Key Technology[END_REF]. In order to solve the issue of authentication of public keys, ID or location based PKC relying on pairing functions has been proposed as an alternative to classical PKC. In this new PKC framework, public and private keys are either derived from identification information using a secret sharing scheme in a MANET context [START_REF] Zhang | Securing Mobile Ad Hoc Networks with Certificateless Public Keys[END_REF] or directly from location information in WSN [START_REF]Location-based Compromise-Tolerant Security Mechanisms for Wireless Sensor Networks[END_REF]. Nevertheless, location-based PKC requires the secure distribution of location-based private keys in an early post-deployment phase. Secret sharing and location-based private keys can also be exploited to provide end-to-end data confidentiality, authenticity and availability in sensor networks that can benefit from a network bootstrapping phase [START_REF] Ren | LEDS: Providing Location-Aware End-to-End Data Security in Wireless Sensor Networks[END_REF].

The main solution for encrypted communications in sensor networks remains symmetric cryptography because of lower computational overhead of the encryption and decryption operations [START_REF] Fang | Securing Resource-Constrained Wireless Ad Hoc Networks[END_REF]. Conversely, it has no support for digital signatures and it is not very scalable because of the challenge of distributing a shared secret key between each pair of nodes.

Symmetric key management protocols

General solutions Numerous key management techniques for general networked systems have been already developed [2] and can be classified according to: i) the number of users/servers participating in the key generation phase (two-party or conference protocols); ii) the method of key establishment (key transport or key agreement protocols).

Key transport protocols imply that key generation takes place at one user or server and is then distributed among the concerned parties using symmetric or asymmetric Chapter 1. Introduction 7 cryptography. Despite their diversity, all the solutions based on symmetric encryption imply the existence of an initial secure channel such as a global key between all nodes or an initial key between each node and an online server (Key Distribution Center) that distributes pairwise session keys. The global or the initial keys are an important security breach with respect to an internal attacker that has compromised a node. The online server also represents a single point of failure in the network and it is not compatible with the decentralized architecture. Symmetric keys can also be transported using PKC with the advantages and disadvantages discussed before.

Key agreement protocols are key establishment protocols in which the key is a function of inputs from all users. Most of the existing schemes are based on the Diffie-Hellman-Merkle protocol, the precursor of PKC, which relies on the computational difficulty of reversing an exponential operation, also known as the Discrete Logarithm Problem. The steps of the protocol are presented in Alg. 1, where s A and s B are the initial private secrete keys of A and B, respectively, q is a large prime number, g is a primitive root of q,3 and s is the shared secret key. The numbers q and g are considered public and can be therefore agreed upon by the use of a public channel. Although it is inherently adapted to decentralized networks, in order to be secure, this protocol requires the generation of sufficiently long keys and it is therefore computationally expensive to implement in networks like WSN.

Data: g, q, s A , s B Result: s A computes p A = g s A mod q ;

A sends p A to B;

B computes p B = g s B mod q ;

B sends p B to A;

B computes s = p s B A mod q ; A computes s = p s A B mod q ;

Algorithm 1: Diffie-Hellman-Merkle key exchange protocol between A and B WSN-oriented solutions A recent survey [START_REF] Zhou | Securing Wireless Sensor Networks: a Survey[END_REF] makes a classification of the main methods to distributively share symmetric secret keys in WSN, recovered under the name of "key pre-distribution" or the generation of online pairwise keys using preloaded key materials. This approach has two main components: key material distribution and key agreement.

Key agreement focuses on how to generate scalable shared keys based on preloaded materials. In Blom's scheme, a central authority computes a public matrix P and a secret matrix S over a finite field GF(q), where q is a large prime number. It then generates a secret matrix A based on P and S and loads each node indexed by i with the i-th columns from P and A. When two nodes want to generate a shared key they exchange their public columns and apply a multiplication operation. A variant of Blom's scheme consists in replacing the matrix operations with bi-variate polynomial operations on the IDs of the nodes, which are now exchanged between nodes in order to generate the shared key.

Key material distribution can be classified into three categories.

• Random key material distribution is represented mainly by Random Key Predistribution (RKP), a method based on random graph theory. According to RKP, each node is preloaded with a set of keys randomly chosen from an universal pool, so that any two neighboring nodes have a certain probability of sharing the same key. If the nodes do not share a key, they have to negotiate a key through a secure route. Several extensions of RKP have been proposed in order to protect against weaknesses such as node compromise, lack of authentication because of the reuse of the same key by several nodes, or the disadvantages in terms of memory storage.

• Deterministic key material distribution replaces the random graph with a strongly connected regular graph or with a multi-dimensional grid. In the first approach, each node is preloaded with a certain number of keys or key materials (e.g., polynomials) corresponding to its adjacent links. In the second approach, each node is assigned a k-dimensional ID and is preloaded with key materials allowing it to generate shared keys with any of the nodes whose IDs differ from its own in only one dimension.

• Location-based key material distribution aims at improving the performance of aforementioned distribution schemes by taking into account the location. This can be achieved either by a cell-splitting strategy or by a pre-deployment estimation of the proximity of the nodes.

The final "key pre-distribution" solutions have different memory costs and levels of resiliency to node compromise [START_REF] Zhou | Securing Wireless Sensor Networks: a Survey[END_REF], but are less scalable in time, i.e., they do not enable key renewal by design.

Physical layer security

Information-theoretic security

In his paper from 1949 [START_REF] Shannon | Communication theory of secrecy systems[END_REF], Shannon applies the mathematical concepts developed in his previous work on communication theory (i.e, entropy and conditional entropy or equivocation) to security aspects. Starting from the parallel current work in cryptography (i.e., the study of codes and ciphers), he builds a "theory of secrecy systems" that sees cryptography as the means of creating a secrecy system. Despite the information-theoretic approach, this fundamental work articulates itself around a cryptanalyst's point of view and enriches it with a stochastic dimension: given the a priori knowledge of the key (K) distribution, the message (M ) statistics (e.g., the redundancy of the language of the message), and the intercepted encrypted message or cryptogram (E K (M )), what are the a posteriori probabilities of each possible message? Also, the article investigates the minimum length of the intercepted sequence for which the solution of the cryptogram becomes unique (i.e., the uncertainty of the cryptanalyst or the equivocation on the message

H(M |E K (M )) vanishes).
Based on these considerations and the newly introduced algebraic formalism, the paper gradually studies the properties of three types of secrecy systems: perfect, ideal and practical. Perfect secrecy (i.e., information-theoretic security) supposes that the cryptanalyst gains no knowledge of the initial message from the cryptogram, or equivalently, that H(M |E K (M )) = H(M ). This relation leads to the impractical condition that the encryption key should be at least as long as the message. An ideal system requires that the equivocation on the message and the equivocation on the key remain bounded, ideally by H(K), when the length of the intercepted message goes to infinity.

These systems are deemed complex because they must be designed in close relation to the message space, which should have a uniform a priori distribution (i.e., the message should not contain any redundancies before encryption). Finally, practical secrecy is discussed by pointing out that even though the equivocation vanishes for sufficiently large intercepted lengths, the "work" needed to find a unique solution to the cryptogram can be a differentiating factor for ciphers.

The final chapter of [START_REF] Shannon | Communication theory of secrecy systems[END_REF] examines the fundamental trade-offs between several desirable properties of secrecy systems, most of which are still relevant today and represent fundamental metrics in various research areas: i) amount of secrecy (information-theoretic security); ii) key length (key distribution); iii) complexity and message expansion at ciphering (cryptography); iv) error propagation after deciphering (less pertinent because of the discovery of powerful error-correcting codes). Currently regarded as the "father" of information-theoretic security, Shannon also initiated a general security framework outlining the links between what would later become two different approaches to security: the information-theoretic security (revisited in 1975 by Wyner [START_REF] Wyner | The Wire-tap Channel[END_REF]) and the computational security (i.e., the traditional vision of cryptographic security in today's communication networks).

Information-theoretic security refers to the property of a system that will remain secure, i.e., the leaked information to the adversary is zero (perfect secrecy) or asymptotically zero, given an adversary with unlimited computational power. 4 On the contrary, classical cryptography relies on the principle of limited computational power of an attacker: if no efficient attack algorithm is found for the considered symmetric encryption algorithm or if the involved mathematical operation is considered hard (e.g., prime factorization of large numbers or discrete algorithms over finite groups), the attacker is left with the brute force choice that will take too much time to solve.

A scheme of the various paradigms of security is given in Figure 1.1. An intermediate notion between the two approaches of security is provable computational security. One would say that RSA is provably secure if it were proved that no efficient algorithm for prime factorization exists, but the scheme would still be vulnerable in front of an attacker with unlimited computational power.

Information-theoretic security can be achieved in several contexts:

• Vernam's one-time padding encryption scheme proposed by Shannon (i.e., XORing of the message with a same-length key), which achieves perfect secrecy.

• Shamir's secret sharing scheme with perfect security (i.e., a secret is divided into unique parts that are distributed amongst users and the secret can only be reconstructed with a certain minimum number of parts).

• Private Information Retrieval schemes, where a user interrogates one or several non-cooperative servers for retrieving a piece of information while keeping it private from the servers. • Secure Multi-Party Computation, in which a group of users wish to compute jointly a function over their inputs while keeping the inputs private.

• quantum key distribution (QKD) [START_REF] Bennett | Experimental Quantum Cryptography[END_REF] based on quantum properties: polarization properties of individual photons or transmitted light pulses cannot be reliably read by a passive eavesdropper without knowing certain parameters of the transmission or without revealing his presence. More details about QKD are provided in Section 1.2.2.

• physical layer security, in which the assumption of an imperfect communication channel offers the opportunity of information-theoretically secure communications with weaker assumptions than perfect secrecy. Physical layer security has two main study components: secure communication and secret key agreement, the focus of the present thesis.

Secure communication over imperfect channels

For the definition of "perfect secrecy", Shannon [START_REF] Shannon | Communication theory of secrecy systems[END_REF] considers that the attacker can have access to a perfect copy of the encrypted message, meaning that the transmission is done over a noiseless public channel. In physical communications, especially in the wireless case, the transmissions are affected by noise and other random phenomena, which must be compensated by channel encoding in order to achieve reliability [START_REF] Cover | Elements of Information Theory[END_REF].

Based on this observation, Wyner [START_REF] Wyner | The Wire-tap Channel[END_REF] imagines a new type of channel model called the "wiretap channel model" (WTC, 1975) represented in Figure 1.2.

The perfect secrecy condition would be expressed as: I(M ; Z n ) = 0. Instead, Wyner [START_REF] Wyner | The Wire-tap Channel[END_REF] proposes the less stringent and more tractable definition of "weak" (Eq. (1.1))

secrecy based on the behavior of the leaked information I(M ; Z n ). This definition is later extended to "strong" secrecy (Eq. (1.2)).

lim n→+∞ 1 n I(M ; Z n ) = 0 (1.1) lim n→+∞ I(M ; Z n ) = 0 (1.2)
The secrecy capacity is defined as the maximum communication rate at which Alice and Bob can communicate while guaranteeing both reliability (Eq. (1.3)) and strong or weak secrecy of their communication with respect to Eve, also called a wiretapper [START_REF] Bloch | Physical Layer Security[END_REF]. In this model, it is assumed that Eve knows the input message space as well as the encoding and the decoding functions that define the WTC code.

lim n→+∞ P(M = M ) = 0 (1.3)
Wiretap channel models. For the mentioned WTC model, also called the degraded WTC, the secrecy capacity can be computed as shown in Eq. (1.4). In the case of binary symmetric channels, it is strictly equal to the difference between the capacity of the main channel and that of the wiretapper channel. Intuitively, we can see the fundamental trade-off between reliability, which demands more redundancy to improve error-correction performance on the legitimate side (I(X; Y )), and secrecy, which calls for less redundancy in order to limit the eavesdropper's decoding capabilities (I(X; Z)) [START_REF] Bloch | Physical Layer Security[END_REF].

C DW T C s = max p X (I(X; Y ) -I(X; Z)) (1.4)
In the following years, several other channel models for the study of the secrecy capacity have been proposed. These include the following models: 5

• the broadcast channel with confidential messages [START_REF] Csiszàr | Broadcast Channels with Confidential Messages[END_REF], in which the wiretap channel is not a degraded version of the main channel (Figure 1.3). In this case, the question of the quality of the main and wiretap channels arises. For example, when the wiretap channel is noisier than the main channel, the secrecy capacity is the same as for the degraded WTC.

• the Gaussian wiretap channel [START_REF] Leung-Yan-Cheong | The Gaussian Wire-tap Channel[END_REF], which is a degraded WTC in which the main and wiretap channels alter the input signal by adding white Gaussian noise. The secrecy capacity is a function of the SNR of the main channel (γ m ) and of the wiretap channel (γ w ) as shown in Eq. (1.5). So, if γ m ≤ γ w the secrecy capacity is 0.

C GW T C s = 1 2 log(1 + γ m ) - 1 2 log(1 + γ w ) (1.5)
• the fading wiretap channel [START_REF] Barros | Secrecy capacity of wireless channels[END_REF], for which the authors show that the secrecy rate can be positive even when eavesdropper has a higher average SNR than the legitimate receiver, given that the transmitter knows only the instantaneous CSI of the main channel. This is possible because of the different instantaneous realizations 5 A more detailed review of these channel models and others can be found in [START_REF] Chen | Wiretap Channel with Side Information[END_REF] and [START_REF] Mukherjee | Principles of Physical Layer Security in Multiuser Wireless Networks: A Survey[END_REF]. of the fading coefficients on the main and wiretap channels, guaranteeing a nonzero probability to have a higher instantaneous SNR on the main channel. This secrecy capacity can also be used to share a symmetric key that can be later used for encryption [START_REF] Bloch | Wireless informationtheoretic security[END_REF].

Alice

Secrecy-achieving strategies. The secrecy capacity expressions are generally proved using the random-coding argument, a method that does not provide explicit code construction because it relies on averaging over all messages in all possible codebooks.

Wiretap code design is also challenging because their performance cannot be measured by an objective metric like the BER in the case of error correction codes [START_REF] Bloch | Physical Layer Security[END_REF]. For example, LDPC, polar, and lattice codes can be used for building wiretap codes for binary erasure channels [START_REF] Bloch | Physical Layer Security[END_REF], binary symmetric channels, and Gaussian channels, respectively.

It can be observed that secrecy can be achieved when the legitimate users have a socalled "advantage", which can be designed as a coding advantage, a signal processing advantage or both. Although wiretap codes are hard to construct, a generic code structure that guarantees both secrecy and reliability can be inferred: each message should be mapped to a pool of codewords, from which the transmitter randomly draws the transmitted codeword in order to confuse the eavesdropper (i.e., a binning structure [START_REF] Bloch | Physical Layer Security[END_REF]).

A signal processing advantage can be designed by employing multiple antennas, beamforming or jamming [START_REF] Mukherjee | Principles of Physical Layer Security in Multiuser Wireless Networks: A Survey[END_REF]. The signal processing only approach cannot be translated in an information-theoretic weak/strong secrecy conditions but simplifies the system design [START_REF] Mukherjee | Principles of Physical Layer Security in Multiuser Wireless Networks: A Survey[END_REF].

In order to illustrate how secrecy could be possible over a noisy channel without any encryption mechanism, consider a degraded AWGN wiretap channel. 6 According to the definition, the degraded wiretap channel [Alice-Eve] has lower SNR than the main channel [Alice-Bob]. Consequently, for a given binary constellation employed by Alice and Bob, the BER for the main channel is lower than the BER for the wiretap channel.

Consider that the difference is large enough so that after decoding of the repeated symbols sent by Alice, Bob is able to identify an unique symbol, while Eve can only see a cloud of points all over the constellation, which would make her unable to decode the sent symbol. This is one of the simplest examples of exploiting a physical layer advantage to securely transmit information between two parties. Despite the inherent existence of the advantage in this scheme, the choice of the constellation by Alice and Bob depends on the knowledge they have about the state of the wiretap channel, which, along with code design, is one of the main challenges in the field of physical layer secrecy.

Usually, physical layer secrecy studies consider either complete or partial knowledge of CSI or no knowledge at all [START_REF] Mukherjee | Principles of Physical Layer Security in Multiuser Wireless Networks: A Survey[END_REF].

Next, we will briefly describe the second approach in physical layer security, i.e., secret key agreement, which stems from exploiting or creating the same kind of advantage while using an authenticated noiseless public channel.

Secret key agreement

The second approach for providing information-theoretic security using the physical layer is to generate secret keys from communication channels and use them as one-time pads. The legitimate users employ the noisy communication channel to generate correlated (i.e., reciprocal) observations and a noiseless public feedback channel to correct the mismatches and obtain a secure key. Consequently, the secrecy and reliability requirements can be treated separately, making secret key agreement strategies simpler to implement than wiretap code design [START_REF] Bloch | Physical Layer Security[END_REF]. The public channel is commonly assumed to be bidirectional, authenticated and rate-unlimited. In wireless communications, correlated observations can be obtained in two main ways. • Two-way channel probing: owing to the reciprocal nature of electromagnetic wave propagation, physical layer measurements are a common source of information for two legitimate users and can be therefore processed in order to obtain common bits.

Ideally, the two users share an inherent advantage over any possible eavesdropper situated at more than a few wavelengths of any of them because the eavesdropper's radio channel is uncorrelated to the main direct and reverse channels. This is a possible instantiation of the "source model" for secret key agreement and it represents the approach taken in this thesis.

• One-way transmissions over the wireless channel: the observed outputs at the receiver and eavesdropper correspond to the outputs of a classical wiretap channel. Therefore, the so-called "channel model" for key agreement can be seen as a wiretap channel reinforced by a public channel, but with a different purpose (i.e., generate a secret key for encryption purposes at higher levels instead of obtaining secrecy directly at the physical layer) [START_REF] Bloch | Physical Layer Security[END_REF].

Conclusion

In this section, we have briefly described how the physical communication channel can be used either for keyless secure communication or for secret key agreement. These notions are intrinsically linked to information-theoretic security, which does not place any computational restrictions on the eavesdropper. In order to get close to or achieve information-theoretic security, systems should use suitably long wiretap codes or utilize the generated secret keys as one-time pads. Meanwhile, even though the key rate might not be large enough for one-time padding, generating a shared secret key on the fly between two devices is a promising alternative for symmetric key distribution, especially in the context of decentralized networks. Moreover, physical layer security does not require additional equipment than that already employed for communication [START_REF] Bloch | Physical Layer Security[END_REF].

Nevertheless, physical layer security is also facing several challenges [START_REF] Trappe | The challenges facing physical layer security[END_REF]. First of all, compared to cryptographic approaches, most physical layer studies consider only passive attackers (at both physical and applicative layers) with few observations and the same type of communication equipment as the legitimate users. Then, a set of assumptions on the wireless channel are necessary for some physical security schemes: i) total or partial knowledge of the eavesdropper's channel state for secure keyless communications; ii) reciprocity of the bidirectional communications and in the same time temporal decorrelation of the channels for continuous key generation; iii) spatial decorrelation or difficulty of prediction of the wireless channel by the attacker. 8 Finally, information-theoretic channel models or suggested signaling (e.g., Gaussian signaling instead of practical QAM) might not always be realistic.

Several of these issues have already been or start to be addressed. For example, in the case of key agreement, secret key generation under active attacks has recently been considered in practical key generation schemes [START_REF] Zeng | Physical Layer Key Generation in Wireless Networks: Challenges and Opportunities[END_REF]. Several experimental studies in various conditions and with various radio technologies confirm the approximate reciprocity of communication channels ( [START_REF] Jana | On the Effectiveness of Secret Key Extraction from Wireless Signal Strength in Real Environments[END_REF], [START_REF] Madiseh | Verification of Secret Key Generation from UWB Channel Observations[END_REF], [START_REF] Tmar-Ben Hamida | Empirical Analysis of UWB Channel Characteristics for Secret Key Generation in Indoor Environments[END_REF]) or propose methods to post-process measurements for improving it [START_REF] Patwari | High-Rate Uncorrelated Bit Extraction for Shared Secret Key Generation from Channel Measurements[END_REF]. Also, attackers with powerful ray-tracing software cannot gain sufficient information about the legitimate signals in rich scattering environments, as shown in [START_REF] Tmar-Ben Hamida | On the Security of UWB Secret Key Generation Methods against Deterministic Channel Prediction Attacks[END_REF].

Physical layer security can be extended to include authentication schemes based on the uniqueness of the channel between the legitimate users [START_REF] Trappe | The challenges facing physical layer security[END_REF] or on location-and devicedependent features. 9 While the first two physical layer security components dealing with confidentiality are situated at the crossroads of information theory and signal processing, the latter consists in signal processing techniques for linking the identity of a device with its wide-sense physical context (e.g., radio channel, absolute positions, relative connectivity).

To conclude with, as already suggested by the need of prior authentication of the public channel, physical layer security solutions are not meant to be a replacement for cryptographic solutions, but rather a complementary solution in order to enforce security, especially in emerging networks with decentralized architecture or limited computational capabilities.

Physical layer secret key agreement

The present section focuses on the main contributions in the state of the art of physical layer secret key agreement. Firstly, the seminal papers from 1993 introducing the information-theoretic secret key agreement from common randomness and the two standard key generation models are presented, followed by the description of the sequential key distillation procedure for the source model. The link between the informationtheoretic models and the wireless fading channel is also discussed, which leads to a classification of the identified key generation approaches. Finally, we outline various channel characteristics or configurations usually employed for key generation with wireless channels.

Source and channel models

In the field of information theory, two main papers [START_REF] Maurer | Secret Key Agreement by Public Discussion from Common Information[END_REF] [33] provide the transition from secrecy capacity studies, initiated by the introduction of the wiretap channel model, towards the notion of secret key capacity. The contributions of these studies are summarized below.

Firstly introduced as the secrecy capacity of broadcast channels with public discussion [START_REF] Maurer | Secret Key Agreement by Public Discussion from Common Information[END_REF] (or equivalently, the channel model capacity [START_REF] Ahlswede | Common Randomness in Information Theory and Cryptography. I. Secret Sharing[END_REF]), the secret key capacity is then defined in the context of a broader model (or equivalently, the source model [START_REF] Ahlswede | Common Randomness in Information Theory and Cryptography. I. Secret Sharing[END_REF]). In Eve's key information rate from her observation Z n and public messages (φ A , φ B ) arbitrarily small. Given a space of keys K, a secret key rate R is achievable if for every e > 0 and sufficiently large n, there exists a secret sharing strategy such that [START_REF] Ahlswede | Common Randomness in Information Theory and Cryptography. I. Secret Sharing[END_REF]:

H(K A ) > R -e
(key rate)

P(K A = K B ) < e (reliability) 1 n I(K A ; Z n , φ A , φ B ) < e (secrecy) 1 n H(K A ) > 1 n log|K| -e (key uniformity) (1.6)
Maurer [START_REF] Maurer | Secret Key Agreement by Public Discussion from Common Information[END_REF] derives upper and lower bounds for the secret key capacity of the source model in the case of independent repeated realizations of each random variable X, Y , and Z (Eq. (1.7)-(1.8)). Finally, it is shown that for a particular case of joint probability distribution p XY Z (i.e., when the three parties receive a binary symmetric source over independent binary symmetric channels), secret key agreement is possible even when the eavesdropper's observations are on average less noisy than the legitimate observations. This is rather counter-intuitive given the results on secrecy capacity but nonetheless possible because of the public channel, which the legitimate parties can use to create an advantage. Later, Maurer and Wolf [START_REF] Maurer | Unconditionally Secure Key Agreement and the Intrinsic Conditional Information[END_REF] finds a tighter upper bound for the secret key rate of the source model by introducing the notion of "intrinsic conditional mutual information".

S(X

; Y ||Z) ≥ max(I(Y ; X) -I(Z; X), I(X; Y ) -I(Z; Y )) (1.7) S(X; Y ||Z) ≤ min(I(X; Y ), I(X; Y |Z)) (1.8)
Ahlswede and Csiszàr [START_REF] Ahlswede | Common Randomness in Information Theory and Cryptography. I. Secret Sharing[END_REF] discusses the secret key capacities for the source and channel models without and with a wiretapper. If no wiretapper is present, the secret key capacity for the source model (i.e., I(X, Y )) can be obtained with one-way public discussion, whereas the secret key capacity for the channel model (i.e., the capacity of the DMC) is achievable with no public channel. Then, the paper presents closed single-letter characterizations for the source and channel key capacities with forward (i.e., from Alice to Bob) public discussion. Lastly, it is outlined that the knowledge of the wiretapper's observations by one of the terminals can improve the secret key capacity.

Both studies point out the link between the source and the channel models: to a given DMC(p Y Z|X ), one can associate several DMS(p XY Z = p Y Z|X • p X ) by varying p X (or equivalently, a DMC can be viewed as a DMS in which one of the parties, namely the transmitter, can control the source). It can be inferred that the key capacity of the channel model is larger or equal to the supremum of the key capacities of the associated source models [START_REF] Ahlswede | Common Randomness in Information Theory and Cryptography. I. Secret Sharing[END_REF]. This link between the two information-theoretic models leads to several inquiries. What is the equivalent of these models in wireless physical layer security and what is the link between the corresponding source and channel models? Are there other more "practical" models for secret key generation exploiting the randomness of the wireless fading channel? Before classifying key generation models exploiting wireless channels, the next section presents the sequential key distillation procedure for the general source model.

Sequential key distillation for the source model

It has been shown that, unlike for the wiretap channel, the reliability and secrecy requirements for the source model can be implemented independently as a succession of several phases [START_REF] Bloch | Physical Layer Security[END_REF].

Randomness sharing. This first step corresponds to the observation of n random realizations of the source by Alice, Bob, and Eve.

Advantage distillation. In the unfortunate case in which Alice and Bob share less information than Alice and Eve for example (I(X; Y ) ≤ I(X; Z)), a public discussion phase is needed in order for Alice and Bob to obtain an advantage (e.g., by keeping only a subset of the realizations). Note that this step implies that Alice and Bob have some information about the statistics of Eve's realizations.

Information reconciliation. Even though Alice and Bob share an advantage with respect to Eve, they can still have differences in their observations. In order to correct them, Alice publicly sends partial information about her sequence to Bob, who uses it to correct the mismatches (i.e., one-way public discussion). Bob can also reply but in this case, the protocol is more difficult to analyze. The reconciliation information, which can be directly observed and employed by Eve, should be kept as small as possible. This step is theoretically equivalent to a source coding problem with side information: given the side information Y , the amount of information that Bob needs to recover Alice's observation X is H(X|Y ). Since H(X|Y ) = H(X) -I(X; Y ), it is obvious that the more mutual information Alice and Bob have, the less information they need for reconciliation.

Similarly to advantage distillation, Alice should preferably have statistical information about the number of mismatches between her sequence and Bob's in order to compute the needed reconciliation rate.

Privacy amplification. Since Eve's information about the shared advantage of Alice and

Bob increases because of the information reconciliation step, the latter have to apply Chapter 1. Introduction 20 supplementary operations to their sequences (considered equal at this point). This can be a deterministic function (e.g., a hash function or a randomness extractor), whose role is to generate a uniformly distributed sequence. The result will be shorter but more secure (i.e., Eve will have negligible information about it). The present step also removes any correlation that might exist between consecutive observations, which is also an advantage for Eve.

Quantum key distribution. One of the early illustrations of the mentioned sequential procedure is QKD based on the laws of quantum physics [START_REF] Mjlosnes | Chapter 5. Quantum Cryptography[END_REF] and implemented using single photons (or light pulses in practical scenarios), whose linear or circular polarities encode the key bits. For example, "1" can be encoded either as a vertically polarized photon or as a right-circularly polarized one. The linear and circular bases are conjugate bases: measuring the polarization in one of them randomizes the polarization in the other one (i.e., Heisenberg's uncertainty principle). This quantum phenomenon allows the legitimate users to statistically detect an eavesdropper having measured the same photons using a different basis than the one used by the legitimate users (e.g., the BB84 protocol [START_REF] Bennett | Experimental Quantum Cryptography[END_REF]).

Several QKD protocols based on different quantum phenomena have been developed [START_REF] Moskovich | An Overview of the State of the Art for Practical Quantum Key Distribution[END_REF] (BB84 and its variants, continuous-variable QKD, entanglement-based protocols, etc.). In order to illustrate the sequential distillation procedure, we briefly describe the BB84 protocol [START_REF] Bennett | Experimental Quantum Cryptography[END_REF]. One may argue that the latter does not follow the source model but rather a channel model. However, given the particular physical properties of light transmissions, the sequential procedure can be applied as follows.

Randomness sharing. Alice sends a random sequence of bits, each one modulated in a randomly chosen basis. Bob measures the polarization of the received photons also in a randomly chosen basis and then, only keeps the bits measured with the correctly guessed bases. The two can also estimate the leaked information to an eavesdropper after a public discussion.

Information reconciliation. In order to find and correct possible errors, a block parity check algorithm is proposed, followed by a repeated parity check on randomly chosen subsets of bits. When an error is detected in a block, iterative parity check per sub-block is performed until the error is corrected.

Privacy amplification. In order to prevent information leakage from the public channel, for each parity bit disclosed on the public channel, Alice and Bob drop the last bit of the corresponding sequence. Furthermore, the leaked information during randomness Chapter 1. Introduction

21

sharing is suppressed by applying a hash function parameterized by the number of final bits, the estimate of the leaked information, and the desired level of security.

The aforementioned protocol has been proved to be perfectly secure under certain assumptions regarding its implementation, the equipment (photon sources, polarizers, beamsplitters, photon detectors) and the reliability of the quantum transmissions [START_REF] Mjlosnes | Chapter 5. Quantum Cryptography[END_REF].

Commercial systems with dual key agreement (quantum and classical) are already available and current research in the QKD field focuses on subjects such as equipment imperfections that have not been yet considered in the proofs, undiscovered vulnerabilities, quantum key distribution networks, etc.10

Practical sequential key generation

In practical wireless scenarios, the classical key generation steps are [START_REF] Zeng | Physical Layer Key Generation in Wireless Networks: Challenges and Opportunities[END_REF]: channel probing and randomness extraction (e.g., measuring RSSI and extracting the small scale fading), quantization (conversion of real or complex values to bits), information reconciliation and privacy amplification. We can map the first three steps to the aforementioned "randomness sharing" phase.

In some cases, an additional public discussion phase before error correction is necessary, for example, if the measured sequences are not synchronized. In our studies, we will consider that the information reconciliation phase consists of: i) a preliminary public discussion for inducing coherence between Alices's and Bob's measurements (e.g., synchronization) ; ii) a conventional error correction scheme. Note that the former can be designed together with the quantization algorithm or separately.

Key generation models with wireless channels

Wireless channels are typically characterized by three main phenomena that affect transmissions: path-loss, shadowing and small-scale fading. Physical layer security is predominantly interested in the random time-varying component of the wireless channel, either in the form of small-scale fading in narrow-band systems or multipath components in UWB systems. In the following, we will refer to the "wireless channel" from a key generation perspective.

We identify several key generation models employing the wireless channel based on the aforementioned source and channel models. Essentially, the channel model consists in transmission strategies that use the wireless channel as a medium in order to convey secret information, whereas the source model considers the wireless channel as a random source of information and not as a transmission support.

• Source model. This approach relies on the reciprocity and spatial decorrelation properties, which offer an inherent advantage to the legitimate users with respect to the eavesdropper. The legitimate users have correlated observations of the common source, the wireless fading channel, while an eavesdropper, located at a certain minimum distance of the legitimate users, has considerably lower chances of obtaining correlated observations. This key generation approach involves bidirectional training or channel probing and the phases described in Section 1.2.2.

The majority of practical secret key generation algorithms presented in Section 1.2.4 fall under this category.

• Extended source model. The sender-excited model is a generalization of the source model with optimized probing signals [START_REF] Chou | Key Generation Using External Source Excitation: Capacity, Reliability, and Secrecy Exponent[END_REF]. In scenarios with long channel coherence times, the bidirectional entropy harvesting source model is not efficient. A possible solution would be the virtual channel approach where one of the parties induces controlled channel variations during the channel coherence time by using e.g., two antennas [START_REF] Huang | Fast Secret Key Generation in Static Wireless Networks: A Virtual Channel Approach[END_REF].

• Wiretap channel model. The channel model for key agreement can be implemented through classical wiretap coding strategies without a public channel and with various levels of channel state knowledge, as investigated in [START_REF] Gopala | On the Secrecy Capacity of Fading Channels[END_REF] (e.g., full main and wiretap CSI at the transmitter, main CSI only at the transmitter, main CSI only at the receiver). Usually, these strategies are not optimal because they do not make use of the public channel.

If a public channel is also available, equiprobable dense parity codes can be employed to securely share a secret key in the case of a binary symmetric wiretap channel [START_REF] Xiao | Dense Parity Check Based Secrecy Sharing in Wireless Communications[END_REF]. The key is distilled from the encoded sequences that are correctly received. The employed codes guarantee both a lower bound on the probability of detecting correctly received symbols and a lower bound on the equivocation rate, ensuring thus information theoretic security.

• Source-emulation channel model. An alternative implementation of the channel model for key agreement is the source-emulation: Alice generates a discrete memoryless source and sends it over the wireless channel in order to yield correlated observations for Bob. The final key is obtained by information reconciliation and privacy amplification like in the source model. Secret key capacities for Rayleigh fading channels with unknown CSI but known CSI statistics has been investigated in [START_REF] Agrawal | Noncoherent Capacity of Secret-Key Agreement With Public Discussion[END_REF].

