Optimal Placement of Protective Jammers for SecuringWireless Transmissions in a Geographic Domain

Esther ArkinDept. Applied Mathematics

and StatisticsStony Brook University

Stony Brook, NY 11794, USA

Yuval CassutoDept. Electrical EngineeringTechnion – Israel Institute of

TechnologyHaifa 32000, Israel

Alon EfratDept. of Computer ScienceThe University of ArizonaTucson, AZ 85721, USA

Guy GreblaDept. Electrical Engineering

Columbia UniversityNew York, NY 10027, USA

Joseph S. B. MitchellDept. of Applied Mathematics

and StatisticsStony Brook University

Stony Brook, NY 11794, USA

SwaminathanSankararamanAkamai Systems

USA

Michael SegalDept. of Communication

Systems EngineeringBen-Gurion University

Beer-Sheva, Israel

ABSTRACTWireless communication systems, such as RFIDs and wireless sen-sor networks, are increasingly being used in security-sensitive ap-plications, e.g. credit card transactions or monitoring patient healthin hospitals. Wireless jamming by transmitting artificial noise, whichis traditionally used as an offensive technique for disrupting com-munication, has recently been explored as a means of protectingsensitive communication from eavesdroppers.

In this paper, we consider location optimization problems relatedto the placement and power consumption of such friendly jammersin order to protect the privacy of wireless communications con-strained within a geographic region. Under our model, we showthat the problem of placing a minimum number of fixed-power jam-mers is NP-Hard, and we provide a PTAS ((1 + ")-approximationscheme) for the same, where " is a tunable parameter between 0and 1.

1. INTRODUCTIONWireless communication is increasingly being employed to trans-

fer highly sensitive information. Systems such as ambient livingassistance systems [20], emergency response systems employingwireless networks [15], contactless smart cards [9] and militarysensor networks [1] all employ wireless communication to transmitpotentially sensitive information, such as patient health informa-tion, banking or financial data or military information. The sharednature of the wireless medium makes the protection of such infor-mation from eavesdropping an important problem.

Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full cita-tion on the first page. Copyrights for components of this work owned by others thanACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-publish, to post on servers or to redistribute to lists, requires prior specific permissionand/or a fee. Request permissions from Permissions@acm.org.IPSN ’15, April 14 - 16, 2015, Seattle, WA, USA.Copyright 2015 ACM 978-1-4503-3475-4/15/04 ...$15.00.http://dx.doi.org/10.1145/2737095.2742142.

In many cases, the use of cryptographic techniques is imprac-tical due to the limited capabilities of the communicating devices(e.g., low-cost sensors or RFID devices in smart cards) or due toapplication constraints (e.g., in emergency situations in which res-cue personnel cannot spend time typing passwords or employingother authentication methods). Moreover, in many situations, thereis a variety of communicating nodes on different frequencies andthe nodes themselves may be dynamically changing, with mobilenodes or the addition/removal of nodes. It is, thus, advantageousfor the security technique to be impervious to such variations in thesystem.

Figure 1. An example scenario in which the storage S consists oftwo warehouses containing the communicating nodes surroundedby a fence. Jammers placed within the fence prevent eavesdroppersoutside the fence from listening.

Due to the inapplicability of cryptography in many scenarios,jamming has recently been explored as a defensive technique toachieve security from eavesdroppers [19, 27]. In contrast to its tra-ditional offensive use, jamming for security must achieve the twinobjectives of (i) reducing the eavesdropper’s channel quality to alevel that is too low for successful reception, and (ii) doing so whilemaintaining sufficient channel quality for legitimate transmissions.We say that a set of jammers is successful if these two objectivesare achieved.

Noting that the communication is often geographically restricted,Sankararaman et al. [23,24] present an environment model consist-ing of communication within a region, the storage S, surrounded by

a fence F, and the storage is to be protected from eavesdroppers ly-ing outside the fence. In this context, they show how to configurefriendly jammers placed within the fence that are to operate inde-pendently of the communicating network. This model is depictedin Figure 1 (from [23]).

The main advantages of this protection scheme are:• The jammers need to know only minimal information about the

communication taking place, such as the frequency of communi-cation and bounds on receiver sensitivity and transmission pow-ers.

• It supports dynamic behavior, such as mobility or addition/removalof nodes. As long as communication is restricted to the storage,the jammers do not need to know the exact locations of nodeswithin the region.

• It is proactive rather than reactive, requiring no overhead for thecommunicating nodes and requiring no synchronization amongstthe jammers.In this paper, we expand upon the results of [23,24] in a number

of important ways. We consider two models. The first model (theFull-interference model) takes into account the accumulative effectof all jammers on every point. The second model (the Nearest-Jammers-interference model, or NJ-interference model) assumesthat all jammers use the same transmission power and that, for eachpoint p 2 R2, takes into account only those jammers that are near-est to p. (This model assumes that jammers are sparse enough thatonly the nearest jammer contributes interference; in many scenar-ios, this assumption is reasonable, due to the rapid decrease of ajammer’s interference with distance.) Further details of these mod-els are discussed below in Section 2.

Our specific contributions include the following:1. Given a discrete set of potential eavesdropper locations and a ge-

ographic domain comprised of a discrete set of storage regions,we show that, in the NJ-model, it is NP-hard to minimize thenumber of jammers necessary to protect the domain.

2. We present, for any fixed " > 0, a polynomial-time (1 + ")-approximation algorithm (i.e., a polynomial-time approximationscheme (PTAS)) for placing a minimum cardinality set of fixed-power jammers in the NJ-interference model.

3. We present a “pruning” method of reducing the region whereeavesdroppers can be placed so that the solution in the “reduced”problem closely approximates the solution to the original prob-lem. This allows us to obtain more efficient solutions, by de-creasing the number of constraints needed in integer linear pro-gramming (ILP) solutions to optimal jammer placement prob-lems. For example, in the Full-interference model, it is shownin [23,24] that the problem of either (i) finding a subset of equal-power jammers (taken from a discrete subsets A of possible lo-cations), or (ii) assigning powers to each jammer for a givenset of jammer locations, can be solved using ILP for the for-mer problem and LP for the latter one. The contribution of thepruning method is in showing that the the number of constraintsrequired in the ILP/LP need not depend on the length of thefence.

Our approximation algorithms are bi-criteria approximations, i.e.,we allow both some suboptimality (approximation) in the num-ber/power of jammers and some relaxation of the channel qualityrequirement (measured using the signal-to-interference ratio) at thenodes.

