Beyond-Diagonal RIS Attacks on Physical Layer Key Generation

While reconfigurable intelligent surface (RIS) technology shows great promise for wireless communication, an adversary using such technology can threaten wireless performance. This paper explores an RIS-based attack on time-division duplex (TDD) based wireless systems that use channel reciprocity for physical layer key generation (PLKG). We demonstrate that deploying a non-reciprocal RIS with a non-symmetric "beyond diagonal" (BD) phase shift matrix can compromise channel reciprocity and thus break key consistency. The attack can be achieved without transmission of signal energy, channel state information (CSI), and synchronization with the legitimate system, and thus it is difficult to detect and counteract. We propose a physically consistent BD-RIS model and verify the impact of its attack on the secret key rate (SKR) of the legitimate system via simulations. Moreover, we provide a heuristic approach for optimizing the BD-RIS configuration to realize a more severe attack in cases where some partial knowledge of the channel state information is available. Our results demonstrate that such channel reciprocity attacks can significantly decrease the SKR of the legitimate system.