Joint Secure Transceiver Design for an Untrusted MIMO Relay Assisted Over-the-Air Computation Networks With Perfect and Imperfect CSI

In this paper, we investigate the physical layer security of an untrusted relay assisted over-the-air computation (AirComp) network, where each node is equipped with multiple antennas and the relay is operated in an amplify-and-forward mode. The relay receives the data from each sensor and sends them to the access point (AP) in the first and second time slot, respectively. The AP applies artificial noise (AN) to protect the aggregation of sensors’ data from being wiretapped by the untrusted relay in the first time slot. In particular, we are interested in minimizing the computation distortion measured by the mean-squared error (MSE) via jointly optimizing beamforming matrices at all nodes, subject to the MSE constraint at the relay and individual power constraints at the AP, the relay and each sensor. In the case of the perfect channel state information (CSI), we convert the nonconvex MSE minimization problem into a difference-of-convex (DC) form and propose a constrained concave-convex procedure that can obtain a local minimum to solve the DC problem. We also generalize the framework to an imperfect CSI case where the additional interference term due to incomplete interference cancellation is considered, and the nonconvex robust MSE minimization problem is solved by a proposed inexact block coordinate descent algorithm. Numerical results are presented to show the effectiveness of our proposed schemes.


Joint Secure Transceiver Design for an Untrusted MIMO Relay Assisted Over-the-Air Computation
Networks With Perfect and Imperfect CSI Hualiang Luo , Quanzhong Li , Qi Zhang , Member, IEEE, and Jiayin Qin Abstract-In this paper, we investigate the physical layer security of an untrusted relay assisted over-the-air computation (AirComp) network, where each node is equipped with multiple antennas and the relay is operated in an amplify-and-forward mode. The relay receives the data from each sensor and sends them to the access point (AP) in the first and second time slot, respectively. The AP applies artificial noise (AN) to protect the aggregation of sensors' data from being wiretapped by the untrusted relay in the first time slot. In particular, we are interested in minimizing the computation distortion measured by the mean-squared error (MSE) via jointly optimizing beamforming matrices at all nodes, subject to the MSE constraint at the relay and individual power constraints at the AP, the relay and each sensor. In the case of the perfect channel state information (CSI), we convert the nonconvex MSE minimization problem into a difference-of-convex (DC) form and propose a constrained concave-convex procedure that can obtain a local minimum to solve the DC problem. We also generalize the framework to an imperfect CSI case where the additional interference term due to incomplete interference cancellation is considered, and the nonconvex robust MSE minimization problem is solved by a proposed inexact block coordinate descent algorithm. Numerical results are presented to show the effectiveness of our proposed schemes.
Index Terms-Over-the-air computation, physical layer security, untrusted relay, transceiver design, optimization.