Related Work. In the field of information theory, several pa-pers [13,19,27, 29,30] consider the wiretap channel [32], in whicha single eavesdropper tries to listen to legitimate communicationbetween a pair of nodes, and it is shown that perfect secrecy ispossible when the eavesdropper’s channel is worse than the legiti-

mate channel. These works consider the use of jammers to degradethe eavesdroppers’ channel and analyze the channel capacity un-der various scenarios, such as cooperating or independent jammers,multiple eavesdroppers, etc. Under the same model of eavesdrop-pers, there have also been game-theoretic approaches for optimiz-ing power consumption of jammers [8,17] and designating regionswhere eavesdroppers cannot be located [8]. However, most of theseworks do not explore the geometry of the problem sufficiently andare primarily of theoretical importance due to the simple scenariosunder consideration.

Recent works [4,17] focus on the Multiple-Input-Multiple-Output(MIMO) wiretap channel where the transmitter, receiver, and eaves-dropper, may possess multiple antennas. The authors of [4] obtaina closed-form relationship for the structure of the jammer’s arti-ficial noise covariance matrix that guarantees no decrease in themutual information between the transmitter and the receiver. Un-der the model considered in [17], the eavesdropper can act either asa passive eavesdropper or as an active jammer, under half-duplexconstraint. Consequently, the authors of [17] use a game-theoreticapproach and examine conditions for the existence of Nash equi-libria. In [2], the authors develop and implement a demodulator fora MIMO receiver. Via experiments, good performance is demon-strated in an environment containing two jammers.

Since RFID devices have extremely low power requirements, of-ten making the use of cryptography difficult, jamming has beenconsidered as a possible security measure [10, 11, 21], but mostworks address the security of only a single RFID tag. Anothersystem with low capability devices is the wireless sensor network.Although, in many cases, cryptography is possible here [22], thefocus is on symmetric key cryptography due to the more resource-intensive nature of asymmetric key cryptography. Here, the pri-mary problem occurs during the key distribution phase [26], whereeavesdropping is still possible. The authors of [25] propose to usean intelligent jammer that utilizes cryptography in order to avoidinterfering with legitimate receivers. However, for the above men-tioned reasons, such techniques are inappropriate for RFID andwireless sensor networks. It is, thus, viable to consider physicallayer techniques in the context of sensor networks.

Gollakota et al. [6] have also used such a well-coordinated com-munication between source and jammers. These methods have sig-nificant advantages, but require reactive jammers (i.e., jammerssynchronized with other jammers) and a flexible physical layer.None of these assumptions are required for our work.

Vilela and Barros ( [28]) showed that without any assumptionson jammers and eavesdroppers’ location, one could still use othernodes as friendly jammers, as long as they avoid co-transmittingwith the legitimate transmitter and in the vicinity of a common des-tination. The authors show how to abstract this setting as a graph,and how to find an optimal subset of nodes using ILP. In [31] theauthors study asymptotic behaviour in a stochastic setting in whichjammers and eavesdroppers are at randomly distributed locations.In particular they study the concept of Secure Throughput, whichis based on the probability that a message is successfully receivedonly by the legitimate receivers.

To the best of our knowledge, [23,24] is the only work that adaptsjamming parameters to complex geometric positioning constraints.In this paper, we extend the results of [23,24] in a number of ways.

2. PRELIMINARIES: THE MODELModel of the Environment. We consider a Storage/Fence en-vironment model in which legitimate communication takes placewithin an enclosure specified by one or more polygonal regions,

S ⇢ R2, called the storage. We let LS denote the total perimeterof S. We do not assume any knowledge of the locations of nodes inS, but we do assume some properties of legitimate communication(described below). In particular, legitimate receivers and transmit-ters can be located at any point ps 2 S. Further, there exists acontrolled region, C ✓ R2, that contains S; no eavesdropper is ableto be within the interior of C. Outside of C is the uncontrolled re-gion, U . The boundary @C is referred to as the fence F. We assumethat C has no holes, but is not necessarily connected; it is a unionof simply connected regions. We let LF denote the perimeter of S(i.e., the length of the fence F). We are also given a region P wherejammers can be placed at points of A ✓ P . We refer to A as theallowable region. The allowable region permits us to model poten-tial restrictions on locations of jammers, e.g., that they be withina minimum distance of S, or that they be constrained to a specificsubset of locations, e.g. near power outlets or in locations that areeasily reached for maintenance purposes.

Storage S

Controlled region C

Uncontrolled region U

Fence F

eavesdropper

A jammer

w1 w2 w3

w4

Figure 2. A “floorplan” of an example scenario, with storage S andthe fence F enclosing the controlled region C. Jammers marked asantenna towers are placed between the fence and the storage.

Communication Model. Our communication model is similar tothat of [23, 24]. We assume that the transmission power ˜P is thesame for all legitimate transmitters and that communication in Sdoes not suffer significant path loss, i.e., for any transmission in S,the received power is ˜P . On the other hand, the signal at eavesdrop-pers does suffer path loss; formally, for an eavesdropper pe listen-ing to a transmitter ps 2 S, the received power is ˜Pkps � pek�� ,where � is the path-loss exponent, typically in the range [2, 6], andkp� qk is the Euclidean distance between p and q.

The Signal-to-Interference Ratio (SIR) is the ratio of the trans-mitted signal power to the total interference contributed by the jam-mers. Formally, for a legitimate receiver ps in S,

SIR(J, ps) =˜PP

j2J Pjkj � psk��,

where Pj is the transmission power of jammer j. For an eaves-dropper pe, since transmissions from the storage suffer path loss,we make the observation that the maximal signal power is receivedfrom a transmitter at the nearest location to pe on S (denoted by

s(pe)) and define

SIR(J, pe) =˜Pks(pe)� pek��

Pj2J Pjkj � pek��

.

As in [23, 24], we note that the total interference at a location pis usually dominated by the interference from the nearest jammerto p, if jammers J are sufficiently spread out, due to the receivedpower decreasing exponentially with distance.

In order that legitimate transmissions are adequately received,we require that SIR(J, ps) > �s, for points ps 2 S and some pa-rameter �s to be specified. Similarly, in order that eavesdroppers areunable to receive secure messages, we require that SIR(J, pe) <�e, for points pe 2 R2 \ C and some parameter �e. More formally,we make the following constraints on a set J of jammers:

SIR(J, ps) > �s, 8ps 2 S, and (1)

SIR(J, pe) < �e, 8pe 2 R2 \ C (2)

This model is the same as the widely accepted Physical Model de-scribed in [7].

