Optimal Independence-Checking Coding For Secure Uplink Training in Large-Scale MISO-OFDM Systems

1 Optimal Independence-Checking Coding F or Secure Uplink T raining in Lar ge- Scale MISO-OFDM Systems Dongyan g Xu ∗ † , Pinyi Ren ∗ † , and James A. Ritcey ‡ ∗ School of Electronic and Information En gineering, Xi’an Jiaotong Uni versity , China † Shaanx i Smart Networks a nd Ubiquitous Acc ess R e search Center , China. ‡ Department of Electrical Engineering, Un iversity of W ashington , USA. E-mail: { xudongya ng@stu.xjtu.ed u.cn, pyr en@mail.xjtu.edu.cn , ritce y@ee.wash ing ton.edu } Abstract —Due to the publicly-kno wn deterministic char acter - istic of pilot tones, p ilot-aware a ttack, by jamming, n ulling and spoofing pilot tones, can significantly paralyze the uplink channel training in large-sca le MISO-OFDM systems. T o solve this, we in th is paper develo p an in dependence-checki ng c oding based (ICCB) uplink training ar chitecture fo r one-ring scattering scenarios allo wing fo r unifor m linear arrays ( U L A) deployment. Here, we not only insert randomized pilots on subcarriers for channel imp u lse response (CIR) estimation, but also diversify and encode subcarrier activ ation patter ns (SAPs) to con v ey those pilots simultaneously . Th e coded SAPs, though interfered by arbitrary unk nown SAPs in wireless env ironment, are qualifi ed to be reliably id en tified an d decoded in to the original p ilots by checking th e hi dden channel indepen dence existing in sub carri- ers. S pecifically , an independ ence-checking coding (ICC) th eory is formulated to support th e encoding/decoding process in this architecture. The optimal ICC code is fu rther de veloped f or guaranteeing a well-imposed estimation of CIR while maximizing the code rate. Based on this code, the identification err or probability (IEP ) i s ch aracterized to ev aluate the reliability of this architecture. Interestingly , we discover the prin ci p le of IEP reduction by exploiting th e array spatial correlation, and prov e that zero-IEP , i.e., perfect reliability , can be guaranteed under continuously-distributed mean angle of arriv al (AoA). Besid es this, a nov el closed form of I EP expression is deriv ed in discretely- distributed case. Simulation results fin all y verify the effectiveness of the p roposed architecture. Index T erms —Physical lay er security , pilot-aware atta ck, OFDM, channel estimation, indepen dence-checking codin g. I . I N T R O D U C T I O N Security paradigms in wire less communications has at- tracted in creasing attention with the ev olution o f air interface technolog y tow ards the r equireme n ts of futur e 5G network s. In tho se envisioned scen arios, multiple existing tech nologie s, such as orth ogona l freq u ency-division multiplexing (OFDM) , are closely integrated with novel innovati ve a ttempts, such as large-scale m ultiple-anten na tech nique or n amely massive multiple-inp ut, mu ltiple-outp ut (Massive MIM O) [1]. And the pheno menon acco mpanied by is that the im perishable characteristic o f wireless channels, such as the open and shared nature, have always been re ndering those air interface technolog ies vulnerab le to gr owing security attacks, in cluding the denial o f service ( DoS) attack s and tamp ering attacks, among other s. As a major manner of DoS attack , jamming attacks, in a v ariety o f beha viors o ut of contro l, have exhibited its aston ishing destruc ti ve power on those existing [2] and emerging air interface techniq ues [3]. A very typ ical example is that OFDM systems und er large- scale antenn a arr a ys are very suspectable to the protocol-aware attack, a well-d irected a ttack that can sense the specific p ro- tocols and intensify the effecti veness of attack by jamming a physical layer mech anism instead o f data payload directly . As a ty pical pro to col-aware attack, pilot-aware attack could h in der the r egular channel trainin g between legitimate transceiv er pair . Th is is don e, in theory , by jamm ing/nullin g /spoofing the deterministic pilot tones which a r e k nown an d shared on the time-frequ ency resource grid (TFRG) by all p arties for channel acquisition [4]–[6]. Th at is to say , pilo t-aware attack co u ld embrace three flexible modes, i.e. , pilot tone jamming (PTJ) attack [5], pilot tone nulling (PTN) attack [5] and pilot ton e spoofing (PTS) attack [6]. As an example o f PTS attack in narrow-band single-car r ier systems, pilot contamina tio n (PC) attack was first intro duced and analysed by [7]. Follo wing [7], many research hav e bee n in vestigated on the advantage of large-scale multi-anten na arrays on defend in g against PC attack [8]– [10]. Howe ver , those stud ies were limited to the attack dete c tio n by exploiting th e phy sical lay er inform ation, such as aux iliar y training or d ata sequen ces [8], [9] an d so me prior-known chann el informatio n [10]. The first a ttempt to reso lve pilot aware attack was pro- posed fo r a conventional OFDM systems in [1 1], that is, transform ing the PTN an d PTS attack into PTJ attack by random izing the location s a n d values of regular pilot tones on TFRG. Ass uming the independen t subcarriers, authors in [6] propo sed a frequ ency-dom ain subcarrier (FS) chan nel estimation framew ork und er the PTS a ttac k by explo iting pilo t random ization a n d indep endenc e compon ent an alysis (ICA). One key problem is that th e practical subcarriers a r e not mutually ind epende n t in the scenarios with limited chan nel taps, and thus ICA does not apply in this case. What’ s most importan t is that the influen ce of SAPs on CIR estimation was not ev aluated. Actually , wh en the so-called optimal co de is adopte d , its CIR estimatio n is extremely ill-impo sed and unprec ise. This fu rther motives us to p r ovide a secure large-scale