Based on the observations that fading is beneficial to secrecy capacity [START_REF] Barros | Secrecy capacity of wireless channels[END_REF], practical secret sharing schemes [START_REF] Bloch | Wireless informationtheoretic security[END_REF] can be designed for AWGN Rayleigh fading channels when instantaneous CSI is available (i.e., complete main channel CSI and complete/partial wiretap CSI at the legitimate users and wiretap CSI at the eavesdropper). The proposed protocol consists in a one-way transmission of a random sequence during the time slots when the secrecy capacity is positive, followed by error correction by LDPC codes and privacy amplification with universal hash functions.

• Mixed models. Recent studies also consider mixed training-transmission key generation strategies with an initial phase of channel probing (i.e., source model) followed by a transmission phase using: i) wiretap coding with receiver CSI only [START_REF] Lai | A Unified Framework for Key Agreement Over Wireless Fading Channels[END_REF]; ii) a source-emulation strategy based on the channel estimates from the first phase [START_REF] Khisti | Secret-Key Agreement over Non-Coherent Block Fading Channels with Public Discussion[END_REF]. Secret keys are generated from both phases. In both cases, the results indicate that when the channel coherence time is long, the contribution from the source model vanishes and the channel model should be used to achieve high key rates.

• Reciprocity-based channel model. 11 Because the source model is highly dependent on the coherence time, static channels would not be adapted for key generation within the practical source model approach. Alternative schemes combining reciprocity/spatial decorrelation and user-generated randomness have been proposed [START_REF] Koorapaty | Secure Information Transmission for Mobile Radio[END_REF] [45] [START_REF] Simmons | Physical Layer Security Over OFDM-Based Links: Conjugate-and-Return[END_REF]. For example in [START_REF] Severi | A Secret Key Exchange Scheme for Near Field Communication[END_REF], Alice and Bob generate random phases φ A and φ B , respectively, and use them to modulate their transmitted signals. If both of them transmit the modulated signals during a period shorter than the channel coherence time, they will be able to obtain a secret key by quantizing the shared information φ A + φ B + φ c , where φ c is the phase induced by the reciprocal bidirectional channel. Keys can also be generated from unilateral user-generated randomness if the channel effect is mitigated by inversion operations (e.g., conjugation [START_REF] Simmons | Physical Layer Security Over OFDM-Based Links: Conjugate-and-Return[END_REF]).

• Alternative model: unknown deterministic sources [START_REF] Shen | Intrinsic Information of Wideband Channels[END_REF]. Recently, key generation has also been studied from a different perspective that combines the informationtheoretic concept of "mutual information" with the notion of "unknown deterministic parameters" from detection and estimation theory. Let Alice and Bob observe a noisy deterministic quantity x. Alice "enciphers" a secret message W with her quantized observation x q A as W e = f (W, x q A ), where f is a deterministic function. Then, she sends W e to Bob, who "deciphers" the intended message W using W e and his quantized observation of the source x q B . The result is a new framework that can characterize the secret key rate, perceived as a secure communication rate achievable with secure mapping functions parametrized by the quantized observations of the source.

Secret key agreement with an active attacker (i.e., using a non-authenticated public channel) can be studied under various assumptions. If the attacker completely blocks the communication during the attack slots, the success of the key agreement depends on the joint initial distribution of the source p XY Z and the suggested protocol consists in secret key agreement during the secure slots [START_REF] Maurer | Secret-Key Agreement over Unauthenticated Public Channels-Part I. Definitions and a Completeness Result[END_REF]- [START_REF]Secret-key Agreement Over Unauthenticated Public Channels-Part II: Privacy Amplification[END_REF]. In the case of wireless fading channels, it is not possible to completely block the communication but it is commonly assumed that the attack is continuous. This scenario is examined in the context of a mixed source-channel model for fading channels and positive secret key capacity is shown to be possible [START_REF] Lai | Key Agreement over Wireless Fading Channels with an Active Attacker[END_REF].

Finally, we also note that secret key generation is not limited to wireless communications and can be also achieved, for example, in networked linear control systems (e.g., sensors and controllers) by exploiting common system state information modifiable by controllers [START_REF] Li | Key establishment via common state information in networked control systems[END_REF].

Wireless channel characteristics for key generation

Key generation methods can be also classified based on the employed channel characteristics (e.g., phase, channel impulse response, magnitude) and their variation over various domains (e.g., time, frequency, space) [START_REF] Forman | A Generalized Scheme for the Creation of Shared Secret Keys through Uncorrelated Reciprocal Channels in Multiple Domains[END_REF]. Measurements are usually performed on absolute or relative scales and their variation is either inherent (i.e., the source model) or user-induced (i.e., the reciprocity-based channel model or intentional variation of transmission parameters such as antenna configurations).

In this taxonomy, we only focus on the source model with a few exceptions of references indexed by u, which represent scenarios of user-induced randomness. A review of some of the key generation methods involving received signal strength or phase information can be found in [START_REF] Ren | Secret Key Generation Exploiting Channel Characteristics in Wireless Communications[END_REF].

• Phase. Although it can be challenging to achieve coarse frequency synchronization, quantization of phase information has been investigated for both narrow-band [START_REF] Hassan | Cryptographic Key Agreement for Mobile Radio[END_REF] [55] u [START_REF] Severi | A Secret Key Exchange Scheme for Near Field Communication[END_REF] u and wide-band channels [START_REF] Koorapaty | Secure Information Transmission for Mobile Radio[END_REF] u [56] [46] u .

• Received Signal Strength (RSS). RSS is a popular channel characteristic for bit extraction because of its wide availability in wireless devices [START_REF] Tope | Unconditionally Secure Communications over Fading Channels[END_REF] [58] u [START_REF] Azimi-Sadjadi | Robust Key Generation from Signal Envelopes in Wireless Networks[END_REF] [60] [START_REF] Jana | On the Effectiveness of Secret Key Extraction from Wireless Signal Strength in Real Environments[END_REF].

Subsequent studies on RSS concern key generation implementation for a network of mobile nodes and static anchors [START_REF] Barsocchi | AmbiSec: Securing Smart Spaces Using Entropy Harvesting[END_REF] or WBAN [START_REF] Ali | Secret Key Generation Rate vs. Reconciliation Cost Using Wireless Channel Characteristics in Body Area Networks[END_REF]. The trade-off between bit generation and resource consumption during channel probing is investigated in [START_REF] Wei | Adaptive Wireless Channel Probing for Shared Key Generation[END_REF]. Despite the simple acquisition process, RSS is considered a low-entropy feature and key generation from RSS measurements usually requires highly dynamic environments to achieve large key lengths.

• Narrow-band CIR. The possibility of employing narrow-band CIR for key generation is investigated in comparison to RSS [START_REF] Mathur | Radio-Telepathy: Extracting a Secret Key from an Unauthenticated Wireless Channel[END_REF] or as a function of the sampling frequency and the channel coherence time [START_REF] Ye | Information-Theoretically Secret Key Generation for Fading Wireless Channels[END_REF] [START_REF] Wu | Secrecy Extraction from Correlated Fading Channels: An Upper Bound[END_REF].

• Multiple channels. An example is to measure RSS over multiple frequency-selective channels [START_REF] Wilhelm | Key Generation in Wireless Sensor Networks Based on Frequency-selective Channels: Design, Implementation, and Analysis[END_REF]. OFDM-like channels have also proved to be a popular key extraction feature in comparison to RSS measurements [START_REF] Liu | Exploiting Channel Diversity in Secret Key Generation From Multipath Fading Randomness[END_REF], narrow-band coefficients [START_REF] Mazloum | Analysis of Secret Key Robustness in Indoor Radio Channel Measurements[END_REF] or when combined with: i) uncorrelated feature extraction [START_REF] Yasukawa | Adaptive Key Generation in Secret Key Agreement Scheme based on the Channel Characteristics in OFDM[END_REF]; ii) delay mitigation and mobility bias correction [START_REF] Hajj Shehadeh | Towards Robust Key Extraction from Multipath Wireless Channels[END_REF]; iii) user-generated randomness [START_REF] Simmons | Physical Layer Security Over OFDM-Based Links: Conjugate-and-Return[END_REF] u . Experimental key generation from MIMO narrow-band RSS measurements is investigated in [START_REF] Zeng | Exploiting Multiple-Antenna Diversity for Shared Secret Key Generation in Wireless Networks[END_REF]. Regarding MIMO theoretical key generation rates, various limiting factors have been analyzed: measurement/estimation noise, spatial correlation between the legitimate and illegitimate channel [START_REF] Wallace | Secure Physical Layer Key Generation Schemes: Performance and Information Theoretic Limits[END_REF] [START_REF] Pasolini | Secret key generation in correlated multi-dimensional Gaussian channels[END_REF], and time correlation of the legitimate channel [START_REF] Pasolini | Secret key generation in correlated multi-dimensional Gaussian channels[END_REF]. Moreover, key generation using beamformed multi-antennas can attain higher secret rates when the nodes have statistical knowledge about the MIMO channel [START_REF] Quist | Maximizing the Secret Key Rate for Informed Radios under Different Channel Conditions[END_REF].

• IR-UWB CIR. The delays and amplitudes of multipath components present in the IR-UWB CIR (see Section 1.3) represent an interesting source of information for symmetric key generation. After the first proof of concept for key generation using relative excess delays of the IR-UWB CIR [START_REF] Kitaura | A Scheme of Private key Agreement based on Delay Profiles in UWB Systems[END_REF], the same characteristic has been recently employed for IR-UWB key generation with channel probing considerations [START_REF] Huang | Dynamic Secret Key Generation Exploiting Ultra-Wideband Wireless Channel Characteristics[END_REF]. The upper-bound for the achievable secret key rates from CIR has been derived [START_REF] Wilson | Channel Identification: Secret Sharing Using Reciprocity in Ultrawideband Channels[END_REF] [START_REF] Madiseh | Secret Key Extraction in Ultra Wideband Channels for Unsynchronized Radios[END_REF]. Several experimental studies with metrological equipment confirm the reciprocity and spatial decorrelation properties of IR-UWB channels [START_REF] Tmar-Ben Hamida | Empirical Analysis of UWB Channel Characteristics for Secret Key Generation in Indoor Environments[END_REF] [28] and investigate the properties of the generated keys [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] [28] [START_REF] Marino | Secret Key Extraction from a UWB Channel: Analysis in a Real Environment[END_REF]. Because of the temporal correlation of CIRs in typical indoor environments, generated keys can be highly predictable when perfect knowledge of the past channel realizations is available to an attacker [START_REF] Madiseh | Time Correlation Analysis of Secret Key Generation via UWB Channels[END_REF]. The proposed solution [START_REF] Madiseh | Time Correlation Analysis of Secret Key Generation via UWB Channels[END_REF] is to employ linear prediction in order to remove the predictable samples.

Other less conventional key extraction algorithms exploit characteristics such as relative node distance [START_REF] Gungor | Secret Key Generation from Mobility[END_REF] or angle of arrival [START_REF] Badawy | Secret Key Generation Based on AoA Estimation for Low SNR Conditions[END_REF], special equipment like reconfigurable antennas [START_REF] Mehmood | Key Establishment Employing Reconfigurable Antennas: Impact of Antenna Complexity[END_REF] u , jamming mechanisms [START_REF] Gollakota | Physical Layer Wireless Security Made Fast and Channel Independent[END_REF], or multi-hop networks [START_REF] Limmanee | Secure Physical-Layer Key Generation Protocol and Key Encoding in Wireless Communications[END_REF]. Moreover, recent studies investigate the negative impact of information leakage from antenna reflections at relatively high SNR values [START_REF] Vogt | Secret-key Generation from Wireless Channels: Mind the Reflections[END_REF].

Although the main aim of a physical layer secret key generation procedure is symmetric key distribution, one can consider exploiting such schemes for security measures such as joint encryption-turbo coding [START_REF] Nguyen | Secret Key Management and Dynamic Security Coding System[END_REF].

Impulse Radio -Ultra Wideband

Although invented at the beginning of the 20 th by G. Marconi and employed in radar technology since the 1960's, UWB communications have gained increased popularity in the last decade [START_REF] Yang | Ultra-Wideband Communications: an Idea Whose Time Has Come[END_REF]. According to the regulation defined by the US Federal Communications Commission (FCC) in 2002, UWB refers to all the emissions with a power spectral density lower than -41.3 dBm and with a bandwidth larger than 500 MHz or larger than 20% of the central frequency. This regulation was intended to define secondary usages of the 3.1 -10.6 GHz band, which explains the low transmission levels corresponding to non-intentional emissions of electronic devices. European regulation defines a low band (3.4-4.8 GHz) and a high band (6-8.5 GHz) for UWB transmissions and imposes the implementation of additional mechanisms in order to protect the coexisting services: Detect And Avoid mainly for high data rate UWB transmissions and Low Duty Cycle aimed at limiting the emission time of low data rate UWB transmissions (e.g., to around 3%) [START_REF] Denis | La Technologie UWB Radio Impulsionnelle: un Etat des Lieux des Solutions en Matière de Localisation Haute Précision et de Transfert de Données à Courte Portée[END_REF].

Today, there are two approaches for UWB communications: the multi-band UWB based on OFDM for high data rate at short transmission ranges and the Impulse Radio UWB consisting in the transmission of short low duty cycle impulses of the order of a few nanoseconds. Because of its temporal characteristics, IR-UWB exhibits high temporal resolution capabilities, which makes it suitable for radio localization applications involving ranging through precise detection of the Time of Arrival (ToA) of transmitted packets. Moreover, because of the low duty cycle transmissions, IR-UWB is adapted to energy-efficient devices as well.

IR-UWB standardization

Two main IR-UWB standards have been proposed [START_REF] Denis | La Technologie UWB Radio Impulsionnelle: un Etat des Lieux des Solutions en Matière de Localisation Haute Précision et de Transfert de Données à Courte Portée[END_REF]:

• IEEE 802.15.4a for joint low data rate communications and peer-to-peer ranging.

The IR-UWB technology, which is capable of achieving low data rates (from 100 kbit/s to 26 Mbit/s) over medium to long distances, has been the natural choice for the physical layer.

• IEEE 802.15.6 for high data rate solutions over short-distance communications in body area networks. The retained physical layer is based on a modified version of the initial 800.15.4a physical layer in order to integrate the particular topology and variable data rates of these networks.

IR-UWB signal

An IR-UWB signal consists in a repetition of pulses with a mean Pulse Repetition Period (PRP) and possibly scrambled by a Time Hopping code in order to smooth the corresponding spectrum. Popular pulse shapes are the Gaussian pulse, the Gaussian monocycle (the first derivative of the Gaussian pulse) and the second derivative of the Gaussian pulse. This is due to the optimal time-bandwidth product of Gaussian pulses (i.e., B = 2/τ where B is the bandwidth and τ is the useful temporal support of the pulse [START_REF] Denis | La Technologie UWB Radio Impulsionnelle: un Etat des Lieux des Solutions en Matière de Localisation Haute Précision et de Transfert de Données à Courte Portée[END_REF]), which achieves maximal time-rate resolution, but also to the facility of generating Gaussian pulses at the antenna level [START_REF] Yang | Ultra-Wideband Communications: an Idea Whose Time Has Come[END_REF].

Classical modulation schemes include (Differential) Binary Phase Shift Keying (D)BPSK, Pulse-Position Modulation PPM (i.e., the temporal position of the pulse indicates the modulated information), On-Off Keying OOK (i.e., modulation by the presence or the absence of the signal) or Transmitted Reference TR (i.e., the information is modulated by the difference between a reference pulse and a secondary one). In the IEEE 802.15.4a standard, a combination of BPSK and/or PPM is considered for flexible modulation (i.e., depending on coherent/non-coherent Rx implementations) and a cascade of an RS encoder and a convolutional encoder is added for channel coding purposes.

IR-UWB channel model

The IEEE 802.15.4a statistical channel models for various type of environments (e.g., office, residential, outdoor, industrial, etc.) and two frequency regimes (above 3 GHz and below 1 GHz) [START_REF] Molisch | A Comprehensive Standardized Bibliography 169 Model for Ultrawideband Propagation Channels[END_REF] are based on a modified version of the Saleh-Valenzuela (S-V) indoor channel model developed in 1987 using measurements with 10 ns pulses [START_REF] Yang | Ultra-Wideband Communications: an Idea Whose Time Has Come[END_REF]. The S-V small-scale fading model assumes that arrival times of multipath components are Poisson-distributed within clusters, which also follow a Poisson distribution. The CIR can be expressed as:

h(t) = ∞ l=1 ∞ k=1 x l,k e jφ l,k δ(t -T l -τ l,k ) (1.9)
where T l is the arrival time of the l-th cluster, τ l,k , x l,k , and φ l,k are the multipath arrival time, amplitude, and phase of the k-th multipath within the l-th cluster. The phases φ l,k are uniformly distributed in [0, 2π] and the amplitudes x l,k are Rayleigh random variables with an exponentially decaying power profile (E[x 2 l,k ] = E[x 2 1,1 ]e T l /Γ e τ l,k /γ with Γ and γ the cluster and multipath decaying rates).

The standardized proposal [START_REF] Molisch | A Comprehensive Standardized Bibliography 169 Model for Ultrawideband Propagation Channels[END_REF] includes several modifications of the S-V model: i) the number of clusters is considered a Poisson random variable; ii) the multipath arrival times are modeled as a mixture of two Poisson processes and the cluster decaying rate Γ as a function of T l ; iii) the small-scale fading amplitudes |x l,k | follow a m-Nakagami distribution. Also, the IEEE 802.15.4a standard modifies the clustering model depending on the considered environment, includes a frequency-dependent term in the path gain model and proposes a new model for correlated shadowing for WBAN. In the following, we will consider this model for the performance evaluation and benchmark of some of our proposals.

Another approach to channel modeling can be achieved by deterministic propagation simulators, like ray-tracing tools that capture the dependency of the received signal with respect to Tx-Rx positions and to the environment. In Chapter 3, we will employ data generated with an IR-UWB ray-tracing tool [START_REF] Amiot | PyLayers: An Open Source Dynamic Simulator for Indoor Propagation and Localization[END_REF] in order to investigate the effect of the spatial correlation of IR-UWB signals on an existing key generation protocol.

IR-UWB receivers

At the receiver, the high sampling rates imposed by the high signal frequencies and large bandwidth can be prohibitive given the consumption requirements for integrated devices. This poses challenges in terms of synchronization/timing acquisition, demodulation and channel estimation, which are usually designed to match a target level of performance depending on the application [START_REF] Denis | La Technologie UWB Radio Impulsionnelle: un Etat des Lieux des Solutions en Matière de Localisation Haute Précision et de Transfert de Données à Courte Portée[END_REF]. Generally, IR-UWB receiver architectures can be [START_REF] Yang | Ultra-Wideband Communications: an Idea Whose Time Has Come[END_REF] [90]: • Coherent. For example, coherent Rake receivers require a priori synchronization and channel estimation in order to separately process every received pulse and combine the results provided by the multipath diversity before making a demodulation decision.

• Semi-coherent. A system employing DPBSK or TR modulations can integrate a semi-coherent receiver, which demands only intra-symbol synchronization, i.e., the detection of the time of arrival of the first multipath component.

• Non-coherent. Energy detectors [START_REF] Dubouloz | Performance analysis of ldr uwb non-coherent receivers in multipath environments[END_REF] and mixed architectures [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF] can simplify a lot the receiver design. According to ED architectures (e.g., for n-PPM, OOK modulations), the energy of the received signal is integrated in small bins whose width is approximately equivalent to the unitary pulse duration, thus relaxing the traditional constraints on synchronization precision, relative clock drifts between Tx and Rx, and sampling rate, which becomes a function of the bin integration duration for non-overlapping bins [START_REF] Dubouloz | Performance analysis of ldr uwb non-coherent receivers in multipath environments[END_REF]. In the case of semi-coherent DBPSK modulations, a prior stage of coherent integration of one-bit quantized signals can be added for SNR improvements [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF].

Herein, we are solely interested in the channel estimation phase, irrespective of any modulation-related questions. A more detailed state of the art on channel estimators is provided in Section 2.4.1.

Motivations and contributions of the thesis

The present thesis explores several aspects of the secret key generation procedure involving the source model, which can be practically implemented with sequential methods (Section 1.2.2). Compared to the source emulation model, which can also be designed according to a sequential approach, the source model does not rely on a temporary or engineered advantage for achieving key sharing. On the contrary, the reciprocity and spatial decorrelation of radio signals are inherent characteristics of radio transmissions and the channel estimation phase is already employed for communication purposes in some systems. This means that the source model is relatively simpler to implement than the other key generation models. However, it is dependent on channel variability, which should be slow enough to allow bidirectional channel probing and fast enough in order to achieve an acceptable key generation rate. The study of channel variability is out of the scope of this work, which focuses on the exploitation of single channel realizations and assumes that the channel is sufficiently slow in order to fulfill the channel probing constraints.

Because of its rich multipath resolution capabilities and favored by its increasing popularity for localization-aware applications and potentially in various kinds of decentralized emerging networks (e.g., WSN, WPAN etc.), the IR-UWB physical layer has been chosen for our investigations. It will be therefore used for both single links and cooperative scenarios (i.e., in mesh networks). We focus on the first part of the sequential key generation chain (i.e., the gray-highlighted steps in Figure 1.6), prior to error-correction and privacy amplification, because of its close links to signal processing techniques. Although joint design of, e.g., quantization and information reconciliation procedures could be a promising research direction, we choose to study them separately 12 because of: i) the simplicity of the approach; ii) the need to initially understand the specific structure and information that can be extracted from IR-UWB signals in single-link and cooperative contexts. Unlike RSS measurements, IR-UWB signals have a special vectorial structure with amplitude and temporal components (i.e., the attenuation and arrival time of multipath components) and the probing phase has an impact on the key generation performance depending on its parameters (e.g., sampling rate, estimation algorithm, etc.). Moreover, all the available physical layer characteristics should be exploited in order to obtain physical layer security solutions with a high potential of device integration. In the case of mobile IR-UWB devices, high-precision ranging provides a valuable source of reciprocal information even though the entropy of such measurements is lower than that of the CIRs. We also try to understand how far the original "physical layer" concept can be extended in the case of cooperative key generation without recurring to higher layer key distribution protocols, which may involve numerous packet exchanges.

Channel probing &

This thesis provides guidelines concerning the aforementioned research axis. We start from existing IR-UWB key generation studies [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF] [29] [79] [START_REF] Tmar-Ben Hamida | On the Security of UWB Secret Key Generation Methods against Deterministic Channel Prediction Attacks[END_REF], which include a key generation protocol for directly sampled CIRs [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF]. Regarding this signal model, we propose two extensions of the mentioned protocol: the first one improves the random character of the generated keys by a diversified bit encoding procedure [START_REF] Tunaru | Random Patterns of Secret Keys from Sampled IR-UWB Channel Responses[END_REF] (Section 2.2)

and the second one increases the immunity to eavesdropping by limiting or masking the public exchanges required for information reconciliation [START_REF]Public Discussion Strategies for Secret Key Generation from Sampled IR-UWB Channel Responses[END_REF] (Chapter 3).

Then, we pursue our investigations in the context of synthetic channel estimates based on the IEEE 802.15.4a model in order to understand the impact of quantization on the reciprocity-randomness trade-off [START_REF]Reciprocity-Diversity Trade-off in Quantization for Symmetric Key Generation[END_REF] (Section 2.3). In this context, we introduce the notions of "inter-key" and "intra-key diversity" to characterize randomness, show how to adapt the quantization thresholds in order to achieve a certain trade-off between reciprocity and inter-key diversity, and propose a scheme that favors intra-key diversity.

Moreover, we extend the signal model to realistic channel estimates issued from various types of estimators (Section 2.4), some of which are designed to lower the prohibitive sampling rates that are usually needed for channel estimation. We examine the degradations in reciprocity incurred by these estimators and we propose a post-processing phase of the channel estimates that improves the reciprocity.

Finally, we develop a new signal-based method that extends the point-to-point source model to cooperative contexts with several nodes intending to establish a group key through the optimization of the channel probing signals [START_REF]Cooperative Group Key Generation Using IR-UWB Multipath Channels[END_REF] (Chapter 4). In this last chapter, the focus lies on the reciprocity at the signal level and on the design of the probing signals, which explains the simplistic ED-like approach that has been chosen for the quantization metric and the key performance evaluation.

Despite the fact that we employ the IR-UWB technology for all our simulations, the findings of Chapters 3 and 4 can be extended to other wireless technologies. Furthermore, our methods are not targeted or restricted to low-complexity networks such as WSN, but are rather general. On the one hand, in Section 2.4 we provide guidelines for quantizing channel estimations obtained with sub-Nyquist sampling. On the other hand, the cooperative key generation method developed in Chapter 4 requires terminals with evolved computational capabilities, such as multi-standard smartphones.

Each of the three main chapters also includes a review of related state of the art work and the concerned signal and system model. 13 The present document is concluded with a summary of the contributions and their limitations in Chapter 5 followed by a few personal thoughts about the societal impacts of information and communications technologies (Chapter 6). Other related subjects that have been investigated in parallel concern: i) quantization of ranging and device-dependent information for generating pseudonyms and provide a security overlay to conventional authentication procedures (Appendix E); ii) quantization strategies for experimental IR-UWB channel estimates issued from low-complexity integrated devices [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF] (Appendix F).

Chapter 2

Quantization of IR-UWB signals for secret key generation

This chapter addresses quantization issues in the context of symmetric key generation from IR-WB channels. After discussing the philosophy of key quantization and a few examples of algorithms (Section 2.1), we investigate several issues related to the quantization step.

• The random aspect of keys generated from directly sampled IR-UWB signals (Section 2.2): we propose a new bit encoding algorithm [START_REF] Tunaru | Random Patterns of Secret Keys from Sampled IR-UWB Channel Responses[END_REF] that reduces the randomness defects compared to a previously proposed solution [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] [95].

• The inherent trade-off between reciprocity and randomness (Section 2.3): we introduce a new metric for quantifying the randomness of the quantization process, namely the diversity of the binary codewords. The mentioned trade-off is illustrated through a study on the optimization of the quantization thresholds for simulated IR-UWB channel estimates [START_REF]Reciprocity-Diversity Trade-off in Quantization for Symmetric Key Generation[END_REF]. Also, a new diversity-aware quantization scheme is proposed for the same signal model.

• The impact of realistic IR-UWB channel estimates on the reciprocity performance of the channel estimates (Section 2.4): we evaluate three different estimators, namely a high sampling rate estimator and two sparse ones, and propose a pairing algorithm adapted to the obtained channel estimates in order to improve their reciprocity.

State of the art: quantization

Quantization for key generation

In the classical sense (e.g., for digital signal compression and/or reconstruction), the term "quantization" refers to the mapping of a continuous set of values to a discrete reproduction alphabet and its binary representation [START_REF] Gray | Quantization[END_REF]. A memoryless quantizer can be represented by its three components: i) a lossy encoder α that maps the continuous value to an index; ii) a reproduction decoder β that maps the index to a codeword of the reproduction alphabet (i.e., the quantized values); iii) a lossless encoder γ that maps the index to a binary codeword. The quantization rule of an input value x is:

q(x) = β(α(x)).
The classical quantization problem is defined by the rate-distortion pair (R(α, γ), D(α, β))

from Eq. (2.1)-(2.2), which describes the trade-off between two conflicting goals : keeping the rate as small as possible and the distortion likewise (i.e., representing the input value as faithfully as possible using a minimum number of bits). We will call this scenario "classical quantization".

R(α, γ) = E X [len(γ(α(X)))] (2.1)
D(α, β) = E X [d(X, β(α(X)))] (2.2)
where d is a distance metric and len returns the number of bits of a binary sequence.

Classical quantizers can be classified as scalar or vector (depending on whether the lossy encoder α operates on scalars or on vectors), fixed or variable rate (depending on whether the reproduction decoder γ produces codewords of the same length or not), and memoryless or with memory (if α or γ depends on the previous quantization operations).

Application of the quantization tools in the key generation context has to be adapted to its specific definitions and goals, as shown hereafter.

Let y u = [y u 1 , y u 2 , ...y u K ] be K real samples issued from the channel probing/estimation phase at user u ∈ {A, B}. We consider the samples as realizations of

K continuous independent RVs [Y u 1 , Y u 2 , ...Y u K ] denoted as Y u .
Further on, the term "key" (K u ) will be used to denote the result of the quantization of y u on each side of the link.

K u = q key (y u ) = γ(α(y u )) (2.3)
In most of the practical key generation protocols, there is no need for the reproduction alphabet or the reproduction decoder because we are only interested in the binary codewords. Moreover, the mapping between an eventual reproduction alphabet and the binary representation is a deterministic public function. Next, we choose between various quantizer types based on the goals of the key generation procedure and the metrics used to measure them.

First of all, an efficient quantization algorithm should be able to generate as many bits as possible from a single channel probe (i.e., high rate). In "classical quantization", vector quantizers are employed to achieve a lower bit rate given a fixed distortion [START_REF] Gray | Quantization[END_REF]. This type of quantizers could be interesting from a joint quantization-reconciliation point of view. For simplicity, we will restrict the study to scalar quantizers. This means that a key is a concatenation of elementary codewords obtained from the quantization of the available samples of y u :

K u = [q key (y u 1 )||q key (y u 2 )||...q key (y u K )] (2.4)
with || representing the concatenation operation. So, the length of the final key will be the sum of the lengths of the elementary binary codewords. Also, for simplicity, we only consider memoryless quantizers.

Secondly, a robust quantization algorithm should generate keys with good reciprocity, meaning low distortion between the keys generated at the two extremities of the link.

The distortion in "classical quantization" implies a measure of the distance between the continuous input value x and its reconstructed quantized version q(x). For key quantization, the distance has to be defined on a discrete space. One option would be the Hamming distance, which is defined for sequences of the same length.

Finally, key bits should have a random aspect, meaning, for example, that there should be diversity in the generated codewords of a single key or intra-key (i.e., over k ∈ {1 . . . K}), but also between the generated keys or inter-key (i.e., at fixed excess delay, over different channels). To illustrate the need of codeword diversity, we take as an example a quantization scheme in which the codewords are long (e.g., binary alphabet on 10 bits) and α is designed so that the first codeword is q key (y u 1 ) = c 1 for 99% of the input signals. The key rate is high (10 bits/codeword), the reciprocity is also high but the scheme performs very poorly from the security point of view because the first codeword of the key is highly predictable. Alternatively, an ideal quantizer from a diversity point of view is one that outputs equiprobable codewords. Even after key generation, randomness can be difficult to quantify. Studies usually use randomness tests for pseudo-random number generators that search for randomness flaws such as bit patterns or predictable oscillations [START_REF] Burr | A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications[END_REF]. Therefore, we identify three performance criteria for the evaluation of key quantization algorithms, namely the length or rate, the reciprocity and the random character of keys.

Chapter 2. Quantization of IR-UWB signals

36

In this way, we incorporate into the quantization phase aspects related to reconciliation (i.e., reciprocity) or privacy amplification (i.e., randomness) in order to: i) control the desired trade-offs easier by trying to optimize only one operation; ii) eventually simplify the following steps of reconciliation and privacy amplification.

Quantization algorithms

In theory, the secret key rate is bounded by the mutual information of the observations of the legitimate users. In practice, quantization algorithms must be designed in order to "extract" the mutual information of the given measurements. For example, the mutual information between two correlated Gaussian random variables is compared to the secret achievable key rates with an equiprobable quantizer and a classical minimumdistortion quantizer, followed by an LDPC-based reconciliation procedure [START_REF] Ye | Extracting Secrecy from Jointly Gaussian Random Variables[END_REF]. When using minimum-distortion quantization, the computed secret key rate must be adapted to take into account the entropy loss caused by the non-equiprobable quantization. Thus, the two quantizers have equivalent performances [START_REF] Ye | Extracting Secrecy from Jointly Gaussian Random Variables[END_REF].

Despite the existence of general quantization models (e.g., equiprobable, minimumdistortion), quantization design depends on the type of input signal and its variations (e.g., RSS, CIR). As described in the following, it can also be concerned with the eventual public information needed to be exchanged between the two legitimate parties as a first stage of reconciliation (e.g., guard-band dropping or quantization map index [START_REF] Wallace | Automatic Secret Keys From Reciprocal MIMO Wireless Channels: Measurement and Analysis[END_REF]).

Quantization schemes usually fall into two categories: parallel quantization or asynchronous quantization. 1 Parallel quantization implies that samples are quantized independently by the two legitimate users according to a previously agreed upon algorithm and parameters. If needed, reconciliation information is exchanged after quantization. Asynchronous quantization is inspired from reconciliation procedures based on distributed source coding, namely source coding with side information. Accordingly, quantization is initially performed by one user and then, relevant quantization information is sent to the second user who can quantize his observation based on the received information. In the present thesis, we only consider parallel quantization because of its simple design and generality.