Finally, as in [23, 24], we assume that the transmission powerof every jammer is at least (1/�e) ˜P . This is a reasonable assump-tion, as long as eavesdroppers are not extremely sensitive, and guar-antees that jamming F implies that all points in R2 \ C are alsojammed, and that the signal from the storage does not “hop over”the fence to more remote locations. On the contrary, removing thisassumption also implies that, with no assumptions on backgroundnoise, no placement of jammers can jam all possible eavesdropperlocations. See [23, 24] for details.

Remarks. (i) Throughout the paper, for reasons of simplicity ofexposition, we ignore the effects of background noise. However,this can be taken into account easily in the model, and all of ourschemes carry over with no change to the guarantees provided. (ii)We can remove the assumption that legitimate communication is offixed power if we have additional knowledge of node locations andtransmitted distance, i.e., we know the topology of the communi-cating network.

Note that constraints (1) and (2) take into effect all jammers(weighted by distance��). Thus, we refer to this model as the Full-interference model. We are now ready to formalize the problemsdiscussed in this paper, under this model.

PROBLEM 1 (OPT-PLACEMENT). Given1. A set, S, of storage region(s), each given as a polygonal re-

gion.2. The controlled region, C, such that S ✓ C. The boundary @C

is also called the fence, and is denoted F = C. We denoteby Cc

= R2 \ C the region which is outside the controlledregion.

3. An allowable region, A, where jammers can be placed.4. The transmission power, ˜P , of legitimate transmitters (e.g.

RFID tags).5. The path loss exponent, �.6. A bound, �s, on the SIR for legitimate receivers in S.7. A bound, �e. If the SIR at q 2 R2 is below �e, then tapping

into transmissions from S is impossible.8. The transmission power, ˆP , of each jammer.

The problem is to place a minimum number of fixed-power jammersin A to satisfy (1) and (2).

The simulations in [23, 24] suggest that when all jammers havethe same transmission power, the cumulative effect of the second,third, etc. nearest jammers to each point are negligible compared

to the effect of the nearest jammer. This is explained by the at-tenuation model, in which the received power decreases dramati-cally (exponentially) with distance. Hence, we study here a sec-ond model, called the Nearest Jammers Interference Model, or NJ-interference model for short, in which we assume that all jammersuse the same transmission power and that, for each point p 2 R2,we take into account only those jammers that are nearest to p.

PROBLEM 2. Same as Problem 1, except that for any point p,in the storage S or in the uncontrolled region U = R2 \ C, only theeffect of the nearest jammer to p needs to be taken into account inconstraints (1) and (2).

3. HARDNESS OF OPTIMAL JAMMERSPLACEMENT

In this section, we show hardness results for Problem 2 in thecase that S ⇢ R2 is a discrete set of regions/points, eavesdroppercan be placed only at points of a discrete set E ⇢ R2 of pointsdistinct from S, and jammers can be placed anywhere in the plane(i.e., the allowable region A = R2). Our reduction uses ideas fromthe NP-completeness proof of the problem HITTING-SET-FOR-PLANAR-UNIT-DISKS: Given a set D of disks of equal radii inthe plane and an integer k, compute whether there is a set P ✓ R2

such that D \ P 6= ; for all D 2 D and |P | k. [16] Thereduction employed in the NP-completeness proof of HITTING-SET-FOR-PLANAR-UNIT-DISKS is from the problem PLANAR-3-SAT [5].

THEOREM 1. Assume that the allowable region where jammerscan be placed is A = R2. Then, given a discrete set, S, of storageregions and a discrete set, E, of potential eavesdropper locations,disjoint from the regions S, OPT-PLACEMENT is NP-hard.

PROOF. For a given instance of PLANAR-3-SAT, the construc-tion used in the proof of NP-completeness of HITTING-SET-FOR-PLANAR-UNIT-DISKS considers a specific set D = {D1, . . . , Dm}of unit disks in the plane, and these disks have the following prop-erty: Each disk appears as an arc of positive length on the boundaryof the union, U , of the disks in D. To compute a hitting set for D,we can select one representative point per face of the arrangementof the m disks; therefore, it suffices for a hitting set to be selectedas a subset of points on the faces of this arrangement.

From D, we construct an instance of the problem OPT-PLACEMENT asfollows. First, we let E be the set of m centerpoints of the disks D.Let U 0 denote the union of disks of radius 1+�, with � > 0 chosensmall enough that U 0 has exactly the same combinatorial structureas U (the exact same arcs on each component of the boundary of theunion). Within each connected component of the set R2\U 0 (whichconsists of the “holes” in the union U 0 of disks, as well as the un-bounded face outside U 0) we construct a simple polygon, whichis one of the storage regions of the set S, that touches each of thecircular arcs bounding the face. (It is easy to see that such a poly-gon can be constructed having its number of vertices linear in thecomplexity of the face.) The set, P, of such polygons has the prop-erty that if each member polygon is grown by � (via Minkowskisum with a disk of radius �), then, with the appropriate choice of�e, constraint (2) requires that there must be a jammer within eachof the unit disks Di centered at the points E in order to satisfy (2)at these points E. In particular, each unit disk is in contact withthe (up to 5) regions grown from polygons P corresponding to thefaces to which the corresponding unit disk contributes an arc to theboundary of U . A minimum-cardinality set of jammers, then, cor-responds precisely to an optimal hitting set for the disks D. Thus,

there exists a jamming set of size k if and only if there exists ahitting set for D of size k.

4. JAMMER PLACEMENTIn this section, we present results for OPT-PLACEMENTin both

interference models. We are given a set, S, of storage regions anda polygonal fence F enclosing S. All jammers have fixed transmis-sion power ˆP . We consider two possible cases for the allowableregion, A: (i) the continuous case, in which A = C \ S and we usethe NJ-interference model (Section 4.2), and (ii) the discrete case,in which A ⇢ C \ S is a discrete set of candidate locations andwe use the Full-interference model (Section 4.3). In both cases, weprovide (1 + ")-approximation schemes.

In the above settings, we first describe how to prune significantportions of F. This will aid in bounding the running times of our al-gorithms. Following this, we describe our approximation schemes.

