# COPR: Consistency-Oriented Pre-Ranking for Online Advertising

Zhishan Zhao, Jingyue Gao  Alibaba GroupBeijingChina ,  Yu Zhang, Shuguang Han
Alibaba GroupBeijingChina ,  Siyuan Lou, Xiang-Rong Sheng  Alibaba
GroupBeijingChina ,  Zhe Wang, Han Zhu  Alibaba GroupBeijingChina ,  Yuning
Jiang, Jian Xu  Alibaba GroupBeijingChina and  Bo Zheng  Alibaba
GroupBeijingChina

(2023)

###### Abstract.

Cascading architecture has been widely adopted in large-scale advertising
systems to balance efficiency and effectiveness. In this architecture, the
pre-ranking model is expected to be a lightweight approximation of the ranking
model, which handles more candidates with strict latency requirements. Due to
the gap in model capacity, the pre-ranking and ranking models usually generate
inconsistent ranked results, thus hurting the overall system effectiveness.
The paradigm of score alignment is proposed to regularize their raw scores to
be consistent. However, it suffers from inevitable alignment errors and error
amplification by bids when applied in online advertising. To this end, we
introduce a consistency-oriented pre-ranking framework for online advertising,
which employs a chunk-based sampling module and a plug-and-play rank alignment
module to explicitly optimize consistency of ECPM-ranked results. A $\Delta
NDCG$-based weighting mechanism is adopted to better distinguish the
importance of inter-chunk samples in optimization. Both online and offline
experiments have validated the superiority of our framework. When deployed in
Taobao display advertising system, it achieves an improvement of up to +12.3%
CTR and +5.6% RPM.

pre-ranking, cascading architecture, consistency, online advertising

††copyright: acmcopyright††journalyear: 2023††doi: XXXXXXX.XXXXX††conference:
Make sure to enter the correct conference title from your rights confirmation
emai; June 03–05, 2023; Woodstock, NY††isbn: 978-1-4503-XXXX-X/18/06

##  1\. Introduction

Online advertising has become a major source of revenue for many web platforms
(Goldfarb and Tucker, 2011; Ma et al., 2022). Advertisers ensure effective
promotion of products by bidding and paying for user actions (e.g., click and
purchase)111Without loss of generality, we regard click as the action in this
paper on advertisements (i.e., ads). To maximize platform revenue, the
advertising system typically ranks ads based on their Expected Cost Per Mille
(ECPM) (Yuan et al., 2019) and selects top ones for impression:

(1) $ECPM=1000\times bid\times pCTR,$

where $bid$ is the price that the advertiser is willing to pay and $pCTR$ is
the predicted click-through rate (CTR) denoting the probability that the user
clicks the ad.

Under strict latency requirements in online deployment, it is infeasible for
complex CTR models (Zhou et al., 2018; Liu et al., 2020; Pi et al., 2020; Guo
et al., 2021) with high inference cost to handle millions of candidates in the
ad corpus. To balance efficiency and effectiveness, a common practice in
industrial systems is to adopt a cascading architecture (Covington et al.,
2016; Wang et al., 2020; Qin et al., 2022; Li et al., 2022a), which filters
ads through multiple phases with increasingly complex models as illustrated in
Fig. 1. Particularly, the retrieval model first retrieves tens of thousands of
relevant ads from the corpus. Afterwards, the pre-ranking model outputs pCTR
for retrieved candidates, where top hundreds with highest ECPM are sent to the
ranking model for final selection. To handle a larger candidate set, the pre-
ranking model is usually designed to be lightweight, which works more
efficiently but less accurately compared with the ranking model.

Figure 1. An illustration of the typical three-phase cascading architecture
for online advertising systems.

Pre-Ranking has recently received increasing attention due to its importance
in the cascading architecture. Huang et al. (Huang et al., 2013) propose a
two-tower model that maps users and candidates into latent vectors and
calculates their inner products. To enable high-order feature interactions, Li
et al. (Li et al., 2022a) add find-grained interactions between two towers and
Wang et al. (Wang et al., 2020) propose to use deep neural network with
squeeze-and-excitation block. Despite improvement of accuracy, there is still
a non-negligible gap between the pre-ranking and ranking models. They may
generate significantly different ranked results on the same candidate set.
Such inconsistency hinders the overall system effectiveness. For example, top
ads selected from the pre-ranking phase could be less competitive in the
ranking phase, causing waste of the computational resource. Also, ads which
are preferred in the ranking phase could be unfortunately discarded in the
pre-ranking phase, leading to sub-optimal results.

Some pioneering studies (Qin et al., 2022; Tang and Wang, 2018) propose to
align the pre-ranking and ranking models via distillation on pCTR scores. The
pre-ranking model is encouraged to generate same scores as the ranking model
(Qin et al., 2022) or generate high scores for top candidates selected by the
ranking model (Tang and Wang, 2018). Although exhibiting encouraging
performance, the paradigm of score alignment suffers from the following
issues, especially when applied to the advertising system:

  * •

Inevitable alignment errors. Due to simpler architecture and fewer parameters
for efficiency concerns, the capacity of the pre-ranking model is limited,
making it difficult to well approximate original scores of the complex ranking
model. Thus even with explicit optimization, there still exist errors in
aligning their scores to be exactly the same.

  * •

Error amplification in ECPM ranks222We use ECPM rank to denote the order of an
ad in the ECPM-ranked list.. In both pre-ranking and ranking phases, ads are
ranked according to their ECPM as Eq. (1), which is jointly determined by the
pCTR score and the bid. Thus the influence of alignment errors could be
amplified due to existence of bids. As shown in Table 1, when multiplied by
corresponding bids, even a tiny difference in pCTR scores of the pre-ranking
and ranking models leads to completely different ranked results.

Table 1. A toy example of error amplification in ECPM ranks. Though pCTR
scores of two phases are similar, their ranked results after considering bids
are different.

Candidates | Pre-Ranking | Ranking
---|---|---
bid | pCTR | ECPM | rank | bid | pCTR | ECPM | rank
A | 21 | 0.1 | 2.1 | 2 | 21 | 0.11 | 2.31 | 1
B | 11 | 0.2 | 2.2 | 1 | 11 | 0.19 | 2.09 | 2

Above issues call for rethinking the necessity of strictly aligning pCTR
scores in the advertising system. Essentially, given a set of candidates, it
is not their absolute pCTR scores but their relative ECPM ranks that determine
the results of each phase. Therefore, to achieve consistent results, the pre-
ranking model is not required to output same pCTR scores as the ranking model.
Instead, it only needs to output scores which yield same ECPM ranks when
multiplied by bids. In this way, the requirement of score alignment can be
relaxed to that of rank alignment, which is more easier to meet. Moreover,
when optimizing pCTR scores for consistent ECPM ranks, the influence of bids
can be taken into account beforehand, thus alleviating the issue of error
amplification.

To this end, we introduce a Consistency-Oriented Pre-Ranking (COPR) framework
for online advertising, which explicitly optimize the pre-ranking model
towards consistency with the ranking model. Particularly, we collect
historical logs of the ranking phase, where each log records a ECPM-ranked
list of candidates. COPR segments the list into fixed-sized chunks. Each chunk
is endowed with certain level of priority from the view of the ranking phase.
With pairs of ads sampled from different chunks, COPR learns an plug-and-play
rank alignment module which aims to consistently distinguish their priority
using scores at the pre-ranking phase. Moreover, we adopts a $\Delta
NDCG$-based weighting mechanism to better distinguish the importance of inter-
chunk pairs in optimization.

Our main contributions can be summarized as follows:

  * •

To the best of our knowledge, we are the first to explicitly optimize the pre-
ranking model towards consistency with the ranking model in the widely-used
cascading architecture for online advertising.

  * •

We propose a novel consistency-oriented pre-ranking framework named COPR,
which employs a chunk-based sampling module and a plug-and-play rank alignment
module for effective improvement of consistency.

  * •

We conduct extensive experiments on public and industrial datasets. Both
offline and online results validate that the proposed COPR framework
significantly outperforms state-of-the-art baselines. When deployed in Taobao
display advertising system, it achieves an improvement of up to +12.3% CTR and
+5.6% RPM.

##  2\. Related Work

In this section, we briefly review studies about pre-ranking.

Located in the middle of the cascading architecture, the pre-ranking system
has played an indispensable role for many large-scale industrial systems (Ma
et al., 2021; Wang et al., 2020). The development of a pre-ranking model is
mainly for balancing the system effectiveness and efficiency, as the
downstream ranking model usually cannot deal with tens of thousands of
candidates. To this end, techniques such as the dual-tower modeling (Huang et
al., 2013; Wu et al., 2018) are commonly adopted. However, this paradigm
limits feature interactions between users and items to the form of vector
product, which often results in extensive performance degradation.

Another line of work strives to enhance high-order feature interactions, and
explores the ways to reduce the online latency. Li et al. (Li et al., 2022a)
add fine-grained and early feature interactions between two towers. Wang et
al. (Wang et al., 2020) propose to use fully-connected layers and employ
various techniques from the perspectives of both modeling efficiency and
engineering optimization. Specifically, a Squeeze-and-Excitation module (Hu et
al., 2018) is utilized to choose the most useful feature set, and meanwhile
system parallelism and low-precision computation are exploited whenever
possible for latency optimization. Ma et al. (Ma et al., 2021) propose a
feature selection algorithm based on feature complexity and variational
dropout (FSCD) to search a set of effective and efficient features for pre-
ranking. A similar study (Li et al., 2022b) uses network architecture
searching (NAS) to determine the optimal set of features and corresponding
architectures. These studies mainly focus on improving the accuracy of the
pre-ranking model but neglects its interaction with the subsequent ranking
model, leading to inconsistent ranked results.

Figure 2. The framework of consistency-oriented pre-ranking.

Several studies propose to align the pre-ranking and ranking models in terms
of pCTR scores via knowledge distillation. RD (Tang and Wang, 2018) encourages
the lightweight student model to score higher for candidates selected by the
larger teacher model, which is often used in training pre-ranking models.
RankFlow (Qin et al., 2022) regularizes the pre-ranking and ranking models to
generate same scores for same candidates. Despite encouraging performance,
there still exist inevitable errors in score alignment due to discrepancy in
model capacity. When applied in online advertising, influence of such errors
would be amplified by bids of ads, yielding inconsistent ECPM-ranked results.
In this paper, we propose to relax the objective of score alignment to rank
alignment, where bids of ads are incorporated and consistency of ranked
results between two phases can be explicitly optimized in an effective manner.

##  3\. Methodology

In this section, we first introduce background knowledge about the pre-ranking
model, and then describe our proposed COPR framework as illustrated in Fig. 2.

