I. INTRODUCTION
IT is well known that eavesdropping over wireless channels can be mitigated through symmetric-key crypto-primitives [1], [2]. Although crypto-primitive based techniques are effective in providing confidentiality, they necessitate the participating nodes to synthesize shared secret-keys at regular intervals. In the context of standard cellular communication, say between a user equipment and a base-station, secret-keys are synthesized using pre-registered subscriber identity module (SIM) based information between the two entities. However, in the context of device-to-device communication, wherein no pre-registered SIM based information are available between the devices, additional dynamic key-generation techniques must be implemented. Among several such key-generation techniques, physical-layer key (PLK) generation methods have received traction in the wireless community. Specifically, in PLK generation, two wireless nodes exploit random fluctuations in their wireless channels to synthesize shared secret-keys, and subsequently feed the generated keys to the higher-level crypto-blocks [3]-[8].
A. Motivation
In this work, we are interested in developing new strategies for PLK generation particularly addressing practical issues that forbid key generation. For instance, PLK generation is not feasible when the two devices are out-of-coverage due to signal-blockage issues or power-limitations. One possible direction to circumvent this problem is to take the assistance of a trust-worthy neighboring node [12]-[15] that acts as a relay by offering the much needed connectivity and a random channel for the two nodes. To formally explain the relay based PLK generation, consider a wireless communication setting between two nodes, denoted by Node-A and Node-B, as shown in Fig. 1, which would like to harvest shared secret-keys through PLK generation. When the direct channel between Node-A and Node-B is not available, the two nodes use a trusted relay, denoted by Node-R, that can offer wireless channels with significant randomness. With the help of the relay, there are broadly two options for key generation; firstly, the relay can share the common randomness with the legitimate nodes through amplify-and-forward strategy [14], [18]. Secondly, the relay can generate keys with the nodes and broadcast them confidentially [12], [13]. However, among the two options, the amplify-and-forward strategy is not preferred due to higher noise in the common source of randomness as well as loss of key rate due to leakage issues in the common randomness at an eavesdropper. With the help of the relay under the latter class, it is clear that Node-A and Node-R may harvest keys by exchanging pilot symbols during the so-called key generation phase. Subsequently, this generated key must be reliably shared with Node-B during a dedicated time called the broadcast phase. Note that Node-R must confidentially share the generated key with Node-B, and this implies that the broadcast phase also requires a pre-shared key between Node-R and Node-B. Overall, the relay based PLK generation is such that pair-wise keys must be generated between Node-A and Node-R, and Node-B and Node-R, in the key generation phase, and then, one of the keys is used to securely share the other key in the broadcast phase.
Among the existing relay based PLK generation methods, a state-of-the-art technique [12], [13], [15], [19] that has gathered attention due to its simple and effective implementation, works as follows: Step 1: Pair-wise secret- keys are generated between Node-A and Node-R, denoted by [TeX:] $$k_{A R} \in\{0,1\}^{N_{A R}}$$, and Node-B and Node-R, denoted by [TeX:] $$k_{B R} \in\{0,1\}^{N_{B R}}$$ during the key generation phase, where [TeX:] $$N_{A R}$$ and [TeX:] $$N_{B R}$$ denote the lengths of the keys. Step 2: In the broadcast phase, an XOR version of pair-wise keys is shared by Node-R so that Node-B can retrieve [TeX:] $$k_{A R}$$ through self- interference cancellation since [TeX:] $$k_{B R}$$ is known at Node-B. For this celebrated XOR based idea, we identify two problems:
Problem 1: Although Node-A and Node-R, and Node-B and Node-R generate [TeX:] $$k_{A R}$$ and [TeX:] $$k_{B R}$$ in the key generation phase, respectively, the length of the key that is shared with Node- B in the broadcast phase is min[TeX:] $$\left(N_{A R}, N_{B R}\right)$$, which in turn reduces the overall key-rate of the protocol. Note that this limitation arises because of the XOR operation that provides confidentiality from an external eavesdropper listening to the broadcast phase. Motivated by this problem, in this paper, we ask “How do we circumvent this loss in key-rate due to the XOR operation?” Given that key-generation protocols are typically executed in multiple rounds in order to update the secret-keys, we explore the possibility of using buffer-aided relay to answer the above question.
Problem 2: We note that the randomness offered by the wireless channel between Node-A (or Node-B) and Node- R depends on its line-of-sight (LOS) component. In other words, higher is the LOS component of the channel, lower is the key length, and vice-versa. On the other hand, since the generated key must be broadcast through the same channel characteristics, we note that higher the LOS component of the channel, higher the reliability. Thus, a lower LOS channel offers conflicting behavior during the key generation phase and the broadcast phase. Moreover, with a given total power budget, allocating majority fraction of power to the key generation phase results in high-rate pair-wise keys; however, this leads to outage events owing to insufficient power to deliver those keys during the broadcast phase. On the other hand, allocating minority fraction of power to probing signals results in low-rate pair-wise secret-keys; however, although this may reduce the fraction of outage events owing to significant power on the broadcast signal, the overall key-rate at Node-A and Node-B might not be maximized. With this observation, we ask “For a given LOS characteristics of the channel, how should the three nodes distribute their power between the key generation and the broadcast phase so as to maximize number of secret bits that reach Node-B?
B. Contributions
(1) We propose buffer-aided relay for PLK generation, and then study its impact on the overall key rate of the protocol. With the buffer at the relay, we show that unused secret bits generated between Node-R and Node-B can be temporarily stored at the relay, and these bits could be used to provide confidentiality for the broadcast phase in the subsequent rounds of key generation. This way, the message length in the broadcast phase would be more than the minimum of the key lengths generated between Node-A and Node-R, and Node-B and Node-R, thereby improving the key rate (see Section II).
(2) When using buffer-aided relay we study power-allocation strategies between the key generation phase and the broadcast phase such that the number of secret bits generated between Node-A and Node-B is maximized as a function of the LOS parameter between Node-A (or Node-B) and Node-R, and the underlying signal-to-noise-ratio (SNR). We first take up the power-allocation problem when optimal key generation algorithms are employed at the three nodes (see Section III). Subsequently, we formulate optimization problems to (i) maximize the throughput of the protocol, and to (ii) maximize the key rate of the protocol subject to an upper bound on the error-rate, say some [TeX:] $$\eta>0$$, of the broadcast phase. The key rate metric is useful when the higher-level crypto- primitives of Node-A and Node-B expect shared secret bits through Node-R on at least [TeX:] $$1-\eta$$ fraction of the key generation rounds. The number [TeX:] $$\eta$$ is however chosen such that the two nodes can manage to garner shared secret bits from some other key generation methods on the residual [TeX:] $$\eta$$ fraction. In a different scenario, the throughput metric is useful when the crypto-primitives of Node-A and Node- B do not impose strict requirements to generate the shared secret bits as long as the total number of bits generated across several key generation rounds is maximized. We present an extensive analysis on the objective functions and the underlying constraints of the optimization problem to show that standard gradient-descent algorithms can be applied to obtain near-optimal solutions. Through simulation results, we show that the proposed solutions provide significant benefits over standard baselines.
(3) We also extend the power-allocation problem to practical scenarios wherein (i) practical key generation algorithms are employed at the three nodes, and (ii) the buffer size at the beginning of the protocol is empty (see Section IV). In this case, we observe that the key rates offered by the protocol is a correlated process since the buffer also accumulates shared secret bits with Node-B across successive rounds of the key generation protocol. As a result, we capture the update process of the buffer as a function of successive rounds, and then derive closed form expressions on key rate. Finally, owing to short block-length codes for the broadcast phase, we invoke non-asymptotic outage probability results from [30], to pose an optimization problem over the power-allocation variable. Through simulation results, we show that the optimal power- allocation parameter results in substantial benefits in both throughput and key rate over equal power allocation between the key generation phase and the broadcast phase. Finally, we show that the key generation protocol with buffer-aided relay outperforms the one without buffer [12], [13], [15], [19].
(4) Finally, we discuss the application of buffer-aided protocol on relay networks wherein the LOS components between the nodes and the relay are different. We show that the optimization problems discussed in the context of relay networks with equal LOS components continue to apply for the case of unequal LOS components (see Section V).
C. Related Work and Novelty
In Fig. 2, we have shown the novel contributions of our work in contrast to the existing contributions. The idea of using a trusted relay [11] for key generation is closely related to the contributions of [12], [13]. However, unlike [12] and
Network model comprising Node-A and Node-B which intend to harvest secret-keys using their channel with Node-R. We use buffer-aided relay along with a power-allocation strategy between the key generation phase and broadcast phase to improve the throughput and key rates of the protocol. Observe that the unused secret bits of Round 1 are used in Round 2.
Salient features of our work: (i) Multiple rounds of PLK generation, (ii) buffers, and (iii) power-allocation strategy.
[13], our work is different in the following aspects: (i) The relay is trusted1 and equipped with a buffer thereby aiding to increase the key rate for every round of key generation, (ii) variable power is considered between the key generation phase and the broadcast phase to deliver maximum number of secret bits within every round of key generation, (iii) the proposed power-allocation strategy is applicable when the two channels are characterized by arbitrary degree of LOS components. As far as the use of buffers is concerned, existing
1Given that Node-A and Node-B are out of coverage, it is implicit that a relay node would also be needed to forward the payload to Node-B. Thus, the use of trusted relay is natural to the setting. However, as a future direction for research, it would still be interesting to study buffer-aided relaying protocol along with an untrusted relay [16], [17], [18], [20].