m ulti- antenna OFDM systems, with so m e necessary con sideration, 2 i.e., array spatial correlation, and r e design the overall pilot sharing pr o cess durin g the up link chann el training ph ase. Most impo rtantly , we hav e to redesign the supporting CIR estimation p rocess. Before that, we ha ve to admit that th e pilot randomiza tio n technique, though n ecessary fo r resolv ing pilot-aware attack, brings to the process two bo ttlenecks, i.e., un predictab le attack modes and non-re c overable pilot informa tio n covered by r andom wireless chann els. Basically , an efficient hybrid attack is more likely to be the following: Problem 1 ( Att ack Model ) . An attacker in hybrid attack mode can choose eith er PTJ mode or silence cheating ( SC) mode fo r in te n tional info rmation hidin g as well. T wo no tes should be noticed, that is, 1) an attacker in PTJ mo de co uld choo se two b ehaviors, i. e. , wide-ban d pilo t jamming (WB-PJ) attack and partial-b and pilot jamm in g (PB- PJ) attack. 2) the attacker in SC m ode tu rns to keep silent f or cheating the legitimate node . In th is case, tho ugh the legitimate node adopts rando m pilots by supposing the attacker exists, the attacker actually does no t pay the price since it do e s not jam at all. On the o ther h and, we cou ld fu rther identify th e seco nd bottleneck a s fo llows: Problem 2. Rand omized pilots, if utilized fo r uplink chan nel training thr ough wir eless channels, ca n not be separated, let alone identified . This issue r efers to th ree fu ndamen tal conce pts which are respectively reco gnized as pilot conve ying, separatio n and identification in th is pap er . Here, th e innovativ e m ethodo lo gy we introduc e is: Selec tively activa te and deactivate th e OFDM subcar- riers and cr eate va rious SAP candidates. Diversify SAPs to encode pilots a nd r euse those coded su bcarriers carrying p ilot information, to estimate th e uplink chann els simultaneou sly . In what follows, the main co ntributions of this paper are sum marized: 1) First, a deterministic and precise en coding prin ciple is established such that arb itrary SAPs c a n be encoded as a binary co de. The ICC theory is then developed to f u rther optimize the cod e such that arbitrary tw o codewords in the c o de, if being superimposed on each oth er , can be separated and identified r eliably . Further more, a n optimal ICC codebo o k is form ulated with the m aximum code r ate while guaranteein g a well-imposed CIR es- timation. Based on this cod e, a reliab le I CCB u plink training architecture is finally built up by constructin g an on e - to-one mapping/dema p ping relatio nship between pilots, co d ew ords and SAPs. 2) W e further charac terize the reliability of this ar c hitecture as the iden tification error prob ability (IEP) and discover a h idden pheno menon th at when sub carrier estimation s are perfor med o n the basis of this architecture, the array spatial co rrelation existing in th e sub carriers overlapped from the legitimate node a n d the attacker can further reduce IEP . At this p oint, the attacker can actually h elp the legitimate node to improve the reliability . Interest- ingly , it c a n also be p roved that zero IEP cannot b e achieved only when th e attacker is located in the clusters $YD %RE %6$OLFH  θ  θ ∆ 7 N λ D 8SOLQN &KDQQHO7UDLQLQJ 3LORW$ZDUH $WWDFN ∆ ∆ ∆ 6FDWWHULQJ&OXVWHUV      x y  α =  π α = −  π α = Fig. 1. Diagram of larg e-scale MISO-OFDM system under the wide-band one-ring sc atterin g model. In this system, AoA ranges of Bob and A v a overla p, which incurs an effe cti ve pilot-aw are attack on the uplink channel estimati on. with the same mean AoA as the legitimate nod e. T his principle, in theory , could facilitate the acqu isition of the position of A va. If we co n sider the mean AoA with con tinuous distribution, the reliab ility , in this sense, can b e perfectly gua ranteed. Otherwise, fo r a practical discrete distribution m odel, we again show h ow much the reliab ility cou ld be furth er reinfor ced. The rest o f the pa p er is summ a rized as follows. In section I I, we presen t an overview of pilot-aware attack on mu lti-antenna OFDM systems. In Sectio n III, we introdu ce an ICCB uplin k training architectur e. Channel estimation and id e n tification enhancem ent is described in Section IV. Nu merical results are presented in Section V an d finally we con c lu de our work in Section VI . I I . O V E RV I E W O F P I L OT - A W A R E A T TAC K O N M U LT I - A N T E N N A O F D M S Y S T E M S In this section, we will provid e a basic overvie w of pilot- aware attack b y introdu cing th ree basic configur ations, in - cluding th e sy stem and sign al mod el as well as the channel estimation mode l. Un der this bac k grou n d, w e will th en revie w the influence of a co mmon- sen se tec h nique, i.e . , pilot ran dom- ization, on the pilot-aware attack and id entify the existing key impedimen ts. A. Sy stem Description W e con sider an syn chrono us large-scale M ISO-OFDM sys- tem with a N T ≫ 1 -ante n na b ase station (named as Alice) and a single-an tenna legitimate user (named as Bob) . As shown in Fig. 1, the based station (BS) with an gle spread ∆ is eq uipped with a D λ -spacin g dire ctiv e ULA and plac ed at the origin along the y -ax is to serve a 120-degree sector that is centered around the x -axis ( α = 0 ). W e assume that no energy is received fo r ang les α / ∈  − π 3 , π 3  . Fu rthermo re, we co nsider the wide - band one- ring scattering model for which Bob is surroun ded by local scatter ers within [ θ 1 − ∆ , θ 1 + ∆] [1 2], 3 [13]. Here θ 1 represents the mean AoA of clusters su r round ing Bob . In this system, pilot-ton e based uplink ch annel training pro- cess is co nsidered in wh ic h N a vailable subc arriers in dexed by Ψ are provide