Parallel quantization

Several of the quantization algorithms that use RSS for bit extraction have been analyzed

in terms of entropy, secret bit rate, and bit mismatch rate [START_REF] Jana | On the Effectiveness of Secret Key Extraction from Wireless Signal Strength in Real Environments[END_REF]. According to this study, the RSS quantizers fall into two categories: i) lossy or guard-band quantizers that drop measurements within a certain distance of the quantization thresholds (i.e., in the guard-bands) in order to achieve higher reciprocity [START_REF] Tope | Unconditionally Secure Communications over Fading Channels[END_REF] [58] r [START_REF] Mathur | Radio-Telepathy: Extracting a Secret Key from an Unauthenticated Wireless Channel[END_REF]; ii) lossless quantizers that do not drop samples but employ compulsory privacy amplification to remove the correlation between the generated bits [START_REF] Azimi-Sadjadi | Robust Key Generation from Signal Envelopes in Wireless Networks[END_REF]. The indexes of the dropped samples are publicly exchanged by the nodes.

The guard-band quantization algorithm from [START_REF] Mathur | Radio-Telepathy: Extracting a Secret Key from an Unauthenticated Wireless Channel[END_REF] is extended to an adaptive guard-band quantization algorithm, which divides the RSS measurements into blocks and applies quantization with block-dependent guard-bands [START_REF] Jana | On the Effectiveness of Secret Key Extraction from Wireless Signal Strength in Real Environments[END_REF]. Later, a guard-band quantization algorithm for IR-UWB CIRs [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] is developed: the corresponding guard-band thresholds are the same across a CIR but evolve during the iterative key extraction process starting from high values and decreasing (Section 2.2.2). In the context of experimental key generation based on IR-UWB CIRs, derivative-based and multi-bit uncensored quantization schemes are compared in terms of bit mismatch and bit frequency for both legitimate and illegitimate links [START_REF] Marino | Secret Key Extraction from a UWB Channel: Analysis in a Real Environment[END_REF].

Asynchronous quantization

An example of asynchronous quantization is given in [START_REF] Wallace | Automatic Secret Keys From Reciprocal MIMO Wireless Channels: Measurement and Analysis[END_REF] under the name of "Channel Quantization Alternating" (CQA). Instead of using guard-bands, the mismatch probability is reduced by adapting the quantization to each observed sample. For example, suppose that Alice quantizes her observation based on a one-dimensional quantization map. She then indicates Bob which side of the cell her observation fell in (e.g., the mapping bit can be "0" for left side and '"1" for right side). Before quantizing his observation, Bob shifts the initial quantization map so that the cells are centered on the sides of the initial cell corresponding to the mapping bit (i.e., if the mapping bit is "0" an initial quantization cell (1, 2) becomes (0.5, 1.5) for Bob).

Parallel studies propose other asynchronous quantizers: i) a mix of guard-band and asynchronous quantization including an authentication procedure intended for measurements with symmetric distributions [START_REF] Ye | Information-Theoretically Secret Key Generation for Fading Wireless Channels[END_REF]; ii) a more general syndrome-based scheme in which quantization and reconciliation are merged (i.e., Bob quantizes his observations based on the syndrome computed by Alice from her initial observations before quantization) [START_REF] Ye | Information-Theoretically Secret Key Generation for Fading Wireless Channels[END_REF]; iii) a multi-bit adaptive quantizer similar to CQA [START_REF] Wallace | Automatic Secret Keys From Reciprocal MIMO Wireless Channels: Measurement and Analysis[END_REF] preceded by an interpolation filter for reciprocity and a decorrelation transformation for randomness [START_REF] Patwari | High-Rate Uncorrelated Bit Extraction for Shared Secret Key Generation from Channel Measurements[END_REF].

Keys from sampled waveforms: random aspect

Experimental studies [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF] show that relatively long keys can be obtained when using an IR-UWB metrological test-bed with trigger-based synchronization. The testbed consists of a pulse generator used to create a 2-9 GHz IR-UWB pulse, a digital oscilloscope with a time step of 50 ps at the reception side, and two omnidirectional dipole UWB antennas. Synchronization is achieved through a wired link used to send a trigger signal. These results have motivated supplementary evaluations of the key generation protocol on a variety of typical indoor IR-UWB signals with a more realistic synchronization method affected by asymmetric reception noise. The considered channels are thus simulated based on the IEEE 802.15.4a standard [START_REF] Molisch | A Comprehensive Standardized Bibliography 169 Model for Ultrawideband Propagation Channels[END_REF]. We aim to understand the effects of the previous quantization scheme (POS) on the random nature of the generated bits (i.e., intra-key randomness). The findings lead to the proposal of an extended quantization algorithm (HIST), which improves the random patterns of the keys, while maintaining an acceptable bit agreement ratio in noisy cases.

System model

The considered communication system includes two parties: Alice, denoted as A, and Bob, denoted as B. The key generation protocol consists of two phases : i) the halfduplex channel probing phase for signal acquisition and eventual processing and ii) the key extraction phase, which takes place in the application layer and deals with quantization and reconciliation. The signals received by Alice and Bob can be expressed as follows:

y A (t) = (h BA * p)(t) + w A (t) (2.5) y B (t) = (h AB * p)(t) + w B (t) (2.6)
where h AB (t) = h BA (t) are the reciprocal CIR, p(t) is the transmitted pulse waveform with central frequency f c and bandwidth B and w A (t), w B (t) are random processes of zero-mean Gaussian white noise with double-sided power spectral density N 0 /2 and filtered in the band of the transmitted signal. The corresponding noise variance is therefore σ 2 w = N 0 /2 × 2B. This model assumes that the pulse waveform is undistorted during propagation, irrespective of its associated multipath component.

The received signals are uniformly sampled at sampling frequency F s and N samples are collected in an observation window whose overall time duration is (N -1)/F s . The signal-to-noise ratio (SNR) is defined as the ratio between the mean power of the received noiseless signal and that of the noise:

SNR = P sig P noise = 1 N N n=1 ((h * x)[n]) 2 σ 2 w (2.7)
where x[n] stands for the sampled version of x(t).

Processing of received signals

An .

Ĥ[l] = Y [l] P [l] = H[l]P [l] + W [l] P [l] (2.8) ĥ[n] = IDF T ( Ĥ[l]) (2.9)
with .

[l] the Discrete Fourier Transform of .

[n].

In an ideal noiseless case, Tx deconvolution without filtering is possible and the channel estimation will tend towards a Dirac distribution like in Figure 2.1(c). In noisy cases, filtering is compulsory for Tx deconvolution [START_REF] Riad | The deconvolution Problem: An Overview[END_REF]. This modifies the characteristics of the estimated signal: a simple brickwall filter equivalent to the pulse bandwidth would make the estimation ĥ[n] tend to the form of a directly sampled signal (Figure 2.1(d)).

From the information-theoretic point of view, the bit extraction algorithms should use an estimated infinite-bandwidth CIR (i.e., pairs of times and amplitudes). Filtered signals like y[n] involve correlated samples, which could lead to deterministic characteristics of the keys. However, channel estimation is a subject of research by itself and existing algorithms are constrained either from the sampling point of view (e.g., high resolution methods such as CLEAN [START_REF] Cramer | Evaluation of an Ultra-Wide-Band Propagation Channel[END_REF]) or from the computational complexity point of view (e.g., compressed sensing algorithms [START_REF] Paredes | Ultra-Wideband Compressed Sensing: Channel Estimation[END_REF]). Alternatives such as low-complexity algorithms, which can be implemented on low power devices [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF], would be more limited in capturing the multipath richness (e.g., in terms of signal dynamics) and would be less suitable for long key generation. Channel estimation aspects are studied in more detail in Section 2.4.

In this study, the following input signals for quantization are considered: i) the estimated channel coefficients ĥ[n] obtained by filtered frequency-domain deconvolution according to Eq. (2.9) (FD) and ii) the unprocessed samples y[n] from direct sampling (DS). Both strategies allow the extraction of a sufficient number of bits because of the large number of available samples but they are also prone to degradations in randomness, which we will study next.

Synchronization considerations

The initial IR-UWB quantization algorithm [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] is evaluated on experimental traces acquired with a 2-9 GHz pulse generator and a 20 GHz real-time digital oscilloscope. The receiver's channel is synchronized with the pulse generator using a trigger signal.

In this study, a more realistic synchronization method based on level-crossing (leading edge detection) will be used. This method aims at detecting the actual channel leading edge (first signal-carrying samples) and using it as a starting point for the temporal observation window. The used detection threshold (y th ) is set as a function of the noise variance. This means that the observation window on each side of the link will start at a time t start defined by the level-crossing time (t y(t)>y th ) and a fixed delay (∆):

t start = t y(t)>y th -∆ (2.10)
where ∆ is employed in order to avoid missing significant samples from the signal.

Polarity-based quantization

The reference key generation method [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] [95] uses a dynamic threshold quantization for bit extraction and can be applied to input signals like y[n] or ĥ[n], denoted as s[n] in the following. The algorithm, although adaptive with respect to the signal dynamics, does not depend on the temporal index (position) of the quantized sample and it is thus entitled POS for the rest of the document. Its phases are the following:

• estimation of the variance of the noise contained in the input quantization signal

s[n] (N 2 lev
), which will be used to define a stopping rule for the bit extraction.

• bit extraction from s[n]:

compute the first thresholds (i = 0) for quantization:

L 0 + = max(s[n]) > 0 and L 0 -= min(s[n]) < 0.
at iteration i, apply the pos i operator defined in Eq. (2.11) to the samples of s[n] that cross the thresholds L i -or L i + , memorize the extracted delay indexes n in a table P and the corresponding iteration step i in a table I.

pos i (s[n]) = 1 if s[n] ≥ L + i 0 if s[n] ≤ L - i (2.11)
update thresholds:

L + i+1 = L + i -L 0 + /δ and L - i+1 = L - i -L 0 -/δ
, where δ is a scaling parameter of the protocol.

repeat the two last steps until the wanted length is reached or the noise level N lev is approached within a guard interval depending on δ (e.g., N lev +L 0 + /δ).

Even though, overall, several thresholds are used, the bits are extracted only from samples with amplitudes that cross the thresholds computed at the last iteration before stopping the extraction.

• public discussion involving the exchange of the index tables (P A and P B ), followed by the selection of the common indexes and their corresponding bits.

• key correction using a Reed-Solomon code to fix mismatching bits. For benchmarking purposes, we use the same code parameters as in [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF]: total block length of 127 seven-bit symbols and encoded message length of 123 symbols. Therefore the maximum number of correctable symbols is 2.

The described bit extraction is adaptive with respect to the SNR. If the SNR is relatively high, a larger δ can be used; this corresponds to a lower stopping threshold and thus, to the extraction of more bits. Furthermore, given a desired key length, the bits corresponding to the most representative parts of the signal are given priority for extraction. Nonetheless, the quantization is based only on the polarity of the input signal with respect to the last threshold, independently for each sample/position. This simple polarity-based encoding applied to a deterministic waveform could possibly lead to regular patterns in the extracted bits. An extension of this bit extraction method, which takes into consideration the relationship between the amplitudes of different samples in order to break the regularity pattern, is presented in the next section.

Amplitude/delay-based quantization

The HIST extension of the POS algorithm concerns the quantization phase described in (2.12), are performed independently for each bin b ∈ {1, 2, ..N b }.

hist b (pos i k (s[n])) = pos i k (s[n]) if k = odd ¬pos i k (s[n]) if k = even , i k ∈ I b (2.12)
where ¬ is the negation operator and I b = {i 1 , i 2 , ...} is the set of ordered iteration steps (indexed by k) that correspond to the extracted bits in bin b. The result consists in a dynamic encoding of the samples depending on the threshold at which they are extracted.

The new algorithm is illustrated on an example with one arbitrary bin (see The result of applying this kind of post-processing is equivalent to a dynamic encoding of the negative and positive amplitudes as a function of the absolute value and the delay index or bin of the sample. With POS, the negative amplitudes are always encoded as "0" and the positive amplitudes as "1", but with HIST the encoding convention varies across the observation window. As the samples are processed following the decreasing

Performance evaluation

We assess the performance of the initial bit extraction algorithm (POS) and the proposed extension (HIST) with standard indoor channels. The advantages in terms of randomness of POS with respect to one-level quantization [START_REF] Aono | Wireless Secret Key Generation Exploiting Reactance-Domain Scalar Response of Multipath Fading Channels[END_REF] or guard-band quantization [START_REF] Mathur | Radio-Telepathy: Extracting a Secret Key from an Unauthenticated Wireless Channel[END_REF] have already been observed using experimental traces [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF]. Here, the data are generated from statistical channel models, which account for the high density of multipath profiles in indoor IR-UWB channels. We consider in particular CM1 and CM2, according to the IEEE802.15.4a standard [START_REF] Molisch | A Comprehensive Standardized Bibliography 169 Model for Ultrawideband Propagation Channels[END_REF]. The initial pulse characteristics (i.e., central frequency of 4.5 GHz and 1 GHz bandwidth) are set so as to comply with both the FCC spectral mask and one of the mandatory bands of the 802.15.4a band-plan, but also with recent Chapter 2. Quantization of IR-UWB signals 44 low-power implementations of IR-UWB transceivers [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF]. The simulated sampling frequency has the same order as that of the experimental tests [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] [95] (20 GHz2 ) and the observation window has a duration of 100 ns. The following performance metrics have been retained:

• key agreement ratio defined as the success rate of key establishment, i.e., when final bits (after reconciliation) on both sides of the link are identical (computed over different IR-UWB channel realizations); an extension of this metric is the min. 64-bit key agreement defined as key agreement ratio with an additional constraint on the minimum key length (64 bits).

• mean key lengths computed for successful keys only (i.e., after reconciliation).

• mean bit agreement ratio between the two parties after the extraction phase and before reconciliation.

• mean number of different bits between POS encoding and HIST encoding (before reconciliation).

• random nature of the extracted keys, tested with bit periodicity tests and with the NIST test suite [START_REF] Burr | A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications[END_REF](before reconciliation).

The algorithms are first of all evaluated in a noiseless scenario, in which generated bits at A and B are always identical (i.e., the key agreement ratio is 1). The goal is to evaluate their intrinsic randomness properties, which depend on the transmitted waveform and on the multipath channel. Next, the reciprocity properties are discussed as a function of the SNR.

Random aspect evaluation with noiseless signals

Preliminary tests are performed on keys of minimum 128 bits generated with an initial scenario (CM1 channels, FD strategy). We analyze graphically the impact of the deterministic waveform on the generated bits and then, we apply the NIST tests. In the end, we show that the conclusions can be generalized to other scenarios.

First of all, the periodic nature of the extracted bits is tested using the Fast Fourier Transform (FFT) on each key. The regular bit pattern in POS is a consequence of the static encoding applied to the polarity of the waveform. The bits imitate the waveform's oscillations, which are determined by its central frequency. Therefore, when changing f c from 4.5 GHz to 2.5 GHz, HIST presents the same approximately white frequency aspect as before while POS

shows a dominant frequency of 0. The NIST suite is built upon the principles of statistical hypothesis testing, in which the null hypothesis is that a sequence is random, given the particular randomness feature.

Each test computes a relevant randomness statistic and an associated "p-value" representing the probability that a perfect random number generator produced a sequence less random than the tested sequence [START_REF] Burr | A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications[END_REF]. A key is said to pass the test when its computed p-value is higher than 0.01 (a common value for the level of significance of the test, i.e., the probability of rejecting the null hypothesis when it is true). Nonetheless, a given set of keys pass a certain test if a very large proportion of the keys pass the test (pass rate) and if the p-values of the keys are uniformly distributed in the (0,1)

interval. The need of p-value uniformity is explained with an example: at the limit, a constant p-value of 1 in the frequency test represents a 100% pass rate but also an equal proportion of ones and zeros, which means that from this point of view, the key is not entirely random. the problem of the p-value repartition with the trade-off of a more complex quantization scheme that can become less effective in practical SNR conditions.

Reciprocity evaluations with noisy signals

In Even at large SNR, significantly lower key agreement rates are achieved for HIST (24.5 % in comparison to 99.9% for POS). This is mainly due to the more complex encoding of amplitude information, which is more sensitive to both noise and synchronization errors and leads to a lower bit agreement before reconciliation. A mean bit agreement of 93.4% cannot be entirely corrected by the chosen Reed-Solomon code; an alternative would be to increase the correction capacities of the Reed-Solomon code with the drawback of having a higher bit agreement rate with an attacker that would also benefit from the error correction scheme. However, if privacy amplification techniques were applied, this issue would be solved with the drawback of obtaining less bits. due to the more complex encoding using the threshold information, but also to the key length constraint. POS does not experience the same phenomenon because it only encodes the polarity of the waveform, making it more robust to noise, but with a weaker random aspect. ∆ bin = 4, the mean bit agreement ratio is 80% for 10 dB and 73% for 5 dB).

∆ bin = 2, 20dB ∆ bin = 4, 20dB ∆ bin = 10, 20dB ∆ bin = 20, 20dB POS, 20dB ∆ bin = 2, 30dB ∆ bin = 4, 30dB ∆ bin = 10, 30dB ∆ bin = 20, 30dB POS, 30dB
∆ bin = 2, 20dB ∆ bin = 4, 20dB ∆ bin = 10, 20dB ∆ bin = 20, 20dB POS, 20dB ∆ bin = 2, 30dB ∆ bin = 4, 30dB ∆ bin = 10, 30dB ∆ bin = 20, 30dB POS, 30dB

Summary

In this section, we have studied several randomness aspects of physical layer key generation using directly sampled IR-UWB signals or channel estimations obtained by frequency deconvolution. We suggest a new bit encoding algorithm (HIST) based on the delay and amplitude information of each sample (i.e., bins and thresholds) in order to improve the random patterns of the generated keys, irrespective of any reciprocity constraints.

HIST is an invertible overlay to the adaptive-threshold quantization algorithm developed in previous studies [79] [95]. Its main advantage is to improve the random patterns of the keys suffering from deterministic characteristics of the input signal, such as the pulse waveform that contributes to the correlation between samples and therefore between bits. Finally, we test the algorithms over multiple 802.15.4a channel realizations and find that an acceptable mean bit agreement ratio can be obtained for the proposed solution over a range of medium to high SNR values.

NIST tests results also show that a pulse with a lower central frequency and a larger bandwidth should be preferred for randomness considerations. The advantage of a larger bandwidth is obvious because it offers higher channel resolution capabilities and thus "more" information. Employing a lower central frequency or sampling directly the envelope of the signal means having to lower the sampling frequency as well, which will lead to shorter keys. These aspects are however common to both initial algorithm and the proposed solution. In this context, we argue that HIST provides an improved encoding mechanism for high-sampling scenarios in which key length is a priority.

Keys from CIRs: reciprocity-randomness trade-off

As explained in the previous section, secret keys are preferably extracted from the channel coefficients that should be estimated after the channel probing phase. Thus, based on simulations, we examine the behavior of various generic quantization schemes applied to noisy channel estimates of an IR-UWB channel.

While in high-resolution or rate-distortion theory [START_REF] Gray | Quantization[END_REF] the "quantization" aims to reduce a certain distortion metric and the number of bits used to represent the quantized signal, in the key generation context a different trade-off arises. In former investigations on secret key quantization [START_REF] Patwari | High-Rate Uncorrelated Bit Extraction for Shared Secret Key Generation from Channel Measurements[END_REF], a new extraction algorithm and a suitable reconciliation scheme have been proposed in order to find a good trade-off between key length and reciprocity (i.e., the number of matching bits between the two parties). Nevertheless, the problem can have an additional optimization axis : the probability of occurrence of each codeword of the codebook used for quantization. These probabilities can be set to their optimal values, which correspond to equally distributed codewords [START_REF] Patwari | High-Rate Uncorrelated Bit Extraction for Shared Secret Key Generation from Channel Measurements[END_REF]. In this study, we will set the length of the codewords (relevant for, e.g., applications with fixed length constraints) and investigate the trade-off between reciprocity, as a measure of robustness, and codeword diversity, as a measure of randomness.

System model

The estimated CIR at each user, ŷu (t), is a noisy version of the standard multipath model, considering noise on the amplitudes of the channel coefficients:

ŷu (t) = h(t) + w u (t) (2.15) h(t) = K k=1 x k δ(t -τ k ) (2.16) w u (t) = K k=1 w u k δ(t -τ k ) (2.17)
where u ∈ {A, B}, K is the number of estimated multipaths, x k is the channel tap (or equivalently, the small-scale amplitude) of the k-th multipath, w u k is the estimation noise at user u for the k th multipath and τ k is the excess delay of the k th multipath. The noise is generated from a synthetic noise model, meaning it does not correspond to the noise issued from a real channel estimator.

In order to generate a binary sequence, we apply a quantization algorithm to the K

samples y u k = x k + w u k considered as realizations of the independent RVs Y u k = X k + W u k
, with X k the RV modeling the channel taps at excess delay τ k and W u k ∼ N (0, σ 2 0 ) the RV modeling the hypothetical estimation noise at excess delay τ k .

The employed guard-band quantization algorithm, which is allowed to vary as a function of the excess delay, is defined by :

• a binary Gray codebook of 2 b valid binary codewords and one invalid codeword corresponding to the guard-band interval :

C = {c j ∈ {0, 1} * |len(c j ) = b, j ∈ {-2 b-1 , . . . -1, 1, . . . , 2 b-1 }} ∪ {c 0 }.
• the respective inferior and superior quantization thresholds delimiting each quantization cell :

θ inf = {θ inf j |j ∈ {-2 b-1 . . . 2 b-1 }, θ inf 0 = -σ 0 , θ inf -2 b-1 = -∞} and θ sup = {θ sup j |j ∈ {-2 b-1 . . . 2 b-1 }, θ sup 0 = σ 0 , θ sup 2 b-1 = ∞}.
The quantization cells are considered adjacent (θ sup j-1 = θ inf j ). For simplicity, we use θ j = θ inf j for j ≥ 1, θ j = θ sup j for j ≤ -1 and θ = θ inf ∪ θ sup for obvious symmetry reasons. This leads to the representation in Figure 2.6.

• a quantization rule : q key (y) = c j if y ∈ [θ inf j , θ sup j ).

... ... In the following, we set the length of the codewords to a fixed value b and we define two types of reciprocity and diversity metrics: inter-key metrics (computed at a fixed excess delay τ by averaging over noise and channel realizations) and intra-key metrics (computed for one channel realization by averaging over the present channel taps). The inter-key metrics characterize the robustness and randomness properties of an "average" codeword generated at a given excess delay and are employed for the design of delayadaptive quantization schemes (Sections 2.3.3). The intra-key metrics can measure the performance of a given quantization scheme applied to a single channel estimation (Section 2.3.4).

Inter-key reciprocity and diversity

The small scale amplitudes |x k | are modeled using a m-Nakagami distribution in the IEEE 802.15.4a standard [START_REF] Molisch | A Comprehensive Standardized Bibliography 169 Model for Ultrawideband Propagation Channels[END_REF]. In order to have tractable formulas and to take into account the sign of the channel tap, we adopt a Gaussian mixture approximation for the RV X k . This model should represent the equally distributed positive and negative multipath components. As we are interested in the average behavior at a certain excess delay τ , we will denote by n the index of this uniformly sampled excess delay and we will focus on the typical channel tap at τ , namely X n . According to this convention, k represents the index of the existing paths in one channel realization whereas n is the index corresponding to the sampled excess delay irrespective of any channel realization. The performance metrics per valid codeword at fixed excess delay n are:

X n ∼ 1 2 N (-µ n , σ 2 n ) + 1 2 N (µ n , σ 2 n ) (2.
• mean Hamming distance between two valid codewords C A n and C B n (to be minimized):

HD(n, θ) = E Xn [E Wn [hd(C A n , C B n )|C A n , C B n = c 0 ]] (2.19)
• spread of valid codewords (to be minimized):

CS(n, θ) = std({P u,1 n , P u,2 n , ..., P u,2 b n }) (2.20) P u,j n = P(C u n = c j |C u n = c 0 ) (2.21)
with C u n the codeword issued from the quantization on b n bits of the n th sample at user

u, hd(c 1 , c 2 ) = |{k|(c 1 ) k = (c 2 ) k }|, (.) k the k th bit of a codeword.
We also define a tunable scalar cost function used to study the trade-off between reciprocity and diversity by varying the relative importance of the components using the weight λ according to Eq. (2.22). The reciprocity component is normalized with respect to a fixed number of bits b n = b and the diversity with respect to its maximum value (i.e., the standard deviation of a repartition with one codeword appearing with probability 1).

L(λ, n, θ) = (1 -λ) HD(n, θ) b + λ 2 b • CS(n, θ) √ 2 b -1 (2.22)
The above-mentioned reciprocity (HD) and diversity (CS) metrics depend on the binary codebook, on the statistical model of Y u as well as on the quantization thresholds. For our investigations, we arbitrarily choose a Gray codebook on b n = 3 bits assuming that

X

Intra-key reciprocity and diversity

The same reciprocity and diversity metrics can be defined per channel realization by averaging over the existing paths in the given channel (Eq. (2.23)-(2.24)). The result Chapter 2. Quantization of IR-UWB signals 54 can be subsequently averaged over channel realizations. These definitions are simulationoriented and do not require an analytical model for the distribution of the channel taps.

HD 1 (θ) = E k [hd(C A k , C B k )|C A k , C B k = c 0 ] (2.23) CS 1 (θ) = std({P 1 , P 2 , ..., P 2 b }) (2.24)
with P j representing the probability of occurrence of codeword c j within the codewords generated from one channel realization.

The intra-key reciprocity-randomness trade-off is investigated in Sections 2.3.4-2.3.5.

Quantization thresholds

This subsection presents the various threshold computation methods that have been employed in the present study.

Uniform and non-uniform quantization

Several quantization techniques with the same guard-band intervals (i.e., θ inf

0 = θ -1 =
-σ 0 and θ sup 0 = θ 1 = σ 0 ) are considered:

• uniform quantization (UQ) : the quantization intervals for each codeword have a fixed width ∆q.

• quantile-based quantization (QQ): the quantization thresholds are computed a priori in order to achieve a specific codeword repartition. A uniform repartition of all the codewords (eq: P u,j n = 1/9 for any j, n) and a non-uniform repartition (ineq: P u,-1 n = P u,1 n = 40% for any n) are given as examples.

• companding-based quantization (CQ): inspired by the work on companders [START_REF] Smith | Instantaneous Companding of Quantized Signals[END_REF],

the initial samples are transformed with an exponential function and the output is quantized uniformly. The employed "expanding" function is the inverse of the µ-law function [START_REF] Smith | Instantaneous Companding of Quantized Signals[END_REF] with range [-1, 1]: and the reciprocity improved.

exp(y n ) = sgn(y n ) ((1 + µ) |yn| -1) µ (2.
To sum up, the UQ and CQ methods have fixed quantization thresholds, while the QQ thresholds are dynamically computed as a function of the desired codeword distribution and the excess delay n.

Optimization of the quantization thresholds

The optimization of a multi-objective function {HD(θ), CS(θ)} can be achieved using a scalarization technique (O 1 ) or a constraint-based method (O 2 ) [START_REF] Caramia | Multi-objective Management in Freight Logistics Increasing Capacity, Service Level and Safety with Optimization Algorithms[END_REF].

(O 1 ) : minimize θ L(λ, θ) s.t θ j ≤ θ j+1 , j ∈ {1, 2, 3} θ j = -θ -j , j ∈ {2, 3, 4} (2.26) (O 2 ) : minimize θ HD(θ) s.t θ j ≤ θ j+1 , j ∈ {1, 2, 3} θ j = -θ -j , j ∈ {2, 3, 4} CS(θ) ≤ c (2.27)
with c an a priori constraint parameter on the diversity metric.

Performance evaluation I

Reciprocity-diversity trade-off

We analyze the expected trade-off between reciprocity and codeword diversity computed using Eq. In conclusion, on the one hand, fixing the codeword diversity like in the QQ case requires specifying the distribution of each codeword, which is unnecessary because, from the application point of view, the interest lies in the spread metric. On the other hand, using strategies like UQ and CQ gives no control on the final trade-off and no indication of the optimality of the scheme. To respond to these constraints, in the next section we present the results of an optimization study on the quantization thresholds. For both SNR values, we observe a sudden variation of the threshold values from small to large λ which corresponds to a bi-static behavior of the general cost function L(θ): at small λ values, the reciprocity is optimized (i.e., only one codeword is generated) while at high λ the codeword diversity is optimized (i.e., uniformly distributed codewords).

For SNR 1 , the optimization routine is able to find an intermediate point corresponding to the statistical domination of two codewords, but this is not the case for SNR 2 . This means that O 1 is not efficient to look for a good compromise solution between reciprocity and diversity, especially since there is no direct a priori link between λ and the relative All the other methods (CQ, QQ, UQ) achieve usually higher costs. The uniform quantization (UQ) parameterized with 36 different quantization steps between 0.05 and 0.4 presents an interesting behavior for SNR 1 : the performance for certain quantization widths (∆q ≥ 0.16) is close to that of the optimal points found by O 2 . This means that, for certain SNR and constraint values, we can simplify the problem and compute optimal uniform quantization steps, which would achieve the same performance as the resolution of O 2 .

Diversity-aware quantization

After the study of inter-key reciprocity and diversity in Section 2.3.3, this section presents a quantization scheme, entitled DIV, that improves the intra-key diversity metric based on a circular dictionary rotation as a function of the excess delay.

The proposed method is an adaptation of the one-bit HIST algorithm for directly sampled signals (Section 2.2) to a general multi-bit quantization scheme while considering a simplified model for noisy estimated multipath components. We recall that HIST produces keys with better randomness properties because of its diversified encoding based on the amplitude and on the delay of the quantized samples. This can be considered as a form of intra-key diversity since it implies a change in the probabilities of occurrence of the one-bit binary codewords employed by the existing algorithm POS.

We consider the noisy channel estimate model from Eq. (2.15) with noise only on the multipath amplitudes and a uniform-threshold quantization scheme (UQ) on b bits of step ∆ q . Accordingly, each channel realization produces K noisy samples y u k for quantization. In this study, we consider the same quantization thresholds regardless of the excess delay τ k of the quantized sample y u k .

The proposed DIV scheme operates as indicated in Figure 2.12. The excess delay axis is split into bins of width ∆ bin and the quantization dictionary varies from one bin to another by means of a rotation. The samples are quantized depending on their excess delay τ k by using the dictionary corresponding to the bin in which they fall. We denote as FIX the alternative fixed-dictionary guard-band quantization in which the dictionary is the same irrespective of the excess delay. This means that DIV can help to recover some of the encoding diversity lost when increasing the quantization bin in order to obtain more reciprocal sequences.

In order to create intra-key codeword diversity, DIV relies on the information given by the temporal delays of the multipath components. When the corresponding estimates are also corrupted by noise, the performance of DIV in terms of reciprocity will be lower.

The impact of realistic channel estimates on reciprocity is the focus of Section 2.4.

As already mentioned in Section 2. Chapter 2. Quantization of IR-UWB signals 62

Summary

In this section, we focused on simulated IR-UWB channel estimates in order to investigate typical trade-offs that arise in the process of fixed-length quantization for key generation purposes. We have introduced a practical way of quantifying randomness based on the probabilities of occurrence of binary codewords at a fixed excess delay (inter-key diversity) or over an entire IR-UWB channel estimation (intra-key diversity).

It should be noted that despite their similar flavor, the inter-key and intra-key metrics characterize different phenomena inherent to key generation using IR-UWB-like signals (i.e., amplitude-delay pairs).

In the first case, the amplitude quantization thresholds can be adapted as a function of the excess delay in order to achieve a desired trade-off between inter-key reciprocity and diversity. The threshold computation is performed through an optimization procedure based on the statistics of the IR-UWB channel and of the noise. It is therefore an a priori design method for "on average" optimal thresholds. Furthermore, we show that there exist uniform quantization steps achieving the same trade-offs as that of the optimized thresholds, which could potentially reduce the complexity of the quantization design step. In the second case, given the same uniform quantization step for the entire channel estimation, we illustrate an intra-key diversity-aware quantization scheme based on a delay-adaptive encoding dictionary. The proposed algorithm does not require identical quantization thresholds over the excess delay, so we can also use the computed thresholds in order to achieve the desired inter-key reciprocity and diversity trade-off. The mixed scheme would be characterized by the following:

• for each excess delay, we can choose beforehand the thresholds that achieve the desired inter-key reciprocity-diversity trade-off, meaning that, on average, some of the codewords will be likely to appear more often than others.

• when quantizing one particular channel estimate, the dictionary is varied circularly so that there are delay-dependent variations in the codewords that are more likely to appear.

The expected effect can be summarized as: decreasing diversity to achieve more reciprocity and then re-boosting diversity. However, this should be confirmed by further studies meant to investigate the interaction between the inter-key diversity and intrakey diversity and possibly extend them to incorporate more complex randomness aspects inspired, for example, by the NIST tests [START_REF] Burr | A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications[END_REF].

To conclude with, in this section, we have shown the interest of using statistical or absolute delay information for designing more robust quantization schemes. However, the findings may be limited by the necessity to operate with a priori known and reliable statistics in a given environment or by the channel estimation performance of real devices and multipath extraction algorithms. The latter will be investigated in the next section.