A single round of key sharing comprises two phases: The key generation phase and broadcast phase. The optimization parameter β ∈ (0, 1) is used to allocate power between the two phases.
relay based PLK generation methods have not considered buffers in their model. However, buffer-aided relays have been used to improve secrecy throughput [21], [22], minimize secrecy outage probability [23], [24] or investigate security and delay/QoS trade-off in the presence of eavesdropper [25], [26].
II. BUFFER-AIDED PROTOCOL WITH RELAY
Consider a network model, as shown in Fig. 1, wherein Node-A and Node-B take the assistance of Node-R to generate secret-keys using PLK generation framework. The complex base band channel between Node-A and Node-R is denoted by [TeX:] $$h_{A R}=\sqrt{c_{R}}\left(\frac{1+i}{\sqrt{2}}\right)+\sqrt{1-c_{R}} g_{A R}$$, such that the constant [TeX:] $$\sqrt{C_{R}}\left(\frac{1+i}{\sqrt{2}}\right)$$ captures the LOS component with [TeX:] $$c_{R} \in[0,1]$$ and [TeX:] $$\sqrt{1-c_{R}} g_{A R}$$ captures the Non-LOS component with [TeX:] $$g_{A R} \sim \mathcal{C} \mathcal{N}(0,1)$$. As a special case, when [TeX:] $$c_{R}=0$$ and [TeX:] $$c_{R}=1$$, [TeX:] $$h_{A R}$$ corresponds to a Rayleigh channel and an additive white Gaussian noise (AWGN) channel, respectively.2 On the other hand, when cR ∈ (0, 1), hAR corresponds to a Ricean channel
2In classical Ricean fading models [33], the parameter [TeX:] $$K \in[0, \infty]$$ is used to capture various degrees of LOS components. Alternatively, in this model, we use [TeX:] $$c_{R}$$ for the same purpose, where K can be obtained as K [TeX:] $$=\frac{c_{R}}{1-c_{R}}$$.
with arbitrary degree of LOS as determined by cR. Along the similar lines, the complex base band channel between Node-B and Node-R is denoted by [TeX:] $$h_{B R}=\sqrt{c_{R}}\left(\frac{1+i}{\sqrt{2}}\right)+\sqrt{1-c_{R}} g_{B R}$$, such that [TeX:] $$\sqrt{1-c_{R}} g_{B R}$$ captures the Non-LOS component with [TeX:] $$g_{B R} \sim \mathcal{C N}(0,1)$$. We assume that both [TeX:] $$h_{A R}$$ and [TeX:] $$h_{B R}$$ are quasi-static with a coherence interval of T time- slots, henceforth referred to as a coherence-block. Although identical LOS components are assumed for the two channels, note that their channel realizations are independent owing to their statistically independent Non-LOS components. Along the similar lines of [9], [10], [13], [19], we assume perfect reciprocity in the pair-wise channels.3 In order to assist buffer- aided key generation, we assume that Node-B and Node-R are equipped with a buffer, using which multiple rounds of relay-assisted key generation protocols are executed, as shown in Fig. 3. To maintain consistency, the two nodes use the buffer as a stack with last-in first-out (LIFO) protocol. To capture successive rounds of key-generation protocols, we use [TeX:] $$m \geq 0$$ to denote the round number, and then explain the key- generation protocol for the mth round in the next section.
3Pair-wise key generation protocol is still applicable for imperfect channel reciprocity [15], [32]. Although the key-rate reduces due to imperfect reciprocity, the difference in the key length of the two channels persists, and therefore, buffers are applicable.
A. Protocol for Key Generation and Distribution
To explain the buffer-aided key generation protocol on the mth round, we assume that the buffers at Node-R and Node- B contain [TeX:] $$B(m-1) \geq 0$$ number of unused secret bits that were generated from the previous rounds. As shown in Fig. 3, each round of key generation protocol constitutes L+1 coherence-blocks, with [TeX:] $$T \geq L$$ for some [TeX:] $$L \in \mathbb{Z}_{+}$$, within which (i) L coherence-blocks are used by the three nodes for the key generation phase to generate pair-wise keys, and (ii) the (L + 1)th coherence-block is used by Node-R to broadcast the generated key to Node-B. A total power budget of PL units is divided between the key generation phase and the broadcast phase as [TeX:] $$\beta P L$$ and [TeX:] $$(1-\beta) P L$$, for some [TeX:] $$0<\beta<1$$. Subsequently, [TeX:] $$\beta P L$$ is equally divided among the three nodes over L coherence-blocks for transmitting the probing symbols, and [TeX:] $$(1-\beta) P L$$ is used by Node-R to distribute the generated keys to Node-B during the (L + 1)th coherence-block. This way, we use [TeX:] $$\beta$$ as the underlying optimization parameter to distribute the power between the key generation phase and the broadcast phase. Note that this framework of power-allocation requires the total power at the relay to be higher than that of the other nodes since it has to execute both the probing phase and the broadcast phase. We do not consider power- allocation for the consensus-phase of key generation as it is proportional to the power needed for probing signals. By using [TeX:] $$l \in\{1,2, \cdots, L+1\}$$ to denote the coherence-block index, the two channels in the network are represented as [TeX:] $$h_{A R}(l)$$ and [TeX:] $$h_{B R}(l)$$. To keep the notations simple, we do not use the round index m in the signal model, however, we use it when referring to the key lengths and the buffer size. First, we present a description of the key generation phase of the protocol within a coherence-block index [TeX:] $$l$$, for [TeX:] $$1 \leq l \leq L$$, and then describe the broadcast phase in the (L + 1)th coherence-block.
1) Key Generation Phase: In the key generation phase, Node-A, Node-B, and Node-R take turns to broadcast a symbol [TeX:] $$x=\sqrt{\beta P / 3}$$ during the 1st, 2nd, and 3rd slots of the [TeX:] $$l$$th coherence-block.
Slot 1: Node-A transmits a probing signal [TeX:] $$x=\sqrt{\beta P / 3}$$, which is used by Node-R to receive a noisy version of [TeX:] $$h_{A R}(l)$$. In particular, the corresponding received signal is
where [TeX:] $$n_{R}^{(1)}(l)$$ represents the AWGN, distribute as [TeX:] $$\mathcal{C N}(0, \gamma)$$. Here, the superscript denotes the slot number of the coherence- block.
Slot 2: Node-B transmits a probing signal [TeX:] $$x=\sqrt{\beta P / 3}$$, is used by Node-R to receive a noisy version of [TeX:] $$h_{B R}(l)$$. In particular, the corresponding received signal is
where [TeX:] $$n_{R}^{(2)}(l)$$ represents the AWGN, distributed as [TeX:] $$\mathcal{C} \mathcal{N}(0, \gamma)$$.
Slot 3: Node-R transmits a probing signal [TeX:] $$x=\sqrt{\beta P / 3}$$, which is used by Node-A and Node-B to receive a noisy version of [TeX:] $$h_{A R}(l)$$ and [TeX:] $$h_{B R}(l)$$, respectively. In particular, the corresponding received signals are
where [TeX:] $$n_{A}^{(3)}$$ and [TeX:] $$n_{B}^{(3)}(l)$$ represent the AWGN, distributed as [TeX:] $$\mathcal{C} \mathcal{N}(0, \gamma)$$. Using the first L coherence-blocks of the mth round, Node-A and Node-R use their observations [TeX:] $$\left\{y_{R}^{(1)}(l), 1 \leq l \leq L\right\}$$ and [TeX:] $$\left\{y_{A}^{(3)}(l), 1 \leq l \leq L\right\}$$, respectively, to apply a pair-wise key generation algorithm to synthesize [TeX:] $$N_{A R}(m)$$ secret bits, denoted by [TeX:] $$k_{A R}(m) \in\{0,1\}^{N_{A R}(m)}$$. Similarly, Node-B and Node-R generate [TeX:] $$N_{B R}(m)$$ secret bits, denoted by [TeX:] $$k_{B R}(m) \in\{0,1\}^{N_{B R}(m)}$$, using their observations [TeX:] $$\left\{y_{R}^{(2)}(l), 1 \leq l \leq L\right\}$$ and [TeX:] $$\left\{y_{B}^{(3)}(l), 1 \leq l \leq L\right\}$$, respectively. The process of pair wise key generation involves an appropriate consensus algorithm to ensure that keys generated separately are identical. The specific consensus algorithm applied in our work would be discussed in Section III and Section IV.
