# Regularity Properties of Monotone Measure-preserving Maps

Alessio Figalli  ETH Zürich, Department of Mathematics, Rämistrasse 101,
Zürich 8092, Switzerland<EMAIL_ADDRESS>and  Yash Jhaveri
Rutgers University – Newark, Department of Mathematics & Computer Science,
Smith Hall, 101 Warren Street, Newark, New Jersey 07102, USA
<EMAIL_ADDRESS>
###### Abstract.

In this note, we extend the regularity theory for monotone measure-preserving
maps, also known as optimal transports for the quadratic cost optimal
transport problem, to the case when the support of the target measure is an
arbitrary convex domain and, on the low-regularity end, between domains
carrying certain invariant measures.

In honor of David Jerison for his 70th birthday.

##  1\. Introduction

Given a pair of atom-free Borel probability measures $\mu$ and $\nu$ on
$\mathbb{R}$, the monotone rearrangement theorem asserts that the function
$y=y(x)$ defined implicitly by

$\int_{-\infty}^{x}\,\mathrm{d}\mu=\int_{-\infty}^{y(x)}\,\mathrm{d}\nu$

is measure-preserving, i.e.,

$\mu(y^{-1}(E))=\nu(E)\quad\text{for any Borel set}\quad E\subset\mathbb{R}.$

In particular, $y$ is unique $\mu$ almost everywhere and can be made to be
monotone, or, equivalently, the derivative of a convex function.

When $\mathbb{R}$ is replaced by $\mathbb{R}^{n}$, however, before Brenier’s
discovery (see [1]), a proper generalization of the monotone rearrangement
theorem was myth; and only after the work of McCann, in [13], was the myth
made real. Precisely, he proved that if $\mu$ vanishes on every Lipschitz
$(n-1)$-dimensional surface111 McCann actually assumes that $\mu$ vanishes on
all (Borel) sets of Hausdorff dimension $n-1$. This guarantees that the set of
non-differentiability points of a convex function are $\mu$-negligible.
However, this assumption can be weakened. Since convex functions are
differentiable outside of a countable union of Lipschitz hypersurfaces (see
[15]), McCann’s theorem holds assuming that $\mu$ vanishes on every Lipschitz
$(n-1)$-dimensional surface., then a convex potential
$u:\mathbb{R}^{n}\to\mathbb{R}\cup\\{+\infty\\}$ exists whose gradient map
$\nabla u=\nabla u(x)$ is unique $\mu$ almost everywhere and pushes $\mu$
forward to $\nu$, i.e.,

$\mu((\nabla u)^{-1}(E))=\nu(E)\quad\text{for any Borel set}\quad
E\subset\mathbb{R}^{n}.$

(Brenier’s theorem guaranteed the same conclusion as McCann’s theorem, but
under some restrictive technical conditions on $\mu$ and $\nu$.)

The first general regularity result on these Brenier–McCann maps was proved by
Caffarelli in [4]: provided that $\mu$ and $\nu$ are absolutely continuous
with respect to $n$-dimensional Lebesgue measure $\mathscr{L}^{n}$, their
respective densities $f$ and $g$ vanish outside of and are bounded away from
zero and infinity on open bounded sets $X$ and $Y$ respectively, and $Y$ is
convex, he showed that $u$ is strictly convex in $X$ (see, e.g., the proof of
[8, Theorem 4.6.2]). This result opened the door to the development of a
regularity theory for mappings with convex potentials based on the regularity
theory for strictly convex solutions to the Monge–Ampère equation (see, e.g.,
[2]); indeed,

$(\nabla u)_{\\#}f=g\text{ is formally, at least, equivalent to }\det
D^{2}u=\frac{f}{g(\nabla u)}.$

Unfortunately, Caffarelli’s boundedness assumptions on the domains $X$ and $Y$
are restrictive, since many probability densities, especially those found in
applications, are supported on all of $\mathbb{R}^{n}$: Gaussian densities,
for example. Motivated by this, in [5], Cordero-Erausquin and Figalli showed
that, in several situations of interest, one can ensure the regularity of
monotone measure-preserving maps even if the measures under consideration have
unbounded supports. However, missing from their collection is the situation
where $Y$ is an arbitrary convex domain. Lifting this restriction is a main
goal of this paper.

###  1.1. Results

Our main theorem is an extension of Caffarelli’s theorem, on the strict
convexity of $u$, in two ways. First, we allow $X$ and $Y$ to be unbounded.
Second, we permit $X$ and $Y$ to carrying certain invariant measures that we
call locally doubling measures (qualitatively, our notion replaces balls in
the classical notion of a doubling measure with ellipsoids, in order to
account for the affine invariance of our setting).

######  Definition 1.1.

A nonnegative measure $\lambda$ is locally doubling (on ellipsoids) if the
following holds: for every ball $B$, there is a constant $C\geq 1$ such that

$\lambda(\mathcal{E})\leq C\lambda(\tfrac{1}{2}\mathcal{E})$

for all ellipsoids $\mathcal{E}\subset B$ with center (of mass) in
$\operatorname{spt}(\lambda)$. Here $\frac{1}{2}\mathcal{E}$ is the dilation
of $\mathcal{E}$ with respect to its center by $1/2$.

This notion of doubling was introduced by Jhaveri and Savin in [12].222 This
family of measures is strictly larger than the family of measures locally
comparable to Lebesgue measure on their supports. (See [12] for examples of
locally doubling measures not comparable to Lebesgue measure on their
supports.) That said, the first consideration of measures with a “doubling
like” property in the world of solutions to Monge–Ampère equations can be
traced back to the work of Jerison [10] and then Caffarelli [3]. In
particular, in [3], Caffarelli showed that Alexandrov solutions to

$\det D^{2}v=\rho,$

where the measure $\rho$ is doubling on a specific collection of convex sets
called sections333 These are sets of the form $\\{v\leq\ell\\}$ for any affine
function $\ell$., share the same geometric properties as Alexandrov solutions
to Monge–Ampère equations with right-hand sides comparable to Lebesgue measure
(see [2]).

We now state our main theorem.

######  Theorem 1.2.

Let $\mu$ and $\nu$ be two locally doubling probability measures on
$\mathbb{R}^{n}$ that vanish on Lipschitz $(n-1)$-dimensional surfaces and are
concentrated on two open sets $X$ and $Y$ respectively, and suppose that $Y$
is convex. Then any convex potential $u$ associated to the Brenier–McCann map
pushing $\mu$ forward to $\nu$ is strictly convex in $X$.

######  Remark 1.3.

It is well-known that $Y$ needs to be convex. When $Y$ is not convex, $u$ can
fail to be strictly convex and $\nabla u$ can behave rather poorly. If we
consider Pogorelov’s counterexample to the strict convexity of solutions to
the Monge–Ampère equation in three dimensions, we see that $Y$ needs to be
convex in order to guarantee the strict convexity of potentials of
Brenier–McCann maps. In particular, let
$u(x^{\prime},x_{3})=|x^{\prime}|^{4/3}(1+x_{3}^{2})$, let
$Q_{r}=\\{|x_{i}|<r/2\text{ for }i=1,2,3\\}$ be the cube with side length
$r>0$ and centered at the origin in $\mathbb{R}^{3}$, and let $Y=\nabla
u(Q_{r})$. If $r\ll 1$, then $f=\det D^{2}u$ is analytic and positive in
$Q_{r}$, and $\nabla u$ is the Brenier–McCann map pushing forward
$\mu=(f/\|f\|_{L^{1}(Q_{r})})\mathscr{L}^{3}\mathop{\hbox{\vrule
height=7.0pt,width=0.5pt,depth=0.0pt\vrule
height=0.5pt,width=6.0pt,depth=0.0pt}}\nolimits Q_{r}$ to
$\nu=(1/\mathscr{L}^{3}(Y))\mathscr{L}^{3}\mathop{\hbox{\vrule
height=7.0pt,width=0.5pt,depth=0.0pt\vrule
height=0.5pt,width=6.0pt,depth=0.0pt}}\nolimits Y$. The set $Y$ is open but
not convex, and $u=0$ along $\\{x^{\prime}=0\\}$. Moreover, as demonstrated
in, for instance, [4] and [11], $\nabla u$ easily fails to be continuous when
$Y$ is not convex.

######  Remark 1.4.

While the target measure $\nu$ need not vanishes on all Lipschitz
$(n-1)$-dimensional surfaces in order to invoke McCann’s theorem (which asks
this only of the source measure $\mu$), it must in order to ensure our main
theorem holds. If $\mu=\mathscr{L}^{2}\mathop{\hbox{\vrule
height=7.0pt,width=0.5pt,depth=0.0pt\vrule
height=0.5pt,width=6.0pt,depth=0.0pt}}\nolimits Q_{1}$ is the uniform measure
on $Q_{1}$ the unit cube centered at the origin in $\mathbb{R}^{2}$ and
$\nu=\mathscr{H}^{1}\mathop{\hbox{\vrule
height=7.0pt,width=0.5pt,depth=0.0pt\vrule
height=0.5pt,width=6.0pt,depth=0.0pt}}\nolimits Q_{1}\cap\\{x_{2}=0\\}$ is the
$1$-dimensional Hausdorff measure restricted to the central horizontal axis of
$Q_{1}$, then the Brenier–McCann map pushing $\mu$ forward to $\nu$ is the
projection map $(x_{1},x_{2})\mapsto x_{1}$. Up to a constant, this map’s
convex potential is $\frac{1}{2}x_{1}^{2}$, which is not strictly convex. With
respect our proof of Theorem 1.2, asking this of both $\mu$ and $\nu$
guarantees the validity of the mass balance formula in Lemma 2.1 (see also
Remark 2.2), our main tool.

######  Remark 1.5.

A simple case to which Theorem 1.2 applies, but the corresponding results in
[4] and [5] do not, is when $\mu=g\mathscr{L}^{3}\mathop{\hbox{\vrule
height=7.0pt,width=0.5pt,depth=0.0pt\vrule
height=0.5pt,width=6.0pt,depth=0.0pt}}\nolimits\\{|x_{1}|<1\\}\times\mathbb{R}^{2}$
and $\nu=g\mathscr{L}^{3}\mathop{\hbox{\vrule
height=7.0pt,width=0.5pt,depth=0.0pt\vrule
height=0.5pt,width=6.0pt,depth=0.0pt}}\nolimits\mathbb{R}^{2}\times\\{|x_{3}|<1\\}$,
and $g$ is the standard Gaussian density on $\mathbb{R}^{3}$ appropriately
normalized to make $\mu$ and $\nu$ probability measures.

With our main theorem in hand, our second and third theorems further extend
the known regularity theory for monotone measure-preserving maps, completing
the story started by Cordero-Erausquin and Figalli in [5] on monotone
transports between unbounded domains.

######  Theorem 1.6.

Let $\mu$ and $\nu$ be two locally doubling probability measures on
$\mathbb{R}^{n}$ that vanish on Lipschitz $(n-1)$-dimensional surfaces and are
concentrated on two open sets $X$ and $Y$ respectively, and suppose that $Y$
is convex. Then the Brenier–McCann map $\nabla u$ pushing $\mu$ forward to
$\nu$ is a homeomorphism from $X$ onto a full measure subset of $Y$. Moreover,
for every $A\Subset X$, a constant $\alpha>0$ exists such that $\nabla u\in
C^{0,\alpha}(A)$. Furthermore, $\nabla u(X)=Y$ whenever $X$ is convex.

