open002021ell.10001

0000-0002-7386-6396

af1]Electrical Engineering Department, Eindhoven University of Technology,
Eindhoven, The Netherlands af2]Mathematics and Computer Science Department,
Eindhoven University of Technology, Eindhoven, The Netherlands

<EMAIL_ADDRESS>
# Implementation of Entropically Secure Encryption: Securing Personal Health
Data

Mehmet Hüseyin Temel  Boris Škorić  Idelfonso Tafur Monroy  [  [

(DD MMMM YYYY; DD MMMM YYYY)

###### Abstract

Entropically Secure Encryption (ESE) offers unconditional security with
shorter keys compared to the One-Time Pad. In this paper, we present the first
implementation of ESE for bulk encryption. The main computational bottleneck
for bulk ESE is a multiplication in a very large finite field. This involves
multiplication of polynomials followed by modular reduction. We have
implemented polynomial multiplication based on the gf2x library, with some
modifications that avoid inputs of vastly different length, thus improving
speed. Additionally, we have implemented a recently proposed efficient
reduction algorithm that works for any polynomial degree. We investigate two
use cases: X-ray images of patients and human genome data. We conduct entropy
estimation using compression methods whose results determine the key lengths
required for ESE. We report running times for all steps of the encryption. We
discuss the potential of ESE to be used in conjunction with Quantum Key
Distribution (QKD), in order to achieve full information-theoretic security of
QKD-protected links for these use cases.

##  1 Introduction

Practical encryption schemes rely on computational hardness assumptions,
making them potentially susceptible to advances in cryptanalysis. The One-Time
Pad (OTP) encryption scheme [1] provides unconditional security, not depending
on any assumptions; however, the size of the key needs to equal at least the
entropy of the message, making OTP-ing impractical. OTP encryption works by
XOR-ing the key and the message. OTP provides perfect security, which means
that the ciphertext leaks no information about the message.

###  1.1 Entropically Secure Encryption

If one does not aim for perfect security, it is possible to achieve
unconditional security with shorter keys. The only additional condition is to
guarantee a lower bound on the entropy of the message from the point of view
of the attacker. This concept is called entropic security and the encryption
scheme is called entropically secure encryption (ESE) [2, 3] . If the
plaintext has at least $t$ collision entropy, then it can be encrypted using a
key with a length $\ell$ of

$\ell=n-t+2\log{\textstyle\frac{1}{\varepsilon}}$ (1)

where $n$ is the message length and $\varepsilon$ is the security parameter
[3, 4]. This implies that a message whose collision entropy is close to its
length (i.e. almost uniformly distributed) requires only a short key for
unconditional security. The collision entropy of a random variable with
probability mass function $(p_{x})_{x\in{\mathcal{X}}}$ is defined as
$-\log_{2}(\sum_{x\in{\mathcal{X}}}p_{x}^{2})$.

In ESE, a short key is expanded to a long pseudorandom string which is then
used as the key for OTP. The key expansion is accomplished through Galois
Field (GF) multiplication of a public random string and the key. Although ESE
has been well studied, there is no implementation for encrypting bulk data,
possibly because of the following reasons. (1) Entropy estimation of the
plaintext. If the data is not generated according to a known probability
distribution, it is impossible to compute the entropy precisely. A way must be
found to lower bound the entropy, which is not always straightforward. (2)
Typical implementations of GF multiplication work with data sizes that are
much smaller than in bulk ESE.

##  2 Entropically Secure Encryption and QKD

QKD has the unique property that it generates unconditionally secure keys.
However, the practical implementation of QKD often involves the subsequent use
of computationally secure encryption methods such as AES to secure transmitted
data [5]. Herein lies an opportunity for further security improvement through
the integration of ESE with QKD: if the QKD system produces key bits at a rate
that is compatible with the key consumption of the ESE (which depends on the
type of data and the transmission rate of the bulk channel) then full
information-theoretic security of the communication channel can be achieved.
As the entropy condition for ESE is tricky, it is prudent to apply a layer of
computationally secure encryption as well.

##  3 Key Expansion

Key expansion consists of two steps: (1) binary polynomial multiplication of
the public string X and the key $k$; followed by (2) modular reduction of the
result with an irreducible polynomial.

###  3.1 Binary Polynomial Multiplication

Our goal is to achieve bulk encryption with relatively short keys.
Consequently, the multiplication algorithm must be suitable for highly
unbalanced multiplication scenarios, where a lengthy public string—possibly
megabytes or gigabytes—is multiplied by a much shorter key.

A number of software libraries is capable of handling operands larger than one
MB. Chen et al. [6] presented the Add-FFT algorithm, which takes two inputs of
equal length up to $2^{36}$ bits. At the time of this research, Add-FFT is the
fastest library for balanced (equal length) multiplication beyond $2^{17}$
bits. The gf2x library [7], one of the most common for GF operations, accepts
arbitrary input lengths. Other libraries exist for multiplication of binary
polynomials, but they cannot handle the lengths with which we want to work.

We benchmarked Add-FFT and gf2x for unbalanced input sizes. (An example is
shown in Table 1). For Add-FFT we applied zero-padding of the short string in
order to get equal lengths. Our setup was a laptop with an Intel Core i7-9750H
2.60GHZ processor and 16GB RAM. For many different operand sizes we observe
that gf2x is much faster than Add-FFT when the operands are unbalanced. Hence
we selected gf2x for further experiments (see Table 2). We observe a sharp
increase at key length $2^{10}$. Due to this artefact the running times are
clearly too long for applications with a high data rate. A new multiplication
implementation becomes essential for achieving more efficient encryption.

Table 1: Execution times (in seconds) of the binary polynomial multiplication for fixed key length $2^{7}$ bits and varying message length (in bits). Length of X | $2^{22}$ | $2^{24}$ | $2^{26}$ | $2^{28}$ | $2^{30}$ | $2^{32}$
---|---|---|---|---|---|---
Add-FFT | 0.02 | 0.08 | 0.47 | 2.60 | 9.67 | 40.77
gf2x | 0.0005 | 0.002 | 0.003 | 0.01 | 0.05 | 0.20
Table 2: Execution times of gf2x binary polynomial multiplication at fixed message length $2^{30}$ bits and varying key length (in bits).  Length of k | $2^{7}$ | $2^{8}$ | $2^{9}$ | $2^{10}$ | $2^{11}$ | $2^{12}$ | $2^{13}$
---|---|---|---|---|---|---|---
time (s) | 0.05 | 0.10 | 0.23 | 5.31 | 5.28 | 5.27 | 5.34

####  3.1.1 Simplemult

In an attempt to remove the artefact, we developed a method simplemult that
performs the multiplication piecewise using blocks that have the size of the
key. Let the key be represented as the polynomial $q(x)$. Let the random seed
be $p(x)=\sum_{i=0}^{N-1}p_{i}(x)x^{i(1+\deg q)}$ where $N=\frac{1+\deg
p}{1+\deg q}$ and the polynomials $p_{i}$ are of degree $\deg(q)$. The
multiplication is computed as

$p(x)\;q(x)=\sum_{i=0}^{N-1}p_{i}(x)q(x)\,x^{i(1+\deg q)}.$ (2)

We use gf2x for the multiplication $p_{i}(x)q(x)$. We have benchmarked
simplemult against gf2x, see Table 3. We also implemented a multithread
version t_simplemult and executed it with 12 threads.

Table 3: Execution times (in seconds) of the binary polynomial multiplication for fixed message length $2^{30}$ bits and varying key length (in bits). Length of k |  $2^{7}$ |  $2^{8}$ |  $2^{9}$ |  $2^{10}$ |  $2^{11}$ |  $2^{12}$ |  $2^{13}$
---|---|---|---|---|---|---|---
gf2x |  0.05 |  0.10 |  0.23 |  5.31 |  5.28 |  5.27 |  5.34
simplemult |  0.12 |  0.08 |  0.07 |  0.14 |  0.19 |  0.28 |  0.40
t_simplemult |  0.08 |  0.07 |  0.07 |  0.07 |  0.07 |  0.07 |  0.09

Table 3 demonstrates a significant superiority of our algorithm over gf2x when
the key length is greater than $2^{7}$. This improvement reaches more than
36-fold when the key length is $2^{10}$. When the key is smaller than $2^{8}$,
our algorithm is slower because of overhead. Additionally, multithreading
gives a further speedup. This indicates that there is potential for further
optimisation on different platforms and with different multithreading options.
We note that gf2x itself cannot be sped up by multithreading since gf2x is a
sequential process.

We have done further benchmarks at fixed key length $2^{14}$ and varying
message length (Table 4). Again, our method is significantly faster than gf2x,
and multithreading is improving performance.

###  3.2 Reduction

The second step of the key expansion is modulo reduction of the multiplication
result with an irreducible polynomial. The choice of this polynomial is
specific to the message length. Lists of irreducible polynomials are available
up to degree around $2^{14}$ [8]. Furthermore, some cryptographic primitives
provide irreducible polynomials of very specific degrees [9]. However, we need
a broad range of degrees. We have implemented a class of irreducible
polynomials and the reduction algorithm proposed by Banegas et al. [10]. The
polynomials have flexible degree, and the reduction algorithm is efficient.
Table 4 lists running times of our implementation redBCP.