Keys from CIR estimates: impact on reciprocity

As already explained, an IR-UWB CIR is in theory a promising source of information for shared secret key generation [START_REF] Wilson | Channel Identification: Secret Sharing Using Reciprocity in Ultrawideband Channels[END_REF] However, the main challenge is the way a receiver, usually limited in sampling frequency, representation dynamics or computational capabilities, can perceive the channel. This channel representation is the output of the channel probing phase and the input of the key quantization algorithm. Therefore, the reciprocal character of such signals is necessary for the study of key generation procedures using IR-UWB waveforms. In the present model, the degradations in the reciprocity of the inputs are caused by conventional additive noise on the received signal. However, a real system would also suffer from unbalanced radio frequency (RF) chains, antenna matching problems, non-linearities etc.

on top of noise.

In this section, we start with an overview of channel estimation methods applicable to IR-UWB channel impulse responses. Then, we analyze the reciprocal character of IR-UWB channel estimates obtained with various types of estimators offering different trade-offs in terms of performance/complexity/hardware requirements: a high-resolution correlation-based estimator [START_REF] Gifford | Effect of Bandwidth on the Number of Multipath Components in Realistic Wireless Indoor Channels[END_REF] and two sparse channel estimation methods [107] [111].

Finally, we infer a practical post-processing mechanism that can be applied to these signals before quantization in order to improve their reciprocity.

State of the art: channel estimation

Because of the high bandwidth occupied by IR-UWB communications, synchronization and channel estimation typically require high sampling rates of the order of tens of GHz. Moreover, in dense multipath environments (e.g., indoors), which we are mainly interested in, the number of parameters to estimate (i.e., delays and amplitudes) can

High-resolution methods

The first category includes the channel estimation algorithms that require sub-pulse sampling resolutions. Maximum-likelihood (ML) estimators for the amplitudes and delays are described for single-pulse channel sounding [START_REF] Win | Characterization of Ultra-Wide Bandwidth Wireless Indoor Channels: a Communication-Theoretic View[END_REF] and (non-) data-assisted [START_REF] Lottici | Channel Estimation for Ultra-Wideband Communications[END_REF] scenarios. These estimators can be applied in high-complexity Rake receivers.

Joint synchronization and channel estimation can be achieved by a least-squares estimator, which takes into account the clustered channel structure computed in advance with a subspace detection method [START_REF] Carbonelli | Synchronization and Channel estimation for UWB Signal[END_REF]. This method assumes knowledge of the multipath order and an upper bound on the maximum excess delay.

Blind channel estimation for PPM transmissions is solved by exploiting the first-order cyclostationarity property of the received signal [START_REF] Wang | Ultra Wide-Band Communications with Blind Channel Estimation Based on First-Order Statistics[END_REF]. 3 In this particular case, the mean over multiple equally distributed symbols of PPM transmissions is exploited to derive the CIR in a blind scenario. The proposed solution involves an FFT-based circular deconvolution.

More recent work on single-pulse channel estimation introduces the iterative detection of the multipaths delays and gains by splitting the ML estimate of the CIR [START_REF] Win | Characterization of Ultra-Wide Bandwidth Wireless Indoor Channels: a Communication-Theoretic View[END_REF] in two iterative steps: i) suboptimal search of the channel delays using a correlation-based method for resolvable paths; ii) computation of the channel gains based on the previously estimated delays. A variant of this approach is called the "search-subtract-readjust" algorithm introduced in [START_REF] Falsi | Time of Arrival Estimation for UWB Localizers in Realistic Environments[END_REF] for characterizing the ranging precision of UWB localizers and exploited in [START_REF] Gifford | Effect of Bandwidth on the Number of Multipath Components in Realistic Wireless Indoor Channels[END_REF] for evaluating the number of detectable multipaths in indoor channels. In our reciprocity evaluations, we will employ this channel estimation method, which, at each iteration step, readjusts all the previously estimated gains as a function of the newly estimated delay.

The aforementioned solutions consider the "sparse" channel model described in the standardization literature [START_REF] Molisch | A Comprehensive Standardized Bibliography 169 Model for Ultrawideband Propagation Channels[END_REF]. This model is extended to include "diffuse" components [START_REF] Michelusi | Hybrid Sparse/Diffuse UWB Channel Estimation[END_REF] modeled as Gaussian variables and adapted Bayesian channel estimation algorithms are introduced. Firstly, the nominal algorithm finds the parameters of the sparse components with an ML estimator consisting in an iterative Expectation-Maximization routine. Then, it estimates a complete hybrid channel estimation using MMSE or MAP estimators.

Low-resolution methods

In order to reduce sampling frequencies, an analog estimation of the aggregated CIR4

is proposed for communication systems with a target demodulation sampling rate equal to the frame rate [START_REF] Yang | Optimal Pilot Waveform Assisted Modulation for Ultra-Wideband Communications[END_REF]. The resulting pilot waveform assisted modulation (PWAM) is inspired by the Transmitted Reference signaling.

Channel estimation for non-coherent energy detection (ED) receivers is translated into a

Power Delay Profile (PDP) estimation problem [START_REF] Geiger | Enhanced-Accuracy Channel Estimation and Ranging for IR-UWB Energy Detectors[END_REF]. The system employs multiple pulse transmissions and a phase offset between the sampling of consecutive pulse repetition periods in order to obtain a combined higher resolution image of the channel compared to typical ED resolutions. The image of the channel represents either a low-pass version of an aggregated PDP 5 or the estimated aggregated PDP by equalization of this low-pass version.

In low-complexity devices, such as the 500-MHz DBPSK transceiver [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF] with 1Gbps direct sub-sampling and "1.5-bit" classical quantization, an image of the CIR can be obtained after differential digital correlations and accumulation of the correlation results over repetitions of a PN sequence on the received sequence.

These lower-complexity solutions will not be evaluated in this work because they either do not provide access to a digital CIR [START_REF] Yang | Optimal Pilot Waveform Assisted Modulation for Ultra-Wideband Communications[END_REF] or the channel estimation phase outputs signals with successive correlated samples [START_REF] Geiger | Enhanced-Accuracy Channel Estimation and Ranging for IR-UWB Energy Detectors[END_REF]. In other cases, the resulting signals [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF] have specific structure and dynamics requiring the design of adapted quantization metrics. 6

Finite Rate of Innovation

Classical sampling and reconstruction theorems put forward by e.g., Shannon, Whittaker, Nyquist, state that a band-limited signal can be perfectly recovered by uniform sampling at a rate higher than two times the maximum frequency present in the signal. This is actually one possibility for recovering the information contained in a band-limited signal. Since then, generalized sampling theorems involving for example, band-pass sam- The described method involves a root finding operation applied to the annihilating filter, which results in an ill-conditioned problem in the presence of noise. An alternative subspace method is proposed in order to apply sub-Nyquist FRI sampling to noisy signals [START_REF] Maravić | Sampling and Reconstruction of Signals with Finite Rate of Innovation in the Presence of Noise[END_REF] [122], such as received IR-UWB signals with the aim of estimating the CIR [START_REF] Maravić | Channel Estimation and Synchronization with Sub-Nyquist Sampling and Application to Ultra-Wideband Systems[END_REF]. This solution exploits a matrix composed of the Fourier coefficients X[m], the fact that its rank is K in the case of noiseless data and the shift-invariance property of particular subspaces of this matrix. 8 More details on the algorithm [START_REF] Maravić | Channel Estimation and Synchronization with Sub-Nyquist Sampling and Application to Ultra-Wideband Systems[END_REF] implemented in our evaluations are given in Section 2.4.3. However, the frequency-domain processing may be questionable in low-complexity IR-UWB devices operating primarily in the time domain.

Compressed Sensing

The aforementioned FRI [START_REF] Vetterli | Sampling Signals with Finite Rate of Innovation[END_REF] [START_REF] Vetterli | Sampling in the Age of Sparsity[END_REF].

Compressed Sensing fundamentals Given an orthonormal basis Ψ = {ψ n , n = 1, . . . , N }, a signal x ∈ R N is considered to have sparse coefficients 9 In the context of CS, this definition is extended to the l 0 "norm", which represents the number of non-zero coefficients denoted as K N , i.e., the orthodox connotation of "sparse". This condition represents the sparsity requirement [START_REF] Candes | An Introduction To Compressive Sampling[END_REF], which in the IR-UWB case is equivalent to the aforementioned degrees of freedom of our signals, i.e., the cardinality of the multipath components.

θ n = x, ψ n if ||θ|| p ≤ R, 0 < p < 2 , R > 0 [125].
The second necessary requirement is the incoherence between the sparsifying basis Ψ and the sensing basis Φ = {φ m , m = 1, . . . , M }, which means that, unlike the signal of interest x, the sensing kernels φ m must have dense representations in Ψ. An example of incoherent basis pairs is the Dirac basis and the Fourier basis [START_REF] Candes | An Introduction To Compressive Sampling[END_REF]. Random matrices are deemed to be largely incoherent with any fixed sparsifying matrix Ψ [START_REF] Candes | An Introduction To Compressive Sampling[END_REF]. So by using a random sensing matrix, CS methods do not need to be adapted to the signal of interest. 9 The lp norm of θ is defined as ||θ||p = ( n |θn| p ) 1/p .

Using M < N samples y m = x, φ m , the reconstructed signal is x = Ψ θ where θ = argmin (2.28)

Note that the sparsity condition is translated into a l 1 minimization problem with linear constraints [START_REF] Candes | An Introduction To Compressive Sampling[END_REF], which is easier to solve than the initial problem. In the noiseless case,

if the signal x is K-sparse in Ψ and M ≥ c • µ 2 (Φ, Ψ) • K • log(N/δ)
, where c is a constant and the function µ is a measure of the incoherence between two basis, the solution to Eq.

(2.28) is exact with probability 1 -δ. It can be found by the Basic Pursuit algorithm (BP) or greedy algorithms such as Matching Pursuit (MP) or Orthogonal Matching Pursuit (OMP).

In the noisy scenario or when the signal x is nearly sparse (i.e., the N -K coefficients are small but not exactly zero), an additional condition is imposed: the Restricted Isometry Property (RIP). In order to be able to reconstruct K-sparse signals θ from the samples y = Φx + z = ΦΨθ + z, where z is the noise term, these vectors should not be in the null space of the matrix ΦΨ [START_REF] Candes | An Introduction To Compressive Sampling[END_REF]. Linear programming methods for the noisy case include Basic Pursuit Denoising (BPD), which adds a penalty term to the cost function in Eq.

(2.28).

IR-UWB Compressed Sensing algorithms

The received IR-UWB signal can be considered sparse in a "pulse" basis, i.e., a dictionary composed of delayed pulses [START_REF] Paredes | Ultra-Wideband Compressed Sensing: Channel Estimation[END_REF]. By random time sampling at an equivalent M/N = 0.36 and MP reconstruction, both CS-based proposed receivers (a Rake-like receiver using CIR estimations and a correlator-based receiver using aggregated CIR estimations) outperform the correlatorbased receiver described in [START_REF] Yang | Optimal Pilot Waveform Assisted Modulation for Ultra-Wideband Communications[END_REF] in terms of BER. The described CS algorithm for CIR estimation with a dictionary of delayed pulses will be used in our evaluations.

In a spread spectrum CS based approach for IR-UWB CIR estimation [START_REF] Naini | Compressive Sampling of Pulse Trains: Spread the Spectrum![END_REF], the authors propose to modulate the received IR-UWB signal with a pseudo-random sequence in order to spread the spectrum. The result is then randomly sampled in the Fourier domain and the received signal is reconstructed using a dictionary of delayed pulses via BPD l 1 minimization. An additional frequency sensing technique for ToA and channel estimation and a new reconstruction algorithm inspired by OMP are proposed in [START_REF] Lagunas | Sparse Channel Estimation Based on Compressed Sensing for Ultra Wideband Systems[END_REF] and compared to the aforementioned ones [107] [127]. This new CS solution achieves a trade-off between path detection accuracy and convergence speed.

The CS sensing framework can be combined with the noise statistics formulation of the ML estimator from [START_REF] Lottici | Channel Estimation for Ultra-Wideband Communications[END_REF] in order to achieve reliability performance in terms of BER close to that of the ML estimator but at a lower sampling rate [START_REF] Liu | Compressed Sensing Maximum Likelihood Channel Estimation for Ultra-Wideband Impulse Radio[END_REF]

System model

We consider two communicating parties (A and B) and a received signal and channel models similar to the ones described in Section 2.2.1:

y u (t) = (h * p)(t) + w u (t) (2.29) h(t) = K k=1 x k δ(t -τ k ) (2.30)
where u ∈ {A, B}, p(t) is the transmitted pulse waveform with central frequency f c and bandwidth B, h(t) is the reciprocal CIR with K multipaths of amplitudes x k and excess delays τ k generated according to the IEEE 802.15.4a, w u (t) is a random processes of zero-mean Gaussian white noise with double-sided power spectral density N 0 /2, which is filtered in the band B of the transmitted signal and has variance σ 2 w = N 0 /2 × 2B. As before, we define the SNR as:

SNR = 1 T T 0 (h * p) 2 (t) dt σ 2 w (2.31)
We denote the sampled version of y(t) at sampling rate F s as y and its length as M .

After sampling, the signal is processed independently at A and B with three different

Channel estimators and pairing issues

Channel estimators

Matched Filter estimator (MF) Given a received signal and a pulse template, the MF algorithm [START_REF] Gifford | Effect of Bandwidth on the Number of Multipath Components in Realistic Wireless Indoor Channels[END_REF] iteratively detects and substracts the most representative paths found in the signal. The operation is based on the output of the cross-correlation between the received signal and delayed versions of the pulse template, which gives access to the estimated path delay. The channel gains are jointly readjusted at each iteration.

Finite Rate of Innovation estimator (FRI) For FRI evaluation, we implement the subspace method from [START_REF] Maravić | Channel Estimation and Synchronization with Sub-Nyquist Sampling and Application to Ultra-Wideband Systems[END_REF]. Based on an a priori targeted number of samples M , the received signal is filtered with a band-pass filter and sub-sampled. Then, the Fourier Transform is applied to y and the M FFT coefficients Ĥ of the searched signal ĥ are obtained after division by the FFT coefficients of the pulse. The resulting vector is arranged into a P × Q Hankel matrix H10 with P + Q -1 = M , P, Q ≥ K. The matrix H, which has a a rank equal to K in the noiseless case, is decomposed with an SVD operation and divided into a signal subspace of dimension K indexed by s and a noise subspace indexed by n:

H = U s Λ s v T s + U n Λ n v T n (2.32)
The matrices U and v satisfy the shift-invariance subspace property, i.e., they have a Vandermonde structure 11 dependent on e -2πjτ k /T . This allows the computation of τk after matrix manipulations on v s or U s . The path amplitudes xk are then estimated from:

Ĥ[m] = K k=1 xk e -2πjmτ k /T , ∀m ∈ {1, . . . , M } (2.33)
Compressed Sensing estimator (CS) The CS estimator inspired from [START_REF] Paredes | Ultra-Wideband Compressed Sensing: Channel Estimation[END_REF] uses a random standard Gaussian sensing matrix Φ in order to acquire M noisy samples y = Φy. The sparsifying matrix Ψ contains the dictionary of delayed pulses with an arbitrary temporal resolution for the delay (e.g., 0.5 ns in our case). Note that this is a digital resolution and is independent of the ADC resolution used for signal acquisition.

Then, a variant of the Matching Pursuit algorithm is implemented based on: y = ΦΨ ĥ.

This algorithm is similar to the MF estimator with the exception that the processing is realized in another domain and the amplitudes are not readjusted at every path detection. Also, the random sensing matrix should be the same for the bidirectional channel estimations.

Pairing of estimated multipath components

Based on our observations, an estimated CIR ĥu can contain misdetected paths or fail to detect paths that are detected on the other side of the link (Figure 2.17(a)). In order to avoid complete desynchronization of the sequences meant for quantization, we propose an heuristic pairing algorithm that involves the public exchange of the estimated excess delays associated with the estimated paths. 12 This means that the delay information cannot be used for quantization anymore and that schemes, such as HIST or DIV, cannot be applied after pairing. The pairing algorithm is detailed in Alg. 2, where xu is the vector of estimated path amplitudes at u, tu is the vector of estimated path delays, and a u is the vector of path amplitudes after pairing. The number of estimated paths is denoted as K in the following.

Data: xA , tA , tB Result: a A initialization pairing vectors v A and v B ;

for i = 1, . . . , K do find tB [j] closest to tA [i]; do v A [i] = j; find tA [j] closest to tB [i]; do v B [i] = j; end find I = {i|1 ≤ i ≤ K, v B [v A [i]] = i} ; set a A = xA [I] ;
Algorithm 2: Path pairing algorithm for CIR estimates (at A)

Performance evaluation

For our evaluations, we employ the following parameters and estimators:

• Signal and channel parameters: f c = 4.5 GHz, B = 1 GHz, 1000 channel realizations according to the IEEE 802.15.4a CM1 model;

• Estimators: MF (a pseudo-analog matched filter estimator at F s = 100 GHz), MF10 (an MF at F s = 10 GHz), MF20 (an MF at F s = 20 GHz), CS and FRI at the same F s ∈ (3.6, 3.7) GHz; 13• Quantization: an arbitrary two-bit quantization scheme with uniformly distributed codeword probabilities applied to the concatenated values issued from the CIR estimation phase (before or after pairing).

We evaluate the reciprocity before quantization through the inter-estimate RMSE metric from Eq. (2.34), where xu can be replaced by âu for the RMSE after pairing. This metric characterizes only the reciprocity errors regardless of the channel estimation performance (e.g., a similarly misdetected path on both sides of the link does not impact the key generation performance). For comparison purposes, the RMSE A,B for each estimator is normalized with respect to the RMSE A,B of the MF estimator. After quantization, we also compute the mean bit agreement ratio obtained after averaging the bit agreement of the quantized sequences for each channel realization. As expected, from the reconstruction point of view, the MF estimator performs the best (Figure 2.16) and exhibits the most "natural" CIR structure (Figure 2.17). However, it is also the most sensitive in terms of reciprocity of the paths (Figure 2.17(a)) because of several polarity inversions, which occur at the matched filter output, and one misdetected path. More details on the impact of the various sampling rates on the MF estimators are provided in the next section.

RMSE A,B = E h(t) [RMSE(x A , xB )] = E h(t) [ K k=1 (x k,A -xk,B ) 2 K ] ( 2

Excess delay (ns)

We also observe that the FRI estimator (Figure 2.17(d)) produces reciprocal excess delays but relatively noisy amplitude estimates. This behavior could be explained by the harmonic approach of initially retrieving the excess delays based on a subspace method, which seems favorable to reciprocity, and then computing the corresponding amplitudes.

Although the order of the strongest FRI-sensed paths is reciprocal (SVD operation and signal space detection), sometimes small errors appear on the excess delays and are later translated to polarity inversions in the amplitudes computed in the time domain. Given the true dense channel from Figure 2.15, we conclude that all the estimators fail in absolute to retrieve the true multipath components because of the inherent limitations of the pulse resolution. However, they are able to recover different images of the channel. These images can be reciprocal and have different structures that are characteristic to each estimator and its parameters (e.g., sampling frequency, extraction algorithm, random sensing matrices for CS).

Reciprocity evaluation

In this subsection, we evaluate the RMSE A,B for two configurations: fixed SNR and variable K and fixed K and variable SNR. Next, we fix K to the maximum number of detectable paths with the present sparse implementations (i.e., 18) and we look at the reciprocity evolution with the SNR (Figure 2.21). We conclude that before pairing the methods have equivalent performance, but after pairing an obvious gap is created between the CS and the MF estimators. Also, the value of the normalized RMSE A,B is systematically lower than 1, meaning that in terms of reciprocity the ranking of the methods is the following: CS, MF10 and MF20, and MF. This seems counter-intuitive at first because higher sampling rates should mean better performances, but this result becomes more explicit when recalling the illustrative example from Figure 2.17. MF methods, especially the ones at higher F s suffer from polarity inversions of certain path estimates. This is due to noise and it happens systematically when the error on the estimated delay is of the order of an odd multiple of 1/2f c . In other words, any inner oscillation of the unitary waveform (i.e., at the center frequency f c ) may be misinterpreted as the center of this waveform because of noise.

In Figures 2.

K

Normalized estimation RMSE CS-L MF10-L MF20-L CS-H MF10-H MF20-H

MF methods with higher temporal resolutions are more sensitive to these phenomena since the maximum of correlation might not be detected in the same way on both sides of the link.

Nevertheless, the advantage of lower-sampling methods in terms of reciprocity does not come without a drawback. Regarding the visual structure of the estimated CIR from Figure 2.17, when the channel is represented less faithfully, its inherent randomness is less well captured, so sparse-sampling methods could suffer from randomness defects.

Bit agreement evaluation

In order to confirm our previous findings and verify the prohibitively low reciprocity of FRI estimates, we plot the average bit agreement ratios for all the estimators at K = 18 before pairing (Figure 2.22) and the respective bit agreement gains after pairing (Figure 2.23). The FRI RMSE A,B results varying between 0.5 and 0.6 confirm that the implemented FRI estimator is less stable or too sensitive in terms of noise. Although the phenomena involved in the FRI estimation process are less transparent because it uses spectral methods, the presumed noise sensitivity indicates that temporal methods should be preferred from a reciprocity point of view for estimates of temporal signals.

Also, the estimator ranking observed in Figure 2.21 still holds for the bit agreement results as shown by the results of the gain after pairing (Figure 2.23). It can also be noted that the pairing has a powerful impact especially for CS at medium SNR values because at lower SNR pairing is not sufficient, while at high SNR it is less needed.

Summary

In this section, we examined the reciprocity degradation incurred by realistic CIR estimates. We compared three estimators: a high-resolution matched filter requiring Nyquist or higher sampling rates, a compressed sensing algorithm, and a spectral method for sparse signal reconstruction. The MF methods are simple to implement, but require high sampling rates and the reciprocity is often deteriorated by misdetected paths. The FRI estimator has low performance in noisy cases and its Fourier-domain implementation along with the SVD operations require important computational capabilities. CS estimates achieve acceptable reciprocity but there are still open questions concerning the associated receiver architecture (e.g., implementation of the sensing part, choice and sharing of the random sensing matrix). Finally, we propose a pairing algorithm based on the exchange of estimated excess delays in order to avoid the mismatching caused by the misdetected paths. This part of our work has been inspired by the study of the theoretical performance of unbiased IR-UWB channel estimators [START_REF] Sahinoglu | Ultra-Wideband Positioning Systems: Theoretical Limits, Ranging Algorithms and Protocols[END_REF]. The authors derive the expressions of the Cramer-Rao Lower Bounds (CRLB) characterizing the accuracy of excess delay and amplitude estimates given the true multipath channel and a certain pulse used for probing. Initially, we aimed at creating a similar "CRLB model" meant to describe the theoretical reciprocity performance, equivalent of the estimation accuracy [START_REF] Sahinoglu | Ultra-Wideband Positioning Systems: Theoretical Limits, Ranging Algorithms and Protocols[END_REF], and compare it to the performance achieved by various estimators. This would mean explaining only the noise effect on a realistic bidirectional channel estimate. Because of pulse interference, a true multipath component could be wrongly but similarly estimated by the two users, which means that it would still contribute to the mutual information for key generation. As an example, if there is pulse overlapping because two paths have very close time of arrivals (e.g., reflections on two close-by pieces of furniture), an estimator cannot "solve" both of them and there would certainly be an error with respect to the true channel. However, since both estimators will do the same error, the

State of the art: information reconciliation

As already mentioned, we consider that a practical information reconciliation phase consists of two steps: i) a preliminary public discussion for sharing quantization-related information (e.g., indexes of dropped samples or information for asynchronous quantization); ii) error correction, after which the bits should be perfectly identical. We recall that all public exchanges are considered to be authenticated, which means that an attacker cannot tamper with the transmitted information or inject false information.

Preliminary public discussions are highly dependent on the key generation protocol, so we will focus on the one proposed in [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF], which involves exchanging the indexes of the dropped samples after quantization. Whereas for consecutive uncorrelated RSS measurements, such exchanges do not offer any advantage to an eavesdropper, in the case of directly sampled IR-UWB CIRs, samples are usually correlated and this information can provide indications about the structure of the legitimate signal. It is therefore preferable to protect this information if possible.

Although in this work we only investigate the first step of reconciliation, a short classification of error correction schemes is also presented for completeness purposes. There are two main types of error correction: iterative and non-iterative error-correction techniques. The iterative Cascade protocol employed in [START_REF] Jana | On the Effectiveness of Secret Key Extraction from Wireless Signal Strength in Real Environments[END_REF] is similar to the information reconciliation step of QKD (Section 1.2.2). It involves random permutation of the bits, divisions in small blocks and iterative exchanges of block parity information. We classify the non-iterative error-correction techniques based on their "philosophy".

• Distributed source coding approach or coding with side information. Typically, Alice maps her observations to codewords extracted from a codebook divided in cosets. The property of the coset organization is that the minimum distance between the elements of the cosets is maximized (i.e., the code"'words in a coset are "very" different). The indexes of the cosets are sent to Bob who uses them along with his observations to find the corresponding codewords. Possible implementations for this approach include: i) coset assignment through Reed-Muller block codes or trellis codes [START_REF] Wilson | Channel Identification: Secret Sharing Using Reciprocity in Ultrawideband Channels[END_REF]; ii) LDPC syndrome computation by Alice and syndrome-based decoding by Bob before or after quantization [START_REF] Liu | Exploiting Channel Diversity in Secret Key Generation From Multipath Fading Randomness[END_REF] iii) classical quantization of the measurements and transmission of the difference between the measured and the quantized values over the public channel [START_REF] Wilhelm | On Key Agreement in Wireless Sensor Networks based on Radio Transmission Properties[END_REF]. In the case of signal envelope quantization in IR-UWB [START_REF] Madiseh | Secret Key Generation and Agreement in UWB Communication Channels[END_REF], it is suggested to add a stage of bilateral independent LDPC decoding for better key agreement before reconciliation.

• Channel coding approach. After parallel quantization, Alice computes the parity check for her sequence with an error-correction code (e.g., Reed-Solomon codes [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF]) and sends it to Bob over the public channel. If the number of errors is not too large comparing to the error correction capabilities of the employed code, Bob can now correct the mismatches of his own binary sequence using the received parity information. For benchmarking purposes, we will employ the same errorcorrection scheme as in [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF].

Other more complex options for key reconciliation include compressive sensing algorithms, if we consider the difference between the users' quantized sequences as a sparse vector [START_REF] Shirazi | A Compressive Sensing Approach for Secret Key Agreement based on UWB Channel Reciprocity[END_REF] or neural networks with specific training algorithms corresponding to typical bit errors [START_REF] Karas | Channel Level Crossing-based Security for Communications over Fading Channels[END_REF]. The same study [START_REF] Karas | Channel Level Crossing-based Security for Communications over Fading Channels[END_REF] proposes a second reconciliation scheme for key generation from signal fades of envelope magnitudes: generating a pseudo-random bit sequence from the average fade length and using it as a mask before applying error correction. Similarly to our proposed solution POS ToF , this method also adds a supplementary layer of security against eavesdropping attacks. However, the mentioned work does not consider the impact of correlated channel observations of an attacker and it is specific to key generation procedures based on signal fades. Our public discussion strategy POS ToF does not operate at the error correction level, employs an external source of reciprocal information (i.e., not the quantized signal) and it can also be adapted to any key generation scheme involving public exchanges of sample indexes.

System model

We employ the same system model as in Section 2.2.1, to which we add an eavesdropper situated close to Bob (Eve, denoted as E). The signal received by E during the channel probing between A and B can be expressed as:

y E (t) = (h AE * p)(t) + w E (t) (3.1)
where the channel seen by E, h AE , has a certain level of correlation (presumably small) with the legitimate channel.

Eve is assumed to know all the physical parameters of the transmission (synchronization method, pulse waveform, duration of observation window) as well as the public protocol parameters for key generation. The attacker performs the signal acquisition simultaneously with the legitimate parties, applies the same processing techniques and extracts her own key using the bit extraction algorithm described in Section 2.2.2. She will then eavesdrop on the public exchanges between the two parties and exploit the information Chapter 3. Public discussion strategies 84 as explained in Section 3.5. The missing information will be replaced with randomly generated bits. This is a basic attack strategy which relies on the unmodified acquired signal and is straightforward to implement. Other more evolved strategies may rely on the received signal to infer the missing bits or even on deterministic ray-tracing predictions given partial knowledge of the physical environment and knowledge of the legitimate positions [START_REF] Tmar-Ben Hamida | On the Security of UWB Secret Key Generation Methods against Deterministic Channel Prediction Attacks[END_REF]. The mentioned study [START_REF] Tmar-Ben Hamida | On the Security of UWB Secret Key Generation Methods against Deterministic Channel Prediction Attacks[END_REF] concludes that an attacker equipped with a ray-tracing simulator is not able to entirely recreate the legitimate signal and that keys can be generated with the help of the diffuse components. Our focus herein is different in the sense that we use ray-tracing signals for the legitimate users also and we aim to investigate the immunity to a passive physical layer attack when employing only the "less" diffuse part of the signal, which would be a worse-case scenario from the signal point of view. Note that the ray-tracing simulator is used for data acquisition purposes only, not for the attack itself.

Round Trip -Time of Flight and synchronization

The Round Trip-ToF (RT-ToF or simply ToF) is also a reciprocal radio characteristic between A and B and it will be used to improve the secrecy of public exchanges during the reconciliation phase. This quantity is usually measured through cooperative handshake protocols, which are based on the time of arrival of exchanged packets [START_REF] Sahinoglu | Ultra-Wideband Positioning Systems: Theoretical Limits, Ranging Algorithms and Protocols[END_REF]. For our simulations with ray-tracing signals, we will use noisy estimates of the ToF relying on the channel leading edge detection, defined by t y ( t)>y th from Eq. (2.10) as introduced in Section 2.2.1. The ToF measured by A and B (T A f and T B f ) will be similar to the ToF measured by E using the A-E link (T E f ) because we deliberately consider the worst case scenario when the attacker is close to B. For each participant, the measured ToF quantity can be transformed in number of samples :

u : N u T oF = T u f • F s (3.2)
with u representing A, B or E.

The accuracy of the level-crossing synchronization depends on the SNR, which impacts both the key generation algorithm, by altering the reciprocity of the samples, and possible ToF-based reconciliation strategies, by altering the ToF estimation.

Limited public exchanges

We suggest, first of all, a bin table exchange (BIN) instead of the position (i.e., sample index) table exchange in order to reduce the public information. A bin is an interval of several samples that is defined beforehand for both sides. 1Instead of exchanging tables containing the indexes of the extracted samples, A and B exchange tables containing the occupancy of each bin, i.e., the number of samples above the final detection threshold in each bin. For illustration purposes, consider an observation window of W obs = 50 samples, a bin length of ∆ bin = 10 samples, and A's quantized samples with indexes [START_REF]History of Cryptography[END_REF][START_REF] Katz | Introduction to Modern Cryptography[END_REF][START_REF]Location-based Compromise-Tolerant Security Mechanisms for Wireless Sensor Networks[END_REF][START_REF] Mjlosnes | Chapter 5. Quantum Cryptography[END_REF][START_REF] Chou | Key Generation Using External Source Excitation: Capacity, Reliability, and Secrecy Exponent[END_REF][START_REF] Gopala | On the Secrecy Capacity of Fading Channels[END_REF][START_REF] Severi | A Secret Key Exchange Scheme for Near Field Communication[END_REF] in W obs . The resulting table transmitted by A over the public channel is [2 1 0 3 1]. After the exchange, A and B drop all the bits corresponding to the bins for which the occupancy is different.

Masked public exchanges

As the previous solution is expected to work in rather high SNR conditions, we suggest another approach for sending information over the public channel by masking or encoding it with a quantity (expressed in number of samples) equivalent to the independently measured ToF. The exchanged encoded tables are:

u : E u ≡ (P u + N u T oF ) mod W obs (3.3)
with u representing A or B.

In order to recover the original index table of the other user, A and B try to decode E using their own N T oF and P. We consider two decoding strategies:

• POS s T oF where A and B assume perfectly symmetric ToF estimates (i.e. N A T oF = N B T oF ) regardless of the actual quality/symmetry of their estimates and decode as follows:

u : D v ≡ (E v -N u T oF ) mod W obs (3.4)
where (u, v) ∈ {(A, B), (B, A)} and D v stands for the positions extracted by v and decoded by u.

• POS a T oF where A and B try to infer the other's N T oF by iteratively checking the values in the neighborhood of their own N T oF in order to compensate for plausible asymmetric measurement biases. For each value, they decode in the same way as before but choose the N T oF that maximizes the number of common extracted indexes, assuming that similar ToF measurements (and thus leading edges' alignment) are likely to generate more common indexes :

u : D v ≡ (E v -N v T oF ) mod W obs (3.5)
where N v T oF = arg max

N T oF |P u ∩ D v (N T oF )|.
After estimating each other's index table, A and B keep only the bits from the estimated common indexes. Contrary to POS, where the indexes are directly exchanged, this time there is no guarantee that the legitimate users estimate the common indexes correctly.

