{'fraction_non_alphanumeric': 0.038274182324286705, 'fraction_numerical': 0.007341684064022269, 'mean_word_length': 4.451536418816389, 'pattern_counts': {'":': 0, '<': 16, '<?xml version=': 0, '>': 8, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 8, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Physical Layer Authentication in Mission-Critical MTC Networks: A Security and Delay Performance Analysis

We study the detection and delay performance impacts of a feature-based physical layer authentication (PLA) protocol in mission-critical machine-type communication (MTC) networks. The PLA protocol uses generalized likelihood-ratio testing based on the line-of-sight (LOS), single-input multiple-output channel-state information in order to mitigate impersonation attempts from an adversary node. We study the detection performance, develop a queueing model that captures the delay impacts of erroneous decisions in the PLA (i.e., the false alarms and missed detections), and model three different adversary strategies: data injection, disassociation, and Sybil attacks. Our main contribution is the derivation of analytical delay performance bounds that allow us to quantify the delay introduced by PLA that potentially can degrade the performance in mission-critical MTC networks. For the delay analysis, we utilize tools from stochastic network calculus. Our results show that with a sufficient number of receive antennas (approx. 4-8) and sufficiently strong LOS components from legitimate devices, PLA is a viable option for securing mission-critical MTC systems, despite the low latency requirements associated to corresponding use cases. Furthermore, we find that PLA can be very effective in detecting the considered attacks, and in particular, it can significantly reduce the delay impacts of disassociation and Sybil attacks.


I. INTRODUCTION
A S mission-critical machine-type communication (MTC) emerges as a new approach to interconnect cyberphysical infrastructures, also new requirements on security features arise. Mission-critical machine-type communication targets at low latencies and high transmission reliabilities, in order to realize new use cases for instance arising in industrial automation. Thus, while in human-oriented communication data confidentiality followed by integrity form the utmost priorities (while service availability and security overhead typically have less relevance), the priorities change in the missioncritical setting. In detail, the order of concern is reversed [1]: Service availability has highest priority since automation applications are typically supposed to run uninterrupted over long time spans. The second highest priority has message integrity, as in a closed control loop it is of vital importance that sensor and actuation information is not altered during transmission, This work is supported in part by the Swedish Civil Contingencies Agency, MSB, through the CERCES project.
while it also must be assured that the received data indeed stems from the claiming source. Finally, confidentiality is of least importance, as in automation applications the reading of sensor and actuation information poses only little threat to the controlled plant. Paired with the general requirement for low transmission latencies, these inverted security priorities are challenging, as traditionally integrity is assured through crypto schemes on the higher layers, which comes with significant computational complexities.
Physical layer authentication (PLA) has been proposed as a lightweight alternative for crypto security for authentication in reliable MTC communications [2]. In general, PLA schemes perform hypothesis testing based on dedicated features of the communication pair like, e.g., the location-specific channel frequency response [3] or a device-specific local oscillator offset [4] to determine if transmissions originate from legitimate sources. The advantage of this method is that messages can be authenticated quickly at the physical layer, without relying on cryptographic methods at higher layers and with slim-tonone security overhead. However, such schemes also come with drawbacks. First of all, due to the hypothesis testing PLA inevitably results in false alarms from time to time (i.e., some legitimate messages will be erroneously rejected) which can necessitate a retransmission. Furthermore, missed detections (i.e., accepting messages from an adversary) can occur if communication is subject to an impersonation attack. Thus, despite the complexity advantages, PLA also comes with costs which potentially can be significant in the context of missioncritical MTC. This raises the question how these costs (i.e., false positives and missed detections) potentially impact in particular the delay performance of a mission-critical MTC system.
Related work so far has largely not been addressing this question. PLA for mission-critical MTC is proposed for instance in [2,5] but without considering the impact on the delay. In [6], the reduction in delay from removing authentication-induced processing delays in cell-handovers by using PLA is simulated. However, this paper does not focus on MTC and additionally does not take false alarms of PLA into account. Ozmen et al. considers the delay-sensitive performance of a communication system under information-theoretic secrecy [7,8]. Delay in these works is characterized through the concept of effective capacity, which essentially allows the approximation of queuing-related performance metrics like the backlog or latency. Furthermore in [9], the delay performance of a Rayleigh fading wiretap channel is studied using stochastic network calculus for queueing analysis. All papers [7][8][9] apply queueing analysis tools to study the delay impacts of different physical layer security techniques, however, none of them consider PLA.
In this work, we address the issue of delay analysis, and thus the cost, of PLA for mission-critical MTC. We consider a centralized MTC network running a mission-critical application in which devices need to deliver data to the access point reliably and with low latency. In the considered network, we introduce a standard generalized-likelihood-ratio test PLA scheme, which we extend to take multiple-message authentication into account. We model several strategies that the adversary can use, namely data injection, disassociation, and Sybil attacks, and analyze the detection performance for each scenario. To derive the delay performance impacts, we develop link-level queueing models that take the PLA errors and actions of the adversary into account. For queuing analysis, we employ tools from stochastic network calculus [10,11]. This work significantly extend the scope of our previous study [12] of delay impacts of PLA that only considered a single antenna system without an active attacker.
The contributions of our paper are the following: We derive delay performance bounds for MTC links where PLA is used for combating various attack strategies. We develop models for how data injection, disassociation, and Sybil attacks are launched against a MTC network and their impact on the queueing delay performance. With respect to stochastic network calculus, we provide an approximation to a previously unsolved mathematical problem: an upper bound on the delay violation probability over a Rice fading single-input multipleoutput channel. From our results, we conclude that PLA, under relatively strong line-of-sight conditions and with sufficient number of receive antennas, can indeed provide high security in a mission-critical application. We also show that PLA effectively reduce the impact of disassociation and Sybil attacks at the cost of an approximately constant increase in delay violation probability. Thus, our results show that despite some costs, PLA promises to be an effective scheme in ensuring message integrity even in mission-critical MTC systems.
The rest of the paper is organized as follows: Section II introduces the system assumptions and our problem formulation. In Section III, we describe the attacker models and their impact on the queueing model. Section IV is devoted to deriving the delay performance bounds using tools from stochastic network calculus. In Section V, we present our numerical results, and Section VI concludes the paper.
Notation: Matrices are represented by bold capital symbols X, and X T and X † denote the matrix transpose and conjugate transpose, respectively. We let tr(X) denote the trace of a matrix. Bold symbols x represents vectors with entries x i and I N denotes the (N × N ) identity matrix. We let x = |x 1 | 2 + ... + |x n | 2 be the Euclidian norm. For an event E, we let P(E) and I(E) denote the probability and indicator function, respectively. For a random variable X, E[X] denotes its expected value and f X (x) and F X (x) its probability density and cumulative distribution function, respectively. We let CN (µ, Σ) represent the multivariate complex Gaussian distribution with mean µ and covariance matrix Σ, N (µ, Σ) the corresponding real-valued Gaussian distribution, χ 2 k a central χ 2 distribution with k degrees of freedom, and χ 2 k (λ) a non-central χ 2 distribution with k degrees of freedom and non-centrality parameter λ.