###  3.1. Background

Training Data. When the advertising system serves online traffic as Fig. 1,
hundreds of ads are ranked through the ranking phase and recorded to logs,
which we refer to as ranking logs. Each log contains an ranked list of ads
with descending ECPM:

(2) $\mathbf{R}=[(ad_{1},pCTR_{1},bid_{1}),...,(ad_{M},pCTR_{M},bid_{M})],$

where $pCTR_{i}$ is the score output by the ranking model for $i$-th ad and
$bid_{i}$ denotes its bid. $M$ is the number of candidates. Then top $N$ ads
are displayed to the user. User feedback $y$ (click/non-click) on each
displayed ad is recorded to impression logs:

(3) $\mathbf{I}=[(ad_{1},y_{1}),...,(ad_{N},y_{N})].$

Base Model. The base model for pre-ranking is usually a lightweight CTR model.
Here we adopt the architecture of COLD (Wang et al., 2020). The input features
consist of three parts: user features $\mathbf{U}$ such as age and gender, ad
features $\mathbf{A}$ such as brand and category, context features
$\mathbf{C}$ such as time and device. After pre-selecting a concise set of
features, COLD feeds them into embedding layers and concatenate their
embeddings for a compact representation $\mathbf{x}$:

(4) $\mathbf{x}=E(\mathbf{U})\oplus E(\mathbf{A})\oplus E(\mathbf{C}).$

Then it employs a prediction net consists of multiple fully-connected layers
to estimate CTR:

(5) $\hat{y}=Sigmoid(MLP(\mathbf{x}))\in[0,1].$

To accurately predict user click $y$, the model is optimized with cross
entropy loss over impression logs $I$:

(6) $L_{ctr}=\sum_{\mathbf{I}}[-ylog(\hat{y})-(1-y)log(1-\hat{y})].$

###  3.2. Consistency-Oriented Pre-Ranking

Though the pre-ranking model is expected to well approximates the ranking
model in the cascading system, their gap in model capacity often hinders
satisfying approximation. Thus in addition to $L_{ctr}$, we aim to explicitly
optimize the pre-ranking model towards consistent results with the ranking
model over $\mathbf{R}$.

####  3.2.1. Chunk-Based Sampling

Figure 3. Illustration of chunk-based sampling.

Given candidates $\\{Ad_{i}\\}_{1}^{M}$ in ranking logs, an ideal pre-ranking
model should output scores that yield same ECPM-ranked list as Eq. (2).
Considering its limited capacity, it could be hard to rank hundreds of ad all
in correct positions. To reduce the learning difficulty, we partition the
ranked list into $D=\frac{M}{K}$ fixed-sized chunks, each constituting $K$
adjacent ads, as shown in Fig. 3. We regard ads in the same chunk as
candidates with same priority in the ranking phase. The pre-ranking model is
not required to distinguish ads in the same chunk. Instead, it only needs to
consistently rank candidates in the granularity of chunk. For each chunk, we
randomly sample a candidate and endow it with the priority related to this
chunk. In this way, for each ranked list, we obtain a concise sub-list:

(7)
$\mathbf{R}_{chunk}=[(ad_{s_{d}},pCTR_{s_{d}},bid_{s_{d}},D-d)]_{d=1}^{D},$

where $s_{d}$ is the index of sampled ad in chunk $d$ and $D-d$ denotes its
priority which the larger the better.

The above chunk-based sampling has two-fold advantages: 1) It provides a
flexible way to control the granularity of consistency, which makes the
objective reachable for the lightweight pre-ranking model. By increasing the
chunk size $K$, the objective of consistency gradually shifts from fine-
grained to coarse-grained. 2) It effectively reduces the size of ranked list
in logs by $K$ times and still maintains coverage of original lists, which is
critical for efficient training in industrial machine learning systems. In our
production implementation, $K$ is set to 10.

####  3.2.2. Rank Alignment

In the following, we introduce how to modify the base model with a plug-and-
play rank alignment module.

Instead of regularizing the difference between $\hat{y}_{i}$ in Eq. (5) and
$pCTR_{i}$ in Eq. (7) as score alignment methods (Qin et al., 2022; Tang and
Wang, 2018), we propose to relax the objective to rank alignment on a
properly-adjusted pCTR score. Particularly, we employ a relaxation net to
learn a factor $\alpha>0$, with which we adjust the original pCTR score:

(8) $\displaystyle\alpha$
$\displaystyle=ReLU(MLP(x))+1e^{-6}\in\mathcal{R^{+}},$
$\displaystyle\tilde{y}$ $\displaystyle=\alpha*\hat{y},$

where $\tilde{y}$ denote the adjusted pCTR. Thus ECPM at the pre-ranking phase
can be accordingly estimated as $\tilde{y}*bid$, based on which we aim to
correctly rank each inter-chunk pair in $\mathbf{R}_{chunk}$. Here we adopt
the pairwise logistic loss for its relatively good performance and the
simplicity for implementation (Burges et al., 2005; Pasumarthi et al., 2019):

(9)
$L_{rank}=\sum_{i<j}log[1+e^{-(\frac{\tilde{y}_{s_{i}}*bid_{s_{i}}}{\tilde{y}_{s_{j}}*bid_{s_{j}}}-1)}].$

For each pair of $ad_{s_{i}}$ and $ad_{s_{j}}$ sampled from different chunks
that $i<j$, we optimize $L_{rank}$ by encouraging
$\tilde{y}_{s_{i}}*bid_{s_{i}}>\tilde{y}_{s_{j}}*bid_{s_{j}}$, which means
$ad_{s_{i}}$ would be ranked before $ad_{s_{j}}$ by ECPM in the pre-ranking
phase. If all inter-chunk pairs can be correctly ranked, we achieve consistent
ECPM-ranked results between the pre-ranking and ranking phases over
$R_{chunk}$.

Note that by introducing the relaxation factor $\alpha$, we slightly modify
the original pCTR score to achieve consistent ranked results if necessary. To
maintain original value as much as possible, $\alpha$ should be around $1$.
Thus we add a symmetric regularization to penalize the deviation of $\alpha$
from 1:

(10) $L_{reg}=\begin{cases}\alpha-1&\alpha>1\\\
\frac{1}{\alpha}-1&\alpha<=1\end{cases}.$

It is worth mentioning that the proposed rank alignment module does not rely
on specific assumption about the architecture of base model. It is an plug-
and-play component that can be added to any pre-ranking models for improvement
of consistency.

####  3.2.3. $\Delta NDCG$-Based Pair Weighting

$L_{rank}$ in Eq. (9) fails to consider the relative importance of different
pairs in consistency optimization. In practice, consistently ranking ads from
chunk $1$ and chunk $10$ is more important than ranking chunk $11$ and chunk
$20$, since only the top ads will be sent to the ranking phase and displayed
to users. It calls for a weighting mechanism that considers chunk-related
priorities of candidates.

Intuitively, if pair $(ad_{s_{i}},ad_{s_{j}})$ in $L_{rank}$ are mistakenly
ranked, the consistency between the pre-ranking and ranking phase will be
hurt. Thus its weight in $L_{rank}$ should be determined by the negative
impact. As each sampled $ad_{s_{d}}$ in $\mathbf{R}_{chunk}$ is endowed with
priority $D-d$, we use NDCG (Järvelin and Kekäläinen, 2017; Burges, 2010) to
measure the utility of any ranked list $p$ of these candidates:

(11) $\displaystyle DCG$
$\displaystyle=\sum_{i=1}^{D}\frac{2^{p_{i}}-1}{log(i+1)},$ $\displaystyle
IDCG$ $\displaystyle=\sum_{i=1}^{D}\frac{2^{D-i}-1}{log(i+1)},$

where $p_{i}$ denote the priority of $i$-th ad in the permutation and the IDCG
is the ideal DCG achieved by $\mathbf{R}_{chunk}$. If we swap the position of
$ad_{s_{i}}$ and $ad_{s_{j}}$ in $\mathbf{R}_{chunk}$, the utility of the list
will experience a drop which can be further normalized as:

(12) $\Delta
NDCG(i,j)=\frac{2^{D-i}-2^{D-j}}{IDCG}[\frac{1}{log(i+1)}-\frac{1}{log(j+1)}].$

The utility drop is used to re-weight inter-chunk pairs in consistency
optimization:

(13) $L_{rank}=\sum_{i<j}\Delta
NDCG(i,j)log[1+e^{-(\tilde{y}_{s_{i}}*bid_{s_{i}}-\tilde{y}_{s_{j}}*bid_{s_{j}})}].$

Thus the objective function of COPR can be formulated as:

(14) $L=\underbrace{L_{ctr}}_{CTR\
Loss}+\underbrace{\lambda_{1}L_{rank}+\lambda_{2}L_{reg}}_{Consistency\
Loss},$

where $\lambda_{1}>0$, $\lambda_{2}>0$ are weights for corresponding loss
terms. By minimizing $L$, we explicitly optimize the pre-ranking model towards
consistency with the ranking model via a plug-and-play rank alignment module.

###  3.3. System Deployment

Figure 4. Overview of system pipeline.

We introduce the deployment of COPR in three stages: data generation, model
training, and online serving as shown in Fig. 4.

Data Generation. During online serving, hundreds of ads are ranked through
ranking model and recorded to ranking logs, with which we perform chunk-based
sampling. The content of each sample includes user index, ad index, chunk
index as well as the bid. Note that the bid at the ranking phase could differ
from that at the the pre-ranking phase (Wang et al., 2022). In this case, we
record the pre-ranking bid since it influences $L_{rank}$ in model training.
When ads are displayed to users in the client, we also record user feedback in
impression logs, which are used in calculating $L_{ctr}$.

Model Training. The training procedure is performed on our ODL (Online Deep
Learning) (Luo et al., 2020) platform, which consumes real-time streaming data
to continuously update model parameters. After training with fixed number of
steps, the learnt model will be delivered to the Model Center, which manages
all online models.

Online Serving. Once a new version of pre-ranking model is ready, pre-ranking
server will load it from Model Center to replace the online version in
service.

##  4\. Experiments

In this section, we conduct experiments on both public dataset and production
dataset to validate the effectiveness of COPR in improving consistency and
overall system performance.

###  4.1. Experiment Setup

Taobao Dataset. It is a public
dataset333https://tianchi.aliyun.com/dataset/dataDetail?dataId=56 with 26
million impression logs of 1 million users and 0.8 million items in 8 days.
Item price is used as bid. Impressions of first 7 days are used to train DIN
(Zhou et al., 2018) as the ranking model. For each impression, we sample 10
candidates and collect ECPM-ranked results by the ranking model to train pre-
ranking models. Logs of the last day are used for evaluation. To simulate the
cascading process, we sample 100 candidates for each impression, among which
the pre-ranking and ranking model sequentially select top 10 and top 1
candidates to display.

Production Dataset. It contain 8 days of impression logs and ranking logs
collected from our system shown in Fig. 4. These logs are of the magnitude of
billions. The first week of logs are used for training and the last day is
used for evaluation. According to the scenario that logs come from, it is
further divided into two subsets: Homepage and Post-Purchase.

Baselines. COPR is compared with following baselines:

  * •

Base adopts the architecture of COLD (Wang et al., 2020) and is trained on
impression logs.

  * •

Distillation (Hinton et al., 2015) directly distills predicted scores of the
ranking model on impression logs.

  * •

RankFlow (Qin et al., 2022) distills predicted scores of the ranking model on
ranking logs and further regularizes the pre-ranking model to generate high
scores for candidates selected by the ranking model.

  * •

COPR w/o $\Delta NDCG$ removes the $\Delta NDCG$-based weighting mechanism
from the COPR framework.

Metrics. We adopt two groups of metrics in evaluation.

  * •

The first group measures the consistency between ECPM-ranked results of the
pre-ranking and ranking phases, including HitRatio(HR@K), normalized
discounted cumulative gain (NDCG@K), and mean average precision (MAP@K). In
HR@K and MAP@K, top 10 candidates selected by the ranking model are treated as
relative ones. In NDCG@K, order in ranking logs is used as a proxy of
relevance. The standard calculation of these metrics can be found in (Liu et
al., 2009).