I. INTRODUCTION
W ITH the increasing number of Internet-of-Things (IoT) devices [1], [2], the communication overhead between mobile devices and the access point (AP) that collects the data becomes dominant. Unlike traditional communication base stations, the AP is more interested in aggregated observations than individual observations [3]. Over-the-air compu- tation (AirComp) is a promising solution for wireless data aggregation, and the main idea of AirComp is to utilize the signal-superposition property of a multiple access channel for "over-the-air aggregation". Benefiting from the ultra-lowlatency and high-mobility [4], [5], [6] of the AirComp in massive wireless data aggregation, much attention has been paid to AirComp [3], [7], [8], [9], [10], [11]. The authors in [9] propose a scheme combining the AirComp and orthogonal frequency division multiplexing, where the desired function is divided into sub-functions and allocated to multiple subcarriers to prevent a vanishing computation rate from the increase in the number of sensors. In [10], the tradeoff between AirComp and delay has been investigated. A cooperative wide-band spectrum sensing scheme using AirComp has been studied in [11], which utilizes the superposition property of wireless channel to implement the computation of Fourier transform. However, both AP in the AirComp network and the base station (BS) in the traditional wireless communication network may suffer from severe fading when sensors or wireless users are far from them. In order to address this issue, relays have been widely applied in the traditional wireless communication network. In [12], an amplify-and-forward (AF) relay is used to assist the BS in downlink communication, and the AF transformation matrix has been jointly optimized with the beamforming matrix of BS. A millimeter wave fullduplex multiple-input-multiple-output (MIMO) relay system is considered in [13] to increase coverage and guarantee high transmission rates for mm-wave communications. Additionally, RIS can also enhance the channel conditions between the information source and sink [14]. The authors in [15] devise and analyze a multiple-relay-aided massive NOMA network to aid the wireless communication and improve spectral efficiency. Motivated by the great success of relaying in wireless communications [15], [16], [17], relays have been introduced in the evolving AirComp networks [18], [19], [20], [21], [22], [23].
A. Related Works 1) Studies on Relay Assisted AirComp: Recently, relay assisted AirComp has become a popular investment spot since relay can improve transmission quality and increase the sensor coverage area. The authors in [18] consider an AF assisted AirComp network and propose a hierarchical communication framework to minimize the computation MSE. The authors in [19] consider an AirComp network that each sensor can transmit its signal with or without relay assistance. A relay selection scheme in relay-aided AirComp is studied in [20], which chooses the best AF relay to send the received source nodes' signal to the AP. A hierarchical AirComp network using multiple relays is investigated in [21], and the computation rate via a multi-hop system has been derived. The relays in [18], [19], [20], and [21] are assumed to be equipped with a single antenna, while some studies have considered the MIMO relays, which have multiple anttennas and can bring the benefits of higher spectral and energy efficiency, broader coverage, and lower mutual interference. A MIMO relay assisted AirComp network is studied in [22], where AP can receive the sensors' data directly from themselves or the data amplified and forwarded by the relay. In [23], a more complicated model has been considered, where sensors send their data to the AP with the help of one selected from multiple MIMO relays, while considering the direct links from the sensors to the AP.
2) Studies on Security Using Untrusted MIMO Relays: Even though a relay can bring many benefits to system performance, it may wiretap the aggregation of the sensors' data under the relay process if the relay is untrusted, or to be more specific, is a potential eavesdropper [25]. This scenario of using untrusted MIMO relays has been widely considered in previous works [26], [27], [28], [29], [30], [31], [32], [33]. In [26], [27], [28], and [29], a MIMO relay operating in a oneway amplify-and-forward mode is considered to be untrusted. In [30], [31], and [32], secure beamforming design problems with an untrusted two-way MIMO relay have been studied. The authors in [33] develop a joint relay selection and power allocation scheme to maximize the instantaneous secrecy rate of a wireless communication network, where there are multiple passive eavesdroppers and untrusted relays.
3) Studies on Security Design for AirComp: With an untrusted relay which may cause information leakage, it is rational to enhance the security of AirComp networks. In [34], physical layer security (PLS) optimization problem for the AirComp network has been studied, and artificial noise (AN) is applied to degrade the eavesdropper's links while receiving sensors' pre-processed signals. To against passive eavesdropping, the authors in [35] propose a scheme that uses a friendly jammer whose signal can be reconstructed and fully canceled by the legitimate receiver but deteriorate the eavesdropper's signal-noise-ratio (SNR), and thus inhibit the illegitimate receiver's ability to estimate the value of the objective function. Besides, different from the physical layer security rate defined in wireless communication, a δ-semantically secure based on the total variation norm on signed measures and a V-MSE-secure are defined in [35]. The V-MSE-secure guarantees that the estimation MSE at the eavesdropper is at least V under a uniformly distributed objective, regardless of which estimator the eavesdropper uses.

B. Motivations and Contributions
First, due to the broadcast nature of wireless communications, the data from sensors may be wiretapped by potential eavesdroppers. Thus, developing a scheme that protects the vulnerable data aggregation from eavesdroppers is reasonable. While quite a few advanced physical layer security strategies (including power allocation [24], [25], [26], [27], [28], [29], [30], [31], [32], [33], AN [24], [29], [32], cooperative jamming [24], [25], [27], zero-forcing beamforming [24], relay selection [24], [33], etc.) have been proposed to protect the transmission security from potential eavesdroppers in traditional wireless communication systems, they cannot be applied to the AirComp network directly. Because, in many AirComp applications, the AP only requires a function of data available at the distributed sensors rather than the complete information about the data themselves, which makes sensors' secrecy rate commonly used in traditional communications become an unsuitable mensuration in AirComp scenarios.
Second, inspired by AN can protect the signal from being wiretapped by jamming and distorting the observation of the eavesdropper in wireless communication networks [25], [34], [36], we may utilize AN to prevent the untrusted relay from wiretapping the value of the aggregation function and improve the transmission security and covertness in AirComp networks.
Third, perfect channel state information (CSI) may not always be available in practice, and a robust AirComp in the presence of imperfect CSI is a more general and realistic assumption. Considering the case of imperfect CSI, [43] uses a reconfigurable intelligent surface to assist the AirComp in IoT networks, and [44] investigates a joint beamforming design of energy supply and data aggregation for wirelessly powered AirComp systems. However, none of them consider a relay assisted AirComp network under a practical condition that perfect CSI may not be obtained.
Motivated by the above observations, in this paper, we study an AN-aided scheme for enhancing the security of an AirComp network that contains an AP, an untrusted relay and several sensors. Each node in the network is equipped with multiple antennas, and there is no direct link between the AP and each sensor. In the first time slot, each sensor sends its own data to the relay, and in the second slot, the relay amplifies and forwards the received signal to the AP.
In summary, the main contributions of this paper are: • We propose an AN-aided scheme to protect the aggregation of sensors' data being wiretapped by the potential eavesdropper. In the first time slot, when sensors send their data to the untrusted relay, the AP sends an AN to interfere with the eavesdropper from obtaining the result of the aggregated observation function at AP. In the second time slot, the relay amplifies and forwards the received signal in the previous time slot to the AP. Note that the AN can be canceled from the received signal at the AP, thereby the AP can estimate the value of the aggregated observation function with high quality but not be interfered with AN.
• We formulate an MSE minimization problem such that the MSE at the untrusted relay should be greater than a threshold, and the power of each node should be less than a preset budget. The formulated optimization problem is highly nonconvex due to coupling optimization variables. Thus, we reformulate the optimization problem into a difference-of-convex (DC) form and propose a constrained concave-convex procedure (CCCP) based algorithm to solve it, and the proposed algorithm can obtain a local minimum.
• We also consider the case of imperfect CSI. In this scenario, the interference caused by AN can not be eliminated perfectly. Therefore, we formulate a robust AP MSE minimization problem that considers the remaining interference term. To solve the nonconvex robust optimization problem, we proposed an inexact block coordinate descent (IBCD) algorithm that can converge to a Karush-Kuhn-Tucker (KKT) point.
• Numerical results demonstrate that the proposed algorithms are effective and superior in terms of MSE performance compared to other existing schemes.