II. PRELIMINARIES
In this section, we present a centralized MTC network model consisting of K d wireless devices communicating uplink data to an access point, as depicted in Fig. 1. The network is assumed to run a mission-critical application in which the MTC devices buffer data (e.g., sensor measurements) that need to be delivered reliably to the access point with minimal delay, as for example in motion control or generally in factory automation. Furthermore, as depicted in Fig. 1, we assume that there is an adversary present in the vicinity of the network, attempting to disturb the system using stealthy wireless impersonation attacks that are compliant with the typical behavior of legitimate devices within the network (e.g., sending payloads, data or disconnection requests). For protection against such attacks, the access point is using a feature-based physical layer authentication (PLA) protocol that compares the channel-state information associated with each transmission to a pre-stored feature bank. The access point is assumed to be equipped with N Rx antennas, both in order to improve the PLA detection performance and to improve capacity, while the MTC devices (e.g., small sensors) are assumed to have single antennas. The stationary feature bank consists of the statistics of the phased-array antenna responses from each device to the multiple-antenna access point, and we assume that the devices are deployed such that a line-of-sight (LOS) path to the access point is available.

A. Medium Access and Physical Layer
We assume that the MTC devices access the wireless medium in a frame-based structure, each beginning with a beacon transmitted by the access point for synchronization, followed by a management (MGMT) period where devices can make various requests 1 . A device can request connecting to the access point (CN), disconnecting (DCN), or resources for transmission of data payload (DTA). The allocation of resources is then communicated to the devices in a broadcast period (BP), followed by the data transmission period (DTP) where devices transmit buffered data. This medium-access model is similar to existing standards such as LTE [13] and beacon-enabled IEEE 802.14e [14]. We let I MGMT (k) denote the set of request messages received in the MGMT period in frame k, each associated with a request REQ(m) ∈ {DTA, CN, DCN} and a device identifier ID(m) ∈ {1, · · · , K d } (e.g., an identification code such as a MAC address). We denote by I DTP (k) the set of devices that are granted DTP resources in frame k and we assume that the access point expects at most one request from each device. We assume the DTP has a fixed length of N Frame complex symbols that are divided by TDMA to the devices in I DTP (k). A fair division of resources is assumed, where the number of symbols each device gets allocated in frame k is denoted by 2 where ⌊x⌋ denotes the largest integer smaller than x. We denote the (N Rx × N Frame ) complex symbols received at the access point in frame k by Y k = [Y k,i1 · · · Y k,i |I DTP | ] and let y k,i (n) denote the nth column of Y k,i (i.e., the observation of the nth symbol received from device i in frame k). The singleinput multiple-output (SIMO) channel is modeled according to for n ∈ {1, · · · , N k }, where h k,i represent the channel vector between device i and the access point in frame k, x k,i (n) are the transmitted data symbols, and w k,i (n) ∼ CN (0, N 0 I NRx ) is the additive noise represented by a circular symmetric complex Gaussian random vector. We assume that E[ h k,i 2 ] = P i N Rx where P i represent the average power received per antenna from device i. We model the channel h k,i as a narrowband SIMO Rice fading channel, i.e., h k,i ∼ CN (µ i , Σ i ) with µ i representing the LOS component and covariance matrix Σ i representing the fading. The covariance matrix is given by ρ is a correlation coefficient, and K Rice is a common Rice factor experienced by all antennas and all devices in the network. Furthermore, we assume that the frame period is shorter than the coherence time of the channel so that the channel realizations h k,i can be assumed to be constant within a frame, independent from frame to frame, and independent among the MTC devices.
For device i, positioned at distance d i and with angle of arrival (AoA) Φ i relative to the receiver antenna array, the channel mean (i.e., the LOS component) is modeled as a phased-array antenna µ i = ae − j2πd i λc e(Ω i ), where λ c is the carrier wavelength, Ω i = cos(Φ i ) is the directional cosine, a = µ i , and e(Ω i ) is the unit spatial signature given by in terms of the complex number z = e −j2π∆r , where ∆ r is the antenna spacing (normalized by the wavelength) [15].
KRice+1 , and we assume the received power follows as P i = P 0 d −β/2 i where β is a path-loss exponent, P 0 is the transmit power, and d i is the distance. Additionally, in the following we normalize the noise power spectral density N 0 = 1 such that P i N Rx also represents the average received signal-to-noise ratio (SNR) on the ith link.

Remark 1.
The assumption of a narrow-band slow-fading LOS channel may appear as too restrictive at a first glance. However, it is relevant in scenarios with low or no device mobility and where the MTC deployment has been carefully planned, for instance, to use LOS beamforming for physical layer security [16]. Furthermore, these conditions allow us to upper bound the delay performance; if delay requirements are violated in this model, PLA will not be applicable for other models either.