2) Broadcast Phase: In the (L + 1)th coherence-block, Node-R intends to confidentially share [TeX:] $$k_{A R}(m)$$ with Node- B, using their secret-key [TeX:] $$k_{B R}(m)$$. Since the lengths of [TeX:] $$k_{A R}(m)$$ and [TeX:] $$k_{B R}(m)$$ are potentially different, the protocol for generating the broadcast message must be carefully designed. If [TeX:] $$N_{A R}(m)<N_{B R}(m)$$, then all the bits of [TeX:] $$k_{A R}(m)$$ can be confidentially shared with Node-B by XORing it with the corresponding number of bits in [TeX:] $$k_{B R}(m)$$. On the other hand, if [TeX:] $$N_{A R}(m)>N_{B R}(m)$$, then only [TeX:] $$N_{A R}(m)-N_{B R}(m)$$ bits of [TeX:] $$k_{A R}$$ can be shared due to lack of padding bits from [TeX:] $$k_{B R}(m)$$ to provide confidentiality. To circumvent this loss in key length, our buffer-aided protocol uses the pre- shared bits in the buffer [TeX:] $$B(m-1)$$ to generate a new sequence [TeX:] $$k_{X O R}(m) \in\{0,1\}^{N_{X O R}(m)}$$ defined as in (4), where [TeX:] $$B(0)=0, \bar{k}_{B R}(m)$$ constitutes the first [TeX:] $$N_{A R}(m)$$ components of [TeX:] $$k_{B R}(m)$$ and [TeX:] $$\bar{k}_{A R}(m)$$ constitutes the first [TeX:] $$N_{B R}(m)$$ components of [TeX:] $$k_{A R}(m)$$, and finally, [TeX:] $$\overline{\bar{k}}_{B R}(m)$$ constitutes the concatenation of [TeX:] $$N_{B R}(m)$$ and the additional [TeX:] $$N_{A R}(m)-N_{B R}(m)$$ bits from the buffer. With the use of the buffer it is clear that the length of the key is shortened only if sufficient number of padding bits is not available in the buffer (as captured in the third case of (4)). Concurrently, in order to enhance the key length for the subsequent rounds, the buffer gets updated as in (5), where [TeX:] $$B(0)=0$$. Since [TeX:] $$k_{A R}(m)$$ and [TeX:] $$k_{B R}(m)$$ are uniformly distributed and statistically independent, the XOR operation in (4) provides confidentiality to the underlying secret-key [TeX:] $$k_{A R}(m)$$ from an external eavesdropper [12], [13]. As the last part of the broadcast phase, [TeX:] $$k_{X O R}(m)$$ is mapped to an L- length codeword [TeX:] $$\mathbf{c} \in \mathcal{S} \subset \mathbb{C}^{L}$$, and then sent to Node-B in the (L + 1)th coherence-block. Here, [TeX:] $$\mathcal{S}$$ denotes the chosen channel code of block-length L in order to provide reliability. Assuming [TeX:] $$\frac{1}{L} \mathbb{E}\left[|\mathbf{c}|^{2}\right]=1$$, Node-B receives
where [TeX:] $$\mathbf{n}_{B}$$ represents the AWGN, distributed as [TeX:] $$\mathcal{C} \mathcal{N}\left(\mathbf{0}_{L}, \gamma \mathbf{I}_{L}\right)$$. In addition to sending the codeword, Node-R also shares the length of [TeX:] $$k_{X O R}(m)$$ through a control channel. Then, Node-B decodes to [TeX:] $$\hat{\mathbf{C}} \in \mathcal{S}$$ using an appropriate decoder, and then recovers [TeX:] $$\hat{k}_{X O R}(m)$$. Using [TeX:] $$N_{X O R}(m)$$ (that is sent by Node-R) and [TeX:] $$N_{B R}(m)$$ (that is known during the pair- wise key generation process), the shared secret-key [TeX:] $$\hat{k}_{A R}(m)$$ is extracted as in (6), where [TeX:] $$\bar{k}_{B R}(m)$$ constitutes the first [TeX:] $$N_{A R}(m)$$ components of [TeX:] $$k_{B R}(m)$$, and [TeX:] $$u_{B R}(m)$$ are the [TeX:] $$N_{X O R}(m)-N_{B R}(m)$$ bits retrieved from the buffer B(m-1) at Node-B. The XOR operation in (6) can be viewed as successive interference cancellation (SIC) as [TeX:] $$k_{B R}(m)$$ and [TeX:] $$u_{B R}(m)$$ are perfectly known at Node-B. We highlight that [TeX:] $$u_{B R}(m)$$ was known since Node-R maintains an identical buffer as that at Node-B. After the recovery process, the buffer at Node-B also gets updated to obtain B(m) identically at Node-R. Thus, due to the proposed buffer-aided relay, [TeX:] $$N_{X O R}(m)$$ bits are communicated to Node-B during the L+1 coherence-blocks of one round. However, due to the channel conditions in the (L + 1)th coherence-block, [TeX:] $$\hat{k}_{X O R}(m)$$ is likely to be in error despite using the channel code S. As a result, we need to study the fraction of times [TeX:] $$\hat{k}_{X O R}(m)$$ is correctly decoded at Node-B.
From the description of relay-assisted protocol, it is clear that the length of the secret-key that is correctly generated between Node-A and Node-B at the mth round depends on the power-allocation factor [TeX:] $$\beta \in(0,1)$$, the LOS component [TeX:] $$c_{R} \in[0,1]$$, the signal-to-noise ratio of the two channels, and the buffer-size B(m - 1) at the end of the (m - 1)th key generation round. To characterize the best-case benefits of the buffer-aided protocol on the mth round, in the next section, we present the throughput and key rate analysis when optimal key generation algorithms are employed for pair-wise key generation between Node-A and Node-R, and Node-B and Node-R. Throughout the next section, we drop the reference to m, when referring to the keys and their lengths.
III. PERFORMANCE ANALYSIS WITH OPTIMAL KEY GENERATION ALGORITHMS
During the key generation phase of the protocol in Section II-A, Node-A and Node-R collect the set [TeX:] $$\left\{y_{A}^{(3)}(l)\right.$$, [TeX:] $$1 \leq l \leq L\}$$ and [TeX:] $$\left\{y_{R}^{(1)}(l), 1 \leq l \leq L\right\}$$, wherein [TeX:] $$y_{A}^{(3)}(l)$$ is correlated with [TeX:] $$y_{R}^{(1)}(l)$$ for each l due to channel reciprocity. On this batch of samples, we assume that an optimal key generation algorithm [35] is applied to obtain kAR, wherein optimality is measured in terms of maximizing the average key-rate, which is [TeX:] $$I\left(y_{A}^{(3)}(l) ; y_{R}^{(1)}(l)\right)$$ bits per coherence- AR block. Note that the consensus methodology used is as per Section IV of [35]. Similarly, Node-B and Node-R collect the set [TeX:] $$\left\{y_{B}^{(3)}(l), 1 \leq l \leq L\right\}$$ and [TeX:] $$\left\{y_{R}^{(2)}(l), 1 \leq l \leq L\right\}$$, and then apply an optimal key generation algorithm [35] to obtain [TeX:] $$k_{B R}$$, with average key rate [TeX:] $$I\left(y_{B}^{(3)}(l) ; y_{R}^{(2)}(l)\right)$$ per coherence-block. Since we have considered same LOS parameter [TeX:] $$c_{R}$$ for both channels, i.e., channel between Node-A and Node-R, and channel between Node-B and Node-R, both the channels are identically distributed. With the same noise variances associated with the channels, the signals observed by all nodes are identically distributed. Since the optimal key rate is obtained by computing the mutual information of pair wise observations which provides identical results for identical distributions, key lengths generated between two pairs of nodes are identical, i.e., [TeX:] $$N_{A R}=N_{B R}$$.
After the XOR operation in (4), where the first condition is always satisfied, the sequence [TeX:] $$k_{X O R}$$ has to be broadcast to Node-B in L channel-uses in the (L + 1)th coherence-block. Given that the entropy of the source is [TeX:] $$I\left(y_{A}^{(3)}(l) ; y_{R}^{(1)}(l)\right)$$ bits per coherence-block, and these bits are communicated over L channel-uses, we represent the rate of communication in bits per channel-use for the broadcast phase as
where the last equality is computed using the joint distribution of [TeX:] $$y_{A}^{(3)}(l)$$ and [TeX:] $$y_{R}^{(1)}(l)$$ [12], [19]. In (8), we define [TeX:] $$\rho \triangleq P / \gamma$$. From the joint source-channel coding theorem [34], it is well known that a source with entropy [TeX:] $$I\left(y_{A}^{(3)}(l) ; y_{R}^{(1)}(l)\right)$$ bits per sample cannot be reliably communicated over a channel with mutual information less than its entropy. Applying these results in our case, information-theoretic outage event will occur when the instantaneous mutual information of the channel between Node-B and Node-R in the (L+1)th coherence-block is less than M. In other words, the probability that the channel [TeX:] $$h_{B R}(L+1)$$ is in outage is given by
where [TeX:] $$\log _{2}\left(1+\left|h_{B R}(L+1)\right|^{2}(1-\beta) \rho\right)$$ is the mutual information of the channel from Node-R to Node-B. Since
[TeX:] $$\left|h_{B R}(L+1)\right|$$ is Rician distributed, the corresponding outage- probability [TeX:] $$P_{\text {out }}^{(B R)}$$ given in (9) can be computed in closed form. Specifically, using the cumulative distribution function (CDF) of a non-central chi-square random variable, we can write Prob [TeX:] $$\left(\left|h_{B R}(L+1)\right|^{2} \leq h\right), \text { for } h \geq 0$$, as
where [TeX:] $$Q_{1}(\cdot, \cdot)$$ is a first-order Marcum-Q function expressed as
such that [TeX:] $$I_{n}(\cdot)$$ is the nth order modified Bessel function. In the next section, we formally define a throughput metric, which captures the fraction of secret bits that are correctly recovered at Node-B.
A. Throughput Analysis
Over the L + 1 coherence-blocks, Node-B recovers LM secret bits through the relay channel whenever the channel from Node-R to Node-B is not in outage. On the other hand, Node-B recovers zero bits when the channel from Node-R to Node-B is in outage. Therefore, the average number of secret bits generated through the relay channel over L+1 coherence- blocks is [TeX:] $$M L\left(1-P_{\text {out }}^{(B R)}\right)$$.
Definition 1: To capture the fraction of secret bits that reach Node-B from Node-R, we formally define the throughput of the scheme as
where M is given in (8) and [TeX:] $$P_{\text {out }}^{(B R)}$$ is given in (9). Note that we have discarded L in the throughput expression since the latency-interval is fixed.
