Security Problems in Software Defined Radio

1
Security Problems in Software Defined Radio

• By Hardy Chang
• 11/16/2006

2
Overview

• Introduction
• Software Defined Radio Technology for Public
  Safety by Public Safety SIG
• Towards a Fraud-Prevention Framework for
  Software Defined Radio Mobile Devices by
  Alessandro Brawerman and John A. Copeland
• Technical Document on Cognitive Radio Networks
  by Joe Evans, Gary Minden, and Ed Knightly

3
Introduction

• www.sdrforum.org
• The attributes of the system can be changed by
  bringing in new application software without any
  change, replacement, or modification of hardware

4
Introduction

• Tier 0 Hardware Radio
• Modified through physical intervention
• Tier 1 Software Controlled Radio
• Inter-connects and power levels, but not
  frequency bands or modulation types
• Tier 2 Software Defined Radio
• Modulation techniques, security functions

5
Introduction

• Tier 3 Ideal Software Radio
• Entire system
• Tier 4 Ultimate Software Radio
• For comparison purposes only
• Accept programmable traffic, control information
• Support broad range of frequencies and
  application software

6
Public Safety

• In USA, more than 55,000 agencies on disparate
  technologies, frequency bands, and protocols
• Require additional equipments
• May become obsolete as system radios are upgraded
• High cost
• Limited spectrum

7
Security Background

• Radio Configuration Data (R-CFG) download,
  storage, and installation
• Tamper-proof hardware
• Users Privacy
• Replace MAC address with Temporal Mobile
  Identifier (TMI) or Pseudorandom Interface
  Identifier (PII)

8
Security Background

• Software Defined Radio Mobile Device (SDR-MD)
  cloning
• Advanced mobile phone system (AMPS)
• Global system for mobile communication (GSM)
  SIM card
• Universal Mobile Telecommunications System (UMTS)
  SIM card

9
Preliminary Design

• Brawerman and Copeland

10
Tamper-Protected H/W Package
11
SDR R-CFG Download Protocol

• Brawerman and Copeland

12
Anti-Cloning

• Bawerman and Copeland
• AC Attestation Credential used to identify
  SDR-MD, signed by privacy CA and presented when
  connecting to network

13
Anti-Cloning

• Brawerman and Copeland

14
Anti-Cloning

• Brawerman and Copeland

15
Cloning Aware SDR-MD

• Brawerman and Copeland

16
Cloning Aware WO

• Brawerman and Copeland

17
Cognitive Radio Features

• Sensing the current radio frequency spectrum
  environment
• Policy and configuration databases
• Self-configuration (plug-and-play)
• Adaptive algorithms
• Distributed collaboration
• Security

18
Cognitive Radio Characteristics

• Operating environment sensing
• Robust communications services with unreliable
  links
• Operational state languages
• Distributed resource management

19
Software Organizations

• Radio Hardware
• Radio frequency circuitry and signal processing
  devices
• Software Modules
• Code loaded to FPGA or DSP
• Middleware
• Reduce details of specific devices and software
  modules to common abstraction

20
Software Organizations

• Logical Radio Layer
• Multiple radio links
• Device Manager
• Loads radio configurations into hardware
  components
• Configuration Manager
• Determines available radio
• Interacts with module libraries

21
Software Organizations

• Module Libraries
• Collections of radio functions
• Rules Engine and Policies
• Operations limited due to regulatory,
  geographical or physical constraints
• Interpret policies
• Smart Controller
• Manages all resources

22
Experimental Infrastructures

• Flexible Cognitive Radio Network Test Environment
• Large, shielded anechoic (RF) chamber
• RF emission generators
• RF measurement instrumentation
• Data management facility
• Open Air Cognitive Radio Network Test Environment
• Open air CR testbed

23
Experimental Infrastructures

• SDR Experimental Platforms (SDR Kits)
• Support in multiple areas
• Support at every levels
• Have industry input and support
• Simulation and Emulation Tools
• Enable many research teams to participate