  * •

The second group measures the overall system performance. We use Click-
Through-Rate (CTR) and Revenue Per Mille (RPM) similar to (Qin et al., 2022;
Wang and Yuan, 2015), which corresponds to user experience and platform
revenue, respectively. On public dataset, CTR is simulated as the portion of
clicked ads in displayed ads, and RPM is simulated as the product of CTR and
average bid of clicked ads. In production experiment, we perform online A/B
test to obtain CTR and RPM on real traffic.

Hyper-parameters. The chunk size is set to 2 and 10 on the public dataset and
the production dataset, respectively. The number of MLP layers in the
prediction net and the relaxation net is 3. The embedding size of raw input
features is set to 16. $\lambda_{1}$ and $\lambda_{2}$ in Eq. (14) are fixed
to 1 and 0.2.

###  4.2. Results on Public Dataset

Table 2. Comparison among COPR and baselines int terms of consistency and
overall system performance. Best results are highlighted in bold.

Method | HR@10 | NDCG@10 | MAP@10 | CTR | RPM
---|---|---|---|---|---
Base | 0.544 | 0.402 | 0.198 | 0.0170 | 112.66
Distillation | 0.593 | 0.461 | 0.244 | 0.0176 | 117.36
RankFlow | 0.722 | 0.467 | 0.270 | 0.0182 | 121.36
COPR w/o $\Delta NDCG$ | 0.741 | 0.514 | 0.327 | 0.0188 | 129.20
COPR | 0.759 | 0.530 | 0.359 | 0.0191 | 132.93

Table 2 compares COPR and baselines in terms of consistency and system
performance. We only show $K=10$ in HR@K, NDCG@K, and MAP@K due to limited
space. Results under other settings of $K$ are similar. From Table 2, we draw
the following conclusions.

First, system performance (CTR and RPM) is highly associated with the
consistency between the pre-ranking and ranking phases. For COPR and
baselines, the higher consistency generally yields the better system
performance. It validates our motivation to explicitly optimize consistency
between phases in order to improve the overall effectiveness of the cascading
system.

Second, COPR achieves best consistent results of all methods, outperforming
the state-of-the-art RankFlow by 5.1%, 13.5%, and 33.0% in terms of HR@10,
NDCG@10, and MAP@10. We attribute the improvement to our shift of objective
from score alignment to rank alignment. By such relaxation, COPR can directly
optimize towards consistent ECPM-ranked results and meanwhile reduce the
learning difficulty for the lightweight model. Moreover, the influence of bids
is considered in training COPR, thus alleviating the issue of error
amplification that RankFlow suffers from. We also find that RankFlow is better
than Distillation. We think it is because Rankflow aligns scores over ranking
logs while the latter is on impression logs which is too sparse.

Third, COPR w/o $\Delta NDCG$ experiences performance drop compared with COPR.
This ablation study verifies the effectiveness of the pair weighting mechanism
based on $\Delta NDCG$. By emphasizing more on important inter-chunk pairs in
consistency optimization, COPR ensures top candidates are more likely to be
consistently ranked, which helps improve the overall utility of pre-ranking
results.

###  4.3. Results on Production Dataset

Figure 5. HR@K of different methods in the scenario of Homepage (Left) and
Post-Purchase (Right).

Figure 6. NDCG@K of different methods in the scenario of Homepage (Left) and
Post-Purchase (Right).

Figure 7. MAP@K of different methods in the scenario of Homepage (Left) and
Post-Purchase (Right).

We also perform similar evaluation on the production dataset composed of
samples from two scenarios. Most conclusions are consistent with those on the
public dataset.

As shown in more details from Fig. 5 to Fig. 7, COPR significantly outperforms
other methods in term of HR@K, NDCG@K, and MAP@K with varying $K$ from 5 to
100 on two scenarios, which demonstrates the stable improvement of consistency
achieved by our proposed framework. Moreover, we still observe the gap between
COPR and COPR w/o $\Delta NDCG$, which shows that the weighting mechanism also
works in the large-scale production dataset.

To evaluate system performance in production environment, we perform online
A/B test on two scenarios, where these methods are used to serve real users
and advertisers. From Table 3 we find that Distillation, RankFlow, and COPR
all perform better than the production baseline, among which COPR achieves the
largest improvement, with a lift of up to +12.3% CTR and +5.6% RPM. With
impressive performance, COPR has been successfully deployed to serve the main
traffic of Taobao display advertising system in the pre-ranking phase since
October of 2022.

Table 3. Relative improvement over the production baseline in online A/B Test.
Best results are highlighted in bold.

Method | Homepage | Post-Purchase
---|---|---
CTR | RPM | CTR | RPM
Base | - | - | - | -
Distillation | +2.2% | +0.1% | +3.6% | +0.6%
RankFlow | +8.3% | +2.9% | +6.8% | +2.3%
COPR w/o $\Delta NDCG$ | +11.5% | +5.0% | +9.6% | +3.7%
COPR | +12.3% | +5.6% | +10.8% | +4.4%

###  4.4. Qualitative Analysis

Given ranked results from the pre-ranking and ranking phases, we calculate the
average pre-ranking position for candidates at each ranking position, based on
which we draw the Ranking-PreRanking Curve (RPC). The ideal RPC happens when
results are exactly same.

####  4.4.1. Error Amplification in ECPM Rank.

As shown in Fig. 8 (Left), RPC by pCTR of RankFlow is close to the ideal
curve, showing well alignment of raw pCTR in two phases. However, after
ranking by ECPM, RPC of RankFlow largely deviates from the ideal one. It
verifies that the involvement of bid in ECPM will amplify the influence of
errors in score alignment, leading to more inconsistent ECPM-ranked results.
This analysis is consistent with the example in Table 1. Hence we confirm that
merely score alignment is not enough for the cascading architecture in online
advertising.

####  4.4.2. More Consistent ECPM Rank.

Fig. 8 (Right) shows RPC by ECPM of different methods. We observe that
compared with Base and RankFlow, RPC of COPR is more close to the ideal curve
in almost each ranking position. It qualitatively shows that ECPM-ranked
results given by COPR are more consistent with results of the ranking phase.
It can be attributed to the design of our consistency-oriented framework,
where the rank alignment module directly optimizes towards this objective. The
incorporation of bid also helps alleviate the above mentioned error
amplification.

Figure 8. Left: RPC by pCTR and ECPM of RankFlow. Right: RPC by ECPM of
different methods.

##  5\. Conclusion

In this paper, we introduce a consistency-oriented pre-ranking framework for
online advertising, which employs a chunk-based sampling module and a plug-
and-play rank alignment module to explicitly optimize consistency of ECPM-
ranked results. A $\Delta NDCG$-based weighting mechanism is also adopted to
better distinguish the importance of inter-chunk samples in optimization. Both
online and offline experiments have validated the superiority of our
framework. When deployed in Taobao display advertising system, it achieves an
improvement of up to +12.3% CTR and +5.6% RPM.

## References

  * (1)
  * Burges et al. (2005) Chris Burges, Tal Shaked, Erin Renshaw, Ari Lazier, Matt Deeds, Nicole Hamilton, and Greg Hullender. 2005.  Learning to rank using gradient descent. In _Proceedings of the 22nd international conference on Machine learning_. 89–96.
  * Burges (2010) Christopher JC Burges. 2010\.  From ranknet to lambdarank to lambdamart: An overview.  _Learning_ 11, 23-581 (2010), 81.
  * Covington et al. (2016) Paul Covington, Jay Adams, and Emre Sargin. 2016\.  Deep neural networks for youtube recommendations. In _Proceedings of the 10th ACM conference on recommender systems_. 191–198.
  * Goldfarb and Tucker (2011) Avi Goldfarb and Catherine Tucker. 2011.  Online display advertising: Targeting and obtrusiveness.  _Marketing Science_ 30, 3 (2011), 389–404.
  * Guo et al. (2021) Huifeng Guo, Bo Chen, Ruiming Tang, Weinan Zhang, Zhenguo Li, and Xiuqiang He. 2021\.  An embedding learning framework for numerical features in ctr prediction. In _Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining_. 2910–2918.
  * Hinton et al. (2015) Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015\.  Distilling the knowledge in a neural network.  _arXiv preprint arXiv:1503.02531_ (2015).
  * Hu et al. (2018) Jie Hu, Li Shen, and Gang Sun. 2018.  Squeeze-and-excitation networks. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 7132–7141.
  * Huang et al. (2013) Po-Sen Huang, Xiaodong He, Jianfeng Gao, Li Deng, Alex Acero, and Larry Heck. 2013\.  Learning deep structured semantic models for web search using clickthrough data. In _Proceedings of the 22nd ACM international conference on Information & Knowledge Management_. 2333–2338.
  * Järvelin and Kekäläinen (2017) Kalervo Järvelin and Jaana Kekäläinen. 2017.  IR evaluation methods for retrieving highly relevant documents. In _ACM SIGIR Forum_ , Vol. 51. ACM New York, NY, USA, 243–250.
  * Li et al. (2022a) Xiangyang Li, Bo Chen, HuiFeng Guo, Jingjie Li, Chenxu Zhu, Xiang Long, Sujian Li, Yichao Wang, Wei Guo, Longxia Mao, et al. 2022a.  IntTower: the Next Generation of Two-Tower Model for Pre-Ranking System. In _Proceedings of the 31st ACM International Conference on Information & Knowledge Management_. 3292–3301.
  * Li et al. (2022b) Xiang Li, Xiaojiang Zhou, Yao Xiao, Peihao Huang, Dayao Chen, Sheng Chen, and Yunsen Xian. 2022b.  AutoFAS: Automatic Feature and Architecture Selection for Pre-Ranking System. In _Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining_. 3241–3249.
  * Liu et al. (2020) Bin Liu, Chenxu Zhu, Guilin Li, Weinan Zhang, Jincai Lai, Ruiming Tang, Xiuqiang He, Zhenguo Li, and Yong Yu. 2020.  Autofis: Automatic feature interaction selection in factorization models for click-through rate prediction. In _Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_. 2636–2645.
  * Liu et al. (2009) Tie-Yan Liu et al. 2009\.  Learning to rank for information retrieval.  _Foundations and Trends® in Information Retrieval_ 3, 3 (2009), 225–331.
  * Luo et al. (2020) Qiang Luo, Xiang-Rong Sheng, Jun Jiang, Chi Ma, Shuguang Wang, Haiyang He, Pengtao Yi, Guowang Zhang, Yue Song, and Guorui Zhou. 2020\.  Bernoulli:A Streaming System with Structured Designs.  (2020).
  * Ma et al. (2022) Ning Ma, Mustafa Ispir, Yuan Li, Yongpeng Yang, Zhe Chen, Derek Zhiyuan Cheng, Lan Nie, and Kishor Barman. 2022\.  An Online Multi-Task Learning Framework for Google Feed Ads Auction Models. In _Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining_. 3477–3485.
  * Ma et al. (2021) Xu Ma, Pengjie Wang, Hui Zhao, Shaoguo Liu, Chuhan Zhao, Wei Lin, Kuang-Chih Lee, Jian Xu, and Bo Zheng. 2021.  Towards a Better Tradeoff between Effectiveness and Efficiency in Pre-Ranking: A Learnable Feature Selection based Approach. In _Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval_. 2036–2040.
  * Pasumarthi et al. (2019) Rama Kumar Pasumarthi, Sebastian Bruch, Xuanhui Wang, Cheng Li, Michael Bendersky, Marc Najork, Jan Pfeifer, Nadav Golbandi, Rohan Anil, and Stephan Wolf. 2019.  Tf-ranking: Scalable tensorflow library for learning-to-rank. In _Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_. 2970–2978.
  * Pi et al. (2020) Qi Pi, Guorui Zhou, Yujing Zhang, Zhe Wang, Lejian Ren, Ying Fan, Xiaoqiang Zhu, and Kun Gai. 2020\.  Search-based user interest modeling with lifelong sequential behavior data for click-through rate prediction. In _Proceedings of the 29th ACM International Conference on Information & Knowledge Management_. 2685–2692.
  * Qin et al. (2022) Jiarui Qin, Jiachen Zhu, Bo Chen, Zhirong Liu, Weiwen Liu, Ruiming Tang, Rui Zhang, Yong Yu, and Weinan Zhang. 2022.  RankFlow: Joint Optimization of Multi-Stage Cascade Ranking Systems as Flows. In _Proceedings of the 45th International ACM SIGIR Conference on Research and Development in Information Retrieval_. 814–824.
  * Tang and Wang (2018) Jiaxi Tang and Ke Wang. 2018.  Ranking distillation: Learning compact ranking models with high performance for recommender system. In _Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining_. 2289–2298.
  * Wang and Yuan (2015) Jun Wang and Shuai Yuan. 2015.  Real-time bidding: A new frontier of computational advertising research. In _Proceedings of the Eighth ACM International Conference on Web Search and Data Mining_. 415–416.
  * Wang et al. (2022) Yiqing Wang, Xiangyu Liu, Zhenzhe Zheng, Zhilin Zhang, Miao Xu, Chuan Yu, and Fan Wu. 2022.  On Designing a Two-stage Auction for Online Advertising. In _Proceedings of the ACM Web Conference 2022_. 90–99.
  * Wang et al. (2020) Zhe Wang, Liqin Zhao, Biye Jiang, Guorui Zhou, Xiaoqiang Zhu, and Kun Gai. 2020\.  Cold: Towards the next generation of pre-ranking system.  _arXiv preprint arXiv:2007.16122_ (2020).
  * Wu et al. (2018) Wenjin Wu, Guojun Liu, Hui Ye, Chenshuang Zhang, Tianshu Wu, Daorui Xiao, Wei Lin, and Xiaoyu Zhu. 2018\.  Eenmf: An end-to-end neural matching framework for e-commerce sponsored search.  _arXiv preprint arXiv:1812.01190_ (2018).
  * Yuan et al. (2019) Bowen Yuan, Jui-Yang Hsia, Meng-Yuan Yang, Hong Zhu, Chih-Yao Chang, Zhenhua Dong, and Chih-Jen Lin. 2019.  Improving ad click prediction by considering non-displayed events. In _Proceedings of the 28th ACM International Conference on Information and Knowledge Management_. 329–338.
  * Zhou et al. (2018) Guorui Zhou, Xiaoqiang Zhu, Chenru Song, Ying Fan, Han Zhu, Xiao Ma, Yanghui Yan, Junqi Jin, Han Li, and Kun Gai. 2018\.  Deep interest network for click-through rate prediction. In _Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining_. 1059–1068.


