Security enhancements with a reconfigurable intelligent surface

1. A method of wireless communication performed by a user equipment (UE), comprising:

receiving a first signal associated with a downlink control channel, wherein the first signal uses a modulation signature that identifies a first security key associated with a reconfigurable intelligent surface (RIS), and wherein the first signal includes a second security key; and

receiving a second signal associated with a downlink shared channel, wherein the second signal includes a third security key, and wherein the second signal is authenticated by the UE based at least in part on the first security key, the second security key, and the third security key.

2. The method of claim 1 , further comprising:

decoding the second signal to authenticate the second signal using the first security key, the second security key, and the third security key.

3. The method of claim 1 , wherein decoding the second signal to authenticate the second signal comprises:

generating, using an authentication function, an authentication key based at least in part on the first security key and the second security key; and

authenticating the second signal based at least in part on whether the authentication key matches the third security key.

4. The method of claim 1 , further comprising:

transmitting, to a base station, a report for a link associated with the RIS, wherein the report indicates at least one of an identifier associated with the RIS and one or more measurements of one or more signals transmitted via the link, wherein the first signal using the modulation signature that identifies the first security key is based at least in part on the report.

5. The method of claim 4 , further comprising:

measuring the one or more signals transmitted via the link using an RIS reference signal associated with the one or more signals to obtain the one or more measurements.

6. The method of claim 4 , wherein the report includes an indication of whether the one or more measurements satisfy a threshold, and wherein the first signal using the modulation signature that identifies the first security key is based at least in part on whether the one or more measurements satisfy the threshold.

7. The method of claim 1 , wherein the modulation signature is at least one of a phase modulation signature, a polarization modulation signature, or an amplitude modulation signature.

8. The method of claim 1 , further comprising:

receiving, from a base station, an indication of a fourth security key, wherein at least one of the second security key or the third security key is based at least in part on the fourth security key.

9. The method of claim 8 , wherein receiving the indication of the fourth security key comprises:

receiving, from the base station, the indication of the fourth security key as part of a connection establishment procedure with the base station.

10. The method of claim 1 , wherein the first signal using the modulation signature that identifies the first security key is based at least in part on the first signal being associated with a beam state or a spatial direction that is associated with the UE.

11. A method of wireless communication performed by a base station, comprising:

transmitting, to a reconfigurable intelligent surface (RIS), an indication of a first security key associated with the RIS, wherein the first security key is to be added, using a modulation signature, to signals reflected by the RIS;

transmitting a first signal that is associated with a downlink control channel, wherein the first signal includes a second security key, and wherein the first signal is to be reflected by the RIS; and

transmitting a second signal that is associated with a downlink shared channel, wherein the second signal includes a third security key, and wherein the first security key, the second security key, and the third security key enable a user equipment (UE) to authenticate the second signal.

12. The method of claim 11 , further comprising:

receiving, from the UE, a report for a link associated with the RIS, wherein the report indicates at least one of an identifier associated with the RIS and one or more measurements of one or more signals transmitted via the link, and wherein transmitting, to the RIS, the indication of the first security key is based at least in part on the report.

13. The method of claim 12 , wherein the report includes an indication of whether the one or more measurements satisfy a threshold, and wherein transmitting, to the RIS, the indication of the first security key is based at least in part on whether the one or more measurements satisfy the threshold.

14. The method of claim 11 , wherein the modulation signature is at least one of a phase modulation signature, a polarization modulation signature, or an amplitude modulation signature.

15. The method of claim 11 , wherein transmitting, to the RIS, the indication of the first security key comprises:

transmitting an indication of a beam state or a spatial direction to which the first security key is to be added by the RIS.

16. A user equipment (UE) for wireless communication, comprising:

a memory; and

one or more processors, coupled to the memory, configured to:

receive a first signal associated with a downlink control channel, wherein the first signal uses a modulation signature that identifies a first security key associated with a reconfigurable intelligent surface (RIS), and wherein the first signal includes a second security key; and

receive a second signal associated with a downlink shared channel,

wherein the second signal includes a third security key, and wherein the second signal is authenticated by the UE based at least in part on the first security key, the second security key, and the third security key.

17. The UE of claim 16 , wherein the one or more processors are further configured to:

decode the second signal to authenticate the second signal using the first security key, the second security key, and the third security key.

18. The UE of claim 16 , wherein the one or more processors, to decode the second signal to authenticate the second signal, are configured to:

generate, using an authentication function, an authentication key based at least in part on the first security key and the second security key; and

authenticate the second signal based at least in part on whether the authentication key matches the third security key.

19. The UE of claim 16 , wherein the one or more processors are further configured to:

transmit, to a base station, a report for a link associated with the RIS, wherein the report indicates at least one of an identifier associated with the RIS and one or more measurements of one or more signals transmitted via the link, wherein the first signal using the modulation signature that identifies the first security key is based at least in part on the report.

20. The UE of claim 19 , wherein the one or more processors are further configured to:

measure the one or more signals transmitted via the link using an RIS reference signal associated with the one or more signals to obtain the one or more measurements.

21. The UE of claim 19 , wherein the report includes an indication of whether the one or more measurements satisfy a threshold, and wherein the first signal using the modulation signature that identifies the first security key is based at least in part on whether the one or more measurements satisfy the threshold.

22. The UE of claim 16 , wherein the modulation signature is at least one of a phase modulation signature, a polarization modulation signature, or an amplitude modulation signature.

23. The UE of claim 16 , wherein the one or more processors are further configured to:

receive, from a base station, an indication of a fourth security key, wherein at least one of the second security key or the third security key is based at least in part on the fourth security key.

24. The UE of claim 23 , wherein the one or more processors, to receive the indication of the fourth security key, are configured to:

receive, from the base station, the indication of the fourth security key as part of a connection establishment procedure with the base station.

25. The UE of claim 16 , wherein the first signal using the modulation signature that identifies the first security key is based at least in part on the first signal being associated with a beam state or a spatial direction that is associated with the UE.

26. A base station for wireless communication, comprising:

a memory; and

one or more processors, coupled to the memory, configured to:

transmit, to a reconfigurable intelligent surface (RIS), an indication of a first security key associated with the RIS, wherein the first security key is to be added, using a modulation signature, to signals reflected by the RIS;

transmit a first signal that is associated with a downlink control channel, wherein the first signal includes a second security key, and wherein the first signal is to be reflected by the RIS; and

transmit a second signal that is associated with a downlink shared channel, wherein the second signal includes a third security key, and wherein the first security key, the second security key, and the third security key enable a user equipment (UE) to authenticate the second signal.

27. The base station of claim 26 , wherein the one or more processors are further configured to:

receive, from the UE, a report for a link associated with the RIS, wherein the report indicates at least one of an identifier associated with the RIS and one or more measurements of one or more signals transmitted via the link, and wherein transmitting, to the RIS, the indication of the first security key is based at least in part on the report.

28. The base station of claim 27 , wherein the report includes an indication of whether the one or more measurements satisfy a threshold, and wherein transmitting, to the RIS, the indication of the first security key is based at least in part on whether the one or more measurements satisfy the threshold.

29. The base station of claim 26 , wherein the modulation signature is at least one of a phase modulation signature, a polarization modulation signature, or an amplitude modulation signature.

30. The base station of claim 26 , wherein the one or more processors, to transmit, to the RIS, the indication of the first security key, are configured to:

transmit an indication of a beam state or a spatial direction to which the first security key is to be added by the RIS.