######  Theorem 1.7.

Let $f$ and $g$ be two functions on $\mathbb{R}^{n}$ that define locally
doubling probability measures concentrated on two open sets $X$ and $Y$
respectively, and suppose that $Y$ is convex. Assume that $f$ and $g$ are
bounded away from zero and infinity on compact subsets of $X$ and $Y$
respectively. Then for every $E\Subset X$, a constant $\epsilon>0$ exists such
that any convex potential $u$ associated to the Brenier–McCann map pushing $f$
forward to $g$ is $W^{2,1+\epsilon}(E)$. Also, $\nabla u$ is locally a
$C^{k+1,\beta}$-diffeomorphism from $X$ onto its image provided $f$ and $g$
are locally $C^{k,\beta}$ in $X$ and $Y$ respectively.

######  Remark 1.8.

We note that the proof of the Theorem 1.7, given the strict convexity of $u$
(provided by Theorem 1.2), is classical. Indeed, it suffices to localize
classical regularity results for the Monge–Ampère equation. We refer the
reader to [8, Section 4.6.1] for more details.

###  1.2. Structure

This remainder of this paper is structured as follows.

In Section 2, we prove Theorem 1.2. Our proof is self-contained apart from
some facts in convex analysis; we provide explicit references to these used
but unproved facts. We remark that our proof is inspired by the proof of the
Alexandrov maximum principle in [12] (and, of course, Caffarelli’s original
proof of the strict convexity of potential functions of optimal
transports/solutions to Monge–Ampère equations). If the reader is familiar
with [5] or [4], then they might consider directing their attention to Case 2.
Case 2b is completely novel. Case 2a illustrates our argument in the setting
of [4], which builds on the work of [2] and is the foundation for Case 2b.

Section 3 is dedicated to the proof of Theorem 1.6. Our proof here is
similarly self-contained (and an adaptation of Caffarelli’s argument of the
same result in [2], but, of course, using the line of reasoning developed to
prove Theorem 1.2). The Hölder regularity of $\nabla u$ is a consequence of
appropriately localizing the arguments of [12].

##  2\. Proof of Theorem 1.2

Before we begin, it will be convenient to replace the potential $u$ by the
following lower-semicontinuous extension of $u$ outside of $X$:444 Here
$\partial u(z)$ is called the subdifferential of $u$ at $z$ and is defined as
follows:  $\partial u(z):=\\{p\in\mathbb{R}^{n}:u(x)\geq
u(z)+p\cdot(x-z)\text{ for all $x\in X$}\\}.$ Moreover, for a set
$E\subset\mathbb{R}^{n}$, we define $\partial u(E):=\cup_{z\in E}\partial
u(z)$.

$\underline{u}(x):=\sup_{\begin{subarray}{c}z\in X\\\ p\in\partial
u(z)\end{subarray}}\\{u(z)+p\cdot(x-z)\\}.$

Observe that $\underline{u}|_{X}=u|_{X}$. For notational simplicity, we shall
not distinguish $\underline{u}$ from $u$; so when we write $u$ in what
follows, we mean $\underline{u}$.

We shall denote the domain of $u$ by $\operatorname{dom}(u)$, namely,
$\operatorname{dom}(u):=\\{u<+\infty\\}$. Note that $\operatorname{dom}(u)$ is
convex. We recall that convex functions are locally Lipschitz inside their
domain (see, e.g., [8, Appendix A.4]). Furthermore, we shall denote the convex
hull of a set $A$ by $\operatorname{conv}(A)$.

Let $\ell$ define a supporting plane to the graph of $u$ at a point in $X$.
Precisely,

$\ell(x)=u(z)+p\cdot(x-z)\quad\text{for some}\quad(z,p)\in
X\times\mathbb{R}^{n}$

and $\ell\leq u$. Note that

$\Sigma:=\\{u=\ell\\}=\\{u\leq\ell\\}$

is closed, as $u$ is lower-semicontinuous,

$\Sigma,X\subset\operatorname{dom}(u),$

and, because $Y$ is convex,

(2.1) $\partial u(\mathbb{R}^{n})\subset\overline{\partial
u(X)}\subset\overline{Y}\quad\text{and}\quad\mathscr{L}^{n}(Y\setminus\partial
u(X))=0.$

(A proof of (2.1) can be found in [5].)

Recall that an exposed point $\hat{x}$ of $\Sigma\subset\mathbb{R}^{n}$ is one
for which there exists a hyperplane $\Pi\subset\mathbb{R}^{n}$ tangent to
$\Sigma$ at $\hat{x}$ such that $\Pi\cap\Sigma=\\{\hat{x}\\}$. Also, remember
that optimal/monotone transports balance mass, in the following way.

######  Lemma 2.1 (Mass Balance Formula).

Let $u:\mathbb{R}^{n}\to\mathbb{R}\cup\\{+\infty\\}$ be convex and such that
$(\nabla u)_{\\#}\mu=\nu$ where $\mu$ and $\nu$ are two Borel measures that
vanish on all Lipschitz $(n-1)$-dimensional surfaces. Then for all Borel sets
$E\subset\mathbb{R}^{n}$,

$\mu(E)=\nu(\partial u(E)).$

######  Remark 2.2.

The mass balance formula was originally proved for measures that are
absolutely continuous with respect to Lebesgue measure (see, e.g., [14, Lemma
4.6]). However, with respect to absolute continuity, the proof only relies on
the measures in question not giving mass to the set of non-differentiable
points of a convex function. As observed in the introduction, such points are
contained in a countable union of Lipschitz $(n-1)$-dimensional surfaces. So
the set of non-differentiable points of a convex function is negligible both
for $\mu$ and $\nu$ under our assumption.

Finally, recall that if a nonnegative measure is locally doubling (on
ellipsoids), then it is locally doubling on all bounded convex domains (see
[12, Corollary 2.5]). After this preliminary discussion, we can now prove our
main theorem.

###### Proof of Theorem 1.2.

Proving that $u$ is strictly convex in $X$ corresponds to proving that for any
supporting plane $\ell$ to (the graph of) $u$ at a point in $X$, the set
$\Sigma=\\{u=\ell\\}$ is a singleton. Assuming that $\Sigma$ is not a
singleton, we will show that $\Sigma$ both has and does not have exposed
points, which cannot be; thus, $\Sigma$ is a singleton, as desired.

### Case 1

$\Sigma$ has no exposed points. If $\Sigma$ has no exposed points, then
$\Sigma\supset\mathbb{R}\mathbf{e}$ for some unit vector $\mathbf{e}$. In
turn, $\partial u(\mathbb{R}^{n})\subset\mathbf{e}^{\perp}$ (see, e.g., [8,
Lemma A.25]). But this is impossible given (2.1):

$0<\mathscr{L}^{n}(\partial u(X)\cap Y)\leq\mathscr{L}^{n}(\partial
u(\mathbb{R}^{n})\cap Y)\leq\mathscr{L}^{n}(\mathbf{e}^{\perp}\cap Y)=0.$

### Case 2

$\Sigma$ has an exposed point $\hat{x}$ in $\overline{X}$. Up to a translation
and a rotation, we can assume that

$\hat{x}=0\in\overline{X},\quad\Sigma\subset\\{x_{1}\leq
0\\},\quad\text{and}\quad\Sigma\cap\\{x_{1}=0\\}=\\{0\\}.$

Since $X$ is open and $\Sigma\cap X$ is nonempty by construction, there is a
point $x_{int}\in\Sigma\cap X$ and a ball centered at this point completely
contained in $X$. Thus, up to a shearing transformation $x\mapsto x-\eta
x_{1}$ with $\eta\cdot\mathbf{e}_{1}=0$, and a dilation, we may assume that

$x_{int}=-\mathbf{e}_{1}\quad\text{and}\quad B_{d}(-\mathbf{e}_{1})\Subset X$

for some $d>0$. Finally, up to subtracting $\ell$ from $u$, we can assume that

$\ell\equiv 0.$

### Case 2a: $0\in\operatorname{int}(\operatorname{dom}(u))\cap\overline{X}$.

As our exposed point $0$ and all of the points in
$\overline{B_{d}(-\mathbf{e}_{1})}$ belong to
$\operatorname{int}(\operatorname{dom}(u))$, which is convex (and, by
definition, open), the convex hull of the union of
$\overline{B_{d}(-\mathbf{e}_{1})}$ and $\\{0\\}$ is contained in
$\operatorname{int}(\operatorname{dom}(u))$. So there exists an open, bounded
set $U\Subset\operatorname{int}(\operatorname{dom}(u))$ containing
$\operatorname{conv}(\overline{B_{d}(-\mathbf{e}_{1})}\cup\\{0\\})$. Moreover,
we know that

$\partial u(U)\subset\operatorname{conv}(\overline{\nabla
u(U)})=:\Upsilon\subset B_{R}\cap\overline{Y}$

for some $R>0$ (see, e.g., [8, Lemma A.22]). Let $u^{\ast}$ be the Legendre
transform of $u$, namely

(2.2) $u^{\ast}(q):=\sup_{x\in\mathbb{R}^{n}}\\{q\cdot x-u(x)\\}$

and define

$\Omega:=\partial u^{\ast}(\Upsilon)\supset U.$

Recalling that $\partial u$ and $\partial u^{\ast}$ are inverses of each other
(see, e.g., [8, Section A.4.2]), we deduce that $(\nabla u)_{\\#}\rho=\gamma$
where

$\rho:=\mu\mathop{\hbox{\vrule height=7.0pt,width=0.5pt,depth=0.0pt\vrule
height=0.5pt,width=6.0pt,depth=0.0pt}}\nolimits\Omega\quad\text{and}\quad\gamma:=\nu\mathop{\hbox{\vrule
height=7.0pt,width=0.5pt,depth=0.0pt\vrule
height=0.5pt,width=6.0pt,depth=0.0pt}}\nolimits\Upsilon.$

In particular, if we let $\phi:\mathbb{R}^{n}\to\mathbb{R}\cup\\{+\infty\\}$
be defined by

$\phi(x):=\sup_{\begin{subarray}{c}z\in\Omega\\\ p\in\partial
u(z)\end{subarray}}\\{u(z)+p\cdot(x-z)\\},$

then, by construction, $\phi$ and $u$ agree on $\Omega$, $\phi$ is (globally)
Lipschitz,

$\partial\phi(\mathbb{R}^{n})=\partial\phi(\Omega)=\Upsilon,$

and $0\in\Omega$ is an exposed point for $\\{\phi=0\\}=\\{\phi\leq 0\\}$.