4.1 Pruning the FenceIn this section, we show how to discard portions of F (thereby re-

ducing the controlled region C) so that, at any point in the discardedportions, the SIR (under any interference model) is approximatedby the SIR at some remaining location. Thus, if eavesdropperslocated in the remaining portions are successfully jammed, anyeavesdropper on F, or anywhere outside C is also approximatelysuccessfully jammed. As stated, the approximation here means thatEquation (1) and Equation (2) hold, after possibly multiplying oneof the sides by a factor of (1 + ").

We first give a few definitions. Let @S be the boundary of S.For two points ps, qs 2 @S that belong to the same polygon inS, let psqs denote the portion of @S obtained by walking coun-terclockwise from ps to qs. We define peqe analogously for twopoints pe, qe 2 F. Let pipi+1⇢ @S be a straight line edge on @S(that is, pi, pi+1 are consecutive vertices of @S) . The general-

ized Voronoi region, denoted by Vor(pipi+1) is the set {p 2 R2 |s(p) 2 pipi+1}, where s(p) is the nearest point to p on S. Simi-larly define the Voronoi region of each vertex pi. The generalized

Voronoi diagram VD(S) is the subdivision of R2 induced by theVoronoi regions of edges and vertices of S. The restricted Voronoi

Diagram RVD(S,F) of S on F is the subdivision of F into seg-ments induced by VD(S) together with the vertices of F; see Fig-ure 3 for an illustration.

s1

s2

Vor(s1)

Vor(s1s2) S

F

Figure 3. Generalized and Restricted Voronoi Diagrams.

The generalized Voronoi diagram is a well-studied structure incomputational geometry [12,14] and can be computed in O(n log n)time. Consequently, the restricted Voronoi diagram RVD(S,F) canbe computed in time O(n2

).Before describing the pruning process, let us emphasize the in-

tuition behind its importance. Figure 4 illustrates two extreme yet

realistic scenarios, of a fence that is significantly larger than thestorage (top of Figure 4), and a fence containing a sharp and long“spike” (bottom of Figure 4). Theorem 2 (below) implies that inboth cases we can solve the optimization problem while consider-ing a much smaller fence, whose perimeter is proportional only tothe perimeter of the storage, and does not contain such sharp an-gles.

S

S

FF

Figure 4. Two extreme cases: The yellow region represents thefence, while the grey area is the storage S. The perimeter LS isarbitrarily smaller than the length of the fence. Theorem 2 statesthat, in order to jam all of F, it suffices to jam a subportion of thefence (highlighted in blue) whose length is comparable to LS.

The output of the pruning process is a set, ⌅, of segments, whichare edges of F. The main result is the following theorem, whoseproof is based on a series of lemmas associated with different stagesof the process; see the Appendix for the lemmas and proofs. Inspecifying the bounds below, we assume, for simplicity, that dis-tances are scaled so that the distance between the closest pair ofpoints p 2 S and q 2 F is 1.

THEOREM 2. Given a set, S, of storage regions, a fence F en-closing S such that eavesdroppers may lie on F, we can generate aset of segments ⌅ such that if a set J of jammers (not necessarilyusing the same transmission power) satisfies constraint (2) at alllocations pe 2 ⇠ for ⇠ 2 ⌅, then (2) is satisfied at all locations inF. Further,

(i) Each segment ⇠ 2 ⌅ is a subset of F;(ii) Any pair of segments in ⌅ is disjoint; and,

(iii)P

⇠2⌅ |⇠| = O((LS + n)/"), where |⇠| is the length of ⇠,and n is the total complexity of S and F.

4.2 Placement Within a Continuous AllowableRegion

In this section, we present a (1 + ")-approximation bi-criteriaapproximation scheme under the NJ-interference model when theallowable region A is a continuous (but not necessarily connected)domain consisting of all the points in the controlled region C thatare not too close to the storage S, as formalized below.

We first present a few necessary definitions. Let ˆP be the trans-mission power of a jammer and let ˜P be transmission power ofthe legitimate communication nodes. Let D[p; r] denote a disk ofradius r centered at a point p. Also, let ↵ = (�e ˆP/ ˜P )

1/� and� = (�s ˆP )

1/� be two parameters useful in simplifying the exposi-tion.

Definition 1. (i) The forbidden region '(S) is the region [ps2SD[ps;�].This is essentially the Minkowski sum [3] of S with a diskwith radius �. No jammer can lie in '(S) since it wouldcause too much interference to possible legitimate transmis-sions within S.

(ii) The allowable region is A = C \ '(S). (Our algorithmstraightforwardly generalizes to accommodate various otherassumptions on the allowable and forbidden regions.)

S

F

pe

'(S)

Vis(pe)

D(pe)

Figure 5. The forbidden region (marked in green) and visiblityregions for the case ↵ = 1

⇠

S

F

Figure 6. Arrangement of visibility regions

(iii) For a point pe 2 E, the critical disk is the disk D(pe) =

D[pe;↵ks(pe)�pek]. Under the NJ-interference model, thisdisk must contain a jammer in order to prevent an eavesdrop-per at pe from listening to transmissions within S, and, inparticular, to a transmitter placed in s(pe).

(iv) For a point in pe 2 F, the visibility region Vis(pe) is the re-gion D(pe)

SA. The vertices of Vis(pe) are the non-differentiable

points of Vis(pe). Refer to Fig. 5

As is easily observed from the above discussion, successful jam-ming can be obtained by a set J of jammers if and only if for everypoint pe 2 F, there is a jammer of J in Vis(pe). Note that a suc-cessful jamming might not exist under the above constraints; forexample, if � is too large (e.g. if �s is too small) the forbidden re-gion might contain essential portions of F.

Arrangements. Given a discrete set, E0, of points outside C, letthe arrangement A(E0, S,F) denote the subdivision of R2 inducedby the set of regions Vis(E0

) = {Vis(pe) | pe 2 E0}. The verticesof A(E0, S,F) are the intersection points of the visibility regions ofpoints in E0, together with the vertices of the visibility regions. Anedge of A(E0, S,F) is a portion of a visibility region between twovertices, and a face is a connected component of R2 \Vis(E0

). Thecomplexity of an arrangement is the total number of vertices, edgesand faces; see Figure 6.

We first present an optimal algorithm for a restricted case that isuseful in the analysis of the (1 + ")-approximation scheme for thegeneral case.

4.2.1 An Optimal Algorithm for a Special CaseWhen S is a (straight-line) segment and E is another (straight-

line) segment disjoint from S, we can find an optimal set of jam-mers, i.e., one of minimum cardinality such that (1) and (2) aresatisfied. Our algorithm is very similar to the algorithm presentedin [23,24] for the case of convex S and convex F enclosing S, with↵ = 1.