Table 4: Execution times (in seconds) of the binary polynomial multiplication and reduction algorithms for fixed key length $2^{14}$ bits and varying message length (in bits). Length of X | $2^{22}$ | $2^{24}$ | $2^{26}$ | $2^{28}$ | $2^{30}$ |  $2^{32}$
---|---|---|---|---|---|---
| Multiplication Algorithms
gf2x | 0.01 | 0.06 | 0.29 | 1.34 | 5.17 |  44.3
simplemult | 0.002 | 0.009 | 0.04 | 0.15 | 0.58 |  2.30
t_simplemult | 0.001 | 0.004 | 0.008 | 0.03 | 0.12 |  0.47
| Reduction Algorithms
redBCP | 0.03 | 0.12 | 0.48 | 1.94 | 8.32 |  34.87
t_redBCP | 0.01 | 0.02 | 0.06 | 0.23 | 0.91 |  3.89

Our reduction takes longer than the polynomial multiplication, even though in
theory it is an easier task. The reason is that our implementation redBCP is
not in any way optimised. We were aiming only for a functional implementation
of [10]. We expect that code optimisation will yield running times below
simplemult. Note that 12-thread multithreading (t_redBCP) leads to a
significant speedup, up to a factor 9.

##  4 Entropy Estimation

From (1) it is clear that the key length depends on the characteristics of the
plaintext, in particular a lower bound $t$ on the collision entropy. On the
encryption side, such a lower bound has to be available. In practical
scenarios the plaintext is not generated from a known fixed distribution, and
the entropy cannot be computed exactly.

It is well known that on average, a piece of data cannot be compressed below
its Shannon entropy [11]. We take the approach of compressing data and then
using the compressed size as an estimate for the collision entropy. It must be
noted that collision entropy is smaller than Shannon entropy unless the
distribution is entirely uniform; hence we obtain an overestimate even if we
get the Shannon entropy correct. Nonetheless, due to lack of other methods we
explore this approach. We consider only lossless compression, since lossy
compression destroys information, which would make our task more difficult.

We looked at two use cases and gathered real-world data for these cases. We
benchmarked various compression methods suitable for the selected data and
based our entropy estimates on the methods yielding the best compression. Then
we used (1) to estimate the required key length in a particular way: (i) The
value of $t$ follows from the above described approach of finding the best
compression; (ii) The value of $n$ is determined by the standard way in which
the data is communicated in the use case. For instance, this can be a non-
optimally compressed form dictated by a standard. Then the key length is
essentially the size of the badly compressed file minus the size of the
optimally compressed file.

In the first scenario, we focused on chest X-ray images from the MIMIC-IV
dataset [12, 13], a widely used dataset. For the second use case, we used a
human genome dataset of the study PRJEB36890 [14] from the 1000 Genome Project
[15]. The dataset comprises human DNA sequencing information, with an average
size of 130 GB, aligning with our aim to do bulk encryption. We selected these
datasets because they contain a type of personal data that is highly
sensitive.

####  4.0.1 X-Ray Image Use Case

The X-Ray image files are in DCM format, a standard for medical images that
includes patient information [16]. DCM files follow the DICOM (Digital Imaging
and Communications in Medicine) format. For our analysis, we utilized a sample
of 881 files from the dataset, 10.7 GB, with an average file size of
approximately 12.5 MB. We benchmarked various compression methods. We present
the compression ratios of the top 6 (Table 5). BZip2 and LZMA2 are universal
methods with generic applications, while the other four methods are versions
of general methods implemented in the GDCM [17] application following the
DICOM format.

Table 5: Compression ratios for X-ray images. Ratio: compressed size/uncompressed size. Method | BZIP2 | LZMA2 | RLE | JPEG | J2K | JPEG-LS
---|---|---|---|---|---|---
Ratio | 0.37 | 0.43 | 0.56 | 0.44 | 0.40 | 0.40

Based on the findings from Table 5, we choose BZIP2’s compression results for
our entropy estimation. On the other hand, DICOM mandates one of the standard
methods; since JPEG-LS is the best-performing standard method we use JPEG-LS
compressed files as the data that needs to be encrypted. The average JPEG-LS-
compressed file size is 5 MB, while the average estimated Shannon entropy for
a file is approximately 4.62 MB. The resulting key length (1) for ESE-
encrypting a JPEG-LS-compressed X-ray file is around 0.38 MB. Compared to OTP
encryption, which needs a 5 MB key, that is a reduction of 93%.

####  4.0.2 Human DNA Use Case

We used a sample of approximately 8 TB from the 1000 Genome Project dataset,
comprising 61 files with an average size of 132.12 GB. In Table 6 we present
the four best methods. The first three are well known general methods. Spring
[18] is a tool specifically developed for processing and compressing genome
files. With Spring, the average compressed file size is around 6.49 GB. It is
worth noting that some DNA compression methods claim to provide better ratios,
but since they are lossy [19], we do not consider them our analysis. We select
the Spring compression results as our entropy estimation.

Table 6: Compression ratios for genome files. Ratio: compressed size/uncompressed size. Method | BZIP2 | LZMA2 | PPMD | SPRING
---|---|---|---|---
Ratio | 0.083 | 0.075 | 0.063 | 0.049

If Spring-compression were ideal, yielding a completely uniform output, then
the ESE key length would be $2\log\frac{1}{\varepsilon}$, which is tiny
compared to the file size. However, it is too optimistic to assume that Spring
produces ideal compression. We want to quantify the gap between the compressed
size and the entropy. Unfortunately there is no obvious way to achieve this.
We present a heuristic method to estimate the gap. We notice that not all
files are compressed at the same ratio; we observe a standard deviation of
around 0.006 in the compression ratio. Handwavingly we postulate that optimal
compression occurs at the average ratio minus one standard deviation, i.e.
$0.049-0.006=0.043$. For an average file size of 132.12 GB this yields an
entropy of 5.68 GB and a compressed size of 6.47 GB. The resulting gap, and
hence key length, is around 800 MB. That is not a large relative reduction
compared to the compressed file size of 6.47 GB. Note however that our
heuristic argument could be too pessimistic; it assumes that all genome files
have the same information density, which may be false.

##  5 Complete Implementation

We have implemented the entire ESE scheme by integrating our multiplication
algorithm simplemult, the t_redBCP reduction, and the final XOR operation of
the message and the expanded key. We ran experiments on two setups: (i) a
personal laptop with Intel Core i7-9750H 2.60GHz(6 cores) with 16GB RAM and
(ii) a server with Intel Xeon Silver 4214R 2.40GHz (48 cores) with 376 GB RAM.
We set $\varepsilon=2^{-128}$, which gives $2\log\frac{1}{\varepsilon}=256$.
(Given the overall key sizes, the choice of $\varepsilon$ has a negligible
effect.) We present execution times in Tables 7, 8 and 9.

In our experiment with X-ray images, files are encrypted as a whole because
this is feasible for the average compressed file size of 5MB.

In the genome use case, the average compressed file size is around 6.49 GB
which makes it difficult to encrypt an entire file at one time. Therefore, we
divided the files into smaller chunks and encrypted them separately. This
increases the key length by 256 bits for every additional chunk due to the
$2\log\frac{1}{\varepsilon}$ term in (1), which applies to each individual
encryption .

Table 7: Average execution time (in seconds) of the sub-processes in the encryption of one X-ray image file. The encryption rate and key consumption rates are in MB/s. |  Mult. |  Red. | XOR | Enc. Rate | Key Cons.
---|---|---|---|---|---
Laptop | 0.22 | 0.05 | 0.0010 | 18.79 | 1.42
Server | 0.22 | 0.03 | 0.0005 | 19.83 | 1.50

In our first experiment with genome files (Table 8), we assume that
compression is optimal, yielding a key length 256 bits per chunk. This leads
to very small key consumption compared to the file size.

Table 8: Average execution times (in seconds) of the sub-processes of the ESE scheme for one genome file with various chunk sizes (MB) when the key length is 256 bits per chunk. The encryption rate is in MB/s and key consumption is in bits/s. Chunk Size | Mult. | Red. | XOR | Enc. Rate | Key Cons.
---|---|---|---|---|---
| Laptop
256 | 16.99 | 68.52 | 1.50 | 76.37 | 79.44
512 | 17.20 | 71.79 | 2.07 | 72.97 | 39.36
1024 | 21.84 | 74.93 | 2.53 | 66.92 | 18.05
| Server
256 | 15.67 | 48.43 | 1.39 | 101.47 | 106
512 | 15.76 | 48.46 | 1.50 | 101.12 | 55
1024 | 15.85 | 49.47 | 1.67 | 99.20 | 27
2048 | 16.13 | 50.45 | 1.89 | 97.06 | 15
4096 | 17.16 | 52.48 | 2.46 | 92.16 | 7

In the second experiment (Table 9), we assume that the entropy ratio in a
genome file is 0.043, which is lower than the compression ratio 0.049. This
yields a key length (per chunk) given by $\approx\frac{\rm
chunksize}{0.049}(0.049-0.043)$.

Table 9: Average execution times (in seconds) of sub-processes of the ESE scheme on the server for one genome file with various chunk sizes (MB) assuming entropy ratio 0.043. Key length (MB) is per chunk. Encryption and key consumption rates are in MB/s. Chunk Size |  Key Length | Mult. | Red. | XOR |  Enc. Rate |  Key Cons.
---|---|---|---|---|---|---
256 |  31.34 | 798 | 50.33 | 1.39 |  7.82 |  0.94
512 |  62.70 | 627 | 51.74 | 1.50 |  9.77 |  1.18
1024 |  125.39 | 792 | 55.12 | 1.67 |  7.82 |  0.94
2048 |  250.78 | 1322 | 53.92 | 1.89 |  4.82 |  0.58

While in Table 8 the encryption rate decreases with increasing chunk size, in
Table 9, the encryption rate reaches its peak with a chunk size of 512 MB.
This is due to the trade-off between the lengths of the operands and the
number of chunks in simplemult. Thus for the genome use case, the optimal
chunk size to be encrypted is around 512 MB.

