More Like this

1. LTE PHY layer vulnerability analysis and testing using open-source SDR tools

   https://doi.org/10.1109/MILCOM.2017.8170787  

   Rao, Raghunandan M.; Ha, Sean; Marojevic, Vuk; Reed, Jeffrey H. (October 2017, Military Communications Conference (MILCOM), MILCOM 2017 - 2017 IEEE)

   This paper provides a methodology to study the PHY layer vulnerability of wireless protocols in hostile radio environments. Our approach is based on testing the vulnerabilities of a system by analyzing the individual subsystems. By targeting an individual subsystem or a combination of subsystems at a time, we can infer the weakest part and revise it to improve the overall system performance. We apply our methodology to 4G LTE downlink by considering each control channel as a subsystem. We also develop open-source software enabling research and education using software-defined radios. We present experimental results with open-source LTE systems and shows how the different subsystems behave under targeted interference. The analysis for the LTE downlink shows that the synchronization signals (PSS/SSS) are very resilient to interference, whereas the downlink pilots or Cell-Specific Reference signals (CRS) are the most susceptible to a synchronized protocol-aware interferer. We also analyze the severity of control channel attacks for different LTE configurations. Our methodology and tools allow rapid evaluation of the PHY layer reliability in harsh signaling environments, which is an asset to improve current standards and develop new and robust wireless protocols. 

   more » « less
2. PhyAuth: Physical-Layer Message Authentication for ZigBee Networks

   Li, Ang; Zhang, Yan; Li, Jiawei; Han, Dianqi; Li, Tao; Zhu, Ting; Zhang, Yanchao (August 2023, Proceedings of the 32nd USENIX Security Symposium)

   ZigBee is a popular wireless communication standard for Internet of Things (IoT) networks. Since each ZigBee network uses hop-by-hop network-layer message authentication based Yanchao Zhang Arizona State University Star E E Tree E E R E Mesh E E R E E E on a common network key, it is highly vulnerable to packetC E injection attacks, in which the adversary exploits the compromised network key to inject arbitrary fake packets from any spoofed address to disrupt network operations and conCoordinator C R E sume the network/device resources. In this paper, we present PhyAuth, a PHY hop-by-hop message authentication frameE E C R R E E E R R C R E E Router E E E End Device Figure 1: ZigBee network topologies. work to defend against packet-injection attacks in ZigBee networks. The key idea of PhyAuth is to let each ZigBee E The coordinator acts as a central node responsible for mantransmitter embed into its PHY signals a PHY one-time password (called POTP) derived from a device-specific secret key and an efficient cryptographic hash function. An authentic POTP serves as the transmitter’s PHY transmission permission for the corresponding packet. PhyAuth provides three schemes to embed, detect, and verify POTPs based on different features of ZigBee PHY signals. In addition, PhyAuth involves lightweight PHY signal processing and no change to the ZigBee protocolstack. Comprehensive USRP experiments confirm that PhyAuth can efficiently detect fake packets with very low false-positive and false-negative rates while having a negligible negative impact on normal data transmissions. 

   more » « less
3. Demo: Decoding Control Information Passively from Standalone 5G Network

   https://doi.org/10.1145/3636534.3698840  

   Wan, Haoran; Cao, Xuyang; Marder, Alexander; Jamieson, Kyle (December 2024, ACM)

   5G New Radio cellular networks are designed to provide high Quality of Service for application on wirelessly connected devices. However, changing conditions of the wireless last hop can degrade application performance, and the applications have no visibility into the 5G Radio Access Network (RAN). Most 5G network operators run closed networks, limiting the potential for co-design with the wider-area internet and user applications. This paper demonstrates NR-Scope, a passive, incrementally-deployable, and independently-deployable Standalone 5G network telemetry system that can passively measure fine-grained RAN capacity, latency, and retransmission information. Application servers can take advantage of the measurements to achieve better millisecond scale, application-level decisions on offered load and bit rate adaptation than end-to-end latency measurements or end-to-end packet losses currently permit. We demonstrate the performance of NR-Scope by decoding the downlink control information (DCI) for downlink and uplink traffic of a 5G Standalone base station in real-time. 

   more » « less
4. Energy-Efficient Power Allocation in Multi-User mmWave Systems With Rate-Splitting Multiple Access

   https://doi.org/10.1109/VTC2024-Fall63153.2024.10757833  

   Everett, Jared; Fasihi, Mohammad Reza; Griva, Igor; Mark, Brian L (October 2024, IEEE)

   We propose an energy-efficient power allocation algorithm for the multi-user millimeter-wave (mmWave) rate-splitting multiple access (RSMA) downlink with hybrid precoding and quality of service (QoS) constraints. The proposed scheme is applicable to the physical layer design of future wireless networks, such as the 6G cellular downlink, in which a transmitter equipped with multiple antennas must communicate unicast messages to multiple receivers simultaneously. First, we use a low-complexity design to define the analog and digital precoders in closed form. Second, we define an energy efficiency (EE) maximization problem to jointly optimize the power allocation among streams and the common stream rate allocation among users. We then solve the problem using a combination of Dinkelbach’s algorithm and difference of convex functions (DC) programming methods. Simulation results show that the proposed RSMA scheme offers EE improvements over a comparable space division multiple access (SDMA) power allocation scheme in scenarios with perfect and imperfect channel state information at the transmitter. Lastly, we present extensive numerical experiments that suggest that the computational complexity of the proposed RSMA energy-efficient power allocation algorithm can be reduced using the interior-point method such that the computational efficiency of RSMA is comparable to that of SDMA. 

   more » « less
5. Graph-based Namespaces and Load Sharing for Efficient Information Dissemination in Disasters

   https://doi.org/10.1109/ICNP.2019.8888047  

   Jahanian, Mohammad; Chen, Jiachen; Ramakrishnan, K. K. (October 2019, 2019 IEEE 27th International Conference on Network Protocols (ICNP))

   Timely, flexible and accurate information dissemination can make a life-and-death difference in managing disasters. Complex command structures and information organization make such dissemination challenging. Thus, it is vital to have an architecture with appropriate naming frameworks, adaptable to the changing roles of participants, focused on content rather than network addresses. To address this, we propose POISE, a name-based and recipient-based publish/subscribe architecture for efficient content dissemination in disaster management. POISE proposes an information layer, improving on state-of-the-art Information-Centric Networking (ICN) solutions such as Named Data Networking (NDN) in two major ways: 1) support for complex graph-based namespaces, and 2) automatic name-based load-splitting. To capture the complexity and dynamicity of disaster response command chains and information flows, POISE proposes a graph-based naming framework, leveraged in a dissemination protocol which exploits information layer rendezvous points (RPs) that perform name expansions. For improved robustness and scalability, POISE allows load-sharing via multiple RPs each managing a subset of the namespace graph. However, excessive workload on one RP may turn it into a “hot spot”, thus impeding performance and reliability. To eliminate such traffic concentration, we propose an automatic load-splitting mechanism, consisting of a namespace graph partitioning complemented by a seamless, loss-less core migration procedure. Due to the nature of our graph partitioning and its complex objectives, off-the-shelf graph partitioning, e.g., METIS, is inadequate. We propose a hybrid partitioning solution, consisting of an initial and a refinement phase. Our simulation results show that POISE outperforms state-of-the-art solutions, demonstrating its effectiveness in timely delivery and load-sharing. 

   more » « less