B. Feature-Based Physical Layer Authentication
With an adversary present, the validity of the message IDs are uncertain and the access point needs to determine their legitimacy. For PLA based on the observed channel states, the access point is assumed to have access to a feature bank consisting of the channel distributions CN (µ i , Σ) that are associated with each legitimate channel and are used for hypothesis testing. In a real system, the access point can obtain the feature bank through learning based on legitimate transmissions (c.f., [17]). In this work, however, we assume that the distributions in the feature bank are perfectly known and the process by which they are obtained is omitted. For a received set of messages I = {m 1 , · · · , m M }, we denote bỹ h mi = CSI(m i ) the observed SIMO channel state associated with each message m i . In general, this channel state is an estimate with limited precision. However, to simplify the analysis we assume perfect channel-state knowledge in the following. Furthermore, we assume that PLA is applied to I ∈ {I MGMT , I DTP }, i.e., MGMT requests and DTP data payloads are authenticated separately.
We consider now the case when L messages share the same ID (e.g., due to multiple impersonated messages injected by an adversary). The PLA procedure divides the set I into subsets I i = {m ∈ I : ID(m) = i} of messages with the same ID, each authenticated independently. To test the legitimacy of the messages in the set I i , the access point constructs a L + 1-ary hypothesis test. We here denote by H l for l ∈ {1, · · · , L}, the disjoint hypotheses that message m l is authentic, i.e., that we believeh m l ∼ CN (µ ID(m l ) , Σ ID(m l ) ), and by H 0 the hypothesis that no message in I L is authentic. The decision of H l results in accepting m l and rejecting the rest, while the decision of H 0 results in rejecting all messages in I i , since the authentication is predicated on that the access point expects only one message per legitimate device. The access point decides between the L messages through where d i (·) is a discriminant function associated with the channel feature of the device with ID i, given by The minimization of the righthand side of (4) is to be viewed as choosing the maximumlikelihood (ML) decision (the discriminant function d i (·) is also the log-likelihood of the observation given the legitimate distribution) while the threshold decision in the lefthand side determines if the ML decision is authentic.
Single message authentication (L = 1): The L message hypothesis test in (4) is an extension of the standard generalized-likelihood-ratio test (GLRT), used for PLA when deciding upon a multi-dimensional complex Gaussian feature such as a multi-carrier frequency response [18] or a channel impulse response [19]. Note that when (4) is reduced to L = 1 (i.e., only a single message with ID = i is received), the hypothesis test becomes d i (h m ) ≷ H0 H1 T , where H 1 represents that the message is legitimate and H 0 represents that the message stems from an adversary.

C. Adversarial Strategies
In this paper, we assume that a single attacker is present in the system, referred to as Eve, having a single antenna, located at distance d E and with AoA Φ E relative to the access point. We model Eve's channel similarly to the legitimate channels with Rice factor K Rice,E and denote Eve's channel (Ω E ) with the normalized spatial signature given in (3). With this representation, we can model both the case when Eve is an external device or when the attack is launched from a compromised device within the network by letting µ E = µ i and Σ E = Σ for some legitimate device i. The power received from Eve's transmissions is assumed to be Given Eve's ability to send messages with fraudulent IDs, we differentiate four cases of adversary behavior: a) Baseline: Eve is present, but inactive, and the performance of the system is only affected by false alarms. The baseline scenario models the impact of introducing the PLA protocol in the system when no attacks are attempted.
b) Data Injection Attack: Eve is sending DTA requests impersonating a legitimate MTC device. Once successful, Eve gets DTP resources and transmits false data with the aim of harming the underlying application (e.g., drive a control system into a dangerous state by introducing fake sensor or actuation signals). In our work, we do not model the impact of the data injection attack on the application; however, metrics like missed detection rate (see Section II-D and III-B) measure Eve's success-rate under such attacks, and the number of resources N k each device gets scheduled will be affected. c) Sybil Attack: Eve transmits multiple DTA requests with fraudulent IDs, referred to as Sybil IDs/devices, with the goal of depleting resources available to the other legitimate devices [20]. In a Sybil attack, we assume that Eve targets a set of inactive devices D Sybil ⊂ {1, · · · , K d } that are not transmitting in the frame and sends DTA requests with the corresponding IDs. Note that it does not make sense for Eve to target active devices in this attack since they will already transmit DTA requests. With each successful Sybil ID, N k in (1) is reduced which degrades the performance of the other links in the network. d) Disassociation Attack: Eve targets a particular device and sends fraudulent requests to disassociate from the access point (DCN) with the corresponding device's ID. If successful, Eve disconnects the legitimate device which needs to reconnect, a process we model as being disconnected for K RC frames (e.g., due to management processes such as generating session keys).
The impersonation attacks that we consider can be launched by external entities (e.g., an attacker positioned in close proximity to the system, using a stolen MTC device or a software defined radio unit) or internal devices whose behavior has been hijacked by malicious code. Our attacker model allows us to model both cases by modifying the assumptions on Eve's channel. We note, however, that Sybil attacks are generally assumed to originate from internal devices that are compromised [20].

D. False Alarm and Missed Detection Rates
Here, we summarize the error events and corresponding probabilities for the single message authentication, which are standard results (c.f., [18] for proofs). In the L = 1 message case, two error events can occur: (i) a false alarm when a legitimate message is rejected; and (ii) a missed detection when an illegitimate message is accepted. Under the legitimate hypothesis H 1 , we have d i (h m ) ∼ χ 2 2NRx and the false alarm rate is is the cumulative distribution function (CDF) of a χ 2 distribution with 2N Rx degrees of freedom. Observe that for a given choice of threshold T , the false alarm rate is equal across all device IDs i, independently of our assumptions on Eve. In practice, the PLA could be designed with different thresholds T i for different devices. However, in order to simplify the analysis we assume a constant threshold T . Under H 0 (i.e., Eve is sending the message m with ID(m) = i), given that Eve's channel covariance-matrix is of the form Pi(1+KRice,E ) and ν i is the non-centrality parameter. Hence, the missed detection rate is is the CDF of a non-central χ 2 distribution with 2N Rx degrees of freedom and non-centrality parameter From this we can note that the missed detection rate varies with the device i that Eve tries to impersonate. Error analysis for PLA with L > 1 has to our knowledge not been studied before. In Section III-B, we provide bounds on the missed detection rate for L = 2 and show that this case will suffice for the delay performance analysis under the considered attack strategies.