Now, let $\phi_{\epsilon}(x):=\phi(x)-\epsilon(x_{1}+1)$ and define

$S_{0}:=\\{\phi=0\\}\cap\\{x_{1}\geq-1\\}\quad\text{and}\quad
S_{\epsilon}:=\\{\phi_{\epsilon}\leq 0\\}.$

Also, let $\gamma_{\epsilon}$ be defined by

$\gamma_{\epsilon}:=(\mathrm{Id}-\epsilon\mathbf{e}_{1})_{\\#}\gamma.$

Notice that, by construction, $S_{0}$ is compact, $S_{0}\subset\\{x_{1}\leq
0\\}$, $0,-\mathbf{e}_{1}\in S_{0}$, and $S_{\epsilon}\to S_{0}$ in the
Hausdorff sense as $\epsilon\to 0$; in particular, there exists $D>0$ such
that

$S_{\epsilon}\subset B_{D}\quad\text{for all}\quad\epsilon\ll 1.$

Also, if $a_{\epsilon}>0$ is such that
$\Pi_{\epsilon}:=\\{x_{1}=a_{\epsilon}\\}$ is a supporting plane to
$S_{\epsilon}$, we see that

$a_{\epsilon}\to 0\quad\text{as}\quad\epsilon\to 0$

and

$\epsilon=|\phi_{\epsilon}(0)|\leq\max_{S_{\epsilon}}|\phi_{\epsilon}|\leq(1+a_{\epsilon})\epsilon.$

Let $A_{\epsilon}$ be the John transformation (affine map) that normalizes
$S_{\epsilon}$ (see, e.g., [7]):

$A_{\epsilon}x:=L_{\epsilon}(x-x_{\epsilon}),$

where $x_{\epsilon}$ is the center of mass of $S_{\epsilon}$ and
$L_{\epsilon}:\mathbb{R}^{n}\to\mathbb{R}^{n}$ is a symmetric and positive
definite linear transformation. Set

$\tilde{\phi}_{\epsilon}(x):=\frac{\phi_{\epsilon}(A_{\epsilon}^{-1}x)}{\epsilon}\quad\text{and}\quad\tilde{S}_{\epsilon}:=A_{\epsilon}(S_{\epsilon}).$

Then

$B_{1}\subset\tilde{S}_{\epsilon}\subset B_{n^{3/2}}$

and

$1=|\tilde{\phi}_{\epsilon}(\tilde{0}_{\epsilon})|\leq\max_{\tilde{S}_{\epsilon}}|\tilde{\phi}_{\epsilon}|\leq
1+a_{\epsilon}\quad\text{with}\quad\tilde{0}_{\epsilon}:=A_{\epsilon}(0).$

Recall that affine transformations preserve the ratio of the distances between
parallel planes; therefore, letting $\Pi_{-1}:=\\{x_{1}=-1\\}$,
$\Pi_{0}:=\\{x_{1}=0\\}$, and $\tilde{\Pi}_{i}:=A_{\epsilon}(\Pi_{i})$ for
$i=-1,0,\epsilon$, we have that

$\frac{\operatorname{dist}(\tilde{\Pi}_{0},\tilde{\Pi}_{\epsilon})}{\operatorname{dist}(\tilde{\Pi}_{-1},\tilde{\Pi}_{\epsilon})}=\frac{\operatorname{dist}(\Pi_{0},\Pi_{\epsilon})}{\operatorname{dist}(\Pi_{-1},\Pi_{\epsilon})}=\frac{a_{\epsilon}}{1+a_{\epsilon}}.$

In turn,

$\operatorname{dist}(\tilde{0}_{\epsilon},\partial\tilde{S}_{\epsilon})\leq\operatorname{dist}(\tilde{\Pi}_{0},\tilde{\Pi}_{\epsilon})\leq\operatorname{dist}(\tilde{\Pi}_{-1},\tilde{\Pi}_{\epsilon})\frac{a_{\epsilon}}{1+a_{\epsilon}}\leq\operatorname{diam}(\tilde{S}_{\epsilon})a_{\epsilon}\leq
2n^{3/2}a_{\epsilon},$

and considering the cone generated by $\partial\tilde{S}_{\epsilon}$ over
$(\tilde{0}_{\epsilon},\tilde{\phi}_{\epsilon}(\tilde{0}_{\epsilon}))$, we
find that

$K_{\epsilon}:=\operatorname{conv}\left(B_{r_{n}}\cup\left\\{\tfrac{r_{n}}{a_{\epsilon}}\mathbf{e}_{1}\right\\}\right)\subset\partial\tilde{\phi}_{\epsilon}(\tilde{S}_{\epsilon})\quad\text{with}\quad
r_{n}:=\frac{1}{2n^{3/2}}.$

(For more details on this inclusion, see, e.g., [8, Theorem 2.8].) So if we
let

$\tilde{\rho}_{\epsilon}:=(A_{\epsilon})_{\\#}\rho\quad\text{and}\quad\tilde{\gamma}_{\epsilon}:=(\epsilon^{-1}L_{\epsilon}^{-1})_{\\#}\gamma_{\epsilon},$

then
$(\nabla\tilde{\phi}_{\epsilon})_{\\#}\tilde{\rho}_{\epsilon}=\tilde{\gamma}_{\epsilon}$,
and, by the mass balance formula,

(2.3)
$\tilde{\gamma}_{\epsilon}(K_{\epsilon})\leq\tilde{\gamma}_{\epsilon}\big{(}\partial\tilde{\phi}_{\epsilon}(\tilde{S}_{\epsilon})\big{)}=\tilde{\rho}_{\epsilon}(\tilde{S}_{\epsilon})\leq\tilde{\rho}_{\epsilon}(B_{n^{3/2}}).$

On the other hand, since $S_{\epsilon}\subset B_{D}$ and
$\tilde{S}_{\epsilon}\supset B_{1}$ for $\epsilon\ll 1$, we see that

$|A_{\epsilon}(w)-A_{\epsilon}(z)|\geq\frac{1}{D}|w-z|\quad\text{for all}\quad
w,z\in\mathbb{R}^{n}.$

In turn, for $\epsilon\ll 1$,

$\tilde{\Omega}_{\epsilon}:=A_{\epsilon}(\Omega)\supset
A_{\epsilon}(B_{d}(-\mathbf{e}_{1}))\supset
B_{\frac{d}{D}}(A_{\epsilon}(-\mathbf{e}_{1})).$

Therefore, if we define

$\tilde{S}_{\epsilon,d}:=\left\\{\operatorname{dist}(\,\cdot\,,\partial\tilde{S}_{\epsilon})\geq\tfrac{d}{2D}\right\\},$

then there exists a dimensional constant $C_{n}>0$ and a point $\tilde{z}_{d}$
such that

$A_{\epsilon}(B_{d}(-\mathbf{e}_{1}))\cap\tilde{S}_{\epsilon,d}\supset
B_{\frac{d}{C_{n}D}}(\tilde{z}_{d}).$

Also, by, for example, [8, Corollary A.23],

$\partial\tilde{\phi}_{\epsilon}(\tilde{S}_{\epsilon,d})\subset
B_{\frac{6D}{d}}.$

Thus, for all $\epsilon\ll 1$,

(2.4)
$\begin{split}\tilde{\rho}_{\epsilon}(B_{n^{3/2}})\leq\tilde{\mu}_{\epsilon}(B_{2n^{3/2}}(\tilde{z}_{d}))\leq
C_{\mu}^{k}\tilde{\mu}_{\epsilon}\left(B_{\frac{d}{C_{n}D}}(\tilde{z}_{d})\right)=C_{\mu}^{k}\tilde{\rho}_{\epsilon}\left(B_{\frac{d}{C_{n}D}}(\tilde{z}_{d})\right),\end{split}$

where $\tilde{\mu}_{\epsilon}:=(A_{\epsilon})_{\\#}\mu$, the number
$k\in\mathbb{N}$ is such that $2n^{3/2}\leq 2^{k}\frac{d}{C_{n}D}$, and
$C_{\mu}$ is the doubling constant for $\mu$ in $B_{4Dn^{3/2}}$. (The last
equality holds since $\tilde{\mu}_{\epsilon}$ and $\tilde{\rho}_{\epsilon}$
agree on $\tilde{\Omega}_{\epsilon}$.) Moreover, using the mass balance
formula again, we deduce that

(2.5)
$\begin{split}\tilde{\rho}_{\epsilon}\left(B_{\frac{d}{C_{n}D}}(\tilde{z}_{d})\right)&\leq\tilde{\rho}_{\epsilon}\left(A_{\epsilon}(B_{d}(-\mathbf{e}_{1}))\cap\tilde{S}_{\epsilon,d}\right)\\\
&=\tilde{\gamma}_{\epsilon}\left(\partial\tilde{\phi}_{\epsilon}(A_{\epsilon}(B_{d}(-\mathbf{e}_{1}))\cap\tilde{S}_{\epsilon,d})\right)\leq\tilde{\gamma}_{\epsilon}\big{(}B_{\frac{6D}{d}}\big{)}\end{split}$

for all $\epsilon\ll 1$. Consequently, combining the three chains of
inequalities (2.3), (2.4), and (2.5), we have that

(2.6) $\tilde{\gamma}_{\epsilon}(K_{\epsilon})\leq
C_{\mu}^{k}\tilde{\gamma}_{\epsilon}\big{(}B_{\frac{6D}{d}}\big{)}.$

Now, let $t_{m}\mathbf{e}_{1}\in K_{\epsilon}$ for $m=1,\dots,M$ be a sequence
of points chosen555 A possible way to construct such a sequence is to choose
$t_{m}=5^{m}$. To ensure that $t_{m}\mathbf{e}_{1}\in K_{\epsilon}$ for any
$m=1,\ldots,M$, one needs $M\leq\frac{\log r_{n}-\log a_{\epsilon}}{\log 5}$.
so that

$\frac{1}{2}K_{m}\subset K_{m}\setminus K_{m-1}\quad\text{with}\quad
K_{m}:=\operatorname{conv}(B_{r_{n}}\cup\\{t_{m}\mathbf{e}_{1}\\})\quad\text{and}\quad
K_{0}:=B_{r_{n}}.$

By construction, $\\{\frac{1}{2}K_{m}\\}_{m=1}^{M}$ is a disjoint family, and

(2.7) $M=M(a_{\epsilon})\to\infty\quad\text{as}\quad a_{\epsilon}\to 0.$

Hence, since $\epsilon L_{\epsilon}(K_{\epsilon})\subset\Upsilon$, we find
that

$M\tilde{\gamma}_{\epsilon}(B_{r_{n}})\leq\sum_{m=1}^{M}\tilde{\gamma}_{\epsilon}(K_{m})\leq
C_{\gamma}\sum_{m=1}^{M}\tilde{\gamma}_{\epsilon}(\tfrac{1}{2}K_{m})\leq
C_{\gamma}\tilde{\gamma}_{\epsilon}(K_{\epsilon}),$

with $C_{\gamma}$ denoting the doubling constant for $\gamma$ in $B_{2R}$,
which is the same as the doubling constant for $\nu$ in $B_{2R}$; since
$\Upsilon$ is convex, $\gamma$ inherits its doubling property from $\nu$. All
in all, considering the above chain of inequalities and (2.6), and denoting by
$j\in\mathbb{N}$ the smallest number such that $\frac{6D}{d}\leq 2^{j}r_{n}$,
we see that

$0<M\tilde{\gamma}_{\epsilon}(B_{r_{n}})\leq
C_{\mu}^{k}C_{\gamma}\tilde{\gamma}_{\epsilon}\big{(}B_{\frac{6D}{d}}\big{)}\leq
C_{\mu}^{k}C_{\gamma}^{j+1}\tilde{\gamma}_{\epsilon}(B_{r_{n}}),$

or, equivalently,

$M\leq C_{\mu}^{k}C_{\gamma}^{j+1}.$

But this is impossible for small $\epsilon$, concluding the proof.