d d uring each a vailable OFDM symbol time. In principle, N B subcarriers indexed by Ψ B = { i 0 , i 1 , . . . , i N B − 1 } are employed for pilot tone in sertion and the fo llowing channel estimation. A single - antenna ma licious no de (n a med as A va) then aims to disturb this training proc ess by jam- ming/spoo fing/nullin g tho se pilot tones. W e denote the set of victim subcarrier s by Ψ A = { i 0 , i 1 , . . . , i N A − 1 } where N A denotes the num ber of victim subcarr ier s. Fu rthermo re, we make the following assumption: Assumption 1. A va is surr ounded by local scatter ers within [ θ 2 − ∆ , θ 2 + ∆] a nd always has the overlapping AoA inter- vals with Bob , this is, [ θ 2 − ∆ , θ 2 + ∆] ∩ [ θ 1 − ∆ , θ 1 + ∆] 6 = ∅ . Here , θ 2 denotes th e mean AoA of clu sters su rr ound ing A va. This assumption is supported by the scenario where a common large scatter in g bod y (e.g . , a large building ) could create a set of angles com mon to all no des in the system and the overlapping is inevitable. The result is that the ch annel covariance eigenspaces o f two nodes are coupled and the attack is h ard to be eliminated throug h an gular separation [12]. B. Rece iv in g Signa l Model T o begin with, we d enote pilo t tones o f Bob an d A v a at the j - th subcarrier and k -th symbo l time, r espectively by x j B [ k ] , j ∈ Ψ B and x j A [ k ] , j ∈ Ψ A . Assumption 2 . W e in this paper assume x i B [ k ] = x B [ k ] = √ ρ B e j φ k , i ∈ Ψ B for low overhead consideration and the- or etical analysis. Alternatively , we can superimpose x B [ k ] onto a ded icated pilot sequence optimized under a non- security oriented scenario . A t this point, φ k can be an ad- ditional phase differ ence for security co nsideration. W e d o not c onstraint the strate gies of pilot tones of A va such tha t x i A [ k ] = √ ρ A e j ϕ k,i , i ∈ Ψ A . Let us proceed to th e b asic OFDM p rocedu re. First, the frequen cy-domain p ilot sign als of Bob an d A va over N subcarriers ar e respectively stacked as N by 1 vectors x B [ k ] = [ x B ,j [ k ]] T j ∈ Ψ and x A [ k ] = [ x A ,j [ k ]] T j ∈ Ψ . H e re ther e exist: x B ,j [ k ] =  x B [ k ] j ∈ Ψ B 0 j / ∈ Ψ B , x A ,j [ k ] =  x j A [ k ] j ∈ Ψ A 0 j / ∈ Ψ A (1) Assume that th e length of cyclic pr efix is larger than L . The p arallel streams, i.e. , x B [ k ] and x A [ k ] , are mo d ulated with in verse fast Fourier tra nsform (IFFT). After re moving the cyclic prefix at the i -th rece ive anten na an d k -th OFDM symbol time, Alice der ive the time-d o main N by 1 vector y i [ k ] as: y i [ k ] = H i C , B F H x B [ k ] + H i C , A F H x A [ k ] + v i [ k ] (2) where H i C , B and H i C , A are N × N circu lant matrices for which the first column of H i C , B and H i C , A are respectiv ely given by h h i T B 0 1 × ( N − L ) i T and h h i T A 0 1 × ( N − L ) i T . Here, h i B ∈ C L × 1 and h i A ∈ C L × 1 are CIR vectors, respectively from Bob and A va to the i -th receiv e antenna of Alice. h i A is assumed to b e ind e p enden t with h i B . v i [ k ] ∈ C N × 1 with v i [ k ] ∼ C N  0 , I N σ 2  is the A WGN vector at th e i -th anten na and k - th symbo l time T aking FFT , Alice finally d erives the frequen cy-domain N by 1 signal vector at the i - th rece i ve antenna an d k - th OFDM symb ol time as e y i [ k ] = diag { x B [ k ] } F L h i B + diag { x A [ k ] } F L h i A + w i N [ k ] (3) Here, there exists F L = √ N F (: , 1 : L ) wher e F de n otes the DFT matrix. And we hav e w i j [ k ] = F j v i [ k ] where F j is the j - row subma trix of F . Thro u ghou t this paper, we assume that the CIRs belonging to different paths at each antenna exhibit spatially u ncorr e la te d Rayleigh fading . W e denote power delay profiles (PDPs) of the l - th p a th of Bob and A va, resp e ctiv ely by σ 2 B ,l , σ 2 A ,l . W ithout loss of gen e r ality , each path has the uniform and normalized PDP satisfying L P l =1 σ 2 B ,l = 1 , L P l =1 σ 2 A ,l = 1 [14]. For each p a th, CIRs of different antenn as ar e assumed to be spatially correlated. In one - ring scattering scenarios, the correlation between th e channel coefficients of ante n nas 1 ≤ m, n ≤ N T , ∀ l can be defined by [12]: [ R k ] m,n = 1 2∆ Z ∆+ θ k − ∆+ θ k e − j 2 π D ( m − n ) sin( θ ) dθ, k = 1 , 2 (4) Here, R i represents the ch a n nel covariance m atrix of Bob if i = 1 and A va otherwise. R 1 , instead of R 2 , is known by Alice. C. Chan n el Estimation Model Now let u s turn to describe the estimation models of FS chann e ls under specific attacks. First, A va un d er PTS attack mode could learn the pilo t tones employed by Bob in advance and imp ersonate Bob by utilizing the same pilot tone lear ned. In this case, there exists Ψ B ∪ Ψ A = Ψ B and x i A [ k ] = x B [ k ] , i ∈ Ψ B . Signals in Eq . (3) can b e rewritten as: e y i PTS [ k ] = F L h i B x B [ k ] + F L h i A x B [ k ] + w i N [ k ] (5) Finally , a least squar e (LS) based channel estimation is formu late d by : b h i con = h i B + h i A + ( F L ) + x H B [ k ] | x H B [ k ] | 2 w i N [ k ] where ( F L ) + is the Moore Pen rose p seudo-inverse o f F L . W e see that the estimation of h i B is contaminated by h i A with a noise bias when a PTS attack happ ens. As to PTN a ttac k, we em phasize th e difference lying in the fact th at there exists diag { x A [ k ] } = Σ ⊙ x A [ k ] such that ΣF L h i A x A [ k ] = − F L h i B x B [ k ] . Obviously , A va can derive a unique solution of the diagon a l m atrix Σ becau se th e assum ed A va can g e t both h i B and h i A (a very stro ng assumption in [5]). In this case, the recei ved signa ls can be rewritten as e y i PTN [ k ] = w i N [ k ] . W e see that th e receiv ed sign als are completely rand om noises, which can b e seen as the worst destruction. In ord er to represent th e case where PTJ attack happ ens, we configur e the ma trix