Apart from being an interesting case in which optimal results canbe achieved, this algorithm is used in the analysis of our approxi-mation algorithm for the general case (see Section 4.2.2) to boundthe running time.

Let E = peqe and S = psqs. The steps of the algorithm are asfollows:

1. Initialize point p = pe 2 E.2. For the current point p, compute the next point, p0 2 E, to

the right of p, such that D(p) and D(p0) are tangential.3. If p0 2 E, place a jammer at D(p)

TD(p0), set p to p0 and

repeat steps 2 and 3.4. If p0 /2 E, stop.See Figure 7 for an illustration of one step of the algorithm, and

Figure 8 for an illustration and the following step. Essentially, wecompute a sequence of disks, covering E, such that any two con-secutive disks are tangential and the number of disks is at mostOPT+ 1.

pe

p0e

s(pe) s(p0e)

E

S

D(pe)

D(p0e)

j

Figure 7. One step of the algorithm for disjoint segments, where↵ > 1. The outer disks centered at pe and p0e are the critical disksof pe and p0e, and their radii are ↵ks(pe)� pek and ↵ks(p0e)� p0ek,respectively. The algorithm places a jammer j at the intersectionpoint of these disks.

THEOREM 3. Given disjoint segments S = psqs and E = peqe,we can place a set of at most OPT+1 jammers J in time O(OPT)such that (i) 8p 2 E, SIR(J, p) < �e and (ii) 8p 2 S, SIR(J, p) >�s.

PROOF. The proof follows from the arguments in [23, cf. Sec-tion 5].

We use the property that there are at most OPT + 1 disks con-structed during the course of the algorithm in the analysis of theapproximation scheme in Section 4.2.2.

4.2.2 (1 + ")-Approximation for the General CaseIn this section, we present a bi-criteria polynomial-time approx-

imation scheme where we allow some leeway in both the number

D(pe

)D(p0

e

)

D(p00e

)

s(pe

) s(p0e

) s(p00e

)

E

S

pe

p0e

p00e

j1j2

Figure 8. Two steps of the algorithm for disjoint segments, when↵ = 1. Critical disks centred at pe (resp. p0e,p00e ) has radius ks(pe)�pek, (resp. ks(p0e) � p0ek, ks(p00e ) � p00ek). The witness point p0e islocated such that D[pe] and D[p0e] are tangential, and the algorithmplaces the first jammer j1 at D[p0e]\D[p00e ]. The process then repeatsfor locating the second jammers j2 and so on.

of jammers as well as the SIR at each point on E. The precisedescription of our result is given by the following theorem.

THEOREM 4. Given storage region(s) S, fence F, thresholds�s, �e and jammer power ˆP , under the NJ interference model, wecan compute locations J ⇢ A\'(S) in time O((T/"O(1)

)

O(1/"2)),

where T = min{L2F,L

2S, n

2OPT2}, such that |J | (1+")OPT,and if jammers of power ˆP are placed at J , then

(i) For any point pe 2 F, SIR(J, pe) < (1 + ")�e.(ii) For any point ps 2 S, SIR(J, ps) > �s.

The overall idea of the algorithm is to compute a discrete set ofwitness points E0 ⇢ E such that the SIR at any point in E \ E0 isapproximated by the SIR at some point in E0. Thus, if we ensurethat any point in E0 is successfully jammed, we ensure that anypoint in E is “almost” successfully jammed, i.e., we are off thethreshold by only a factor (1 + ").

Algorithm Description. The algorithm consists of the followingstages.

Stage (i). Generate witness points. The set E0 of witness pointsis constructed in two steps. First, we obtain a set of segments⌅ from F = @C according to Theorem 2 and add their end-points to E0. For each segment peqe in ⌅, we then place wit-ness points as described below in PLACE-WITNESSES. LetE0 be the set of these points.

Stage (ii). Generate Candidate Jammer Locations: We nowcompute a discrete set of candidate jammer locations J0 asfollows: compute Vis(pe) for each pe 2 E0 and compute thearrangement A(E0, S,F). For each face of the arrangementwe pick an arbitrary point and add it to J0.

Stage (iii). Find an almost-optimal set of jammers: Givendiscrete sets E0 and J0, the problem now transforms into thefollowing discrete hitting set problem: Given a discrete setof critical disks centered at points of E0 and a discrete setof points J0, compute a minimum cardinality subset J ⇢ J0

such that every critical disk contains at least one point in J .Although the minimum hitting set problem for disks is NP-Hard, we can obtain a (1+")-approximate solution using themethod of Mustafa and Ray [18] in time O(|E0||J 0|O(1/"2)

).If there is no feasible solution to the hitting set problem, thereis no feasible placement of jammers.

Procedure PLACE-WITNESSES(⌅). Let peqe be a segment in ⌅

and without loss of generality, let kpe�s(pe)k < kqe�s(qe)k. We

pe

qe

p0ep00e

r(p0e)

s(pe) s(qe)

"r(p0e)

D(p0e)

Figure 9. One step of procedure PLACE-WITNESSES

place witness points along peqe, starting at pe, until we reach qe.At an intermediate step, assume we are located at an already placedwitness point p0e 2 peqe. Let r(p0e) be the radius of the critical diskD(p0e). We place a witness point p00e on the portion p0eqe such thatkp0e � p00ek = "0r(p0e), where "0 is chosen such that (1 + "0)� (1 + ") and move to p00e (see Figure 9). If kqe � p0ek < "0r(p0e), weterminate the procedure. Let the set of witness points placed for asegment peqe be denoted by E0

peqe .

LEMMA 4.1. For any segment peqe and any point p0e 2 peqe,there exists a point p00e 2 E0

peqe such that, for any jammer j 2 J,

SIR(j, p00e ) �e ) SIR(j, p0e) (1 + ")�e.

PROOF. Assuming without loss of generality that kpe�s(pe)k kqe�s(qe)k, let p00e be the point closest to p0e on pep0e implying thatkp00e�p0ek "0↵kp00e�s(p00e )k. If, for a jammer j, SIR(j, p00e ) �e,then j 2 D[p00e ;↵kp00e � s(p00e )k]. Therefore,

kp0e � jk kp0e � p00ek+ ↵kp00e � s(p00e )k (1 + "0)↵kp0e � s(p0e)k,

since kp0e�s(p0e)k kp00e�s(p00e )k. Now, since (1+"0)� (1+"),by the choice of "0, the lemma is proved.