C. Organizations and Notations
The rest of this paper is organized as follows. In Section II, we describe the system model. In Section III, we formulate the optimization problem with perfect CSI and propose a CCCP algorithm to solve the problem. In Section IV, we extend the optimization problem to the case of imperfect CSI and propose an IBCD algorithm to solve it. We present the numerical results in Section V and conclude our paper in Section VI.
The ∥X∥, tr(X), X * , X † , X ‡ , X T and vec(X) denote Frobenius norm, trace, conjugate, conjugate transpose, pseudo inverse, transpose and vectorization, respectively. X ⪰ (≻)0 denotes that X is positive semidefinite (positive definite). x(i) represents the i-th entry of vector x. ℜ{x} means the real part of x. ⊗ denotes the Kronecker product. The C m×n (R m×n ) denotes a complex(real) matrix with m rows and n columns. λ max (X) denotes the maximum eigenvalue of matrix X.

II. SYSTEM MODEL
Consider an untrusted relay-assisted AirComp network as illustrated in Fig. 1, which consists of K sensors each with N s antennas, an untrusted MIMO relay with N r antennas and an AP with N a antennas. 1 Denote the channel from the 1 Each node in the framework can be equipped with a single antenna or multiple antennas arbitrarily, and the case of multiple-input and single-output (MISO) or single-input and single-output (SISO) can be regarded as a special case of the framework. Usually, the sensor has fewer antennas because the number of sensors is generally large, and its limitation on the physical size, weight, and deployment cost need to be considered. The AP and relay are equipped with more antennas to obtain higher spectral efficiency and better performance [15]. k-th sensor to relay as H k ∈ C N r ×N s , the channel from AP to relay as G 1 ∈ C N r ×N a and the channel from relay to AP as G 2 ∈ C N a ×N r . We assume that there is no direct link between AP and any sensor, which occurs when the direct link is blocked due to long-distance path loss or obstacle [18], [20]. Each sensor transmits its data, which consists of K heterogeneous time-varying data, to AP with the help of the relay., each sensor's pre-processing data The relay is untrusted and regarded as a potential eavesdropper which tends to eavesdrop on the data aggregation from all sensors. The relay is considered to be trusted at the service level while untrusted at the data level 2 , which has been commonly adopted in the literature on secure cooperative communications with untrusted relay [25], [26], [30], [33]. The relay is operated in a half-duplex mode and the AirComp from the sensors to the AP is completed in two time slots. We assume that the system is perfectly synchronised 3 [20], [23], and the AP have the global CSI. 4 The proposed framework could be implemented in many realistic IoT networks, e.g., in heterogeneous networks (or integrated aerial-terrestrial networks), the small-cell BS (or a low-altitude unmanned aerial vehicle (UAV)) acts as an untrusted relay and the macro-cell BS (or highaltitude platform station or airship) acts as the AP to collect data [18].
We consider the sum operation 5 as the target-function [20], [43], [44] In the first time slot, the k-th sensor's data is multiplied by a transmit beamforming matrix W k ∈ C N s ×N s and then sent to the relay. To enhance the security of the aggregation of all sensor's data, the AP sends an AN signal s a ∈ C N a to interfere with the potential eavesdropper, i.e., the untrusted relay. The AN signal s a is satisfied E[s a s † a ] = I and also multiplied by a beanforming matrix V ∈ C N a ×N a . Thus, in the first time slot, 2 Service level trust implies the relay follows the AF protocol as expected, which involves that the relay has to send back true CSI and forward the amplified version of the received signal without modification. Being untrusted at the data level means that the relay may decipher the confidential aggregation of the sensors' data from its received signal, that is to say, being a potential passive eavesdropper. 3 An alternative scheme called AirShare [37] could be used for synchronizing sensors by broadcasting a reference-clock signal and its effectiveness demonstrated using a prototype, while the synchronization phase offset (SPO) can be compensated by the SPO estimation and equalization method designed in [11]. 4 We assume that the CSI from each sensor to the relay and the CSI between the relay and the AP can be obtained by implementing a suitable channel estimation method [25], [36], [38], [39], [40]. Many works have been studied to reduce the overhead for CSI estimation [10], [41], [42], and it will be a promising future work to extend those techniques to relay assisted AirComp network. Additionally, since the AP has the global CSI, the AP can act as a central processor to perform the optimization process, and the optimized results can be assigned to the relay and sensors through the feedback channel [38], [40]. 5 The aggregation function can be many nomographic functions such as arithmetic mean, weighted sum, euclidean norm, polynomial, etc. the received signal at the relay is where n r ∼ CN (0, σ 2 I) denotes the noise at the relay. In the second time slot, the relay amplifies and forwards the received signal to the AP. Specifically, the received signal y r is amplified by a beamforming matrix F ∈ C N r ×N r and sent to the AP. Then, the received signal at the AP is where n a ∼ CN (0, σ 2 I) denotes the noise at the AP. The AP and the relay apply the aggregation beamforming to the received signals as the computing output, so as to reduce the computation distortion as much as possible. Then the computing output of AP and relay can be expressed asŝ where U d and U r are the aggregation beamforming matrix of the relay and the AP, respectively. The computation distortion betweenŝ and s can be measured by the MSE [23], i.e. MSE(ŝ, s) = E(∥ŝ−s∥ 2 ). Thus, the MSE at the relay is given by

