Hyperledger Foundation Hyperledger Global Forum 2021, 11 Jun 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Access for the Next Billion - Decentralizing Authentication and Handover... - Sudheesh Singanamalla

Description

Access for the Next Billion - Decentralizing Authentication and Handover in 4G LTE/5G - Sudheesh Singanamalla, University of Washington

Cellular networks have traditionally been operated exclusively by a small number of national-scale mobile network operators (MNOs) like Verizon, AT&T etc., using a wide-area licensed spectrum and deploying expensive edge elements like base stations or leased towers while running specialized software. The economics make it extremely difficult for large operators to increase cellular network coverage in rural areas leaving more than a billion people worldwide without Internet access. To address this challenge, smaller organizations are beginning turn to unlicensed spectrum, neutral host architectures, private LTE/5G, or community cellular networks (CCNs) for low cost connectivity in local areas. With smaller community run telecom operators, it becomes important to efficiently interoperate between them. This talk looks at decentralizing telecoms to improve connectivity for the next billion.

Sessions Details & Slides (if available)- https://sched.co/j3d2
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #HyperledgerGlobalForum2021 #Blockchain

A

So um hello, everyone and good morning afternoon or evening, depending on where you're watching this talk from uh I'm sudeesh and I'm here to speak about some of some of the work. My colleagues and I have been doing at the university of washington to improve global internet access and this work is in collaboration with uh esther zhang, nick duran, uh matt, johnson, sachin, nayak, spencer, sevilla and curtis heinrich.

A

So I um I'm I'm open to taking questions anytime through through the talk, so please feel free to put them in in the q and a section of the of the chat or ask them on the chat, and I can get get to them uh towards the end of the talk. I have it planned for maybe around 25 minutes. So um so I can get to the questions right right after that, and hopefully hopefully that should work. Thank you so um to to introduce myself.

A

I am a phd student in the information communication technology for development lab or the ictd lab at the university of washington in seattle, and I'm advised by professors, curtis heimel and richard anderson, I'm here to present some of the work that we've been doing uh in decentralizing, lte and 5g authentication, and enabling roaming in telecom networks, specifically community cellular networks and private network course.

A

So, let's kind of dive in there are approximately a billion people today who live outside mobile broadband coverage and there is a large digital divide between the urban and rural population in terms of internet and cellular connectivity.

A

The the economics of it make it extremely difficult for uh national scale operators to increase seller coverage in in rural areas, leaving more than a billion people worldwide uh without access to the to the internet.

A

But 2g 3g network operators have actually rolled out their networks as far as they're really commercially viable and that's indicated by uh the gsme report in the state of mobile internet connectivity. But despite that, there are 400 million people who live outside any mobile coverage.

A

So there is this need for improving rural connectivity in networks with ourselves and make networks which are like self-sufficient, which can be managed by the community. But this problem is not particular to rural areas. Let's take a look at seattle itself right so 15 of seattle's residents do not have access to the internet, and this number is higher in immigrant or refugee families and low and middle income communities who are living in the city of seattle.

A

So cellular networks have traditionally been operated exclusively by a few national scale. Network operators like verizon and at t or t-mobile in the in the united states, and they all use a wide area, license spectrum.

A

These operators, kind of deploy very expensive network edge elements like base stations, their own towers, or they used least towers in addition to making running specialized close source software uh on and making their architecture very, very centralized.

A

So this makes it possible for these large providers to actually establish some kind of direct peering or interconnects between the operators and the business and business and other businesses, so so that they can allow subscribers from one network to actually roam on some other network operators infrastructure.

A

This can be done for various and eventually this can be done for billing purposes or actually giving people enhanced network coverage, but the centralized network core that these operators run means that wherever the network operators do not have service or some partner with whom they provide service, there is actually no networks network capability.

A

So to address this kind of challenge, smaller organizations really have been turning to something called community cellular networks or private networks, and uh these are used for providing like low-cost connectivity in a lot of local areas.

A

But, unlike a traditional cellular network, community, cellular networks are small, they're independent from cellular networks, and they usually consist of a single base station, like the like the tower that you see here in in in the figure that is there and they take what is usually available in the data centers and move them to the edge, which is the edge of this community, where most of the data processing needs to happen.

A

So over the last few years, our lab has actually been working with field partners to deploy some of these community cellular networks, and these type of networks are actually optimized for local needs.