We add to E0 all points in E0peqe for all peqe 2 ⌅.

Analysis. It remains to bound the number of points in E0. Clearly,since the minimum distance between S and F is 1, for each segmentpeqe, procedure PLACE-WITNESSES places O(kpe � qek/"O(1)

)

witness points in E0. Thus, a simple bound is O(LF/"O(1)

).However, from Lemma 7.3, we have that for any segment peqe 2

⌅ such that s(peqe) is a vertex of S, PLACE-WITNESSES placesO(1/"O(1)

) witness points in E0. Combined with Theorem 2, weclearly have O(LS/"

O(1)) witness points placed by PLACE-WITNESSES.

We can also obtain a different bound independent of perimetersof S or F by a more complicated analysis.

LEMMA 4.2. For any segment peqe 2 ⌅ ✓ F such that s(peqe)is a single segment on S, PLACE-WITNESSES places O(OPT/"O(1)

)

witness points in peqe.

PROOF. Let ✓ = ✓c(peqe) be the critical angle (see Definition2 in the Appendix) of peqe. Consider any two points p0e, p

00e on

peqe such that D(p0e) and D(p00e ) are tangential to each other andkp0e � s(p0e)k kp00e � s(p00e )k. Then,

↵kp00e � s(p00e )k = ↵kp0e � s(p0e)k(1 + sin ✓)/(1� sin ✓).

Now, consider the set of points {pe,0, pe,1, . . . , pe,k} such thatpe,0 = p0e and

↵kpe,i � s(pe,i)k = ↵kpe,i�1 � s(pe,i�1)k(1 + sin ✓),

and k is the largest integer such that pe,k lies in between p0e and p00eon peqe.

Clearly, pe,i lies at the point of intersection of D(pe,i�1) andpeqe. We can now see that k = O(1/") from the fact that ↵kp00e �s(p00e )k = ↵kp0e � s(p0e)k(1 + sin ✓)/(1 � sin ✓) and that sin ✓ <

1/(1 + ")1/� for all segments in ⌅.We now use the algorithm from Section 4.2.1, which computes

a sequence of disks such that any two consecutive disks are tan-gential. From Theorem 3, it is clear that we can compute such asequence of at most O(OPT) disks to cover peqe.

For any disk in this set, PLACE-WITNESSES clearly places O(1/"O(1))

witness points. Thus, for a segment in ⌅, the total number of wit-ness points in E0 is O(OPT/"O(1)

).

Putting it all together, we have |E0| = O(

pT/"O(1)

) and |J0| =O(T/"O(1)

), where T = min{L2F,L

2S, n

2OPT2} thus complet-ing the proof of Theorem 4.

4.3 Discrete Candidate LocationsIn this subsection we study the usefulness of the pruning tech-

nique for jammer location under the Full-interference model aswell. Given storage region(s) S, a polygonal fence F enclosing Ssuch that eavesdroppers may lie on F, in [23, 24] the authors showhow, given a discrete set J of candidate locations of jammers, tocompute a minimum cardinality set J ✓ J, such that Equations (1)and (2) are satisfied, up to a factor of at most (1 + ").

Given J, the algorithm first identifies two sets, S0 ⇢ S andE0 ⇢ R2 \ S, of witness points. From these sets, an Integer LinearProgram (ILP) is determined in which each witness point yields oneconstraint, yielding overall O(|E0|+ |S0|) constraints. The solutionprovides a bi-criteria approximation similar to our results above,which hold for any point in S or outside of C. However, it is im-portant to reduce the number of constraints as much as possible,especially for the ILP whose computation cost can be very high;in this case, a decrease in the number of constraints is achievedthrough a reduction in the number of witness points. Specifically,we apply our pruning techniques from Section 4.1. Thus, we obtainthe following theorem:

THEOREM 5. Given storage region(s) S, fence F, discrete can-didate jammer locations J, thresholds �s, �e and jammer powerˆP , under the Full interference model, we can compute a set oflocations J ⇢ E by solving an integer linear program with atmost O(k(n2/"O(1)

)(log

2(n/"O(1)

) + log T )) constrains, whereT = min{LF,LF} such that |J | (1 + ")OPT and if jammersof power ˆP are placed at J ,

(i) For any point pe 2 E, SIR(J, pe) < (1 + ")�e.(ii) For any point ps 2 S, SIR(J, ps) > (1� ")�s.

The paper [23, 24] discusses a similar algorithm for assigningpower to the jammers, while having their locations fixed. A resultanalogous to Theorem 5 holds for this case as well.

5. CONCLUSIONIn this paper, we have considered optimization problems in place-

ment and power consumption of jammers designed to protect wire-less communication within a specified region from eavesdropperswho are outside, physically isolated from this region. While wehave shown that the general optimization problem is NP-Hard, wehave also provided efficient (1+ ")-approximation schemes for theplacement of a minimum number of jammers. Our schemes areproactive and require minimal knowledge of the communicationsystem being protected.

6. ACKNOWLEDGMENTA. Efrat was partially supported by the National Science Founda-

tion (CNS-1017114). G. Grebla was partially supported by the De-fense Threat Reduction Agency grant HDTRA 1-13-1-0021. E. Arkinand J. Mitchell were partially supported by the National ScienceFoundation (CCF-1018388) and by the US-Israel Binational Sci-ence Foundation (Grant 2010074).

7. REFERENCES[1] D. S. Alberts, J. J. Garstka, and F. P. Stein. Network centric

warfare: Developing and leveraging information superiority.Technical report, DTIC Document, 2000.

[2] D. W. Bliss. Robust MIMO wireless communication in thepresence of interference using ad hoc antenna arrays. InIEEE Military Communications Conference, MILCOM’03,volume 2, pages 1382–1385. IEEE, 2003.

[3] M. de Berg, M. van Kreveld, M. Overmars, andO. Schwarzkopf. Computational Geometry: Algorithms andApplications. Springer-Verlag, 2000.

[4] S. A. Fakoorian and A. L. Swindlehurst. Solutions for theMIMO Gaussian wiretap channel with a cooperative jammer.IEEE Transactions on Signal Processing, 59(10):5013–5022,2011.

[5] M. R. Garey and D. S. Johnson. Computers andIntractability: A Guide to the Theory of NP-Completeness.W. H. Freeman, 1979.

[6] S. Gollakota, H. Hassanieh, B. Ransford, D. Katabi, andK. Fu. They can hear your heartbeats: Non-invasive securityfor implantable medical devices. ACM SIGCOMM ComputerCommunication Review, 41(4):2–13, 2011.