III. OPTIMIZATION WITH PERFECT CSI
In this section, we consider the case that all the CSI in the AirComp network is known perfectly. Since the perfect CSI is available and AN is known at the AP, it can eliminate the interference caused by AN before aggregating sensors' data. After that, the computing output of AP can be expressed ass and the MSE at the AP is given by To enhance the AirComp performance, we are interested in minimizing the MSE at AP under the transmit power constraints at each node. Meanwhile, to protect the sensors' data aggregation from being wiretapped by the untrusted relay, the minimum MSE at the relay needs to be greater than a given threshold. Thus, the MSE minimization problem is formulated as where ξ is the minimum secure MSE threshold of the untrusted relay, P a , P r and P k are the maximum transmit power at the AP, the relay and the k-th sensor. When W k ,V and F are fixed, the optimal solution of U r and U d are given by [45] where Substituting (9) into the problem (8), it can be reformulated as Due to the existence of coupling optimization variables and nonlinear equality constraints, the optimal solution of (11) is hard to obtain. Therefore, we will need the following lemmas to convert the problem (11) into a DC form, and aim to obtain a local optimum. Lemma 1: The following two sets of expressions are equivalent to each other,X Lemma 2: The following two sets of expressions are equivalent to each other,B Proof: See Appendix A. ■ To apply the above lemmas to the equality constraints in (10), we define the auxiliary variables as follow, Applying Lemma 1, Lemma 2, and Lemma 3 and denoting (11) can be further recast as Note that the constraints (17p)-(17t) have DC form and they are nonconvex. Employing the exact penalty method [12], [46], problem (17) can be reformulated as where τ is a positive penalty factor that is large enough.
In problem (18), the objective function is DC form and the constraints are convex. Proposition 1: There exist 0 < τ l < ∞ such that when τ > τ l , problem (18) is equivalent to problem (17).
Proof: See Appendix B. ■ Since problem (18) is a DC program, we employ CCCP to solve it. 6 By applying the first-order Taylor approximation to the concave term in (18a), in (t + 1)-th iteration, we need to solve the problem (19), as shown at the bottom of the next page, where ρ > 0 is a constant coefficient of the regular term, V t and F t denote the optimal solution in the t-th iteration, and all = {W 1 , . . . , W K , V, F, }.
Proof: See Appendix C. ■ 6 While a general penalty CCCP algorithm is also proposed to solve DC problem in [12], our algorithm has the following differences: 1) the system model is quite different, which leads to distinct optimization problems; 2) we do not introduce any auxiliary variable when linearizing the nonconvex terms, which does not increase the dimension of the optimization problem; 3) we use Schur complement to convert equality constraints into linear matrix inequalities (LMIs) and DC constraints, whose form and kind are more complex than that in [12], and we use epigraph to convert the MSE constraint into a more traceable form.
Complexity: Problem (19) is a semi-definite programming problem, and the interior-point method can be used to solve it efficiently with the worst-case complexity of O(n 3.5 log( 1 ϵ )), where n is the number of optimization variables and ϵ is the preset solution accuracy [47]. Thus, the computational complexity of Algorithm 1 is O(T iter 1 (K N 2 s + 5N 2 d + 5N 2 r + (2K +1)N r N s +(K +1)N a N s + N r N a ) 3.5 log( 1 ϵ )), where T iter 1 is the iteration number of Algorithm 1.
Remark 1: The outer polyblock approximation algorithm in [48] is employed to obtain a global optimal solution for a DC program. However, it is hard to be applied to problem (18) due to the non-convex quadratic terms and the inversion of the matrix in the objective function of problem (18). Obtaining a globally optimal solution to problem (18) is still an open problem.

