Antenna-Transceiver Integration

1. Antenna-Transceiver Integration • Meeting selectivity specs is one of the big challenges for this architecture • Our approach: RF multiplexer optimized to antenna impedance with external noise dominance constraint • No antenna tuning! • Simultaneous access to • multiple bands “Transducer power gain” for RF multiplexer optimized for a 20 cm long monopole antenna “External noise dominance” in VHF-High and 220 MHz bands RF Front End (RFFE) Board S.M. Shajedul Hasan and S.W. Ellingson, “Multiband Antenna-Receiver Integration using an RF Multiplexer with Sensitivity-Constrained Design,” IEEE 2008 Int'l Symp. Ant. & Prop.

2. Direct Conversion Transceiver Sections (2nd Gen.) These two boards stack vertically with the RFFE board using MMCX connectors (no RF cables)‏ ADC / DAC / LO Synthesizer Board (2nd Gen.) ADC/DAC: 130 mA @ 9V, running 4 MSPS < 50 cm2 to implement on a 4-layer PCB ADC ~ $21 (1k), DAC ~ $10 (1k) 4-Band Transceiver Board (2nd Gen.) 40 mA (RX) + 40-90 mA (TX) + 80 mA/DDS @ 9V < 25 cm2 to implement on a 4-layer PCB About $100 in parts to implement, excluding PCB.

3. Baseband Design Actually Used • Prototype currently implemented on • an Altera Stratix II FPGA (EP2S60). • Massive overkill (60k LEs) but board • familiar and readily available. • Implemented directly via FPGA: • Analog FM waveform • Synthesis of 4 MHz ADC/DAC clocks • Interfaces to codec, ethernet, and display controller chips • In our project, it appears that we will not need to implement a soft-core processor: We are currently 100% Verilog HDL. • Target FPGA is Altera Cyclone III; 25k LEs, about $50 (chip). Power consumption is variable and hard to predict, but state-of-the-art power management features are available.

5. Thanks! Acknowledgements: Motorola: G. Cafaro,B. Stengle, N. Correal Mahmud Harun (student) Rithirong Thandee (student) Web Sites: http://www.ece.vt.edu/swe/chamrad/ http://www.ece.vt.edu/swe/ http://wireless.vt.edu/ U.S. Dept. of Justice National Institute of Justice Grant 2005-IJ-CX-K018

6. SDR/CR Security Jung-Min “Jerry” Park and Tim Newman

7. Security Issues in Cognitive Radio Networks Jung-Min “Jerry” Park

8. Taxonomy of CR Network Security Threats

9. SDR/CR Software Tampering • Adversary can alter radio operating characteristics by modifying SW • Software critical to radio operating characteristics • Policies (policy database) • System strategy reasoner • Policy reasoner XG radio architecture [3]. [3] D. Wilkins et al., “Policy-based cognitive radios,” IEEE Wireless Comm., Aug. 2007.

10. Our Approach for CR Software Tamper Resistance Applying tamper resistance to unprotected assembly code. Contribution of each operation on runtime overhead.

11. Testing & Implementation of Our Scheme Tamper resistance primitives embedded into assembly code GNU Radio USRP board Tamper resistant executable code

12. Policy-related Security Issues • Policy enforcement • Need to ensure that SDR’s configuration conforms w/ regulatory and system policies • Need a “Policy Enforcer (PE)” • Erroneous radio operation due to policy conflicts • CRs operate in the presence of multiple policies from multiple stakeholders • When multiple policies are activated, CR needs to resolve conflicts among policies [6] F. Perich et al., “Policy-based spectrum access control for dynamic spectrum access network radios,” Web Semantics Sci Serv Agents World Wide Web, 2008. [7] P. Flanigan et al., “Dynamic policy enforcement for software defined radio,” 38th Annual Simulation Symposium, 2005. Policy enforcement in XG radio [6]

13. Need for CR Policy Analysis • Motivation for policy analysis • Need to identify policy conflicts • Policy analysis results can be used to aid • Policy Reasoner’s computation of opportunity constraints • Creation of meta-policies for prioritization of policies • Shared Spectrum Company’s policy conflict resolution scheme consists of a combination of a default rule and a prioritization schemata Spectrum access opportunity discovery in XG radio [6]