Σ with random input values. Th e 4 %RE $YD    + = 5HFHLYHU3LORW,GHQWLILFDWLRQDQG &KDQQHO(VWLPDWLRQ 7UDQVPLWWHU3LORW&RQYH\LQJ 6LJQDO6XSHUSRVLWLRQRQ6XEFDUULHUV LQ:LUHOHVV(QYLURQPHQW 5HFHLYHU3LORW6HSDUDWLRQ   ,GHQWLILHG 3LORWV + (VWLPDWH6XEFDUULHUV DQG&,5V 6XEFDUULHU$FWLYDWHG 6XEFDUULHU'HDFWLYDWHG 6$3VIRU 7UDQVPLVVLRQ 6HSDUDWHG6$3V 6XSHULPSRVHG6$3V 3LORW ,GHQWLILFDWLRQ                     4XDQWL]HG 3KDVHV )UHTXHQF\ 'RPDLQ &RGH'RPDLQ ,&& (QFRGLQJ Fig. 2. Diagram of ICCB uplink channel traini ng procedures. estimated ch annels ar e with the similar fo rm as tho se in PTS attack. The difference is that un like PTS attack, the estimate d channels cannot benefit b oth Bob a nd A va, which is least efficient. D. Influ ence of P ilot Rando mization on Pilo t-A war e Attack T o defend a g ainst pilo t- aware attack, the com monsense is that Bob sha ll ran domize its own pilot tones. I n practice , the rand omization of pilot tone values is employed . Mor e specifically , each of the cand idate pilot phases is map ped into a u nique qu antized samples, ch o sen fro m the set A , defined b y C = { φ : φ = 2 mπ / C , 0 ≤ m ≤ C − 1 } where C reflects the quantization resolu tion. This type of p ilot ran domization , due to the constrain t o f discrete p hase samples, practically could not p revent a h ybrid attack from happen ing but ser ves as a prerequ isite for d efending aga in st pilot aware attack. In wha t fo llows, we make the fo llowing assump tio n fo r Bob for th e sake of th eoretical analysis: Assumption 3. During two ad jacent OFDM symbol time, su ch as, k i , k i +1 , i ≥ 0 , two pilo t pha ses φ k i and φ k i +1 ar e kept with fixed phase differ ence, th at is, φ k i +1 − φ k i = φ . Her e, φ k i +1 and φ k i ar e both random but φ are deterministic and publicly known. Institutively , h ow the value C increases affects the perfo r- mance o f anti-attack tech nique. Howev er, th ings seem no t to be simple as we th ink. A s discussed in the In tr oduction par t, a fact is tha t rand omized pilots, if u tilized for uplink ch annel training through wireless chan nels, canno t be separated, let alone id entified. I I I . I C C B U P L I N K T R A I N I N G A R C H I T E C T U R E In view of above issues, we in this section aim to co nstruct a n ovel p ilot sharin g mechanism, lo gically includin g three key proced u res, i.e. , pilot con veying, pilot separation and pilot identification. Each p rocedu re can b e fo und in Alg orithm 1 and Fig . 2. A. Pilot Conve ying via Bin ary Code o n Code- F r equency Do- main 1) Bin ary Code: The Eq. (40) in [15] provid es a de cision threshold func tio n γ ∆ = f ( N T , P f ) , for me a su ring how m any antennas on one sub carrier are required to ach iev e a certain probab ility P f of false alarm . Here we conside r three sym bol time and a 3 × N T receiving signal m atrix is created f o r detec- tion. Un d er this r equiremen t, we tr y to build up a relation ship between SAPs with th e comm on b inary co de. Before that, we have th e following definitio n : Definition 1. One subcarrier can be p r ec isely en coded if, for any ε > 0 , ther e exis ts a positive nu mber γ ( ε ) su ch that, for all γ ≥ γ ( ε ) , P f is smaller than ε . W e should n ote that f ( N T , P f ) is a mon otone decr easing function o f two independ ent variables N T and P f . For a giv en prob ability constraint ε ∗ , we could always expect a lower bou nd γ ( ε ∗ ) of p ossible threshold s such th at γ ( ε ∗ ) = f ( N T , ε ∗ ) is satisfied. Un der this equation, we co uld flexibly configur e N T and γ ( ε ∗ ) to make ε ∗ approa c h z e r o [15]. W e also find that th e γ that achieves zero - P f is decreased with th e incr ease of a n tennas. Basically , this ph e nomeno n originates from the fact that the incr eased dimension makes the eigenv a lues of n oise matrix to b e m ore concentr a te d in a n arrow interval, which is deter mined by the well-known Marcenko-Pastur Law [16]. 2) Cod e F r e quency Dom a in: Based on Definition 1, we can encode the m -th subcarrier as a b inary digit s m accordin g to : s m =  1 if there exis t s ig nals 0 otherw ise (6) Meanwhile, let us denote a set of binary co de vectors by S with S = { s | s m ∈ { 0 , 1 } , 1 ≤ m ≤ L s } where L s denotes the maximum leng th of the code. T hen, a code frequency domain cou ld be con structed as a set of pairs ( s , b ) with s ⊂ S and 1 ≤ b ≤ N B where b is an integer repr esenting the subcarrier ind ex of appearan ce of th e co de. T his c an be depicted in Fig. 2. 3) Bin ary Codeboo k Matrix: On th e formu lated code- frequen cy do main, we group the binary d igits and constru ct the bin ary co de by presenting a binary co deboo k a s fo llows: Definition 2. Given a N B × C binary matrix C with each element satisfying c i,j ∈ s ⊂ S , we den o te the i - th column o f C b y c i with c i =  c 1 ,i · · · c N B ,i  T . W e call C a binary codebo ok matrix an d c i a cod ewor d of C of leng th N B . Based on this definition, we also defin e a superposition principle b etween co dew ords by the following: Definition 3. The sup e rp osition sum z = x V y ( designated a s the dig it-by-dig it Bo olean sum) of two codewor ds d e n oted by x = ( x 1 , x 2 , . . . , x N B ) ⊂ C and y = ( y 1 , y 2 , . . . , y N B ) ⊂ C is de fi ned by: z i =  0 if x i = y i = 0 1 otherw ise (7) wher e z i denotes the i - th elemen t of vector z . Based on above p r eparation s, th e pilot conv eying proc e ss can b e shown in Algor ithm 1. B. Pilot Sepa ration and Ide ntification V ia ICC The stud y of how to optim ize th e previous binary c o deboo k such that it c a n separate and iden tify codewords fr o m the dis- 5 Algorithm 1 Pilot Conve ying, Separation an d Id entification 1: Pilot C o n veying 1 ) Inser t one ph ase that is selected from set A , onto su bcarriers at the in itial OFDM sym bol, for instance defined by k 0 . The phases of pilot signals inserted in adjacent OFDM symbols, such as k i , i ≥ 1 obey the Assumption 3. 