### Case 2b: $0\in\partial(\operatorname{dom}(u))\cap\overline{X}$.

In this subcase, let $u_{\epsilon}(x):=u(x)-\epsilon(x_{1}+1)$ and define

$S_{0}:=\Sigma\cap\\{x_{1}\geq-1\\}\quad\text{and}\quad
S_{\epsilon}:=\\{u_{\epsilon}\leq 0\\}.$

Like before, for all $\epsilon\ll 1$,

$S_{\epsilon}\subset B_{D}$

for some $D>0$. Here, however, as $0\in\partial(\operatorname{dom}(u))$, we
have that

$\partial\tilde{u}_{\epsilon}(\tilde{S}_{\epsilon})\supset\operatorname{conv}(B_{r_{n}}\cup\mathbb{R}^{+}\mathbf{e}_{1})\quad\text{with}\quad
r_{n}:=\frac{1}{2n^{3/2}}.$

The function $\tilde{u}_{\epsilon}$ is defined in an analogous fashion to how
$\tilde{\phi}_{\epsilon}$ was defined in Case 2a (but replacing $\phi$ by $u$)
and, again, $\tilde{S}_{\epsilon}:=A_{\epsilon}(S_{\epsilon})$ with
$A_{\epsilon}$ denoting the John map associated to $S_{\epsilon}$ whose linear
part is $L_{\epsilon}$. In turn, arguing as we did in Case 2a, where again
$k\in\mathbb{N}$ is such that $2n^{3/2}\leq 2^{k}\frac{d}{C_{n}D}$ and
$C_{\mu}$ is the doubling constant for $\mu$ in $B_{4Dn^{3/2}}$, but in the
original variables, we deduce that

$\nu_{\epsilon}\big{(}\epsilon L_{\epsilon}(K_{\epsilon})\big{)}\leq
C_{\mu}^{k}\nu_{\epsilon}\big{(}\epsilon
L_{\epsilon}(B_{\frac{6D}{d}})\big{)}$

for all $\epsilon\ll 1$ (cf. (2.6)). Here, instead,
$\nu_{\epsilon}:=(\mathrm{Id}-\epsilon\mathbf{e}_{1})_{\\#}\nu$ and

$K_{\epsilon}:=\operatorname{conv}\left(B_{r_{n}}\cup\left\\{\tfrac{r_{n}}{\epsilon}\mathbf{e}_{1}\right\\}\right).$

Now notice that

$|L_{\epsilon}(\mathbf{e}_{1})|=|A_{\epsilon}(0)-A_{\epsilon}(-\mathbf{e}_{1})|\leq
2n^{3/2}.$

Moreover, we claim there exists an $N\gg 2n^{3/2}>0$ such that

$\|\epsilon L_{\epsilon}\|\leq N\quad\text{for all}\quad\epsilon\ll 1.$

Indeed, if not, then we can find a sequence of points $z_{\epsilon}\in
S_{\epsilon}$ and slopes $p_{\epsilon}\in\partial
u_{\epsilon}(z_{\epsilon})\cap\operatorname{span}(S_{0})^{\perp}$ such that
$|p_{\epsilon}|\to\infty$. In particular, in the limit, we find a point
$z_{0}\in S_{0}$ such that $\partial
u(z_{0})\cap\operatorname{span}(S_{0})^{\perp}$ contains a sequence of slopes
$\\{p_{j}\\}_{j\in\mathbb{N}}$ with $|p_{j}|=j$. But as
$p_{j}\in\operatorname{span}(S_{0})^{\perp}$, we see that
$p_{j}\cdot(x-z_{0})=p_{j}\cdot x=p_{j}\cdot(x-z)$ for any $z\in S_{0}$.
Hence, $p_{j}\in\partial u(z)$ for all $z\in S_{0}$ and $j\in\mathbb{N}$.
However, this is impossible;
$S_{0}\cap\operatorname{int}(\operatorname{dom}(u))$ is nonempty, and on this
set, $u$ is locally Lipschitz, proving the claim.

Therefore,

$\epsilon L_{\epsilon}(K_{\epsilon})\subset B_{N}\quad\text{and}\quad\epsilon
L_{\epsilon}\big{(}B_{\frac{6D}{d}}\big{)}\subset B_{\frac{6DN}{d}}.$

And so, arguing exactly like we did in Case 2a, we find that

$M\leq C_{\mu}^{k}C_{\nu}^{j+1},$

where $C_{\nu}$ is the doubling constant for $\nu$ in $B_{6DN/d}$ and
$M=M(\epsilon)\to\infty$ as $\epsilon\to 0$ is the analogous count for this
case’s $K_{\epsilon}$ (cf. (2.7)). But, again, this is impossible.

### Case 3

$\Sigma$ has an exposed point $\hat{x}$ in
$\mathbb{R}^{n}\setminus\overline{X}$. In this case, up to a translation, a
dilation, a rotation, and subtracting $\ell$ from $u$, we can assume that

$\hat{x}=0,\quad\Sigma\subset\\{x_{1}\leq 0\\},\quad\ell\equiv
0,\quad\text{and}\quad
S_{0}:=\Sigma\cap\\{x_{1}\geq-1\\}\Subset\mathbb{R}^{n}\setminus\overline{X}.$

Like before, let $u_{\epsilon}(x):=u(x)-\epsilon(x_{1}+1)$ and define

$S_{\epsilon}:=\\{u_{\epsilon}\leq
0\\}\quad\text{and}\quad\nu_{\epsilon}:=(\mathrm{Id}-\epsilon\mathbf{e}_{1})_{\\#}\nu.$

Again, $S_{\epsilon}\to S_{0}$ as $\epsilon\to 0$, so

$\operatorname{diam}(S_{\epsilon})\leq
2\operatorname{diam}(S_{0})\quad\text{and}\quad
S_{\epsilon}\Subset\mathbb{R}^{n}\setminus\overline{X}$

for all $\epsilon\ll 1$. For these small positive $\epsilon$, then,

$0=\mu(S_{\epsilon})=\nu_{\epsilon}(\partial u_{\epsilon}(S_{\epsilon})),$

where the second equality follows from the mass balance formula. (Recall that
$\mu$ vanishes on $\mathbb{R}^{n}\setminus\overline{X}$.) Moreover, as $Y$ is
convex,

$\partial
u_{\epsilon}(S_{\epsilon})\subset\operatorname{spt}(\nu_{\epsilon})=\overline{Y}-\epsilon\mathbf{e}_{1}$

(cf. (2.1)). Thus, any open subset of $\partial u_{\epsilon}(S_{\epsilon})$
must be in the interior of the support of $\nu_{\epsilon}$. In turn,
considering the cone generated by $\partial S_{\epsilon}$ over
$(0,u_{\epsilon}(0))$, for $0<\epsilon\ll 1$, we find that

$0=\nu_{\epsilon}(\partial
u_{\epsilon}(S_{\epsilon}))\geq\nu_{\epsilon}(B_{r_{\epsilon}})>0\quad\text{with}\quad
r_{\epsilon}:=\frac{|u_{\epsilon}(0)|}{2\operatorname{diam}(S_{0})}.$

(Again, for more details on this inclusion, see, e.g., [8, Theorem 2.8].) This
is a contradiction and concludes the proof. ∎

##  3\. Proof of Theorem 1.6

Again, we replace $u$ by its lower-semicontinuous extension outside of $X$,
exactly as we did at the beginning of Section 2. We split the proof in three
parts.

### Part 1: $u$ is continuously differentiable inside $X$.

We follow the argument used to prove [2, Corollary 1]. Assume for the sake of
a contradiction that the result is false. Up to a translation, let $0\in X$ be
a point at which $u$ has two distinct supporting planes. After a rotation,
dilation, and subtracting off an affine function from $u$, we may assume that

$u(x)\geq\max\\{x_{1},0\\},\quad
u(0)=0,\quad\text{and}\quad\frac{u(-s\mathbf{e}_{1})}{s}\to
0\quad\text{as}\quad s\to 0.$

Now consider the function $u_{\sigma}$ defined by

$u_{\sigma}(x):=u(x)-\tau(x_{1}+2\sigma)\quad\text{with}\quad\tau:=\frac{u(-\sigma\mathbf{e}_{1})}{\sigma}.$

Note that $\tau\to 0$ as $\sigma\to 0$. If

$S_{\sigma}:=\\{u_{\sigma}\leq 0\\},$

then, by the strict convexity of $u$ provided by Theorem 1.2, we see that

$S_{\sigma}\subset B_{D}\Subset
X\cap\operatorname{int}(\operatorname{dom}(u))$

for some $D>0$ and for all $\sigma\ll 1$; also, for these small positive
$\sigma$,

$\partial u_{\sigma}(S_{\sigma})\subset B_{R}\cap Y$

for some $R>0$. Moreover, if $\Pi_{-a}:=\\{x_{1}=-a\\}$ and
$\Pi_{b}:=\\{x_{1}=b\\}$ denote the two parallel planes that tangentially
sandwich $S_{\sigma}$, we see that

$a>\sigma\quad\text{and}\quad b<\frac{2\tau\sigma}{1-\tau},$

provided $\sigma>0$ is small enough to guarantee that $\tau<1$. Furthermore,

$\max_{S_{\sigma}}|u_{\sigma}|=|u_{\sigma}(0)|=2\tau\sigma,$

and

$\frac{\operatorname{dist}(\Pi_{b},\Pi_{0})}{\operatorname{dist}(\Pi_{-a},\Pi_{b})}=\frac{b}{a+b}\leq\frac{b}{a}\leq\frac{2\tau}{1-\tau}\to
0\quad\text{as}\quad\sigma\to 0,$

where $\Pi_{0}:=\\{x_{1}=0\\}$.

Now, set

$\tilde{u}_{\sigma}(x):=\frac{u_{\sigma}(A_{\sigma}^{-1}x)}{2\tau\sigma}\quad\text{and}\quad\tilde{S}_{\sigma}:=A_{\sigma}(S_{\sigma}),$

where $A_{\sigma}$ is the John map that normalizes $S_{\sigma}$. Arguing as we
did in the proof of Theorem 1.2, we find the same contradiction as we did in
Case 2 when $\tau$ sufficiently small; the only difference is that we consider
a slightly different chain of inequalities:

$\begin{split}\tilde{\nu}_{\sigma}(K_{\sigma})\leq\tilde{\nu}_{\sigma}\big{(}\partial\tilde{u}_{\sigma}(\tilde{S}_{\sigma})\big{)}&=\tilde{\mu}_{\sigma}(\tilde{S}_{\sigma})\\\
&\leq
C_{\mu}\tilde{\mu}_{\sigma}(\tfrac{1}{2}\tilde{S}_{\sigma})=C_{\mu}\tilde{\nu}_{\sigma}\big{(}\partial\tilde{u}_{\sigma}(\tfrac{1}{2}\tilde{S}_{\sigma})\big{)}\leq
C_{\mu}\tilde{\nu}_{\sigma}(B_{\frac{1}{r_{n}}})\end{split}$

(cf. (2.6)) where $\tilde{\mu}_{\sigma}$ and $\tilde{\nu}_{\sigma}$ are
defined so that
$(\nabla\tilde{u}_{\sigma})_{\\#}\tilde{\mu}_{\sigma}=\tilde{\nu}_{\sigma}$
and

$K_{\sigma}:=\operatorname{conv}\left(B_{r_{n}}\cup\left\\{\tfrac{r_{n}+n(1-\tau)}{2\tau}\mathbf{e}_{1}\right\\}\right)\quad\text{with}\quad
r_{n}:=\frac{1}{2n^{3/2}}.$

This proves that $u$ is differentiable.