However, the length of the final sequence is the same on both sides for POS s T oF , as it can be seen from Eq. (3.6), where d = N B T oF -N A T oF and the second equality is due to sets' properties. The same is not always true for POS a T oF because of the asymmetrical nature in the errors made by A and B when using the estimation in Eq. (3.5). This makes POS a T oF vulnerable to key length issues even if, at first sight, it seems more robust to measurement noise.

|P A ∩ D B | = |P A ∩ (P B + d)| = |(P A -d) ∩ P B | = |D A ∩ P B | (3.6)

Performance evaluation

Attacker strategy

The attacker E in the vicinity of B measures the channel between A and herself (y E (t))

and the ToF on the same link (T E f ). She obtains a bit sequence from the quantization of y E [n], which she uses along with the public information to guess the key generated between A and B. We assume that the attacker plays a passive role in the key generation procedure (i.e., she does not inject/modify packets, her final aim being the eavesdropping of the communication between A and B), but she has nonetheless the advantage to exchange packets with A in order to measure the ToF. These measurements along with the proximity to Bob would allow Eve to exploit spatial correlation effects.

In the case of POS, Eve will only keep the quantized bit values corresponding to the common indexes between A and B and guess the missing ones by randomly choosing between equally distributed "0" and "1". For the BIN protocol, she will divide her observed signal samples into bins, select the bits corresponding to the common bin occupancy of A and B, and guess the missing ones. If her bins do not match the occupancy advertised by A and B, she will just add or delete bits at the end of the bins. Chapter 3. Public discussion strategies 87 For POS T oF variants, the attacker will either decode the position tables using her own N T oF or try to infer them by maximizing the number of common positions between A and B based on Eq. (3.5). After decoding, she will continue with the same strategy as for POS. The attacker will have no clear indication about the number of bits conserved by A or B for POS T oF .

Simulated signals

The used data are generated by a deterministic IR-UWB ray-tracing simulator using a reference indoor office environment [START_REF] Amiot | PyLayers: An Open Source Dynamic Simulator for Indoor Propagation and Localization[END_REF]. The simulator gives access to (x * h)(t) for 900 different Tx/Rx positions taken on a regular grid, which are then used to generate y(t) by adding noise. The positions of A and B are chosen randomly on the grid and the position of E as close as possible to that of B (i.e., at 1 m). Ray-tracing signals can help quantifying the impact of spatial correlation on the generated keys because the generated signals depend on both the environment and the Tx/Rx locations. They are, however, more limited in the number of multipath components than statistical channel realizations (Section 2.2) because they mainly capture the most significant reflexion and diffraction phenomena. As expected, the diffuse components are captured less reliably because they usually derive from the details of the building layout or the complexity of the materials.

The sampling frequency of the available ray-tracing data is fixed at approximately 18 GHz and the pulse has a bandwidth of 2.5 GHz at a central frequency of 4.5 GHz. The retained metrics for evaluation are the key agreement ratio, mean successful key lengths, mean bit agreement between legitimate users (mean legal bit agreement), and mean bit agreement ratio with a potential attacker (illegal mean bit agreement), defined according to Section 2.2.4. If the keys have different lengths, the bit agreement ratio is considered to be 0. The standard deviations are computed for the key lengths and the legal/illegal bit agreement ratios.

Results

We compare the initial key generation protocol with position-based public discussion (POS) with the same quantization algorithm followed by the newly introduced variants of the public discussion phase (BIN, POS a T oF and POS s T oF ). The first tests have been performed using typical algorithm parameters (δ = 10 for the quantization process in all the algorithms and ∆ bin = 0.25 ns for BIN2 ). T oF is not a reliable solution for generating identical keys, which is later confirmed by the statistics on the legal bit agreement: a small mean value (Figure 3.2) and a large standard deviation with approximately the same order as the mean. This means that maximizing the number of common positions is not a good criterion to estimate the exact ToF of the other user because it leads to keys of different lengths, which are considered to have a bit agreement of 0. This explains the large variance on the legal bit agreement for POS a T oF while the standard deviations for all the other algorithms are between 0.06 and 0.22.

Both BIN and POS s

T oF improve the mean illegal bit agreement (Figure 3.3 where the associated standard deviations are approximately 0.13 for all the algorithms). POS s T oF is better than POS and BIN over all SNR values and moreover, its mean value of 0.5 is equivalent to a blind guess of the attacker. It also yields a higher mean successful key length (Figure 3.4) because it does not drop bits by groups like BIN. For SNR values between 5 and 30 dB, the standard deviations of BIN key lengths span from 27 to 48 bits while those for POS s T oF are around 40-42 bits. Since the key length statistics (mean and standard deviation) are the same for POS and POS s T oF , we conclude that the key lengths depend more on the quantization algorithm and the channel itself than on the public discussion. When analyzing supplementary values of ∆ bin between 0.1 ns and 0.65 ns, we conclude that the key agreement ratio for BIN changes its behavior: it decreases almost linearly with δ at low ∆ bin and it presents an optimal δ for higher ∆ bin . The lower key agreement values at high ∆ bin and low δ are due to the empty-key phenomenon (i.e., after the public discussion phase, there are no common bins left). The mean illegal bit agreement for POS and the BIN variants decreases with δ (Figure 3.6). The differences between POS and BIN are, however, smaller than the standard deviation of the samples which can be between 0.2 and 0.1. POS s T oF presents similar standard deviations but its mean is always approximately 0.5, which shows that it is a more efficient public exchange method for all δ values.

Summary

In this section, we showed that signal spatial correlation and public information can help a passive attacker guess parts of the shared secret key between two legitimate users quantizing a directly sampled IR-UWB channel response according to [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] under more realistic synchronization assumptions. Among the proposed more discrete reconciliation methods, BIN can be easily adapted to the SNR conditions by varying the bin size, but it is less efficient at large bin sizes because it implies dropping bits by large groups.

POS s

T oF proves to be efficient (i.e., in terms of key length and also for achieving an optimal mean illegal bit agreement of 0.5) since it only hides the publicly exchanged information by using the ToF as a mask. Moreover, none of these methods increases the public discussion overhead in terms of exchanged packets. Since we use ray-tracing data for our simulations, our results would be valid for realistic IR-UWB signals from simple environments with limited multipath and solutions such as BIN or POS T oF would be useful for adding a supplementary layer of protection against eavesdropping in these cases.

Chapter 4

Cooperative physical layer key generation

The previous chapters focused on the exploitation of the physical radio layer to generate symmetric keys over single point-to-point links. The channel can be also probed over successive transmissions for obtaining longer keys by concatenation but the performance is dependent on the channel coherence time. Therefore, an elementary issue for physical layer key generation is how to gather more entropy from channel measurements in a given static scenario. This leads to the idea of extending the key generation process to several nodes in order to exploit more physical links (cooperative/multi-link strategy) and/or to generate a group key (contrary to a point-to-point key). From a practical point of view, the solutions should be scalable, adapted to ad hoc scenarios and should avoid the high level complexity issues of classical key distribution techniques (e.g., key pre-distribution, numerous packet exchanges, etc.). Some of the key generation models have been adapted to cooperative scenarios involving several nodes, either to reinforce the generated pairwise keys or to issue a common group key (i.e., shared by more than two nodes). In this chapter, we investigate key generation from IR-UWB multipath channels according to the source model. We propose a new method to generate group keys within cooperative scenarios, while exploiting all the available physical links in a full mesh topology and reducing over-the-air traffic. The main idea consists in adjusting the IR-UWB signals usually transmitted for channel probing so that a receiving node has access to non-observable channels corresponding to its non-adjacent links. 1 This operation leads to a deconvolution problem, for which we investigate various solutions.

The present chapter starts with an overview of the main cooperative key generation methods. Then, a general state of the art protocol named CKD (Cooperative Key Distribution) is presented for comparison purposes with the the proposed method entitled CKG (Cooperative Key Generation). For the latter, we detail the signal processing algorithms involved in computing the optimized transmitted signal. Firstly, we show that the maximum-likelihood (ML) approaches to the deconvolution problem are not stable with respect to imperfect channel estimates. Then, we introduce a parameterized maximum a posteriori (MAP) solution and we analyze two automatic methods for parameterization: Cross Validation (CV) and Expectation Maximization (EM). Finally, the protocol is analyzed in terms of traffic complexity and the key length gains are assessed through simulations.

State of the art: cooperative key generation

The secret key capacities for the source model with multiple terminals including a subset of helpers, various extents of an eavesdropper's knowledge, and unrestricted public discussion are characterized in [START_REF] Csiszar | Secrecy Capacities for Multiple Terminals[END_REF]. First, the secret key capacity when the eavesdropper only observes the public exchanges without having any side information regarding the source is shown to be closely related to the multiterminal source coding problem with no secrecy constraints. Then, the expression of the secret key capacity when the eavesdropper wiretaps a subset of the helpers is also derived.

Similar studies [START_REF]Secrecy Generation for Multiaccess Channel Models[END_REF] [START_REF] Chan | Multiterminal Secret Key Agreement[END_REF] extend the source emulation channel model to include a public channel eavesdropper and multiple users. The latter can be classified as: i) active users that want to generate a secret key per group [START_REF]Secrecy Generation for Multiaccess Channel Models[END_REF] [START_REF] Chan | Multiterminal Secret Key Agreement[END_REF] or per sub-group [START_REF]Secrecy Generation for Multiaccess Channel Models[END_REF]); ii) untrusted helpers, whose channel inputs and/or outputs can be wiretapped by the eavesdropper; iii) trusted helpers. The active users can be either senders or receivers [START_REF]Secrecy Generation for Multiaccess Channel Models[END_REF] or both [START_REF] Chan | Multiterminal Secret Key Agreement[END_REF]. The results consist in lower and upper bounds for the secret key capacities.

Multiterminal or cooperative secret key generation has also been investigated for less complex systems with the aim to design practical protocols and to measure their performance.

Early work from [START_REF] Ye | Group Secret Key Generation Algorithms[END_REF] presents an extension of the source model to cooperative pairwise key agreement and group key generation in a pairwise independent network (i.e., a network in which the point-to-point channels are independent). Point-to-point keys are generated from each physical network link and the group keys (or extra secret bits for pairwise cooperative keys) are propagated through XOR-ing operations over a graph representation of the network.

In more recent studies [START_REF] Lai | Cooperative Key Generation in Wireless Networks[END_REF] [START_REF] Wang | Cooperative Secret Key Generation from Phase Estimation in Narrowband Fading Channels[END_REF], the secret key between two user nodes is generated with the help of a relay. First, non-cooperative pairwise keys (from the main channel and the side channels, i.e., the channels between each node and the relay) are generated using a typical key distillation procedure based on channel gains [START_REF] Lai | Cooperative Key Generation in Wireless Networks[END_REF] or phase estimations [START_REF] Wang | Cooperative Secret Key Generation from Phase Estimation in Narrowband Fading Channels[END_REF]. At this point, each user node holds the key from the main channel and a key from a side channel. After that, the relay, which holds the keys obtained from both side channels, publicly broadcasts the bitwise combination of those keys. The user nodes can therefore recover the key that was generated by the other user node and the relay and append one of these side channel keys to the main channel key. An equivalent approach based on pairwise keys is described in [START_REF] Wei | Group Secret Key Generation Algorithm from Wireless Signal Strength[END_REF], where the received signal strength is quantized for non-cooperative pairwise key generation and a group key, generated by a root node, is securely distributed in the network using the pairwise keys.

If the wireless channels are static in time or too sparse in terms of multipath, there might not be enough information to harvest in order to generate a robust secret key. In order to deal with the issue of limited entropy of the source model, a recent study [START_REF] Wang | Cooperative Key Agreement for Wireless Networking: Key Rates and Practical Protocol Design[END_REF] extends the channel model for key generation to a cooperative scenario with a relay and an eavesdropper that is collocated with the relay. The authors derive the upper and lower bound for the secret key rate with a relay and propose a joint optimized design of the different key generation phases (advantage distillation, information reconciliation and privacy amplification) while focusing on the trade-off between security and protocol efficiency. Although it is shown that collocating with the relay is the worst case scenario for the secret key rate, this assumption also facilitates the advantage distillation phase because the legitimate users are informed about the quality of the eavesdropper's signal by the cooperative relay.

Overall, the previous contributions on the source model with cooperative pairwise keys or with group keys rely on the initial pairwise single-link key generation and subsequent key distribution. This involves extra-traffic and latency, while the length of the group key is limited by the shortest pairwise keys. Herein, we describe a novel method of physical layer group key generation that avoids the pairwise key generation before group key generation. An alternative way to deal with the entropy limitation in the case of the source model would be to use multiple links as input signals for quantization. The final group key is obtained after quantization and reconciliation of a concatenation of measurements from several links. The protocol involves several cooperative nodes and the obtained key is by construction known to all the participants, so it becomes a group key. This solution avoids extra public communication overhead but comes with an expense on the signal processing side where supplementary operations for channel probing are needed.

The "probing" of a non-adjacent channel is possible because of the cooperation between nodes, which will send specific signals (called s-signals in the following) in order to "induce" a certain channel state observed at the receiver. This operation depends on the type of measured signal; in the case of IR-UWB channel responses, which we will use for illustration purposes, the operation consists in a deconvolution operation, which is one of the scenarios with the highest complexity. This can be nonetheless acceptable for current personal devices such as smartphones and possibly even for next generation wireless sensors. The general concept and the protocol are however applicable to different technologies and channel measurements, which would require less complex signal processing capabilities.

Similar concepts (e.g., IR-UWB time-reversal [START_REF] De Nardis | Combining UWB with Time Reversal for Improved Communication and Positioning[END_REF]) have been put forward for improved communication robustness and intrinsic signal secrecy by spatial focusing of the signal energy. These methods rely on pre-filtering on the transmitter side and thus, enable location-dependent SNR gains on the receiver side. However, they are neither intended to provide secret material, such as keys, to higher layer cryptographic functions nor used in cooperative protocols as described in our method.

System model

We consider the simplest example of full mesh topology, consisting of three nodes (A, B, and C) with direct IR-UWB links between each pair. The received signal can be expressed according to Eq. (4.1)-(4.2).

y uv (t) = (p * h uv )(t) + w uv (t), w uv (t) ∼ N (0, σ 2 w ) (4.1)
h uv (t) = K k=1 x k δ(t -τ k ) (4.2)
where y uv (t) of duration T w is the convolved noisy channel response between the trans- We arbitrarily define the SNR as the ratio between the power of the transmitted pulse and the noise power, assuming that all the CIRs are normalized (

Tw 0 h 2 (t) dt = 1): 2 SNR = P pulse P noise = 1 Tp Tp 0 p 2 (t) dt σ 2 w (4.
3)

The three channels (h AB , h AC , and h BC ) are considered independent two by two at a given channel probing time. Also, we assume that they vary from one channel probe to the next one (independently of the past channel realizations).

Cooperative key distribution

One way of extending the point-to-point source model for key generation to several links and to a group key is to generate pairwise keys on each link and then distribute a group key (similarly to [START_REF] Ye | Group Secret Key Generation Algorithms[END_REF]). CKD can be achieved in two phases.

• Each node generates a pairwise symmetric key with each of its neighbors based on the properties of the radio channel. The employed key generation method for the current evaluations will be described in Section 4.4.1. Contrary to CKG, the key generation for CKD is performed separately for each pair of nodes using only their corresponding channels.

• A group key, generated by a lead node using a random number generator, is propagated in the network by XOR-ing operations using the previous single-link keys. The security of the scheme relies therefore on the single-link keys.

It is not compulsory to have pairwise keys on all the links but at least on a sufficient number of links that can form a spanning tree over the given network. The length of the group key is limited by the length of the pairwise keys in the following manner: if we consider that there is a pairwise key between the lead node and each other node and we want to avoid additional traffic, the length of the group key is the minimum of the lengths of these keys. If not, the group key length is limited by the minimum key length in the most "advantageous" spanning tree (i.e., the spanning tree containing the links with the largest key lengths). In this case, additional traffic between nodes is needed in order for the lead node to be able to determine the group key length before initiating the distribution procedure.

Cooperative key generation

This section describes the proposed cooperative key generation method for IR-UWB signals [START_REF]Cooperative Group Key Generation Using IR-UWB Multipath Channels[END_REF] in three steps: description of the protocol sequence including a deconvolution operation (Section 4.4.1), focus on the deconvolution problem from a statistical estimation perspective and on state of the art approaches for statistical inference (Section 4.4.2), and performance evaluation of the selected methods for deconvolution (Section 4.4.3-4.4.4).

Protocol description

In the following description A, B, and C have different roles and the protocol must be repeated with interchanged roles in order to obtain a group key. We define A as the cooperator, B as the initiator and C as the generator. We also refer to an adjacent channel as the channel that can be directly probed by a node (e.g., channels [B -A] and [C -A] for node A). The CKG protocol consists of several steps:

• channel sounding using a pulse template signal to obtain adjacent channel responses (y BA (t) and y CA (t)) for the cooperator A according to Eq. (4.1) (step 1 in Figure 4.1).

• CIR estimation (i.e., delay and amplitude extraction) at the cooperator A from the received y CA (step 2 in Figure 4.1). This operation can be achieved by means of sampling at sampling frequency F s and correlation with an a priori pulse template (corresponding to the expected unitary received pulse waveform p(t)). The used search-subtract-readjust algorithm [START_REF] Gifford | Effect of Bandwidth on the Number of Multipath Components in Realistic Wireless Indoor Channels[END_REF] iteratively detects, estimates and then subtracts multipath components out of the acquired received signal y CA to obtain ĥCA .

• computation of the so-called s-signal s AC at the cooperator A (step 2 in Figure 4.1). The previous channel estimate ĥCA is used by the cooperator A to compute s AC to be sent to the generator C so that the latter deduces the non-adjacent channel [B -A] represented by y BA . The following problem needs to be solved:

3 Find s AC s.t. (s AC * ĥCA )(t) = y BA (t) (4.4)
• transmission of the computed s-signal s AC from A to C (step 3 in Figure 4.1). Accordingly, the employed transmitter must enable the programming of an arbitrary IR-UWB waveform, given an a priori occupied bandwidth (e.g., [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF]), in order to generate s AC . The generator C receives: • quantization of the input signal S CAB using, e.g., uniform quantization with guardbands.

r BA (t) = (s AC * h AC )(t) + w AC (t) (4.5)
The steps 1-4 are repeated by all the nodes with interchanged roles so that all of them obtain the three channels.

• public discussion between the three nodes: i) sharing the indexes of the dropped samples falling into the guard-bands; ii) error correction using Reed-Solomon codes (a lead node, for example A, generates a syndrome representing its own bit sequence and sends it over the public channel to the other nodes, which will try to decode/correct their bit sequences to align them to A's sequence).

Parameterized s-signal computation

Searching for a solution to Eq. (4.4) is a non-trivial deconvolution problem. We will first explore straightforward solutions4 and then, focus on the more general problem of s-signal estimation implying two levels of statistical inference (model fitting and model selection) separately or jointly.

Deconvolution solutions

As mentioned before, A needs to solve the following equation :

ĤCA s = y BA (4.6)
where y BA is the N ×1 sampled version of y BA , ĤCA is the N ×N s matrix corresponding to the N h × 1 convolution kernel ĥCA such that ĤCA s = ĥCA * s.

Considering the classical convolution definition, N s should be N -N h + 1. This leads to an overdetermined system of equations, which is consistent (i.e., has one or an infinity of solutions) only if a certain number of equations are linear combinations of the rest of the equations. As the coefficients from ĤCA are random by construction, the present system has high chances of being inconsistent. Consequently, we give the s-signal more degrees of freedom by imposing that only the valid part of the convolution5 approaches y BA , which implies that N s = N + N h -1. Eq. (4.6) becomes then an underdetermined system, which can have zero or an infinity of solutions.

Therefore, we replace the search for an exact solution to Eq. (4.6) with a least-squares (LS) minimization problem (Eq. (4.7)), whose solution will be denoted as ML (maximum likelihood 6 ). The LS problem is still ill-posed in the sense that it could have multiple solutions.

s ML AC = argmin s || ĤCA s -y BA || 2 (4.7)
We quantify the performance of the deconvolution operation with the residual error (RMSE) between the analog signals (s AC * h AC )(t) and y BA (t). Note that the receiver should perform additional windowing operations since the sent s-signal is longer than the needed observation window. This RMSE metric includes the degradation produced by the imperfect channel estimation ĥCA = h CA . Additional artefacts are incurred by the additive noise from the [A -C] channel. Even though these degradations are not directly considered for the computation of the s-signal, their effect is taken into account in the performance evaluation from Section 4.5.

In terms of implementation, Eq. (4.7) can be solved using solutions similar to Matlab R 's linear least-squares solver mldivide, which employs QR decomposition on matrix ĤCA and provides a solution s with the fewest possible non-zero components. After computing the s-signal using the aforementioned method on sampled signals at F s = 10 GHz, we simulate the pseudo-analog s-waveform s AC (t) by sinc-interpolation. 7 The obtained waveform is next convolved with the true multipath channel h AC (t). In Figure 4.2, we show the noiseless received signal in C and the target signal to be deduced, y BA (t), for arbitrary realizations of CM1 channels (according to the IEEE 802.15.4a standard). All the received and target signals are normalized with respect to their maximum absolute value. We will refer to these particular channel realizations as "the basic channel configuration" hereafter. A value of SNR = 20 dB is employed for all the evaluations in the present section.

Therefore, we observe that the ML solution can be unstable with respect to the imprecision of channel estimations. This means that the criterion of fewest non-zero elements is not adapted to our problem and another type of least-square solution should be preferred. A simple preliminary test using Matlab R 's Moore-Penrose pseudo-inverse function pinv, which produces a solution s with minimal l 2 -norm, shows significant improvements at the expense of longer computation times. As it relies on singular value decomposition, the computation of the pseudo-inverse is deemed to add unnecessary complexity to the resolution of a linear system. The instability issue of the ML solution can be efficiently addressed by adding a penalty term to Eq. (4.7) and solving it, for example, with mldivide-like methods. Note that if P = I Ns , the solution of Eq. (4.8) is equivalent to the aforementioned pinv solution with minimal l 2 -norm, where λ is a fixed parameter.

y BA (t) (s M L AC * h AC )(t)
s AC = argmin s || ĤCA s -y BA || 2 + λ||Ps|| 2 (4.8)
This operation is known as a Tikhonov regularization, where matrix P is chosen in order to constrain s and λ is a real scalar trade-off parameter. The penalty term, also called prior in a Bayesian setting, enforces the desired characteristics of the optimized s-signal (e.g., minimal l 2 -norm, smoothness, etc.), while the first term keeps the result after convolution close to the data. Eq. (4.8) has a closed form solution, which we will denote as MAP (maximum a priori ):

s MAP AC = ( ĤT CA ĤCA + λP T P) -1 ĤT CA y BA (4.9)
Figure 4.3 shows the normalized deduced signal with the MAP solution for the computation of the s-signal (basic channel configuration). For this illustration, a value of λ = -4 dB is chosen. In the next subsections, we investigate methods for finding an adapted value for this parameter.

The signal instability observed for the ML solutions can be regarded as an overfitting issue: the s-signal is computed based on the imperfect channel estimation, ĥ, but the final performance depends on the unknown real channel, h(t). This means that even though the ML deconvolution solution is exact for the given data (channel estimates and target channel), it could behave unpredictably for slightly different real channel conditions (equivalent to variations in the channel estimates). Adding the penalty term avoids the overfitting if its weight is properly chosen.

From deconvolution to inference

The deconvolution can be seen as a generalization of an interpolation problem (i.e., interpolation is a deconvolution with a kernel consisting of a Dirac delta function). The tutorial paper on Bayesian interpolation [START_REF] Mackay | Bayesian Interpolation[END_REF] uses the noisy data interpolation problem to illustrate the principles of Bayesian model selection, regularization and noise estimation and to compare them to classical (frequentist) misfit or cross-validation techniques.

We first summarize the approach presented in the aforementioned work and then, describe a more recent alternative for statistical estimation problems with incomplete data, namely the Expectation Maximization algorithm.

Like other data modeling processes (e.g., pattern classification, clustering, detection, etc.), data interpolation or signal estimation 8 can consist in a statistical inference procedure with (minimum) two phases [START_REF] Mackay | Bayesian Interpolation[END_REF]:

• signal estimation based on a specified model with known parameters (also called first level of inference). This phase can be solved by Bayesian (e.g., MAP) or non-Bayesian (e.g., ML) estimators. In the Bayesian case, the fundamental relation 8 Equivalent terminologies for interpolation include regression, curve-fitting, learning.

between the probability density functions is expressed as:

Posterior = Likelihood × Prior Evidence (4.10) p(s|D, Θ) = p(D|s, Θ) × p(s|Θ) p(D|Θ) (4.11)
where D is the known data, s is the searched signal and Θ represents the model parameters.

• model comparison/selection, which reduces to a parameter tuning phase if the aim is to find an optimal value for the parameters of a given model. Classical techniques include hypothesis testing, misfit criteria9 or cross-validation (described in Section 4.4.3). The Bayesian "evidence maximization" method treats this step as a second level of interference, the parameters becoming the new quantity to be estimated (e.g., by ML or MAP estimators). Maximizing the evidence p(D|Θ) is equivalent to finding the parameters that can best "explain" the observed data with respect to the chosen model.

The two levels of inference are performed independently: first, estimation of the parameters based on evidence maximization and then, signal estimation with the obtained parameters.

Alternatively, the estimation of a signal using a model with unknown parameters can be solved by an Expectation Maximization (EM) algorithm. EM has been discovered and used independently in several domains ranging from genetics, statistics (estimation of parameters of mixture distributions) to maximum likelihood image reconstruction and speech recognition (estimation of parameters of Hidden Markov models) [START_REF] Moon | The Expectation-Maximization Algorithm[END_REF]. Often thought as an evolution of the maximum likelihood estimator, EM can be simply illustrated through the example of the maximum likelihood parameter estimation with incomplete data [START_REF] Borman | The Expectation Maximization Algorithm[END_REF]. For simplicity, we will restrict to this example10 and then, show how our deconvolution problem can be seen as an incomplete data model.

Given some data D sampled from a model with unknown parameters Θ, the ML estimator returns the parameters Θ M L that maximize the likelihood function p(D|Θ).11

Most of the time, the model involves hidden variables S (e.g., D = f (S, Θ)), which cannot be efficiently taken into account by the ML estimator on its own, but which can be naturally included in the EM framework. This algorithm alternates between solving for the hidden variables, knowing the latest parameter estimates and the observed data, and finding the optimal parameters, knowing the current hidden variable estimations and the observed data. Contrary to the level-based statistical inference, EM condenses the two inference levels in an iterative procedure with two steps for each iteration i:

• the Expectation step (E-step): computation of the conditional probability distribution p(S|D, Θ i-1 ) 12 and of the conditional expectation ξ i (Θ).

ξ i (Θ) = E S|D,Θ i-1 [ln p(D, s|Θ)] (4.12)
• the Maximization step (M-step):

Θ i = arg max Θ ξ i (Θ) (4.13)
The convergence can be proved by showing that the algorithm increases the likelihood at each iteration [START_REF] Borman | The Expectation Maximization Algorithm[END_REF].

The deconvolution problem presented in the previous subsection can be seen as a signal estimation problem with unknown model parameters or, equivalently, a parameter estimation problem (i.e., the regularization parameter or the weight of the prior) with hidden variables (i.e., the searched s-signal). In order to apply Bayesian model selection techniques, we create a statistical model corresponding to the regularized deconvolution equation Eq. (4.8).

Statistical deconvolution model

We identify the known data as the target signal (y BA ) and the hidden data as the searched s-signal (s AC ). The estimated channel ( Ĥ) is a deterministic fixed quantity in this model. For simplicity and generalization purposes, we will drop the signal indexes representing the users for the rest of Section 4.4. The model consists of two equations: one for the data fit, where e represents the fitting error with independent samples of mean 0 and variance 2 , and one for the signal prior, which offers an artificial representation of the resulting waveform as a noisy zero-mean process of sample variance γ 2 . y = Ĥs + e, e ∼ N (0, 2 I N ) (4.14)

Ps ∼ N (0, γ 2 I Ns ) (4.15)
Therefore, we can write Bayes' rule for the given model:

p(s|y, , γ) = p(y|s, ) × p(s|γ) p(y| , γ) (4.16)
By identification between Eq. (4.8) and the MAP estimator derived from the current model, 13 we have 2 /γ 2 = λ. Although the MAP solution expressed in Eq. (4.9) depends only on the value of λ, the present model provides a richer description of the underlying phenomena because the two model parameters ( and γ) have a concrete meaning (i.e., represents the capacity of the model to fit the known data and γ can represent, for example, the energy of the searched signal).

We have therefore several solutions for our deconvolution problem:

• a MAP solution (solved by an LS minimization algorithm) with two choices of parameterization:

a weight parameter between the data fit and the prior (λ from Eq. (4.8)), which can be set using a cross-validation technique (Section 4.4.3).

-Bayesian parameterization based on and γ, which can be estimated with an evidence (p(y, Ĥ| , γ)) maximization procedure [START_REF] Mackay | Bayesian Interpolation[END_REF]. We will not evaluate this option in our simulations because of the complexity of the evidence function in terms of optimization (see Appendix C).

• an EM solution, which provides a joint estimation of the parameters of the Bayesian model and of the s-signal (Section 4.4.4).

MAP solution with Cross Validation parameterization

The MAP solution depends on the choice of the trade-off parameter λ and of the prior We conclude that at small λ values, the regularization works as intended, reaches an optimal value for λ values around 0 dB, but degrades after a certain upper threshold, when the prior obtains too much weight and "flattens" the signal in its initial form (s → 0). Although the estimated s-signal can be amplified or the received signal can be normalized, as it is the case, the received signal with unadapted λ contains more artefacts, as it can be observed for λ = 2 dB in The generalization error does not always have a minimum and, therefore, model selection using CV does not have optimal performance for all channel configurations. This could be explained by the small cardinality of the data set on which cross-validation is applied (500 samples). In certain cases, the validation samples can be insufficient or unadapted to "generalize" the estimation of the s-signal to the unknown real channel conditions.

Expectation Maximization solution

The EM algorithm applied to our Bayesian data model consists in solving the following steps:

In order to evaluate the performance achieved by the EM signal estimation method, we measure the RMSE for the same previous 100 channel configurations and the s-signals obtained after 200 EM iterations starting from the same initial point λ as the MAP solution. 16 Representative parameter convergence curves are reported in Appendix D.

From Figure 4.7, it can be inferred that, at low λ values, the EM solution has lower performance compared to the MAP estimator with manually tuned parameter. However, it is a relatively "unfair" to compare a solution that gives an estimation of the signal and the parameters (EM) with one that takes as an input a suitable value of the parameter and provides only an estimation of the s-signal. Moreover, EM presents an RMSE advantage for relatively large values of λ, for which it manages to find optimal parameter values that, on average, incur less artefacts on the final deducted signal (e.g., Figure 4.8

for the basic channel configuration).

To sum up, the performance achieved by the EM solutions with the considered model are comparable or inferior to a manual tuning of the trade-off parameter (i.e., choosing a constant very small prior weight irrespective of the channel configuration). This suggests that the incurred complexity of the EM solution is unnecessary. However, the EM framework presents several advantages that cannot be achieved by any of the alternative solutions:

• computation of the uncertainty related to the s-signal estimation, potentially exploitable by the subsequent quantization layer.

• comparison between different priors (e.g., another example of prior could be the information about arbitrary regulatory emission masks compulsory for over-the-air transmissions).

• joint s-signal estimation and channel estimation adaptation if supplementary information about the channel estimation uncertainty is available. In this case, the hidden variable would be the couple (s, h).

Performance evaluation

Simulation framework

We now evaluate the two key generation protocols, namely CKD and CKG, in a full mesh network of three nodes considering only the MAP solution for CKG. We deem that the EM solution presents system-level advantages but its impact is less obvious in terms of final key performance. Our aim is to compare the two protocols in terms of number of generated bits after several rounds of channel probing for the same number of over-the-air packets. The quantization and reconciliation schemes are not analyzed in this section because they are not discriminant elements for the two protocols, which employ the same type of input signal for quantization. However, it should be noted that in a more exhaustive performance assessment, the random properties of generated keys, which depend on the input signal and the quantization algorithm, should be studied as well.

The reciprocal CIRs corresponding to the three links are generated independently using the IEEE 802.15.4a statistical model for LOS indoor environments (CM1). The transmitted pulse for initial channel probing p(t) has a bandwidth of 1 GHz (defined at -10 dB of the Power Spectral Density) and a center frequency at 4.5 GHz. The duration of the observation window is set at T w = 50 ns.

For CKG, the sampling frequency for channel impulse response estimation and for the computation of s-signals is set at F s = 10 GHz. The s-signal is computed using the MAP solution in Eq. (4.9) with the regularization parameter set manually to λ = -4 dB and the obtained s-signal is then filtered to conform with the required signal bandwidth and central frequency.

The input signal for quantization has a sampling frequency of F p = 1/T p and it is normalized with respect to the minimum and the maximum values in order to obtain signal samples between 0 and 1 for all nodes. An example of such a signal issued from link [A-C] and seen in A, B (based on the reception of an s-signal), and C is provided in Figure 4.9. For simplicity reasons, we choose a two-bit uniform quantization with corresponding cells {(0-0.25), (0.25-0.5), (0.5-0.75), (0.75-1)} and a Grey dictionary ({"00", "01", "11", "10"}). The employed guard-bands (GB) vary between 0 and 0.1

Results

As a preliminary study, we compare the number of communication packets (including broadcasts when possible) needed for one round of key generation for the two methods (Table 4.1). We do not consider the packets exchanged in order to establish a lead node (for reconciliation in CKG and for distribution in CKD) because they are not discriminating. The cooperative channel probing for CKG can be achieved with 3 or 6 exchanges depending on the number of cooperators. The key distribution for CKD consists of one packet sent to the lead node to inform it of the length of the key on its non-adjacent channel and 2 packets for group key propagation. We conclude that, in any case, CKG requires less traffic than CKD to issue a group key.

