SecCSI: Securing Wireless Environment With RIS Against CSI-Forgery Attacks

Channel state information (CSI) is known to be crucial for both enhancing the transmission performance and ensuring physical-layer security (PLS) in wireless communication systems. To estimate a channel’s CSI, the transmitter (Tx) typically broadcasts a predetermined pilot signal, then the receiver (Rx) computes the channel coefficients based on the received pilot signal and returns the estimated CSI to the Tx. Most, if not all, of existing communication algorithms simply assume that the fed-back CSI is reliable/secure. However, in practice, a malicious terminal may send falsified CSI to the infrastructure, thus compromising the throughput and/or security of the communication over the channel. Although some researchers have already identified this vulnerability, demonstrated the feasibility of the CSI-forgery attacks, and designed countermeasures thereof, their methods either (i) are tailored to specific types of attacks, thus lacking generality, or (ii) require modifications to the pilot sequence and hence the protocol. To counter the CSI-forgery attacks and remove/mitigate the deficiencies of existing counter-measures, we first develop a comprehensive CSI-forgery model that can subsume the existing CSI-forgery attacks as special instances to facilitate the design of general countermeasures. Then, we propose a novel approach, called SecCSI, to detect potential CSI-forgery activities and identify their initiators using reconfigurable intelligent surface (RIS). SecCSI leverages the RIS to secretly and dynamically modify the wireless environment transparently to the receiver (Rx) in which the pilot signal is transmitted. The infrastructure can, therefore, detect any attempted manipulation of CSI by appropriately configuring the reflection coefficient matrix of the RIS, transmitting the pilot signal, and analyzing all CSI feedback. SecCSI can serve as a guard module for existing communication systems that simply accept the fed-back CSI without checking its trustworthiness. Our theoretical analysis, experimental and numerical evaluations have shown SecCSI to effectively detect the CSI-forgery attacks and identify the attacker.