By [8, Lemma A.24], for example, we know that differentiable convex functions
are continuously differentiable. So we conclude that $u$ is continuously
differentiable in $X$.

### Part 2: $\nabla u(X)=Y$ when $X$ is convex.

Because $\nabla u$ is continuous in $X$, its image $Y^{\prime}:=\nabla u(X)$
is an open set of full $\nu$-measure contained inside $Y$. Also, as the
assumptions on $\mu$ and $\nu$ are symmetric, the optimal transport map
$\nabla v$ from $\nu$ to $\mu$ is continuous, and $X^{\prime}:=\nabla v(Y)$ is
an open set of full $\mu$-measure contained inside $X$. Hence, recalling that
$\nabla u$ and $\nabla v$ are inverses of each other (see, e.g., [9, Corollary
2.5.13]), we conclude that $X^{\prime}=X$ and $Y^{\prime}=Y$, as desired.

### Part 3: $\nabla u$ is locally Hölder continuous inside $X$.

Thanks to the strict convexity and $C^{1}$ regularity of $u$, we can localize
the arguments of the proof of [12, Theorem 1.1] to obtain the local Hölder
continuity of $u$ inside $X$.

More precisely, if $u^{\ast}$ denotes the Legendre transform of $u$ (see
(2.2)), as in [12], one can show that $u^{\ast}$ satisfies a weak form of
Alexandrov’s Maximum principle (see [12, Lemma 3.2]), from which one deduces
the engulfing property for the sections of $u^{\ast}$ (see [12, Lemma 3.3]).
Iteratively applying this engulfing property, one obtains a polynomial strict
convexity bound for $u^{\ast}$. This bound implies the local Hölder continuity
of $u$ inside $X$ (see [12, Proof of Theorem 1.1]). We leave the details of
this adaptation to the interested reader.

Conflict of Interest: Authors state no conflict of interest.

Funding Information: AF acknowledges the support of the ERC grant No. 721675
“Regularity and Stability in Partial Differential Equations (RSPDE)” and of
the Lagrange Mathematics and Computation Research Center. YJ was supported in
part by NSF grant DMS-1954363.

## References

  * [1] Y. Brenier,  Polar factorization and monotone rearrangement of vector-valued functions,  Comm. Pure Appl. Math. 44 (1991), no. 4, 365 – 417.
  * [2] L. A. Caffarelli,  A localization property of viscosity solutions to the Monge-Ampère equation and their strict convexity,  Ann. of Math. 131 (1990), 129 – 134.
  * [3] L. A. Caffarelli,  Some regularity properties of solutions of Monge-Ampère equation,  Comm. Pure Appl. Math. 44 (1991), no. 8-9, 965 – 969.
  * [4] L. A. Caffarelli,  The regularity of mappings with a convex potential,  J. Amer. Math. Soc. 5 (1992), no. 1, 99 – 104.
  * [5] D. Cordero-Erausquin and A. Figalli,  Regularity of monotone transport maps between unbounded domains,  Discrete Contin. Dyn. Syst., 39 (2019), no. 12, 7101 – 7112.
  * [6] M. Gromov,  Convex sets and Kähler manifolds,  in Advances in Differential Geometry and Topology, World Scientific, Teaneck, NJ, 1990, pp. 1 – 38.
  * [7] C. E. Gutiérrez,  “The Monge-Ampère equation”,  Progr. Nonlinear Differential Equations Appl., 44, Birkhäuser Boston, Boston, MA, 2001.
  * [8] A. Figalli,  “The Monge-Ampère equation and its applications”,  Zurich Lectures in Advanced Mathematics. European Mathematical Society (EMS), Zürich, 2017. x+200.
  * [9] A. Figalli and F. Glaudo,  “An Invitation to Optimal Transport, Wasserstein Distances, and Gradient Flows”,  EMS Textbooks in Mathematics. EMS Press, Berlin, 2021. vi+136 pp.
  * [10] D. Jerison,  Harmonic measure in convex domains,  Bull. Amer. Math. Soc. (N.S.) 21 (1989), no. 2, 255 – 260.
  * [11] Y. Jhaveri,  On the (in)stability of the identity map in optimal transportation,  Calc. Var. Partial Differential Equations 58 (2019), no. 3, Art. 96, 25 pp.
  * [12] Y. Jhaveri and O. Savin,  On the regularity of optimal transports between degenerate densities,  Arch. Ration. Mech. Anal. 245 (2022), no. 2, 819 – 861.
  * [13] R. J. McCann,  Existence and uniqueness of monotone measure-preserving maps,  Duke Math. J. 80 (1995), 309 – 323.
  * [14] C. Villani,  “Topics in optimal transportation”,  Graduate Studies in Mathematics, 58. American Mathematical Society, Providence, RI, 2003. xvi+370 pp.
  * [15] L. Zajíček,  On the points of multiplicity of monotone operators,  Comment. Math. Univ. Carolinae 19 (1978), no. 1, 179 – 189.


#  Rand-OFDM: A Secured Wireless Signal

Hesham Mohammed and Dola Saha  Department of Electrical & Computer Engineering
University at Albany, SUNY
{hhussien, dsaha} @albany.edu

###### Abstract

Wireless communication has been a broadcast system since its inception, which
violates security and privacy issues at the physical layer between the
intended transmit and receive pairs. As we move towards advanced spectrum
sharing methodologies involving billions of devices connected over wireless
networks, it is essential to secure the wireless signal such that only the
intended receiver can realize the properties of the signal. In this paper, we
propose Rand-OFDM, a new waveform, secured with a shared secret key, where the
signal properties can be recovered only at the expected receiver. We achieve
the signal level security by modifying the OFDM signal in time-domain, thus
erasing the OFDM properties and in turn obfuscating the signal properties to
an eavesdropper. We introduce a key-based secured training signal for channel
estimation, which can be used only at the intended receiver with prior
knowledge of the key. As a final step for the recovery of the signal, we use a
clustering based technique to correct the phase of the received signal. Our
cryptanalysis shows that Rand-OFDM is especially useful in future wide band
signals. Extensive simulation and over-the-air experiments show that the
performance of Rand-OFDM is comparable to legacy OFDM and SNR penalty due to
the secured waveform varies between $\approx$ 1-4dB. In all these scenarios,
Rand-OFDM remains unrecognized by the adversary even at the highest possible
SNR.

##  I Introduction

As new spectrum (sub-6GHz, mmWave and TeraHertz) becomes available for
communication and coexistence of frequency-agile cognitive heterogeneous nodes
becomes a norm, we need to rethink physical layer security to provide maximum
secrecy in a broadcast channel. There has been a growing interest recently
among multiple federal agencies to utilize the spectrum in a collegial way by
heterogeneous devices. This also indicates that wireless signals will be
vulnerable to various security attacks, which was unforeseen in prior
extremely regulated framework. This motivates us to investigate in physical
layer secured communication, which is hard to decipher by an eavesdropper in a
hostile scenario, as well as practical enough to be accepted for mass
deployments.

Prior work [1, 2, 3, 4, 5] utilizes imperfection of the communication channel
to establish secrecy by physical layer methods without the need of a shared
secret key. However, channel imperfections are not enough to provide high
secrecy capacity when the eavesdropper has a high signal-to-noise ratio (SNR)
or has similar quantized channel state as the intended receiver. Higher layer
encryption [6] provides computationally hard secrecy, but there exists key
management and distribution issues. Also, since the waveform remains unchanged
in all the above mentioned scenarios, it is plausible for the eavesdropper to
restrict cryptanalysis search space within that waveform. To address these
issues for future wireless agile radios, we introduce physical layer security,
where we modify the OFDM waveform to completely disrupt its orthogonality
properties of the subcarriers based on a shared secret key. At the receiver,
we perform extensive channel estimation and reconstruct the waveform. The
secret key can be derived from the channel or stored in the radio hardware,
which will minimize the key distribution issues. In this paper, we only focus
on modification of the time-domain signal at the transmitter and
reconstruction of that back at the receiver.

Figure 1: Rand-OFDM: A system overview.

If $M$ is the message that Alice needs to transmit to Bob, she can encrypt it
with the shared secret key ($K$) to produce $X$. As it reaches Bob, it passes
through the channel $H_{AB}$, such that the received signal is
$Y_{B}=XH_{AB}+N_{B}$, where $N_{B}$ is the noise. An eavesdropper, Eve, will
experience a different channel and will receive $Y_{E}=XH_{AE}+N_{E}$. If
channel imperfections are used to encrypt, secrecy capacity is a function of
received SNR at Eve. In this scenario, we propose Rand-OFDM, where we modify
the time domain signal, such that the transmitted signal, $X$, is no longer a
known waveform (OFDM, CDMA, etc.). Figure 1 shows an overview of Rand-OFDM,
where we randomize the time domain OFDM signal based on $K$, such that the
resultant $X$ does not have orthogonality property. Due to the spectral
efficiency of OFDM and its use in most standards, like Wi-Fi [7], 5G [8], we
have chosen it as the candidate for generating the base waveform.

Our approach has two distinct benefits over prior work. Firstly, secret key
based approach to modify the signal indicates that even at high SNR or even if
Eve has full channel knowledge between Alice and Bob, $H_{AB}$, she will not
be able to decode $X$. In other words, if Eve gets access to
$Y_{E}^{\prime}=XH_{AB}+N_{B}$, she will not be able to decode $X$ without the
key $K$, which is used to generate $X$. Secondly, by modifying the time domain
signal based on a key, we ensure that it appears as a noise or an unknown
signal to Eve. The combination of the key and data will create a different
signal every time it is transmitted. Thus it creates a larger search space for
Eve to attack this waveform. It is to be noted here that any higher layer
encryption or bit level interleaving can be used in conjunction with Rand-OFDM
to provide multiple layers of protection from different security threats.

The major challenges of Rand-OFDM are: 1) to design a computationally light
operation to modify the OFDM waveform in time-domain, 2) to estimate the
channel effects accurately at the receiver, which looses frequency domain
properties due to the time domain modifications, 3) to hide the channel
parameters in a way to make it difficult for the eavesdropper to estimate the
channel accurately, and 4) to architect a design to correct the residual phase
offsets due to the absence of pilot subcarriers in frequency domain. To the
best of our knowledge, we are the first ones to modify the time domain
wireless OFDM signal to loose the orthogonality of the signal and introduce
novel channel estimation technique to recover the signal back at the receiver
and evaluated the system in practical over-the-air scenarios. Hence, the key
contributions of our work can be listed as follows:

(a) Time domain OFDM signal before randomization

(b) Time domain Rand-OFDM signal after randomization

(c) Frequency response of Rand-OFDM signal

(d) Constellation diagram of BPSK-modulated Rand-OFDM.

Figure 2: Time domain and frequency domain representation of Rand-OFDM at the
transmitter.

Key-based Time Domain Security: We designed a secret key based time domain
modification of the OFDM signal to generate a new waveform, Rand-OFDM, which
does not retain any OFDM properties that are essential to combat the multipath
effects of the channel. At the receiver, we successfully reconstruct the
signal by channel estimation and decryption of the Rand-OFDM waveform.

