Millimeter-wave (mmWave) communication systems utilize phased-array antennas to generate highly directional beams, effectively reducing the signal footprint. Nonetheless, eavesdropping, particularly within the main-lobe, remains a significant concern. This paper introduces BeamSec, a novel beam hopping approach to maximize absolute secrecy rates with no information about the channel state information (CSI) or location of the eavesdroppers. Methodologically, BeamSec identifies diverse beam-pairs between transceivers by analyzing signal characteristics, such as angle of departure (AoD) and angle of arrival (AoA). To prevent the secure message from being eavesdropped, BeamSec splits and jointly encodes data among selected beams. Moreover, BeamSec optimizes secrecy by adapting time allocation across selected beams under different levels of channel knowledge, namely (i) full/-partial radio frequency (RF) maps constructed based on the empirical data of legitimate users, (ii) knowledge of the room floor plan, and (iii) only the instantaneous knowledge of the legitimate transmitter (TX)-receiver (RX) channel. Furthermore, we experimentally validate the efficiency of the proposed schemes using an 802.11ad-compatible 60 GHz phased-array testbed. Specifically, BeamSec demonstrates a non-zero absolute secrecy rate even for the simplistic uniform time allocation approach. Radio map (partial channel knowledge) and known room geometry (instantaneous TX/RX) based schemes provide further improvement of 124.8% and 58.13%, respectively, as compared to uniform time allocation.

The high directionality of millimeter-wave (mmWave) communication systems has proven effective in reducing the attack surface against eavesdropping, thus improving the physical layer security. However, even with highly directional beams, the system is still exposed to eavesdropping against adversaries located within the main lobe. In this paper, we propose BeamSec, a solution to protect the users even from adversaries located in the main lobe. The key feature of BeamSec are: (i) Operating without the knowledge of eavesdropper's location/channel; (ii) Robustness against colluding eavesdropping attack and (iii) Standard compatibility, which we prove using experiments via our IEEE 802.11ad/ay-compatible 60 GHz phased-array testbed. Methodologically, BeamSec first identifies uncorrelated and diverse beampairs between the transmitter and receiver by analyzing signal characteristics available through standard-compliant procedures. Next, it encodes the information jointly over all selected beampairs to minimize information leakage. We study two methods for allocating transmission time among different beams, namely uniform allocation (no knowledge of the wireless channel) and optimal allocation for maximization of the secrecy rate (with partial knowledge of the wireless channel). Our experiments show that BeamSec outperforms the benchmark schemes against single and colluding eavesdroppers and enhances the secrecy rate by 79.8% over a random paths selection benchmark.