In the above definition, we have assumed that [TeX:] $$k_{X O R}$$ can be accurately recovered at Node-B when [TeX:] $$h_{B R}(L+1)$$ is not in outage, assuming that the channel code [TeX:] $$\mathcal{S}$$ is appropriately designed. By using (10) in (12), we get
where
Note that [TeX:] $$\Theta$$ is a function of [TeX:] $$\beta, c_{R}$$ and [TeX:] $$\rho$$. For a given [TeX:] $$\rho>0$$ and a given [TeX:] $$c_{R} \in[0,1]$$, our goal is to solve4
4We consider [TeX:] $$\beta$$ only for key generation and broadcast phases; consensus power is not considered in the optimization problem because as in lemma 4.3 of [35] power required to achieve consensus is function of [TeX:] $$\beta$$ or directly proportional to power allocated for key generation phase.
It is easy to verify that [TeX:] $$\Theta \geq 0$$ over the domain [TeX:] $$\beta \in[0,1]$$ with equality when [TeX:] $$\beta=0$$ and [TeX:] $$\beta=1$$. This is because M and [TeX:] $$Q_{1}\left(\frac{\sqrt{c_{R}}}{\sqrt{\frac{1-c_{R}}{2}}}, \frac{\sqrt{h}}{\sqrt{\frac{1-c_{R}}{2}}}\right)$$ evaluate to zero when [TeX:] $$\beta=0$$ and [TeX:] $$\beta=1$$, respectively. Before solving (15), we need to understand the behavior of [TeX:] $$\Theta$$ as a function of [TeX:] $$\beta$$. We immediately note that M is non-concave in [TeX:] $$\beta$$ and [TeX:] $$Q_{1}\left(\frac{\sqrt{c_{R}}}{\sqrt{\frac{1-c_{R}}{2}}}, \frac{\sqrt{h}}{\sqrt{\frac{1-c_{R}}{2}}}\right)$$ is the sum of infinite Bessel functions. Although the Marcum-Q function has been shown to exhibit monotonous and log-concave properties [28], the function [TeX:] $$Q_{1}\left(\frac{\sqrt{c_{R}}}{\sqrt{\frac{1-c_{R}}{2}}}, \frac{\sqrt{h}}{\sqrt{\frac{1-c_{R}}{2}}}\right)$$ is not log-concave in β since the parameter h in the second variable of the Marcum-Q function is a non-linear function of [TeX:] $$\beta$$, as shown in (14). Furthermore, we also note that the Marcum-Q function is typically expressed as an infinite sum of the modified Bessel functions of the first kind. Thus, owing to the non-concave structure of M and [TeX:] $$Q_{1}\left(\frac{\sqrt{c_{R}}}{\sqrt{\frac{1-c_{R}}{2}}}, \frac{\sqrt{h}}{\sqrt{\frac{1-c_{R}}{2}}}\right)$$, we are unable to characterize the structure of their product as a function of [TeX:] $$\beta$$. As a result, the throughput expression is mathematically intractable to derive results on the optimal power-allocation factor.
To circumvent this issue, we present a lower bound on [TeX:] $$\Theta$$, and then analyze its behavior with respect to [TeX:] $$\beta$$. Subsequently, we will show that searching for [TeX:] $$\beta$$ that maximizes this lower bound on [TeX:] $$\Theta$$ will provide throughput values close to that when maximizing the exact throughput expression.
B. Lower Bound on Throughput
In this section, we present a lower bound on [TeX:] $$\Theta$$, and then prove that the lower bound is unimodal over [TeX:] $$\beta \in(0,1)$$ under some constraints on [TeX:] $$c_{R}$$ and [TeX:] $$\rho$$.
Theorem 1: The throughput expression given in (13) is lower bounded by (16) shown at the top of next page.
Proof: In (11), the infinite series of [TeX:] $$I_{n}(\alpha \lambda)$$ can be lower bounded by considering the first dominant term as [TeX:] $$Q_{1}(\alpha, \lambda)>e^{-\frac{\alpha^{2}+\lambda^{2}}{2}} I_{0}(\alpha \lambda)>e^{-\frac{\alpha^{2}+\lambda^{2}}{2}}$$, wherethelast inequality is applicable because of the bound [TeX:] $$I_{0}(\alpha \lambda)>1$ given in [27]. Using the above lower bound on the Marcum-Q function in (13), and by substituting [TeX:] $$\alpha=\sqrt{c_{R} /\left(\frac{1-c_{R}}{2}\right)}$$ and [TeX:] $$\lambda=\sqrt{\frac{2^{M}-1}{\left(\frac{1-c_{R}}{2}\right)(1-\beta) \rho}}$$, the throughput expression is lower bounded as [TeX:] $$\log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{9+6\left(\frac{1-c_{R}}{2}\right) \beta \rho}\right) e^{-\frac{c_{R}}{2\left(\frac{1-c_{R}}{2}\right)}} e^{-\frac{\left(\frac{1-c_{R}}{2}\right) \beta^{2} \rho}{2\left(9+6\left(\frac{1-c_{R}}{2}\right) \beta \rho\right)(1-\beta)}}$$.
Since [TeX:] $$9+6\left(\frac{1-c_{R}}{2}\right) \beta \rho$$ is lower bounded by [TeX:] $$6\left(\frac{1-c_{R}}{2}\right) \beta \rho$$, we further bound the third term in the above product to get
.
With this lower bound, we now split the domain [TeX:] $$\beta \in(0,1)$$ into two parts, namely: (i) [TeX:] $$0<\beta \leq 9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$ and (ii) [TeX:] $$9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)<\beta<1$$, provided the constants [TeX:] $$\rho$$ and [TeX:] $$\left(1-c_{R}\right)$$ are such that [TeX:] $$9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)<1$$. In the latter case, when [TeX:] $$9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)<\beta$$, we have [TeX:] $$\log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{9+6\left(\frac{1-c_{R}}{2}\right) \beta \rho}\right)>\log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right)$$.
By substituting the above bound in (17), we get [TeX:] $$\Theta>\log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right) e^{-\frac{c_{R}}{2\left(\frac{1-c_{R}}{2}\right)}} e^{-\frac{\beta}{12(1-\beta)}}$$, when [TeX:] $$9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)<\beta<1$$. Similarly, when [TeX:] $$0<\beta \leq 9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$, we have the inequality [TeX:] $$\log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{9+6\left(\frac{1-c_{R}}{2}\right) \beta \rho}\right) \geq \log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{18}\right)$$. By substituting the above bound in (17), we get [TeX:] $$\Theta \geq \log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{18}\right) e^{-\frac{c_{R}}{2\left(\frac{1-c_{R}}{2}\right)}} e^{-\frac{\beta}{12(1-\beta)}}$$, when [TeX:] $$0<\beta \leq 9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$. Combining the above two cases, we obtain the lower bound on the throughput given in (16). This completes the proof.
In the rest of this section, we present three lemmas to show that the proposed lower bound in (16) is unimodal in [TeX:] $$\beta$$. This result ensures that we can apply a gradient descent algorithm of suitable step-size to find β that maximizes (16), i.e., to solve the problem:
Our approach to prove the unimodal property is to partition the interval (0,1) into three regions, namely: [TeX:] $$\mathcal{R}_{1}=\left(0, \beta_{\min }\right], \mathcal{R}_{2}=\left(\beta_{\min }, 23 / 24\right), \text { and } \mathcal{R}_{3}=[23 / 24,1)$$, where [TeX:] $$\beta_{\min }=9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$ provided [TeX:] $$c_{R}$$ and [TeX:] $$\rho$$ satisfy an appropriate constraint. Subsequently, we prove that [TeX:] $$\Theta_{L B}$$ is (i). an increasing function in [TeX:] $$\mathcal{R}_{1}$$ (given in Lemma 1), (ii). concave in [TeX:] $$\mathcal{R}_{2}$$ (given in Lemma 2), and (iii). a decreasing function in [TeX:] $$\mathcal{R}_{3}$$ (given in Lemma 3).
Lemma 1: [TeX:] $$\Theta_{L B}$$ is an increasing function of [TeX:] $$\beta$$ in the interval [TeX:] $$0<\beta \leq 9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$ provided [TeX:] $$\left(1-c_{R}\right)$$ and [TeX:] $$\rho$$ are such that [TeX:] $$\left(\frac{1-c_{B}}{2}\right) \rho>1.862$$.
Proof: When [TeX:] $$0<\beta \leq 9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right), \Theta_{L B}$$ is of the form (from (16)) [TeX:] $$\log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{18}\right) e^{-\frac{c_{R}}{2\left(\frac{1-c_{R}}{2}\right)}} e^{-\frac{\beta}{12(1-\beta)}}$$. Since the second term in the above product does not contain [TeX:] $$\beta$$, we need to show that [TeX:] $$\frac{d}{d \beta}\left(\log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{18}\right) e^{-\frac{\beta}{12(1-\beta)}}\right)>0$$, when [TeX:] $$0<\beta \leq 9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$. After differentiating the above and rearranging terms, we must prove the following equivalent inequality
Applying the inequality [TeX:] $$\log (1+x) \leq x$$ on the first term of the right hand side (RHS) of (19), it suffices to show that [TeX:] $$\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta \rho^{2}}{9} 12(1-\beta)^{2}>\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{18} \times\left(1+\frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}}{18}\right)$$.
