Can Frequency Diverse Array Prevent Wireless Eavesdropping for techRxiv

,


I. INTRODUCTION
Directional Modulation (DM) is a type of keyless physical-layer wireless security technique, which, in its original form, is able to transmit desired signal waveforms with information modulated only along pre-selected directions, while distorting the waveforms along all other spatial directions in free space [1]- [4].In this fashion the information transmitted wirelessly in free space can only be reliably recovered by legitimate receivers positioned along those selected directions, enhancing security directly at physical layer.The technique is very attractive for security applications of modern radio systems, as it does not require mathematically generated cryptographic keys and supports a very simple receiver's architecture.However, the biggest issue for real-life applications is its inability to provide security in range-domain when line-of-sight (LoS) communication links are concerned, i.e. any eavesdropper located at the same direction as the legitimate receiver is able to intercept the information that is supposed only for the legitimate receiver.
Recent theoretical works in [5]- [15] attempted to solve this problem.The proposed solutions combine DM with a Frequency Diverse Array (FDA) -a technique used in radar systems to illuminate target at a given range with a multi-frequency signal of short duration.If successful, the combination of FDA-DM would have allowed unprecedented levels of wireless security, offering to securely transmit information to almost any wireless device without the need for traditional cryptographic encryption algorithms, avoiding problem of key distribution.
Despite promising theoretical results, to the best of the authors' knowledge, currently there is no experimental validation of the FDA-DM that demonstrates its alleged security in range domain.This mismatch between theoretical and experimental work decelerates further development of DM, as the combination of FDA with DM so far did not deliver on its promise of security without encryption.However, a brief observation was made in [16], [17] relating to the potential problem of time-invariance of FDA systems in the context of radiation-pattern optimization.
This paper provides the first in-depth analysis into the mechanisms of the FDA-DM security in range domain.It significantly extends the analyses provided in [5]- [15] in order to include a more generic approach with time as the third missing variable.Proposed analysis demonstrates that the so obtained security in range-domain cannot be time-invariant and that the "secure region" propagates with time.The provided results are generic for any FDA-based security technique, regardless of the antenna structure and secrecy metric used.

II. FREQUENCY DIVERSE ARRAY
The concept of FDA was first introduced in [18], [19].It employs array elements that radiate electromagnetic waves with slightly different frequencies, where the frequency differences are assumed to be many orders smaller than the reference carrier frequency.Fig. 1 illustrates a one-dimensional (1D) uniformly spaced N-element FDA with a linear carrier frequency increment ∆f applied across the array.The first array element is taken as the reference with its excitation at the carrier frequency f0.Here ∆f << f0.
Illustration of a 1D FDA with uniform frequency increment ∆f.
It was presented in [18] and [19] that the 'beamforming patterns' are angle-range dependent.Two aspects need to be emphasized; 1) The term 'beamforming patterns' used in [18] and [19] is not the same concept as the 'far-field radiation patterns' commonly used in the literature on antenna engineering, since the latter by definition refers to single frequency [20].The 'beamforming patterns' can be instead interpreted as 'normalized electric (or magnetic) field distribution in the far-field'; 2) The 'beamforming patterns' are also a function of time.Since in [18] and [19] the radiated waveforms were designed to be very short  [18] and [19] are not snap-shots at a certain time instant, but a series of snap-shots presented as a function of single parameter that combines time and range as t = R/c.This angle-range dependent 'beamforming patterns' of the pulsed FDA have been extensively investigated since then, resulting in a number of promising pulsed FDA Radar systems, seen in [21]- [23] and references therein.However, contrary to Radar applications, in order to establish a wireless communication link (the scope of the FDA systems studied in this paper), a continuous electromagnetic wave needs to be transmitted to carry information.Thus, the detected electric (or magnetic) field at each angle-range coordinate varies with time, i.e. 'beamforming patterns' are functions of angle, range and time.
In the meantime, another research effort on Directional Modulation (DM) was made in the antenna and propagation community.Most early DM works could only securely transfer narrow band signals.Therefore, the authors in [24] made the first effort in combining FDA with DM so that an OFDM modulated DM system was constructed.
Here, the FDA transmits signal waveforms continuously in time, different to pulsed signals for FDA Radar applications.No range-domain security was claimed in [24].
Inspired by the FDA range-angle dependent beamforming patterns, and its first introduction to the DM systems, many recent research efforts have been focused on using FDA concept to secure free space DM systems in range domain, e.g.[5]- [7], resulting so-called FDA-DM systems.However, an important factor was overlooked, since the FDA range-angle dependent beamforming patterns are also functions of time.This indicates that the secure reception regions (normally defined as the locations where the received bit error rates (BERs) are below a specified threshold) propagate in range as time elapses.This is analyzed in more detail in the subsequent section.