A

They can be run cooperatively and they're sustainable in rural areas, providing all the users in those areas with with internet access, but community cellular networks have some challenges: they're severely constrained they have, but by like backhaul satellite connectivity, because that's how they get their internet access and- and they also have power supply issues uh in these regions and the intermittentness of the power supply actually affects the the service that can be provided.

A

So why are we doing this? Why can't telecom operators actually set up infrastructure? That is necessary to improve connectivity in rural areas and to provide them with internet access. What happens when these community members actually move out of the network zone that they are in to a different network zone and traditional lte networks?

A

Do not do this because it is not economically viable for them for large corporations to actually do this and um in in a community setting it it. It becomes more like the case of roaming and roaming between networks is a challenging problem, because network operators enter into business agreements and replicating a similar result in a community. Cellular case is a problem of exponential complexity.

A

Every single telecom operator has to have a roaming agreement with some other smaller operator, and each of these communities need to work with each other so and also many countries don't allow national roaming. So this this business operation complexity can only be handled really by large telecom operators and it's very cumbersome small for smaller community scale operators to actually do this, so that brought us to this important question that we had is it which is?

A

Can we provide affordable and sustainable cellular data access in remote and rural areas where there is no cellular network coverage, and can we enable these users, in in smaller community cellular networks, to geographically roam uh between communities without disruptions to their cellular services?

A

But before we go into how we tried to answer that question? Let me let me take you through a quick introduction of of lte and an lte is an end to end all ip network, which consists of two parts right.

A

The first part is the radio access network, which is this base station that you see here, and the second part is the enhanced packet core or the epc in lte and the 5g core in in 5g, both of which behave very similarly, and these are these are the networks to which radio access networks are actually connected, and these are typically data centers to which radio infrastructure is linked.

A

The lte network is network architecture specifically, is a large, complex beast, and the interoperability of these two networks is due to standardization of protocols by gsma and 3gpp, which are organizations actively involved in in standardizing lte and wireless protocols.

A

But the first part of the ecosystem is really the users right. The user equipment are like the handsets that I get. These are standard off the shelf, mobile handsets, which are lte capable and can support connectivity in in different lte bands and in in any innovation that we make. We would like to ensure that there is no need to really modify these devices other than their hardware compatibility for a band, for example.

A

The second one is the e note b or the g note, b in the 5g networks, and it's a radio based station which provides uh radio link interfaces between the between the handsets and the code network, and the third part is, uh is a mobility entity which is a part of the core network and is in traditional cellular networks. It's actually present in data centers, and this is the segment that this is like a micro service or a segment that actually handles uh the various state functionalities of of your uh of your device.

A

So, depending it decides when to signal your device when to allow your device to move from one tower to another tower called handovers, uh it helps perform bits and pieces of authentication, maintaining the state of it and it performs a very crucial service.

A

The the serving gateway is a system that routes and it forwards all the user data packets and allows any traffic management to actually take place and the packet data gateway is, uh is a gateway service that actually provides internet connectivity to the to the users and is capable of performing any policy enforcements or performing lawful interception uh on on the user's data.

A

The home subscriber service uh is, is like a database server which contains user related uh security, related information like sim cards, any data limits or any policies that that the user has to ask has to like uh adhere to when they're using the network.

A

But there are a lot of other pieces to to the entire lte architecture, but what we can do is we can really strip them down into these series of little micro services and just have these pieces put together to create a minimum functioning lte network and in the community cellular networks.

A

This essentially moves any traditional data center networking operations from from the cloud to the edge and in our deployments, these run on low power, zotac boxes, with a reasonable amount of memory like four to eight gb of memory, they're very inexpensive and actively support hundreds of users uh in a deployment site that we have in bokondini in indonesia.

A

But what we do is all actively contribute to the development of open 5gs, which is the stack that we run on it. It's a c implementation of the lte and 5g protocols, but while private lte and 5g and community cellular networks are promising ways uh to improve internet connectivity and access, they come with a bunch of challenges and, as the number of these private players increase in urban areas it it opens up.

A

This need where you need to enable cooperation for fair spectrum usage, especially because most of these smaller organizations cannot afford to buy spec wide area spectrum license. They rely on the unlicensed spectrum and organizations in these areas need to collaborate and coordinate their spectrum so that they avoid any radio resource contentions or any radio resource issues. But as the density of these operators increase, it becomes difficult to establish any such agreements and to monitor spectrum to monitor the usage of different operators on the spectrum.