Secured Training Signal: We designed a novel training signal based on a shared
phrase or data with the same randomization key, such that only the intended
receiver is able to correctly decode it to estimate the channel accurately at
the receiver.

Clustering based Phase Offset Correction: We scramble the signal in time
domain, where the frequency domain pilots change in both phase and magnitude
and cannot be used as known symbols for channel estimation or phase tracking.
We introduced a unique solution to track the residual phase offset by
utilizing K-medoids clustering algorithm underneath.

Cryptanalysis: We perform cryptographic analysis on the Rand-OFDM signal, and
provide insights on the resiliency of the waveform, specially for higher
orders of FFT, as envisioned in next generation of wireless systems.

Practical Evaluation: In midst of mostly theoretical research in time domain
physical layer security, we formulated the mathematical problem for Rand-OFDM
and provided a receiver design that is essential for successfully decoding the
signal in multipath-rich environment. We also evaluated our system using
extensive experiments over the air in an indoor environment for the protocol
to be embraced for practical deployment.

##  II Related Work

Time domain security: A fairly decent amount of research has been done in
recent years to modify the time domain signal to achieve security in physical
layer. However, most of them are either theoretical or are dependent on
impractical assumptions. In [9], authors introduced an OFDM encryption scheme
based on multiplying the real and the imaginary parts of the generated OFDM by
dynamic values based on a shared secret key between the transmitter and the
receiver. This changes the signal values, which changes the Peak-to-Average
Power Ratio (PAPR) of the OFDM symbol. The results are evaluated only for
simulated AWGN channel, where there is no channel effects. Authors in [10]
uses a random shuffling based on a secret key. The algorithm has been
evaluated for a flat fading channel, where channel effects are negligible.
These works do not attempt to introduce any channel or phase correction at the
receiver due to theoretical nature of these research.

In [11], authors propose a time domain physical layer security scheme based on
modifying the length of the cyclic prefix (CP) to be equal to the channel
impulse response of the intended user, whereas the channel impulse of Eve may
be longer than the intended user. This introduces inter symbol interference
(ISI) to the received signal of the Eve. However, if Eve has a better channel
compared to Bob, this technique fails. In [12], authors propose adding an
artificial noise to the time domain OFDM signal such that when it passes
through the receiver channel, it gets accumulated on the Cyclic Prefix. The
receiver can decode the message after removing the CP, while the
eavesdropper’s signal can not be recovered due to the presence of the noise.
This is also a theoretical attempt without any receiver modification in
practical scenarios.

Frequency domain secrecy: Modifying the frequency domain signal is a common
technique to achieve secured [13, 14, 15, 16] or covert communication [17]. In
[13], the transmitter uses the non fading subcarriers to the intended user for
data transmission. The assumption of this theoretical work is that Eve’s
channel has a completely different deep fading, which might not be a practical
assumption. In [14], the authors proposed an algorithm to provide pre-coder
and post-coder matrices to make the channel matrix of the legitimate user to
be diagonal. Also the authors in [15] proposed an optimal channel selection
for channel indices to maximize the SINR for the legitimate user to achieve
secure communication. In [16], the author proposed an encryption algorithm for
OFDM system based on dummy data insertion of a portion of sub carrier to make
performance degradation at the eavesdropper. It is to be noted that frequency
domain modification retains the OFDM properties and reveals the waveform
characteristics to the eavesdropper.

Space domain secrecy: Use of MIMO antennas [18, 19, 20] to beamform towards
the intended receiver and/or steer null towards the eavesdropper is another
way to enable physical layer security. The two major assumptions in these set
of work are a) Eve will have fewer antenna elements, which cannot be accurate
in the world of electronic warfare and b) Eve is not in the path of beam
pattern radiation, which is inaccurate specially when devices are getting
smaller and can be placed anywhere in plain sight.

##  III Background

Orthogonal Frequency Division Multiplexing (OFDM) is a digital multicarrier
modulation technique, where subcarriers are orthogonal to each other. This is
achieved by Inverse Fast Fourier transform (IFFT) on the modulated data
stream. For $N$ parallel data streams, $N-point$ IFFT is performed on the
complex digital modulated signal $X(n)$. The time domain signal $x(n)$, can be
expressed as:

$x[n]=IFFT(X[n])=\sum_{i=1}^{N-1}{X(i)e^{\frac{j2\pi in}{N}}}$ (1)

In order for the IFFT/FFT to create an intersymbol interference (ISI) free
channel, the channel must appear to provide a circular convolution. Hence, a
cyclic prefix of length v is appended after the IFFT operation, resulting in N
+ v samples, which are then sent in serial through the wireless channel.

The duality between circular convolution in the time domain and simple
multiplication in the frequency domain is a property unique to the Discrete
Fourier Transform (DFT), which can be utilized to represent the received OFDM
signal $Y(n)=H(n)X(n)$.

At the receiver, the cyclic prefix is discarded, and the N received symbols
are demodulated, using an FFT operation, which results in N data symbols. The
received frequency domain signal $Y(n)$ is given by:

$Y[n]=FFT[y(n)]=\sum_{i=1}^{N-1}{y(i)e^{\frac{-j2\pi in}{N}}}$ (2)

where $y$ is the received OFDM symbol in the time domain.

##  IV System Design of Rand-OFDM

Figure 3: Transmitter and receiver blocks in Rand-OFDM. Blocks in yellow are
either added or modified in the legacy system.

In this section, we introduce the system design of Rand-OFDM, which
predominantly has modifications at both the transmitter and the receiver side.
The key idea of Rand-OFDM lies in randomizing the FFT output or the time
domain digital complex signals to loose the OFDM properties, such that it
appears as a wideband noise to the eavesdropper. Figure 2 shows such an
example a) time domain signal after the IFFT output, followed by b) its
randomized version, which is transmitted over the air. The c) frequency
response of the transmitted Rand-OFDM signal and d) its constellation plot
show that we have successfully destroyed the OFDM properties for the signal to
appear as a noise at the transmitter side, even before the channel impairments
are introduced. Figure 3 shows the transmitter and receiver modules, which are
discussed in § IV-A and § IV-B respectively.

###  IV-A Transmitter Design of Rand-OFDM

Rand-OFDM transmitter is based on Wi-Fi [7] like OFDM [21] building blocks. We
introduce a new block termed Randomizer after the IFFT block in the OFDM
transmitter chain, as shown in figure 3. The Randomizer introduces time domain
scrambling of the resultant time domain complex samples from the IFFT block.
The time domain scrambling is based on a shared secret key between the
transmitter and the receiver pair. In other words, this is the symmetric key
that is used both in encryption and decryption process. For example, if the
original OFDM symbol is $[a_{0},a_{1},a_{2},a_{3},a_{4},a_{5}]$, then the
resulted randomized sequence is $[a_{5},a_{3},a_{1},a_{2},a_{4}]$, where the
key is $[5,3,1,2,4]$. The cyclic prefix (CP) is added after that to be able to
extract frequency response of the channel at the receiver, which is detailed
in § IV-B.

As the Randomizer block is added in the OFDM transmitter chain, the time
domain Rand-OFDM signal, $x_{t}$, can be expressed as:

$x_{t}=P_{CP}RF^{-1}X_{F}$ (3)

where $P_{CP}$ is the cyclic prefix matrix, $R$ is the randomizer matrix and
$F^{-1}$ is the inverse Fourier Transform Matrix.

By randomizing in time domain, the secured transmitted wave form has lost all
the OFDM properties. In other words, the Rand-OFDM transmitted wave form
$X_{t}$ can given by:

$X_{t}=FTx_{t}=FRF^{-1}X_{F}$ (4)

where $T$ is the truncation matrix for cyclic prefix removal and $F$ is the
N-FFT matrix and can be given as:

$F=\begin{bmatrix}W^{0,0}&W^{0,1}&.........&W^{0,N-1}\\\
W^{1,0}&W^{1,1}&.........&W^{1,N-1}\\\ .\\\ .\\\
W^{N-1,0}&W^{N-1,1}&.........&W^{N-1,N-1}\end{bmatrix}$ (5)

where $W^{n,k}=e^{-2j\pi\frac{nk}{N}}$ and N is the FFT size.

$FRF^{-1}=\frac{1}{N}\sum{e^{2j\pi\frac{n(k-m)}{N}}}=\begin{cases}I,&R=I\\\
Q,&R\neq I\end{cases}$ (6)

where $I$ is the identity matrix and $Q$ is the generated transformation
matrix due to the presence of $R$.

From equation 6, we can conclude that if there is no randomization in the time
domain samples (i.e $R_{F}=I$), the OFDM symbol retains its orthogonality
property. Otherwise, a magnitude and phase noise is added to the received OFDM
symbol. This distorts the original OFDM symbol by transforming the original
constellation into a random constellation pattern which depends on the
randomization matrix $R$. We would like to highlight here that the changes
introduced in this stage do not depend on the original modulation order of the
transmitted constellation. Moreover, the transformation matrix spreads the
power of the OFDM symbol over the whole bandwidth including the guard bands.
Figure 2 shows the transformation of an OFDM symbol to a Rand-OFDM symbol. In
this case, 52 subcarriers were modulated with BPSK modulated signal,
generating the time domain OFDM signal as in figure 2(a). The resultant signal
goes through a Randomizer to generate the Rand-OFDM waveform as shown in
figure 2(b). If we perform FFT on this waveform, we notice that the magnitude
of the subcarriers are varying randomly, as well as the power spreads to all
64 subcarriers and not confined to only 52, as we started with. This is
evident in figure 2(c), which is due to the matrix multiplication of $R$.
Figure 2(d) shows the phase noise that is induced due to the randomization.
These imperfections require significant modifications in the receiver design,
which is explained in § IV-B.

Figure 4: Packet Structure of Rand-OFDM.

The packet structure of Rand-OFDM is shown in figure 4, where the short and
long preambles of legacy 802.11 [7] system are used to detect the start of the
packet. Rest of the MAC layer packet structure remains same except they are
modified just before transmission to the Rand-OFDM waveform. A training signal
of one OFDM symbol duration is appended to improve the channel estimation at
the intended receiver, the design of which is detailed in § V-A.

###  IV-B Receiver Design of Rand-OFDM

The receiver design of Rand-OFDM is based on legacy 802.11a/g [7] receiver
blocks, where yellow colored blocks are the ones which we added or modified,
as shown in figure 3. Receiver design starts with a packet detection block,
followed by Carrier Frequency Offset (CFO) correction and removal of cyclic
prefix. FFT follows right after that to convert the data to the frequency
domain. Based on the modifications at the transmitter, it might seem that we
need to insert the Derandomizer block just before the data goes into the FFT
block. One of the major components before the FFT is the channel correction,
as the received waveform can be represented as:

$Y_{t}=H_{t}X_{t}+N_{t}=H_{t}P_{CP}RF^{-1}X_{F}+N_{t}$ (7)

where $H_{t}$ is the channel impulse response in time domain and $N_{t}$ is
the noise. At this point, we need to estimate and correct the channel
impairments at the receiver. Time domain channel estimation and correction has
been shown to be computationally more expensive [22], due to which we choose
to perform it in frequency domain. Derandomizing the signal before extracting
the channel information would make the channel estimation problem intractable.
Hence, we convert the signal to frequency domain to extract the frequency
domain channel response, which is first corrected on the signal. Once the
cyclic prefix is removed, we perform N-point FFT to convert the time domain
signal $Y_{t}$ to frequency domain. The received waveform in frequency domain
can then be expressed as:

$X_{rF}=FTY_{t}=H_{F}FRF^{-1}X_{F}+N_{F}$ (8)

where $H_{F}$ is the channel frequency response. Channel estimation for Rand-
OFDM is discussed in details in § V-A. In the following discussion, we assume
that we know the channel $H_{F}$ and inverse it yielding received frequency
domain waveform $\tilde{X}_{rF}$ without channel impairments.