##  6 Conclusion

We have implemented all stages of Entropically Secure Encryption and studied
execution times for two use cases. The computational bottleneck is the
polynomial multiplication. We see room for improvement by better use of
parallelization. Furthermore, the implementation of the reduction can be
significantly improved.

In the X-ray images use case, we get file encryption in around 0.3 seconds,
with a key consumption rate of 1.5 MB/s. In the DNA use case with a heuristic
entropy estimate, which may be highly pessimistic, we get optimal performance
when we independently encrypt chunks of 512 MB, with a key consumption rate
around 1 MB/s. With an optimistic estimate of the compression efficiency we
get much smaller keys, leading to increased encryption speed and key
consumption of less than 100 bits/s.

For the use of ESE in conjunction with QKD, the key generation rate of QKD
must exceed the speed at which key material is used up, which is dictated by
the data rate of the communication channel and the ESE key size associated
with the data type. For simplicity, we consider the case that compressed files
need to be sent at 10 MB/s which is a reasonable rate for a hospital [20] . In
the X-ray use case, this implies that there is 0.5s available to encrypt a
compressed file, which is feasible on a laptop. Furthermore, it leads to a key
consumption of 0.6 MB/s. In the genome use case with pessimistic assumptions
(Table 9) and 512MB chunk size, the encryption rate struggles to match the
data rate, and the key consumption is 1.2 MB/s.

Whether the key consumption matches the QKD key generation rate depends on the
use case, the deployed QKD technology and the QKD distance. Current QKD
implementations achieve key rates up to approximately 14 MB/s over distances
of about 10 km [21, 22] and 0.4 MB/s at around 100 km [23]. At distances up to
roughly 50 km this is certainly compatible with the key consumption in both
our use cases, even under pessimistic assumptions. Beyond that range, it is
certainly compatible with the genome use case under mildly optimistic
assumptions on the quality of the compression.

In conclusion, even an un-optimised implementation of Entropically Secure
Encryption shows that ESE should be practical in the two studied use cases,
and that integration with QKD is feasible given the matching key rates. As
topics for future work we highlight further optimization of the finite-field
multiplication, studying more use cases, and improved entropy estimates.

Part of this work was supported by the Dutch Startimpuls NAQT CAT-2 and NGF
Quantum Delta NL CAT-2

## References

  * [1] authorVernam, G.S.: titleSecret signaling system.  noteUS Patent 1310719 (year1918)
  * [2] authorRussell, A., authorWang, H.: titleHow to fool an unbounded adversary with a short key.  In: booktitleInternational conference on the theory and applications of cryptographic techniques, pp. pages133–148. organizationSpringer (year2002)
  * [3] authorDodis, Y., authorSmith, A.: titleEntropic security and the encryption of high entropy messages.  In: booktitleTheory of Cryptography Conference, pp. pages556–577. organizationSpringer (year2005)
  * [4] authorTemel, M.H., authorŠkorić, B.: titleEntropically secure encryption with faster key expansion.  journalQuantum Information Processing volume23(number4), pages1–19 (year2024)
  * [5] authorAlléaume, R., et al.: titleQuantum key distribution and cryptography: a survey (year2010)
  * [6] authorChen, M.S., et al.: titleFaster multiplication for long binary polynomials.  journalarXiv preprint arXiv:1708.09746 (year2017)
  * [7] authorBrent, R.P., et al.: titleFaster multiplication in GF(2)[x].  In: booktitleAlgorithmic Number Theory: 8th International Symposium, ANTS-VIII Banff, Canada, May 17-22, 2008 Proceedings 8, pp. pages153–166. organizationSpringer (year2008)
  * [8] authorSeroussi, G.: titleTable of low-weight binary irreducible polynomials. Hewlett-Packard Laboratories (year1998)
  * [9] authorRijmen, V., authorDaemen, J.: titleAdvanced encryption standard volume19, pages22 (year2001)
  * [10] authorBanegas, G., authorCustódio, R., authorPanario, D.: titleA new class of irreducible pentanomials for polynomial-based multipliers in binary fields.  journalJournal of Cryptographic Engineering volume9(number4), pages359–373 (year2019)
  * [11] authorCover, T.M., authorThomas, J.A.: titleElements of information theory.  John Wiley & Sons (year1999)
  * [12] authorJohnson, A., et al.: titleMimic-iv.  journalPhysioNet. Available online at: https://physionet. org/content/mimiciv/1.0/(accessed August 23, 2023) pp. pages49–55. (year2023)
  * [13] authorGoldberger, A.L., et al.: titlePhysioBank, PhysioToolkit, and PhysioNet: components of a new research resource for complex physiologic signals.  journalcirculation volume101(number23), pagese215–e220 (year2000)
  * [14] titleEna Nucleotide Archive.  https://www.ebi.ac.uk/ena/browser/view/PRJEB36890
  * [15] authorGibbs, R.A., et al.: titleA global reference for human genetic variation.  journalNature volume526(number7571), pages68–74 (year2015)
  * [16] titleNEMA DICOM STANDARD.  https://www.dicomstandard.org
  * [17] https://sourceforge.net/projects/gdcm/ (year2023)
  * [18] authorChandak, S., et al.: titleSPRING: a next-generation compressor for FASTQ data.  journalBioinformatics volume35(number15), pages2674–2676 (year2019)
  * [19] authorHernaez, M., et al.: titleGenomic data compression.  journalAnnual Review of Biomedical Data Science volume2, pages19–37 (year2019)
  * [20] authorFCC-Federal Communications Commission: titleHealth care Broadband in America.  note[Online; accessed 26-March-2024].  howpublishedhttps://transition.fcc.gov/national-broadband-plan/health-care-broadband-in-america-paper.pdf (year2010)
  * [21] authorLi, W., et al.: titleHigh-rate quantum key distribution exceeding 110 mb $s^{-1}$.  journalNature Photonics volume17(number5), pages416–421 (year2023)
  * [22] authorBacco, D., et al.: titleBoosting the secret key rate in a shared quantum and classical fibre communication system.  journalCommunications Physics volume2(number1), pages140 (year2019)
  * [23] authorGrünenfelder, F., et al.: titleFast single-photon detectors and real-time key distillation enable high secret-key-rate quantum key distribution systems.  journalNature Photonics volume17(number5), pages422–426 (year2023)


# Spectral Efficiency Optimization for
Hybrid Relay-Reflecting Intelligent Surface

Nhan Thanh Nguyen1, Quang-Doanh Vu2, Kyungchun Lee3, and Markku Juntti1
(E-mail<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>The research has been supported in part by Academy of
Finland under 6Genesis Flagship (grant 318927) and EERA Project (grant
332362). Corresponding author: N. T. Nguyen (email: nhan.nguyen@oulu.fi).
1Centre for Wireless Communications, University of Oulu, P.O.Box 4500,
FI-90014, Finland  2The Mobile Networks, Nokia, 90650 Oulu, Finland  3Dept. of
Electrical and Information Engineering, Seoul National University of Science
and Technology, Seoul, South Korea

###### Abstract

We propose a novel concept of hybrid relay-reflecting intelligent surface (HR-
RIS), in which a single or few elements are deployed with power amplifiers
(PAs) to serve as active relays, while the remaining elements only reflect the
incident signals. The design and optimization of the HR-RIS is formulated in a
spectral efficiency (SE) maximization problem, which is efficiently solved by
the alternating optimization (AO) method. The simulation results show that a
significant improvement in the SE can be attained by the proposed HR-RIS, even
with a limited power budget, with respect to the conventional reconfigurable
intelligent surface (RIS). In particular, the favorable design and deployment
of the HR-RIS are analytically derived and numerically justified.

###### Index Terms:

Hybrid relay-reflecting intelligent surface (HR-RIS), Reconfigurable
intelligent surface (RIS), MIMO

##  I Introduction

A new technology called _reconfigurable intelligent surface_ (RIS) has
recently emerged as a promising solution to significantly enhance the
performance of wireless communication systems [1]. RIS is often assumed to be
designed as a planar meta-surface or realized as a planar array of numerous
_passive reflecting elements_ , which are connected to a controller, allowing
modifying the phases of the incident signals independently in real-time.

The initial studies on RIS in the literature mainly focus on the performance
and design aspects of the RIS-assisted communication systems. Specifically, in
[2], the asymptotic achievable rate in a RIS-assisted downlink system is
analyzed, and a passive beamformer is proposed to increase the achievable
system sum-rate. The gain of RIS is further investigated in [3] and [4] for
multiple-input-single-output (MISO) downlink channels operated at sub-6 GHz
and mmWave frequencies, respectively. It is shown that the RIS of $N$ elements
can achieve a total beamforming gain of $N^{2}$ [3] and allows the received
signal power to increase quadratically with $N$ [4]. Moreover, the achievable
data rate of communication systems assisted by a practical RIS with limited
phase shifts and hardware impairments are characterized in [5, 6].