E. Delay Performance Metric
As mentioned in Section I, the use of PLA for improved security might have unintended consequences on the system's ability to meet delay requirements. To study such delay performance issues, we introduce infinite-buffer queues that model the flow of data from each MTC device to the access point. The queueing model is described by the bivariate stochastic processes representing the cumulative arrivals to and departures from the queue in the time interval [τ, t) for all 0 ≤ τ ≤ t. In frame k, a (i) k represents the instantaneous arrivals to the ith MTC device buffer measured in bits (e.g., incoming sensor measurements), and d (i) k represent the instantaneous departures from the ith queue (i.e., information successfully transmitted to the access point). The ability to transfer data from the buffer queue to the destination at the access point is characterized by the cumulative service process Considering that a device is assigned resources, we assume that the transmitter chooses a coding rate R (i) k , and transmits s encoded information bits over the SIMO channel. Furthermore, we introduce the Bernoulli random variable X We use the Shannon capacity R (i) k = log 2 (1 + γ k,i ) as a proxy for the amount of bits per channel use that can be transmitted over the channel. Assuming the access point has perfect channel state information and uses maximum-ratio combining for the channel model (2), the instantaneous SNR is given by A widely used measure on the queueing system's ability to meet delay requirements is the delay violation probability [21]. The queueing delay at time point t is defined as representing the frames required to serve the bits in the queue at time t. This delay is randomly varying due to the random service process and the delay violation probability is defined as p i (w) = P(W i (t) > w), i.e., the probability that a bit is not received within a defined deadline w. In many cases, an exact expression for the delay violation probability is complicated to derive. However, queueing analysis can give statistical bounds on this function. In particular, the stochastic network calculus framework, introduced in Section IV, contains tools that are appropriate for deriving an upper bound on p i (w) given the underlying service process in (7). Such delay bounds are particularly suitable for performance evaluation in mission-critical networks since they provide upper limits on the delay violation probability, i.e., a real system operating under the assumed conditions will certainly achieve a better delay performance.

F. Problem Formulation
Based on the system preliminaries outlined above, we are interested in jointly studying the security and delay performance impacts of PLA in the baseline scenario when Eve is inactive, as well as under the considered adversarial strategies presented in Section II-C. To be able to do this, we must first characterize how the PLA error events and the different attack strategies affect the link layer performance of the system, which we capture through queuing analysis. That is, we seek the distributions of N k and X (i) k given the behavior of Eve. This problem is addressed in Section III. Next, we must analyze how the PLA impacts the delay performance in the resulting queueing system. We tackle this by deriving upper bounds on the delay violation probability p i (w), subject to a given PLA threshold T , corresponding p FA (T ) and p MD (i, T ), and the adversary strategy. Derivations of the bounds are provided in Section IV. Based on this analysis, we seek to answer if, and under which circumstances, PLA is a viable option for authentication in mission-critical communications. More specifically, we want to answer what the baseline delay impacts on introducing PLA are, how detection and delay performance scale with the number of receive antennas N Rx and the strength of LOS component K Rice , and what impacts the considered adversarial strategies have on the system. These among other questions are finally studied through our numerical results in Section V.

III. ATTACK MODELING AND QUEUEING IMPACTS
In this section, we analyze how erroneous PLA decisions impact the system and queueing service models that we have introduced in Section II under each of the adversarial strategies.

A. Baseline Scenario
In the baseline scenario, the adversary is inactive and the queueing model is affected only by dropped messages due to false alarms. We assume that a set D Active ⊆ {1, · · · , K d } of devices are active and that each has a constant arrival rate α i , which means that each of the active devices will request DTA resources in each frame. Considering one of the active devices i, it will request resources with a DTA request in the MGMT period. Since the adversary is inactive, the access point will receive only one request with the ID of device i and the message will be authenticated based on the single message authentication d i (h m ) ≷ H0 H1 T (see Section II-B). The observed channel stateh m will in this case be the authentic channel CN (µ i , Σ) and the false alarm rate is given by p FA (T ) in (5). Since we assume perfect channel-state information and a frame period shorter than the coherence time of the channel, the observed channel state will remain constant during the frame. Hence, if the DTA request is accepted, so will the following data payload message in the DTP 3 . Since the requests independently get rejected by PLA with p FA (T ), the number of scheduled devices follows a binomial distribution and the distribution of N k follows as p N k (n) = p |IDTP| ( NFrame n ). The threshold T is ideally set such that p FA (T ) is low, giving a possible approximation |I DTP | ≈ |D Active |. For a particular device i, the distribution of X (i) k is given by That is, in case of a false-alarm in frame k, the data buffer observes zero service.

B. Detection of Data Injection Attacks
In a data injection attack, Eve transmits a DTA request in the MGMT period with the aim of getting DTP resources for transmitting a false data message. Either Eve impersonates an inactive device i that is not requesting resources in the current frame, in which case the DTA requests undergoes singlemessage authentication and is undetected with probability p MD (i, T ), or Eve impersonates an active device, in which case the message is authenticated by L = 2 message authentication. In the latter case, denoting by m i and m E the messages from device i and Eve, respectively, a missed detection occurs in the union of events arg min m=mi,mE In this case, the probability of missed detection, denoted by p L=2 MD (i, T ), can be written as We now use the notation to discuss the probability (11). The second line of (11) is simply p FA (T )p MD (i, T ). However, for the second term P(d E < d i |d i < T ) an exact expression can only be obtained in integral form. Instead, by noting that P( , we can provide upper and lower bounds Additionally, we can observe that P(d i < d E , d E < T ) ≤ P(d E < d i ) and provide an upper bound P(d E < d i ) ≤ p d (i) in the following lemma: where and use the Chernoff bound to get that for every t > 0 where we have applied the Markov inequality and used the independence of h i and h E .
for −λ/2 < t < 1/2 from the standard moment generating functions for the corresponding distributions. Plugging these expressions into (14) and minimizing over t yields (13) which completes the proof.
The upper bound that is tightest out of (12) and (13) depends on the authentication threshold T (clearly p MD (i, T ) → 1 as T → ∞ and p MD (i, T ) → 0 as T → 0 while p d (i) is independent of T ). Hence, we tighten our bound on the missed detection probability when Eve is launching a data injection attack against active device i by This bound will additionally later prove useful when analyzing the disassociation attack in Section III-D.