By again rearranging the above, we need to show
in the interval [TeX:] $$0<\beta \leq 9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$. We substitute [TeX:] $$\beta=9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$ in the left hand side (LHS) of (20), and then find the range of values of [TeX:] $$\left(\frac{1-c_{B}}{2}\right) \rho$$ such that the inequality in (20) is satisfied. This implies we need to find the range of values of [TeX:] $$\left(\frac{1-c_{R}}{2}\right)$$ such that
The roots of the above quadratic equation are [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho=1.21$$ and [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho=1.862$$. It is easy to note that the inequality in(21)is satisfied when [TeX:] $$0 \leq\left(\frac{1-c_{R}}{2}\right) \rho<1.21$$ and [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho>1.862$$. Out of the two regions, note that [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho<1.21$$ leads to [TeX:] $$\beta>1,$$ and therefore this range is not applicable. On the other hand, the range [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho>1.862$$ implies [TeX:] $$\beta<0.805$$, and therefore this region is applicable. Thus, if [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho>1.862$$, the extreme ends of the interval
[TeX:] $$\beta \in\left(0,9 /\left(6\left(\frac{1-c_{R}}{2}\right)\right) \rho\right)$$ satisfy (20). Finally, since the LHS of (20) is a deceasing function of [TeX:] $$\beta$$, the inequality in (20) is satisfied when [TeX:] $$\beta$$ takes interior points of the interval [TeX:] $$\left(0,9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)\right)$$. Thus, [TeX:] $$\Theta_{L B}$$ is an increasing function of [TeX:] $$\beta$$ in the interval [TeX:] $$0<\beta \leq \beta_{\min }$$, where [TeX:] $$\beta_{\min }=9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$ provided [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho>1.862$$.
Lemma 2: [TeX:] $$\Theta_{L B}$$ is a concave function when [TeX:] $$\frac{9}{6(1-r R) \rho}<\beta<23 / 24$$ provided [TeX:] $$c_{R} \text { and } \rho$$ are such that [TeX:] $$9 /\left(6\left(1-c_{R}\right) \rho\right)<23 / 24$$
Proof: From (16), we have [TeX:] $$\Theta_{L B} \quad=\log _{2}\left(1+\left(\frac{1-c_{R}}{2}\right) \beta \rho / 12\right) e^{-c_{R} /\left(2\left(\frac{1-c_{R}}{2}\right)\right)} e^{-\frac{\beta}{12(1-\beta)}}$$. Since the second term does not contain [TeX:] $$\beta,$$ we represent [TeX:] $$\log _{2}\left(1+\left(\frac{1-c_{R}}{2}\right) \beta \rho / 12\right) \text { and } e^{-\frac{\beta}{12(1-\beta)}} \text { as } f(\beta)$$ and [TeX:] $$t(\beta)$$, respectively. Subsequently, we prove that the second derivative of [TeX:] $$f(\beta) t(\beta)$$ is negative, i.e.,
Taking the first and the second derivatives of [TeX:] $$t(\beta) \text { and } f(\beta)$$, we get [TeX:] $$\begin{aligned} \frac{d t \beta}{d \beta} &=\frac{-t(\beta)}{12(1-\beta)^{2}}, \frac{d t^{2}(\beta)}{\beta^{2}}=t(\beta) \frac{24 \beta-23}{12^{2}(1-\beta)^{4}} \\ \frac{d f(\beta)}{d \beta} &=\left(\log _{2} e\right) \frac{1}{1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}} \frac{\left(\frac{1-c_{R}}{2}\right) \rho}{12} \\ \frac{d f^{2}(\beta)}{d \beta^{2}} &=-\left(\log _{2} e\right)\left(\frac{\frac{\left(\frac{1-c_{R}}{2}\right) \rho}{12}}{1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}}\right)^{2} \end{aligned}$$
Since [TeX:] $$\frac{d f^{2}(\beta)}{d \beta^{2}} \text { and } t(\beta)$$ are always negative and positive, respectively, in the region of interest, the first term in (22) is always negative and so is the second term. Since [TeX:] $$\frac{d^{2} t(\beta)}{d \beta^{2}}<0$$ for [TeX:] $$\beta<23 / 24, \text { and } f(\beta)$$ is non-negative, it is straightforward to observe that (22) is negative in the region [TeX:] $$\beta<23 / 24 .$$. Furthermore, since the lower bound is applicable when [TeX:] $$\beta>9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)$$, we deduce that [TeX:] $$\Theta_{L B}$$ is a concave function in the interval [TeX:] $$9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)<\beta<23 / 24$$. This completes the proof.
Lemma 3: When [TeX:] $$c_{R} \text { and } \rho$$ are such that [TeX:] $$9 /\left(6\left(\frac{1-c_{R}}{2}\right) \rho\right)<23 / 24$$, the lower bound on throughput given in (16) is a decreasing function of [TeX:] $$\beta$$ in the interval [TeX:] $$23 / 24 \leq \beta<1$$.
Proof: The expression for [TeX:] $$\Theta_{L B}$$ is a product of three terms, where the second term is not a function of [TeX:] $$\beta .$$ As a result, it suffices to prove that [TeX:] $$\frac{d}{d \beta}\left(\log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right) e^{-\frac{\beta}{12(1-\beta)}}\right)<0$$, in the interval [TeX:] $$23 / 24<\beta<1$$. After differentiating the above with respect to [TeX:] $$\beta,$$ we have to prove that [TeX:] $$\begin{array}{r} \log _{2}\left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right) \frac{-e^{-\frac{\beta}{12(1-\beta)}}}{12(1-\beta)^{2}} \\ +\left(\log _{2} e\right)\left(\frac{\frac{\left(\frac{1-c_{R}}{2}\right) \rho}{12}}{1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}}\right) e^{-\frac{\beta}{12(1-\beta)}<0} \end{array}$$.
After rearranging the above terms, it suffices to prove that [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho(1-\beta)^{2}<\left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right) \log \left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right)$$. Applying the bound [TeX:] $$\log (x) \geq 1-1 / x$$ on the RHS of the above equation, we get [TeX:] $$\begin{aligned} &\left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right) \log \left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right) \\ &\geq\left(1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}\right)\left(\frac{\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}}{1+\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12}}\right) . \end{aligned}$$.
As a result proving the below inequality suffices. [TeX:] $$\begin{aligned} \left(\frac{1-c_{R}}{2}\right) \rho(1-\beta)^{2} &<\frac{\left(\frac{1-c_{R}}{2}\right) \beta \rho}{12} \\ 12(1-\beta)^{2} &<\beta . \end{aligned}$$
This further implies that we need to prove [TeX:] $$12-25 \beta+12 \beta^{2}<0$$. It can be verified that the roots of the quadratic equation [TeX:] $$12-25 \beta+12 \beta^{2}=0$$ are 3/4 and 4/3. Therefore, [TeX:] $$12-25 \beta+12 \beta^{2}>0$$ for [TeX:] $$\beta<3 / 4$$ and [TeX:] $$\beta>4 / 3$$, and also [TeX:] $$12-25 \beta+12 \beta^{2}<0$$ for [TeX:] $$3 / 4<\beta<4 / 3$$ The interval [TeX:] $$23 / 24 \leq \beta \leq 1$$ falls inside the interval [TeX:] $$3 / 4<<beta<4 / 3$$, and hence, the lower bound on throughput [TeX:] $$\Theta_{L B}$$ is a decreasing function of [TeX:] $$\beta$$ in the interval [TeX:] $$23 / 24 \leq \beta<1$$.
Theorem 2: [TeX:] $$\Theta_{L B}$$ given in (16) is unimodal provided [TeX:] $$C_{R}$$ and [TeX:] $$\rho$$ are such that [TeX:] $$\left(\frac{1-c_{R}}{2}\right) \rho>1.862$$.
Proof: The proof follows from the conjunction of results in Lemma 1, Lemma 2, and Lemma 3.
C. Simulation Results on Throughput Optimization
In this section, we present simulation results on throughput optimization when the channel offered by Node-R experiences LOS values of [TeX:] $$c_{R} \in\{0,0.1, \cdots, 0.9\}$$, and when the underlying SNR values are [TeX:] $$\rho \in\{5,10,15,20,25,30\}$$ in dB. For each combination of [TeX:] $$c_{R} \text { and } \rho$$, the power-allocation parameter [TeX:] $$\beta$$ is obtained using the following methods: (i) Maximizing [TeX:] $$\Theta$$ in (13) using a brute-force search over [TeX:] $$\beta \in(0,1)$$ in steps of 0.001, (ii) applying a gradient descent method to maximize [TeX:] $$\Theta_{L B}$$ in (16) with step-size of 0.001, (iii) using
COMPARISON OF OPTIMIZED POWER-ALLOCATION PARAMETERS [TeX:] $$\beta_{o p t}$$ AND [TeX:] $$\beta^{*}$$, WHICH ARE OBTAINED BY MAXIMIZING THE EXACT EXPRESSION OF THROUGHPUT IN (12) AND THE LOWER BOUND IN (16), RESPECTIVELY.
[TeX:] $$\beta=3 / 4$$, which corresponds to equal power-allocation for key generation and broadcast phase. In Table I, we list the values of [TeX:] $$\beta_{\text {opt }} \text { and } \beta^{*} \text {, }$$ which maximize the exact throughput expression and its lower bound, respectively. Table I highlights that the absolute values of [TeX:] $$\beta$$ offered by solving the optimization problem are different from that of uniform distribution, i.e., [TeX:] $$\beta=3 / 4$$.
In Fig. 4, we present the plots on [TeX:] $$\Theta$$, which are obtained by substituting [TeX:] $$\beta$$ from (i), (ii), and (iii). The plots highlight that at [TeX:] $$\rho=15$$ dB, the throughput values of all the three schemes are approximately same. However, at [TeX:] $$\rho=20,25$$, and 30 dB, the plots show that instead of allocating equal power to key generation and broadcast phase, the choice of [TeX:] $$\beta$$ must be made by solving the proposed optimization problem as a function of [TeX:] $$c_{R}$$ and [TeX:] $$\rho$$. In particular, Fig. 4 indicates that the gains over equal power-allocation is maximum when [TeX:] $$\rho$$ is high and [TeX:] $$c_{R}=0$$, which corresponds to Rayleigh channel between Node-R and Node-B. Furthermore, the plots show that the throughput values obtained by maximizing the lower bound is approximately same as that when optimizing the exact throughput expression.