2) Constru c t an one - to-one m apping from the phases in set A to cod ew ords of bin a ry codebo ok matrix derived in Section III-A, an d then f u rther to SAPs. Select one phase, i.e., the phase at k 0 , for p attern activ ation. The specific principle is that pilot sig nals are transmitted on the i -th subcarrier if the i -th digit of th e cod eword is equal to 1, otherwise th is sub carrier is kept unocc u pied. 2: Pilot Separation Alice detects the av ailab le subcar riers to acquir e the superimposed SAPs using the d etection technique shown in [15]. Th en Alice deco d es tho se su- perimpo sed SAPs and derives two individual codewords by using the inner-produ ct based differential de c oding propo sed in [6]. 3: Pilot Identification Separ ated codewords that satisfy T h e- orem 1 are q ualified to b e id entified and th en demapped into the p ilot ph ases in A for recovering th e pilot signals of Bob. turbed codeword is called I CC th eory , including the en coding principle an d dec oding p rinciple. 1) En coding Principle: W e in troduce the con cept of s - overlapping co de with co nstant weight w by d efining: Definition 4. A N B × C b inary matrix C is called a ICC- ( N B , s ) cod e of length N B and or der s , if fo r any column set Q such that |Q| = 2 , there exist at least a set S of s r ows such that c i,j = 1 , ∀ i, j, i ∈ S , j ∈ Q . In this principle, we can know that any two co dew ords in C must overlap with ea c h oth er on at lea st s non- z e ro dig its. Backing to the subcar riers, s mean s the overlapp ed sub carriers which are explo ited for c hannel estimation. Now , w e tr y to establish the relationship of s with the weight w of the cod e since the nu mber of w determin es the code r ate. Theorem 1. The weight of ICC- ( N B , s ) cod e of len gth N B and order s satisfie s w = N B + s 2 with N B ≥ s . w is an inte ger smaller th an N B . Pr oof. See pr oof in Append ix VII-A. Here and in the following section, we assume the ratio of two integers is alw ays kept to be an integer without loss of generality . Based on the theo rem, we can derive the nu mber of codewords or namely the columns in C , by a binomial coefficient C =  N B N B + s 2  . Therefo re, we have the following propo sition: Proposition 1. The cod e rate of ICC- ( N B , s ) cod e, defin ed by R I C C = log 2 ( C ) N B , is calculated as R I C C = log 2 " N B !  N B + s 2  !  N B − s 2  ! # 1/ N B (8) Theorem 2. The optimal ICC- ( N B , s ) code max imizing the code rate hold s when s = L . In this case, the r elia bility measur ed b y IEP is given b y P I = N B ! −  N B + L 2  !  N B − L 2  ! 2 N B +1  N B + L 2  !  N B − L 2  ! (9) Pr oof. See proo f in Append ix VII-B. 2) Dec o ding Pr oc edur e: The related tech nique in this par t is same with tha t in Fig. 3 of [6]. W e do no t specify th is. The overall pro cess can be shown in Alg o rithm 1. I V . C H A N N E L E S T I M A T I O N A N D I D E N T I FI C AT I O N E N H A N C E M E N T In this section, we continue our d e sign work and foc u s o n the cha n nel estimatio n ph ase. A. FS Chann el Estimation W e d o not con sider th e case where there is no a ttac k since in this case LS estimator is a n atural ch oice. If look ing back to the p ilot identification under a certain attack, we could derive two results, th at is, one identified Bob’ s pilot vector or two confusing pilot vector s. For better co nsidering th e two cases, we in this section assume the identificatio n erro r hap p ens and forget the case withou t er ror, that is, we could ge t two co nfus- ing pilot vectors defined b y x L , 1 =  x B [ k 0 ] x B [ k 1 ]  T and x L , 2 =  x A [ k 0 ] x A [ k 1 ]  T within two OFDM symb o l time, i.e., k 0 and k 1 . I n this way , the estimator to b e designed in this ca se can also apply in the another case n aturally . W e consider two OFDM symb ol time, i.e . , k 0 and k 1 and s, s ≥ 1 random ly-overlapping subcarrier s. The rand omness means th e ir rand om positions o f car r ier frequ ency . The n the signals r eceived on overlapping subcarr iers with in k 0 and k 1 are stacked as the 2 × N T s m atrix Y L , equ al to Y L = X L H L + N L (10) where X L is de noted by a 2 × 2 ma trix satisfyin g X L =  x L , 1 x L , 2  . Th e in tegrated 2 × N T s channel matrix H L satisfies H L =  h T B , L h T A , L  T . Here, there e xist h B , L =   F L ,s h i B  T , . . . ,  F L ,s h N T B  T  and h A , L =   F L ,s h i A  T , . . . ,  F L ,s h N T A  T  . F L ,s is the s -row matrix for which each index of s rows belo ngs to the set P s that is defined by P s = { j 1 , . . . , j s } , P s ⊆ Ψ , |P s | = s . N L represents the 2 × N T s no ise matrix with N L =  w T L [ k 0 ] w T L [ k 1 ]  T where ther e exists w L [ k ] = h w 1 T s [ k ] , . . . , w N T T s [ k ] i for k = k 0 , k 1 . Now we tu rn to the proce dure of channel estimation . First, x L , 1 and x L , 2 , ar e deemed as the can didate weight vectors f or estimating . W e then con sider the sam p le covari- ance matrix given by C Y L = 1 N T s Y L Y H L and finally de- riv e the asymptotically- optimal linear minimum me a n squar e error (LM MSE) estimators as W B , L = T B x H L , 1 C − 1 Y L and W A , L = T A x H L , 2 C − 1 Y L , where T B ∆ = T r( R B , L )T r( R F ) N T s and T A ∆ = 6 T r( R A , L )T r( R F ) N T q . Here, there exists T r ( R B , L ) = T r ( R A , L ) = N T and th erefore we co uld define T B = T A = T . The estimated versions of FS ch annels are respectively derived as b h B , L = W B , L Y L , b h A , L = W A , L Y L (11) The n ormalized m ean squar e erro r (NMSE) for the two estima- tions are r espectively defined b y ε 2 B = E n k b h B , L − h B , L k 2 o N T s , ε 2 A = E n k b h A , L − h A , L k 2 o N T s Furthermo re, the relationsh ip betwee n the ideal ch annels with estimated versio n s can be given by h B , L = b h B , L + ε B h an d h A , L = b h A , L + ε A h ′ where ε B h is uncorr elated with h B , L and ε A h ′ is un correlated with h A , L . Here, the entries of h and h ′ are i.i.d zero-mean complex Gaussian vectors with each element h aving unity variance. Based on above results, we could have the fo llowing propo - sition: Proposition 2. W ith the lar ge-scale antenn a array , ther e exis ts ε 2 B = ε 2 A at high SNR . Pr oof: See proo f in Appen dix VII-C B. Id entification En h ancemen t Identification e nhancem ent in th is sectio n means redu cing IEP fur ther . Since Bob c ould get two confusin g pilots and two confusing estimated ch annels, w e model the pr o cess o f iden - tification en hancemen t as a decision betwee n two hypo thesis: H 0 : b h B , L → B ob, H 1 : b h A , L → B ob (12) For the sake of simplicity , we define the f ollowing eigenvalue decomp o sition: R i = U i Λ i U H i , Λ i = diag  λ i, 1 · · · λ i,ρ i 0 · · · 0  (13) R i = U i Λ i U H i , Λ i = diag  λ − 1 i, 1 · · · λ − 1 i,ρ i 0 · · · 0  (14) R F = V f Σ f V H f , Σ f = diag  λ f , 1 · · · λ f ,ρ f 0 · · · 0  (15) R F = V f Σ f V H f , Σ f = diag  λ − 1 f , 1 · · · λ − 1 f ,ρ f 0 · · · 0  (16) where there exists R F = F T L ,s F ∗ L ,s . The ran k of R i and R F are respectively deno ted by ρ i and ρ f = min { s, L } . T o identify the two h ypoth esis, we build up the error d ecision fu nction as ∆ f ∆ = f  b h B , L  − f  b h A , L  (17) where the functio n f satisfies f ( r ) = r  R 1 ⊗ R F  r H . The function f can be simp lified by the fo llowing th eorem: Theorem 3 . Wh en N T → ∞ , the err or decision function ca n be simplifie d as: ∆ f = L  ρ 1 − T r  R 2 R 1  (18) Pr oof: See proo f in Appen dix VII-D Examinin g this eq uation, we cou ld find the pilot sche duling strategies of A va across subcarriers do not affect the decision function . In what follows, we try to further acquir e th e characteristic of ∆ f from the ob servation of R 1 and R 2 . Algorithm 2 :Channel Estimation a nd Id entification Enhanc e- ment 1: Id e ntify whethe r attack h a ppens through the codew ords derived by using inner produ ct in [6]. 2: If attack happen s, calcu late the sample covariance m atrix C Y L = 1 N T s Y L Y H L . Derive the two pilot sign al vectors x L , 1 and x L , 2 . Calculate the weight ma tr ices an d finally derive the FS ch annel estimations using Eq. (11). If no attack happ ens, ju st u se LS estimato r to ge t FS chan nels. 3: If no a ttac k h appens, directly der iv e CIR estimation u sing estimated FS channels, otherwise, calcu late ∆ f u sing Eq. (17). Acco r ding to Theor em 4, if ∆ f > 0 , b h B , L serves as the true estimated FS ch annel o f Bob for further CIR estimating, other wise ∆ f < 0 , b h A , L does. When ∆ f = 0 , an identification err or h appens and the reliability breaks down. 1) Hin ts Derived fr om Sp atial Corr ela tion: The au- thors in [12] pointed ou t that the set of eigen val- ues o f R i and the s et of uniform ly spaced samples { S i ( n / N T ) : n = 0 , . . . , N T − 1 } a re asymptotically eq ually distributed, i.e., f or any con tinuous function f ( x ) . T h e function S i ( x ) over x ∈  − 1 2 , 1 2  satisfies: S i ( x ) = 1 2∆ P 0 ∈ [ D sin( θ i − ∆)+ x,D sin( θ i +∆)+ x ] 1 √ D 2 − x 2 . And the channel covariance eigenvectors U i , i.e., N T × ρ i matrix U i , can be app roximated with a su bmatrix of th e DFT matrix F in th e following sense: lim N T →∞ 1 N T    U i U H i − F S i F H S i    2 F = 0 , i = 1 , 2 where F S i = ( f n : n ∈ J S i ) with J S i = { n, [ n / N T ] ∈ S i , n = 0 , . . . , N T − 1 } Here, S i denotes the support o f S i ( x ) . Backing to the Eq. (18), the trace function satisfies T r  R 2 R 1  ≤ T r  Λ 2 U H 2 U 1 Λ 1  = T r  Λ 2 , p U H 2 U 1 Λ 1 , p  where Λ i, p and Λ i, p are respectively defined by Λ i, p = diag  λ i, 1 · · · λ i,ρ i  and Λ i, p = diag  λ − 1 i, 1 · · · λ − 1 i,ρ i  . As previously discussed, we ap - proxim a te U H 2 U 1 using F H S 2 F S 1 and defin e S 1 ∩ S 2 = S 3 . W e then discuss th e influen ce of S 3 on T r  Λ 2 , p U H 2 U 1 Λ 1 , p  . When S 3 = ∅ , we can have T r  R 2 R 1  = 0 . When S 3 6 = ∅ , we a ssume S 3 = P a and h av e T r  Λ 2 , p U H 2 U 1 Λ 1 , p  ≤ a X j =1 λ 2 ,i j λ 1 ,i j (19) This is because the eigenvectors lab e led by the indexes o ut of the inter acted set S 3 are mu tually orthog o nal [12]. Then we have th e following theor em: Theorem 4. When N T → ∞ , ther e always exists a P j =1 λ 2 ,i j λ 1 ,i j = a . If θ 1 6 = θ 2 , there must exist a < ρ 1 and ∆ f > 0 . Otherwise if θ 1 = θ 2 , th er e mu st exist a = ρ 1 and ∆ f = 0 . Pr oof: See proo f in Ap pendix VI I-E 2) I E P Redu ction: Inspir ed by the above result, we know that the iden tification erro r hap pens only w h en θ 1 = θ 2 . Theorem 5. Und er the assumption of mean AoA ob eying 7 θ 1 - π / 4 - π / 8 0 π / 8 π / 4 θ 2 - π / 4 - π / 8 0 π / 8 π / 4 20 40 60 80 100 120 140 160 180 200 220 0 Fig. 3. Strength of ∆ f versus θ i , i = 1 , 2 with N T = 100 . continuo us pr obab ility d istribution (CPD), the IEP P I in Eq. (9) is up d ated to be zer o. Under the assumption of me an Ao A obeying distr ete pr o b ability distribution (DPD) , for instance, uniform distribution with interval leng th K , th e IE P P I in E q. (9) is up dated to be P I K . The proo f is instituti ve. T herefor e, the IEP can be seriously reduced and reliability is thus significantly enhanced under hybrid attack environment. Fina lly , we give the overall pro- cess of chan nel estimation and identification en hancemen t in Algorithm 2 . V . N U M E R I C A L R E S U LT S In this section, we fur ther carry out the perfor m ance evalu- ation co ncernin g a b ove tec hniques men tioned. In this part, we aim to verify the feasibility of Theorem 4 through simula tio ns sho wn in Fig. 3 where the strength of ∆ f is plotted again st θ i , i = 1 , 2 by co n figuring N T = 100 and K = 5 . In this simulation, we con sid er that the candidate samples of discrete m e an AoAs lie within the set  − π 4 , − π 7 , 0 , − π 7 , − π 4  . Based o n the estimation in Eq. (1 1) and the corr elation model in Eq. ( 4), we derive the cor respond - ing examples of ∆ f . As we can see, the identification e r ror happen s wh e n ∆ f = 0 , that is, θ 1 = θ 2 . In this sense, we could en vision that the IEP is zer o und e r the assumption of the mean AoA with CPD. For the sake o f a comp rehensive an a ly sis, we con sider the DPD mode l for mean AoA and furthe r simulate the IE P perfor mance in Fig . 