A

So there is this need to build a spectrum coordination mechanism, and but but you want to maintain them in such a way that the individual network course, which are run by different communities or organizations, can continue to be independent but still enable coordination and it. It also enables us options uh like good opportunities to actually provide the same mobility experiences that centralized telecom operators provide while maintaining the security of uh of these providers.

A

So our solution was to address these challenges using using a blockchain layer and allowing all these individual operators to cooperate without losing their independence of their operations, and the blockchain could also be used for spectrum coordination. It can be used for making decisions about the spectrum and recording these decisions about the spectrum for transparency reasons.

A

So the goal of of the community of of network operators as a whole is to maximize the the throughput of the available uh available uh network resources that they have and the blockchain layer with with with some changes to the protocol switch, which I will get into actually continue to be backward compatible to do cell phone devices with where a user can go and attach themselves to a centralized telecom provider and also makes them work in decentralized telecom provider settings without compromising any of the security.

A

So what actually really makes roaming complex is that is the need to authenticate a user right who does not belong to the network and it is to grant them access to the network resources. So typically, this is done by uh whenever a phone tries to connect to a roaming network.

A

It is done by tunneling all the requests from the roaming network to the home network, so there is some trusted relationship between the home network and the roaming network, but all the requests from the roaming network are actually tunneled home and this affects latencies and results in slightly degraded network experiences.

A

But another way would be for the home network to just share the keys of of you of your sim card to the roaming network based on their trust model. But this has some serious security concerns.

A

But, additionally, what happens is all the network cores need to be fully available and connected? So when a user tries to connect to a roaming network, the authentication is done by the home network of the subscriber.

A

But how does this actually happen?

A

And the lte and 5g authentication procedures are like a is a protocol that allows bi-directional authentication, which means that the users can authenticate to the network and the network also authenticates themselves to the users, and this is generally done by using a pre-burnt symmetric key in the sim card provided by the telecom operator and over here. We are really constrained to not change any of the authentication mechanisms, since these are protocols that the hardware manufacturers have built into phones- and these are what standard cellular devices are actually optimized for.

A

So we need to make some interesting changes to the core network and the sim cards follow a specification and are manufactured by a lot of third-party manufacturers like over. Here we printed our own sim cards, for example, and we got them manufactured so it is, it is for and and all these sim cards come with uh uh use, an authentication, algorithm called millinerge, and it relies on uh symmetric key crypto with 128 bit encryption. So every sim card that is provisioned.

A

It contains a symmetric key which is stored in the sim and the same key is also available in the telecom operators database and along with any additional identifiable fields like the phone number or an or a unique mobile subscriber identity number, as we call them, but inside the sim card. The sim card is broken into like a matrix with a sequence of numbers, and these are particularly interesting to us because they are one-time use, values which are organized into a matrix and the mobile device.

A

What it can do is it uses a sequence of these numbers in a specific row every time it needs to authenticate and join the network. So once a vector is actually used or if it is skipped, it invalidates the vector and it moves on it.

A

Moves on, and this is typically necessary when there is uh synchronization issues and where the telecom operator asks the phone to actually re-synchronize and re-establish their authenticity, for example, if if a phone joins or attaches with the sequence value of 0, which is the first value here- and it then follows it up with the value of 64..

A

The value of 32 is invalidated and it actually cannot be used and the one-time usage uh property that that it provides at a hardware level is what gives us the ability to actually make interesting changes to this, but also the the lte specification provides multiple functions called f1 and f2345, which is a collection of four separate functions which are used uh to randomly generate a value uh like the message authentication code, the expected response, a a corresponding anonymity key or an integrity key or a cipher key for encrypting.

A

The message traffic at the radio layer and so on, and these are actually issued by the home subscriber service database that we looked at to the mobility manager, which is the state maintainer, and it is then further signaled down to the mobile device.

A

So we have a standard telecom authentication mechanism here which we want to continue to keep, and we want to emulate this while, while allowing roaming. But to do this, the first step would be to connect these networks, while allowing each network operator to maintain their independence and since establishing these agreements between many networks in in an urban environment is actually extremely difficult.

A

We want each of these communities to be able to coordinate, despite not being fully connected. So to do this, we actually connect these network cores over a permissioned consortium, blockchain layer we use sawtooth for for uh for our experiments and in the measurements of our implementation.