Another important line of studies on RIS focuses on the capacity/data rate
maximization of various RIS-assisted communication systems [7]. Specifically,
in [8], the problem of maximizing the achievable rate of a RIS-enhanced
single-input-single-output (SISO) orthogonal frequency division multiplexing
(OFDM) system is solved by jointly optimizing the transmit power allocation
and the RIS passive array reflection coefficients. By contrast, the MISO
systems are considered in [9, 10, 11, 12]. While [9, 10] focus on the joint
transmit and passive beamforming problem of RISs with continuous phase shifts
to attain substantially increased capacity/data rate, Han _et. al_ in [11]
consider the discrete phase shifts and justify that only two-bit quantizer is
sufficient to guarantee a high capacity, which agrees with the finding in
[12]. Unlike the aforementioned works, the studies in [13, 14, 15] considered
RIS-aided MIMO systems. Specifically, Zhang _et. al_ in [13] develop an
efficient alternating optimization (AO) method to find the locally optimal
phase shifts of the RIS, providing a significant improvement in the channel
total power, rank, condition number, and capacity. Furthermore, Perović _et.
al_ in [14] propose the projected gradient method (PGM), which can achieve the
same achievable rate as the AO scheme, but with a lower computational
complexity. In both [13, 14], the perfect channel state information (CSI) is
assumed. In contrast, only partial CSI is required in the investigation in
[15].

A main limitation of the RIS compared to the relays is the fact that the
reflection limits the degrees of freedom in the beamforming. Both Björnson
_et. al_ [16] and Wu _et. al_ [3] show that a very large RIS is needed to
outperform decode-and-forward (DF) relaying; otherwise, it can be easily
outperformed even by a half-duplex (HD) relay with few elements. Furthermore,
as the RIS becomes sufficiently large, the performance improvement is not
significant if the number of elements in the RIS increases. This implies that
if a few passive elements of the RIS are replaced by active ones, the
reduction in the passive beamforming gain is just marginal, while the gain
from active relaying can be significant. Furthermore, the introduction of
active elements with RF chains and baseband signal processing facilitates
efficient channel estimation, as proposed in [17, 18]. The aforementioned
aspects motivate a new architecture of the intelligent meta-surface, allowing
it to leverage the benefits of both the RIS and relay, as the HR-RIS proposed
in this paper.

The major contributions of the paper are summarized as follows: We propose the
novel HR-RIS architecture, which enables a hybrid active-passive beamforming
scheme rather than fully-passive beamforming of the conventional RIS. In
particular, HR-RIS exploits the benefits of relaying while mitigating the
limitation of passive reflecting. The design and optimization of the HR-RIS is
formulated in the SE maximization problem, whose solution is efficiently
solved by the AO method. Our analytical results show that this proposed HR-RIS
requires activating only a single or few elements of the RIS to serve as
active relays to attain remarkable SE improvement. The findings are
numerically justified by simulations. The results provide further insights on
the fundamental trade-off between RIS and relaying.

##  II HR-RIS Architecture, System model and SE Problem formulation

###  II-A Proposed HR-RIS Beamforming Architecture

The HR-RIS is equipped with $N$ elements, including $M$ passive reflecting and
$K$ active relay elements $(M+K=N)$. Here, the passive elements can only shift
the phase while the active ones can tune both the phase and amplitude of the
incident signal. It is noted that an active element would consume more power
for processing compared to the passive one due to the operation of the RF
chain. Thus, for practical deployment, we are interested in the case that
$1\leq K\ll M$. Furthermore, we consider the case that the number and
positions of the active elements are predefined and fixed in manufacture. The
extension to optimize a HR-RIS with dynamic active elements will be considered
in our future work.

Let us denote by $\mathbb{A}$, $\mathbb{A}\subset\\{1,2,\ldots,N\\}$, the set
of the positions of the $K$ active elements. Let $\alpha_{n}$ denote the
relay/reflection-coefficient used at the $n$th element,

$\displaystyle\alpha_{n}=\begin{cases}\left|\alpha_{n}\right|e^{j\theta_{n}},&\text{if
}n\in\mathbb{A}\\\ e^{j\theta_{n}},&\text{otherwise}\end{cases},$ (1)

where $\theta_{n}\in[0,2\pi)$ represent the phase shift. We note that
$\left|\alpha_{n}\right|=1$ for $n\notin\mathbb{A}$. We also define three
diagonal matrices based on $\\{\alpha_{n}\\}$ as
$\boldsymbol{\Upsilon}=\text{diag}\\{\alpha_{1},\ldots,\alpha_{N}\\}$,
$\boldsymbol{\Phi}=\text{diag}\\{\phi_{1},\ldots,\phi_{N}\\}$, and
$\boldsymbol{\Psi}=\text{diag}\\{\psi_{1},\ldots,\psi_{N}\\}$ where

$\displaystyle\phi_{n}=\begin{cases}0,&\text{if }n\in\mathbb{A}\\\
\alpha_{n},&\text{otherwise}\end{cases},\text{and
}\psi_{n}=\begin{cases}\alpha_{n},&\text{if }n\in\mathbb{A}\\\
0,&\text{otherwise}\end{cases}.$

In words, $\boldsymbol{\Phi}$ and $\boldsymbol{\Psi}$ contain only the passive
reflecting and active relaying coefficients, respectively, while
$\boldsymbol{\Upsilon}$ contains the coefficient of all elements of HR-RIS.
Clearly, $\boldsymbol{\Upsilon}=\boldsymbol{\Phi}+\boldsymbol{\Psi}$.

###  II-B System Model

Fig. 1: Illustration of the HR-RIS-aided communication system.

We consider downlink transmission where the base station (BS) and mobile
station (MS) are equipped with $N_{t}$ and $N_{r}$ antennas, respectively,
with $N_{t},N_{r}\geq 1$. The communications is aided by the HR-RIS, as
illustrated in Fig. 1. Specifically, the signals reflected more than once on
the HR-RIS are assumed to be of negligible power due to the severe pathloss,
and, thus, can be ignored [19]. In this work, to focus on the optimization of
the semi-passive beamforming at the HR-RIS and to simplify the system model
and algorithm design, we assume that the signals propagated on the direct link
from the BS to the MS are blocked by obstacles (e.g., buildings, trees) [20,
21]. Furthermore, we assume the uniform power allocation at the BS.
Specifically, let $\textbf{{x}}\in\mathbb{C}^{N_{t}\times 1}$ be the
transmitted signal vector. Then, we have
$\mathbb{E}\left\\{\textbf{{x}}\textbf{{x}}^{H}\right\\}=P_{\mathrm{BS}}\textbf{{I}}_{N_{t}}$,
where $P_{\mathrm{BS}}$ is the transmit power at the BS. The signals received
by the MS can be given as

y
$\displaystyle=\textbf{{H}}_{r}\boldsymbol{\Phi}\textbf{{H}}_{t}\textbf{{x}}+\textbf{{H}}_{r}\boldsymbol{\Psi}\textbf{{H}}_{t}\textbf{{x}}+\textbf{{H}}_{r}\boldsymbol{\Psi}\textbf{{n}}_{\mathrm{H}}+\textbf{{n}}_{\mathrm{MS}}$
$\displaystyle=\left(\textbf{{H}}_{r}\boldsymbol{\Phi}\textbf{{H}}_{t}+\textbf{{H}}_{r}\boldsymbol{\Psi}\textbf{{H}}_{t}\right)\textbf{{x}}+\textbf{{n}}$
$\displaystyle=\textbf{{H}}_{r}\boldsymbol{\Upsilon}\textbf{{H}}_{t}\textbf{{x}}+\textbf{{n}},$
(2)

where $\textbf{{H}}_{t}\in\mathbb{C}^{N\times N_{t}}$ and
$\textbf{{H}}_{r}\in\mathbb{C}^{N_{r}\times N}$ represents the channels from
the BS to the HR-RIS and that from the HR-RIS to the MS, respectively.
Furthermore,
$\textbf{{n}}_{\mathrm{H}}\sim\mathcal{CN}(0,\sigma_{\mathrm{H}}^{2}\textbf{{I}}_{K})$
and
$\textbf{{n}}_{\mathrm{MS}}\sim\mathcal{CN}(0,\sigma_{\mathrm{MS}}^{2}\textbf{{I}}_{N_{r}})$
are the complex additive white Gaussian noise (AWGN) vectors caused by the $K$
active relay elements at the HR-RIS and $N_{r}$ receive antennas at the MS,
respectively, with $\sigma_{\mathrm{H}}^{2}$ and $\sigma_{\mathrm{MS}}^{2}$
being the corresponding average noise variances, and
$\textbf{{n}}=\textbf{{H}}_{r}\boldsymbol{\Psi}\textbf{{n}}_{\mathrm{H}}+\textbf{{n}}_{\mathrm{MS}}$
represents the total effective noise vector at the MS. For simplicity, we
assume the same noise power spectrum density and noise figure at the HR-RIS
and the MS, yielding
$\sigma_{\mathrm{H}}^{2}=\sigma_{\mathrm{MS}}^{2}\triangleq\sigma^{2}$ and
$\textbf{{n}}\sim\mathcal{CN}\left(0,\sigma^{2}\left(\textbf{{I}}_{N_{r}}+\textbf{{H}}_{r}\boldsymbol{\Psi}\boldsymbol{\Psi}^{H}\textbf{{H}}_{r}^{H}\right)\right)$.