D. Key Rate Analysis
In this section, we consider the metric of maximizing the key rate subject to an upper bound on the outage probability of the broadcast phase, given by [TeX:] $$P_{\text {out }}^{(B R)} \leq \eta$$, for some [TeX:] $$\eta>0$$. The key rate maximization problem for a given [TeX:] $$\eta>0$$ can be formally defined as below,
We consider the following lemmas to solve the optimization problem in (23).
Lemma 4: The key rate in (8) is an increasing function of [TeX:] $$\beta .$$
Proof: Taking the first derivative of (8) w.r.t [TeX:] $$\beta$$, we get [TeX:] $$\begin{aligned} \frac{d}{d \beta} M=& \frac{d}{d \beta} \log _{2}\left(1+\frac{\left(\frac{1-c_{B}}{2}\right)^{2} \beta^{2} \rho^{2}}{9+6\left(\frac{1-c_{R}}{2}\right) \beta \rho}\right) \\ =& \log _{2} e \frac{1}{9+6\left(\frac{1-c_{R}}{2}\right) \beta \rho+\left(\frac{1-c_{R}}{2}\right)^{2} \beta^{2} \rho^{2}} \\ & \times \frac{18\left(\frac{1-c_{R}}{2}\right)^{2} \beta \rho+12\left(\frac{1-c_{R}}{2}\right)^{3} \beta^{2} \rho^{3}}{9+6\left(\frac{1-c_{R}}{2}\right) \beta \rho} \end{aligned}$$. For [TeX:] $$c_{R} \in[0,1], \beta \in(0,1), \text { and } \rho>0, \frac{d}{d \beta} M$$ is always positive, and thus the key rate, M is an increasing function of [TeX:] $$\beta .$$
Lemma 5: The outage probability in (10) is an increasing function of [TeX:] $$\beta .$$
Proof: Taking the first derivative of (10) w.r.t [TeX:] $$\beta$$, gives [TeX:] $$\begin{aligned} \frac{d}{d \beta} P_{\text {out }}^{(B R)}=&-\frac{d}{d \beta} Q_{1}\left(\frac{\sqrt{c_{R}}}{\sqrt{\frac{1-c_{R}}{2}}}, \frac{\sqrt{h}}{\sqrt{\frac{1-c_{R}}{2}}}\right) \\ =& \frac{1}{1-c_{R}} I_{o}\left(\frac{2 \sqrt{c_{R} h}}{1-c_{R}}\right) e^{-\frac{c_{R}+h}{\left(1-c_{R}\right)}} \\ & \times \frac{\left(\frac{1-c_{R}}{2}\right)^{2} \beta \rho\left(18-9 \beta+6\left(\frac{1-c_{R}}{2}\right) \beta \rho\right)}{\left(9+6\left(\frac{1-c_{R}}{2}\right) \rho \beta-9 \beta-6\left(\frac{1-c_{R}}{2}\right) \beta^{2} \rho\right)^{2}} \end{aligned}$$. In the RHS on the above equation, the term [TeX:] $$I_{o}\left(\frac{2 \sqrt{c_{R} h}}{1-c_{R}}\right)>1$$ as given in [27]. The denominator of [TeX:] $$\frac{d}{d \beta} P_{\text {out }}^{(B R)}$$ is always positive. Furthermore, for [TeX:] $$\beta \in(0,1)$$, the numerator of the last product term is also always positive. Thus, [TeX:] $$P_{\text {out }}^{(B R)}$$ is an increasing function of [TeX:] $$\beta \in(0,1)$$.
With the above two lemmas, the optimization problem in (23) can be transformed into an equivalent problem, as given in the following theorem.
Theorem 3: The optimization problem in (23) has same optimal solution as that of the following problem.
Proof: Suppose that [TeX:] $$\beta^{\dagger}$$ is the solution that satisfies the outage probability equation in (24) for a given value of [TeX:] $$\eta \text {. }$$ Since the outage probability is an increasing function of [TeX:] $$\beta$$ by Lemma 5, the solutions for the outage probability inequality equation in (23) for the same value of [TeX:] $$\eta$$ will be in the interval [TeX:] $$\left(0, \beta^{\dagger}\right]$$. Furthermore, since the key rate expression (which is the objective function of (23) and (24)) is an increasing function of [TeX:] $$\beta$$ by Lemma 4, the optimal solution for the optimization problem in (23) will also be [TeX:] $$\beta^{\dagger} .$$ Thus, the optimal solution to (23) and (24) are the same.
Note that the outage probability, [TeX:] $$P_{\text {out }}^{(B R)}$$ is the complement of the first order Marcum Q-function, which is mathematically intractable. Thus, solving the root of the equality in (24) for a given [TeX:] $$\eta$$, requires a numerical approach. As a naive approach to numerically solve this problem, we need to plot the key rate along with the corresponding outage probability expression as a function of [TeX:] $$\beta$$ for a given [TeX:] $$\rho$$ and [TeX:] $$c_{R}$$ (as shown in Fig. 4). Subsequently, to determine the maximum key rate with the outage probability constraint, we should draw a horizontal line [TeX:] $$P_{\text {out }}^{(B R)}=\eta$$ on the plots and then determine the point at which this line intersects the outage probability curve. The corresponding x-coordinate of this point of intersection gives the [TeX:] $$\beta$$ value that maximizes the key rate under the constraint. However, as a formal approach to solve (24), a possible strategy is to use the well-known Newton-Raphson method [38], wherein the function [TeX:] $$P_{\text {out }}^{(B R)}-\eta$$ is used to iteratively compute the root by choosing a suitable step-size for [TeX:] $$\beta$$ in the range (0, 1).
IV. PERFORMANCE ANALYSIS WITH PRACTICAL KEY GENERATION ALGORITHMS
In this section, we discuss the buffer-aided protocol of Section II from an implementation viewpoint by considering practical key generation algorithms at the three nodes, and an empty buffer at the start of the key generation protocol.
A. Buffer-aided Relay Protocol
In this section, we adopt the relay-assisted key generation protocol discussed in Section II-A, with the exception that practical key generation algorithms are used to optimize the throughput and the key rate yard-sticks. Adopting the state- of-the art key generation protocol [29] on their observations, Node-A and Node-R, unfold each complex number into two real values. Subsequently, a two-level crossing algorithm is applied on the samples by choosing an appropriate guard band, denoted by [TeX:] $$q^{-} \text {and } q^{+}$$, such that the key miss-match rate is less than or equal to [TeX:] $$\epsilon,$$ for some [TeX:] $$\epsilon>0$$. After applying the algorithm in [29], Node-R generates a key [TeX:] $$k_{A R}$$ of length [TeX:] $$N_{A R}$$ with Node-A, and also generates a key [TeX:] $$k_{B R}$$ of length [TeX:] $$N_{B R}$$ along with Node-B. Since [TeX:] $$N_{A R} \text { and } N_{B R}$$ are random variables, we are interested in characterizing the average key lengths [TeX:] $$\mathbb{E}\left[N_{A R}\right] \text { and } \mathbb{E}\left[N_{B R}\right]$$. Towards that direction, the following lemma is straightforward to prove.
Lemma 6: With [TeX:] $$y_{A} \text { and } y_{R}$$ denoting the real sample of a coherence-block between Node-A and Node-R, the probability that the two samples are in consensus is [TeX:] $$p_{\epsilon}=\iint_{y_{A}, y_{R} \notin(q-, q+)} f\left(y_{A}, y_{R}\right) d y_{A} d y_{R}, \text { where } f\left(y_{A}, y_{R}\right)$$ denotes the joint density function of [TeX:] $$y_{A} \text { and } y_{R}, \text { and } q+\text { and } q-$$ represent the threshold levels of the guard band of the two- level crossing algorithm.
The consensus probability for samples between Node-B and Node-R is also [TeX:] $$p_{\epsilon}$$ since the two channels are identically distributed. With 2L real samples subject to the two-level key generation algorithm, and since each real sample is statistically identical and independent, the key length between a pair of nodes is equal to the number of real samples in consensus. Thus, we note that both [TeX:] $$N_{A R} \text { and } N_{B R}$$ are independent Binomial random variables defined as [TeX:] $$N_{A R}$$ ~ [TeX:] $$\mathcal{B} i n\left(2 L, p_{\epsilon}\right), \text { and } N_{B R} \sim \mathcal{B} i n\left(2 L, p_{\epsilon}\right)$$, and therefore, we have [TeX:] $$\mathbb{E}\left[N_{A R}\right]=\mathbb{E}\left[N_{B R}\right]=2 L p_{\epsilon}$$. In case, a multi-level crossing algorithm is used for key generation [31], the average key length will be multiplied by [TeX:] $$f, \text { where } 2^{f}$$ is the number of levels of the quantizer. From the buffer-aided relay model, the length of [TeX:] $$k_{X O R}$$ depends on the difference between [TeX:] $$N_{A R}$$ and [TeX:] $$N_{B R}$$, and the size of the buffer at that point. In practice, the buffer may not have sufficient bits, and therefore, we expect [TeX:] $$N_{X O R}$$ to be less than [TeX:] $$N_{A R}$$ in some rounds of the key generation protocol. In the next section, we revisit the broadcast phase of the relay model in order to compute [TeX:] $$\mathbb{E}\left[N_{X O R}\right]$$ with buffer constraints.