# Securing Wireless Communications of the Internet of Things from the Physical
Layer, An Overview

Junqing Zhang, Trung Q. Duong, Roger Woods, and Alan Marshall This work was
supported by the Royal Society Research Grant under Grant ID RG160302. J.
Zhang, T. Q. Duong and R. Woods are with School of Electronics, Electrical
Engineering and Computer Science, Queen’s University Belfast, Belfast, BT9
5AG, U.K. (email<EMAIL_ADDRESS><EMAIL_ADDRESS>r.woods@qub.ac.uk)A. Marshall is with Department of Electrical Engineering and
Electronics, University of Liverpool, Liverpool, L69 3GJ, U.K. (email:
<EMAIL_ADDRESS>
###### Abstract

The security of the Internet of Things (IoT) is receiving considerable
interest as the low power constraints and complexity features of many IoT
devices are limiting the use of conventional cryptographic techniques. This
article provides an overview of recent research efforts on alternative
approaches for securing IoT wireless communications at the physical layer,
specifically the key topics of key generation and physical layer encryption.
These schemes can be implemented and are lightweight, and thus offer practical
solutions for providing effective IoT wireless security. Future research to
make IoT-based physical layer security more robust and pervasive is also
covered.

###### Index Terms:

Internet of Things, physical layer security, key generation, physical layer
encryption

##  I Introduction

The Internet of Things (IoT) aims to allow ubiquitous connections between
things with computing, communication, and sensing ability. IoT applications
include smart cities, smart traffic, healthcare, smart home, industrial
monitoring, and environment monitoring, etc. [1, 2], which have revolutionized
every aspect of our life. On the other hand, many open research problems still
remain to allow this technology to become widely available as proposed [3].
For example, IoT security and privacy remains a major concern as indicated by
the UK IoT government report [4] and agreed by many experts [5]. To this end,
research into effective IoT security remains a key objective as indicated by
major sponsors such as the US National Science Foundation [6], the European
Horizon 2020 research programs [7], and the UK’s Engineering and Physical
Sciences Research Council [8].

The number of connected devices has already exceeded the world’s population
and is increasing exponentially. It is predicted by numerous sources that IoT
devices will number 10 billion by 2020 [9]. For example, Cisco estimated there
would be 6.58 connected devices per person by 2020, i.e., about 50 billion
devices in total [10]. With the huge amount of IoT devices, wireless
communication is preferred as it allows easy installation and provides
ubiquitous connection. Wireless air interfaces involved in the IoT include
IEEE 802.15.4 (Zigbee), Bluetooth Low Energy (BLE), IEEE 802.11 Wi-Fi,
LoRaWAN, cellular connections, ultrawide band, near field communication (NFC),
radio-frequency identification (RFID), to name but a few.

While we are enjoying the benefits that wireless connection has brought, its
broadcast nature makes the transmission vulnerable to passive eavesdropping
and active jamming. Thus, there is a clear need to protect the data on-the-fly
in the IoT as it will generally contain sensitive, private or confidential
information. For example, in healthcare applications, the sensor nodes collect
patients’ health information such as heart rate and blood pressure. This
information is private and highly confidential, and hence a secure
transmission channel is required. However, IoT systems are far from safe and
many vulnerabilities exist [11]. For example, HP reported that 70% of devices
did not encrypt their communications [12].

The security countermeasures are mainly categorized into computational
security and information-theoretic security [13]. The former has been the main
approach in protecting the communication systems where cryptographic
algorithms and protocols are deployed at the upper layers of the protocol
stack [14]. For example, the transport layer security (TLS) is a well-known
protocol to protect the transport link [15] while Wi-Fi protected access (WPA)
is designed to secure the media access control (MAC) layer111IEEE 802 splits
the open systems interconnection (OSI) data link layer into MAC sublayer and
logical link control (LLC) sublayer. in the IEEE 802.11 systems [16]. A
classical cryptosystem comprises public key cryptography (PKC) for key
distribution222Public key cryptography can also be used for
encryption/decryption and digital signature, which are not discussed in this
article. and symmetric encryption for data protection, as shown in Figure 1,
where Alice and Bob are the legitimate users wishing to communicate securely.
PKC security relies on exploiting the computational hardness of mathematical
problems, such as discrete logarithm, and distributes the same session key to
Alice and Bob. Symmetric encryption usually occurs in the upper layers, i.e.,
data link/MAC layer and above, allowing encryption of plaintext with the
common session key shared between users using PKC.

Figure 1: Classic cryptosystem with MAC layer encryption as an example. The
gray blocks represent the encrypted data.

Whilst classical cryptosystems have protected conventional wireless systems,
there are challenges in applying these approaches in IoT. IoT devices range
from well-resourced smartphones to low cost, low energy and lightweight
computing embedded devices. Many low cost IoT devices cannot afford the
additional silicon area, power consumption, and code space needed to perform
the expensive mathematical calculations of cryptographic methodologies [17].
In addition, IoT applications may work in a device-to-device communication
mode where there is no secured public key infrastructure (PKI) for the
distribution of public keys. Finally, with the development of quantum
computing, the concept of PKC will be fundamentally challenged [18].

Conventional upper layer-based cryptography also leaves the transmission
vulnerable to many passive and active attacks. For example, the MAC header is
sent in plaintext and attackers can perform traffic analysis by observing the
MAC header. In addition, the physical packet header is also sent in plaintext
and can reveal side-channel information (SCI) such as data rate, packet
length, mapping schemes, etc. [19]. Eavesdroppers can perform various attacks
based on the observed SCI, such as analysis of users’ activities and selective
jamming.

Therefore, the design of a low cost and robust cryptosystem for IoT is vital.
While the main security streams have focused on the upper layers, the physical
layer can also be leveraged to enhance security. In fact, reusing the physical
layer features can decrease additional energy cost for security. As shown in
Figure 2, security enhancement at the physical layer can be twofold. Firstly,
information-theoretic security, also known as physical layer security (PLS),
exploits the unpredictable features of wireless channels, such as fading;
therefore, the system will not be compromised no matter how powerful the
attackers are [20, 21, 22, 23]. PLS transmission techniques achieve security
through artificial noise [24], jamming [25], or beamforming [26], etc.
However, many PLS transmission schemes are not practical yet because they
require complex coding and/or the perfect/imperfect channel state information
(CSI) of the receiver and/or eavesdroppers [13]. On the other hand, physical
layer key generation, an active branch of PLS, is implementable because the
legitimate users are able to agree on the same key from the noisy channel
estimation [27], which can be used as an alternative to PKC in many
circumstances. Secondly, moving the encryption to the physical layer can
protect the entire physical layer packet and thus the wireless connection is
secured from many passive and active attacks.

Figure 2: Taxonomy of security enhancement techniques at physical layer

Recently, a new hybrid approach considers how we can deploy cryptosystems
directly into the physical layer and integrates information-theoretical
security and computational security schemes, which are constructed by physical
layer key generation and physical layer encryption (PLE), as shown in Figure
3. Alice and Bob carry out wireless transmission over the noisy channel using
pilot signals. They are able to exploit common information of wireless
channels and agree on the same cryptographic key through the key generation
protocol consisted of channel probing, quantization, information
reconciliation, and privacy amplification. The key is then fed to the PLE,
which performs encryption operations at the modulation stages of the physical
layer, and protects the IoT wireless transmission. Their integration offers a
good example of how information-theoretic security schemes and computational
security schemes can work together to protect IoT systems. Security
countermeasures from the physical layer are lightweight and offer protection
to the wireless transmission, and therefore are advantageous over conventional
upper layer encryption-based security primitives.

Figure 3: Key generation and PLE-based cryptosystem. The gray blocks represent
the encrypted data.

There have been survey papers on the PLS transmission [28] and key generation
[29, 27] to protect IoT. However, PLS transmission is limited in practical
implementation and a survey on integration of key generation and encryption
has never been reported. This article aims to provide an overview on the
recent progress of this promising hybrid physical layer cryptosystem, with a
focus on the practical implementation and algorithm prototyping.

The rest of this article is organized as follows. The wireless technologies
used in IoT are introduced in Section II. We then describe the physical layer
key generation in Section III and PLE in Section IV. Finally, we propose some
future research directions in Section V that make securing IoT from the
physical layer more robust and pervasive. Section VI concludes the article.

##  II Wireless Technologies for IoT and Their Security Countermeasures

IoT aims to connect everything together and wireless communication is seen as
the best option in order to avoid installation costs while enabling ubiquitous
connection. IoT devices are normally tiny, embedded, and battery-powered, and
thus communicate with each other through various low-power wireless
communication technologies. This section introduces several popular wireless
technologies, including IEEE 802.15.4 (Zigbee), BLE, IEEE 802.11, and LoRaWAN.