###  II-C Problem Formulation

In this work, the HR-RIS is designed and optimized in terms of SE. Based on
(2), the SE can be expressed as

$\displaystyle
f_{0}(\\{\alpha_{n}\\})=\log_{2}\left|\textbf{{I}}_{N_{r}}+\rho\textbf{{H}}_{r}\boldsymbol{\Upsilon}\textbf{{H}}_{t}\textbf{{H}}_{t}^{H}\boldsymbol{\Upsilon}^{H}\textbf{{H}}_{r}^{H}\textbf{{R}}^{-1}\right|,$

where $\left|\cdot\right|$ denotes the determinant of a matrix or the absolute
value of a scalar.
$\textbf{{R}}=\textbf{{I}}_{N_{r}}+\textbf{{H}}_{r}\boldsymbol{\Psi}\boldsymbol{\Psi}^{H}\textbf{{H}}_{r}^{H}\in\mathbb{C}^{N_{r}\times
N_{r}}$ is the aggregate noise covariance matrix, and
$\rho=\frac{P_{\mathrm{BS}}}{\sigma^{2}}$. The transmit power of the active
elements of the HR-RIS is

$\displaystyle P_{\mathrm{a}}$
$\displaystyle\triangleq\mathrm{trace}\left(\boldsymbol{\Psi}\left(\textbf{{H}}_{t}\mathbb{E}\left\\{\textbf{{x}}\textbf{{x}}^{H}\right\\}\textbf{{H}}_{t}^{H}+\sigma^{2}\textbf{{I}}_{N}\right)\boldsymbol{\Psi}^{H}\right)$
$\displaystyle=\mathrm{trace}\left(\boldsymbol{\Psi}\left(P_{\mathrm{BS}}\textbf{{H}}_{t}\textbf{{H}}_{t}^{H}+\sigma^{2}\textbf{{I}}_{N}\right)\boldsymbol{\Psi}^{H}\right).$
(3)

The problem of designing coefficients of the HR-RIS for maximizing spectral
efficiency can be formulated as

$\displaystyle(\mathrm{P0})\quad\max_{\\{\alpha_{n}\\}}\quad$ $\displaystyle
f_{0}(\\{\alpha_{n}\\})$ (4a) s.t.
$\displaystyle\left|\alpha_{n}\right|=1\text{ for }n\notin\mathbb{A}$ (4b)
$\displaystyle P_{\mathrm{a}}\leq P_{\mathrm{a}}^{\textrm{max}}$ (4c)

where $P_{\mathrm{a}}^{\textrm{max}}$ is the power budget of the active
elements. Function $f_{0}(\\{\alpha_{n}\\})$ is nonconvex with respects to
$\\{\alpha_{n}\\}$. In addition, the feasible set of $(\mathrm{P0})$ is
nonconvex due to the unit-modulus constraint (4b). Consequently, problem
$(\mathrm{P0})$ is intractable, and it is difficult to find an optimal
solution. In the following section, we develop an efficient solution to
$(\mathrm{P0})$.

##  III Optimization of the HR-RIS

To make $(\mathrm{P0})$ tractable, we consider the upper bound of its
objective function. Specifically, we have

$\displaystyle f_{0}(\\{\alpha_{n}\\})$
$\displaystyle=\log_{2}\left|\textbf{{I}}_{N_{r}}+\rho\textbf{{H}}_{r}\boldsymbol{\Upsilon}\textbf{{H}}_{t}\textbf{{H}}_{t}^{H}\boldsymbol{\Upsilon}^{H}\textbf{{H}}_{t}^{H}\textbf{{R}}^{-1}\right|$
(5)
$\displaystyle=\log_{2}\left|\textbf{{R}}+\rho\textbf{{H}}_{r}\boldsymbol{\Upsilon}\textbf{{H}}_{t}\textbf{{H}}_{t}^{H}\boldsymbol{\Upsilon}^{H}\textbf{{H}}_{t}^{H}\right|-\log_{2}\left|\textbf{{R}}\right|$
(6) $\displaystyle\leq f(\\{\alpha_{n}\\}),$ (7)

where in (7),
$f(\\{\alpha_{n}\\})\triangleq\log_{2}|\textbf{{I}}_{N_{r}}+\textbf{{H}}_{r}\boldsymbol{\Psi}\boldsymbol{\Psi}^{H}\textbf{{H}}_{r}^{H}+\rho\textbf{{H}}_{r}\boldsymbol{\Upsilon}\textbf{{H}}_{t}\textbf{{H}}_{t}^{H}\boldsymbol{\Upsilon}^{H}\textbf{{H}}_{t}^{H}|$
is obtained by substituting the expression of R to the first term in (6). The
equality occurs when $\mathbb{A}=\emptyset$. We note that
$\log_{2}\left|\textbf{{R}}\right|=\log_{2}\left|\textbf{{I}}_{N}+\boldsymbol{\Psi}^{H}\textbf{{H}}_{r}^{H}\textbf{{H}}_{r}\boldsymbol{\Psi}\right|$
is negligible. The reason is that the path loss is large, and
$\boldsymbol{\Psi}$ is very sparse because HR-RISs are equipped with small
numbers of active elements (i.e., small $K$) to ensure a low hardware cost and
power consumption for active processing. Thus, $f(\\{\alpha_{n}\\})$ is a
tight upper bound of $f_{0}(\\{\alpha_{n}\\})$. Therefore, we consider in the
sequel the problem of maximizing $f(\\{\alpha_{n}\\})$:

$\displaystyle\left(\mathrm{P}\right)\quad\max_{\\{\alpha_{n}\\}}\quad
f(\\{\alpha_{n}\\}),\quad\textrm{s.t.}\quad\eqref{opt_hyb_con_unit_modul},\eqref{opt_hyb_con_relay_power}.$

Let $\textbf{{r}}_{n}\in\mathbb{C}^{N_{r}\times 1}$ be the $n$th column of
$\textbf{{H}}_{r}$, and let $\textbf{{t}}_{n}^{H}\in\mathbb{C}^{1\times
N_{t}}$ be the $n$th row of $\textbf{{H}}_{t}$. Then, we have
$\textbf{{H}}_{r}=[\textbf{{r}}_{1},\ldots,\textbf{{r}}_{N}]$ and
$\textbf{{H}}_{t}=[\textbf{{t}}_{1},\ldots,\textbf{{t}}_{N}]^{H}$. Because of
the diagonal structure of $\boldsymbol{\Upsilon}$ and $\boldsymbol{\Psi}$, we
have
$\textbf{{H}}_{r}\boldsymbol{\Upsilon}\textbf{{H}}_{t}=\sum_{n=1}^{N}\alpha_{n}\textbf{{r}}_{n}\textbf{{t}}_{n}^{H}$
and
$\textbf{{H}}_{r}\boldsymbol{\Psi}=\sum_{n\in\mathbb{A}}\alpha_{n}\textbf{{r}}_{n}$,
which leads to

$\displaystyle\textbf{{I}}_{N_{r}}+(\textbf{{H}}_{r}\boldsymbol{\Psi})(\textbf{{H}}_{r}\boldsymbol{\Psi})^{H}+\rho(\textbf{{H}}_{r}\boldsymbol{\Upsilon}\textbf{{H}}_{t})(\textbf{{H}}_{r}\boldsymbol{\Upsilon}\textbf{{H}}_{t})^{H}$
$\displaystyle=\textbf{{A}}_{n}+\left|\alpha_{n}\right|^{2}\textbf{{B}}_{n}+\alpha_{n}\textbf{{C}}_{n}+\alpha_{n}^{*}\textbf{{C}}_{n}^{H},$
(8)

where $\textbf{{A}}_{n}$, $\textbf{{B}}_{n}$, and $\textbf{{C}}_{n}$ are
defined as follows:

$\displaystyle\textbf{{A}}_{n}$
$\displaystyle\triangleq\textbf{{I}}_{N_{r}}+\left(\sum_{i\in\mathbb{A},i\neq
n}\alpha_{i}\textbf{{r}}_{i}\right)\left(\sum_{i\in\mathbb{A},i\neq
n}\alpha_{i}^{*}\textbf{{r}}_{i}^{H}\right)$ $\displaystyle\hskip
28.45274pt+\rho\left(\sum_{i=1,i\neq
n}^{N}\alpha_{i}\textbf{{r}}_{i}\textbf{{t}}_{i}^{H}\right)\left(\sum_{i=1,i\neq
n}^{N}\alpha_{i}^{*}\textbf{{t}}_{i}\textbf{{r}}_{i}^{H}\right),$ (9)
$\displaystyle\textbf{{B}}_{n}$
$\displaystyle\triangleq\textbf{{r}}_{n}\textbf{{r}}_{n}^{H}+\rho\textbf{{r}}_{n}\textbf{{t}}_{n}^{H}\textbf{{t}}_{n}\textbf{{r}}_{n}^{H},$
(10) $\displaystyle\textbf{{C}}_{n}$
$\displaystyle\triangleq\textbf{{r}}_{n}\left(\sum_{i\in\mathbb{A},i\neq
n}\alpha_{i}^{*}\textbf{{r}}_{i}^{H}\right)+\rho\textbf{{r}}_{n}\textbf{{t}}_{n}^{H}\left(\sum_{i=1,i\neq
n}^{N}\alpha_{i}^{*}\textbf{{t}}_{i}\textbf{{r}}_{i}^{H}\right)$ (11)

for $n\in\mathbb{A}$, and

$\displaystyle\textbf{{A}}_{n}$
$\displaystyle\triangleq\textbf{{I}}_{N_{r}}+\rho\left(\sum_{i=1,i\neq
n}^{N}\alpha_{i}\textbf{{r}}_{i}\textbf{{t}}_{i}^{H}\right)\left(\sum_{i=1,i\neq
n}^{N}\alpha_{i}^{*}\textbf{{t}}_{i}\textbf{{r}}_{i}^{H}\right),$ (12)
$\displaystyle\textbf{{B}}_{n}$
$\displaystyle\triangleq\rho\textbf{{r}}_{n}\textbf{{t}}_{n}^{H}\textbf{{t}}_{n}\textbf{{r}}_{n}^{H},$
(13) $\displaystyle\textbf{{C}}_{n}$
$\displaystyle\triangleq\rho\textbf{{r}}_{n}\textbf{{t}}_{n}^{H}\left(\sum_{i=1,i\neq
n}^{N}\alpha_{i}^{*}\textbf{{t}}_{i}\textbf{{r}}_{i}^{H}\right)$ (14)

for $n\notin\mathbb{A}$. From (8), the objective function of
$\left(\mathrm{P}\right)$ can be rewritten in the form