Remark 2.
In a data injection attack, the delay performance of legitimate devices will be affected since accepted DTA requests from Eve will reduce the amount of resources scheduled to other devices. However, this impact is principally the same as under the Sybil attack discussed in Section III-C. Therefore, we only use the data injection scenario to study the detection performance of PLA, leaving questions regarding queueing performance to be answered by the study of Sybil attacks.

C. Queueing Impacts of Sybil Attacks
Recall that in a Sybil attack, Eve targets a set of inactive devices D Sybil and sends DTA requests with the corresponding IDs. Consequently, the access point receives messages from D Active ∪D Sybil in the MGMT period and needs to differentiate which ones are legitimate. If Eve successfully gets many DTA requests through, N k given by (1) decreases and legitimate devices get less resources which can result in growing queue backlogs. Under a Sybil attack, we assume that active legitimate devices D Active experience service dropouts modeled by X (i) k the same way as in the baseline case (10); however, the distribution of N k is different due to Sybil IDs launched by Eve.
Assuming all IDs in D Active ∪ D Sybil are distinct (Eve is assumed to target only inactive devices in the Sybil attack), the number of devices that get resources in the data transmission period is We decompose |I DTP | = K Active + K Sybil where K Active is characterized by the baseline distribution of (9) (i.e., requests rejected by false alarms) and represents the number of Sybil IDs successfully launched by Eve. For a moderate number of Sybil IDs (< 30), the distribution of K Sybil can be combinatorially approximated as where A k denotes the set of all size k subsets of D Sybil . This approximation stems from an assumption that the events {d i (h E ) < T } i∈DSybil can be approximated as independent, in which case K Sybil is Poisson-binomial distributed. Now the distribution of |I DTP | under a Sybil attack can be written as the convolution from which the distribution of N k follows as p N k (n) = p IDTP,Sybil ( NFrame n ). The impact of the Sybil attack depends on the system's available resources N Frame : If N Frame by design allows all devices to communicate simultaneously, the Sybil IDs will not have a substantial impact on the service of the legitimate devices. However, if the system is optimized to only have a subset of devices communicating at a time (e.g., in order to reduce latency or if only a subset of devices is involved in a particular sensing tasks), the result of launching multiple additional Sybil IDs might have severe impacts on the active legitimate devices. An alternative counter-strategy is to only accept requests from devices that are expected to transmit (e.g., sensors carrying relevant measurements for the running application). However, such application-layer information might not be available at the physical and MAC layers.

D. Queueing Impacts of Disassociation Attacks
In a disassociation attack, Eve targets an active legitimate device and sends DCN request with the corresponding ID. In an attacked frame, the access point will observe two messages m 1 and m 2 with the same ID (i.e., ID(m 1 ) = ID(m 2 )) and uses (4) to decide which one is authentic. If the access point accepts the DCN request from Eve, the legitimate device will need to reconnect in order to continue its data transfer which results in a disruption of the communication (i.e., s k = 0) for K RC consecutive frames which can lead to growing backlogs and increased delay. In principle, Eve could launch disassociation attacks against multiple links within the network. However, here we model the queueing impact when Eve targets a single device i.
In the disassociation attack, the frame-level service process s k in (7) follows the same model as in the baseline scenario (10) (i.e., frames are dropped with the false alarm rate and N k is given by its baseline distribution). We consider independent Bernoulli attack attempts from Eve with probability p Attack and to model the impact on the queueing performance, we divide the data flow from device i to the access point into blocks consisting of K RC frames each and define the aggregated arrival process as a ′ l = KRC(l+1)−1 k=KCNl a k and service process as where D l is a Bernoulli random variable indicating a successful disassociation attack in the block. The distribution of D l is then given by where p L=2 MD (i, T ) is the probability of accepting Eve's DCN message (i.e., the same situation as in the data injection attack and hence p L=2 MD (i, T ) is given by (11)). We recall from Section III-B that a closed form solution for p L=2 MD (i, T ) is not available. However, since Pr(D l = 1) is monotonically increasing with p L=2 MD (i, T ) ∈ [0, 1), an upper bound on p L=2 MD (i, T ) suffices to upper bound P(D l = 1). An upper bound on p L=2 MD (i, T ) is given by (15) and hence we get an upper bound P(D l = 1) Our analysis of the disassociation attack serves as a worstcase model due to the upper bound on P(D l = 1). However, since in the next Section IV we aim to upper bound the delay violation probability, an upper bound on the disassociation probability suffice for this purpose. Additionally, we acknowledge that other methods could be used for reducing the impact of disassociation attacks. For example, one could always choose DTA over DCN requests, which would render the disassociation attack harmless as long as an active device is targeted. However, we see this as an issue of protocol design and include disassociation attacks in our studies in the following.