IEEE 802.15.4 defines the physical and MAC layer protocols while Zigbee is
based on IEEE 802.15.4 and includes high layer protocols. It runs at an
unlicensed industrial, scientific and medical (ISM) 2.4 GHz frequency and uses
direct sequence spread spectrum (DSSS) as the physical layer modulation. IEEE
802.15.4 is energy efficient and supports a data rate of up to 250 kbps, which
is quite suitable for applications with limited data exchange requirements. It
has been used extensively in wireless sensor networks (WSNs), especially in
industrial applications.

BLE, also known as Bluetooth Smart, was standardized in 2010 as Bluetooth Core
Specification Version 4.0. BLE runs at 2.4 GHz frequency and uses frequency
hopping spread spectrum (FHSS) to combat frequency interference. It supports
short range communications (50 to 100 m) and a data rate of 1 Mbps. In
addition, BLE consumes extremely low energy and can run for months on standard
coin-cell batteries. It is suited for IoT applications such as wearable
devices and it is predicted by the Bluetooth special interest group that more
than 90% smartphones will support BLE by 2018 [30].

IEEE 802.11 families are the most popular wireless local area network (WLAN)
standards working at 2.4/5 GHz. They include IEEE 802.11a/b/g/n and are
supported almost by all smartphones, laptops, tablets, etc. IEEE 802.11 can be
used in the smart home applications to provide large amounts of data transfer
and as most houses are already covered by IEEE 802.11, installation costs can
be avoided. Whilst legacy IEEE 802.11 standards may not be suitable for many
lightweight IoT applications, IEEE 802.11ah was recently announced by the Wi-
Fi alliance which has been developed explicitly for IoT. It works at sub 1 GHz
bands and can cover large range communications. In addition, 802.11ah adopts
narrower bandwidth and implements energy efficient protocols to extend the
sensors’ battery life. It is also optimized to support large groups of
stations or sensors that cooperate to share the signals.

LoRaWAN is an emerging low power wide area network (WAN) technology with the
first specification released in June, 2015 [31]. It also runs at sub 1 GHz and
employs chirp spread spectrum. It supports long range coverage ($>15$ km),
millions of users, and low power consumption (up to ten years), and therefore
is extremely suitable for low cost IoT devices.

IEEE 802.15.4, Bluetooth, and IEEE 802.11 systems usually handle the security
at the data link/MAC layer. For example, an AES block cipher is used to
protect the link layer of IEEE 802.15.4 and Bluetooth systems. In IEEE 802.11
systems, an MAC layer encryption scheme named WPA has been designed and
implemented using AES. LoRa implements the security countermeasures by
encryption at network and application layers.

A summary and comparison of the wireless technologies for the IoT is given in
Table I.

TABLE I: Wireless technologies for the IoT

Technique | Frequency | Range | Data Rate |  Security Countermeasure |  Applications
---|---|---|---|---|---
IEEE 802.15.4 (Zigbee) | 2.4 GHz | 10 to 100 m | 250 kps |  AES in MAC layer |  WSN, industrial, environment, and healthcare monitoring
BLE | 2.4 GHz | 50 to 150 m | 1 Mbps |  AES in link layer |  Wearable devices, smartphones
IEEE 802.11 a/b/g/n | 2.4 or 5 GHz | 50 m |  $>$ 100 Mbps |  WPA in MAC layer (with AES implemented) |  Smart home, entertainment
IEEE 802.11 ah | sub 1 GHz | 1 km | 150 Kbps |  |  Smart city, smart grid, smart home, healthcare, [t]
LoRaWAN | sub 1 GHz |  $>$ 15 km | 0.3 kbps to 50 kbps |  Encryption at network and application layer |  Machine-to-machine, smart city, and industrial applications [b]

##  III Physical Layer Key Generation

Key generation from the randomness of wireless channels has been receiving
much research interest [27], as it is well-suited for establishing
cryptographic keys as an alternative to PKC in IoT applications [32]. As shown
in Figure 3, firstly, key generation exploits unpredictable but characteristic
features of the wireless channel, and is thus information-theoretically secure
[33, 34]. Secondly, it can be carried out between a pair of users with no aid
from a third user, while a secured PKI is always required for PKC. Finally,
key generation is lightweight and uses limited resources as all of the
operations are not complicated and thus meets the low computation capacity of
IoT devices. Zenger et al. implemented their key generation scheme in a 32-bit
ARM Cortex M3 processor (EFM32GG-STK3700) and an 8-bit Intel MCS-51 and showed
the resource and energy consumption to be very low [35]. The authors also
implemented a lightweight PKC, elliptic curves Diffie-Hellman key generation
(ECDH), as a comparison. As shown in Table II, taking the implementation in
32-bit ARM processor as an example, the ECDH requires 5.73 times more code,
128.26 times more cycles, and consumes 41.52 times more energy, than that of
the key generation protocol, respectively. Therefore, key generation from
wireless channels is extremely suitable for low cost IoT devices.

TABLE II: Resource and energy consumption comparison between key generation
and ECDH

Protocol | Platform | Architecture | Resources | Energy
---|---|---|---|---
Code Size (kb) | Cycles | Computation (mJ) | Communication (mJ) | Total (mJ)
Key generation | ARM Cortex-M3 | 32-bit | 1.033 | 302,297 | 2.246 | 0.187 | 2.433
Key generation | Intel MCS-51 | 8-bit | 1.137 | 1,345,205 | 5.206 | 0.187 | 5.393
ECDH | ARM Cortex-M3 | 32-bit | 5.918 | 38,774,000 | 100.96 | 0.064 | 101.024
ECDH | Intel MCS-51 | 8-bit | 8.749 | 1,734,400,000 | 528.45 | 0.064 | 528.514

Key generation works well in a dynamic wireless communication system, and is
built on three principles.

  * •

Channel reciprocity means the channel responses of the forward and backward
links are the same, which is the basis for key generation. When two users
measure the same channel parameters at the same frequency in a time-division
duplex (TDD) mode, the measurements at Alice and Bob are impacted by the non-
simultaneous sampling and noise. However, a high correlation between channel
measurements of Alice and Bob can still be maintained and eligible for key
generation in a slow fading channel, as demonstrated in many practical
experiments [36, 37, 38, 39].

  * •

Temporal variation indicates that there is randomness residing in the dynamic
channel333In the urban area, the interference may be chaotic, because of the
densely deployed access points [40]. The interference will impact the channel
measurements accuracy but will not affect randomness nature of the wireless
link between users. In addition, the statistical features of the channel may
be deterministic [41, 42], but key generation is exploiting the instantaneous
channel variation, which is random in nature., which ensures the extracted
keys are random. A random key will make the cryptographic applications robust
against attacks such as brute force.

  * •

Spatial decorrelation implies that when located a half-wavelength away from
the legitimate users, the eavesdropper experiences an uncorrelated channel
compared to that between Alice or Bob, guaranteeing the security of the key
generation. When the system works at 2.4 GHz, a half-wavelength is about 6 cm,
which is quite short.

These principles have been theoretically modeled and analyzed in [43, 44] and
experimentally validated in [39, 38].

###  III-A Procedure

Key generation involves channel probing, quantization, information
reconciliation, and privacy amplification, as shown in Figure 3. Without loss
of generality, Alice is selected as the initiator of the key generation
process.

In the channel probing step, the randomness residing in the temporal [36, 37,
43], frequency [45, 46, 43, 47], and spatial [48, 49, 50, 51] domains can be
extracted by measuring the channel parameters such as the received signal
strength (RSS) and CSI, etc. In particular, at time $t_{A}$ Alice sends a
public pilot signal to Bob who will measure the channel parameter as $X^{B}$.
Then, at time $t_{B}=t_{A}+\tau$, Bob also sends a public pilot signal to
Alice who will measure the same channel parameter and store it as $X^{A}$.
Alice and Bob will repeat the above channel sampling until they get enough
measurements to generate a full set of keys444The key length is determined by
the cryptographic applications. For example, the key length of AES can be
128-bit, 192-bit, or 256-bit.. It is worth noting that in this step, users
adopt a public pilot signal to measure the channel but do not try to exchange
message secretly. It is possible that some of the probe packets are not
successful because of the poor channel condition, which results in a mismatch
between the pairing of the measurements of Alice and Bob. This can be solved
by exchanging and comparing the timestamps of the measurements, and keeping
the records with the common timestamps. In TDD mode, the common timestamp does
not necessarily indicate the timestamps with the exact same value, but their
difference should be the sampling delay $\tau$ . For example, Alice will send
her recorded timstamps to Bob, who will compare his timestamps and keep the
common ones. Bob will then send his censored timestamps to Alice and she will
also only keep the common ones, which will finally enable Alice and Bob to
have the paired measurements. The exchange does not reveal any useful
information to eavesdroppers.

In the second step, both Alice and Bob will convert the analog measurements
into binary sequences using quantization schemes. Mean and standard deviation-
based quantizer [36] (Algorithm 1) and cumulative distribution functions
(CDF)-based quantizer [52] (Algorithm 2) are two popular quantizers. In
Algorithm 1, $\mu_{X^{u}}$ is the mean value of $X^{u}$, $\sigma_{X^{u}}$ is
the standard deviation of $X^{u}$, $\alpha$ is used to adjust the threshold,
and $n$ is the number of the channel measurements. The design of quantizer
relies on the selection of threshold and quantization level (QL). CDF-based
quantization is able to obtain the same proportion of 0s and 1s as it can
adaptively adjust the threshold, which is at the cost of increased complexity.
The computational complexity of calculating the mean and variance is
$\mathcal{O}(n)$. When calculating CDF, one key step is sorting the
measurements, whose complexity is $\mathcal{O}\big{(}n\log(n)\big{)}$, which
requires more computation than the calculation of the mean and variance. A
performance comparison of quantization schemes is reported in [53].

Algorithm 1 Mean and standard deviation-based quantization

1:$X^{u}$ $\%$ Channel measurement, RSS or CSI

2:$K^{u}$ $\%$ Key

3:$\eta_{+}^{u}=\mu_{X^{u}}+\alpha\times\sigma_{X^{u}}$ $\%$ $\eta_{+}^{u}$ is
the positive threshold.

4:$\eta_{-}^{u}=\mu_{X^{u}}-\alpha\times\sigma_{X^{u}}$ $\%$ $\eta_{-}^{u}$ is
the negative threshold.