IV. OPTIMIZATION WITH IMPERFECT CSI
In this section, we generalize the AirComp network to a more practical case that all CSI contains channel estimation error.
Consider the presence of uncertainties in the channels and model them as [49] and [50] whereH k andḠ i are the estimated CSI, H k and G i are the corresponding channel uncertainties whose elements are independent and identically distributed (i.i.d.) zero mean complex Gaussian random variables. In general, the channel uncertainties can be modeled as [49] and [50] whereH k andG i are i.i.d. Gaussian random variables with zero mean and unit variance, H,k and G,i are the row covariance matrices of H k and G i , and T H,k and T G,i are the column covariance matrices of H k and G i . When the CSI is imperfect, AP can no longer eliminate the interference caused by AN perfectly, and only a part of the interference can be eliminated. Therefore, the computing output of AP can be further expressed as and the MSE at the AP is given by For ease of exposition, we denote the expectation term of H, G 1 and G 2 in (23c) as λ H ({W k } K k=1 ), λ G 1 (V) and λ G 2 (F), and the details are presented in Appendix D for brevity.
Further, the MSEȆ d at the AP can be recast as Similarly, denote λ G 1 (V) as an expectation term of G 1 , and the definition is presented in Appendix D. Based on the above, the MSEȆ r at the relay can be formulated as Similar toȆ d andȆ r , the left-hand-side of constraint (8d) can be expressed as So far, we can generalize the MSE minimization problem (8) into a robust optimization problem, which can be formulated as Since the optimization problem (27) is highly nonconvex due to coupling optimization variables, we will propose an IBCD algorithm to solve it effectively.

A. Optimization of {U r and U d }
When W k ,V and F are fixed, the optimization problem of U r and U d is an unconstrained optimization problem, and the optimal solutions of U r and U d are given by [45] (28b)

B. Optimization of {F}
When W k ,V, U r and U d are fixed, there is only the constraint (27d) that is relevant to the optimization variable F, and the optimization problem of F can be written as As in [51], using the property of the Kronecker product Tr(ABCD) = vec A † † D T ⊗ B vec(C) and the diagonal matrix vectorization [52], problem (29) can be further recast as where f = vec(F),P,q andȒ are constant in problem (30), and their definitions are given in Appendix D for brevity. Since problem (30) is a convex quadratically constrained quadratic problem (QCQP), the Lagrange multiplier method can be used to solve it efficiently, and the expression of the optimal f can be obtained as where µ is the optimal Lagrange multiplier. Thus, the optimal F ⋆ is given by Note that there are two possible cases for the optimal µ. Oncȇ q((P) ‡ ) †Ȓ (P) ‡q ≤ P r is satisfied, we have µ = 0, otherwise, µ can be obtained by bisection method as in [53].

C. Optimization of {W k and V}
When F, U r and U d are given, the problem of optimizing W k and V can be written as Authorized licensed use limited to the terms of the applicable license agreement with IEEE. Restrictions apply.
where k , v , k , v , ϒ k and ϒ v are constant in problem (33), and their definitions are given in Appendix D for brevity. Note that the constraint (33b) is nonconvex, thus we apply first-order Taylor approximation to tackle the nonconvex terms. In the (t + 1)-th iteration, we solve where W t k and V t are the optimal solution in the t-th iteration. Incidentally, since problem (34) is convex, the consensus-ADMM [53] could be used to covert it into several subproblems, and in each iteration of consensus-ADMM, each subproblem can be solved via a closed-form solution which is quite similar to equation (31).
Proof: See Appendix E. ■ Complexity: The computation burden of the proposed Algorithm 2 mainly comes from solving the convex problem (34), which can be cast as a second-order cone program (SOCP) and takes the complexity of O k 0.5 soc m 3 soc + m 2 soc k soc n soc + k soc n 2 soc log( 1 ϵ ) with a given accuracy ϵ [54], where k soc , m soc and n soc are the number of SOC constraints, the dimension of the optimization problem and the dimension of each SOC. Thus, the computational complexity of Algorithm 2 is O(T iter 2 (K + 2) 0. 5 [(N 2 a + K N 2 s ) 3 + (N 2 a + K N 2 s )(K + 2)N as + (K + 2)N 2 as ] log( 1 ϵ )), where N as = max(N a , N s ) and T iter 2 is the iteration number of Algorithm 2.
Remark 2: Although the stochastic CSI model appears in many studies [14], [49], [50], bounded CSI model is also commonly adopted. In this scenario, the extension of S-lemma [55], [56] can be applied to convert the power constraints and the relaxed constraint corresponding to the objective function into LMIs. While the conservative approximation [57] can be used to handle the secure MSE constraint.

