This presentation aims at providing elements about advances in physical security and about relevant application perspectives in public wireless networks. This work is supported by the PHYLAWS project (FP7 id. 317562, starting Nov. 2012). Given the growing prevalence of wireless radio-communication technologies, the security and the reliability a person or an organization can have in the confidentiality of the exchanged information is a major societal challenge for both personal and professional sphere. Moreover, the growing importance of sensing procedures and of cognitive pilot channels in future radio access technologies (white spectrum, cognitive networks), will occur numerous radio-transmissions of geo-referenced spectrum allocations and of radio engineering data, whose integrity and confidentiality are major industrial challenges for both operators and administrations. Security of radio-interface within wireless networks appears now as crucial for many applications such as broadband internet, e-commerce, radio-terminal payments, bank services, machine to machine, health/hospital distant services. Most of citizens, professionals, stakeholders, services providers and economical actors are thus concerned by confidentiality lacks and by privacy improvements of the physical layer of wireless networks. On the first hand, several classical solutions already exist for protecting privacy of radio communication, - At access attempts: dedicated early identification protocols exist such as Identification of Friend and Foe. - At the transmission level, wave forms can be designed in order to achieve Low Probability of Interception (LPI) and Low Probability of Detection (LPD), by using furtive spread spectrum signals or frequency/time hopped signals. Such transec protections apply mainly at signal frame and at symbol level. - At the signaling level, protocols can be designed in order to achieve low probability of decoding and low intrusion capabilities of the signaling messages by non-legitimate users, thanks to subscriber authentication procedure, to advanced scrambling interleaving coding and ciphering techniques etc. Such netsec protections may apply either at signal frame, at symbol level and at bit level. - At the communication level, encryption algorithm such as DES, AES, Self-Synchronizing stream cipher, etc., and message integrity control schemes are used in order to avoid non legitimate interpretation and/or access attempts of the users' messages. Such comsec protections apply mainly at message/bit level. Nevertheless, all these classical protections require a priori knowledge or exchanges of keys, thus improving the complexity of the network management and/or reducing the set of users of highest protected modes. In addition, these protections often require shared time reference. Moreover, their implantation use added data, and thus decrease the spectrum efficiency especially when facing short packet transmission mode. Finally these constraints trend to dramatically reduce the effective privacy of wireless standards when designed for a worldwide mass market. One the second hand, Physical Layer Security is a radically novel concept that exploit the properties of the local radio-environments, especially when complex, dispersive and non-stationary. • The fundamental model of wiretap channel has led to the definition of secrecy capacity and to the design and/or to the re-use of advanced coding schemes in order to improve it (such as Low Density Parity Check Codes, lattice codes, trellis coded modulations, coset codes, polar codes). • A native tremendous advantage of Physec is the absence of Keys: Security over radio-channel is achieved in the same processing as signal transmission, thanks to coding schemes that optimize information recovery by legitimate receiver and mitigate information about the legitimate link at any eavesdropper location. Thus, no external information is required nor exchanged and low rate penalty is expected of communication content. • Because of its information-theoretic foundation, physec is intrinsically robust to any computer attack (unlimited computing power), even to quantum attack. • For the close future of wireless standards, physec appears as a "front end" solution for warranting privacy, that provides confidentiality at the radio interface by software means only, with low impacts at upper layers of the transmission protocol and at network management. Thus, many practical advantages may be expected from Physec-derivate solutions: reduced impact on terminal and network architectures, easy and low cost integration, compatibility with existing encryption solutions and radio access technologies, negligible impact on spectrum efficiency, etc. This paper will first introduce several notions relevant to information theory and the main principle that are relevant to Physical Layer Security. Then, from a state of the current researches, we will highlight theoretic advantages and point out several security solutions that are outputs of the native Physec concepts when facing passive eavesdroppers, such as advanced secrecy coding schemes, cooperative jamming and implantations within MIMO RATs. We will then introduce physec perspectives to counter active threats such as radio-hacker intrusion attempts of signaling messages. Possible drawbacks of physec will be discussed too, that may be relevant to secrecy codes determination, to implantation of coding and decoding schemes into handset and base stations, to embedded computing complexity (versus the expected performances of embedded computers), etc. The paper will conclude on practical implantation perspectives of Physec in existing and future radio-networks, as stand-alone added modules operating at the physical player, or as added algorithm combined with classical solutions in order to upgrade and/or to simplify existing transec, netsec and comsec protections. It will highlight particular items been studied and developed in the PHYLAWS project that intent to merge both academic and industrial skills in order to provide enhanced-secure RATs into existing and future public wireless standards.