IV. DELAY PERFORMANCE ANALYSIS
In this section, we derive delay performance bounds for the considered system using tools from stochastic network calcu-lus. We begin by introducing necessary results and notation from the stochastic network calculus framework:

A. Stochastic Network Calculus
Stochastic network calculus is a mathematical framework that allows us to analyze input-output relationships of stochastic queueing systems through, for example, performance bounds on delay or backlog given arrival and service distributions. For a complete overview of stochastic network calculus, we refer to [10]. The work in [21] developed the stochastic network calculus framework for wireless fading links by observing that the analysis is simplified by converting the bivariate stochastic processes A(τ, t), S(τ, t) and D(τ, t) into A(τ, t) e A(τ,t) , S(τ, t) e S(τ,t) and D(τ, t) e D(τ,t) . This transformation allows the characterization of the random service process in terms of the varying instantaneous SNR due to fading. This is referred to as transforming the bit-domain processes into the SNR-domain since the processes become linear in the instantaneous SNR γ k instead of logarithmic. Arrival processes in the SNR-domain can then be seen as instantaneous SNR demands. In bit-domain, stochastic network calculus is based on a (min, +) dioid algebra over R + . Stochastic network calculus in the SNR-domain, on the other hand, is instead based on the (min, ×) dioid algebra since processes in the SNR-domain become multiplicative instead of additive. The performance bounds, which can be seen as variations of moment bounds, are derived in terms of Mellin transforms of the involved queueing processes. The Mellin transform of a random variable X, closely related to the moment-generating function (MGF), is defined as The upper bound on the delay violation probability we utilize in this paper is given by Lemma 2: where K(s, τ, t) is called the kernel and given by ] due to the independence of the instantaneous service and arrivals s k and a k . Then, assuming stationarity of the underlying queueing processes, we let t → ∞ in the righthand side of (22) and get under the stability condition M A (1 + s)M S (1 − s) < 1 required for the sum in (23) to converge. Since Lemma 2 holds for all s > 0, it follows that minimization of (24) over s > 0 gives us an asymptotic upper bound on the delay violation probability. Hence, for the stable and stationary queueing system, the upper bound on the delay violation probability can be compactly written as p(w) ≤ inf s>0 {lim t→∞ K(s, t + w, t)} with the objective function to be minimized given by the steady-state kernel in (24). This function can be shown to be a convex function for every s in the stability interval M A (1 + s)M S (1 − s) < 1 (see Theorem 1 in [22]). However, no analytical tools from convex optimization can be applied, and therefore, one typically resorts to a numerical grid search for the minimization over s.
Since in this paper we assume constant arrivals of α bits per frame, the arrival process is deterministic and the Mellin transform of the SNR-domain arrival process can easily be found to be M A (s) = e α(s−1) . The service process, following the SIMO channel service model (7), has a more complicated Mellin transform which we derive in the following subsections for the considered attack scenarios.
It is worth noting that alternative stochastic network calculus approaches exist that may be used for this analysis including effective capacity [23] and MGF-based analysis [24]. Nevertheless, the usefulness of the approach in [22] that we employ is most apparent when applied to wireless fading channels as the Mellin transform M S is already derived for many fading channels in the literature, e.g., [9,11,25]. This makes the approach particularly attractive for wireless networks analysis.

B. Baseline Analysis
Recall that in the baseline scenario no active attacker is present and frames are dropped with the false alarm rate, i.e, Pr(X = 0) = 1 − p X = p FA . The service model is given by (7) with R k = log 2 (1 + h † k h k ) where we now, for ease of notation, have dropped the user index i. Note that in this section we assume the allocated resources N k to be deterministic, something we will later generalize when deriving the Sybil attack bound. To simplify the derivation, we define the functions h(γ k , X k ) e s k and g(γ k ) = 1 + γ k in terms of the instantaneous SNR γ k so that In the following, we provide our main analytical result, which is an approximate expression for the Mellin transform of g(γ k ) in Theorem 1. From this result, the Mellin transform of the service process in steady-state easily follows, as stated in Corollary 1.

(27)
Proof. We begin by using the fact that γ k is a sum of independent non-central χ 2 distributed random variables with E[γ k ] = tr(Σ) + µ † µ and Var[γ k ] = tr(Σ 2 ) + µ † Σµ. Now we use that the sum of non-central χ 2 random variables can be approximated as a scaled central χ 2 [26]. That is, we write γ k ≈ α g X, where X ∼ χ 2 kg . Transferred to the Mellin transform, the approximation becomes M g(h k ) (s) ≈ M 1+αg X (s). Now, we seek where in the second line we have used the change of variable u = 1 + αx and defined the integral I which remains to be solved. To solve it, we can use the binomial expansion (u − 1) where we in the second to third line have used the change of variable t = u/2α g and introduced k ′ = kg −2 2 . Plugging (29) into (28) yields (26). Finally, since E[α g X] = α g k g and in order to match the two first moments of the approximation, which completes the proof.
With the result of Theorem 1 in place, we get the serviceprocess Mellin transform through Corollary 1: Corollary 1. For the baseline scenario, with Bernoulli frame drops with probability p FA due to PLA, the Mellin transform of the service process is given by Proof. It follows by taking the expectation of h(γ k , X k ) s−1 , observing that X k independent of γ k and Bernoulli distributed with p X = P(X k = 1), and that p X = 1 − p FA in the baseline scenario. For mathematical details, we refer to [11,12].

C. Analysis for Sybil Attacks
In a Sybil attack, the number of resources each device gets assigned N k ∼ p N (n) is varying depending on the success of the adversary. We provide the Mellin transform of the service process in this generalized case in the following corollary (following from Theorem 1): Under Sybil attack, with scheduled resources distributed according to p N (n) and frame-drops with the false alarm rate p FA , the service-process Mellin-transform is given by (25) is a function of the random variable N k as well. Following the same logic as in the proof of Corollary 1, we find that Similarly to Corollary 1, we have and by plugging this into (32) and again noting that p X = 1 − p FA , the proof of (31) follows.

D. Analysis for Disassociation Attacks
The modifications to the queueing model for disassociation attacks are described in Section III-D. The delay bound in Section IV-A applies to the block-aggregated service and arrival processes s ′ l and a ′ l . However, with the redefinition of the time scale, we now have p(w) = Pr(W (t) > K RC w). In the following, we present the Mellin transforms of the aggregated arrival and service process under these assumptions. Since we assume constant arrivals of α bits per frame, we simply have a ′ l = K CN α and M A,Disassociation (s) = e KCNα(s−1) . What remains is the Mellin transform of the aggregated service process, provided in the following corollary: Proof. We note that M S ,Disassociation (s) is given by where we have used that h(γ k , X k ) is independent for each k.