[N (N -1)/2 -(N -1)] × N Reconciliation (dropping) N (N -1) N Reconciliation (error-correction) N (N -1)/2 1 Key distribution N (N -1)/2 0 Total O(N 2 ) O(N 3 )
The presented simulation results are obtained for a fixed-traffic scenario (30 packets corresponding to 2 rounds for CKD and 3 rounds for CKG). Keys that are not equal after reconciliation are considered to have length of 0. Averaging is performed over 500 channel configurations (each configuration comprising three channel realizations corresponding to the three pairwise links). The channels are independent over the three links and also from one round to another, meaning that bits can be concatenated for the final key.

From Figure 4.10, we conclude that CKG is more advantageous in terms of key length for higher SNR and larger guard-bands. This is due to the fact that before quantization, the CKG method does not have direct access to the non-adjacent channel measurements that are obtained after a deconvolution operation and another noisy transmission. This degrades the reciprocity of the final samples and leads to more keys that are not agreed upon for CKG at lower SNR or smaller guard-bands. However, it can be verified that CKG achieves a relatively high bit matching ratio between the three keys generated at the participating nodes (Figure 4.11). The bit matching ratios for the CKD method, although higher than those for CKG, do not present an interest in this study because they can only be computed for pairwise keys and represent solely the single-link reciprocity performance of the system.

Summary

In this chapter we have investigated an alternative method for generating secret group We show the advantages of our method in terms of traffic overhead as well as in terms of key length for certain parameter configurations.

Our proposal focuses on the parameterized estimation of specific s-signals obtained after a deconvolution process and emitted by cooperative nodes in order to "induce" nonadjacent channel information for their neighbors. We investigate the accuracy of the non-adjacent signal reconstruction phase at the reception side, which is an important factor for subsequent key generation. Consequently, we describe and test two methods for signal estimation and parameter specification. The first one is based on a cross-validation technique with the aim of choosing an optimal value for the maximum a posteriori Further studies should look into the complexity issues of the s-signal generation, potentially by considering a joint design between the s-signal generation and the rest of the key generation protocol (e.g., signal acquisition, estimation, quantization).

The proposed scheme can be adapted to other technologies (narrow-band, OFDM) by changing the cooperative signal generation method according to the most relevant channel features. Moreover, the concept of s-signal could be extended to cases where the target signals are not channel estimates but randomly generated information, which leads to a mixed key generation model (see Section 1.2.1). However, this complicates the overall key generation procedure because there would be no more direct acquisitions of channel information.

Chapter 5

Conclusion and perspectives

In this thesis we were interested in symmetric secret key generation methods using the physical layer. This approach to symmetric key distribution is part of the larger framework of physical layer security, which takes advantage of wireless propagation phenomena, such as fading and noise, in order to complement traditional confidentiality and authentication cryptographic solutions. Physical layer security solutions are situated at the crossroads of information theory and signal processing and are particularly appealing in decentralized wireless networks, where security becomes more challenging because of the lack of infrastructure. In this context, key agreement strategies based on public discussions have been proved simpler to implement than keyless secrecy achieving solutions, which require wiretap code design and/or physical advantage engineering (e.g., by jamming or beamforming). Similarly to the majority of secure communication solutions, physical layer key generation does not address initial authentication of the legitimate users.

The IR-UWB CIR is an interesting option for secret key generation according to the source model, first of all, because of the fact that one CIR measurement provides several values for quantization (i.e., several significant channel taps), but also because of the delay information contained in such signals (e.g., the excess delays of the significant channel taps). This is not the case for RSS measurements, for example, which are acquired at a uniform probing rate or over several parallel channels. As a general drawback of the source model, the wireless channel must provide temporal variability in order to generate sufficiently long keys or renew them. Since this issue is not directly linked to the signal structure and rather depends on the environment or on the network configuration (i.e., mobile or static), we did not address it in the main part of the present work (only partially in Appendix F).

We do not claim that IR-UWB CIRs are always more advantageous than other wireless technologies and channel characteristics because the design of key generation protocols, as any other security solution, depends on the context (i.e., application, deployment environment, type of network, hardware or software limitations, etc.). We believe that in order to achieve optimal integration of physical layer solutions, it is necessary to take advantage of all the opportunities provided by a certain radio technology. Therefore we provide guidelines for key generation using various types of IR-UWB temporal signals.

By allowing further processing, IR-UWB signals could be exploited in the frequency domain as well with the advantage of achieving synchronization at the expense of less entropy (i.e., quantizing only the absolute value of the complex gain).

The work accomplished in this thesis is divided along three main research axis, corresponding to the three main chapters (Chapters 2-4): IR-UWB channel quantization issues, public discussion strategies for information reconciliation, and cooperative physical layer key generation. Although the first chapter is concerned with specific IR-UWB issues, the rest of the our findings can be adapted to other types of channel measurements. Two of our main proposals, namely HIST (Section 2.2) and POS T oF (Chapter 3), are extensions of an existing key generation protocol employing IR-UWB directly sampled signals [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF] [79], whereas the rest of the work is built on new signal models (e.g., channel estimates) and has new aims (e.g., optimized quantization or cooperative techniques).

Quantization issues for IR-UWB signals

In this work, we considered the optimization of the quantization phase based on supplementary criteria related to reconciliation and privacy amplification. This resulted in a practical approach for key generation and for the study of the trade-offs between length, reciprocity and randomness. The studies of quantization algorithms applied to IR-UWB signals (Chapter 2) highlighted the potential of the delay information for achieving keys with better randomness properties (i.e., HIST scheme for directly sampled CIRs and DIV scheme for simulated noisy CIR estimates) or for improving reciprocity in the case of realistic channel estimates. We have also shown how to adapt the quantization thresholds in order to obtain a desired reciprocity-randomness trade-off for an "average" generated codeword given the expected average energy of the underlying multipath components.

In this case, the randomness has been measured by the proposed inter-key diversity metric.

Once realistic CIR estimates are available for quantization, the delay information becomes useless for quantization if it is exchanged on the public channel for reciprocity purposes. Although the DIV scheme cannot be applied, the optimization of quantization thresholds or the search for equivalent uniform quantization thresholds at a fixed excess delay is still feasible. Nonetheless, since the optimized threshold computation is based on the statistics of the simplified signal model (i.e., with a Gaussian mixture model), the performance for individual channel realizations might be different. This can be caused by the fact that the considered statistics for the true channel might not be representative for the estimated channel tap, as it has been suggested by the structure of CIR estimates studied in Section 2.4. Therefore, a new model for realistic channel estimates should be investigated in order to be able to apply the proposed threshold optimization techniques. As already mentioned, the difficulty of such approaches resides in the dependence of the CIR structure on the employed estimator and, to the best of our knowledge, in the lack of theoretical models for pulse interference scenarios.

Nevertheless, the proposed methods and ideas remain valid for any type of signal that contains characteristic delay information. For example, we can imagine ED-based channel probing, similarly to the one used for quantization tests in Chapter 4. Although these signals have uniform measurement steps, the significant delay information can be extracted by a threshold operation on the amplitudes (e.g., all the samples lower than a given value are set to 0). In this way, in dense multipath environments, pairs of delays and amplitudes could be obtained and quantized according to the described proposals.

Discrete public discussion strategies

In Chapter 3, we presented two extensions (BIN and POS T oF ) of an existing public discussion method [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF], which aim at achieving better immunity against eavesdropping attacks. BIN is an adaptable solution that limits the publicly disclosed information but is more sensitive to noise than POS T oF , which only masks the public information.

We deliberately used ray-tracing data for our simulations because it gives direct insight into the advantage that an attacker could have by combining the location-dependent signal with the eavesdropped public information. The study is restricted because the available data did not allow to consider attackers that are closer than 1 m from one of the legitimate users. However, the obtained results suggest that the eavesdropping could become even more problematic at shorter distances for the considered type of signal.

Further investigations should also analyze the case of realistic IR-UWB signals with denser and more diffuse multipath components, which are likely to favor the legitimate users.

We acknowledge the fact that although POS T oF achieves good results in terms of bit agreement between the legitimate keys and the key generated by an eavesdropper, the Chapter 5. Conclusion and perspectives 120 performance is highly dependent on the attacker model. We considered a "naive" physical layer attacker that does not know the relative positions of the nodes and does not apply any data mining techniques, which would be a subject of research by itself. However, this is also a more "probable" attacker model.

Lastly, the masking procedure proposed by POS T oF is not at all equivalent to an encryption operation and a simple ToF measurement is by far less powerful than a symmetric key. In order to achieve better secrecy performance, mobile nodes could use several consecutive high-precision ToF measurements (e.g., stored in memory) for masking one public exchange. Moreover, if enough ToF measurements are available, they could be employed similarly to one-time pads to exchange the excess delays of realistic channel estimates. This would therefore allow joint delay-based reconciliation and delay-dependent quantization for IR-UWB CIR estimates, which have been discussed in Chapter 2.

Cooperative physical layer key generation

Chapter 4 introduced a new idea for extending the key generation source model to several cooperative nodes in order to directly extract a group key. The proposed solution, a mix between a source model and a reciprocity-based channel model, relies on equalizationlike operations and avoids over-the-air traffic needed for multiple pairwise key generation procedures and their associated reconciliation messages. Prior to quantization and reconciliation, nodes concatenate direct channel measurements from the adjacent links with measurements from cooperative transmissions of their neighbors. The cooperative transmissions are meant to assist distant nodes to "infer" their non-adjacent channels.

We illustrate the proposed idea in a scenario where devices can afford expensive computations such as deconvolution operations involving IR-UWB channels. We adopt a temporal Bayesian approach (i.e., MAP or EM solutions) for the estimation of the optimized signals that need to be transmitted in order to induce a certain desired signal at the receiver. The most important limitation of these methods, especially the iterative ones, is the advanced computational capabilities required for implementation and the computation time. This makes them more adapted to relatively static environments, which have been one of the motivations for this proposal, and to powerful devices, in the particular case of IR-UWB. However, the developed CKG protocol could be more easily implemented in narrow-band systems involving phase or channel gain information because of the simplification of channel equalization operations.

Chapter 6

Reflections "We cannot solve our problems with the same thinking we used when we created them."

Albert Einstein

Progress has always been a part of human nature. The search for more, better and faster is something almost innate to people as a species and probably the engine that embarked us on an accelerated journey through technology.

From fire, agriculture and cities to medicine, Internet and autonomous cars . . . From survival and safety to comfort and pleasure . . .

From local to global.

Technological progress is our response to the limitations we encounter and so, telecommunications1 technology becomes the expression of our desire to share information despite the physical limitations of space. As any other invention, it carries within it the potential for good and bad, in the sense that it can be beneficial from a social or economic perspective, a drive for humanitarian actions, a tool of knowledge, a means of connection, but in the same time, it can be disruptive, misused, overused, detrimental.

Although the binary "good vs. bad" model can be vastly debated, I believe that, at some point and for each specific context, lines have to be drawn and choices have to be made. As a technological researcher, it is part of my work to understand the impact that technology has on the people using it. Whenever possible, this understanding needs to be incorporated in the technological choices that are made regarding aspects such as centralization or security. As a daily technology user, I would like to be conscious about the way I employ it. The present discussion is a short overview of my current perception of sensitive telecommunications-related issues and the questions they rise.

You are now online. We own landline phones, computers, tablets, and smartphones that we can use for phone calls, SMS, MMS, online chat, online calls, video calls, personal and professional emails, social media, instant private or group messaging, conference calling. This makes a lot of options for contacting someone and for being contacted. If the advantages of this proliferation of communication means is obvious on a short-term basis (e.g., business models, personal life, etc.), the possible negative effects are usually long-term, more subtle, and dependent on the particular usage. Some people can show signs of fatigue and decreased productivity when handling multitasking between offline work and abundant emails or phone calls. Others find it difficult to manage their personal life with constant access to professional emails or when owning a professional mobile phone. Teenagers or even adults can become so attached to their online identities and friends that they neglect or fear real social contact. Furthermore, this can lead to feelings of dissatisfaction and inferiority caused by the permanent comparison to the images that "others" project about them and ironically, to feelings of loneliness. As users, we should understand that being "always on" is both an opportunity and a trap, and that our physical rhythm or reality could sometimes have difficulties in coping with our instant accelerated online lives.

Based on the philosophical idea that organized refined writing, rather than oral communication, contributed to the development of modern society, it is argued that instant messaging and social media can potentially produce a regression in our language skills [START_REF] Stillwaggon-Swan | Are Social Media Making Us Stupid? [Opinion[END_REF]. This could be caused by the widespread adoption of instant communication tools that replace the "thought-enhancing" written form of communication with a pseudo-oral written language. In my opinion, although scientific evidence for proving such claims can be difficult to obtain, the described scenario is nonetheless plausible given common-sense trade-off mechanisms between efficiency and creativity, for example.

The Internet of ... Everything! The Internet of Things is about connecting common objects to the Internet in order to optimize environmental monitoring, infrastructure management, energy consumption, medical services, transports, etc. or just make things easier and less time-consuming in our daily life. First of all, the aim of connecting billions of objects brings new tremendous challenges regarding the management, security, privacy or fail-safe requirements of such systems. Secondly, the promised positive impact should be carefully weighted against the input costs. For example, energy consumption monitoring systems could help reduce our domestic CO 2 footprint, but the overall environmental impact of the manufacturing, usage and disposal of electronic devices that are still difficult to recycle has yet to be completely understood. Chapter 6. Reflections 123 Furthermore, at a psychological and social level, would an "easier" daily life or time gains necessarily make us happier or just more technology-dependent? Of course, the same could be argued about the washing machine that we now accept as an essential tool in our lives. However, all technology requires a learning process so in the beginning it can be perceived as rather disruptive than facilitative. Things become even more complex when considering the "quantified self" concept [START_REF] Lupton | Understanding the Human Machine [Commentary[END_REF], which, on the one side, seems like a valuable tool of self-development, and on the other side, raises ethical concerns about dehumanization by promoting numerical, objective measurements of complex or subjective human states.

Regarding technological dependency, an interesting point is made by studies on slavemaking ants (i.e., ants that "enslave" a part of their population), which present diminished survival capacities if the slave-ants are taken away from the colony [START_REF] Robbins | Ruminations on the IQ2 Debate: We Are Becoming Enslaved by Our Technology? [Opinion[END_REF]. 2 In my opinion, this does not necessarily mean that we are becoming "enslaved" by our technology, but it is obvious that the way we use it shapes our skills and our expectations in terms of happiness, efficiency, and sometimes self-esteem.

Privacy or the right to accept the terms and conditions you do not understand. The accumulation of sensing data from various sources, especially personalrelated ones ranging from localization and commercial preferences to household indicators, has become the "Graal" for a lot of ICT 3 companies. In a consumer-oriented society, big data brings companies big money through mechanisms such as targeted advertising or more generally, consumer profiling based on personal information that is initially not provided for these purposes. This is what allows companies to offer free online services while remaining highly profitable in some cases (e.g., Google, Facebook, etc.). Adverse reactions to this business model include views based on the slogan "If you're not paying for it, you are not the customer; you are the product being sold.". Objectively, postal mail, cellular services, and even libraries are not free, why would email be? However, the Internet situation is slightly different: the user already pays a fee to his Internet connection provider and historically speaking, we have been "educated" to expect free online services. In this context, any online service provider demanding even a small fee would be perceived as a bad deal.

It is probably that even with a full understanding of the underlying data processing mechanisms, some users would still accept the data disclosure in return for free Internet services. However, the advent of the Internet of Things and the fact that we will no longer entirely or easily control the information disclosed by our devices will possibly raise more interest in privacy-friendly solutions already available but less popular today.

Users of a particular data gathering application should be able to transparently choose what happens to their data, with whom it is shared, and for what purposes. In this sense, applications should be provided with comprehensive privacy interfaces or even more, engineered according to social rather than purely commercial principles [START_REF] Nold | The Internet of People for a Post-Oil World[END_REF].

The main argument for dismissing privacy-related burdens can be resumed in a simple rhetorical question: "Why bother if I don't have anything to hide anyway?". Although it might seem legitimate at first, we should consider that privacy is not lost or gained in one shot, but rather incrementally [START_REF] Geer | The Right to Be Unobserved[END_REF]. If today we do not feel concerned about who can track our shopping preferences, tomorrow, our online profile might contain sensitive information (e.g., health-related) that allows discriminative profit-oriented polices to be implemented (e.g., health insurance fees). We should probably think harder before contributing to the fading of a right that we do not know when we might need. Fastforwarding on the same slope, the paradigm could shift in the sense that disclosing information could become a requirement in order to have certain basic benefits (i.e., the unraveling effect [START_REF] Eldridge | The Circle [Book Review[END_REF]). From this hypothetical point and taking into account present surveillance capabilities and legislation of certain states (e.g., both in terms of data and meta-data), we could even imagine moving towards the dreaded orwellian4 society. This inevitably leads us to a more complex issue: government surveillance and the debated privacy-safety trade-off. Despite the fact that at the present moment we seem to be far from such orwellian scenarios, precautionary principles encourage us to raise awareness on privacy issues. On the contrary, a survey on the public perception of information gathering practices of the US government [START_REF] Anthony | Big Brother in the Information Age: Concerns about Government Information Gathering over Time[END_REF] shows an increase (1985)(1986)(1987)(1988)(1989)(1990)(1991)(1992)(1993)(1994)(1995)(1996) followed by a decrease (1996)(1997)(1998)(1999)(2000)(2001)(2002)(2003)(2004)(2005)(2006) of concerns regarding privacy threats. The decrease could be potentially explained by a "cultural lag": once people get accustomed to ICTs as part of their daily lives, the related fears diminish despite the fact that surveillance capabilities might increase. This might also be the case for biometrics in the following years. However, in this case, privacy issues regarding biometrics seem to be on the legislation table from the early beginning at least in the EU [START_REF] Bustard | The Impact of EU Privacy Legislation on Biometric System Deployment: Protecting citizens but constraining applications[END_REF]. Although, the case of biometrics for border control or national identification is too complex and out of the scope of this discussion, the idea of using such intrusive identification for customer profiling is, to my mind, unnecessary for the simple reasons that we are not the things we buy and that our preferences and habits should evolve as freely as possible in order to conserve diversity. Despite its socio-economic and political connotations, privacy can mean two things:

"the right to be left alone" and "the right to misrepresent oneself" [START_REF] Geer | The Right to Be Unobserved[END_REF]. Personally, I associate the former with a passive attitude and a personal legitimate choice of not disclosing ourselves. The latter is probably more complex since it can include active participation while escaping the responsibility of our sayings and doings. This type of duality characterizes implementations such as the "darknet". 5 Accessible to drug dealers and activists in the same time, the darknet is gaining increasing popularity even for mainstream activities because of its privacy features.6 * Telecommunications tools bring solutions to the issues they were designed for. The way we use them can nonetheless cause new problems that could have hardly been anticipated at their creation. Similarly to the example of the rapid industrial development followed by the recent acknowledgment of the need for sustainability measures, ICTs have witnessed widespread adoption and it is now becoming necessary to think about sustainable communication technologies. This cannot be achieved by applying the same concepts that launched or promoted the improvement of ICTs, but rather by delving into the social, economic, and political contexts and defining the core principles that we want ICTs to follow. Since they are already so deeply rooted in our lives to the point that our online identities are becoming persistent, we should expect ICTs to follow the same principles that we use to define our ideal society: choice, awareness, security, nondiscrimination, freedom of expression, solidarity, etc. As challenging as it may seem, we should try to translate aspects like these into technological solutions and integrate them in today's and tomorrow's systems.

(D.1) p(s|y, , γ) ∝ p(y|s, ) × p(s|γ) (D.2) p(y|s, ) = (2π 2 ) -N 2 e -1 2 2 (y-Ĥs) T (y-Ĥs) (D.3) p(s|γ) = (2πγ 2 ) -Ns 2 e -1 2γ 2 (Ps) T (Ps) (D.4) s T Σ s -1 s -2µ s T Σ s -1 s + cte = -2 (s T ĤT Ĥs -2y T Ĥs + cte) + γ -2 s T P T Ps (D.5)

Introduction

In the emerging Internet of Things (IoT), location information may contribute to forge, reinforce or control the ego identity of independent devices and users for security or privacy purposes. It may be also useful to establish common identities within local groups or communities (sometimes referred to as IoT "Bubbles of Trust"). Such information reflects both the unique physical insertion of a device in its geographical environment (e.g., its absolute 2D position in a given building) and its interconnections with other collocated fellows or entities (e.g., its relative position with respect to neighbors). This "spatialized" identity could become a key feature in trust and reputation marks granted In Section E, we browse through related state-of-the-art contributions. Section E presents a generic scheme enabling location-based pseudonym generation, as well as a specific example based on peer-to-peer range information and optionally, relative clock drifts. In Section E, we evaluate the schemes as a function of system parameters such as the quantization grids. Section E concludes the paper.

where ID i is the public ID of node i, [x i , y i ] are the 2D absolute Euclidean coordinates of node i delivered by, e.g., GNSS or a WiFi-based localization system, {d ij } j∈N e(i) is the set of measured peer-to-peer distances (possibly drift-biased, with relative clock drifts {γ ij } j∈N e(i) w.r.t. neighbors j ∈ N e(i)). Note that much simpler characteristics (still accounting for the "physical insertion" of the device) could be considered as well, such as node i's (N -hop) connectivity w.r.t. to nodes j ∈ N e(i).

One straightforward implementation of f (.) is a hash function. Hash functions map inputs of different lengths to a fixed-length output, while small changes in the input produce a completely different output. Moreover, cryptographic hash functions (e.g.

SHA-1) are deemed to be collision-resistant, meaning that there is a small probability to find two different inputs that give the same output. This property is useful in order to avoid pseudonym collisions between legitimate nodes but also with respect to an attacker.

The pseudonyms between different legitimate nodes can be shared either through direct communication during a secure short time period or by inference (i.e., the neighbors of a given node try to guess its pseudonym to the best of their knowledge). In the inference case, the measurements feeding the hash function are quantized in order to provide better stability and reciprocity against measurement noise for legitimate nodes. The setting of the quantization step is a key parameter that can be adapted online according to empirical measurement statistics. It is obvious that inference is preferable for security reasons. However, the choice of the method depends on the available information used as input to the hash function. Overall we identify two preferred embodiments:

• One global pseudonym per node: the hash input can contain location information (e.g. position, relative distances w.r.t. all the neighbors) and/or connectivity information (e.g. adjacency information), and/or further device-dependent information (e.g. relative clock drifts w.r.t. all the neighbors). Inferring this type of pseudonym requires public exchanges, which, in the long term, could lead to the full disclosure of the network characteristics and can limit the advantage with respect to attackers. In this case, the pseudonyms must be shared securely.

γ BF = ∆γ 1+δ 1-δ -1-δ 1+δ
where δ is the maximum clock imprecision (specified by the manufacturer).

We perform three studies. Firstly, we investigate the differences between the quantization of the estimated distances issued from two different technologies, namely Narrowband (NB) IEEE 802.15.4 at 2.4 GHz and IR-UWB. The relative distances are computed from RSSI and RT-ToF measurements, respectively in NB and IR-UWB cases (both under typical radio assumptions and parameters). Secondly, we evaluate the performances of pseudonym generation schemes jointly based on distance and drift for the IR-UWB case only. Finally, we compare our impersonation prevention method to an RSSI-based monitoring method [START_REF] Zeng | Non-Cryptographic Authentication and Identification in Wireless Networks[END_REF].

Pseudonyms from NB & IR-UWB range estimates

The received power measurements reflected by RSSI readings in NB are generally expressed (in dB) as a function of a log-normal distance-dependent path loss model [START_REF] Laaraiedh | Enhancing Positioning Accuracy through Direct Position Estimators Based on Hybrid RSS Data Fusion[END_REF],

whose key parameters are P L ref , the path loss reference at distance d ref , α, the path loss exponent, and X S , random centered Gaussian shadowing with standard deviation σ s .

In our simulations, we consider assigning to all the feasible links some random channel configurations (i.e., Line of Sight (LOS), Non Line of Sight (NLoS) and severe NLoS

Conclusion

In this paper we have investigated and discussed the possibility to generate, infer and/or share local pseudonyms out of various sources of radiolocation information for more secure IoT transactions and reinforced device identity. For the link dependent pseudonyms, we have shown that they could be securely guessed by legitimate neighbors, while achieving relatively low impersonation success rates. However, the absolute value of the attack success rates suggest that link dependent pseudonyms should be used as an authentication overlay.

Remaining challenges concern the degraded precision and the asymmetry of input measurements in typical environments. The performance of the proposed algorithms could be assessed on real integrated devices and field measurements. Mobility support is also challenging for the perennial tracking and management of new generated location-based IDs. It should also be noted that the pseudonyms provide a security overlay as long as the initial radiolocation measurements phase is not compromised by an active attacker.

However, in mobility scenarios, pseudonyms can be easily refreshed in order to counter passive attacks (e.g., eavesdropping).

between the two legitimate users. So one of the main challenges is how to distribute this common key among legitimate users in a secure way.

Among the classical key distribution approaches there are the Key Distribution Center (KDC) [START_REF] Menezes | Handbook of Applied Cryptography[END_REF], the Diffie Hellman (D-H) exchange protocol [START_REF] Diffie | New directions in cryptography[END_REF] and asymmetric cryptography. In the KDC method there is a third party who is responsible for the creation (or the storage) and distribution of keys among the users. This method is highly centralized, thus it is not adapted to ad-hoc/decentralized mobile networks. D-H exchange is a decentralized method but it includes expensive exponential operations, which should be avoided for resource constrained devices. Lastly, asymmetric cryptography relies on cumbersome certification operations for the public keys.

Physical layer security [START_REF] Bloch | Physical Layer Security[END_REF] includes an alternative approach for symmetric key distribution. It allows to extract a common secret key from the radio channel by measuring its features. The direct and reverse channels between two legitimate users (Alice and Bob) are theoretically reciprocal, but noise and other transmission artifacts can produce slightly different measurements. However, if an attacker, Eve, situated in a different position than Bob, will try to generate the same key, she will not succeed because of the spatial decorrelation of radio channels under certain distance and environmental conditions (i.e., the channel between Alice and Bob is uncorrelated with the channel between Alice and Eve).

The procedure of physical layer key generation can be separated in four steps [START_REF] Zeng | Physical Layer Key Generation in Wireless Networks: Challenges and Opportunities[END_REF]:

• Channel probing used to collect channel measurements by Alice and Bob. This step also includes post-processing in order to extract randomness from the measured signals.

• Quantization used to convert the extracted channel measurements into bits.

• Reconciliation used to correct random errors caused by imperfect reciprocity with the help of error correction codes such as Reed-Solomon or LDPC codes. During this procedure, the parity information is exchanged over a public channel and a certain amount of bit information will be revealed to Eve.

• Privacy amplification used to eliminate Eve's partial information about the key and the correlation among the bits.

Herein, we focus on the two first steps: post-processing of the channel acquisitions and quantization in order to produce appropriate raw keys.

Regarding quantization, one can apply several types of algorithms (Figure F.1). For example, One-level bit extraction means comparing the samples with a fixed threshold. (CQA) bit extraction scheme. In this method they combine quantization and reconciliation procedures. The main idea is that Alice quantizes her sequence and sends some information about it (a quantization map) to Bob through the public channel. After this, Bob quantizes his sequence using the obtained information. This helps Bob to reduce the error probability of his sequence.

This study is concerned with the generation of secret keys using Channel Impulse Responses obtained from IR-UWB low-complexity nodes developed at CEA-Leti [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF]. The generated keys are evaluated in terms of reciprocity, randomness and length. Also, a new quantization method adapted to the signals issued by the employed nodes is proposed.

The remainder of the study is organized as follows. The first section introduces the measurement campaign, shows the environment conditions in which the measurements took place, and describes the main metrics employed in this study. In the second section, we show the limitations of amplitude quantization for our specific signals. The proposed solution, analysis and the evaluation of results are presented in the third section. Finally, we conclude the study and provide several perspectives for further work. the n th elements of vectors c and b. This method is optimal but in a real scenario we cannot use it because one node is not aware about the measurements from the other node. This scheme will be used as a reference to estimate the optimal performance of key generation. Firstly, we test several quantization approaches that exploit the signal amplitude of cropped or uncropped CIRs as the input data: 1-bit (or one-level), 2-bit and 2-bit with guard bands (GBs). The main parameters for each quantization algorithm are the thresholds that divide the amplitude space into cells. Our thresholds are defined independently for each node. They are computed offline for the whole set of measurements.

Also, we concatenate 10 consecutive CIRs for obtaining sufficiently long keys. Table F.1

shows the mismatch rates for various quantization algorithms and scenarios. Unfortunately, in our particular case, such kind of quantization algorithms give unacceptable high mismatch rate ( i.e., always higher than 14%, even for static scenario and for the simplest one-level extraction algorithm). Moreover, it is not possible to use the entire uncropped signal for key generation because of the randomness defects of the obtained keys. One can clearly see this feature in Figure F.6 that compares keys obtained using 1-bit quantization on cropped and uncropped signals, where white corresponds to "1" and black corresponds to "0" bits). and after filtering with a window size equal to 10. This choice is made so as to obtain a reciprocity coefficient of minimum 0.9. In order to further investigate the random character of the keys after the new quantization scheme we applied the NIST tests. For the measurement in the Coffee room we obtain 98 keys of 108 bits and for the measurement in the Meeting room 97 keys of the same length. Table F.2 shows that a good percentage of keys pass the tests.

Number of samples

Conclusion

The generation of secret keys from IR-UWB channels, using low-complexity devices, has been investigated in this work. The measurements were performed in different environments. Estimated channel impulse responses were used as an input for key generation.

After channel probing, CIRs were synchronized, cropped and quantized in order to obtain raw secret keys. Standard amplitude quantization methods are not suitable for these particular devices, thus we proposed an alternative technique based on filtering and quantization of the number of samples above a threshold. The final implementation achieves good performance in terms of reciprocity and randomness. Nevertheless it has a lower key rate than amplitude-based quantization.

Further work could continue the investigation of the secret key generation procedure in other environmental conditions. For example, it would be interesting to test a mix of mobile and occupied scenarios. The optimization of the final quantization parameters and realistic synchronization methods could also be studied. Finally, the impact of public information (e.g., cropping and quantization parameters) on the predictability of the keys should be considered as well.

Génération de clés secrétés avec la couche physique dans les réseaux sans fil décentralisés

Une quantité importante de données personnelles ou sensibles seront produites et échangées par de nouvelles applications concernant la surveillance environnementale, la domotique, les villes intelligentes, l'optimisation de la consommation énergétique, les paiements sans fil, etc. Ces applications seront supportées le plus souvent par des réseaux sans fil décentralisés de type réseaux de capteurs (WSN), réseaux mobiles ad hoc (MANET), réseaux véhiculaires (VANET) ou encore réseaux personnels (WPAN Classiquement, on peut utiliser la cryptographie asymétrique (basée sur un couple clé privée -clé publique) ou des protocoles à base du schéma Diffie-Hellman [START_REF] Diffie | New directions in cryptography[END_REF] afin de distribuer une clé symétrique. Au-delà de la complexité calculatoire élevée de ces méthodes, la cryptographie asymétrique nécessite la mise en place d'un système de distribution des certificats et ne s'avère donc pas bien adaptée aux réseaux décentralisés. La distribution de clés à l'intermédiaire d'un centre de distribution de clés ou d'un serveur présente le même désavantage en termes d'architecture. Les solutions décentralisées [START_REF] Zhou | Securing Wireless Sensor Networks: a Survey[END_REF], comme par exemple la distribution des matériels cryptographiques avant déploiement afin de générer des clés symétriques après déploiement, ne peuvent pas assurer la flexibilité nécessaire au renouvellement de la clé symétrique. Les nouvelles recherches concernant la sécurité avec la couche physique proposent des méthodes alternatives pour la distribution des clés secrètes.

La sécurité avec la couche physique

Contrairement aux méthodes classiques de sécurisation qui reposent sur la difficulté calculatoire qu'un attaquant rencontrerait en essayant d'inverser les opérations cryptographiques utilisées par les algorithmes de chiffrage, la sécurité avec la couche physique de transmission radio utilise les avantages existants ou induits dans les canaux de communication sans fil. Des phénomènes comme le bruit ou les évanouissements (fading), considérés comme pénalisants pour la fonction de communication, sont utilisés afin de sécuriser les communications. En 1949, Shannon définit la sécurité au sens de la théorie de l'information à travers la notion d'ambiguïté qu'un message crypté induit pour un attaquant qui peut le lire parfaitement [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. En utilisant une clé sécrète de même longueur que le message et à l'aide d'opérations XOR, une communication peut être rendue parfaitement sécurisée indépendamment de la puissance de calcul détenue par l'attaquant. L'observation selon laquelle un message parvenant à un attaquant dans un canal de communication physique ne peut pas être récupéré sans aucune distorsion (a fortiori dans les canaux sans fil) a contribué à la définition du canal wiretap, ainsi qu'à l'extension de la définition de sécurité au régime asymptotique vis-à-vis de la longueur du message [START_REF] Wyner | The Wire-tap Channel[END_REF]. Ainsi, étant donné un encodage aléatoire des messages en émission, un attaquant disposant d'une copie imparfaite de ces messages peut avoir une ambiguïté maximale quand la longueur des messages tend vers infini. Dans le deuxième chapitre de cette thèse, on utilise des signaux IR-UWB obtenus par une méthode de modélisation déterministe du canal (ray tracing) pour mettre en évidence l'effet de la corrélation spatiale des signaux et de l'information publique sur la sécurité des clés obtenues avec une méthode existante [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF]. Ensuite, on présente deux méthodes plus discrètes de discussion publique : la première limite la quantité d'information divulguée et la deuxième la masque au moyen d'autres métriques réciproques caractérisant le lien légitime, telles que des mesures du temps de vol du signal (RT-ToF).