5:for $i\leftarrow 1\>\>\>\>\textbf{to}\>\>\>\>n$ do

6: if $X^{u}(i)>\eta_{+}^{u}$ then

7: $K^{u}(i)=1$

8: else if $X^{u}(i)<\eta_{-}^{u}$ then

9: $K^{u}(i)=0$

10: else

11: $X^{u}(i)$ dropped

12: end if

13:end for

Algorithm 2 CDF-based quantization

1:$X^{u}$ $\%$ Channel measurement, RSS or CSI

2:QL $\%$ Quantization level

3:$K^{u}$ $\%$ Key

4:$F(x)=\text{Pr}(X^{u}<x)$ $\%$ CDF calculation

5:$\eta_{0}^{u}=-\infty$ $\%$ Threshold

6:for $j\leftarrow 1\>\>\>\>\textbf{to}\>\>\>\>2^{\textit{QL}}-1$ do

7: $\eta_{j}^{u}=F^{-1}(\frac{j}{2^{\textit{QL}}})$ $\%$ Threshold

8:end for

9:$\eta_{2^{\textit{QL}}}^{u}=\infty$

10:Construct Gray code $b_{j}$ and assign them to different intervals
$[\eta_{j-1}^{u},\eta_{j}^{u}]$

11:for $i\leftarrow 1\>\>\>\>\textbf{to}\>\>\>\>n$ do

12: if $\eta_{j-1}^{u}\leq X^{u}(i)<\eta_{j}^{u}$ then

13: $K^{u}(i,\textit{QL})=b_{j}$

14: end if

15:end for

In practical measurements, due to the half-duplex nature of the most
commercial hardware platforms and the independent hardware noise, channel
measurements of Alice and Bob, i.e., $X^{A}$ and $X^{B}$, will not be
identical, thus resulting in a disagreement between $K^{A}$ and $K^{B}$. In
the information reconciliation stage, Alice and Bob will leverage the error
correction code (ECC) to reach an agreement, which is achieved via public
discussion by exchanging information such as the syndrome. Secure sketch [54]
is a popular key reconciliation technique and is given as an example in
Algorithm 3. A comprehensive survey on information reconciliation techniques
can be found in [55]. Finally, privacy amplification is employed to eliminate
the information revealed to eavesdroppers, which can be implemented using hash
functions [27].

Algorithm 3 Secure sketch

1:$K^{A}$, $K^{B}$ $\%$ Quantized keys of Alice and Bob

2:$C$ $\%$ ECC set shared by Alice and Bob

3:$K^{A}$, $K^{B^{\prime}}$ $\%$ Reconciled key

4:Alice randomly selects $c$ from an ECC set $C$

5:Alice calculates $s=\text{XOR}(K^{A},c)$

6:Alice transmits $s$ to Bob through a public channel

7:Bob receives $s$

8:Bob calculates $c^{B}=\text{XOR}(K^{B},s)$

9:Bob decodes $c^{B}$ to get $c$

10:Bob calculates $K^{B^{\prime}}=\text{XOR}(c,s)=K^{A}$ $\%$ Alice and Bob
agree on the same key

###  III-B Application

Due to its lightweight feature, this form of key generation has strong
potential to provide the security for IoT. It has been applied in many
wireless technologies, such as IEEE 802.11, IEEE 802.15.4, Bluetooth, etc.,
with many prototypes/implementations reported, see [27].

IEEE 802.11 is the most popular technique for the key generation
implementation as the technique is widely adopted in our daily life. The work
in [36] is one of the first and important papers that implemented key
generation protocol. The authors generated keys from the peak of channel
impulse response (CIR) using an 802.11 compatible field-programmable gate
array (FPGA)-based platform, and also from RSS with a commercial Wi-Fi network
interface card (NIC). However, the key generation rate is rather limited,
i.e., about 1 bps, since the authors only extracted keys from coarse-grained
channel parameter. Orthogonal frequency-division multiplexing (OFDM) is
employed by IEEE 802.11a/g/n/ah, which can provide fine-grained CSI in both
time and frequency domain and significantly improve the key generation
performance [43, 45].

A key generation system using wearable devices with IEEE 802.15.4 is
implemented in [56]. Channel measurements are carried out along with data
transmission, in other words, no dedicated transmission is incurred for key
generation. This avoids the additional energy burden required by key
generation, which can significantly save power consumption as the radio
transmission is always the dominant [17]. In addition, a low cost filter is
employed to improve the signal cross-correlation, which helps the system reach
an agreement as high as 99.8% [56]. Since there is not much data transmission
required by wearable devices, the system takes about half an hour to generate
128-bit keys. The duration is acceptable as it still meets the requirement.
For example, Wi-Fi recommends to refresh the session key every hour.

Key generation has also been applied in Bluetooth systems [57]. The authors
implemented their system in two Google Nexus One smartphones and sampled RSS
with experiments in indoor and outdoor environments. Random frequency hopping
was employed to combat the interference from other wireless networks running
at the ISM bands. It has also been demonstrated by experiments that Bluetooth-
based key generation can be carried out using much lower transmit power (3
dBm) with a performance comparable to that of Wi-Fi-based system, which is
desirable for IoT devices.

##  IV Physical Layer Encryption

Modern communication systems employ a layered protocol stack to organize
communication functions and most of the current security methodologies are
applied at the MAC layer and above. The physical layer is the lowest layer of
the protocol stack and was designed originally to modulate data for
transmission but without any security considerations. This section introduces
some recent ongoing encryption schemes implemented at the physical layer,
which protects the entire physical layer packet. PLE schemes are lightweight
as they do not introduce additional complexity, therefore are quite suitable
for IoT applications.

###  IV-A Procedure

The data payload undergoes several physical layer modulation stages, such as
channel coding, mapping, inverse fast Fourier transform (IFFT) operation (for
OFDM systems), etc. PLE can be applied by encrypting the data flow in these
physical layer modulation stages. Some PLE schemes applicable for OFDM systems
are shown in Figure 4, including XOR encryption [58], phase encryption [59,
60, 58], and OFDM subcarriers encryption [61, 62, 63, 64, 65, 66, 67]. The
user first generates the encryption information using the output of stream
cipher or chaotic mapping. Based on the adopted encryption scheme, the
encryption information is used to calculate phase rotation, dummy subcarrier
locations, or subcarrier scrambling/interleaving permutation, etc., which is
then used to protect the corresponding modulation stage. The detailed
calculation step will shown in Section IV-B. The seed for the stream cipher or
the initial state of the chaotic map can be shared between legitimate users
using the key generation discussed in the last section.

The entire packet is protected. The encryption of the physical layer payload,
i.e., the MAC layer packet, will secure the MAC layer content, including the
MAC header. In addition, the protection of the physical layer header can
prevent eavesdroppers from carrying out functions of synchronization and
channel estimation, significantly increasing the processing overheads for the
eavesdropper [67].

Figure 4: Physical layer encryption schemes in OFDM. Gray modules are added
for encryption.

###  IV-B Algorithm Prototype

The PLE design is determined by the wireless technologies which employ
different physical layer modulations. In this section, we introduce several
PLE prototypes based on the modulation stage that they have encrypted.

XOR encryption is the most straightforward and lightweight scheme and can be
implemented in hardware in a very efficient manner. As XOR is a bitwise
operation, it usually happens before coding, as shown in Figure 4. This scheme
is applicable to all the wireless technologies as the data passed from the MAC
layer is always in binary form. However, it is implemented at the beginning of
modulation stages and does not randomize the physical layer waveform, which
results in a weaker protection [67].

Phase encryption can also be applied as long as phase-shift keying or
quadrature amplitude modulation is used [59, 60, 58]. As shown in Figure 4,
phase encryption occurs after symbol mapping and the constellation symbols are
not in binary values any more. The encrypted constellation symbols
$m_{k}^{\prime}$ can be denoted as

$\displaystyle m_{k}^{\prime}=m_{k}e^{j\theta_{k}}+n_{k},$ (1)

where $m_{k}$ is the constellation symbols, $\theta_{k}$ is the rotation
angle, and $n_{k}$ is the random noise. $\theta_{k}$ is generated according to
the key sequence and then used to rotate the constellation symbols. In order
to create a denser encrypted constellation, more key bits are required to
generate rotation angles, which increases the key-to-data ratio555Key-to-data
ratio is defined as the number of key bits needed to encrypt one bit
plaintext, which is a key metric of PLE.. Random noise, $n_{k}$, can be
deliberately added to the rotated symbols to make it even more difficult for
the eavesdroppers to demodulate the ciphertext [59, 60]. The implementation of
this technique is also efficient because the main resource is a multiplier and
related control circuits.

The OFDM technique modulates data onto multiple orthogonal
subcarriers/frequencies and can significantly increase the data rate,
providing an additional domain to protect the data. The parallel input data
$X$ can be scrambled in frequency domain before IFFT operation [61, 62, 63],
which can be given as

$\displaystyle X^{\prime}=XS_{f},$ (2)

where $S_{f}$ is the frequency scrambling matrix, or the IFFT output data can
be scrambled in the time domain [64] and written as

$\displaystyle x^{\prime}=xS_{t},$ (3)

where $S_{t}$ is the time scrambling matrix. Scramble-based schemes can bring
a large search space. However, it may result in a high computational
complexity as matrix operations are required, which may not be suitable for
low cost devices [67].

Different from above OFDM schemes that scramble all the data subcarriers, the
work in [65, 66] interleaves only part of the subcarriers. In particular, the
scheme in [65] selects a subset of the subcarriers whose phase is larger than
the threshold, and then interleaves their real and imaginary components of the
symbols. The method in [66] selects a subcarrier subset based on the CSI, and
then interleaves these subcarriers according to the descending order of their
channel amplitudes. Encryption usually involves mathematical operations, e.g.,
XOR operation, between the plaintext and key sequence, but here the concept
applies more generally to the data manipulation according to the common secret
information. In addition, the authors use channel information as encryption
information directly without resorting to stream ciphers, which requires a
careful design of the interleaving pattern because of the channel estimation
errors at transmitters and receivers.

While the standard OFDM systems use all the data subcarriers for data
transmission, some subcarriers can also be reserved to transmit dummy data,
i.e., rubbish information, for obfuscation [67]. Due to the introduction of
dummy subcarriers, there is a trade-off between the security and data rate,
but it has been demonstrated in [67] that it is worthwhile as there are many
subcarriers and the data rate is usually only slightly reduced. In addition,
the preambles are encrypted in [67] so the entire packet is protected.

The above schemes protect different physical layer modulation stages, which
lead to distinctions on the security level, complexity, etc. For example, XOR
and phase encryption are easier to implement but provide less strong
protection. On the other hand, scrambling-based schemes may require matrix
operations, including matrix multiplication and inversion, which result in a
higher computation complexity. A detailed comparison in terms of search space
to the brute force attack, key rate, and complexity of the above schemes can
be found in [67].

###  IV-C Practical Implementation

To the best of the authors’ knowledge, there has been only one paper which has
implemented a physical layer phase encryption IEEE 802.15.4 transceiver and
RC4 to generate the key sequence [68]. The work in [68] first validated the
design using FPGA technology and then implemented the system in application-
specific integrated circuit (ASIC) using UMC 0.18 $\mu m$ complementary metal-
oxide-semiconductor (CMOS) technology. The security enhancement, including the
RC4 and phase encryption/decryption, results in a 26% increase on the gate
counts compared to a standard 802.15.4 transceiver, which is a reasonable
overheard for security.

##  V Future Work Suggestions

Although there have been prototypes/demonstrations of the above physical
layer-based security countermeasures, research is still needed to make these
schemes more robust and pervasive. In this section, we suggest some future
research directions in securing the IoT from the physical layer.

###  V-A Physical Layer Key Generation

Most current commercial platforms work in half-duplex mode, and the keying
nodes have to measure the channel alternately in different time instances. Key
generation in this setting is only applicable to slow fading channels in order
to get a highly correlated measurements between users. Therefore, key
generation in fast fading channels is very challenging, which limits its
application, e.g. in vehicular communications. Work in [69] and [70] designed
key generation systems with the maximum vehicle speed tested as 20 mph and 50
mph, respectively, but their key generation rates are limited, e.g., 5 bit/s
in [70]. In addition, work in [71] tested their algorithms in indoor
environment only. There is also some simulation work, e.g., [72, 73]. Their
performance in the practical fast fading channels remains unknown. This topic
is thus still require more efforts, e.g., by using full-duplex hardware [74].