B. Broadcast Phase with Buffer Constraints
We recollect from Section II-A that the buffer bits at Node-R are the unused bits in consensus between Node-B and Node-R from the previous rounds of the key generation protocol. To incorporate practical constraints on the buffer for analyzing the throughput and key rate, we incorporate the round number [TeX:] $$m \geq 0$$ when referring to the buffer size, keys and their lengths. Consequently, [TeX:] $$B(m), N_{A R}(m), N_{B R}(m), N_{X O R}(m)$$ denote the buffer size, the pair-wise key lengths, and the length of the sequence [TeX:] $$k_{X O R}(m)$$ broadcast to Node-B at the end of the mth round. With these definitions, we immediately note that [TeX:] $$N_{A R}(m), N_{B R}(m)$$ are statistically independent across m, whereas [TeX:] $$B(m) \text { and } N_{X O R}(m)$$ are statistically dependent across m because the latter numbers depend on B(m - 1), [TeX:] $$N_{A R}(m) \text { and } N_{B R}(m)$$. In particular, with the updates in (4) and (5), we broadly have three types of schemes, namely:
• The optimal scheme, wherein [TeX:] $$B(m)=\infty, \forall m$$, • The min-scheme, wherein [TeX:] $$B(m)=0, \forall m, \text { and }$$ • The intermediate scheme, where [TeX:] $$B(0)=0 \text { for } m=0$$.
We note that the optimal scheme is such that [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]=\mathbb{E}\left[N_{A R}(m)\right]=2 L p_{\epsilon}$$, for all m, whereas the min-scheme is such that [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]=\mathbb{E}\left[\min \left(N_{A R}(m), N_{B R}(m)\right)\right]$$ for all m. Given that the intermediate scheme makes use of the buffer as and when available, it is intuitive that [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$ of the intermediate scheme should lie in between that of the optimal scheme and the min-scheme. Moreover, unlike the optimal scheme and the min-scheme, we expect that [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$ for the intermediate scheme changes as a function of m since [TeX:] $$\{B(m) \mid m \geq 0\}$$ is a non-stationary random process. Towards understanding the behavior of [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$ of the three schemes, we present simulation results to compute the average key lengths of their broadcast phase, i.e., [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$ for various values of m. In Fig. 5, we plot the average key lengths of all the three schemes as a function of m for the
On the left: Plots of throughput when [TeX:] $$\beta$$ is optimized using (i) [TeX:] $$\Theta_{\text {exact }}$$, the exact throughput expression in (12), (ii) the lower bound [TeX:] $$\Theta_{L B}$$ given in (16), and (iii) [TeX:] $$\Theta_{\text {uniform }}$$, which corresponds to equal power-allocation for the key generation phase and the broadcast phase. On the right: Plots of key rate and its outage probability as a function of [TeX:] $$\beta$$ with various values of [TeX:] $$\rho \text { and } c_{R}$$, while considering that block length is asymptotically large.
channel condition [TeX:] $$\rho=20 \mathrm{~dB}, \beta=0.6, \text { and } c_{R}=0.2$$. Furthermore, under the intermediate scheme, we plot the average key lengths for various buffer switch-on time-instants. In this context, the buffer switch-on time is the round index of the key generation protocol until which the min-scheme is active, i.e., the buffer is allowed to grow from m = 0 till the switch-on instant whenever [TeX:] $$N_{A R}(m)<N_{B R}(m)$$. To generate the simulation results, the buffer switch-on time were {0, 10, 30, 50, 100, 150}. From the simulation results, we observe that the intermediate scheme achieves the optimal scheme when the buffer is switched-on at {100,150}, and it is apparent that we do not need to wait longer than m = 100 to achieve the optimal key length. Inspired by the observations made in Fig. 5, we would like to theoretically analyze the key lengths, i.e., [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$ for any given m, offered by the three variants. Note that the average key lengths of these regimes are different from that of the asymptotic case because these average key lengths are from using a practical key generation algorithm as opposed to the optimal one as discussed in Section III. In order to characterize [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$, we need to understand the probability mass function (PMF) on the difference between [TeX:] $$N_{A R}(m)$$ and [TeX:] $$N_{B R}(m)$$ (which are individually binomially distributed and statistically independent), and also the PMF on B(m). In the following lemma, we present the PMF on D(m) [TeX:] $$\underline{\Delta} N_{A B}(m)-N_{B R}(m)$$ by dropping the index m since D(m) is identically distributed across m.
Lemma 7: Given [TeX:] $$N_{A R}, N_{B R} \sim \mathcal{B} i n\left(2 L, p_{\epsilon}\right)$$ and are statistically independent, the PMF on [TeX:] $$D=N_{A R}-N_{B R}$$, i.e., P (D = d), for [TeX:] $$-2 L \leq d \leq 2 L$$, can be computed as in (25).
In the following lemma, we provide a way to construct the PMF on B(m) for any [TeX:] $$m \geq 1$$.
Lemma 8: Assuming that the buffer is switched-on at round [TeX:] $$m^{\prime}$$, the PMF on B(m) can be computed in closed-form for any [TeX:] $$m>m^{\prime}$$.
Proof: Throughout the proof, we use n = 2L. Let [TeX:] $$B\left(m^{\prime}\right)=B_{0}<n$$ be the size of buffer at the time when buffer is switched on. At the [TeX:] $$\left(m^{\prime}+1\right)$$th round of key generation, we have
where [TeX:] $$B\left(m^{\prime}+1\right)=N_{A R}\left(m^{\prime}+1\right)-N_{B R}\left(m^{\prime}+1\right)$$ is a random variable which has a support set, [TeX:] $$\mathcal{S} u p p\left(B\left(m^{\prime}+1\right)\right)=\left[0, B\left(m^{\prime}\right)+n\right] . \text { Since } B\left(m^{\prime}\right)$$. Since [TeX:] $$B\left(m^{\prime}\right)$$ is a constant, the PMF of [TeX:] $$B\left(m^{\prime}+1\right)$$ can be easily determined using the PMF of [TeX:] $$D\left(m^{\prime}+1\right)$$ as in (26), where b1 is a realization of [TeX:] $$B\left(m^{\prime}+1\right)$$. At the [TeX:] $$\left(m^{\prime}+j\right)^{t h}$$ round of key generation, for [TeX:] $$j \geq 2$$, the buffer size is updated using the distribution on [TeX:] $$B\left(m^{\prime}+j-1\right)$$ as given in (27), where [TeX:] $$\mathcal{S} u p p\left(B\left(m^{\prime}+j\right)\right)=\left[0, B\left(m^{\prime}\right)+j n\right]$$. Defining a new random variable [TeX:] $$Y\left(m^{\prime}+j\right)=B\left(m^{\prime}+j-1\right)-D\left(m^{\prime}+j\right)$$ whose PMF can be determined, the PMF of [TeX:] $$B\left(m^{\prime}+j\right)$$ can be determined as below by using [TeX:] $$b_{j}$$ as a realization of [TeX:] $$B\left(m^{\prime}+j\right)$$.
This completes the proof. Using the PMFs on D(m) and B(m), in the following theorem, we provide a closed form expression on the average
Plots of average key lengths as a function of time for SNR [TeX:] $$\rho=20$$ dB, power optimization parameter, [TeX:] $$\beta=0.6$$ LOS parameter, [TeX:] $$c_{R}=0.2$$, and number of coherence-blocks, L = 100 for variable bits available in the buffer at different instants of time.
key length of the intermediate that has [TeX:] $$B(m-1)=b_{m-1}$$ bits in the buffer for the mth round.
Theorem 4: Given that [TeX:] $$B(m-1)=b_{m-1}$$, for some fixed [TeX:] $$b_{m-1}>0$$, the average key length of the buffer-aided practical key generation scheme for the mth round is given by (30), where [TeX:] $$P_{N_{A R}(m)}(\cdot) \text { and } P_{N_{B R}(m)}(\cdot)$$ denote the evaluation of PMF of [TeX:] $$N_{A R}(m) \text { and } N_{B R}(m)$$ at a particular realization, respectively.
Proof: By definition, [TeX:] $$N_{X O R}(m)$$ is given by
Since [TeX:] $$b_{m-1}$$ is a constant, we can use the joint probability mass function of [TeX:] $$N_{A R}(m) \text { and } N_{B R}(m)$$, denoted by [TeX:] $$P_{N_{A R}(m), N_{B R}(m)}(\cdot \cdot \cdot)$$, to compute [TeX:] $$\mathbb{E}\left[N_{X O R}(m) \mid B(m-1)=\right.$$[TeX:] $$\left.b_{m-1}\right]$$ as below:
wherein [TeX:] $$z_{1} \text { and } z_{2}$$ run through different realizations of [TeX:] $$N_{A R}(m) \text { and } N_{B R}(m), \text { while } z$$ takes the appropriate value depending on [TeX:] $$z_{1}, z_{2} \text { and } b_{m-1}$$, as defined in (31). This completes the proof.