V. NUMERICAL RESULTS
In this section, we use our analytical results to study a network consisting of K d = 24 MTC devices deployed in a square 20 m × 20 m grid, one access point placed at the origin, and the adversary Eve positioned either outside the network or representing a compromised device within the network (see Fig. 2(a) for an example deployment). The network is operating at carrier frequency f c = 2.4 GHz and the access point antenna array has normalized antenna separation ∆ r = 0.5 and is oriented parallel to the line y = −x. We assume that all channel covariance-matrices are of the form [Λ] i,j = ρ |i−j| where ρ is a correlation coefficient. The delay performance bounds are upper bounds on the delay violation probability p i (w) < p i,Bound (w) computed as described in Section IV-A, where the minimization over s is carried out by a grid search. To specify the arrival rates α i , we compute the rate corresponding to a fixed server utilization, defined as u = E(a k ) E(s k ) .

A. Bound Validation
In Fig. 2(b), we show the delay violation probability for device D12, evaluated through link-level simulations, together with the corresponding bounds. In this figure, K Rice = 6 dB, ρ = 0, N Rx = 4 and we have included results with PLA in the baseline scenario, under Sybil attack, and under disassociation attack, as well as results without PLA in the baseline scenario. For the Sybil attack, we assume Eve launches |D Sybil | = 4 Sybil IDs, and for the disassociation attack we assume the reconnection time is K CN = 4 frames. We can observe that in each scenario the analytical bounds and simulation results follow the same slope with a gap of 1-3 orders of magnitude between the curves; hence, our analysis can validly upper bound the performance of the modeled system. Typically, the gap between simulation and bound increases with the slope of the curves. Therefore, the derived bounds will clearly overestimate the true delay violation probability as seen in Fig. 2(b). However, they provide us with an efficient (i.e., in the sense that computing the bounds is significantly less computationally demanding than simulating the system) and conservative (i.e., the true system will perform considerably better than the bounds predict) way of evaluating the system's delay performance. Fig. 2(c) illustrates the delay w ǫ that can be analytically guaranteed with a violation probability of ǫ = 10 −6 , i.e., p i,Bound (w ǫ ) = ǫ, for a given false alarm rate. For illustration, we consider only a subset of devices covering the full range of AoAs and distances. The value of w ǫ varies little between devices. This is beacuse arrival rates are adapted differently for each device to fix the utilization u. Fig. 2(c) also illustrates how PLA impacts the system: to get a low missed detection rate we typically want to have a low threshold T . However, decreasing T increases the false alarm rate, which clearly impacts the delay performance guarantee w ǫ . For this particular scenario, we see that a false alarm rate approaching 10 −2 can have an impact of 2-5 frames on the delay guarantee. Higher utilization in Fig. 2(c) means that the arrival rates are higher, resulting in an increased delay guarantee. However, we observe that the delay shows a similar behavior with the false alarm rate for both u = 0.5 and u = 0.9.

C. Data Injection Attacks
Here, we consider the detection performance of PLA in the data injection attack. Delay impacts of data injection are not studied in this case since these are similar to the Sybil attack, as discussed in Section III-B.
a) Inactive device targeted: Fig. 3 shows the analytical missed detection rate p MD (i, T ) when Eve launches a data injection attack against an inactive device. In these figures, we assume that Eve is positioned at (x, y) = (25, 0) [m], targeting devices {D4, D8, D12, D16, D20}, and that the PLA threshold is fixed at a false alarm rate p FA = 10 −2 . Fig. 3(a) depicts the missed detection rate for varying K Rice with fixed K Rice,E = 0 dB. As expected, the missed detection rate improves with stronger LOS component. We observe that the detection performance for D4 is worse due to its location at (0, 20) close to Eve. Additionally, we can observe that higher antenna correlation has a positive effect on the missed detection rate performance. Fig. 3(b) shows the influence of K Rice,E on the missed detection rate for fixed K Rice = 5 dB. For PLA of devices far from Eve, a stronger LOS component from Eve allows the access point to better differentiate messages from Eve. However, for device D4 the missed detection rate shows the opposite behavior since Eve's channel more and more resembles the legitimate channel. We can also see that for low K Rice,E (i.e, Eve's channel is approaching NLOS), the missed detection rate approaches the same value for all choices of devices to impersonate. In Fig. 3(c), we plot the missed detection rate for varying N Rx showing that the missed detection rate follows an approximately log-linear decrease with N Rx . b) Active device targeted: Fig. 4(a) shows the missed detection rate p L=2 MD when Eve targets an active device from d E = 30 m and varies her AoA from π/4 to 3π/4. The first upper bound corresponds to p MD (T, i), the second to p d (i), the lower bound correspond to p MD (T, i)p FA (T ) (see (12) and (15) in Section III-B), and the solid curve is generated by Monte Carlo simulation. We can observe that the gap between the tightest upper bound and the true value is around 1 order of magnitude. Additionally, this figure illustrates that there is an optimal AoA for Eve to impersonate this particular device with the highest success rate. In Fig. 4(b) (a)  actual detection performance is around one order of magnitude lower. We observe that for devices D1, D5 and D6, the missed detection rate is very low (< 10 −8 ), while the upper bound can approach values higher than 10 −1 for some poorly positioned devices. Also, we observe that generally, the missed detection rate is improved when Eve only has a NLOS channel (i.e., K Rice,E = −∞ dB). As a single-antenna attacker, we note that it is impossible for Eve to estimate the optimal AoA through eavesdropping communications. Though through knowledge of the deployment, Eve can position herself at a similar LOS path as the legitimate device to optimize her chances of success. However, if Eve's objective is to impersonate several devices simultaneously, the optimal AoA becomes conflicting as illustrated by Fig. 4(b).
These results highlight two variables affecting the detection performance of PLA for a given false alarm rate: (i) network deployment and environment affecting LOS strengths for legitimate channels and for Eve; and (ii) access point design in terms of amount and placement of antennas. It is clear that we can improve the missed detection rate by adding more antennas and placing them such that antennacorrelation is high. Moreover, by designing the deployment and the immediate environment such that devices have a strong LOS path to the access point, while Eve is unable to get a strong LOS path (e.g., through deployment of the system in a closed environment), we can improve detection performance. Influencing channel characteristics for improved PLA performance might be feasible in some scenarios (e.g., in a factory deployment). Moreover, deployments with strong LOS components might be desirable for pure communication reasons as well.