$\displaystyle
f(\alpha_{n})\triangleq\log_{2}\left|\textbf{{A}}_{n}+\left|\alpha_{n}\right|^{2}\textbf{{B}}_{n}+\alpha_{n}\textbf{{C}}_{n}+\alpha_{n}^{*}\textbf{{C}}_{n}^{H}\right|,$
(15)

where matrices $\textbf{{A}}_{n},\textbf{{B}}_{n},$ and $\textbf{{C}}_{n}$ are
all independent of one particular $\alpha_{n}$, although they depend on other
coefficients $\alpha_{i},i\neq n$. It is observed that the new objective
function $f(\alpha_{n})$ of $\left(\mathrm{P}\right)$ is in an explicit form
of _an individual reflecting/relaying coefficient_ $\alpha_{n},n=1,\ldots,N$.
This motivates an AO method [13] to solve $\left(\mathrm{P}\right)$ by
optimizing each values of $\alpha_{n},n=1,\ldots,N$111We note that the
coefficients $\\{\alpha_{n}\\}$ can also be obtained by employing the PGM
scheme [14]. However, we adopt the AO method because it can provide closed-
form solutions to $\\{\alpha_{n}\\}$, which facilitates the optimal structure
design of the HR-RIS.. Furthermore, because of the diagonal structure of
$\boldsymbol{\Psi}$, we have
$\mathrm{trace}\left(\boldsymbol{\Psi}\boldsymbol{\Psi}^{H}\right)=\sum_{n\in\mathbb{A}}\left|\alpha_{n}\right|^{2}$
and
$\mathrm{trace}\left(\boldsymbol{\Psi}\textbf{{H}}_{t}\textbf{{H}}_{t}^{H}\boldsymbol{\Psi}^{H}\right)=\sum_{n\in\mathbb{A}}\left|\alpha_{n}\right|^{2}\left\lVert\textbf{{t}}_{n}\right\rVert^{2}$.
Therefore, after some manipulations, $P_{\mathrm{a}}$ in (3) can be further
expanded as

$\displaystyle
P_{\mathrm{a}}=\sum_{n\in\mathbb{A}}\left|\alpha_{n}\right|^{2}\xi_{n},$ (16)

where
$\xi_{n}\triangleq\sigma^{2}+P_{\mathrm{BS}}\left\lVert\textbf{{t}}_{n}\right\rVert^{2}$.
From (15) and (16), $\alpha_{n}$ is the solution to the problem

$\displaystyle\left(\mathrm{Pn}\right)\quad\max_{\alpha_{n}}\quad$
$\displaystyle f(\alpha_{n})$ (17a) s.t.
$\displaystyle\left|\alpha_{n}\right|=1,n\notin\mathbb{A}$ (17b)
$\displaystyle\left|\alpha_{n}\right|^{2}\leq\frac{P_{\mathrm{a}}^{\mathrm{max}}-\tilde{P_{\mathrm{a}}}}{\xi_{n}},n\in\mathbb{A}.$
(17c)

where $\tilde{P_{\mathrm{a}}}\triangleq\sum_{i\in\mathbb{A},i\neq
n}\left|\alpha_{i}\right|^{2}\xi_{i}$ represents the total power allocated to
the other active elements, which is a constant because
$\\{\alpha_{i}\\}_{i\in\mathbb{A},i\neq n}$ are fixed in the considered AO
method. This optimization problem can be further simplified by noting that
$\textbf{{A}}_{n}$ is a full rank matrix
$(\textrm{rank}(\textbf{{A}}_{n})=N_{r})$ and invertible based on its
definition. Therefore, $f(\alpha_{n})$ can be expressed as

$\displaystyle
f(\alpha_{n})=\log_{2}\left|\textbf{{A}}_{n}\right|+g(\alpha_{n}),$ (18)

where
$g(\alpha_{n})\triangleq\log_{2}|\textbf{{I}}_{N_{r}}+\left|\alpha_{n}\right|^{2}\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}+\alpha_{n}\textbf{{A}}_{n}^{-1}\textbf{{C}}_{n}+\alpha_{n}^{*}\textbf{{A}}_{n}^{-1}\textbf{{C}}_{n}^{H}|$.
Because $\log_{2}\left|\textbf{{A}}_{n}\right|$ is independent of
$\alpha_{n}$, the problem in (17a) is equivalent to
$\max_{\alpha_{n}}g(\alpha_{n}),\textrm{s.t.}\eqref{opt_f_con_passive},\eqref{opt_f_con_active}$.
Therefore, we focus on investigating $g(\alpha_{n})$ in the sequel.

Let
$\textbf{{D}}_{n}=\textbf{{I}}_{N_{r}}+\left|\alpha_{n}\right|^{2}\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}$.
Then, we have

$\displaystyle g(\alpha_{n})$
$\displaystyle=\log_{2}\left|\textbf{{D}}_{n}+\alpha_{n}\textbf{{A}}_{n}^{-1}\textbf{{C}}_{n}+\alpha_{n}^{*}\textbf{{A}}_{n}^{-1}\textbf{{C}}_{n}^{H}\right|$
$\displaystyle=\log_{2}\left|\textbf{{D}}_{n}\right|+h(\alpha_{n}),$ (19)

where
$h(\alpha_{n})\triangleq\log_{2}\left|\textbf{{I}}_{N_{r}}+\alpha_{n}\textbf{{E}}_{n}^{-1}\textbf{{C}}_{n}+\alpha_{n}^{*}\textbf{{E}}_{n}^{-1}\textbf{{C}}_{n}^{H}\right|$
with $\textbf{{E}}_{n}\triangleq\textbf{{A}}_{n}\textbf{{D}}_{n}$. We at first
investigate the first term in (19), i.e.,
$\log_{2}\left|\textbf{{D}}_{n}\right|=\log_{2}\left|\textbf{{I}}_{N_{r}}+\left|\alpha_{n}\right|^{2}\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}\right|$.
We note that
$\mathrm{rank}(\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n})\leq\mathrm{rank}(\textbf{{B}}_{n})=1$.
Therefore, $\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}$ has rank of either zero or
one. Because $\mathrm{rank}(\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n})=0$ only
when $\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}=\textbf{0}$, we focus on the case
$\mathrm{rank}(\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n})=1$. Furthermore,
$\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}$ is non-diagonalizable if and only if
$\mathrm{trace}(\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n})=0$ [13], which rarely
happens in general. Therefore, we focus on the case that
$\mathrm{trace}(\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n})\neq 0$ and
$\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}$ is diagonalizable. As a result,
$\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}$ can be expressed as
$\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}=\textbf{{Q}}_{n}\boldsymbol{\Gamma}_{n}\textbf{{Q}}_{n}^{-1}$
based on the eigenvalue decomposition (EVD), with
$\textbf{{Q}}_{n}\in\mathbb{C}^{N_{r}\times N_{r}}$ and
$\boldsymbol{\Gamma}_{n}=\mathrm{diag}\left\\{\gamma_{n},0,\ldots,0\right\\}$.
Here, $\gamma_{n}$ is the sole non-zero eigenvalue of
$\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}$. Furthermore, because
$\textbf{{A}}_{n}$ and $\textbf{{B}}_{n}$ are both positive semi-definite,
$\gamma_{n}$ is non-negative and real, and we obtain

$\displaystyle\log_{2}\left|\textbf{{D}}_{n}\right|$
$\displaystyle=\log_{2}\left|\textbf{{I}}_{N_{r}}+\left|\alpha_{n}\right|^{2}\textbf{{Q}}_{n}\boldsymbol{\Gamma_{n}}\textbf{{Q}}_{n}^{-1}\right|$
$\displaystyle=\log_{2}\left(1+\left|\alpha_{n}\right|^{2}\gamma_{n}\right).$
(20)

Considering the second term in (19), i.e., $h(\alpha_{n})$, we also focus on
the case that $\textbf{{E}}_{n}^{-1}\textbf{{C}}_{n}$ is diagonalizable, which
allows it to be decomposed as
$\textbf{{E}}_{n}^{-1}\textbf{{C}}_{n}=\textbf{{U}}_{n}\boldsymbol{\Lambda}_{n}\textbf{{U}}_{n}^{-1}$
based on the EVD, with $\textbf{{U}}_{n}\in\mathbb{C}^{N_{r}\times N_{r}}$,
$\boldsymbol{\Lambda}_{n}=\mathrm{diag}\left\\{\lambda_{n},0,\ldots,0\right\\}$,
and $\lambda_{n}$ is the sole non-zero eigenvalue of
$\textbf{{E}}_{n}^{-1}\textbf{{C}}_{n}$. Furthermore, let
$\textbf{{V}}_{n}\triangleq\textbf{{U}}_{n}^{H}\textbf{{E}}_{n}\textbf{{U}}_{n}$,
$v_{n}$ be the first element of the first column of $\textbf{{V}}_{n}^{-1}$,
and $v_{n}^{\prime}$ be the first element of the first row of
$\textbf{{V}}_{n}$. Then, $h(\alpha_{n})$ can be expressed as [13]:

$\displaystyle
h(\alpha_{n})=\log_{2}\left(1+\left|\alpha_{n}\right|^{2}\left|\lambda_{n}\right|^{2}+2\mathfrak{R}{\left(\alpha_{n}\lambda_{n}\right)}-v_{n}^{\prime}v_{n}\left|\lambda_{n}\right|^{2}\right),$
(21)

where $\mathfrak{R}{\left(\cdot\right)}$ denotes the real part of a complex
number. The detailed derivation of (21) can be found in [13]. We note that,
compared to [13], the additional coefficient $\left|\alpha_{n}\right|^{2}$ is
due to the active relaying coefficient in the HR-RIS, which does not exist for
the conventional RIS [13].