Efficient group and pairwise key generation are essential to assist secure
broadcast and unicast transmission in a large scale IoT network. A fusion
center broadcasts signals to the network users, which requires a pre-
establishment of a common session key. The devices may also exchange unicast
packets between each other, and private keys between pairs of users are
required. In ad hoc IoT, many users may join and leave the network frequently,
therefore robust and efficient schemes to update the session key and private
keys are required. There have been several group key generation protocols
reported, e.g., a time-slotted round-trip phase-based scheme [75], RSS-based
protocols for star and chain topologies [76], and group key generation for
mesh topology [77]. However, the scalability (with the size of the group) and
efficiency of the above protocols are limited and more research effort is
required.

Although key generation is able to achieve information-theoretic security, in
practice the security performance requires special attention. For example,
when there is a strong line-of-sight, the spatial decorrelation may not hold
any more, which makes the system vulnerable to passive eavesdropping [39, 78].
Key generation is also subject to active attacks [79, 80], which will result
in less efficient or even unsuccessful key generation. It is thereof very
important to design key generation techniques secure from passive
eavesdropping and robust to active jamming. In addition, the majority of the
research focuses on the indoor and/or mobile channels, while in an outdoor or
static environment, the channel randomness is rather limited. A less random
key will expose the cryptographic systems to brute force attack and should be
always avoided.

###  V-B Physical Layer Encryption

PLE applies encryption at the physical layer, and entails additional
operations and hardware resources. No hardware implementation for PLE schemes
has been reported except for those in [68]. The additional operations will
introduce latency in the critical path and may not meet the timing
requirements of the current MAC protocol. Therefore, a cross-layer design
between the physical and MAC layer is necessary.

The keys generated are usually fed to a stream cipher to produce pseudo random
numbers to encrypt plaintext. In scenarios where keys can be generated fast or
only very small amount of data exchange is required, the keys generated can be
used to encrypt the data directly, rather than be used as the seed for stream
cipher. Key generation and PLE is then integrated as a one-time pad scheme to
offer perfect Shannon secrecy, which can provide strongest protection ever.
However, the practical security performance and implementation requires
further investigation.

##  VI Conclusion

This article has provided an overview on securing wireless communications of
IoT applications from the physical layer. We have introduced two security
techniques, namely, physical layer key generation and physical layer
encryption. For each, we have discussed their features and applications by a
special consideration of IoT devices’ low power and low cost features. The
remaining challenges of how to make these schemes more robust and pervasive
have also been proposed. Unlike previous work, this article has focused on
practical prototypes/implementations, thus offering insights for their
applications in the IoT to enhance wireless security.