[7] P. Gupta and P. R. Kumar. The capacity of wireless networks.IEEE Transactions on Information Theory, 46(2):388–404,2000.

[8] Z. Han, N. Marina, M. Debbah, and A. H. rungnes. Physicallayer security game: Interaction between source,eavesdropper, and friendly jammer. EURASIP Journal onWireless Communications and Networking, 2009(1):452907,2009.

[9] M. Hendry. Multi-application Smart Cards: Technology andApplications. Cambridge University Press, 2007.

[10] A. Juels and J. Brainard. Soft blocking: Flexible blocker tagson the cheap. In Proc. 2004 ACM Workshop on Privacy inthe Electronic Society (WPES), pages 1–7, 2004.

[11] A. Juels, R. L. Rivest, and M. Szydlo. The blocker tag:selective blocking of RFID tags for consumer privacy. In10th ACM Conference on Computer and CommunicationsSecurity, pages 103–111, 2003.

[12] D. G. Kirkpatrick. Efficient computation of continuousskeletons. In 20th Annual IEEE Symposium on Foundationsof Computer Science (FOCS’79), pages 18–27, 1979.

[13] L. Lai and H. E. Gamal. The relay-eavesdropper channel:Cooperation for secrecy. IEEE Transactions on InformationTheory, 54(9):4005–4019, 2008.

[14] D. T. Lee and R. L. Drysdale. Generalization of Voronoidiagrams in the plane. SIAM Journal on Computing,10(1):73–87, 1981.

[15] D. Malan, T. Fulford-Jones, M. Welsh, and S. Moulton.Codeblue: An ad hoc sensor network infrastructure foremergency medical care. In Proc. 1st InternationalWorkshop on Wearable and Implantable Body SensorNetworks, pages 55–58, 2004.

[16] N. Megiddo and K. Supowit. On the complexity of somecommon geometric location problems. SIAM Journal onComputing, 13(1):182–196, 1984.

[17] A. Mukherjee and A. L. Swindlehurst. Jamming games in theMIMO wiretap channel with an active eavesdropper. IEEETransactions on Signal Processing, 61(1):82–91, 2013.

[18] N. H. Mustafa and S. Ray. Improved results on geometrichitting set problems. Discrete and Computational Geometry,44:883–895, 2010.

[19] R. Negi and S. Goel. Secret communication using artificialnoise. In Proc. IEEE 62nd Vehicular Technology Conference,pages 1906–1910, 2005.

[20] J. Nehmer, M. Becker, A. Karshmer, and R. Lamm. Livingassistance systems: An ambient intelligence approach. In28th International Conference on Software Engineering,pages 43–50, 2006.

[21] P. Peris-Lopez, J. Hernandez-Castro, J. Estevez-Tapiador,and A. Ribagorda. RFID systems: A survey on securitythreats and proposed solutions. In Personal WirelessCommunications, volume 4217 of LNCS, pages 159–170.Springer, 2006.

[22] A. Perrig, J. A. Stankovic, and D. Wagner. Security inwireless sensor networks. Communications of the ACM,47(6):53–57, 2004.

[23] S. Sankararaman, A. K. Abu-Affash, A. Efrat, S. D.Eriksson-Bique, V. Polishchuk, S. Ramasubramanian, andM. Segal. Optimization schemes for protective jamming. In13th ACM International Symposium on Mobile Ad HocNetworking and Computing, MobiHoc’12, Hilton Head, SC,USA, June 11-14, 2012, pages 65–74, 2012.

[24] S. Sankararaman, K. Abu-Affash, A. Efrat, S. D.Eriksson-Bique, V. Polishchuk, S. Ramasubramanian, andM. Segal. Optimization schemes for protective jamming.Mobile Networks and Applications, 19(1):45–60, 2014.

[25] W. Shen, P. Ning, X. He, and H. Dai. Ally friendly jamming:How to jam your enemy and maintain your own wirelessconnectivity at the same time. In IEEE Symposium onSecurity and Privacy, pages 174–188, 2013.

[26] M. A. Simplício Jr., P. S. L. M. Barreto, C. B. Margi, andT. C. M. B. Carvalho. A survey on key managementmechanisms for distributed wireless sensor networks.Computer Networks, 54(15):2591–2612, 2010.

[27] X. Tang, R. Liu, P. Spasojevic, and H. V. Poor. Interferenceassisted secret communication. IEEE Transactions onInformation Theory, 57(5):3153–3167, 2011.

[28] J. P. Vilela and J. Barros. Collision-free jamming forenhanced wireless secrecy. In IEEE 14th InternationalSymposium on "A World of Wireless, Mobile and MultimediaNetworks", WoWMoM 2013, Madrid, Spain, June 4-7, 2013,pages 1–6, 2013.

[29] J. P. Vilela, M. Bloch, J. Barros, and S. W. McLaughlin.Wireless secrecy regions with friendly jamming. IEEETransactions on Information Forensics and Security,6(2):256–266, 2011.

[30] J. P. Vilela, M. R. Bloch, J. Barros, and S. W. McLaughlin.Friendly jamming for wireless secrecy. In IEEEInternational Conference on Communications, ICC’10, CapeTown, South Africa, 23-27 May 2010, pages 1–6, 2010.

[31] J. P. Vilela, P. C. Pinto, and J. Barros. Jammer selectionpolicies for secure wireless networks. In CommunicationsWorkshops (ICC), 2011 IEEE International Conference on,pages 1–6. IEEE, 2011.

[32] A. D. Wyner. The Wire-tap Channel. Bell Systems TechnicalJournal, 54(8):1355–1387, 1975.

Appendix: The proof of Theorem 2The pruning process employs the following steps. Initially, wecompute RVD(S,F). For any fence segment peqe in RVD(S,F),let s(peqe) be the set {ps 2 S | 9p0e 2 peqe, s(p0e) = ps}. Let ⌅v

be the segments peqe 2 RVD(S,F) such that s(peqe) is a singlevertex of S and let ⌅s be the remaining segments. For each segmentpeqe 2 ⌅v such that p0e is the closest point to s(peqe) on the linethrough pe and qe, if p0e 2 peqe, we replace peqe with pep0e andp0eqe in ⌅v .

With the sets of segments ⌅v and ⌅s, we further shorten or re-move segments according to the following lemmas. The proofshold under both interference models.