V. SIMULATION RESULTS
In this section, we provide the simulation results to evaluate the performances of our proposed algorithms with perfect and imperfect CSI. The wireless channels H k , G 1 and G 2 are modeled as i.i.d. circularly symmetric complex Gaussian random variables with zero mean and variances σ 2 [22], [23] denote the corresponding distance from AP to relay and the corresponding distance from relay to sensors. The AP and the relay are equipped with N a = N r = 10 antennas [43], and the sensors are equipped with N s = 4 antennas [7]. For fair performance comparison with different numbers of sensors K , the performance of the AirComp network is given by the normalized MSE at AP, defined by MSE/K [8], [34], [44]. All simulations are performed in MATLAB R2019b on a Windows desktop with Intel i7 and 8 GB of RAM, and the CVX [58] is used to solve convex optimization problems. The simulation results are averaged over 100 randomly generated channel realizations.

A. The MSE With Perfect CSI
In the perfect CSI scenario, we compare the proposed Algorithm 1 with a scheme without beamforming (denoted as "w/oBF") [3], a scheme of Maximal Ratio Transmission (denoted as "MRT") [59], a scheme that only optimizes sensors' beamforming (denoted as "OSBF"), a scheme that only optimizes the relay's beamforming (denoted as "ORBF") and a scheme that without secure MSE constraint (denoted as "w/oSec"). The "w/oBF", "MRT" "OSBF" and "ORBF" schemes are assumed to use the entire power budget to send the AN signal and successfully cancel the interference caused by AN at AP. The transmit powers at AP, the relay and the sensors are P a = P r = 20 dB, P k = 10 dB [3], [44], [49], the number of the sensors is K = 30 [6], and the minimum secure MSE threshold of the relay is ξ = 3K , if not specified.
In Fig. 2, we show the convergence performance of the proposed CCCP Algorithm. From Fig. 2, we see that the proposed algorithm converges as the iteration progresses. Fig. 3 depicts the normalized MSE at AP versus the number of sensors K . It is observed that the normalized MSE performance of all schemes decreases as K increases except the "ORBF" scheme, and the proposed algorithm outperforms all other schemes. Because the proposed algorithm also optimizes the beamforming of the relay, it achieves better performance than the "OSBF" scheme. When the sensors' beamforming has not been optimized, for any sensor, the signals sent by other sensors can be regarded as interference. As the number of sensors increases, the interference will also increase; this may be the reason why the MSE of the "ORBF" scheme increases as K increases. Also illustrated in the figure, the performances of the "w/oBF" and "MRT" schemes are inferior to other schemes since they do not use the channel state  information efficiently, since the "w/oBF" scheme does not use any CSI and the "MRT" scheme may not properly utilize the CSI of each node, both "w/oBF" and "MRT" schemes yield poor performance solutions which are close to the upper bound of the MSE at the AP (corresponding to the aggregation beamforming matrix of the AP is set to zero matrix). Moreover, the simulation result also implies that the schemes designed for information communication may not be directly applied to the AirComp network. Fig. 4 shows the normalized MSE versus the transmit power of sensors P k . The figure shows that as P k increases, the normalized MSE obtained by each scheme decreases. That is because a higher transmit power of each sensor P k leads to a higher transmit SNR, which is beneficial to the aggregation at AP. Among all schemes, the proposed algorithm achieves the best performance. Besides, although the normalized MSE gap between the proposed algorithm and "OSBF" decreases as the transmit power of each sensor grows, the gap is not disappearing. This phenomenon indicates that a larger transmit power of sensors P k brings a lower MSE at the AP, but the impact introduced by not optimizing relay beamforming cannot be ignored (even when the transmit power of a single sensor P k is already greater than the transmit power of the relay).    5 plots the normalized MSE versus the transmit power of the relay P r . Racing the transmit power of the relay leads to reduced normalized MSE, according to predicted results, and the proposed algorithm obtains the smallest normalized MSE. In addition, the decline rate of the normalized MSE is lower when the transmit power of the relay P r is relatively large. At this time, the performance of the AirComp network mainly depends on the transmit power of sensors P k which is much smaller than the transmit power of the relay P r . Fig. 6 shows the normalized MSE versus the secure MSE threshold. With the increase of the secure MSE threshold at the relay, the MSE at the AP obtained by each scheme increases very slowly, which implies that with the help of AN, the MSE at the AP is not significantly affected by the increase of the secure MSE threshold. Fig. 7 compares the normalized MSE at AP and the secure MSE constraint violation rate of the two schemes with and without secure MSE constraint under the number of the relay antennas. The alternating optimization (AO) method proposed in [22] and [23] is used to solve the optimization problem without secure MSE constraint. The violation rate of a scheme is defined as the proportion of the channels whose solution obtained by the scheme violates the secure MSE constraint to the total number of channel realizations. In Fig. 7, the secure  MSE threshold of the proposed algorithm is ξ = 90, and we say that for the "w/oSec" scheme, an obtained result violates the secure MSE constraint if the MSE at the relay is greater than ξ ′ . It can be seen from the figure that the normalized MSE degrades as the number of relay antennas N r increases. Both schemes have similar MSE performances, which implies that with the help of the AN, the secure MSE constraint does not significantly impact the AP's performance. However, when the secure MSE threshold is set to the same as 90, the violation rate of the "w/oSec" scheme is always one. Even though the secure MSE threshold is quite lower than the proposed scheme, the violation rate of the "w/oSec" scheme increases with the N r , eventually reaching one. This shows that compared to the proposed algorithm, the existing AirComp techniques that do not consider security may not protect the aggregation of sensors' data from being wiretapped by the untrusted relay.