From (18)–(21), we obtain

$\displaystyle
f(\alpha_{n})=\log_{2}\left|\textbf{{A}}_{n}\right|+\log_{2}\left(1+\left|\alpha_{n}\right|^{2}\gamma_{n}\right)$
$\displaystyle+\log_{2}\left(1+\left|\alpha_{n}\right|^{2}\left|\lambda_{n}\right|^{2}+2\mathfrak{R}{\left(\alpha_{n}\lambda_{n}\right)}-v_{n}^{\prime}v_{n}\left|\lambda_{n}\right|^{2}\right).$
(22)

It is observed from (22) that the phase of the optimal solution
$\alpha_{n}^{\star}$ to $\left(\mathrm{Pn}\right)$ is
$-\arg\\{\lambda_{n}\\}$, and $f(\alpha_{n})$ is a monotonically increasing
function of $\left|\alpha_{n}^{\star}\right|$. Therefore, the optimal value of
$\left|\alpha_{n}^{\star}\right|$ is given as
$\left|\alpha_{n}^{\star}\right|=\frac{P_{\mathrm{a}}^{\mathrm{max}}-\tilde{P_{\mathrm{a}}}}{\xi_{n}},\forall
n\in\mathbb{A}$ based on (17c). Hence, the optimal coefficients of the HR-RIS
is given by

$\displaystyle\alpha_{n}^{\star}=\begin{cases}\sqrt{\frac{P_{\mathrm{a}}^{\mathrm{max}}-\tilde{P_{\mathrm{a}}}}{\xi_{n}}}e^{-j\arg\\{\lambda_{n}\\}},&n\in\mathbb{A}\\\
e^{-j\arg\\{\lambda_{n}\\}}.&\text{otherwise}\end{cases},$ (23)

allowing $\boldsymbol{\Upsilon}^{\star}$ to be solved as in Algorithm 1.
Specifically, in step 1, the coefficient matrix $\boldsymbol{\Upsilon}$ is
initialized with random phases, and random power fractions are allocated to
the active elements. As a result, in steps 2–10, the coefficients of the HR-
RIS are updated based on (23) until the objective value is converged. Finally,
$\boldsymbol{\Upsilon}^{\star}$ is obtained in step 11. The monotonic
convergence of Algorithm 1 is guaranteed because the objective value of
$\left(\mathrm{Pn}\right)$ is non-decreasing over iterations [13].

###### Remark 1

The result in (23) suggests the favorable deployment of the HR-RIS.
Specifically, the power amplifier coefficient $\left|\alpha_{n}\right|$ of an
active element decreases with $\tilde{P_{\mathrm{a}}}$ and $\xi_{n}$.
Therefore, with a limited power budget $P_{\mathrm{a}}^{\mathrm{max}}$, the
HR-RIS with a small number of elements, i.e., small $K$, is easier to attain
SE gains than that with numerous active elements. Furthermore, with a fixed
$P_{\mathrm{a}}^{\mathrm{max}}$, a lower $P_{\mathrm{BS}}$ and/or smaller
channel gain $\left\lVert\textbf{{t}}_{n}\right\rVert^{2}$ from the BS, which
can be caused by a more severe pathloss, results in a higher power amplifier
coefficients $\left|\alpha_{n}^{\star}\right|$, and thus, more significant
performance improvement.

Algorithm 1 Find $\boldsymbol{\Upsilon}^{\star}$ for HR-RIS

0: $\textbf{{H}}_{t},\textbf{{H}}_{r},\mathbb{A}$.

0: $\boldsymbol{\Upsilon}^{\star}$.

1: Randomly generate $\\{\alpha_{n}\\}$ with $\left|\alpha_{n}\right|=1$ for
$n\notin\mathbb{A}$ and
$\sum_{n\in\mathbb{A}}\left|\alpha_{n}\right|^{2}\xi_{n}=P_{\mathrm{a}}^{\mathrm{max}}$
for $n\in\mathbb{A}$.

2: while not converge do

3: for $n=1\rightarrow N$ do

4: Compute $\textbf{{A}}_{n},\textbf{{B}}_{n}$, and $\textbf{{C}}_{n}$ based
on (9)-(14).

5:
$\textbf{{D}}_{n}=\textbf{{I}}_{N_{r}}+\left|\alpha_{n}\right|^{2}\textbf{{A}}_{n}^{-1}\textbf{{B}}_{n}$,
$\textbf{{E}}_{n}=\textbf{{A}}_{n}\textbf{{D}}_{n}$.

6: Find $\lambda_{n}$ as the sole non-zero eigenvalue of
$\textbf{{E}}_{n}^{-1}\textbf{{C}}_{n}$.

7: Compute $\alpha_{n}^{\star}$ based on (23).

8: end for

9: Check convergence.

10: end while

11:
$\boldsymbol{\Upsilon}^{\star}=\mathrm{diag}\left\\{\alpha_{1}^{\star},\ldots,\alpha_{N}^{\star}\right\\}$.

##  IV Simulation Results

Fig. 2: Horizontal locations of the BS, MS, and HR-RIS.

In this section, numerical results are provided to validate the proposed HR-
RIS scheme. We assume that in a two-dimensional coordinate, the BS, HR-RIS,
and MS are deployed at $(0,0)$, $(x_{\mathrm{H}},0)$, and
$(x_{\mathrm{MS}},y_{\mathrm{MS}})$, respectively, as illustrated in Fig. 2.
As a result, the distance between the BS and MS is $d_{t}=x_{\mathrm{H}}$, and
the corresponding path loss is given by
$\beta(d_{t})=\beta_{0}\left(\frac{d_{t}}{1\mathrm{m}}\right)^{\epsilon_{t}}$,
where $\beta_{0}=-30$ dB is assumed [3, 13], and $\epsilon_{t}$ is the path
loss exponent. The small scale-fading channel between the BS and the HR-RIS is
modeled by
$\tilde{\textbf{{H}}}_{t}=\left(\sqrt{\frac{\kappa_{t}}{1+\kappa_{t}}}\textbf{{H}}_{t}^{\mathrm{LoS}}+\sqrt{\frac{1}{1+\kappa_{t}}}\textbf{{H}}_{t}^{\mathrm{NLoS}}\right)$
following the Rician fading channel model [3, 13], where
$\textbf{{H}}_{t}^{\mathrm{LoS}}$ and $\textbf{{H}}_{t}^{\mathrm{NLoS}}$
represent the deterministic LoS and NLoS components, respectively. The channel
matrix between the BS and the HR-RIS, i.e., $\textbf{{H}}_{t}$, is obtained by
multiplying $\tilde{\textbf{{H}}}_{t}$ by the square root of the corresponding
path loss $\beta(d_{t})$, i.e.,
$\textbf{{H}}_{t}=\sqrt{\beta(d_{t})}\tilde{\textbf{{H}}}_{t}$. The channel
matrix between the HR-RIS and MS is modeled similarly. For the detailed
generation of $\textbf{{H}}_{t}^{\mathrm{LoS}}$ and
$\textbf{{H}}_{t}^{\mathrm{NLoS}}$, please refer to [3, 13].

In simulations, we set $\\{\epsilon_{t},\epsilon_{r}\\}=\\{2.2,2.8\\}$ and
$\\{\kappa_{t},\kappa_{r}\\}=\\{\infty,0\\}$ [3], where the subscripts
$(\cdot)_{t}$ and $(\cdot)_{r}$ imply the parameters associated with
$\textbf{{H}}_{t}$ and $\textbf{{H}}_{r}$, respectively. Furthermore,
$\sigma^{2}=-80$ dBm,
$\\{x_{\mathrm{MS}},y_{\mathrm{MS}},x_{\mathrm{H}}\\}=\\{40,2,51\\}$ m, and
two-bit resolution phase shifts of the RIS/HR-RIS are assumed unless otherwise
stated. For comparison, we consider the conventional RIS with $N$ fully
passive reflecting elements, whose phases are either randomly generated or
optimized using the AO method in [13].

Fig. 3: SEs of the proposed HR-RIS scheme compared to those of the
conventional RIS schemes for $N_{t}=32$, $N_{r}=2$, $N=50$. The other
parameters are set as follows: $K=4$ in Fig. 3(a); $P_{\mathrm{BS}}=30$ dBm in
Fig. 3(b); $K=4$, $P_{\mathrm{a}}^{\mathrm{max}}=0$ dBm, and
$P_{\mathrm{BS}}=30$ dBm in Fig. 3(c).

In Fig. 3(a), the SEs of a $32\times 2$ MIMO system with $N=50$, $K=4$,
$M=N-K=46$, and $P_{\mathrm{a}}^{\mathrm{max}}=\\{-10,0,10\\}$ dBm is shown.
It is observed that the RIS with random phases has poor performance compared
to the optimized RIS. By contrast, the HR-RIS scheme achieves significant
improvement in the SE with respect to the conventional RIS, especially at low
$P_{\mathrm{BS}}$, agreeing with Remark 1. The HR-RIS only requires a small
$P_{\mathrm{a}}^{\mathrm{max}}$ to achieves remarkable SE improvement at low
$P_{\mathrm{BS}}$, and with $P_{\mathrm{a}}^{\mathrm{max}}=\\{0,10\\}$ dBm,
sustainable SE gains of the HR-RIS are seen for the whole considered range of
$P_{\mathrm{BS}}$.