This presentation aims at providing elements about threats that may drop privacy and thrust in public wireless networks, because of eavesdropper and hacking technologies that operate at the radio interface, and aims at providing elements about relevant counter-measures. This work is supported by the PHYLAWS project (FP7 id. 317562, starting Nov. 2012). Given the growing prevalence of wireless radio-communication technologies, the security and the reliability a person or an organization can have in the confidentiality of the exchanged information is a major societal challenge for both personal and professional sphere. Moreover, the growing importance of sensing procedures and of cognitive pilot channels in future radio access technologies (white spectrum, cognitive networks), will occur numerous radio-transmissions of geo-referenced spectrum allocations and of radio engineering data, whose integrity and confidentiality are major industrial challenges for both operators and administrations. Security of radio-interface within wireless networks appears now as crucial for many applications such as broadband internet, e-commerce, radio-terminal payments, bank services, machine to machine, health/hospital distant services. Most of citizens, professionals, stakeholders, services providers and economical actors are thus concerned by confidentiality lacks and by privacy improvements of the physical layer of wireless networks. This paper will first describes the main kind of security protocols that are used at the physical layer of wireless civilian networks, such as subscriber authentication, control of message integrity, cyphering procedures of messages' content, etc. By focusing on several example such as radio-cells (GSM, UMTS, LTE), Wireless Access Network (WiFi), Short Range Communications (Bluetooth, ZigBee), etc., we will introduce the main failures that may occur in these procedures and discuss about their multiple causes: first of all the worldwide nature of modern digital standards and the consequent intrinsic weakness of the early negotiation phases; often the radio access technology itself; sometimes operators' radio-engineering practices, users' misunderstanding of security aspects, policies restrictions that may occur locally, etc. By considering these weaknesses, we will describe several hacker and eavesdropper threat during the initial access attempts, during negotiation protocols and during established calls. We will take into account both active and passive attacks. Nevertheless, in order to avoid any paranoiac or angelic caricature, we will consider too the (severe) practical limitations of eavesdropper and hacking systems that are caused by radio environment in many real field situation. Then, existing countermeasures principles for improving thrust and security within wireless network will be introduced, by distinguishing security of radio-signal (transmission security), security of signaling message content (network security), security of users' message content (communication security). Advantages and drawbacks of these procedures regarding civilian use will be discussed. Additional considerations on secure architectures for radio terminals will be given too. Finally, we will introduce new protection concepts for radio-communications that exploit the physical properties of radio-environments. Especially when complex, dispersive and non-stationary, radio-environment and radio propagation has to be measured by infrastructures and handsets (equalization, RAKE processing, MISO/MIMO transmitters and receivers, sensing procedures of cognitive radios, etc.) and the relevant physical information provide significant opportunities for enhancing security algorithms during access phases and established calls: • Implantation of coding schemes that optimize the secrecy capacity over a legitimate radio link, (and that mitigate the information about the legitimate link at any eavesdropper locations) • Use of propagation-dependent random generator sources for generation of secret keys, combination with existing coding/cyphering schemes • Implantation of versatile and of artificial random in radio access schemes at several levels: allocation of spectrum resource, modulation, coding, ciphering. • Design of radio access schemes that generate signal mixtures: duplex techniques, MIMO, MISO, artificial jamming. • Design of early identification procedures based on weak/furtive transmission signals. • Etc. All these concepts deal with "physical based" security in a large sense (Physec). The paper will conclude on the most promising Physec technologies that are expected in the future years by mixing classical protections and advanced issues of information-theoretic security, secrecy coding and cooperative jamming. It will highlight particular items been studied and developed in the PHYLAWS project that intent to merge both academic and industrial skills in order to provide enhanced secure RATs with realistic implantation perspectives in existing and future wireless standards.