B. The MSE With Imperfect CSI
In the imperfect CSI scenario, we apply the proposed IBCD Algorithm under different channel uncertainties and compare the proposed algorithm with "OSBF", "ORBF" and sample average approximation (denoted as "SAA") [60] schemes. The "OSBF", "ORBF" and "SAA" schemes are assumed to cancel where α = 0.6 and β = 0.5 are the correlation coefficients, σ 2 e denotes the estimation error variance, and the dimensions of and are related to the corresponding channel, to be more specified, the H k , G 1 and G 2 in (21). Each scheme can apply the successive interference cancellation to eliminate a part of the interference caused by AN. The transmit powers of the AP, the relay and the sensors are P a = P r = 20 dB, P k = 10 dB [3], [44], [49], the number of the sensors is K = 30 [6], the minimum secure MSE threshold of relay is ξ = 3K , the estimation error variance is σ 2 e = 0.001, and the number of channel realizations of "SAA" scheme is 100, if not specified.
In Fig. 8, we show the convergence performance of the proposed IBCD Algorithm with different channel uncertainties, i.e. σ 2 e = 0.0001, 0.001 and 0.003 [49]. It is observed from Fig. 8 that our proposed IBCD Algorithm can converge with the iteration increasing. Under different channel uncertainties, the number of iterations for the proposed IBCD Algorithm to achieve convergence is almost the same. As expected, a greater channel uncertainty leads to a greater normalized MSE. Fig. 9 presents the normalized MSE at AP versus the number of sensors K with different channel uncertainties. We use the performance in the case of perfect CSI as a benchmark and show it in the figure with the dotted line. It can be observed that all the normalized MSE reduces as the number of sensors increases, which means that more sensing data aggregated at the AP can reduce the normalized computation  distortion. Meanwhile, a smaller channel uncertainty leads to a smaller normalized MSE. Besides, it can be observed that the normalized MSE obtained under the smallest channel uncertainty is close to the normalized MSE under perfect CSI, especially when the K is relatively large, which indicates that the proposed IBCD Algorithm can also provide a relatively efficient solution. The gap between perfect CSI and imperfect CSI becomes smaller with the increase of K , which may be because the gap between E d andȆ d (the interference caused by the residual AN) is averaged by the number of sensors K and becomes smaller with the increase of K . Fig. 10 presents the normalized MSE at AP versus transmit power of each sensor P k with different channel uncertainties. It can be seen from Fig. 10 that with different channel uncertainty, the normalized MSE decreases as the transmit power P k increases. When the channel uncertainty is small, the performance of the proposed IBCD algorithm is generally close to the perfect CSI case, which also reflects the effectiveness of the proposed IBCD algorithm. Fig. 11 shows the normalized MSE at AP versus the number of sensors. Similar to the case of perfect CSI, the normalized MSE performance of each scheme decreases as K increases except the "ORBF" scheme, and the proposed  algorithm outperforms all other schemes. The performance of the "SAA" scheme is closer to the proposed algorithm than other schemes, and if the number of channel realizations increases, the gap between the two schemes will be smaller. Nevertheless, this will increase the computation complexity of the "SAA" scheme and consume more system storage resources. Fig. 12 plots the normalized MSE at AP versus transmit power of each sensor. The normalized MSE performance of all schemes decreases as the transmit power of each sensor P k increases. The performance of the proposed algorithm is better than all the other schemes. Fig. 13 depicts the normalized MSE versus the secure MSE threshold. It can be observed that the growth rate of the MSE at the AP with the secure MSE threshold is still very slow, which signifies that the AN still works in the case of imperfect CSI. Fig. 14 compares the normalized MSE at AP and the secure MSE constraint violation rate of the two schemes with and without secure MSE constraint versus the number of the relay antennas. The definition of violation rate is the same as in the case of perfect CSI. The secure MSE threshold of the proposed algorithm is ξ = 90, and the threshold of the "w/oSec" scheme is ξ ′ = 90 or 22.5. It can be seen that the MSE at the AP of "w/oSec" scheme is slightly lower than that of the proposed  scheme. However, the "w/oSec" scheme still cannot guarantee that the MSE at the relay is below a given threshold in the case of imperfect CSI, even when the threshold is small.