4 . The mean AoA is discretely and unifor m ly distributed in a length- K inter val. As shown in this figure, the p e r forman ce of IEP is plotted versus the leng th of N B under different number L of ch annel taps. W e consider L to be from 7 to 1 3 and K to b e 20. k , related to N B , satisfies N B = 2 k + 1 . As we can see, e ven with small subcarrier overhead s, that is, N B is small, the IEP can be low and o ur architec tu re has a very r eliable perfo rmance guar a ntee. Moreover , we can find that when L is low , such as L = 7 , the IEP has a maximum value after wh ich IEP decrea ses w ith the incr ease of N B . W ith the incre a se o f L , IEP de c r eases monoto nically with N B . Fur th ermore , the initial value o f L determines the u pper boun d IEP can achieve. With the increase of L , the upper bou nd decreases. For instan ce, the u pper boun d of P I achieves a s low as 10 − 3 . 3 at k = 80 when L is equ al k 0 10 20 30 40 50 60 70 80 log 10 P I -5.5 -5 -4.5 -4 -3.5 -3 L = 7 L = 9 L = 11 L = 13 N B = 2 k + 1 Fig. 4. Performance of IE P versus N B under differ ent L . SNR( dB) 5 10 15 20 25 NMSE 10 -3 10 -2 10 -1 10 0 Under Spo o fi ng Binned Scheme in [11] Propsoed; N T = 50 Proposed; N T = 150 Perfect MMSE Fig. 5. NMSE of CIR estimation versus SNR under dif ferent number of antenna s. to 9 . In this case, the number o f occupied su bcarriers satisfies N B = 161 . Finally , we simulate the p erform ance of c h annel e stima tio n in Fig. 5 in which the NMSE is p lotted versus SNR o f Bob under different n umber of antennas. L an d N B are respe c ti vely configur ed to be 6 and 2 56. Here, we consider the estima tio n shown in Eq . (1 1) an d assume perfe c t identificatio n for attacks. W e do not con sider the case wh e re th ere is no attack since in this case LS estimator is a n a tural ch o ice. For the simplicity of co mparison , we o nly presen t the chann el estimation und er PTS attack because the estimation error floo r unde r PTN and PTJ attack can be easily understood to be very high. The binned sch eme proo sed in [11] is simulated as an anoth er compariso n scheme. As we can see, PTS attack, if happ e n s, causes a hig h-NMSE floor on CIR estimation fo r Bob. This pheno m enon can also be seen in the b inned schem e. Howe ver, the estimation in our prop osed f ramework breaks down this floor an d its NMSE grad ually decre a ses with the increase of transmitting antenn as. Also , we co nsider perfect MMSE to be a perfo rmance b enchmar k for which p erfect pilot tones, including A va’ s pilot tones, ar e assume d to be known by Alice. W e fin d that the NM SE bro ught in ou r scheme gradu a lly approa c h es the level und er perfect MMSE with the increase of antennas. Th a t’ s because the e stima to r high ly relies on the statistical pro p erty of C Y L , deter mined by the num ber of an tennas. 8 V I . C O N C L U S I O N S This pa per in vestigated the issue of p ilot-aware attack on the uplink channel tr aining process in large- scale MI SO- OFDM systems. W e prop osed a secure ICCB up link training architecture in which pilot tone s, usually expo sed in pu b lic, are now enabled to be shar ed between legitimate transceiver pair under hybrid attack e nvironmen t. W e d ev eloped a n ovel coding th eory to sup port and secure th is pilot sharin g pr o- cess, and foun d an op timal code rate to finally pr ovide the well-imposed CIR estimation. The o retically , we verified an importan t fact that this arch itec tu re could perf ectly secur e pilot sharing against the attack if the CPD model of mea n AoA was considered . In practical scenarios with D PD model o f mean AoA, this arch itecture cou ld a lso b ring a high -reliability and high-p recision CIR estimation . V I I . A P P E N D I X A. Pr oof o f Th eor em 1 Since code words in this constant- weight code are c o n- strained to be with same an d fixed len gth, the number o f overlapping digits achieves its minimu m only when the zero digits of each cod ew ord are fully occupied . In this case, the remanen t digits, i.e., the overlapping digits, accou nt for 2 w − N B which should be equal to s and less than w . Therefo re, we can prove the theorem. B. Pr oof o f Th eor em 2 T o gu arantee w e ll-imposed CIR estimation , there sho uld be s ≥ L , that is, F L ,s is with full column ra n k. Howe ver , the increase of s will reduce the code rate since the fu nction of C decreases with s . T h erefor e, th e optim al code rate is proved. Considering the hybr id attack , we kn ow that their exists the po ssibility of 2 N B codewords to ap pear . T wo interpre te d codewords derived b y inner-product o peration in [6], if satisfying the same weight co nstraint, will co nfuse Alice. In this case, each assumption is d e cided with the prob a b ility of 0 . 5 . T h e po ssible n u mber of codewords th at satisfy this condition is equal to N B !  N B + L 2  !  N B − L 2  ! . One exception is when the codeword of A va is identical to that of Bob. In this case, th e codeword can be u niquely determin ed. Finally , there exists the p ossibility o f N B !  