The SE improvements of the HR-RIS for various $K$ are shown in Fig. 3(b) with
$P_{\mathrm{a}}^{\mathrm{max}}=\\{-10,0,10\\}$ dBm and $P_{\mathrm{BS}}=30$
dBm. It is seen that deploying more active elements does not always guarantee
a higher SE. Specifically, increasing $K$ improves the SE for
$P_{\mathrm{a}}^{\mathrm{max}}=\\{0,10\\}$ dBm, which, however, degrades the
SE for $P_{\mathrm{a}}^{\mathrm{max}}=-10$ dBm. In general, a satisfying SE
performance gain with respect to the RIS can be attained even with small $K$,
or even with $K=1$.

In Fig. 3(c), we present the SEs of the HR-RIS for different geographical
deployment: the MS is at $\\{(40,2),(100,2)\\}$, while the HR-RIS/RIS is
located at $(0,x_{\mathrm{H}})$, where $x_{\mathrm{H}}\in[10,100]$ m.
Increasing $x_{\mathrm{H}}$, i.e., the RIS/HR-RIS moves far away from the BS,
causing more severe pathloss between the BS and HR-RIS, and hence, more
significant active beamforming gains are attained, as discussed in Remark 1.
It can be concluded from Fig. 3(c) that the proposed HR-RIS is robust over
geographical deployment.

##  V Conclusion

We proposed a novel HR-RIS to assist MIMO communication systems with
significantly improved SE compared to that assisted by the conventional RIS.
The HR-RIS is a semi-passive beamforming architecture, in which a few elements
are capable of adjusting the incident signals’ power. It has been designed and
optimized by the AO scheme. The analytical results suggest the favorable
design and deployment of the HR-RIS. Specifically, a small number of active
elements is sufficient for a satisfying SE gain with respect to the
conventional RIS. Furthermore, the HR-RIS can attain significant SE
improvement when the transmit power at the transmitter is small or moderate,
and the improvement is more significant when the distance between the
transmitter and the HR-RIS is large. Finally, intensive simulations have been
performed to numerically justify the findings. The results reveal that the HR-
RIS has the potential to outperform both the passive RIS and active AF
relaying in certain communications channels. Further investigation and
optimization of the proposed HR-RIS architecture in terms of energy efficiency
as well as the consideration of transmit beamforming at the BS can be
considered for future research.

## Acknowledgment

This work has been supported in part by Academy of Finland under 6Genesis
Flagship (grant 318927) and EERA Project (grant 332362).

## References

  * [1] M. D. Renzo, M. Debbah, D. T. P. Huy, A. Zappone, M. Alouini, C. Yuen, V. Sciancalepore, G. C. Alexandropoulos, J. Hoydis, H. Gacanin, J. de Rosny, A. Bounceur, G. Lerosey, and M. Fink, “Smart radio environments empowered by reconfigurable AI meta-surfaces: an idea whose time has come,” _EURASIP J. Wireless Comm. Network._ , vol. 2019, p. 129, 2019.
  * [2] M. Jung, W. Saad, M. Debbah, and C. S. Hong, “Asymptotic optimality of reconfigurable intelligent surfaces: Passive beamforming and achievable rate,” in _IEEE Int. Conf. Commun. (ICC)_ , 2020, pp. 1–6.
  * [3] Q. Wu and R. Zhang, “Intelligent reflecting surface enhanced wireless network via joint active and passive beamforming,” _IEEE Trans. Wireless Commun._ , vol. 18, no. 11, pp. 5394–5409, 2019.
  * [4] P. Wang, J. Fang, X. Yuan, Z. Chen, and H. Li, “Intelligent reflecting surface-assisted millimeter wave communications: Joint active and passive precoding design,” _IEEE Trans. Veh. Tech._ , 2020.
  * [5] H. Zhang, B. Di, L. Song, and Z. Han, “Reconfigurable intelligent surfaces assisted communications with limited phase shifts: How many phase shifts are enough?” _IEEE Trans. Veh. Tech._ , vol. 69, no. 4, pp. 4498–4502, 2020\.
  * [6] H. Guo, Y.-C. Liang, J. Chen, and E. G. Larsson, “Weighted Sum-Rate Maximization for Intelligent Reflecting Surface Enhanced Wireless Networks,” in _IEEE Global Commun. Conf. (GLOBECOM)_. IEEE, 2019, pp. 1–6.
  * [7] S. Gong, X. Lu, D. T. Hoang, D. Niyato, L. Shu, D. I. Kim, and Y.-C. Liang, “Towards smart wireless communications via intelligent reflecting surfaces: A contemporary survey,” _IEEE Commun. Surveys Tuts._ , 2020.
  * [8] Y. Yang, B. Zheng, S. Zhang, and R. Zhang, “Intelligent reflecting surface meets OFDM: Protocol design and rate maximization,” _IEEE Trans. Commun._ , 2020.
  * [9] Y. Yang, S. Zhang, and R. Zhang, “IRS-enhanced OFDM: Power allocation and passive array optimization,” in _IEEE Global Commun. Conf. (GLOBECOM)_ , 2019, pp. 1–6.
  * [10] J. Yuan, Y.-C. Liang, J. Joung, G. Feng, and E. G. Larsson, “Intelligent reflecting surface-assisted cognitive radio system,” _IEEE Trans. Commun._ , 2020.
  * [11] Y. Han, W. Tang, S. Jin, C.-K. Wen, and X. Ma, “Large intelligent surface-assisted wireless communication exploiting statistical CSI,” _IEEE Trans. Veh. Tech._ , vol. 68, no. 8, pp. 8238–8242, 2019.
  * [12] B. Di, H. Zhang, L. Li, L. Song, Y. Li, and Z. Han, “Practical Hybrid Beamforming With Finite-Resolution Phase Shifters for Reconfigurable Intelligent Surface Based Multi-User Communications,” _IEEE Trans. Veh. Tech._ , vol. 69, no. 4, pp. 4565–4570, 2020.
  * [13] S. Zhang and R. Zhang, “Capacity characterization for intelligent reflecting surface aided mimo communication,” _IEEE J. Sel. Areas Commun._ , vol. 38, no. 8, pp. 1823–1838, 2020.
  * [14] N. S. Perović, L.-N. Tran, M. Di Renzo, and M. F. Flanagan, “Achievable rate optimization for MIMO systems with reconfigurable intelligent surfaces,” _IEEE Trans. Wireless Commun._ , 2021.
  * [15] J. Xiong, L. You, Y. Huang, D. W. K. Ng, W. Wang, and X. Gao, “Reconfigurable intelligent surfaces assisted MIMO-MAC with partial CSI,” in _IEEE Int. Conf. Commun. (ICC)_ , 2020, pp. 1–6.
  * [16] E. Björnson, O. Özdogan, and E. G. Larsson, “Intelligent reflecting surface vs. decode-and-forward: How large surfaces are needed to beat relaying?” _IEEE Wireless Commun. Lett._ , pp. 1–1, 2019.
  * [17] A. Taha, M. Alrabeiah, and A. Alkhateeb, “Deep learning for large intelligent surfaces in millimeter wave and massive MIMO systems,” in _IEEE Global Commun. Conf. (GLOBECOM)_ , 2019, pp. 1–6.
  * [18] ——, “Enabling large intelligent surfaces with compressive sensing and deep learning,” _arXiv preprint arXiv:1904.10136_ , 2019.
  * [19] Y. Han, S. Zhang, L. Duan, and R. Zhang, “Cooperative Double-IRS Aided Communication: Beamforming Design and Power Scaling,” _IEEE Wireless Commun. Lett._ , 2020.
  * [20] C. Huang, A. Zappone, M. Debbah, and C. Yuen, “Achievable rate maximization by passive intelligent mirrors,” in _IEEE Int. Conf. Acoustics, Speech and Signal Process. (ICASSP)_ , 2018, pp. 3714–3718.
  * [21] C. Huang, R. Mo, and C. Yuen, “Reconfigurable intelligent surface assisted multiuser MISO systems exploiting deep reinforcement learning,” _IEEE J. Select. Areas in Commun._ , vol. 38, no. 8, pp. 1839–1850, Aug. 2020\.


|  Daniel Benatar is an MSc student in the SISE Department at BGU. His
research interests include machine learning and cyber-security. Contact him at
<EMAIL_ADDRESS>
---|---
|  Ron Bitton is a PhD candidate in the SISE Department at BGU. His research
interests include machine learning, cyber-security, and cyber-risk management.
Contact him at<EMAIL_ADDRESS>
---|---
|  Dan Avraham is an MSc student in the SISE Department at BGU. His research
interests include machine learning and cyber-security. Contact him at
<EMAIL_ADDRESS>
---|---
|  Asaf Shabtai is a professor in the SISE Department at BGU. His research
interests include computer and network security, and machine learning. Shabtai
received a PhD in information systems from BGU. Contact him at
<EMAIL_ADDRESS>
---|---

##  Appendix A Analysis of Traffic Predictability using an Additional Dataset
(UNSW) [76]

(a)

(b)

(c)

(d)

(e)

(f)

Figure 13: Traffic predictability analysis using UNSW data [76]: Comparison
between IoT and non-IoT devices (Fig. 13a and 13b), comparison among IoT
models (Fig. 13c and 13d), and correlation with IoT model complexity (Fig. 13e
and 13f). In this dataset, the IoT devices comprised of Nest Dropcam, Nest
Protect smoke alarm, and Insteon camera, while the non-IoT devices comprised
of Samsung Galaxy Tab, iPhone, a laptop, two Macbooks, and two Android phones.