D. Sybil Attacks
Here, we assume that devices D Active = {D12, D13, D14, D17, D18, D19, D22, D23, D24} (i.e., the upper-right quadrant of the deployment) are active and that device D4 has been compromised and is launching a Sybil attack. Fig. 5(a) shows E[K Sybil ], the average number of Sybil nodes successfully launched by Eve, as a function of the number of targeted devices |D Sybil |. The solid lines are computed according to our approximate distribution (18), while the dashed lines correspond to simulation results, showing that our approximation is accurate. We see that with no PLA, Eve successfully gets every Sybil ID accepted. With PLA and lower p FA , the number of successful Sybil nodes is kept lower. For instance, when p FA = 10 −2 , the expected number of Sybil nodes does not exceed E[K Sybil ] > 2 even though Eve can launch up to |D Sybil | = 14 Sybil IDs, which means that PLA is effective against the attack. However, it is apparent from Fig. 5(a) that there are Sybil IDs that cannot be detected by the PLA. The reason is that in the particular scenario that we have investigated, Eve is device D4, and hence, more easily impersonates devices {D1, D2, D3} due to having the same AoA. Fig. 5(b) shows the delay guarantee w ǫ for D12 and ǫ = 10 −6 under the Sybil attack. We can observe that without PLA, the increasing number of Sybil IDs launched by Eve has a severe effect on the delay performance. For example, when the link utilization is high (u = 0.9), Eve only has to introduce 4-5 Sybil IDs to cause the delay in the queue to grow towards infinity. On the other hand, by effectively detecting the Sybil IDs with PLA with p FA = 10 −2 , the delay performance can be made almost independent of the number of Sybil IDs, at a cost of a constant higher delay of around 3 frames.

E. Disassociation Attacks
Here, we assume that Eve is an external entity, positioned at d E = 25 m and Φ E = π/3, launching a disassociation attack targeting device D12. Fig. 5(c) shows the delay guarantee w ǫ for ǫ = 10 −6 for the targeted device as a function of the attack probability. In the results without PLA, we have assumed that the access point performs random guessing whenever two requests are received at the same time. For this case, we can clearly see that the attack causes the delay to increase for very low attack intensities, simply because the device gets disconnected 50% of the times Eve sends a DCN request. With PLA the impact is reduced and the system is able to give delay guarantees even when p Attack → 1 and Eve is sending DCN requests in every frame. For N Rx = 4, we however see an increase in w ǫ with p Attack due to the occasional missed detections. Fig. 5(c) also illustrates that this increase can be mitigated by increasing the number of receive antennas to N Rx = 8.

F. Discussion
The PLA scheme studied in this paper can achieve missed detection rates of around 10 −6 and even as low as 10 −10 under certain channel conditions. These values can certainly meet security requirements even in applications where message integrity is of critical importance. Our results also indicate that these security enhancements comes at a limited cost in terms of delay: In the baseline scenario, given reasonable false alarm rates p FA < 10 −2 , our results show that a delay w ǫ < 5 frames can be guaranteed with a reliability of ǫ = 10 −6 . Furthermore, PLA can assure reliable operation of the studied system, even under hostile scenarios like Sybil and disassociation attacks that are aimed at impacting the service on legitimate channels. All these observations make a strong case for that PLA can be a viable option for message integrity in mission-critical MTC.
Introducing multiple-antenna access points appear beneficial from both a PLA security and a delay perspective. Already with 4-8 receive antennas, we observe large benefits in terms of missed detection rate that continues to improve in a loglinear fashion. The benefits of introducing more antennas at the access point can be interpreted in two ways: (i) improved detection performance for a given false alarm rate, or (ii), improved false alarm rate for a given detection performance. That is, we can utilize extra antennas either to strengthen the integrity of communication, or to reduce the delay impacts (i.e., decrese false alarm rate). Our results also provide insight into deployment strategies: We have seen that if many devices are deployed along a straight line resulting in similar AoA profiles, an external or internal attacker will be more effective in impersonating this set of devices simultaneously. Hence, if the deployment of MTC devices can be influenced for security purposes, this can be used to make sure that Sybil attacks targeting many devices are unlikely to succeed. Furthermore, if certain devices transmit particularly sensitive information, these can be placed in positions such that Eve's success-rate when impersonating is minimized.

VI. CONCLUSIONS
We have studied delay impacts of a feature-based PLA protocol in order to investigate the viability of PLA for missioncritical MTC applications. Based on a MTC network model consisting of multiple devices and a multi-antenna access point we have derived delay performance bounds that quantify the delay impacts of PLA. Evaluation of the derived bounds for a network with a square-grid deployment of 24 MTC devices shows that PLA can, under good LOS conditions, be used without introducing excessive delays. Additionally, we have found that PLA allows low-latency high-reliability communication even under hostile attack scenarios such as Sybil and disassociation attacks. As a means of improving detection and delay performance, one could consider multiple antenna-arrays deployed at separate locations in a distributed manner. Additionally, in this paper we have limited the analysis to a single-antenna adversary; however, this could be extended to several adversaries with multiple antennas. Moreover, channel estimation techniques and their effect on the queueing model and authentication performance is still an open problem. Finally, our analysis could easily be modified to encompass other authentication schemes (e.g., based on other features or fingerprinting tags) and through this be used to compare different PLA schemes from a delay perspective.