N B + L 2  !  N B − L 2  ! − 1 codewords that could cause identification erro rs. Then the u ltimate IEP can be pr oved. C. P r oof of Pr op o sition 2 T ake Bob for example, we can d eriv e the er ror o f MMSE based estimatio n as ε 2 B = T  1 − T X H L , 1 C − 1 Y L X L , 1  . C Y L is transform ed i nto C Y L a . s . − − − − − → N T →∞ 1 N T s X L R C X H L + σ 2 I 2 using asy m ptotic ap proxim ation [16]. Here, the 2 × 2 matrix R C satisfies R C = diag  T r ( R 1 ) T r ( R F ) T r ( R 2 ) T r ( R F )  . Therefo re, we can d erive ε 2 B = T n 1 − X H L , 1  X L X H L  − 1 X L , 1 o at h ig h SNR region. In the same way , we can derive ε 2 A = T n 1 − X H L , 2  X L X H L  − 1 X L , 2 o . A f ter calcu lating the matrix inverse and perf orming m atrix multiplicatio n, we can finally verify ε 2 B = ε 2 A . T his com p letes the pro of. D. Pr oof o f Th e or em 3 Thanks to b h B , L = h B , L − ε B h , f  b h B , L  can be expr essed as: f  b h B , L  = ( h B , L − ε B h )  R 1 ⊗ R F  ( h B , L − ε B h ) H then this equation can be expande d in to f  b h B , L  = f 1 − 2 f 2 + f 3 where f 1 = h B , L  R 1 ⊗ R F  h H B , L and f 2 = ε B h B , L  R 1 ⊗ R F  h , f 3 = ε 2 B h  R 1 ⊗ R F  h . By using th e asymptotic approx imation for each ter m, we can have f  b h B , L  a . s . − − − − − → N T →∞ ρ 1 L + ε 2 B T r  R 1 ⊗ R F  In the same way , we can simp lify the functio n f  b h A , L  as: f  b h A , L  a . s . − − − − − → N T →∞ L T r  R 2 R 1  + ε 2 A T r  R 1 ⊗ R F  As indic a ted in Proposition 2, there exists ε 2 B = ε 2 A . By comparin g f  b h B , L  and f  b h A , L  , we can complete the proof . E. Pr oof o f Th eor em 4 First, we will pr ove a P j =1 λ 2 ,i j λ 1 ,i j = a . As shown in [12], the empirical CDF of eigen values of R i can be asymp tot- ically app roximated using the collectio n of samples from { S i ([ n / N T ]) , n = 0 , . . . , N T − 1 } . Th erefore , the eig en val- ues of different individuals, if overlappin g at the same location n , can b e appr oximated with the same eigenv a lues. Then we prove that there must a < ρ 1 . Exa m ining [ θ 2 − ∆ , θ 2 + ∆] and [ θ 1 − ∆ , θ 2 + ∆] we foun d if θ 1 6 = θ 2 is satisfied, there must exist a < ρ 1 since [ θ 2 − ∆ , θ 2 + ∆] must have n on-emp ty inter section with [ θ 1 − ∆ , θ 1 + ∆] . In this case, the nu mber of eleme n ts in S 3 is red uced to b e smaller than that ρ 1 . Now we turn to the case θ 1 = θ 2 in which we easily have R 1 = R 2 and th erefore th e theo r em is proved. R E F E R E N C E S [1] T . Bogale and L. B. L e, “Massiv e MIMO and mmW ave for 5G wireless HetNet: Potentials and challenges, ” IEEE V eh. T echnol. Mag . , vol . 11, no. 1, pp. 64-75, Feb . 2016. [2] C. Shahriar , M. La Pan, M. L ichtman, T . C. Clancy , R. McGwier , R. T andon, S. Sodagari, and J. H. Reed, “PHY -Layer resilienc y in OFDM communicat ions: A tutorial, ” IEEE Commun. Surve ys T uts. , vol. 17, no. 1, pp. 292-314, Aug. 2015. [3] H. Pirzadeh, S. M. Raza vizade h, and E. Bjornson, “Subve rting m assive MIMO by sm art jamming, ” IE EE W ir eless Commun. Lett. , vol. 5, no. 1, pp. 20-23, Feb . 2016. [4] M. Ozdemir and H. Arslan, “Channel estimatio n for wireless OFDM systems, ” IEEE Commun. Surveys T uts. , vol. 9, no. 2, pp. 18-48, 2nd Quart. 2007. [5] T . C. Clancy , “Efficie nt OFDM denial : Pilot jamming and pilot nulling, ” in Pr oc. IE EE Int. Conf. Commun. , J une 2011, pp. 1-5. [6] D. Xu, P . Ren, Y . W ang, Q. Du, and L. Sun, “ICA-SBDC: a channel estimati on and identificat ion mechanism for MISO-OFDM systems under pilot spoofing attack, ” in Proc . IEE E Int. Conf. Commun. (ICC) , May 2017, pp. 1-5. [7] X. Z hou, B. Maham, and A. Hjorungnes, “Pilot contaminat ion for activ e eav esdropping, ” IEEE T rans. W irel ess Commun. , vol. 11, no. 3, pp. 903- 907, Mar . 2012. [8] D. Kapetanovi c, G. Zheng, K . -K. W ong, and B. Ottersten , “Detection of pilot contamin ation atta ck using random training and massiv e MIMO, ” in Pr oc. IE EE Int. Symp. on P ersonal , Indoor and Mobile Radio Commun. (PIMRC’13) , Sep. 2013, pp. 13-18. 9 [9] J. K.Tugna it, “Self-cont amination for detectio n of pilot contaminati on attac k in multiple antenna systems, ” IEEE W ir eless Commun. Letters , vol. 4, no. 5, pp. 525-528, Oct. 2015. [10] D. Kapetano vic, A. Al-Nahari, A. Stojanovi c, and F . Rusek, “Detection of acti ve eav esdroppers in massiv e MIMO, ” in Pr oc. IEEE Int. Symp. on P ersonal Indoor and Mobile Radio Commun. (PIMRC’14) , Sep. 2014, pp. 585-589. [11] C. Shahr iar and T . C. Clancy , “Performance impact of pil ot tone randomiza tion to mitigate OFDM jamming attac ks, ” in Proc . IE EE CCNC , Jan. 2013, pp. 813-816. [12] A. Adhikary , J. Nam, J.-Y . Ahn, and G. Caire, “Joint spatial divi sion and multiple xing-The large-scal e array regime,, ” IEEE Tr ans. Inf. Theory , vol. 59, no. 10, pp. 6441-6463, Oct. 2013. [13] B. Han and Y . R. Zheng, “Higher rank principal Kronecker m odel for triply selecti ve fading channels with experi mental vali dation, ” IEEE T rans. V eh. T echnol . , vol. 64, no. 5, pp. 1654-1663, May 2015. [14] M. R. McKay , P . J. Smith, H. A. Suraweer a, and I. B. Collings, “On the mutual informat ion distrib ution of OFDM-based spatial multiple xing: exa ct va riance and outage approximation, ” IEEE T rans. Inf. Theory , vol. 54, no. 7, pp. 3260-3278, 2008. [15] M. Z. Shakir , A. Rao, and M.-S. Alouini, “On the decision threshold of eigen va lue ratio dete ctor based on m oments of joint and margina l distrib utions of ext reme eigen val ues, ” IEE E T rans. W irele ss Commun. , vol. 12, no. 3, pp. 974-983, Mar . 2013. [16] J. Hoydis, S. ten Brink, and M. Debbah, “Massiv e MIMO in the UL/DL of cellula r networks: How many anten nas do we need?” IE EE J . Sel. Area s Commun. , vol. 31, no. 2, pp. 160-171, Feb . 2013.