14. Our Approach for CR Policy Analysis A graph-theoretic approach for policy analysis [8] G. Denker et al., “A policy engine for spectrum sharing,” IEEE DySpan, Apr. 2007. SRI International’s policy reasoning procedure [8]

15. Cognitive Radio Security Issues (Overview) Timothy R. Newman, Ph.D.

16. Cognitive Radio Introduction • Cognitive Radios (CR) and CR Networks offer amazing promise • Intelligent Radios • Self Adapting • Improve Overall Communications • Primary Focus of research has not been security • DSA • Cognitive Engines (GA/CBR/Rule-based) • New Technology means new Threats • Putting AI in charge of radio operation causes potential problems

17. Cognitive Radio Introduction • Multiple Classes of new CR specific attacks • Sensory Manipulation • Belief Manipulation • Cognitive Radio Viruses • Common goal of creating sub optimal communication or malicious communication • CRs need common sense in order to overcome these attacks

18. Policy Radio Threats • Policy Radios • No learning involved • Basically just a validation and recommendation engine • Shared Spectrum Radios are DSA Policy Radios • Primary concern is sensor spoofing or “sensory manipulation attacks”. • Rely on knowledge of internal logic • What types of inputs are being used • How these input statistics are calculated • How they affect the transmission parameters – (e.g. the fitness function)

19. Learning Radio Threats • Vulnerable to the same threats as Policy radios with an added twist. • Learning radios make decisions based off previous experiences • Threat damage can be long term • Example: Jam the communication of a learning radio whenever it uses a fast modulation rate. • This TEACHES the radio to that fast modulations produce an extremely high BER. Forcing it to use lower modulation rates. • Learning radio may store this in memory after X number of attacks causing long term damage. • Cognitive Radio Networks can proliferate malicious actions. • The state of Radio 1 can affect the state of Radios 2,3, and 4. • Cognitive Radio Network virus!

20. Objective Function Attacks • On path attackers can determine key characteristics • Symbol Rate • Modulation • Manipulation the beliefs of the CR using environment parameters • Example: Jam channel when using High Security • Result: Fitness function is always higher when security is low • Overall objective is to make the CR believe specific options are not optimal • Attacks restricted to CRs that use online learning f = w1P + w2R + w3S

21. Individual CR Attack Mitigation • Need to instill some “common sense” into the radios. • Robust Sensor Inputs • Ideal CR can always tell the difference between interference and noise • Distinguish between natural and man-made RF • Robust Data Fusion Techniques for CR Networks • Distributed Environment technique used to improve performance • Decision Fusion • Bayesian Detection • Neyman-Pearson Tests R. Chen, J.-M. Park, Y. T. Hou, and J. H. Reed, "Toward secure distributed spectrum sensing in cognitive radio networks," IEEE Communications Magazine Special Issue on Cognitive Radio Communications, Apr. 2008.

22. Individual CR Attack Mitigation • Individual policies should be developed with care • Similar to writing robust code. Sure strcpy() works but its extremely exploitable if not used properly. • Formal state-space validation can be done to ensure bad states can not exist. • PUE attacks require a different more technical approach • Develop better sensing algorithms! • Energy detection is extremely simple but should practically never be used by itself outside of a lab. • Cyclostationary features • 10-20 Time domain characteristics

23. Individual CR Attack Mitigation • A priori information can be used to supplement sensing techniques • Geolocation – Validating physical location using SNR • FCC white space decision will require this most likely • Learning attacks can be mitigated through constant feedback. • Receiver is constantly providing QoS feedback so learned actions do not get poisoned. • Not full proof but requires attacker to be actively “teaching” in order to keep the learned actions invalid. • Develop relationships or objective functions that demonstrate orthogonality between objectives that aren’t related. • Example: Throughput should not affect security level • In no situation should we adapt the security level simply because the throughput is lowered. • This results in a more complex fitness function but removes a large portion of the ability for attackers to manipulate unrelated objectives.