VI. CONCLUSION
In this paper, we have studied the physical layer security of an untrusted relay assisted AirComp network. To protect the sensors' data aggregation from being wiretapped by the untrusted relay, AN is applied to ensure that the MSE at the relay is greater than a given threshold. We propose a CCCP based iterative algorithm for the case of perfect CSI and propose an IBCD Algorithm for the case of imperfect CSI. Numerical results show that the proposed scheme is superior to other existing schemes, and AN can help improve the security of the sensors' data aggregation, indirectly improving the AirComp network's performance.

APPENDIX B PROOF OF PROPOSITION 1
For notational simplicity, denote the optimal value of problem (17) and (18) Since the feasible set of problem (17) is a subset of the feasible set of problem (18), we have η 2 ≤ η 1 , that is, η 1 is an upper bound on the problem (18).
Then we show that η 2 ≥ η 1 . To prove that, we only need to prove that when τ ≥ τ l , the optimal solution τ p , τ n of the problem (18) is a feasible solution to the problem (17). That is to say, f p ( τ p ) − f n ( τ n ) ≤ 0 is a necessary condition. We prove this by contradiction. Assume the τ l satisfying the conditions in Proposition 1 does not exist, which means that f p ( τ p ) − f n ( τ n ) > 0 for any positive τ . Thus, when τ → +∞, we have τ (f p ( τ p ) − f n ( τ n ))) → +∞, which indicates that the optimal value of problem (18) is unbounded. This contradicts the fact that problem (17) is bounded and η 2 ≤ η 1 .

APPENDIX C PROOF OF PROPOSITION 2
For ease of exposition, in the t-th iteration, denote the objective value and solution of problem (19) as η t and t = {W t k } K k=1 , V t , F t , t , and denote the objective function of problem (18) and problem (19) as f( ) andf( ; t ), respectively. Assume that the feasible set of each optimization problem is not empty.
First, we show that the objective value of problem (19) obtained by Algorithm 1 converges as the iteration of the CCCP proceeds. With the property of the first order Taylor expansion, it is easy to verify that t is a feasible solution of the optimal solution in (t + 1)-th iteration, and the corresponding objective value is η t , which means that the objective value obtained in (t + 1)-th iteration is not greater than η t , i.e., η t+1 ≤ η t . In short, the objective value is non-increase as the iteration of the CCCP proceeds. Meanwhile, since the feasible set of the problem (19) is compact, the objective value is bounded. Thus, Algorithm 1 produces a convergent non-descending objective value sequence.
Then, we show that Algorithm 1 converges to a stationary point. Since the objective function of problem (19) is strictly convex, the solution of it is unique [46], which means the entries of the two sequences {η t } and { t } are one-to-one correspondence. Therefore, t is convergence. Denote the convergence point as ⋆ = lim t→∞ t . Sincef( ; t ) is constructed by the first order Taylor expansion, for any t-th iteration, it is easy to verify that f( ) ≤f( ; t ), (41a) where the gradient in (41c) is w.r.t . The equations in (41) fulfill the properties (P1), (P2), and (P3) in [61], and a constraint qualification condition named linear independence constraint qualification (LICQ) [61] is satisfied for the problem (19) naturally. Therefore, according to the result (R2) in [61], the limit point ⋆ is a stationary point of the problem (18). Finally, we show that ⋆ is a local minimum. In general, a stationary point could be a saddle point, a local maximum, or a local minimum of a nonlinear program [62]. According to [63], Algorithm 1 will converge to either a local optimum or a saddle point of the problem (18). Because the objective of the problem (19) is twice-continuously differentiable and strictly convex, Algorithm 1 will not converge to a saddle point [46] but a local optimal solution, i.e., ⋆ is a local minimum.

APPENDIX D THE DEFINITIONS OF SOME EXPECTATION TERMS AND COEFFICIENTS A. The Definitions of the Expectation Terms inȆ
B. The Definitions of Coefficients in Problem (30) C. The Definitions of Coefficients in Problem (33) k =H † k U r U † rH k + tr U † r H,k U r H,k .
Authorized licensed use limited to the terms of the applicable license agreement with IEEE. Restrictions apply.