LEMMA 7.1. For any segment peqe 2 ⌅s, (i) s(peqe) is eithera segment sese0 along the boundary of some region in S, and (ii)for some p0e 2 E, if the segment connecting p0e to s(p0e) intersects Eat some point p00e , then, for any J ⇢ J,

SIR(J, p00e ) < �e ) SIR(J, p0e) < �e.

PROOF. Clearly, (i) is true. The proof of (ii) follows from [23,cf. Lemma 3.1].

Lemma 7.1 implies that we can shorten all segments in RVD(S,F)to portions such that for any point pe in the remaining portions, thesegment connecting pe and s(pe) does not intersect F. Let ⌅s and⌅v be replaced with the segments obtained through this shortening.

pe

qe

ps = s(pe)

✓

qs = s(qe)

pe

qe

ps = s(peqe)✓

p(a) s(peqe) = psqs (b) s(peqe) = ps

Figure 10. Critical angle ✓ = ✓c(peqe) for a segment peqe.

Definition 2. The critical angle ✓c(peqe) (see Figure 10) for asegment peqe 2 ⌅ is defined as follows (assuming without loss ofgenerality kqe � s(qe)k � kpe � s(pe)k):

(i) If s(peqe) is a segment psqs, then ✓(peqe) is the angle be-tween the lines containing peqe and psqs

(ii) If s(peqe) is a vertex ps 2 S, then ✓(peqe) is the angle \qepspwhere p is the closest point to ps on the line containing peqe.

We define the grazing angle

ˆ✓ = sin

�1

1

(1 + ")1/�

!.

LEMMA 7.2. For a segment peqe 2 ⌅s, if the critical angle✓c(peqe) > ˆ✓, then,

(i) kpe � qek = O(

1")ks(pe)� s(qe)k.

(ii) For any J ⇢ J, if SIR(J, pe) < �e, then, for any p0e 2 peqe,SIR(J, p0e) (1 + ")�e.

✓

ks(pe)� pek

kp0e � pek sin ✓

↵ks(pe)� pek + kp0e � pek

pe

s(p

0e)s(pe)

j

D(pe)

qe

p0e

Figure 11. Illustration of proof of Lemma 7.2

PROOF. Let ✓ = ✓c(peqe). The proof of part (i) follows fromthe fact that kpe � qek = ks(pe) � s(qe)k/ cos ✓. We prove part(ii) under the NJ-interference model as follows. The proof underthe Full-interference models follows from combining this with [23,cf. Lemma 3.1]. Since SIR(j, pe) �e, j 2 D(pe). For anyp0e 2 peqe, we have

SIR(j, p0e) ˜Pks(p0e)� p0ek��

ˆPkj � p0ek��

˜PˆP

✓kp0e � pek+ kj � pek

kp0e � pek sin ✓ + ks(pe)� pek

◆�

,

since ks(p0e)�p0ek = kp0e�pek sin ✓+ks(pe)�pek and by triangleinequality, kj � p0ek kp0e � pek + kj � pek. See Figure 11 foran illustration. Further,

SIR(j, p0e) ˜PˆP

kp0e � pek+ ↵ks(pe)� pek

kp0e � pek( 11+"

)

1/�+ ks(pe)� pek

!�

(1 + ")↵�˜PˆP (1 + ")�e,

since kj � pek ↵ks(pe) � pek, ↵ � 1 and (1 + ")1/� � 1.Thus, the lemma is proved.

Based on Lemma 7.2, we then prune all segments of peqe of ⌅s

such that ✓c(peqe) > ˆ✓. We remove all such segments from ⌅s andkeep only their lower endpoint (as a degenerate segment).

LEMMA 7.3. For a segment peqe 2 ⌅v , whose critical angle✓(peqe) > ˆ✓ let ps = s(peqe) and p00e be the point on peqe suchthat \p00epsp0e =

ˆ✓ where p0e is the closest point to ps on the linecontaining peqe. We now have,

(i) kpe � p00ek = O(

1")kps � pek.

(ii) For any set of jammers J ⇢ J, if SIR(J, p00e ) < �e, then, forany p000e 2 p00e qe, SIR(J, p000e ) < (1 + ")�e.

PROOF. We have tan\p00epsp0e = kp00e � p0ek/kp0e � psk =

O(1/"). Since kp00e �p0ek � kp00e �pek and kp0e�psk kpe�psk,part (i) is proved. Part (ii) can be proved in a manner similar to theproof of part (ii) of Lemma 7.2.

Lemma 7.3 implies that we can shorten all segments that lie inthe Voronoi region of a vertex of S and have a high critical angle

S

S

F

S

S

F

S

S

F

Figure 12. The solid lines represent the portion of the fence that needs to be considered, while the dashed lines represent portions that can bepruned and the thin dotted lines are the edges of the Voronoi diagram of S based on which the pruning is performed. (left) Original scenario,(middle) After pruning based on Lemma 7.1, (right) After pruning based on Lemmas 7.2 and 7.3.

such that, once shortened, the critical angle is exactly ˆ✓. The finalset ⌅ is the resulting set of segments ⌅v [ ⌅s.

Figure 12 shows the effects of this pruning process through anexample. In each case, the dashed edges are the portions of thefence that are pruned. Figure 12(a) shows the scenario where wehave two storage regions in S inside a fence F. Figure 12(b) showsthe effects of pruning based on Lemma 7.1 while Figure 12(c)shows the pruned portions based on Lemmas 7.2 and 7.3. As canbe seen, a significant portion of the fence need not be considered.

Combining Lemmas 7.1, 7.2 and 7.3, Theorem 2 is proved. QED.

We can actually prune further using the following lemma:

SE

F

x

pepe

qe �p

0e

Figure 13. The settings of Lemma 7.4. Masking a connected por-tion of F by the two segments pex and qex (not on F), in order toprune this portion.

LEMMA 7.4. Assume next that u and v are points in F. Let � bethe portion of @F between pe and qe, and E ⇢ @S be a straight-linesegment such that for every p0e 2 �, s(p0e) 2 E, and p0es(p0e) ⇢ C.Refer to Fig. 13.

Assume that in addition there is a point x 2 C such that• pex ⇢ C \ S.• qex ⇢ C \ S.• s(pex) ⇢ E and s(qex) ⇢ E and• ✓c(pex) > ˆ✓ and ✓c(qex) > ˆ✓

Then for any J ⇢ J if SIR(J, pe) < �e, and SIR(J, qe) < �e then,for any p0e 2 �, SIR(J, p0e) (1 + ")�e.