III. DM AND FDA IN THEIR GENERAL FORMS
In this section, we present mathematical modelling of both DM and FDA in their general forms, from which the previously reported FDA-DM fusion systems can be derived in Section III, leaving their discussions revealing the flaws in Section IV.

A. DM
For a 1D N-element transmit array, e.g. the one shown in Fig. 1 with ∆f being set to zero, the received far-field electric (or magnetic) field F can be expressed as where H = [H1, H2, …, HN] is the channel vector, and '[•] T ' refers to vector transpose operator.d is the uniform spacing between two consecutive array elements.r1 denotes the displacement between the first antenna (as the reference) and the far-field observation point.θ is the spatial direction with respect to the array, ranging from 0 to π defined in Fig. 1.In order to achieve DM functionality [2], in general form the array excitation vector G is designed to be ( ) Here D is a complex number, representing a symbol (i.e.information modulated in IQ space) intended for transmission.Vector W is power normalized, i.e. † WW = 1, and it lies in the null space of channel vector ( ) ( ) vector Hermitian transpose, respectively.θ0 is the desired secure communication direction.p and q determine the power allocation between useful information D and orthogonal artificial noise W .When inserting (2) into (1), we get ( ) ( ) ( ) From (3), we can see that the information D (or associated modulation waveforms) are transferred to the legitimate user along θ = θ0, while for other directions the information D are contaminated with the randomly updated artificial noise W , greatly reducing probability of interception.

B. FDA
In this subsection, we mathematically describe how an FDA, shown in Fig. 1, operates.The radio frequency (RF) carrier frequency applied at each antenna element is For this uniformly spaced 1D FDA array, the received (pathloss being normalized out) far-field electric (or magnetic) field B along a spatial direction θ in free space can be written as where An = Dvnexp(jφn) is the excitation of the n th array element, with scalar valued vn of amplitude and φn of phase in its initial state.Without loss of generality, vnexp(jφn) is set to be unity for each n.
The phase term ϕn, seen in ( 5) can be further expressed as The last term in the bracket in ( 6) is extremely tiny for practical FDA configurations.For example, when ∆f = 10 kHz, f0 = 3 GHz, d = c/(2f0), and N = 10, this last phase term is less than 0.05º.This term is thus omitted hereafter.The phase difference with respect to the signal radiated by the first antenna is The beamforming pattern B in (5) reaches its peaks when the phases of every summation terms are aligned.It requires ∆n to be 2knπ for each n.kn can be any arbitrary integers.Equivalently, This shows how the beamforming pattern peaks change with angle θ, range r1, and time t.When ( 8) is satisfied, which means the information D is delivered to the coordinate (θ, r1) at the time instant t, with a beamforming gain of 20log10(N) in dB.Since z can be any integer, there are infinite solutions to (8), meaning no wireless security can be achieved with FDA alone.