Génération de clés coopératives

Un des principaux défis pour le modèle source réside dans la collecte de mesures entropiques dans le cas de réseaux ou de liens peu dynamiques dans le temps. Pour pallier cette difficulté et arriver de surcroît à générer des clés partagées par plusieurs noeuds, on suggère d'étendre le modèle source point-à-point à des réseaux maillés de petite dimension en utilisant plusieurs liens physiques et des transmissions coopératives entre les utilisateurs.

L'idée principale du protocole proposé dans le troisième chapitre de cette thèse consiste à générer une clé de groupe à partir de mesures réalisées sur tous les liens d'un réseau maillé : des liens directs -ou adjacents-d'un noeud et des liens non-adjacents perçus par le biais de transmissions coopératives de la part de ses voisins. On aboutit alors à un problème d'égalisation, qui dans le cas de l'IR-UWB, prend la forme d'une déconvolution (ici, temporelle). Dans ce chapitre, on se propose donc de développer et de comparer différentes méthodes de calcul d'un signal porteur du canal non-adjacent pour son destinataire. Dans ce contexte, on s'intéresse à des méthodes d'estimation non-Bayésiennes de type maximisation de vraisemblance, qui s'avèrent assez peu efficaces, et à des méthodes Bayésiennes à base de validation croisée ou d'espérance-maximisation.

Finalement, on compare notre protocole à une solution de distribution utilisant des clés point-àpoint générées à partir de la même couche physique IR-UWB. On montre ainsi que notre méthode apporte des gains significatifs en termes de trafic et de longueur de clé, au détriment d'une complexité calculatoire accrue en cas de déconvolution. Néanmoins, l'approche proposée demeure applicable à des cas plus simples d'égalisation reposant sur des mesures de phase ou de coefficients OFDM.

Conclusion

Après un récapitulatif des grands résultats obtenus, de leurs limitations, ainsi que des perspectives de recherche qui en découlent, en lien avec le sujet initial sur la sécurité, la thèse se conclut par quelques réflexions personnelles sur l'impact sociétal des nouvelles technologies de communication sur l'individu et sur les principes de conception qui pourraient être appliqués afin d'éviter certains effets ou dérives non désirables.

Enfin, des travaux techniques connexes et des résultats intermédiaires sont décrits en annexes : i) quantification des informations réciproques de localisation afin de générer des pseudonymes et de fournir une sur-couche supplémentaire d'authentification ; ii) stratégies de quantification s'appliquant à des mesures expérimentales issues des dispositifs IR-UWB intégrés.

1. 1 3 . 3 F. 1

 1331 Security approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Degraded wiretap channel . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Broadcast channel with confidential messages . . . . . . . . . . . . . . . . 1.4 Secret key agreement source model . . . . . . . . . . . . . . . . . . . . . . 1.5 Secret key agreement channel model . . . . . . . . . . . . . . . . . . . . . 1.6 Key generation steps within the source model (with concerned steps highlighted in gray) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . List of Figures x Mean illegal bit agreement. Parameters: δ = 10 and ∆ bin = 0.25 ns . . . . 3.4 Mean successful key length. Parameters: δ = 10 and ∆ bin = 0.25 ns . . . . 3.5 Key agreement at SNR=15 dB . . . . . . . . . . . . . . . . . . . . . . . . 3.6 Mean illegal bit agreement at SNR=15 dB . . . . . . . . . . . . . . . . . . 4.1 Physical layer cooperative key generation . . . . . . . . . . . . . . . . . . 4.2 Example of deduced signal with the ML method (RMSE = 29.8%) . . . . 4.3 Example of deduced signal with the MAP method (RMSE = 9.8%) . . . . 4.4 Non-adjacent signal reconstruction performance for 100 channel configurations (ML, MAP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 Example of deduced signal with the unadapted MAP method (RMSE = 11.6%) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Generalization error curves for two channel configurations . . . . . . . . . 4.7 Non-adjacent signal reconstruction performance for 100 channel configurations (EM, MAP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.8 Example of deduced signal with EM (RMSE = 9.8%) . . . . . . . . . . . 4.9 Typical input quantization signal seen by the three nodes (SNR= 20 dB) 4.10 Average key length gain of CKG w.r.t. CKD . . . . . . . . . . . . . . . . 4.11 Average bit matching for CKG . . . . . . . . . . . . . . . . . . . . . . . . A.1 Illustration of the computation of the uBP P . . . . . . . . . . . . . . . . D.1 Convergence behavior of parameter . . . . . . . . . . . . . . . . . . . . . D.2 Convergence behavior of parameter γ . . . . . . . . . . . . . . . . . . . . . E.1 Possible block diagram of a location-based pseudonym generator. . . . . . E.2 Performance of range-based pseudonym generation : legitimate inference success probability (P l ) and attack success probability (P (p)BF ) . . . . . E.3 Performance of pseudonym generation based on relative range vs. jointly relative range and clock drift measurements at fixed ∆ d = 10 m . . . . . E.4 Comparison of the successful attack probabilities in pseudonym generation vs. RSSI monitoring for different attacker-legitimate distances d AE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Examples of types of quantization algorithms . . . . . . . . . . . . . . . . F.2 Structure of the communication protocol . . . . . . . . . . . . . . . . . . . F.3 Plan of the Meeting room . . . . . . . . . . . . . . . . . . . . . . . . . . . F.4 Histogram of the difference between the reciprocity coefficients obtained with MAXCORR and THRESHOLD . . . . . . . . . . . . . . . . . . . . . F.5 Example of the typical bidirectional CIRs . . . . . . . . . . . . . . . . . . F.6 The keys after 1-bit quantization for static scenario before and after cropping158 F.7 Signals before filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F.8 Signals after filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F.9 The keys after the moving average filtering and the new quantization scheme applying. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Symbols c, n, N , λ scalar values x(t) a continuous signal x[.], X[.] arrays of scalar values I a set |I| the cardinal of a set std(.) the empirical standard deviation of a set of values X a random variable E X [.] the expectation over the random variable X

Figure 1 . 1 :

 11 Figure 1.1: Security approaches

Figure 1 . 3 :

 13 Figure 1.3: Broadcast channel with confidential messages

Figure 1 . 5 :

 15 Figure 1.5: Secret key agreement channel model

Figure 1 . 6 :

 16 Figure 1.6: Key generation steps within the source model (with concerned steps highlighted in gray)

  example of an IEEE 802.15.4a CM1 channel realization h(t) and the analogue received signal are shown in Figure 2.1(a) -2.1(b). On each side of the A-B link, the CIR can be estimated as ĥ[n] after performing, for example, a straightforward frequencydomain deconvolution of the presumably known transmitted waveform p[n] out of the received signal y[n]

Chapter 2 .

 2 Quantization of IR-UWB signals Noiseless deconvolution result with filtering

Figure 2 . 1 :

 21 Figure 2.1: Channel estimation by frequency deconvolution (noiseless case)

  Section 2.2.2. The rest of the key generation protocol remains the same. The main idea is to exploit the absolute amplitude of the signal across the iterative extraction steps in order to improve the encoding process after applying pos i . The observation window is split into N b bins of a given sample length ∆ bin . These two parameters are considered public. The auxiliary bit operations of HIST, denoted by the operator hist b from Eq.

Figure 2 . 2 :

 22 Figure 2.2: Illustration of HIST algorithm in one bin

  Figure 2.3 shows a regularity pattern for POS keys in both bit and frequency domains. The dominant frequency component at approximately 0.27 is equivalent to a bit pattern period (BPP) of 1/0.27 = 3.7 bits. The quantization diversity of HIST seems to solve this issue because HIST keys do not show any particular dominant frequency. Frequency representation of HIST keys

Figure 2 . 3 :

 23 Figure 2.3: Periodic nature of CM1 extracted keys using FD strategy. Parameters: δ = 10 (POS and HIST) and ∆ bin = 10 samples (HIST)

For

  the considered initial scenario, POS passes the frequency and random walk tests, but fails the oscillations and pattern tests for almost all the keys. Moreover, it does not respect the uniformity criterion on the p-values for any of the tests. On the contrary, HIST shows an improvement in the uniformity of p-values over all tests and manages to pass them with a minimum proportion of 94%. These results reinforce the trends observed in the key-frequency diagrams from Figure 2.3, which give a complementary representation of the statistical pattern test. Next, we present a synthesis of four randomness tests for the initial scenario (CM1, f c = 4.5 GHz, B = 1 GHz, FD strategy) and for several extensions using various channel models, central frequencies and bandwidths, or with a different input signal (DS

Figure 2 .

 2 Figure 2.4 shows the limitations of HIST in terms of generating successful 64-bit keys especially for high δ and ∆ bin values. The lower key agreement ratio for HIST is mainly

1

  Iteration parameter (δ) Min. 64-bit key agreement

Figure 2 . 4 :

 24 Figure 2.4: Key agreement for POS and several variants of HIST(∆ bin (samples)), SNR=20 dB and SNR=30 dB

Figure 2 . 5 :

 25 Figure 2.5: Bit agreement for POS and several variants of HIST(∆ bin (samples)), SNR=20 dB and SNR=30 dB

Figure 2 . 6 :

 26 Figure 2.6: Quantization thresholds

2 .

 2 18) with µ n = E[|X n |] and σ n , the standard deviation of |X n |, representing channel parameters computed empirically from simulations using the 802.15.4a channel model CM1 and Chapter Quantization of IR-UWB signals 53 a reference acquisition window. The mean and the standard deviation of the channel taps are decreasing functions of the excess delay index n, similarly to the power delay profile (PDP).

  n follows the distribution in Eq. (2.18) and that it is independent of W n . The details of the computation and the final expressions are provided in Appendix B. The inter-key reciprocity-randomness trade-off is studied in Sections 2.3.2-2.3.3.

2 .

 2 [START_REF] Trappe | The challenges facing physical layer security[END_REF] with sgn(.) the sign function and µ an arbitrary parameter. The result is a nonuniform quantization algorithm with gradually decreasing quantization intervals, which are also symmetric with respect to 0. Accordingly, the quantization intervals Chapter Quantization of IR-UWB signals 55 are expected to be larger for the values y n with lower signal-to-noise ratio (SNR)

( 2 . 2 .

 22 [START_REF] Chen | Wiretap Channel with Side Information[END_REF])-(2.20) and the channel tap model described in Section 2.3.1. The parameters of the Gaussian mixture model for the channel taps X n are computed empirically from IEEE 802.15.4a simulations over a 50 ns acquisition window: µ n ∈ [0.075, 0.44], σ n ∈ [0.05, 0.18]. The estimation noise is fixed at a reference value of σ 0 = 0.1. This corresponds to a variation of the SNR from 13.5 dB to -0.9 dB between the beginning and the end of the acquisition window. At fixed CS (QQ scheme), the mean Hamming distance increases almost linearly with the excess delay because of the degradation in the SNR (Figure 2.7). The UQ and CQ quantization algorithms achieve an optimal HD at a characteristic excess delay, which corresponds mainly to an asymptotically high value of CS (Figure 2.8). The UQ and CQ Chapter Quantization of IR-UWB signals q = 0.25 UQ: ∆ q = 0.35 QQ: eq QQ: ineq CQ: µ = 0.5 CQ: µ = 3 CQ: µ = 5

Figure 2 . 7 :

 27 Figure 2.7: Inter-key reciprocity cost for various quantization schemes

Figure 2 . 8 :

 28 Figure 2.8: Inter-key diversity cost for various quantization schemes

Chapter 2 .

 2 Quantization of IR-UWB signals 57 Optimized quantization thresholds Given the symmetry of the problem, the optimization can be performed on a threedimensional variable θ = [θ 2 , θ 3 , θ 4 ], which contains the positive thresholds corresponding to a quantization on 3 bits (i.e., 8 valid codewords in total including 4 codewords corresponding to positive values of y n ). The optimization routines are based on Eq. (2.19), (2.20), (2.22) and on the a priori measured channel statistics (µ n , σ n ). Both problems are solved with a nonlinear constrained optimization function using the interior-point algorithm (fmincon solver from Matlab R ). In the case when the optimization results vary with the initialization values of the solver (e.g., for O 1 ), the final thresholds are the ones achieving the minimum cost over 100 trials starting from uniformly random initial values. For illustration purposes, we use two SNR values corresponding to different excess delays in a real channel (SNR 1 = 13.5 dB and SNR 2 = 7.3 dB). The obtained thresholds with O 1 are shown in Figure 2.9.

Figure 2 . 9 :

 29 Figure 2.9: Illustration of the optimal thresholds O 1 for SNR 1

Figure 2 . 10 :

 210 Figure 2.10: Illustration of the thresholds O 1 for SNR 2

Figure 2 . 12 :

 212 Figure 2.12: Illustration of the diversity-aware quantization method (DIV)

3 . 4 , 1 FIX

 341 HIST also achieves intra-key diversity, which might seem contradictory at first sight because the uniformly sampled signals employed for testing HIST do not contain explicit delay information, such as excess delays. We DIV ∆ bin = 5 ns DIV ∆ bin = 10 ns

Figure 2 . 13 : 1 FIX

 2131 Figure 2.13: Mean intra-key reciprocity metric

Figure 2 . 14 :

 214 Figure 2.14: Mean intra-key diversity metric

  because of the fine temporal resolution capabilities of the IR-UWB technology (Section 1.3). The latter allows the extraction of accurate information such as amplitude and delay of the representative multipath components of a CIR. Not only does one CIR contain several scalar values, the latter are hard to predict by an attacker without knowing the exact positions of A and B or without employing complex ray-tracing tools [92] [96].

Chapter 2 .

 2 Quantization of IR-UWB signals 64 be relatively large. The tutorial in Yang and Giannakis[START_REF] Yang | Ultra-Wideband Communications: an Idea Whose Time Has Come[END_REF] provides several examples of timing acquisition techniques and channel estimation methods adapted to IR-UWB signals. Further, we will present an extended classification of channel estimators based on the required sampling frequencies employed for signal acquisition before the key generation stage (high, low, or sparse). The sparsity-aware estimators, which take into account the sparse structure of the CIR modeled as a Dirac stream, are divided into two categories based on their approach: Finite Rate of Innovation (FRI) estimators, which translate the channel estimation into an harmonic retrieval problem, and Compressed Sensing (CS) algorithms.

  pling, derivative sampling or super-resolution sampling for image reconstruction, have been developed and have inspired the extension of sampling theorems to a larger class of signals: infinite-bandwidth signals with limited energy[START_REF] Unser | A Generalized Sampling Theory without Band-Limiting Constraints[END_REF].Similarly, perfect reconstruction of non-band-limited noiseless signals presenting a finite number of degrees of freedom per unit of time (i.e., the rate of innovation) is possible by employing a finite number of uniform samples[121] [122]. Examples of this type of signals include streams of Diracs or piecewise polynomials sampled with a sinc kernel at or above their rate of innovation. For example, in the case of a periodic stream of Diracs, the reconstruction is equivalent to the harmonic retrieval problem: estimation of the phases and amplitudes of a finite number of exponentials by sampling their sum.The main idea is to employ a tool from spectral theory, namely an annihilating filter7 applied in the domain of Fourier series coefficients, in order to identify the time instants of the Diracs and then compute the Diracs' amplitudes.To sum up, the reconstruction of h, a T -periodic stream of K Diracs can be achieved as follows: i) sampling the sparse signal h with a low-pass kernel to obtain M samples (M ≥ 2K + 1); ii) computing M Fourier series coefficients H[m] of h by solving a linear system constructed with the M samples; iii) finding the coefficients A[m] of the annihilating filter of H[m]; iv) finding the roots of the annihilating filter, each of them giving direct access to the time instants τ k of the Diracs; v) computing the Diracs' amplitudes x k by solving H[m] = K k=1 x k e -2πjmτ k /T .

θ∈R N ||θ|| 1

 1 subject to y m = φ m , Ψθ , m ∈ {1, . . . , M }.

Chapter 2 .

 2 Quantization of IR-UWB signals 70 estimators in order to generate CIR estimations. Next, we detail the considered channel estimators.

Figure 2 . 15 :

 215 Figure 2.15: Illustration of an IEEE 802.15.4a true multipath channel

Figures 2. 16

 16 Figures 2.16-2.17 show examples of the reconstructed signals from various estimators

  Figures 2.16-2.17 show examples of the reconstructed signals from various estimators and the corresponding estimated bidirectional CIRs for an arbitrary channel realization (Figure 2.15). The bidirectional CIRs are measured at A an B and are denoted by different colors. The number of estimated multipath components is K = 8 and the SNR is deliberately high for better visualization (SNR = 25 dB). The reconstructed signals (Figure 2.16) are shown only for one side of the link because there is no significant

Figure 2 . 16 :

 216 Figure 2.16: Illustration of initial and reconstructed "analog" signals with various estimators

  Finite Rate of Innovation estimator (FRI)

Figure 2 . 17 :

 217 Figure 2.17: Illustration of the estimated bidirectional CIRs with various estimators

18

 18

Figure 2 . 18 :

 218 Figure 2.18: RMSE A,B before pairing at low and high SNR: 5 dB (L) and 30 dB (H)

Figure 2 . 19 :

 219 Figure 2.19: RMSE A,B after pairing at low and high SNR: 5 dB (L) and 30 dB (H)

Figure 2 . 20 :Figure 2 . 21 :

 220221 Figure 2.20: Mean number of paths after pairing: 5 dB (L) and 30 dB (H)

Figure 2 . 22 :

 222 Figure 2.22: Mean bit agreement before pairing for K = 18

Figure 2 . 23 :

 223 Figure 2.23: Mean bit agreement gain after pairing for K = 18

Figure 3 . 1 :Figure 3 . 2 :

 3132 Figure 3.1: Key agreement. Parameters: δ = 10 and ∆ bin = 0.25 ns

Figure 3 . 3 :Figure 3 . 4 :

 3334 Figure 3.3: Mean illegal bit agreement. Parameters: δ = 10 and ∆ bin = 0.25 ns

ToFFigure 3 . 5 :

 35 Figure 3.5: Key agreement at SNR=15 dB

ToFFigure 3 . 6 :

 36 Figure 3.6: Mean illegal bit agreement at SNR=15 dB

Chapter 4 .

 4 mitter u ∈ {A, B, C} and the receiver v = u, v ∈ {A, B, C}, p(t) is the transmitted pulse waveform of duration T p , h uv = h vu is the reciprocal channel impulse response between u and v, x k and τ k are respectively the amplitude and delay associated with the k th multipath component (k ∈ {1, ..K}), and w uv (t) is the AWGN. Cooperative physical layer key generation 97

Figure 4 . 1 :

 41 Figure 4.1: Physical layer cooperative key generation

Steps 1 -

 1 3 can be performed by both A and B because they can both measure C's non-adjacent reciprocal channel [B -A] ≈ [A -B]. If both of them send an ssignal, supplementary processing can be used at C to coherently take advantage of the two incoming signals r BA and r AB in order to obtain a more reliable version of the non-adjacent channel. • processing of all the acquired signals at the generator C. At this point, C detains signals corresponding to all three channels. These signals are further processed (e.g., through windowing, signal squaring, low-pass filtering and down-sampling at frequency F p , compatible with the multipath resolution capability allowed by the signal bandwidth). The generator C then concatenates the three signals to obtain the input quantization signal S CAB . The concatenation is applied according to an arbitrary order without loss of generality.

Chapter 4 .

 4 Cooperative physical layer key generation

Figure 4 . 2 :

 42 Figure 4.2: Example of deduced signal with the ML method (RMSE = 29.8%)

Chapter 4 .

 4 Cooperative physical layer key generationAC * h AC )(t)

Figure 4 . 3 :

 43 Figure 4.3: Example of deduced signal with the MAP method (RMSE = 9.8%)

matrix P . Figure 4 . 4 :

 .44 Figure 4.4: Non-adjacent signal reconstruction performance for 100 channel configurations (ML, MAP)

Figure 4 . 5 (

 45 basic channel configuration).AC * h AC )(t)

Figure 4 . 5 :

 45 Figure 4.5: Example of deduced signal with the unadapted MAP method (RMSE = 11.6%)

  Example of non-convex generalization error

Figure 4 . 6 :

 46 Figure 4.6: Generalization error curves for two channel configurations

Figure 4 . 7 :

 47 Figure 4.7: Non-adjacent signal reconstruction performance for 100 channel configurations (EM, MAP)

Figure 4 . 8 :

 48 Figure 4.8: Example of deduced signal with EM (RMSE = 9.8%)

Chapter 4 .Figure 4 . 9 :

 449 Figure 4.9: Typical input quantization signal seen by the three nodes (SNR= 20 dB)

  keys using the physical layer in IR-UWB systems without relying on classical pairwise

Figure 4 . 10 :

 410 Figure 4.10: Average key length gain of CKG w.r.t. CKD

Figure 4 . 11 :

 411 Figure 4.11: Average bit matching for CKG

Chapter 4 .

 4 Cooperative physical layer key generation 115 deconvolution solution, whereas the second one applies the Expectation Maximization algorithm to obtain a joint estimation of the required signal and of the parameters of the employed statistical model. The two methods are iterative with different levels of complexity (i.e., iterative cost computations for CV and iterative matrix inversions for EM) but also different evolution opportunities (e.g., the EM model is more adapted for incorporating the errors on channel estimation).

(Figure E. 4 :

 4 Figure E.4: Comparison of the successful attack probabilities in pseudonym generation vs. RSSI monitoring for different attacker-legitimate distances d AE

Figure F. 1 :

 1 Figure F.1: Examples of types of quantization algorithms

Figure F. 3 :

 3 Figure F.3: Plan of the Meeting room

Figure F. 5 :

 5 Figure F.5: Example of the typical bidirectional CIRs

Figure F. 6 :

 6 Figure F.6: The keys after 1-bit quantization for static scenario before and after cropping

Figure F. 7 :

 7 Figure F.7: Signals before filtering.

Table 2 .

 2 1and Figure2.2). In this example, the indexes 21, 23, 24, 26 and 29 belong to the same bin if a bin contains 10 samples. The iteration steps corresponding to the bits extracted by POS are also memorized ("Iteration steps" row). Even though they can be available in both algorithms, the values of the iteration steps are not used for POS.

Table 2 . 1 :

 21 Illustration of the bit extraction algorithms (HIST vs. POS)

	Bits extracted by POS	1	0	0	1	1
	Delay indexes of POS bits (P) 21 23 24 26 29
	Iteration steps # (I b )	10 12 10 17 12
	Indices of the steps (k)	1	2	1	3	2
	Final bits (HIST)	1	1	0	1	0
					#10
	Amplitudes	0			#12 #12 #17 #17
					#10
		Samples 21 22 23 24 25 26 27 28 29 30

Table 2 . 2 :

 22 Statistics on NIST randomness tests for several scenarios: A(CM1/The results are presented in Table2.2. The conclusions of the initial scenario can be reported to all the other scenarios. HIST pass ratios in the runs and serial tests slightly

	[fc;B]=[4.5;1] GHz/FD) & B(CM2/ [fc;B]=[4.5;1] GHz/FD) & C(CM1/ [fc;B]=[2.5;1]
	GHz/FD) & D(CM1/ [fc;B]=[4.5;0.5] GHz/FD) & E(CM1/ [fc;B]=[4.5;1] GHz/DS)
	Scenario	Metric	Freq. Block	Sums(1) Cum.	Runs	Serial(1)
	A	POS HIST	% 10 3 V ar 3.33 100% % 98% 10 3 V ar 81.96	100% 10.93 98% 90.17	3% NA 94% 89.62	0 NA 94% 77.52
	B	POS HIST	% 10 3 V ar 3.86 100% % 97% 10 3 V ar 87.45	100% 15.10 96% 96.59	2% NA 93% 96.23	0 NA 93% 83.99
	C	POS HIST	% 10 3 V ar 5.93 100% % 99% 10 3 V ar 83.53	100% 15.84 99% 86.85	59% 15.26 98% 86.91	0 NA 97% 83.62
	D	POS HIST	% 10 3 V ar 3.51 100% % 96% 10 3 V ar 85.60	100% 11.58 95% 95.79	2% NA 89% 83.78	0 NA 91% 79.90
	E	POS HIST	% 10 3 V ar 3.06 100% % 98% 10 3 V ar 80.06	100% 10.35 97% 89.18	1% NA 90% 90.41	0 NA 92% 78.69
	decrease when using a narrower bandwidth pulse (scenario D). A supplementary test
	confirms that the pattern drawback found by the serial test (pass rate of 91%) is related
	to the bin size, which becomes comparable to the pulse duration in scenario D: by
	increasing the bin size to 20 samples, the serial(1) pass rate for HIST becomes 96%,
	meaning that the pattern defect is a limitation of the encoding procedure itself, which
	is, after all, a deterministic algorithm. Overall, from the point of view of these tests, the

strategy). The algorithm parameters, the key lengths and the number of tested keys are the same as for the previous tests. The condensed metrics are the pass rate (%) and the variance of the p-values used for representing the uniform character of the repartition (V ar). If the variance is small, this would correspond to a non-uniform repartition of p-values meaning that the extraction algorithm is prone to produce keys within certain p-values, i.e., with a certain deterministic aspect, regardless of the channel. best scenario for both POS and HIST would be one using the FD strategy as well as a pulse with lower central frequency (i.e. with less oscillations), but large bandwidth.

In conclusion, the proposed extension, HIST, passes all the tests in most cases and solves

Table 2 . 3 :

 23 Performance metrics for the extraction of keys of max. 128 bits from CM1 channels using the DS strategy at SNR=30 dB. Parameters: δ = 10 (POS and HIST)and ∆ bin = 10 samples (HIST).

  T PΣ s ) + s T P T Ps N s

	15
	E-step: ξ i ( , γ) = E s|y, i-1 ,γ i-1 [ln p(y, s| , γ)]	(4.18)
	M-step: ( i , γ i ) = arg max	ξ i ( , γ)	(4.19)
			( ,γ)
	After the developments detailed in Appendix D, we obtain a mean signal s, its associated
	covariance Σ s , and the model parameters and γ:
	Σ s = ( -2 ĤT Ĥ + γ -2 P T P) -1	(4.20)
	s = -2 Σ s	ĤT y	(4.21)
	=	y T y -2y T Ĥs + Tr( ĤT ĤΣ s ) + s T ĤT Ĥs N	(4.22)
	γ =	Tr(P

Table 4 . 1 :

 41 Exchanged packets for one group key generation/distribution

	Phase/Method	CKD	CKG
	Pairwise channel probing	3	3
	Cooperative channel probing	0	3 or 6
	Reconciliation (dropping)	6	3
	Reconciliation (error-correction)	3	1
	Key distribution	1 + 2	0
	Total	15	10 or 13

Table 4 .

 4 2 compares the number of packets needed for CKD and CKG in a full mesh network of N nodes when CKG inference is achieved with only one cooperator. Because of the cooperative channel probing, CKG is less scalable than CKD for N > 6. However, larger values of the number of nodes makes it difficult to obtain a full mesh scenario and to establish a key during the channel coherence time for both methods and they are, therefore, not practical.

Table 4 .

 4

	2: Exchanged packets for one group key generation/distribution in a full mesh
		of N nodes
	Phase/Method	CKD	CKG
	Pairwise channel probing	N	N
	Cooperative channel probing	0

  to mobile devices. Besides, various wireless localization technologies have emerged in the last past years, based on, e.g., fingerprinting with respect to WiFi access points, Bluetooth-Low Energy beacon-based cell attachment, range-based trilateration and cooperative positioning over Impulse Radio -Ultra Wideband (IR-UWB) or Zigbee links.In this context, ad hoc location-based pseudonyms could be generated and used as a protection overlay to prevent impersonation attacks. Known uniquely by the legitimate devices (either through secure sharing or robust guess) and supposed secret with respect to attackers, they ease authentication procedures and protect data transactions. Secure procedures based on pseudonyms generated from stable connectivity or explicit location information rely on the fact that any malicious entity claiming a stolen public ID or address can neither experience nor generate the same physical awareness as that of the legitimate peers under attack. These schemes can also be extended to generate local secrets similarly to Physically Unclonable Functions (PUF) or to produce seeds for Pseudo Random Number Generators (PRNG).

	tion results show tangible gains in terms of : i) legitimate inference success rate, when
	integrating IR-UWB RT-ToF measurements instead of IEEE 802.15.4 RSSI readings as
	quantization inputs (because of lower noise dispersion in practical environments), ii)
	immunity against attackers with prior statistical knowledge about the expected range
	distributions, by coupling estimated relative clock drifts with range estimations, iii) pre-
	vention against impersonation attacks with the proposed range-based approaches as an
	alternative to direct RSSI monitoring solutions.

This paper introduces simple methods to generate local pseudonyms out of various radiolocation features and technologies, which could be available in turn in most IoT devices, namely Received Signal Strength Indicator (RSSI) readings or measured Round Trip -Time of Flight (RT-ToF) of packets over the short-range peer-to-peer communication links. Particularly, we propose techniques that combine one-hop wireless connectivity, relative range information and optionally, device-dependent characteristics (e.g., estimated relative clock drifts, which are often required to mitigate RT-ToF measurement biases). The aim is not only to generate local pseudonyms but also to make possible the guess of these pseudonyms by trusted neighbors (secure legitimate inference). Simula-

  qd AB = qd AB |r] × P rob[ qγ AB = qγ AB ] (E.8) with R max the maximum internode distance/range, p R (r) the a priori probability density function of the internode distance for uniformly distributed nodes, R the random variable representing the legitimate(A-B) internode distance, f the guessed feature f ∈ {qd, qγ} at the attacker, P d (p)BF the probability of guessing the quantized distance based on: i) BF : P d BF (r) = ∆ d Rmax or ii) pBF: P d pBF (r) = p R (r), P γ BF the probability of guessing the quantized drift, independently of the internode distance: P

	P (p)BF |R (r) = P rob[P S E (A) = P S A (A)|r]	(E.6)
	= P d (p)BF (r) × P γ BF	(E.7)
	= P rob[
	• Link-dependent pseudonyms: the hash function outputs a new ID of the present
	node w.r.t. each neighbor using link-dependent information (e.g. relative distance
	or relative clock drift w.r.t. to the respective neighbor). In this case, the inference
	is facilitated thanks to the assumed reciprocity of the input data (See Figure E.1)
	and it can be achieved without any public exchange of information.
	Therefore, pseudonym generation schemes rely mainly on non-complex digital operations
	(quantization and hash functions) and on the ranging capabilities increasingly present

Table F . 1 :

 F1 Comparison of different quantization algorithms in Static (Mobile) scenarios, with (without) signal cropping

			Mismatch
		Entire signal	Cropped signal
	Quantization algorithm	Static M obile Static M obile
	1-bit	0.14	0.25	0.29	0.33
	2-bit	0.26	0.33	0.41	0.35
	2-bit + GBs	0.22	0.24	0.26	0.29

Table F . 2 :

 F2 Comparison of different quantization algorithms in Static (Mobile) scenarios, with (without) signal cropping.

