Vulnerability of LTE to hostile interference

Abstract

Abstract-LTE is well on its way to becoming the primary cellular standard, due to its performance and low cost. Over the next decade we will become dependent on LTE, which is why we must ensure it is secure and available when we need it. Unfortunately, like any wireless technology, disruption through radio jamming is possible. This paper investigates the extent to which LTE is vulnerable to intentional jamming, by analyzing the components of the LTE downlink and uplink signals. The LTE physical layer consists of several physical channels and signals, most of which are vital to the operation of the link. By taking into account the density of these physical channels and signals with respect to the entire frame, as well as the modulation and coding schemes involved, we come up with a series of vulnerability metrics in the form of jammer to signal ratios. The "weakest links" of the LTE signals are then identified, and used to establish the overall vulnerability of LTE to hostile interference.

Ultra-reliable communications in failure-prone realistic networks

“…Causes of failure include software upgrades (if performed simultaneously to multiple base stations), hacking of the system (e.g. jamming [12]), natural disasters (storms, earthquakes, etc. ), and discharge of batteries after long power outages (especially for small cells with typically small power backup).…”

Performance of advanced telecommand frame synchronizer under pulsed jamming conditions

“…However, the provided analysis focuses on the sensitivity to a time-invariant channel gain estimation error rather than on the effect of time-varying channel conditions (as for pulsed jamming). Standard-specific vulnerability-tojamming-attacks analyses have been reported, for example, in [12]- [14]. However, to the best of our knowledge, a similar study that is representative for the next generation CCSDS TC standard has not been carried out yet.…”

Enhancing the security of LTE networks against jamming attacks

“…A recent report introduces the potential theoretical results of jamming the PBCH of LTE networks [5]. The authors of the original study expanded the details of this study in a recent paper [6]. This attack, which could be applied to both 2G and 3G networks as well, targets this channel because, as described in Section 2.1, its assigned PRBs are known a priori and always mapped to the central 72 subcarriers of the OFDMA signal.…”

“…The attacker is only able to deny the service locally to UEs located in its vicinity. However, more sophisticated attacks have been discovered as a potentially more effective way to jam LTE networks [5,6]. These smart jamming attacks aim to saturate specifically the main downlink broadcast channel of LTE networks in order to launch a local DoS attack that requires less power, making it stealthier.…”