$\tilde{X}_{rF}=H_{F}^{-1}X_{rF}=FRF^{-1}X_{F}+\tilde{N}_{F}$ (9)

This is the output of the channel correction block as shown in figure 3, which
is in frequency domain. We introduced the randomization in time domain, and
hence it is necessary to convert it back to time domain as a part of the
decryption block. After the signal is passed through the IFFT block of the
decryption process, it can be represented as

$F^{-1}\tilde{X}_{rF}=F^{-1}FRF^{-1}X_{F}+\tilde{N}_{F}=RF^{-1}X_{F}+\tilde{N}_{F}$
(10)

Now, this time domain signal is passed through the Derandomization block to
yield the correct time domain data symbols.

$R^{-1}RF^{-1}X_{F}+\tilde{N_{F}}=F^{-1}X_{F}+\tilde{N}_{F}$ (11)

The final step is to perform FFT on equation 11 to demodulate the data
subcarriers.

$FF^{-1}X_{F}+\tilde{N_{F}}=X_{F}+\tilde{N}_{F}$ (12)

We introduce another Phase Offset Correction phase, which is detailed in §
V-B.

##  V Distortions from Channel and Hardware

(a) Actual Channel (Mag)

(b) Estimated Channel (Mag)

(c) Actual Channel (Ph)

(d) Estimated Channel (Ph)

Figure 5: Channel Estimation (Magnitude & Phase) of frequency selective
channel for training signal based estimation technique.

Imperfections at the received are induced due to the wireless multipath
channel and the underlying hardware. In this section, we illustrate the
methodologies that we introduce to estimate and counteract the imperfections
to yield better performance.

###  V-A Training signal based channel estimation

Accurate estimation of channel is essential in high frequency selective fading
channels, specially at higher order modulations, where minimal error in
channel estimation will lead to significant error in demodulation. In § IV-B,
we assumed complete knowledge of the channel $H_{F}$, which is an incorrect
assumption in practical systems. Partial channel estimation on only 52
subcarriers of long preamble and extrapolating that for 64 subcarriers, as
required for Rand-OFDM, yields poor performance in multipath channels. Hence,
we design a training signal that spans all 64 subcarriers to better estimate
the channel at the intended receiver. We use a shared secret data and
randomize it based on the same shared key between Alice and Bob to create one
BPSK modulated Rand-OFDM signal, as described in § IV-A. This OFDM symbol is
transmitted after the preamble as shown in figure 4. Channel estimation at the
receiver requires knowledge of transmitted waveform, which in this case is
secured by the shared key. Hence, we add another layer of security, where Eve
will not be able to estimate the channel accurately as the training signal is
dependent on the shared secret key, and physical layer authentication can be
initiated using the training signal [23, 24].

If $X_{Tr}$ is the BPSK-modulated OFDM signal, then the Rand-OFDM training
signal can be derived from equation 3 as $x_{Tr}=P_{CP}RF^{-1}X_{Tr}$. The
received training signal can be derived from equation 7 as

$y_{Tr}=H_{t}P_{CP}RF^{-1}X_{Tr}+N_{Tr}$ (13)

Since $X_{Tr}$ and $R$ matrices are shared between the transmitter and the
intended receiver only, the channel can be estimated by only Bob. Ignoring the
noise, channel frequency response can be estimated by:

$H_{F}=\textstyle\frac{FTy_{Tr}}{X_{Tr}}$ (14)

Figure 5 shows the actual and the estimated phase and magnitude of the channel
in frequency selective fading conditions. It is obvious that training signal
channel estimation gives an accurate channel estimation for the whole 64 sub-
carriers rather than the preamble channel estimation which only concerns on 52
sub-carriers .

(a) Before Phase correction

(b) After Phase correction

Figure 6: Clustering based residual phase offset correction for over the air
indoor experiments using 16QAM modulation.

###  V-B Clustering based phase offset correction

Device impairments introduce difference between the carrier frequency of the
receiver and that of the transmitter. Coarse and fine carrier frequency offset
correction blocks are introduced at the receiver to estimate and correct those
offsets based on short and long preambles respectively, as shown in figure 3.
Residual carrier frequency offset of conventional OFDM received waveform is
calculated based on the pilot subcarriers. In Rand-OFDM, the pilots inserted
in frequency domain do not capture the channel frequency response at those
subcarriers as the pilot energy gets spread due to the process of
randomization. Hence, we introduce a clustering based algorithm to track the
residual phase offset due to hardware impairments. It is to be noted here that
the purpose of this block is not to estimate the variation in channel per OFDM
symbol, which can be accurately estimated by inserting pilot subcarriers in
every OFDM symbol. This block is intended to estimate and correct the offset
between the transmitter and receiver pairs, which do not change from one OFDM
symbol to the next.

We use K-mediods clustering algorithm [25], where the input to the algorithm
is the In-Phase and Quadrature values of the constellation points of all the
subcarriers of all received OFDM symbols in a packet and the number of
expected clusters based on the modulation order. The resultant $C$ cluster
centers are then examined to estimate the residual phase offset. We choose the
farthest cluster points in each quadrant to determine the phase offset. There
are also the highest energy point indicating a total of 4 cluster centers for
QAM or QPSK modulations and only 2 for BPSK. The rationale for choosing the
highest energy point within a quadrant is that there exists only one such
point in the transmitted constellation to which it can be mapped to. This is a
generic approach and can be scaled to even higher order modulations, like
256-QAM and beyond. The phase offset is then calculated per quadrant as:

$\theta_{estimated,i}=arg(X_{Ti}/C_{max,i})$ (15)

where $X_{Ti}$ is the farthest transmitted constellation point within a
quadrant and $C_{max,i}$ is the maximum energy cluster center of the same
quadrant $i$. Averaging 2 values in BPSK or 4 for other modulation orders, we
calculate residual phase offset as:

$\theta_{estimated}=\textstyle\frac{1}{M}\sum_{i=1}^{M}\theta_{estimated,i}$
(16)

where $M$ is 2 for BPSK and 4 for other modulations. In the last step, we
correct the residual phase offset by multiplying the estimated phase to the
received signal to generated the corrected signal, $X_{Fc}$, which can then be
used for demodulation.

$X_{Fc}=X_{F}e^{j\theta_{estimated}}$ (17)

where $X_{F}$ is the received OFDM signal before correction. Figure 6 shows an
example scenario of over-the-air experiments at 15dB SNR, where the residual
phase offset is corrected based on the proposed clustering algorithm.

##  VI Cryptanalysis

In this section, we perform security analysis on Rand-OFDM to evaluate its
resiliency against various types of attacks. For simplicity, let’s assume that
the received OFDM symbol at Eve is:

$Y_{E}=FRF^{-1}X_{F}$ (18)

According to Shannon secrecy [26], the system can be perfectly secure if the
key size equals to the data size such that:

$E(R_{i})\geq E(X_{F})$ (19)

where $E(X)$ is the entropy of the random variable $X$. This analysis can
easily be realized in bit level, however in physical layer we observe it from
two different viewpoints. First, the system achieves perfect secrecy on symbol
level as both the data symbol size and the key size are equal to the FFT size
N. In other words, Eve can not deduce any information with one symbol. Second,
if the system has a set of keys $\textit{K}=[K_{1},K_{2},K_{3},...,K_{V}]$,
and OFDM frame $\textit{X}=[X_{1},X_{2},X_{3},...,X_{n}]$, the mutual
information between the encrypted and original symbols equal to:

$\lim_{V\to n}I(X_{E},X_{F})=0$ (20)

###  VI-A Brute-force attack

In this attack, the eavesdropper knows the encryption and the decryption
algorithm, however the key is unknown. The eavesdropper performs an exhaustive
search on all possible keys to decrypt the cipher data (i.e the encrypted
data). The strength of the algorithm is proportional to the length of the key,
which is the size of FFT for Rand-OFDM. The number of all possible keys $L$ is
given by $L=N!$, where $N$ is the FFT size. So the probability of success
$P_{s}$ to predict the key is uniformly distributed and is given by
$P_{s}=\frac{1}{L}$. FFT size has been chosen to be 64, which is minimum for
802.11a/g [7], and can be a much larger value of 1024 or 2048 in newer
wideband Wi-Fi and 5G standards.

###  VI-B Cipher text attack

In this attack, $Y_{E}$ is only available with the decryption function $D$.
Eve tries to predict $R_{E}$ by attempting different keys based on the
statistical properties on the cipher data. However, since the security layer
is introduced in physical layer, especially in time domain, the statistical
properties of the received waveform does not change, for example received
power or the peak to average power ration (PAPR). So Eve has to try all
possible keys to decrypt the data, resulting in Brute-force attack.

###  VI-C Chosen plain text attack

In this attack, $Y_{E}$ and $X_{F}$ are known at the eavesdropper. In other
words, Eve knows some pattern and the corresponding cipher patterns. For fixed
key, Eve can solve equation 18 and deduce the corresponding $R_{E}$. However
the security of the algorithm can be increased by using a defined shared set
of keys $K=[K_{1},K_{2},...,K_{V}]$, and the selected shared key changed
dynamically from one symbol to another based on certain distribution
$f_{K}(K)$. In this case, Eve has to deduce the statistical properties of the
key distribution for multiple attacks assuming $K$ is known.

##  VII Evaluation

In this section, we present the performance analysis of the Rand-OFDM system
in comparison with legacy 802.11a/g in different channel models. Although we
do not use any pilot symbols, they are still inserted as in the legacy system
such that same number of data bits are transmitted for both the cases. We used
MATLAB to encrypt and decrypt the signals and used the channel models to
perform extensive simulations for both legacy OFDM and Rand-OFDM. For the rest
of the paper, the suffixes (L) and (R) are used for legacy OFDM [7] and Rand-
OFDM transmissions with full channel knowledge respectively. In addition, we
use (R-T) using training signal based channel estimation.

Channel | AWGN | Flat | Frequency Selective
---|---|---|---
Model | - | Rayleigh | Rayleigh
No. of taps | 0 | 1 | 6
Path delays | 0 | 0 | [0,100,200,300,500,700] ns
Path loss | 0 | 0 | [0,-3.6,-7.2,-10.8,-18,-25.2] dB
Doppler | 0 | 0 | 3Hz
TABLE I: Channel Models

###  VII-A Without Channel Estimation

We evaluate the performance of Rand-OFDM receiver blocks as described in §
IV-B in the basic scenario, where no channel estimation is required.

(a) AWGN Channel.

(b) Indoor channel.

(c) Flat fading channel.

(d) Indoor channel.

Figure 7: BER of Rand-OFDM compared to legacy OFDM. Figures (a,b) with
complete channel knowledge and (c,d) with training signal channel estimation.