The latest 2.75G enhancements in the GSM standard, also referred to as Evolved EDGE comprise higher order modulation schemes and turbo coding. Type II hybrid ARQ or Incremental Redundancy (IR) mechanism aids Evolved EDGE systems to achieve higher average throughput. A Base Transceiver Station (BTS) transmits punctured Radio Link Control (RLC) blocks packed on bursts to a Mobile Station (MS). In the MS, a RLC block, typically represented as soft information, is stored in case decoding proves unsuccessful. Subsequently, the BTS retransmits the RLC block with a different puncturing pattern and the MS combines the soft information of the current transmission and the previously stored version. In case decoding fails again, the procedure is repeated. Correspondingly, the coding rate decreases with each retransmission whereas the decoding success rate increases. Thus, IR aids to achieve high average throughput. However, the MS is requested to accept up to 1024 RLC blocks. Minimum average throughput requirements from the 3GPP specifications ask that a large number of these blocks are stored in the memory of the MS. Therefore, memory and processor challenges are two major concerns when implementing IR at MS side. [1,2] A classical hardware setup of the MS consists of a SoC for the digital part of the protocol stack attached to an RF transceiver. The SoC has I/O ports for external RAM, display, microphone, and other peripherals. Internally, the SoC system comprises a system processor for L2/L3 operations. For L1 or digital baseband processing a DSP with a number of accelerators is employed. Alternatively, there exist approaches (e.g. [3]) which make do without a DSP. Instead, the digital baseband processing is implemented in dedicated hardware only. According to literature (e.g. [4]), IR implementation is distributed over various parts of the SoC architecture. In this example, erroneous RLC blocks are stored in an external RAM. An IR control unit is running on the system processor and the unit where RLC blocks are processed for IR is attached to the system processor. The decoding of the RLC blocks takes place in the digital baseband either on the DSP and an accelerator or, in case of [3], in dedicated hardware only. In such a conventional setup the IR mechanism claims high demands for the system processor, which is not desired. And, L2/L3 software developers need to incorporate IR operations. Furthermore, the data bus between external memory and Soc and between system processor and digital baseband can experience high loads due to IR processing. Emerging applications that require ultra low-cost and low-power devices, such as Internet of Things (IoT) or machine to machine (M2M) communication, which may use the GSM/EDGE standard due to its ubiquitous coverage, high computational loads are prohibitive. An IR processing block incorporated into the digital baseband comprising all IR related operations, would remove IR complexity and load from the system processor and external components. In this work, above mentioned IR implementation challenges are addressed and an efficient dedicated hardware architecture, which hides the IR complexity from the system processor and higher protocol layers, is proposed. In order to gain insight into the IR mechanisms, an Evolved EDGE capable version of the open-source OsmoPHY GSM physical layer (PHY) framework [5] was equipped with IR functionality. Matlab modules for IR support are added to the OsmoPHY framework. The minimum IR memory size in order to meet the 3GPP throughput requirements, based on the receiver performance of the extended framework and a model RF front-end, is determined. The IR hardware architecture uses a dedicated memory for storing punctured RLC blocks and comprises depuncturing units, memory management, and a soft information combiner unit. A corresponding VHDL model is implemented and synthesized using standard engineering tools. As the OsmocomBB L2/L3 software does not support packet switched communication, the OsmoPHY Matlab model is tested with a minimalistic L2/L3 test-software. We further show that protocol stack developers no longer need to incorporate IR control and management into L2/L3 software, because IR can be detached and implemented in L1 alone. The proposed IR architecture elegantly obfuscates all IR related operations from L2/L3 to such an extent, that higher layers need zero awareness of IR processing. This simplicity can together with OsmoPHY drastically speed up the development of L2/L3 software. Traffic load between system processor and digital baseband are reduced and no external component for IR operations is necessary. This architecture can be incorporated into already existing ultra-low power dedicated hardware PHY implementations such as [3]. This dedicated IR unit can be attached spatially close to the channel decoder unit following the locality principle enabling low-power protocol stacks. [1] 3GPP standard specifications. [2] E. Seurre, P. Savelli, P. Pietri. EDGE for Mobile Internet. Artech House, 2003. [3] C. Benkeser, A. Bubenhofer, Q. Huang, A 4.5mW Digital Baseband Receiver for Level-A Evolved EDGE, IEEE International Solid-State Circuits Conference (ISSCC), San Francisco, CA, USA, Dig. Techn. Papers, pp. 276-277, Feb 7-11, 2010. [4] L. Chang and Y. Wang, Edge Incremental Redundancy Memory Structure and Memory Management, U.S. Patent 7272768, filed December 9, 2003, and issued September 18, 2007 [5] H. Kröll, C. Benkeser, S. Zwicky, B. Weber, Q. Huang, Baseband Signal Processing Framework for the OsmocomBB GSM Protocol Stack, Proc. of SDR 2012 Europe, Brussels, Belgium, June 2012.

This paper focuses on the validation of an innovative soft-ware-defined radio architecture for a WiMAX system based on commercially available field-programmable gate array and digital signal processor modules. We provide a real-time implementation of a standard-compliant time-division duplex physical layer including a mobile and a base station as well as downlink and uplink communications, thus obtaining a full-featured physical layer. Additionally, a set of different configurations are supported as described in the standard and in the WiMAX Forum. The main contribution of the paper consists in a reproducible and repeatable validation of the implementation in representative scenarios. At the same time, a characterization of the performance exhibited by the system is provided based on bit error rate measurements carried out using a custom-made, real-time channel emulator.

We present an open source LTE receiver framework. Using GNU Radio's block-based signal processing capabilities, various LTE baseband specific functionality has been implemented in dedicated easily reconfigurable blocks. These can be used to decode and analyze arbitrary channels in the LTE downlink signal. As an example we decode the Master Information Block (MIB) transmitted on the Broadcast Channel (BCH). Our work is focused on performance measurements in order to identify critical processing operations on a General Purpose Processor (GPP). By optimizing critical components, e.g. channel estimation, synchronization, we can improve the overall system performance and therefore the system's real-time capabilities.