IV. PREVIOUSLY REPORTED FDA-DM SYSTEMS
When realizing FDAs can generate angle-range dependent beamforming patterns, plenty of efforts have been made to incorporate FDA concept into DM transmitters [6]- [11], claiming that the information D can be securely delivered to a pre-specified angle-range coordinate, saying (θ0, R).The general form of the resulting FDA-DM systems reported in previous works is formulated in this section.
Note: In Section IV, the authors will argue that the resulting FDA-DM systems, however, CANNOT secure information in range domain as what the reported works have claimed.This is because an important fact that FDA beamforming patterns at each spatial location are time-dependent was overlooked.
Combining FDA and DM, namely applying baseband DM excitation vector G in (2) onto the frequency shifted RF carriers in (5), the electric (or magnetic) field in any far-field location (θ, r1) becomes Here Gn is the n th entry of the vector G .Replacing Gn in (2) into (10), we get where Wn is the n th entry of the vector W .The same tiny phase as the last term in ( 6) is safely ignored here.
The previously reported FDA-DM works [5]- [11] claimed that for a desired receiver's located at (θ0, R) the information D can be uniquely conveyed to the desired receiver at (θ0, R) only.This is under assumption that the receiver samples signals at a reference time t = 0, when ∆f of the transmitted signal is designed to be c/R.In these conditions, (11) becomes ( ) For locations other than (θ0, R), the second summation in ( 11) is non-zero at t = 0, acting as orthogonal artificial noise in both angle and range domains.
A simulation example of ( 11) is illustrated in Fig. 2 with FDA-DM system parameters listed in Table I.From Fig. 2, it can be seen that the QPSK modulated waveforms are only preserved in a pre-identified   11) is not a function of range (excluding the identical time harmonic term at f0 for every n), indicating no artificial noise is injected in range domain; b) when q = 0 (irrespective of the choice of ∆f), the second summation term in ( 11) is zero, indicating no artificial noise is injected in both angle and range domains.Readers can perform the simulations to verify the special cases if interested.The results are omitted here for brevity.The secure reception region can be further shrunk by increasing the number of antenna elements N and/or by allocating more power to artificial noise (i.e.increasing the ratio q/p), which are common strategies used in DM systems [2].

TABLE I SYSTEM PARAMETERS OF
The above common proposition claimed in previous FDA-DM works will be rebutted in the following section.

