Lightweight Software Assurance for Distributed Mobile Networking

With developments in software-defined radio (SDR) and OpenRAN, the mobile networking implementations for radio and security control are becoming increasingly software based. We design and build a lightweight and distributed software assurance scheme, which assures that a wireless user holds the correct software (version/code) for its wireless networking implementations. Our scheme is distributed (to support the distributed and ad hoc networking which does not utilize the networking-backend infrastructure) and lightweight (to support the resource-constrained device operations). Our scheme is distinct from the remote code attestation in trusted computing, which requires the hardware-based security and the real-time challenge-and-response communications with a centralized trusted server, thus making its deployment in the distributed mobile networking environments prohibitive. We incorporate Merkle tree for the verification efficiency to make it appropriate for the wireless-broadcasting medium with multiple receivers. We implement and test our scheme on srsRAN (a popular open-source software for cellular technology, including 4G and 5G) and conduct experiments on a phone, Raspberry Pi, and a computer to demonstrate the lightweight design and its appropriateness for wireless networking applications. Our results show that the number of hash computations for the proof verification grows logarithmically with the number of software code files being assured and that the verification is three orders of magnitude cheaper in time than the proof generation, while the proof generation overhead itself is negligible compared to the software update period.