Finally, using the above result, the overall average key length for the mth round can be computed as in (33). As a special case of the above expression, we can also obtain average key length of the optimal scheme and min-scheme. In particular, to obtain the optimal scheme as a special case, applying [TeX:] $$B(m)=\infty, \forall m$$ (4), we observe that [TeX:] $$N_{A R}(m)-N_{B R}(m)>B(m-1)$$ never happens, and therefore, we have
Note that the above expression corresponds to the black curve in Fig. 5. Similarly, we can also obtain the average key length of the min-scheme by using [TeX:] $$B(m)=0, \forall m$$. As a result, we get (34). We now need to use [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right], \text { for } m \geq 1$$, to compute the power-allocation parameter [TeX:] $$\beta$$ such that the throughput is maximized or the key rate is maximized subject to the outage probability constraint in the broadcast phase.
hroughput and Key Rate Analysis
Based on our protocol for the mth round, the key generation phase is executed with [TeX:] $$\beta \in(0,1)$$, after which Node-R has an average of [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$ secret bits from the first L
coherence-blocks. In the (L + 1)th coherence-block, Node-R communicates this message using a code of block-length L with rate [TeX:] $$R=\frac{\mathbb{E}\left[N_{X O R}(m)\right]}{L}$$, such that the average power per channel use is [TeX:] $$(1-\beta) P$$ Towards studying the error performance of the code used for the broadcast phase, the outage probability expression of Section III is no longer applicable since L need not be large in practice. As a result, we apply the corresponding non-asymptotic outage probability results of [30] to compute [TeX:] $$P_{\text {out }}^{(B R)}(m)$$ as a function of [TeX:] $$\beta$$. Formally, [TeX:] $$P_{\text {out }}^{(B R)}(m)$$ can be computed as
where [TeX:] $$\Gamma=\left|h_{B R}\right|^{2}(1-\beta) \frac{P}{\gamma}$$ is the instantaneous SNR of the wireless channel, [TeX:] $$(1-\beta) P$$ is the average power per channel use, R is the code rate, [TeX:] $$f_{\Gamma}(.)$$ is the probability density of the instantaneous SNR [TeX:] $$\Gamma, C(\Gamma)=\log _{2}(1+\Gamma)$$ is the Shannon channel capacity, [TeX:] $$V(\Gamma)=\frac{\Gamma}{2} \frac{\tilde{\Gamma}+2}{(\Gamma+1)^{2}} \log _{2}^{2} e$$ is the back-off factor for finite block-length, and finally, [TeX:] $$Q(x)=\frac{1}{2 \pi} \int_{x}^{\infty} e^{-\frac{u^{2}}{2}} d u$$ When using a practical key generation algorithm along with finite block length code, we observe that both the average key length [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$ and the outage probability [TeX:] $$P_{\text {out }}^{(B R)}(m)$$ are not available in closed-form, and therefore, we solve the optimization problem [TeX:] $$\arg \max _{\beta \in(0,1)} \mathbb{E}\left[N_{X O R}(m)\right]\left(1-P_{\text {out }}^{(B R)}(m)\right)$$ using simulation results.5
5Consensus power is not considered in the optimization problem as in the similar case of asymptotic analysis.
To generate the simulation results, we fix L = 100, min-scheme subject to outage probability, Pout = 10 . Overall, the simulation results of this section have shown that the optimal scheme with the help of the buffer outperforms the min-scheme [12], [13], [15], [19]. and then vary the value of [TeX:] $$\beta \in(0,1)$$ at discrete steps to compute [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]\left(1-P_{\text {out }}^{(B R)}(m)\right)$$ for both the optimal scheme and the min-scheme. These simulations are presented in Fig. 6 for the LOS parameters [TeX:] $$c_{R}=[0,0.6]$$ and SNR, [TeX:] $$\rho=[15,20,25,30]$$ in dB. We observe that the optimal value of [TeX:] $$\beta$$ that maximizes the throughput is close to [TeX:] $$\beta$$ = 0.9, and this behavior is unlike the throughput analysis for the asymptotic case. This difference is because of two factors: first, in the broadcast phase the generated key is encoded using a strong channel code of block-length L, and second, the rate of increase of [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right] \text { as } \beta$$ increases is low due to two-level quantizer employed in key generation process. In general, when either a multi-level crossing algorithm is used for key generation, or when the codes used for the broadcast is uncoded, we expect the optimal value of [TeX:] $$\beta$$ to reduce. We also observe from the plots that the optimal scheme outperforms the min-scheme in throughput [12], [13], [15], [19]. For instance, in Fig. 6 when [TeX:] $$\rho=15 \mathrm{~dB} \text { and } c_{R}=0$$, optimal scheme with optimal power allocation yields 8% increase in throughput, in comparison to min-scheme with equal power allocation.
Similar to the key rate analysis for the asymptotic case in Section III-D, in Fig. 6, we plot the average key length and outage probability for the case of short block-lengths. We observe that both the average key length and the outage probability increase as [TeX:] $$\beta$$ increases. To determine the optimal value of [TeX:] $$\beta$$ that provides maximum key rate subject to given outage probability, we suggest drawing a horizontal line which corresponds to the given outage probability constraint, and then the x-coordinate of the intersection point of the line gives the optimal [TeX:] $$\beta$$ value. The plots in Fig. 6 show that for a given outage probability constraint, the optimal scheme provides higher key rate compared to the min-scheme, which is none other than the existing buffer-less key generation method [12], [13], [15], [19]. This behavior can be attributed to the fact that although the optimal scheme provides higher values of [TeX:] $$\mathbb{E}\left[N_{X O R}(m)\right]$$, the corresponding difference in the rate does not result in significant changes in the outage probability. For instance, in Fig. 6 when [TeX:] $$\rho=15 \mathrm{~dB}, c_{R}=0$$, optimal scheme yields 9% increase in average key length, in comparison to min-scheme subject to outage probability, [TeX:] $$P_{\text {out }}^{(B R)}=10^{-2}$$. Overall, the simulation results of this section have shown that the optimal scheme with the help of the buffer outperforms the min-scheme [12], [13], [15], [19].
V. BUFFER-AIDED PROTOCOL WITH ASYMMETRIC LOS CHARACTERISTICS
In Section II, we introduced a network model wherein the LOS parameters of the channels between Node-A and Node-R, and Node-B and Node-R are identical (denoted by [TeX:] $$\left.c_{R} \in[0,1]\right)$$. As a result, without loss of generality, the key generated between Node-A and Node-R during the key generation phase is broadcast to Node-B, although the roles of Node-A and Node-B could have been swapped. However, if a relay network is such that the channels between Node-A (or Node-B) and Node-R have different LOS parameters, then
On the left: Plots of throughput as a function of [TeX:] $$\beta$$ with various values of [TeX:] $$\rho \text { and } c_{R}$$. The legend in the fourth subplot applies to all subplots of left side. On the right: Plots of average key length and its outage probability as a function of [TeX:] $$\beta$$ with various values of [TeX:] $$\rho \text { and } c_{R}$$. Note that four legends in each subplot apply to all subplots.
appropriate modifications on the buffer-aided protocol must be discussed. Towards that direction, the following proposition states that higher the LOS parameter of the channel, lower is the key rate offered by the PLK generation.
Proposition 1: The mutual information [TeX:] $$I\left(y_{A}^{(3)}(l) ; y_{R}^{(1)}(l)\right)$$ in (8) is a decreasing function of [TeX:] $$c_{R} \in[0,1]$$.
To formally discuss the modifications needed on the buffer-aided protocol, let [TeX:] $$c_{A R} \in[0,1] \text { and } c_{B R} \in[0,1]$$ represent the LOS components of [TeX:] $$h_{A R} \text { and } h_{B R},$$, respectively. Furthermore, suppose that [TeX:] $$c_{A R}<c_{B R}$$. During the key generation phase of the protocol, it is clear from Proposition 1 that the pair-wise keys [TeX:] $$k_{A R} \text { and } k_{B R}$$ are such that [TeX:] $$N_{B R}<N_{A R}$$ with high probability in each round of the protocol. As a result, even if the relay assisted key generation is executed over several rounds to fill the buffer with unused bits of [TeX:] $$k_{B R},$$ there will not be sufficient bits to provide confidentiality to achieve [TeX:] $$N_{A R}$$ as the key length. Thus, choosing [TeX:] $$k_{B R}$$ as the key for broadcast is the best strategy, and hence, buffers are no longer useful. Note that the key [TeX:] $$k_{B R}$$ should not be broadcast to Node- A through [TeX:] $$h_{A R}$$ because transmitting a message over lower LOS channel results in higher values of outage probability compared to transmitting over a channel with higher LOS parameter. Because of this result, we propose that Node-R uses the first [TeX:] $$N_{B R} \text { bits of } k_{A R},$$ and then broadcast an XOR version to Node-B. This way, both the key-rate of the key generation phase as well as the outage probability of the broadcast phase are functions of the LOS parameter [TeX:] $$c_{B R}$$. Consequently, the optimization problems for throughput and key rate for this case can be solved by applying the techniques in Section III and Section IV, however, by replacing [TeX:] $$c_{R} \text { with } c_{B R} \text {. }$$ Overall, we have shown that the power-allocation strategies proposed in this work are also applicable to a relay network when the LOS components of the two channels are different.
VI. SUMMARY
We addressed a key generation scenario wherein two wireless devices seek the assistance of a trusted relay to generate secret-keys. To handle the reduction in key rate due to XOR based broadcast, we have proposed buffer-aided key generation protocol at the relay wherein the unused secret bits generated between the relay and one of the nodes can be temporarily stored in a buffer before using them to provide the confidentiality feature for the broadcast phase in the subsequent rounds. We have also proposed power allocation policies between the key generation phase and broadcast phase by optimizing the overall key rate and throughput in different scenarios: (i) Optimal or practical key generation methods and (ii) empty buffer at the start of algorithm. Simulation results show that using buffer results in remarkable benefits when the LOS of the two channels are close.
Towards implementing the strategies proposed in this work, the knowledge of the LOS component is required for choosing an appropriate value of the power-allocation factor. In practice, we believe that this could be achieved in the following way. Before a pair of nodes initiates the key generation process, each node processes to detect the LOS component by estimating the fading channel characteristics. For instance, the techniques mentioned in [36], [37] could be used since LOS component is usually a long-term characteristic of the channel. Subsequently, for every round of secret key generation, each node could use the corresponding optimal power allocation parameter (solved using our proposed scheme) against the detected LOS component. One way to implement this in practice is to store a table of the power allocation parameter values and the LOS values a priori in the memory of the devices. With this stored information, in the subsequent rounds of secret key generation and distribution, the three nodes could allocate the power for their transmission by looking up the table in the memory.