V. SECURE RECEPTION REGIONS 'PROPAGATE' IN RANGE AS TIME ELAPSES IN FDA-DM SYSTEMS
In this section, the authors argue that the constructed FDA-DM systems, formulated in (11), CANNOT secure wireless transmissions in range domain.The misinterpretation of (11) was rooted in the treatment of time t.Like the example shown in Fig. 2, the previous FDA-DM works use far-field patterns in 2D angle-range domain at a selected time reference when the legitimate receiver samples detected signals, to claim the secure transmission in range domain.Thus, the patterns, such as those plotted in Fig. 2, are the field distributions at that chosen time instant.
Two problems are associated with this time treatment; 1) At the legitimate receiver end, in order to perform demodulation, the entire modulation symbol with a symbol period T is frequency down-converted first, before baseband sampling.Within this T, the (b) Fig. 3. Simulation example of previously reported FDA-DM system in its general form in (11).System parameters are listed in Table I  term exp[j2π(n−1)∆f(t−r1/c)] in the second summation in (11) is not identical for each n, indicating the artificial noise cannot be perfectly cancelled out at the selected location (θ0, R).The amount of the remaining artificial noise for the legitimate receiver is determined by the system parameters, in particular N, ∆f, and T. This aspect has never been studied, while the second problem discussed below is more critical, which invalidates the previously reported FDA-DM systems; 2) The early FDA-DM works used the beamforming patterns at the selected time instant to calculate secure reception regions, claiming range-domain wireless security.However, the eavesdroppers do not necessarily sample the signals at the same time instant as the desired receiver does.Taking the same FDA-DM example with the settings in Table I (except time t), the simulated range-domain far-field patterns at the time instant t = (Re − R)/c = (36 km -30 km)/c = 210 −5 s are illustrated in Fig. 3.It is assumed that an eavesdropper receiver is positioned at (θe = θ0 = 40º, Re = 36 km).From Fig. 3, it can be clearly seen that the secure reception region (for this example it is the location where the well-formatted QPSK IQ constellations/waveforms are preserved) 'propagates' at the speed of light, as time elapses.Similarly, when θe = θ0 and Re < R, the well-preserved signal waveforms pass the eavesdropper at the time instant (R − Re)/c ahead the time reference.To conclude, NO secure transmissions in range domain can be achieved by the previously reported FDA-DM systems.
Another intuitive explanation of why the FDA-DM systems cannot provide range-domain security is presented below: Assuming a legitimate receiver positioned at (θ0, R) in free space detects electromagnetic waves which correspond to desired modulation symbols, these electromagnetic waves, spatially combined by each electromagnetic wave radiated from each transmit antenna, propagate at the speed of light along θ0, irrespective of their frequencies.Therefore, the same signal waveforms (subject to magnitude scaling) detected by the legitimate receiver reach every points along θ0 at different time instants when the far-field condition is met.From this observation, it can be concluded that any FDA-DM arrangements, including their variants CANNOT provide secure wireless transmission in range domain in free space.
Next, we briefly list the issues in some recent FDA-DM literatures; • [5]- [11]: A time dependent phase term (i.e.αn shown in (7) in this paper) was missing in {(5) in [5]; (4) in [6]; (2) in [7]; (3) in [8]; (6) in [9]; (4) in [10]; (2) in [11]} and all the analyses thereafter.This indicates that an assumption t = 0 was made for every receiver in the field.In other words, the authors in these works enforce legitimate and eavesdropping receivers sampling signals at the same instant, leading to erroneous conclusions; • [12]: The authors used the same time instant to sample the received signals at both legitimate and eavesdropping receivers, see (11) and ( 12) in [12]; • [13]: From (10) in [13], the author claimed that the radiation energy is focused at (θ in , R). Mathematically, this can only be obtained when t = 0.In fact, when t varies, it can be seen that this focusing point propagates at the speed of light in range domain; • [14], [15]: In {(9) in [14]; (4) in [15]}, the time 't' in the denominator is the time reference the authors selected (when the legitimate receiver samples signals), while the time 't' in the numerator should be the time instant when each receiver samples their detected signals.These two time 't' are not necessarily identical.In fact, when different 't' in numerator is chosen, it can be observed that the spatial focusing region propagates; • [25]: In fact, the Fig. 2 in [25] and the associated discussions clearly shown that the secure reception region propagates at the speed of light in range domain.However, the authors claimed that if the array excitation vector changes accordingly, the secure region does not propagate.This statement is erroneous, as the continuously altered array radiation at the transmitter end cannot instantly propagates through space.When the propagation delay is considered, it can be observed that the secure reception region propagates no matter the excitation vector changes or not.
Based on the above analyses, the conclusions reached in some previous FDA works [5]- [15], [25] are unreliable.

VI. CONCLUSION
The realization of DM scheme that allows security with respect to both direction and range domains is a significant research problem, with potentially high impact if solved.However, the paper demonstrated that such security cannot be obtained by combining DM with FDA when the time variable is incorporated in the investigated model.It has been demonstrated that the 'secure area' will propagate in range -similarly to any other electromagnetic signal -and consequently any eavesdropper located along the pre-defined direction is able to easily intercept the signal within limited time.

Fig. 2 .
Simulation example of previously reported FDA-DM system in its general form in(11). System parameters are listed in TableI.(a) Magnitudes and (b) phases of electric (or magnetic) fields in angle domain when r1 = R = 30 km; (c) Magnitudes and (d) phases of electric (or magnetic) fields in range domain when θ = θ0 = 40º (pathloss is removed for illustration purpose).
Member, IEEE, and Adam Narbudowicz, Member, IEEE pulses for Radar applications, the time instant t associated with the detected electric field at a certain distance R is thus uniquely determined, i.e. t = R/c where c is the speed of light.In other words, the 'beamforming patterns' shown in