	Test	Occupancy scenario	Mobile scenario
	The Frequency test	98/98	92/97
	Frequency test in a block	98/98	95/97
	The Cumulative Sums test	98/98	93/97
	The Runs test	97/98	94/97
	The Entropy test	98/98	87/97

  ). Dans ce sens, de nouvelles technologies et standards sont en train d'être mis en place: WiFi Direct et l'option D2D dans les standards 5G en cours, IEEE 802.11p adapté aux VANET et technologies de communications à courte portée (Near Field Communications), Bluetooth-Low Energy, IEEE 802.15.4 ou Zigbee, IEEE 802.15.4a ou IEEE 802.15.6 à base de radio impulsionnelle ultra large bande (IR-UWB)).Étant donné la nature de ces données et la vulnérabilité des réseaux de communication sans fil aux différents types d'attaques passives (par exemple, eavesdropping) ou actives (par exemple, corruption de l'intégrité des données), les systèmes de communication devraient être protégés par des mesures de sécurité adaptées en termes d'architecture, complexité de calcul, etc. La plupart des solutions cryptographiques assurant la confidentialité et l'intégrité des données reposent sur la cryptographie symétrique qui demande le partage a priori d'une clé secrète identique de part et d'autre du lien de communication et son renouvellement périodique. Le problème ainsi intitulé « distribution de clé » devient encore plus difficile dans les réseaux décentralisés, sans infrastructure ou avec une connectivité et une topologie dynamiques (typiquement, en situation de mobilité).

des signaux IR-UWB pour la génération de clé en point-à-point

  En 1993, Maurer et Ahlswede & Csiszàr étudient les capacités de génération d'un secret partagé à partir de deux modèles[START_REF] Maurer | Secret Key Agreement by Public Discussion from Common Information[END_REF] [Ahl93] : i) un canal wiretap auquel on ajoute un canal public authentifié utilisé pour assurer un retour/échange d'information entre les utilisateurs légitimes (modèle canal) ; ii) une source aléatoire observée par tous les utilisateurs et un canal publique (modèle source). Il se trouve que, grâce à la possibilité de traiter séparément les conditions de fiabilité et de confidentialité, le modèle source est plus facilement mis en oeuvre.On connaît ainsi des solutions qui consistent à générer des clés secrètes à partir des seules propriétés du lien de communication sans fil à protéger. Les terminaux des utilisateurs légitimes (Alice et Bob) viennent mesurer certaines métriques radio (par exemple, les réponses impulsionnelles du canal de communication reliant les terminaux ou des séquences de puissance reçue) afin d'extraire une clé secrète commune. Cette solution tire partie de la réciprocité bidirectionnelle entre le lien direct et la voie retour, et de la décorrélation "spatiale" des canaux de communication sans fil. Plus précisément, la réponse impulsionnelle du canal de communication entre Bob et Alice est théoriquement identique, au bruit près, à celle du canal de communication entre Alice et Bob. Alice et Bob peuvent donc séparément élaborer la même clé secrète à partir d'une estimation du canal de communication les reliant, réalisée de part et d'autre du lien. Par ailleurs, dès lors que le terminal de l'attaquant (Eve) est situé à plus de quelques longueurs d'onde de celui de Bob (dans le cas des communications bande-étroite), le canal de communication entre Alice et Eve (respectivement entre Bob et Eve) a des caractéristiques décorrélées de celui entre Alice et Bob (respectivement entre Bob et Alice). Il n'est donc pas aisé pour Eve de générer la même clé secrète en écoutant simplement ses propres canaux vis-à-vis d'Alice ou de Bob. Enfin, le canal de communication entre Alice et Bob est généralement sujet à des variations temporelles de ses caractéristiques, notamment lorsque l'une ou l'autre des parties se déplace. La clé secrète peut ainsi être renouvelée, ou sa longueur peut être augmentée.Dans ce travail, on a employé le modèle source de partage de clé en l'appliquant aux communications impulsionnelles ultra large bande. Ces dernières permettent en effet de « capter » une quantité d'information mutuelle suffisamment riche de part et d'autre du lien, du fait du pouvoir de résolution multi-trajets conféré par la largeur de bande en réception. Typiquement, les méthodes de génération de clé à partir de la couche physique et du modèle source se décomposent en plusieurs étapes : i) acquisition du canal (mesures, estimations etc.) et extraction de la partie aléatoire ; ii) quantification des valeurs à travers un encodage binaire ; iii) réconciliation des séquences binaires légitimes en corrigeant les possibles différences à l'aide d'échanges sur le canal de communication public ; iv) amplification de privacy, utilisée pour diminuer la quantité d'information qu'un attaquant pourrait détenir ou gagner sur la clé finale. En la matière, on s'est particulièrement intéressé aux phases initiales d'estimation et de quantification, ainsi qu'aux discussions publiques à des fins de réconciliation. On a également proposé une nouvelle extension du modèle source à la génération coopérative (entre plusieurs noeuds) de clés de groupe. Le résultat de l'étape de quantification (ou la clé avant correction d'erreur) est évalué en fonction de trois critères de base : la longueur (préférablement grande), le nombre d'erreurs entre les séquences générées de part et d'autre du lien (ou inversement la réciprocité des séquences) et le caractère aléatoire, imprévisible. Ces trois critères constituent les axes d'un compromis caractérisant la génération de clé sur une liaison point-à-point. Le premier chapitre de cette thèse s'intéresse à plusieurs aspects de ce compromis en utilisant différents types de signaux IR-UWB. Tout d'abord, à partir de travaux existants[START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF] sur la génération de clé avec des signaux IR-UWB directement échantillonnés (à environ 20 GHz), on propose un nouvel algorithme d'encodage binaire qui favorise le caractère aléatoire des séquences finales tout en observant les impacts négatifs sur la réciprocité. Notre algorithme utilise un procédé d'embrouillement (scrambling) en fonction de l'amplitude et du retard du canal, qui « efface » les motifs binaires induits par la forme d'onde de l'impulsion de sondage du canal. Ensuite, on s'intéresse au compromis entre réciprocité et caractère aléatoire des clés, en fonction de différentes stratégies de quantification et pour des réponses impulsionnelles (CIR) bruitées générées de manière synthétique à partir d'un modèle statistique du canal IR-UWB (IEEE 802.15.4a). A cette fin, on introduit une nouvelle métrique permettant d'évaluer un aspect du caractère aléatoire des clés : la diversité des mots de code binaires générés par l'algorithme de quantification. Le compromis mentionné est alors illustré par le biais d'une étude d'optimisation des seuils de quantification pour un nombre fixe de bits par échantillon, d'une part, et avec la proposition d'une nouvelle méthode de quantification favorisant la diversité des mots de code, d'autre part.Finalement, l'impact d'estimations réalistes des CIR IR-UWB sur la réciprocité est mis en évidence pour trois estimateurs représentatifs : un estimateur à très haute résolution reposant sur un filtrage adapté à la forme d'onde reçue[START_REF] Gifford | Effect of Bandwidth on the Number of Multipath Components in Realistic Wireless Indoor Channels[END_REF] et deux estimateurs parcimonieux (Compressed Sensing[START_REF] Paredes | Ultra-Wideband Compressed Sensing: Channel Estimation[END_REF] et Finite Rate of Innovation[START_REF] Maravic | Channel Estimation and Synchronization with Sub-Nyquist Sampling and Application to Ultra-Wideband Systems[END_REF]). Afin d'améliorer la réciprocité fortement dégradée par les fausses détections de trajets, on propose également à cette occasion un algorithme d'appariement.Stratégies discrètes de discussion publiqueLe signal radio directement acquis par l'attaquant et/ou les données transitant sur le canal public représentent une fuite d'information disponible pour l'attaquant. Dans les travaux précédents portant sur la génération de clé à partir des signaux expérimentaux IR-UWB, la réconciliation consiste à échanger les indices des échantillons choisis pour la quantification et à corriger les erreurs éventuelles à l'aide d'un code correcteur d'erreur du type Reed-Solomon. Tandis que le code correcteur peut être adapté en fonction du compromis entre les capacités de correction et la fuite d'information, l'échange des indices des échantillons en clair sur le canal public est une spécification fixée du protocole.

	Quantification

Cellular networks are classified as centralized with respect to the core network, which is responsible for routing, authentication etc.

A number g is the primitive root of q if for every a relatively prime with q there exists k s.t. g k = a mod q.

This particular assumption could be questioned if powerful ray-tracing tools and the necessary knowledge about the environmental conditions are available to the attacker.

Studies regarding the generation of location-and device-dependent pseudonyms have been accomplished in parallel of the present thesis and are reported in Appendix E.

For more details on QKD advantages and challenges one can refer to the SECOQC White Paper on Quantum Key Distribution and Cryptography and to The black paper of quantum cryptography: real implementation problems[START_REF] Moskovich | An Overview of the State of the Art for Practical Quantum Key Distribution[END_REF].

We note that this denomination is not part of the established terminology in the key generation state of the art.

The obtained bit sequences will sometimes be called "keys" without any implication on their symmetric character.

Throughout the document, the SNR is sometimes defined differently according to the context of the study.

We note that the denominations "parallel" or "asynchronous" as defined herein are not established terminology in the key generation state of the art.

Although this sampling frequency is too restrictive for embedded devices, we maintain it for comparison purposes.

O 1 ,SNR 1 O 2 ,SNR 1 UQ,SNR 1 QQ,SNR 1 CQ 1 ,SNR 1 CQ 2 ,SNR 1 CQ 3 ,SNR 1 O 1 ,SNR 2 O 2 ,SNR 2 UQ,SNR 2 QQ,SNR 2 CQ 1 ,SNR 2 CQ 2 ,SNR 2 CQ 3 ,SNR 2Figure 2.11: Inter-key costs for various quantization schemes

The so-called aggregated CIR is the result of the convolution between the transmitted pulse template and the CIR.

An aggregated PDP can be expressed as |p(t) * h(t) * p * (-t)| 2 , where p(t) is the transmitted pulse and h(t) is the CIR.

Note that we have recently initiated experimental studies regarding the achievable key rates exploiting this particular type of signals obtained in indoor mobile scenarios. For more details, the reader should refer to Appendix F.

An filter a[n] is said to annihilate the signal s[n] if (a * s)[n] = 0.

The FRI subspace method is similar to spectral theory algorithms like ESPRIT and MUSIC, which use the covariance matrix of the Fourier data instead. ESPRIT exploits the shift-invariance property for particular subspaces of this covariance matrix and MUSIC relies on the orthogonality between the signal and noise subspaces.

A Hankel matrix is a matrix with constant skew diagonals.

We do not use the traditional Hungarian algorithm for the complete assignment problem because we do not necessarily need to pair every single path, but rather we do not pair some of the paths if the cost of the resulting pair is too high.

Note that this sampling rate corresponds to 5 times more the number of minimum samples needed for a noiseless FRI estimator using band-pass sampling.

Note that the bin definition is the same as in Section

2.2.3.

∆ bin (now expressed in ns for simplicity) corresponds to approximately half of the pulse duration in this case.

Non-adjacent links are links between other nodes in the network

We adopt a new SNR definition based on the pulse duration because in this particular study we deal with various lengths for the observation windows: one for adjacent channel probing and another for non-adjacent channel acquisition. This aspect is however transparent in the protocol because of a supplementary windowing process.

Although the equations are initially written in the continuous analog domain for more generality, the channel estimation and the computation of s-signals are solved in the discrete domain (See Section

4.4.2).

We restrict our analysis to the natural temporal domain of IR-UWB signals in order to avoid supplementary processing incurred by the Fourier Transform, but also because of the richness of data processing techniques concerning deconvolution in similar domains (e.g., statistical spatial methods for image deconvolution).

The samples of the central part of the convolution, where the two input signals overlap entirely. These samples are obtained from the summing of min(Ns, N h ) non-zero terms.

LS and ML estimators are equivalent in the case of a noisy data model with Gaussian noise, which will be the case for our data model described in the subsequent subsections.

The pseudo-analog waveforms are simulated at a simulation frequency of 100 GHz.

The misfit metric represents the gap between the known data and the statistics of the predicted data with the unknown model parameters. The model parameters are derived from solving the equation that sets the misfit metric to a fixed value.

A more detailed description of EM and its properties can be found in[START_REF] Moon | The Expectation-Maximization Algorithm[END_REF],[START_REF] Roweis | A Unifying Review of Linear Gaussian Models[END_REF],[START_REF] Dempster | Maximum Likelihood from Incomplete Data via the EM Algorithm[END_REF].

This quantity represents the likelihood function with respect to the parameter estimation problem and also the evidence with respect to the signal estimation problem considered above.

Note that the E-step provides an estimation of the probability distribution over the hidden variables, so implicitly the mean and the associated uncertainties.

A prior matrix corresponding to a differential kernel [1, -1] T gives similar results, but it is more adapted at higher sampling frequencies, where the signal can be considered smooth.

For reasons of consistency in the vector and matrix notations, we ignore the convention regarding the capitalization of the names of the random variables

We actually set γ0 = 1 and 0 = γ0 √ λ.

from the Greek "tele-", meaning "distant", and the Latin "communicare", meaning "to share"

The cited article references the mentioned ant study in the context of discussions about the 2014 IQ2 debate "We are becoming enslaved by our technology" (http://www.iq2oz.com/debates/ we-are-becoming-enslaved-by-our-technology-/).

https://en.wikipedia.org/wiki/Orwellian

Wikipedia: "An overlay network that can only be accessed with specific software, configurations, or authorization, often using non-standard communications protocols and ports. Two typical darknet types are friend-to-friend networks (usually used for file sharing with a peer-to-peer connection) and anonymity networks such as Tor via an anonymized series of connections."

http://www.ted.com/talks/jamie_bartlett_how_the_mysterious_dark_net_is_going_ mainstream

(s-µs) T Σs -1 (s-µs)

We drop the index of the iteration in the first part of the demonstration for readability purposes: = i-1 and γ = γi-1.

Acknowledgements

When preparing a PhD, three years is a short period: after the first year you have the Acknowledgment: Part of this work has been carried out in the framework of the BUTLER project (FP7-ICT-287901) and the SocIoTal project (ICT-FP7609112), which are funded by the European Commission. Proceedings of international conferences with peer reviews I. Tunaru, B. Denis, R. Perrier, B. Uguen, "Cooperative Group Key Generation Using IR-UWB Multipath Channels", IEEE International Conference on Ubiquitous Wireless Broadband 2015 (IEEE ICUWB'15), Montreal, Oct. 2015 I. Tunaru, B. Denis, B. Uguen, "Location-Based Pseudonyms for Identity Reinforcement in Wireless ad hoc Networks", IEEE Vehicular Technology Conference-Spring 2015 (IEEE VTC-Spring'15), Glasgow, May 2015 I. Tunaru, B. Denis, B. Uguen, "Reciprocity-Diversity Trade-off in Quantization for Symmetric Key Generation", IEEE International Symposium on Personal Indoor, and Mobile Radio Communications 2014 (IEEE PIMRC'14), Washington, Sep. 2014 I. Tunaru, B. Denis, B. Uguen, "Random Patterns of Secret Keys from Sampled IR-UWB Channel Responses", IEEE International Conference on Ultra Wideband 2014 (IEEE ICUWB'14), Paris, Sep. 2014 I. Tunaru, B. Denis, B. Uguen, "Public Discussion Strategies for Secret Key Generation from Sampled IR-UWB Channel Responses", Conference on Communications 2014 (COMM'14), Bucharest, May 2014

Abbreviations

AWGN reciprocity of the estimates would not be affected. This proved to be a difficult problem because of the assumption of realistic pulse interference, which was the core of the phenomenon we wanted to describe. Typically, this assumption is avoided in theoretical studies regarding the performance of unbiased estimators [START_REF] Sahinoglu | Ultra-Wideband Positioning Systems: Theoretical Limits, Ranging Algorithms and Protocols[END_REF] or the mutual information between bidirectional IR-UWB channels for key generation [START_REF] Wilson | Channel Identification: Secret Sharing Using Reciprocity in Ultrawideband Channels[END_REF]. Moreover, when considering the pulse interference phenomenon, it is admitted that, because of noise, the bidirectional estimates will potentially contain false alarms or missed paths. This leads to an assignment or pairing problem, which automatically implies additional reconciliation procedures. We conclude that the study of the reciprocity performance of channel estimates is dependent on the chosen reconciliation procedure and that the theoretical performance of joint probing-reconciliation schemes becomes even more complex than the initial aim of the "CRLB" reciprocity model.

Chapter 3

Public discussion strategies

In narrow-band communications, the radio signal perceived by an eavesdropper situated at more than a few wavelengths of one of the legitimate users is uncorrelated with the main channel signal [START_REF] Durgin | Space-Time Wireless Channels[END_REF]. However, in wide-band communications, notably in IR-UWB, the spatial decorrelation property of channels does not present the same behavior with the distance: it depends on the considered radio characteristic (e.g., CIR, averaged CIR, etc.) as well as on the propagation environment [START_REF] Tmar-Ben Hamida | Empirical Analysis of UWB Channel Characteristics for Secret Key Generation in Indoor Environments[END_REF]. The mentioned study on the spatial correlation of IR-UWB channels [START_REF] Tmar-Ben Hamida | Empirical Analysis of UWB Channel Characteristics for Secret Key Generation in Indoor Environments[END_REF] exploits experimental data from the same measurement campaign [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF] [START_REF] Tmar-Ben Hamida | An Adaptive Quantization Algorithm for Secret Key Generation Using Radio Channel Measurements[END_REF] presented in Section 2.2.

The acquired radio signal of the eavesdropper and the information that transits on the public channel represent the leaked information impacting the immunity to eavesdropping attacks. The reconciliation phase from the previous key generation protocol [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF] consists in the exchange of the position tables followed by Reed-Solomon error correction (see Section 2.2.2). The error correction scheme can be adapted to correct more or less mismatched bits in order to guarantee an acceptable compromise between bit agreement and security. On the contrary, the table exchange is a fixed protocol specification and the information transmitted on the public channel (i.e., the indexes of the extracted samples) represents the excess delay information of the significant channel coefficients.

In this chapter, we consider IR-UWB signals obtained by deterministic Ray-Tracing simulations, which, contrary to the statistical IEEE channel realizations, can model the location-dependent characteristics and therefore, the spatial correlation of the received IR-UWB signals. We aim to investigate the security impact of the public exchanges proposed in previous studies [START_REF] Tmar-Ben | Signal-based Security in Wireless Networks[END_REF] when employing threshold-based synchronization and we propose alternative reconciliation strategies that limit or mask the publicly exchanged information [START_REF]Public Discussion Strategies for Secret Key Generation from Sampled IR-UWB Channel Responses[END_REF]. Before discussing the system model and the main results, a short state of the art of practical reconciliation schemes is presented.

Patents

I. Tunaru, B. Denis, R. Perrier, "Procédé de géneration de clé secrète de groupe basée sur la couche physique radio et terminal sans fil associé", filed patent application, Aug.

2015

Appendix A

Bit pattern period

The upper bound on the bit pattern period (uBP P ) is the number of samples of a sinusoidal function that cross the given thresholds L 0 + /δ and L 0 -/δ. Figure A.1 shows that the uBP P presents a symmetry with respect to 0. We remind that F s is the sampling frequency and f c is the central frequency of the signal.

From Figure A.1, we have: We define T half = 1/(2f c ) as the demi-period of a sine wave of frequency f c and ∆ t = 1/F s as the sampling resolution.

Appendix B

Reciprocity and diversity cost functions

According to the model in Section 2.3.1, the codewords C A n and C B n are independent given the noiseless value x n . We define Q(.) as the Q-function representing the Gaussian survival function for the estimation noise σ 0 . Although the following expressions contain discrete variables C A n or C B n , we actually work with continuous probabilities because

The diversity cost CS(n, θ) (i.e., the spread of the probabilities of occurrence of the expected codewords) is detailed in the following equations:

The term

The reciprocity cost HD(n, θ) (i.e., mean Hamming distance between two valid codewords) is computed through numerical integration according to the following equation:

Reciprocity and diversity cost functions

The two terms of the integrand are detailed as follows. The conditional mean Hamming distance between two valid codewords:

For c j = c 0 :

The probability distribution function of x n conditioned on the validity of the codewords is expressed using Bayes' rule:

where

Appendix C

Parameterization with evidence maximization

The optimal parameters can be deducted by maximizing the evidence function:

In order to compute the integral analytically, we will transform it into a generalized Gauss integral. The integrand becomes:

with

This leads to:

The maximization of ln p(y| , γ) is usually time-consuming, because of the term 1 2 ln |C s |, which involves computing the determinant of an N s × N s matrix.

Appendix D S-signal estimation with

Expectation Maximization E-step and M-step At iteration i: 1

• identification of the parameters (mean µ s , and covariance Σ s ) of the searched signal s from the expression of the conditional probability density p(s|y, i-1 , γ i-1 ) by factorizing the terms in s and those in s T s from the exponential function.

• computation of the expectation based on µ s and Σ s and ignoring the terms that do not depend on and γ because they do not influence the maximization step.

After re-arranging the terms, we have:

• derivation with respect to and γ:

which leads to the final result:

Convergence of the parameters

In this section, we show the behavior of the parameter values during 200 EM iterations starting from different initial conditions : γ 0 = 1 and 0 = γ 0 √ λ 0 . The convergence graphics are given for two different channel configurations. We note that, except for the very small λ 0 values, the algorithm manages to converge to stable parameter values.

State of the art Available radiolocation technologies and modalities

Besides conventional GNSS means, alternative wireless localization solutions have been promoted recently [START_REF] Nielsen | Assessment of Cooperative and Heterogeneous Indoor Localization Algorithms with Real Radio Devices[END_REF], including low data rate IR-UWB and IEEE 802.15.4/Zigbee.

Benefiting from low power consumption, these technologies also offer appealing peer-topeer capabilities, which are suitable for mesh and cooperative connectivity in decentralized or versatile network contexts.

IR-UWB This technology enables RT-ToF and Time (Differences) of Arrival (T(D)oA) estimation with unprecedented timing accuracy, in the order of the nanosecond (i.e. within 30 cm spatial resolution) [START_REF] Sahinoglu | Ultra-Wideband Positioning Systems: Theoretical Limits, Ranging Algorithms and Protocols[END_REF]. The RT-ToF gives direct access to the distance between two nodes. Side efforts have also been committed to design Medium Access Control (MAC) synergetic protocols with better support for both ranging and decentralized positioning functionalities. They typically rely on beacon-enabled Time Division Multiple Access (TDMA) superframe structures [START_REF] Maman | Synergetic MAC and Higher Layers Functionalities for UWB LDR-LT Wireless Networks[END_REF], estimating and compensating harmful relative clock drift effects through the use of cooperative n-way ranging transactions. IEEE 802.15.4/Zigbee Various integrated solutions compatible with these two standards are currently available on the market. All of them can issue RSSI readings at the physical layer for each demodulated packet. Assuming a certain path loss model, such measurements can be exploited for parametric point-to-point range estimation [START_REF] Laaraiedh | Enhancing Positioning Accuracy through Direct Position Estimators Based on Hybrid RSS Data Fusion[END_REF].

However, in common environments, the expected precision of both ranging and positioning is hardly better than several meters [START_REF] Nielsen | Assessment of Cooperative and Heterogeneous Indoor Localization Algorithms with Real Radio Devices[END_REF].

Location-based identification and authentication

In order to prevent impersonation attacks, conventional cryptographic techniques may not be suitable in contexts like IoT, considering the massive deployment of low-cost and low-power entities with limited computational capabilities. Furthermore, cryptographic mechanisms usually need a centralized certified entity to distribute, refresh and revoke identity keys and signatures, which makes them more challenging to implement in decentralized networks with temporary ad hoc inter-connections.

Alternative non-cryptographic techniques relying on the lower layers of the communication protocol have thus emerged recently [START_REF] Zeng | Non-Cryptographic Authentication and Identification in Wireless Networks[END_REF]. However, software-based methods (e.g., probe request behavior at the MAC level) or hardware-based solutions (e.g., radiometric fingerprinting, clock skewness or PUF) are still subject to practical limitations, requiring the exchange of numerous challenge-response messages or too specific hardware.

Additional lower layer techniques are based on the continuous monitoring of physical radio properties such as location-specific Channel State Information (CSI) or RSSI readings to detect identity-based attacks [START_REF] Faria | Detecting Identity-Based Attacks in Wireless Networks Using Signalprints[END_REF]- [START_REF] Patwari | Robust Location Distinction using Temporal Link Signatures[END_REF]. Channel sounding is then combined with hypothesis testing to determine if prior (authenticated/trusted) and current communications are issued by one unique user. The key challenge is to collect physical radio features over time so as to detect unexpected transients caused by impersonations.

In [START_REF] Zeng | Non-Cryptographic Authentication and Identification in Wireless Networks[END_REF], RSSI Similarity based Authentication (SA) and Temporal RSSI Variation Authentication (TRVA) methods are recalled. The SA technique aims at detecting large unexpected RSSI changes between consecutive frames at one receiver. In Section E, SA will be used as reference for benchmark purposes.

Finally, assuming error-free GNSS information in a WSN context [START_REF] Zhang | Securing Sensor Networks with Location-Based Keys[END_REF], each sensor can be uniquely addressed by its 2D coordinates rather than an ID. Given a pre-loaded secret key (IK) generated from the initial ID and a system master key, each node securely receives an additional location-based key (LK) from one mobile entity. Node-to-node authentication and optional pairwise secret key establishment can then be applied using these location-based keys within a pairing-based crypto-system. Security lies in the secrecy of LK and one can verify that each node has the LK corresponding to its claimed position for authentication.

Overall, the previous concepts have not yet been extended to benefit from cooperation and heterogeneous radiolocation modalities for even better resilience against impersonations. Related recent work [START_REF] Gungor | Secret Key Generation via Localization and Mobility[END_REF] explores the possibility of generating symmetric secret keys for cryptography out of relative location estimates in mobile networks.

Proposed scheme: location-based pseudonyms Generic algorithm with heterogeneous inputs

The proposed approach consists in gradually using explicit or related location information to generate local pseudonyms, which complete or even temporarily substitute the IDs of wireless end-devices. Whenever multiple sources of location-dependent information are available at a given device, one can perform heterogeneous data integration, as follows:

144 in a large number of communicating devices. The inference phase does not increase the complexity because it does not require any protocol overhead or any additional processing of the measured data. We detail hereafter one example based on the quantization of peer-to-peer range information between two devices (from RSSI/RT-ToF measurements and optional relative clock drift estimates). The same pseudonym generation algorithm will be used for the evaluations in Section E.

Link-dependent pseudonyms from peer-to-peer ranges and relative clock drifts

In this particular scheme, each node generates N pseudonyms, with which it will be addressed by its N neighbours. As an example, the pseudonym (generated at A) that should be used by node B to address node A is:

with hash the cryptographic hash function (SHA-1 in the present simulations), || the concatenation function, ID A the initial public ID of A, ∆ d the distance quantization step, qd AB the quantized relative distance between A and B measured at A using: i) n-way ranging protocols and Time of Arrival (ToA) estimation to issue RT-ToF measurements (e.g., in IR-UWB, [START_REF] Sahinoglu | Ultra-Wideband Positioning Systems: Theoretical Limits, Ranging Algorithms and Protocols[END_REF]), ii) RSSI-based ranging with a path loss model (e.g., in IEEE 802.15.4, [START_REF] Laaraiedh | Enhancing Positioning Accuracy through Direct Position Estimators Based on Hybrid RSS Data Fusion[END_REF]).

One step further, adding hardware device-dependent information (only for RT-ToF estimations), the new pseudonym is:

under the same notations as before, with qγ AB the quantized relative drift of A's clock with respect to B's clock [START_REF] Maman | Synergetic MAC and Higher Layers Functionalities for UWB LDR-LT Wireless Networks[END_REF] (by definition, only measured at node A using the same ranging procedures) and ∆ γ the related quantization step.

The inference of A's pseudonym without public information exchange is made possible because node B also estimates similar reciprocal characteristics: relative distance 145 (d BA ∼ = d AB ) and optionally, relative clock drift (γ BA ∼ = 1/γ AB ), depending on the chosen technology and features. Asymmetries in the quantization inputs are thus mainly caused by measurement noise, which affects the unitary ToA estimates producing the RT-ToF/range estimations and by power fading for RSSI measurements. The legitimate peer B will then generate an inferred pseudonym for A:

An attacker E (passively) eavesdropping or (actively) exchanging packets with nodes A and B can estimate neither the relative distance between A and B (because of its different location), nor the relative clock drift, which is inherent to both the link and the hardware characteristics of the legitimate peers. Moreover, if E compromises one node, it cannot find the pseudonyms that are used on the other non-adjacent links. Therefore, the attacker has to make a blind (or eventually statistics-assisted) guess on the generated pseudonym in order to obtain P S E (A).

Performance evaluation and discussion

In order to evaluate the robustness of our proposal with respect to noise over legitimate links, as well as its security in the presence of an attacker, we define two metrics:

• the probability of a successful inference of the pseudonym by a legitimate user : P l = P [P S B (A) = P S A (A)] evaluated through Monte Carlo simulations, considering 1000 distinct network realizations of 10 nodes each, with an average node degree between 7 and 8 neighbors and with uniformly distributed coordinates in a 20x20m area.

• the probability of a successful guess by an attacker: P (p)BF = P [P S E (A) = P S A (A)] evaluated by numerical integration over the internode distances in two cases: i) brute-force (BF) attack (i.e., the attacker makes a uniform random guess on the value of the internode distance and/or relative clock drift); ii) probabilistic brute-force (pBF) or statistics-aided guess (i.e., the attacker knows a priori the distribution of the true internode distances in the area and makes his best guess accordingly).

The successful attack probabilities (when using both range and drift information for quantization) are computed as follows: This is due to the more advanced ranging capabilities of the IR-UWB technology compared to NB technologies (i.e., larger bandwidth implies more precision). The difference is significant in the LOS case where the detection of ToA of the first multipath component for IR-UWB is more robust than in the NLOS case. We also report the brute-force and the probabilistic brute-force successful attack probabilities as a function of the distance quantization step and identify advantageous quantization steps that maximize the distance between the legitimate agreement and the successful attack curves (e.g.

Pseudonyms from IR-UWB range & clock drift estimates

Using the same framework as before, we incorporate the drift into the quantization procedure (we choose a fixed distance quantization step ∆ d = 10m). When adding the

Comparison with RSSI monitoring authentication

The probability of a successful attack in RSSI monitoring methods (P sa ) depends on the variance of the shadowing (σ 2 s ) that affects the RSSI readings and on the distance between the attacker and a legitimate node (d AE ) when averaging over the distances between the legitimate nodes (d AB ). The averaging is performed in the same way as in Eq. (E.5) by replacing P (p)BF |R with the probability of misdetection of an attacker as a legitimate node (conditioned on the range d AB ). We assume that the threshold for impersonation detection at the legitimate nodes is set at ±3σ s from the mean empirical RSSI value. Note that the mean RSSI value and In wireless decentralized networks security and privacy become more challenging because of the decentralized architecture and sometimes low-complexity profile. Confidentiality of the transmissions is usually achieved by symmetric cryptography, which implies a distribution of identical secret keys between the legitimate nodes. Classic solutions for symmetric key distribution can be too complex from a computational or infrastructural point of view. An alternative to these key management techniques is the physical layer key generation that exploits the radio channel as a source of common information. This paper is dedicated to the generation of secret keys from IR-UWB channels using lowpower integrated devices. We investigate the possibility to generate identical secret keys in practical environments (e.g., typical indoor rooms, possibly occupied) and operating conditions (e.g., under mobility). The main challenge is to obtain reciprocal and random keys at an acceptable rate. Taking into account these three criteria (reciprocity, randomness, and key length), we propose an adapted quantization scheme for the measured CIRs acquired with embedded devices.

Introduction

Because of their broadcast nature, wireless networks can suffer from eavesdropping attacks. Therefore, one of the main issues for reliable communication is security, more specifically confidentiality of exchanges. This is usually achieved by symmetric-key cryptography, which relies on encryption and decryption operations using a secret shared key

Experimental setup Communication protocol

For obtaining a CIR pair we use the output of low-power integrated IR-UWB devices initially designed for localization purposes (i.e., TCR nodes [START_REF] Pezzin | A low Power, Low Data Rate Impulse Radio Ultra Wide Band Transceiver[END_REF]). Two sensor nodes have been used in our experiments. One of them is connected to a computer in order to transmit and save all the collected data by both of them. It is the main node and we call it Coordinator. The second one (Remote node) is not connected to the PC and it sends all its data to the Coordinator.

Experimental scenarios

The measurements took place in three separate rooms under different conditions of mobility, occupancy (with or without people) and geometry. We created three scenarios:

• The static scenario took place in a Laboratory with metallic equipment and furniture but without people. This is the simplest scenario in terms of reciprocity, because the nodes were not mobile and they always have LOS. The acquisition time was of approximately 2-3 min for every Tx-Rx position.

• The occupied scenario took place in the Coffee room. At any time there were at least a few people inside. The acquisition time was of 4-5 min for every Tx-Rx position.

• The mobile scenario took place in the Meeting room. As it can be seen from Figure F.3, the room is equipped with a U-shape table. There was a fixed position for the Coordinator at the end of the table. The Remote node was moving around table (dashed line) and did 3 circles.

156

In the THRESHOLD scheme one sets a certain noise threshold and puts the first value above the threshold on the first position. This method can be applied to both nodes independently, thus it can be easily implemented in a realistic key generation scenario.

The reciprocity between the two bidirectional measurements after synchronization is measured using the Pearson linear correlation coefficients (i.e., the reciprocity coefficients). In order to compare the THRESHOLD synchronization scheme and the optimal MAXCORR synchronization, we show in In order to avoid these correlated samples, we set the noise threshold independently on each side and we crop the main part of the signal. Subsequently, we send through the public channel the sizes of the obtained sequences at each node and additionally crop the longer one in order to match the lengths.

Preliminary amplitude quantization

After channel probing both parties have to quantize the extracted channel measurements into bits. On the one hand, after applying the quantization scheme, keys should have small mismatches in order to be able to correct them with an error correction code without leaking too much information on the public channel. On the other hand, keys The filter helps decreasing the mismatch rate but we still have a problem with randomness. The samples of the signal become highly correlated and cannot be directly quantized. The idea of the new quantization scheme is to divide the signals in windows with a fixed number of samples inside, then to set a certain threshold and to quantize the number of samples above the threshold according to a one-level quantization scheme.

The proposed scheme gives a rather promising mismatch (less than 10%). In this method the length of the key becomes smaller and we need more time for obtaining a key of required length, which translates into a concatenation of more CIRs. For this reason the measurements in the meeting room and room with occupancy were repeated with longer acquisition time (15 minutes) and we concatenated 40 CIRs for obtaining one key.

Therefore this scheme has a lower key rate (∼ 18 bits s ) comparing to amplitude-based quantization, but it would still be higher than RSSI-based key generation algorithms employing the same communication protocol. Figure F.9 illustrates the keys after the moving average filtering and the new quantization.