####  VII-A1 AWGN Channel

The first case for evaluation is Additive White Gaussian Noise (AWGN) channel,
where the channel frequency response matrix $H_{F}=I$, since both time and
frequency coefficients are unity. Figure 7(a) shows the BER performance of
Rand-OFDM in AWGN channel for different modulation orders. Performance of
Rand-OFDM is close to that of legacy OFDM signal. This is due to the fact that
OFDM structure, even when lost, can be reconstructed back at the receiver in
the absence of channel effects. From equation 10, it is evident that if the
eavesdropper does not have the key to generate the matrix $R$, she can not
decode the packet. This is shown in the results as well, where the BER curve
for Eve remains constant and never go down even at higher SNRs. This is a
major advantage of using key-based physical layer security over channel based
encryption techniques. We choose not to show the BER curve for Eve as she was
unable to decode in the best possible channel.

####  VII-A2 Complete channel knowledge

In this section, the performance of the proposed system is evaluated assuming
that we have full channel knowledge (i.e $H_{F}$ is known). Based on ITU-R
recommendation, we assume frequency selective indoor channel model with
parameters shown in table I. We assume that legacy receiver also knows the
$H_{F}$ matrix. Figure 7(b) shows the performance of Rand-OFDM in a frequency
selective channel when the channel is known at the receiver. If channel is
known, the SNR gap between legacy OFDM and Rand-OFDM is due to the
modification of the waveform, which cannot be retrieved at the receiver.

(a) BPSK

(b) QPSK

(c) 16QAM

(d) 64QAM

Figure 8: BER of Rand-OFDM compared with legacy OFDM for over-the-air
experiments using different modulation orders.

###  VII-B With Channel Estimation

In this section, we analyze the performance of the channel estimation
techniques, as elaborated in § V-A in two different channel models, ‘Flat
Fading’ and ‘Frequency Selective Fading’, as shown in table I.

Training signal is used to estimate the wireless channel effect for Rand-OFDM
transmissions, while legacy OFDM signal did not require this extra OFDM
symbol. Figure 7(c) shows the performance of the training signal based channel
estimation, which performs well due to the accuracy of the channel estimation
using the training signal channel estimation. there is a small SNR penalty
around $\approx 2dB$ due to the loss of orthogonality due to the randomization
process at the transmitter. This is expected as the channel effects are minor
in a relative flat channel. Figure 7(d) shows the performance in a multipath
rich environment, where the channel is extremely frequency selective. Results
indicate that the newly introduced training signal is not only secured, but
also provides accurate channel estimation for the signal to be reconstructed
back with minimal SNR penalty. The SNR gap between legacy OFDM and Rand-OFDM
is $\approx 4dB$, indicating that it can be embraced in various practical
scenarios.

##  VIII Over the Air experiments

We perform extensive over-the-air experiments in indoor scenario to validate
Rand-OFDM. Figure 9 shows one of our transceiver nodes equipped with USRP X310
[27] with 10 $dBi$ antenna. It is connected to an Intel NUC (NUC7i7BNH) with
i7-7567U processor and 16GB DDR4 memory for faster processing of the I/O. The
experiments are performed in multiple locations in a multipath-rich indoor
environment in both line of sight and non-line-of-sight scenarios. We present
the results for an average of all those locations to eliminate any
dependencies on channel. Also, all the experiments were performed at 20MHz
bandwidth and 2.484GHz frequency to avoid any interference from the Wi-Fi
Access Points operating in the same area. Each data point in our result is an
average of 500 OFDM symbols for both legacy OFDM and Rand-OFDM.

Figure 9: Experimental setup of one node.

Figure 8 shows the BER performance for legacy and Rand-OFDM transmissions for
different modulation orders. It is evident that there is an SNR gap between
the Rand-OFDM and the Legacy OFDM transmission. This gap is due to the loss of
orthogonal property of OFDM signal and channel estimation imperfections. This
is the SNR penalty that we incur to secure a waveform in time domain.
Moreover, the SNR gap decreases at higher modulation order due to the higher
operated SNR, which enables the receiver to decrease the error space in
channel estimation using the training signal. In other words, the error
introduced due to time-domain modification can be reconstructed back more
efficiently at a higher SNR.

Figure 10 presents the phase angle correction distribution for different
modulation orders over all packets at different SNRs. The residual phase error
is dependent on the hardware impairments and not on modulation order or
channel characteristics. This is evident from the values, which varies between
0.05 to 0.12 radians. The phase correction results indicate that there exists
significant residual error, which needs to be corrected to improve the
performance.

Figure 10: Residual phase offset correction for different modulation orders.

##  IX Conclusion

In this work, we present Rand-OFDM, a secure OFDM transmission based on time
domain scrambling using a shared secret key between the transmitter and the
receiver. We perform channel estimation and equalization to retrieve the
signal. Furthermore, we introduce a secured training signal to accurately
estimate the channel followed by cluster based residual phase error
correction. Over the air experiments show the success probability of this
system. In future, the key generation and management can be developed based on
channel state for lightweight secured physical layer encryption.

## References

  * [1] H. V. Poor and R. F. Schaefer, “Wireless physical layer security,” _Proceedings of the National Academy of Sciences_ , vol. 114, no. 1, pp. 19–26, 2017. [Online]. Available: https://www.pnas.org/content/114/1/19
  * [2] J. Hamamreh, H. M. Furqan, and H. Arslan, “Classifications and applications of physical layer security techniques for confidentiality: A comprehensive survey,” _IEEE Communications Surveys and Tutorials_ , vol. PP, pp. 1–1, 10 2018.
  * [3] G. Baldini, T. Sturman, A. R. Biswas, R. Leschhorn, G. Godor, and M. Street, “Security aspects in software defined radio and cognitive radio networks: A survey and a way ahead,” _IEEE Communications Surveys Tutorials_ , vol. 14, no. 2, pp. 355–379, Second 2012.
  * [4] A. G. Fragkiadakis, E. Z. Tragos, and I. G. Askoxylakis, “A survey on security threats and detection techniques in cognitive radio networks,” _IEEE Communications Surveys Tutorials_ , vol. 15, no. 1, pp. 428–445, First 2013.
  * [5] R. K. Sharma and D. B. Rawat, “Advances on security threats and countermeasures for cognitive radio networks: A survey,” _IEEE Communications Surveys Tutorials_ , vol. 17, Secondquarter 2015.
  * [6] Y. Zou, J. Zhu, X. Wang, and L. Hanzo, “A survey on wireless security: Technical challenges, recent advances, and future trends,” _Proceedings of the IEEE_ , vol. 104, no. 9, pp. 1727–1765, Sep. 2016.
  * [7] _Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications_ , IEEE Computer Society : LAN/MAN Standards Committee. [Online]. Available: http://standards.ieee.org/getieee802/download/802.11-2007.pdf
  * [8] S. Sesia, I. Toufik, and M. Baker, _LTE, The UMTS Long Term Evolution: From Theory to Practice_. Wiley Publishing, 2009.
  * [9] F. Huo and G. Gong, “A new efficient physical layer ofdm encryption scheme,” in _IEEE INFOCOM 2014-IEEE Conference on Computer Communications_. IEEE, 2014, pp. 1024–1032.
  * [10] R. Melki, H. N. Noura, M. M. Mansour, and A. Chehab, “An efficient ofdm-based encryption scheme using a dynamic key approach,” _IEEE Internet of Things Journal_ , vol. 6, no. 1, pp. 361–378, 2018.
  * [11] H. M. Furqan, J. M. Hamamreh, and H. Arslan, “Enhancing physical layer security of ofdm systems using channel shortening,” in _2017 IEEE 28th Annual International Symposium on Personal, Indoor, and Mobile Radio Communications (PIMRC)_. IEEE, 2017, pp. 1–5.
  * [12] H. Qin, Y. Sun, T.-H. Chang, X. Chen, C.-Y. Chi, M. Zhao, and J. Wang, “Power allocation and time-domain artificial noise design for wiretap ofdm with discrete inputs,” _Wireless Communications, IEEE Transactions on_ , vol. 12, 02 2013.
  * [13] E. Güvenkaya and H. Arslan, “Secure communication in frequency selective channels with fade-avoiding subchannel usage,” in _Communications Workshops (ICC), 2014 IEEE International Conference on_. IEEE, 2014, pp. 813–818.
  * [14] J. M. Hamamreh, H. M. Furqan, and H. Arslan, “Secure pre-coding and post-coding for ofdm systems along with hardware implementation,” in _2017 13th International Wireless Communications and Mobile Computing Conference (IWCMC)_. IEEE, 2017, pp. 1338–1343.
  * [15] J. M. Hamamreh, E. Basar, and H. Arslan, “Ofdm-subcarrier index selection for enhancing security and reliability of 5g urllc services,” _IEEE Access_ , vol. 5, pp. 25 863–25 875, 2017.
  * [16] J. Zhang, A. Marshall, R. Woods, and T. Q. Duong, “Design of an ofdm physical layer encryption scheme,” _IEEE Transactions on Vehicular Technology_ , vol. 66, no. 3, pp. 2114–2127, 2016.
  * [17] A. Dutta, D. Saha, D. Grunwald, and D. Sicker, “Secret agent radio: Covert communication through dirty constellations,” in _Information Hiding_ , M. Kirchner and D. Ghosal, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013, pp. 160–175.
  * [18] S. Shafiee and S. Ulukus, “Achievable rates in gaussian miso channels with secrecy constraints.” in _ISIT_ , 2007, pp. 2466–2470.
  * [19] Z. Rezki and M.-S. Alouini, “On the finite-snr diversity-multiplexing tradeoff of zero-forcing transmit scheme under secrecy constraint,” in _2011 IEEE International Conference on Communications Workshops (ICC)_. IEEE, 2011, pp. 1–5.
  * [20] A. Mukherjee and A. L. Swindlehurst, “Robust beamforming for security in mimo wiretap channels with imperfect csi,” _IEEE Transactions on Signal Processing_ , vol. 59, no. 1, pp. 351–361, 2010.
  * [21] S. Weinstein and P. Ebert, “Data transmission by frequency-division multiplexing using the discrete fourier transform,” _IEEE transactions on Communication Technology_ , vol. 19, no. 5, pp. 628–634, 1971.
  * [22] C. Suh, C.-S. Hwang, and H. Choi, “Comparative study of time-domain and frequency-domain channel estimation in mimo-ofdm systems,” in _14th IEEE Proceedings on Personal, Indoor and Mobile Radio Communications, 2003. PIMRC 2003._ , vol. 2. IEEE, 2003, pp. 1095–1099.
  * [23] L. Xiao, L. Greenstein, N. Mandayam, and W. Trappe, “Fingerprints in the ether: Using the physical layer for wireless authentication,” in _2007 IEEE International Conference on Communications_. IEEE, 2007, pp. 4646–4651.
  * [24] ——, “Using the physical layer for wireless authentication in time-variant channels,” _arXiv preprint arXiv:0907.4919_ , 2009.
  * [25] L. Kaufman and P. Rousseeuw, _Clustering by Means of Medoids_ , ser. Delft University of Technology : reports of the Faculty of Technical Mathematics and Informatics. Faculty of Mathematics and Informatics, 1987. [Online]. Available: https://books.google.com/books?id=HK-4GwAACAAJ
  * [26] C. E. Shannon, “Communication theory of secrecy systems,” _Bell system technical journal_ , vol. 28, no. 4, pp. 656–715, 1949.
  * [27] Ettus, _X310_ , available at https://files.ettus.com/manual/page_usrp_x3x0.html.