## References

  * [1] L. Atzori, A. Iera, and G. Morabito, “The Internet of Things: A survey,” _Computer Networks_ , vol. 54, no. 15, pp. 2787–2805, 2010.
  * [2] A. Al-Fuqaha, M. Guizani, M. Mohammadi, M. Aledhari, and M. Ayyash, “Internet of Things: A survey on enabling technologies, protocols, and applications,” _IEEE Commun. Surveys Tuts._ , vol. 17, no. 4, pp. 2347–2376, Fourth Quarter 2015.
  * [3] J. A. Stankovic, “Research directions for the internet of things,” _IEEE Internet Things J._ , vol. 1, no. 1, pp. 3–9, 2014.
  * [4] M. Walport, “The Internet of Things: Making the most of the second digital revolution, A report by the UK government chief scientific adviser,” Tech. Rep., December 2014, https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/409774/14-1230-internet-of-things-review.pdf, Accessed on 22 June 2017.
  * [5] “The Internet of Things: Five critical questions,” McKinsey Global Institute, August 2015, http://www.mckinsey.com/industries/high-tech/our-insights/the-internet-of-things-five-critical-questions, Accessed on 22 June 2017.
  * [6] “A partnership to secure and protect the emerging Internet of Things,” National Science Foundation, August 2015, http://nsf.gov/news/news_summ.jsp?cntn_id=136104&org=NSF, Accessed on 22 June 2017.
  * [7] European Research Cluster on the Internet of Things, http://www.internet-of-things-research.eu/, Accessed on 22 June 2017.
  * [8] “New Internet of Things research hub announced,” The Engineering and Physical Sciences Research Council, January 2016, https://www.epsrc.ac.uk/newsevents/news/iotresearchhub/ , Accessed on 22 June 2017.
  * [9] A. Nordrum, “The Internet of fewer things,” September 2016, http://spectrum.ieee.org/telecom/internet/the-internet-of-fewer-things, Accessed on 22 June 2017.
  * [10] D. Evans, “Internet of things research study,” Cisco, Tech. Rep., April 2011, http://www.cisco.com/c/dam/en_us/about/ac79/docs/innov/IoT_IBSG_0411FINAL.pdf, Accessed on 22 June 2017.
  * [11] A. Grau, “How to build a safer Internet of Things,” February 2015, http://spectrum.ieee.org/telecom/security/how-to-build-a-safer-internet-of-things, Accessed on 22 June 2017.
  * [12] “Internet of things research study,” HP, Tech. Rep., November 2015, https://www.hpe.com/h20195/v2/GetPDF.aspx/4AA5-4759ENN.pdf, Accessed on 22 June 2017.
  * [13] Y. Zou, J. Zhu, X. Wang, and L. Hanzo, “A survey on wireless security: Technical challenges, recent advances, and future trends,” _Proc. IEEE_ , vol. 104, no. 9, pp. 1727–1765, September 2016.
  * [14] J. Granjal, E. Monteiro, and J. Sa Silva, “Security for the Internet of Things: A survey of existing protocols and open research issues,” _IEEE Commun. Surveys Tuts._ , vol. 17, no. 3, pp. 1294–1312, Third Quarter 2015.
  * [15] T. Dieks and E. Rescorla, “The Transport layer security (TLS) protocol,” Internet Requests for Comments, RFC Editor, RFC 5246, August 2008. [Online]. Available: http://www.rfc-editor.org/rfc/rfc5246.txt
  * [16] “Wireless lan medium access control (mac) and physical layer (phy) specifications: Amendment 6: Medium access control (mac) security enhancements,” IEEE, Tech. Rep. 802.11i, July 2004.
  * [17] W. Trappe, R. Howard, and R. S. Moore, “Low-energy security: Limits and opportunities in the Internet of Things,” _IEEE Security Privacy_ , vol. 13, no. 1, pp. 14–21, January/February 2015.
  * [18] C. Cheng, R. Lu, A. Petzoldt, and T. Takagi, “Securing the Internet of Things in a quantum world,” _IEEE Commun. Mag._ , vol. 55, no. 2, pp. 116–120, February 2017.
  * [19] H. Rahbari and M. Krunz, “Secrecy beyond encryption: obfuscating transmission signatures in wireless communications,” _IEEE Commun. Mag._ , vol. 53, no. 12, pp. 54–60, December 2015.
  * [20] X. Zhou, L. Song, and Y. Zhang, Eds., _Physical layer security in wireless communications_. CRC Press, 2013.
  * [21] B. He, X. Zhou, and T. D. Abhayapala, “Wireless physical layer security with imperfect channel state information: A survey,” _ZTE Communications_ , vol. 11, no. 3, p. 11–19, September 2013.
  * [22] A. Mukherjee, S. Fakoorian, J. Huang, and A. Swindlehurst, “Principles of physical layer security in multiuser wireless networks: A survey,” _IEEE Commun. Surveys Tuts._ , vol. 16, no. 3, pp. 1550–1573, Third Quarter 2014.
  * [23] Y. Liu, H.-H. Chen, and L. Wang, “Physical layer security for next generation wireless networks: Theories, technologies, and challenges,” _IEEE Commun. Surveys Tuts._ , vol. 19, no. 1, pp. 347 – 376, 2017.
  * [24] S. Goel and R. Negi, “Guaranteeing secrecy using artificial noise,” _IEEE Trans. Wireless Commun._ , vol. 7, no. 6, 2008.
  * [25] S. Ma, M. Hempel, Y. L. Yang, and H. Sharif, “An approach to secure wireless communications using randomized eigenvector-based jamming signals,” in _Proc. 6th Int. Wireless Communications and Mobile Computing Conf._ , Caen, France, July 2010, pp. 1172–1176.
  * [26] A. Mukherjee and A. L. Swindlehurst, “Robust beamforming for security in mimo wiretap channels with imperfect csi,” _IEEE Trans. Signal Processing_ , vol. 59, no. 1, pp. 351–361, 2011.
  * [27] J. Zhang, T. Q. Duong, A. Marshall, and R. Woods, “Key generation from wireless channels: A review,” _IEEE Access_ , vol. 4, pp. 614–626, March 2016.
  * [28] A. Mukherjee, “Physical-layer security in the Internet of Things: Sensing and communication confidentiality under resource constraints,” _Proc. IEEE_ , vol. 103, no. 10, pp. 1747–1761, October 2015.
  * [29] K. Zeng, “Physical layer key generation in wireless networks: challenges and opportunities,” _IEEE Communications Magazine_ , vol. 53, no. 6, pp. 33–39, 2015.
  * [30] S. Janiak, “Three ways Bluetooth® smart technology enables innovation for the Internet of Things,” January 2015, http://blog.bluetooth.com/three-ways-bluetooth-smart-technology-enables-innovation-for-the-internet-of-things/, Accessed on 22 June 2017.
  * [31] “LoRa Alliance,” https://www.lora-alliance.org/, Accessed on 22 June 2017\.
  * [32] C. T. Zenger, M.-J. Chur, J.-F. Posielek, C. Paar, and G. Wunder, “A novel key generating architecture for wireless low-resource devices,” in _Proc. Int. Workshop Secure Internet of Things (SIoT)_ , Wroclaw, Poland, September 2014, pp. 26–34.
  * [33] R. Ahlswede and I. Csiszar, “Common randomness in information theory and cryptography – Part I: secret sharing,” _IEEE Trans. Inf. Theory_ , vol. 39, no. 4, pp. 1121–1132, 1993.
  * [34] U. M. Maurer, “Secret key agreement by public discussion from common information,” _IEEE Trans. Inf. Theory_ , vol. 39, no. 3, pp. 733–742, 1993.
  * [35] C. T. Zenger, M. Pietersz, J. Zimmer, J.-F. Posielek, T. Lenze, and C. Paar, “Authenticated key establishment for low-resource devices exploiting correlated random channels,” _Computer Networks_ , vol. 109, pp. 105–123, 2016.
  * [36] S. Mathur, W. Trappe, N. Mandayam, C. Ye, and A. Reznik, “Radio-telepathy: Extracting a secret key from an unauthenticated wireless channel,” in _Proc. 14th Annu. Int. Conf. Mobile Computing Networking (MobiCom)_ , San Francisco, California, USA, September 2008, pp. 128–139.
  * [37] S. Jana, S. N. Premnath, M. Clark, S. K. Kasera, N. Patwari, and S. V. Krishnamurthy, “On the effectiveness of secret key extraction from wireless signal strength in real environments,” in _Proc. 15th Annu. Int. Conf. Mobile Computing and Networking (MobiCom)_ , Beijing, China, September 2009, pp. 321–332.
  * [38] J. Zhang, R. Woods, T. Q. Duong, A. Marshall, and Y. Ding, “Experimental study on channel reciprocity in wireless key generation,” in _Proc. 17th IEEE Int. Workshop Signal Process. Advances in Wireless Commun. (SPAWC)_ , Edinburgh, UK, July 2016, pp. 1–5.
  * [39] J. Zhang, R. Woods, T. Q. Duong, A. Marshall, Y. Ding, Y. Huang, and Q. Xu, “Experimental study on key generation for physical layer security in wireless communications,” _IEEE Access_ , vol. 4, pp. 4464–4477, September 2016.
  * [40] S. Kajita, T. Amano, H. Yamaguchi, T. Higashino, and M. Takai, “Wi-fi channel selection based on urban interference measurement,” in _Proc. 13th Int. Conf. on Mobile and Ubiquitous Systems: Computing, Networking and Services_ , Hiroshima, Japan, November/December 2016, pp. 143–150.
  * [41] E. Chin, D. Chieng, V. Teh, M. Natkaniec, K. Loziak, and J. Gozdecki, “Wireless link prediction and triggering using modified ornstein–uhlenbeck jump diffusion process,” _Wireless Networks_ , vol. 20, no. 3, pp. 379–396, 2014.
  * [42] J. A. Santana, E. Macías, Á. Suárez, D. Marrero, and V. Mena, “Adaptive estimation of wifi rssi and its impact over advanced wireless services,” _Mobile Networks and Applications_ , pp. 1–13, 2016.
  * [43] J. Zhang, A. Marshall, R. Woods, and T. Q. Duong, “Efficient key generation by exploiting randomness from channel responses of individual OFDM subcarriers,” _IEEE Trans. Commun._ , vol. 64, no. 6, pp. 2578–2588, June 2016.
  * [44] J. Zhang, B. He, T. Q. Duong, and R. Woods, “On the key generation from correlated wireless channels,” _IEEE Commun. Lett._ , vol. 21, no. 4, pp. 961–964, 2017.
  * [45] H. Liu, Y. Wang, J. Yang, and Y. Chen, “Fast and practical secret key extraction by exploiting channel response,” in _Proc. 32nd IEEE Int. Conf. Comput. Commun. (INFOCOM)_ , Turin, Italy, April 2013, pp. 3048–3056.
  * [46] W. Xi, X. Li, C. Qian, J. Han, S. Tang, J. Zhao, and K. Zhao, “KEEP: Fast secret key extraction protocol for D2D communication,” in _Proc. 22nd IEEE Int. Symp. of Quality of Service (IWQoS)_ , Hong Kong, May 2014, pp. 350–359.
  * [47] Y. Peng, P. Wang, W. Xiang, and Y. Li, “Secret key generation based on estimated channel state information for tdd-ofdm systems over fading channels,” _IEEE Trans. Wireless Commun._ , 2017.
  * [48] K. Zeng, D. Wu, A. Chan, and P. Mohapatra, “Exploiting multiple-antenna diversity for shared secret key generation in wireless networks,” in _Proc. 29th IEEE Int. Conf. Comput. Commun. (INFOCOM)_ , San Diego, California, USA, March 2010, pp. 1–9.
  * [49] J. W. Wallace and R. K. Sharma, “Automatic secret keys from reciprocal MIMO wireless channels: Measurement and analysis,” _IEEE Trans. Inf. Forensics Security_ , vol. 5, no. 3, pp. 381–392, 2010.
  * [50] C. Chen and M. A. Jensen, “Secret key establishment using temporally and spatially correlated wireless channel coefficients,” _IEEE Trans. Mobile Comput._ , vol. 10, no. 2, pp. 205–215, 2011.
  * [51] E. A. Jorswieck, A. Wolf, and S. Engelmann, “Secret key generation from reciprocal spatially correlated MIMO channels,” in _Proc. IEEE GLOBECOM Workshop Trusted Commun. with Physical Layer Security (TCPLS)_ , Atlanta, Georgia, USA, December 2013, pp. 1245–1250.
  * [52] N. Patwari, J. Croft, S. Jana, and S. K. Kasera, “High-rate uncorrelated bit extraction for shared secret key generation from channel measurements,” _IEEE Trans. Mobile Comput._ , vol. 9, no. 1, pp. 17–30, January 2010.
  * [53] C. T. Zenger, J. Zimmer, and C. Paar, “Security analysis of quantization schemes for channel-based key extraction,” in _Proc. 12th EAI Int. Conf. Mobile and Ubiquitous Systems: Computing, Networking and Services_ , Coimbra, Portugal, July 2015, pp. 267–272.
  * [54] Y. Dodis, R. Ostrovsky, L. Reyzin, and A. Smith, “Fuzzy extractors: How to generate strong keys from biometrics and other noisy data,” _SIAM J. Comput._ , vol. 38, no. 1, pp. 97–139, 2008.
  * [55] C. Huth, R. Guillaume, T. Strohm, P. Duplys, I. A. Samuel, and T. Güneysu, “Information reconciliation schemes in physical-layer security: A survey,” _Computer Networks_ , vol. 109, pp. 84–104, 2016.
  * [56] S. Ali, V. Sivaraman, and D. Ostry, “Eliminating reconciliation cost in secret key generation for body-worn health monitoring devices,” _IEEE Trans. Mobile Comput._ , vol. 13, no. 12, pp. 2763–2776, December 2014.
  * [57] S. N. Premnath, P. L. Gowda, S. K. Kasera, N. Patwari, and R. Ricci, “Secret key extraction using Bluetooth wireless signal strength measurements,” in _Proc. 11th Annu. IEEE Int. Conf. Sensing, Commun. Networking (SECON)_ , Singapore, June 2014, pp. 293–301.
  * [58] F. Huo and G. Gong, “XOR encryption versus phase encryption, An in-depth analysis,” _IEEE Trans. Electromagn. Compat._ , vol. 57, no. 4, pp. 903–911, August 2015.
  * [59] D. Reilly and G. Kanter, “Noise-enhanced encryption for physical layer security in an OFDM radio,” in _Proc. IEEE Radio and Wireless Symp. (RWS)_ , San Diego, CA, USA, January 2009, pp. 344–347.
  * [60] R. Ma, L. Dai, Z. Wang, and J. Wang, “Secure communication in TDS-OFDM system using constellation rotation and noise insertion,” _IEEE Trans. Consum. Electron._ , vol. 56, no. 3, pp. 1328–1332, 2010.
  * [61] M. A. Khan, M. Asim, V. Jeoti, and R. S. Manzoor, “On secure OFDM system: Chaos based constellation scrambling,” in _Proc. Int. Conf. on Intelligent and Advanced Syst. (ICIAS)_ , Kuala Lumpur, Malaysia, November 2007, pp. 484–488.
  * [62] D. Tseng and J. Chiu, “An OFDM speech scrambler without residual intelligibility,” in _Proc. IEEE Region 10 Conf. (TENCON)_ , Taipei, October 2007, pp. 1–4.
  * [63] L. Zhang, X. Xin, B. Liu, and Y. Wang, “Secure OFDM-PON based on chaos scrambling,” _IEEE Photon. Technol. Lett._ , vol. 23, no. 14, pp. 998–1000, 2011.
  * [64] H. Li, X. Wang, and W. Hou, “Secure transmission in OFDM systems by using time domain scrambling,” in _Proc. 77th IEEE Veh. Technology Conf. (VTC Spring)_ , Dresden, Germany, June 2013, pp. 1–5.
  * [65] H. Li, X. Wang, and Y. Zou, “Dynamic subcarrier coordinate interleaving for eavesdropping prevention in OFDM systems,” _IEEE Commun. Lett._ , vol. 18, no. 6, pp. 1059–1062, June 2014.
  * [66] H. Li, X. Wang, and J.-Y. Chouinard, “Eavesdropping-resilient OFDM system using sorted subcarrier interleaving,” _IEEE Trans. Wireless Commun._ , vol. 14, no. 2, pp. 1155–1165, February 2015.
  * [67] J. Zhang, A. Marshall, R. Woods, and T. Q. Duong, “Design of an OFDM physical layer encryption scheme,” _IEEE Trans. Veh. Technol._ , vol. 66, no. 3, pp. 2114–2127, 2017.
  * [68] A. K. Nain, J. Bandaru, M. A. Zubair, and R. Pachamuthu, “A secure phase-encrypted ieee 802.15.4 transceiver design,” _IEEE Trans. Computers_ , vol. 66, no. 8, pp. 1421 – 1427, August 2017.
  * [69] J. Wan, A. B. Lopez, and M. A. Al Faruque, “Exploiting wireless channel randomness to generate keys for automotive cyber-physical system security,” in _Proc. 7th International Conference on Cyber-Physical Systems_ , Vienna, Austria, April 2016, p. 13.
  * [70] X. Zhu, F. Xu, E. Novak, C. C. Tan, Q. Li, and G. Chen, “Using wireless link dynamics to extract a secret key in vehicular scenarios,” _IEEE Trans. Mobile Comput._ , vol. 16, no. 7, pp. 2065–2078, April 2017.
  * [71] X. Li, J. Liu, Q. Yao, and J. Ma, “Efficient and consistent key extraction based on received signal strength for vehicular ad hoc networks,” _IEEE Access_ , vol. 5, pp. 5281–5291, 2017.
  * [72] A. M. Abdelgader and L. Wu, “A secret key extraction technique applied in vehicular networks,” in _Proc. IEEE 17th Int. Conf. Computational Science and Engineering_ , Chengdu, China, December 2014, pp. 1396–1403.
  * [73] A. M. S. Abdelgader, S. Feng, and L. Wu, “Exploiting the randomness inherent of the channel for secret key sharing in vehicular communications,” _International Journal of Intelligent Transportation Systems Research_ , pp. 1–12, 2017.
  * [74] H. Vogt, K. Ramm, and A. Sezgin, “Practical secret-key generation by full-duplex nodes with residual self-interference,” in _Proc. 20th Int. ITG Workshop on Smart Antennas_ , Munich, Germany, March 2016, pp. 344–347.
  * [75] Q. Wang, H. Su, K. Ren, and K. Kim, “Fast and scalable secret key generation exploiting channel phase randomness in wireless networks,” in _Proc. 30th IEEE Int. Conf. Comput. Commun. (INFOCOM)_ , Shanghai, China, April 2011, pp. 1422–1430.
  * [76] H. Liu, J. Yang, Y. Wang, Y. J. Chen, and C. E. Koksal, “Group secret key generation via received signal strength: Protocols, achievable rates, and implementation,” _IEEE Trans. Mobile Comput._ , vol. 13, no. 12, pp. 2820–2835, 2014.
  * [77] C. D. T. Thai, J. Lee, and T. Q. Quek, “Secret group key generation in physical layer for mesh topology,” in _Proc. IEEE Global Communications Conference (GLOBECOM)_ , San Diego, CA, USA, December 2015, pp. 1–6.
  * [78] C. Zenger, H. Vogt, J. Zimmer, A. Sezgin, and C. Paar, “The passive eavesdropper affects my channel: Secret-key rates under real-world conditions,” in _Proc. IEEE GLOBECOM Workshop Trusted Commun. with Physical Layer Security (TCPLS)_ , Washington DC, USA, December 2016, pp. 1–6.
  * [79] M. Zafer, D. Agrawal, and M. Srivatsa, “Limitations of generating a secret key using wireless fading under active adversary,” _IEEE/ACM Trans. Netw._ , vol. 20, no. 5, pp. 1440–1451, October 2012.
  * [80] R. Jin and K. Zeng, “Physical layer key agreement under signal injection attacks,” in _Proc. IEEE Conf. Commun. and Network Security (CNS)_ , Florence, Italy, September 2015, pp. 254–262.