Covert Communications of Wireless Hardware Trojans

Our work studies a special covert communication setting where the adversary can manipulate the pilot estimation process of the legitimate transmitter-user pair. We consider the following setting (Fig 1) where a legitimate transmitter, Alice, communicates with a legitimate receiver, Willie. Tom, a hardware trojan (the adversary) embedded in Alice, tries to simultaneously (and silently) communicate with its intended rogue receiver, Eve. Tom’s adversarial strategy unfolds in two stages. First, Tom tries a pilot scaling attack in the channel estimation phase to corrupt Willie’s channel estimation. Subsequently, if Willie fails to detect this initial attack, Tom exploits the imperfect channel estimates to covertly communicate with Eve.

We conduct separate hypothesis tests on the channel estimation and communication phase, and our main result shows that a pilot-scaling attack allows the Trojan adversary to communicate in the “linear-regime,” thereby allowing transmission at a positive rate to the rogue receiver, Eve.. Using a heatmap (Fig 2), we present a relation between the pilot scaling parameter, Tom’s transmit power, and the corresponding cover communication rate achieved between Tom and Eve.

In this heatmap, we have kept both propagation loss power = 0.1, Rayleigh channel fading magnitude = 1, both noise power = 0.1, Alice’s transmit power = 20 and detection budget in the estimation phase = 0.32. We observe that Tom’s covert rate decreases after a certain value of the pilot scaling parameter. As the pilot scaling parameter increases, the interference due to mismatched decoding increases and thus the SINR ratio decreases. A substantial drop in SINR may result in unexpected decoding errors at Willie, thereby revealing the presence of rogue communication.

Related publications:

S. Bakirtas, M. R. Bloch, and Elza Erkip. “Pilot-Attacks Can Enable Positive-Rate Covert Communications of Wireless Hardware Trojans.” arXiv preprint arXiv:2404.09922, 2024.