A

uh We see that uh in we see that there are some some interesting properties with with respect to performance and also the consortium model gives like an interesting trust, guarantee of who the who, who different communities, trust and how different communities want to bring in different core operators into their network. So we're partnering with uh with an organization called the local connectivity lab and we're using the blockchain to interconnect independent community cellular network deployments across the city of seattle and to provide access to seattle's residents who do not have access to the internet.

A

So to do this, we actually modify the authentication procedure a little bit and implement our own protocol called de-auth, which is a decentralized authentication mechanism and in d-arth what happens is each of the home networks publishes a set of and publishers of assigned and a pre-computed authentication vector which are used as one-time tokens and issued to the entire network?

A

All the other peers on the network actually take this information, and whenever the phone goes to a new network, they can automatically consume this information and report the consumption with the proof of success or a proof of failure which can be verified and the issue tokens that are here can also be revoked and they can be reissued.

A

So these tokens can be directly used by the mobility manager, which means that in a disconnected rural setting, if we're looking at it, we don't need the roaming network core and the home network core to actually be available uh at all times to speak to each other. So it can work in slightly offline settings and uh but but when a user moves between these networks, the biggest problem is that the the dr protocol actually results in a disconnect and a reconnect mechanism.

A

Something similar to how your phone uh does the disconnect when you, when you enable airplane mode and re and reconnects to a network when you disable the airplane mode it and, and it actually scans for all the available networks and decides which network it can, it can join. But this isn't just a pipe dream. We implemented this.

A

We connected multiple community cellular network course as peers over sawtooth and each home network, actually computes and publishes a fixed set of these vectors uh for regarding their subscribers or their users to the network and and these values are all issued as transactions which are sent by uh by the home network core to the peers. So the peers actually regularly compute these blocks of transactions and they achieve a common state.

A

The current benchmarks that we have are are very naive and in like very disconnected, very low, throughput settings, and we can see that we roughly can achieve four transactions per second, but but the transaction item itself is very bulky, so we can package a lot of maybe like up to 100 users worth of information into a specific transaction and send it out. So we can achieve four transactions per second.

A

uh What we've been doing since then is try and use batching based optimizations that are already available in sawtooth to see if we can achieve closer to the hundreds of transactions per second uh on on unthrottled, uh completely available networks. So they're still ongoing experiments for this.

A

But what we do see is, as the density of these networks uh actually increase, it provides an opportunity to improve the user mobility experiences. So typically, what uh mobile large telecom operators do is use techniques called handover where, as you're traveling in a car or as you're walking from one location to another, your cell phone or your mobile device moves its connection from one tower to another tower, and this specific technique is called the handover technique.

A

So in in a decentralized network performing such handover techniques is extremely difficult because it needs you to share the security state that is available at each of the mobility manager, cores that exist in this network. So, for example, if you look at this figure, uh the the phone uh first has is connected to a base station and it's connected to the first network. As the phone moves from one cell to another network cell. It performs a traditional handover using the xn protocol and this is the same handover protocol that works in today's national scale.

A

Cellular networks, but as the user moves out of one's one network zone to a network that is operated by a different community, we use the dxn, which is a decentralized xn protocol by sharing the network state between the between the two network cores- and this includes sharing some security context and selectively. Revealing some information through cryptographic means. But it is possible to do that. But in in case this fails, we use an older protocol or a backward compatible uh protocol called the s1 protocol.

A

But in the decentralized settings to do the exact same exact same thing, but as the user moves from this green zone into a zone where there is no network connectivity, which is the red zone and moves into a new network, the user can go back and use the standard, decentralized authentication uh protocol uh that that that exists and uh for the user. This needs no changes to to their uh to their actual handsets, but it needs changes at each of the individual network course.

A

So the experience is going to be exactly the same and there's going to be. No, no explicit need to change what's happening, but there are some significant challenges and problems that exist here. All these handovers are actually time critical operations, especially the dxn process and over the blockchain and with with strong cryptographic techniques it becomes. It becomes quite slow and most of these handlers result into failure. So we're still trying to figure out uh an interesting way to achieve security properties, while maintaining these uh speed guarantees that exist so yeah in.

A

In addition to all of this information about mobility and authentication, uh there is a need for coordination of of the spectrum. So as the unlicensed spectrum, uh as more people start using the unlicensed spectrum, there is going to be heavy contention.

A

So what we would want to continue doing is take the existing blockchain layer and use a bun use the fleet of users to perform measurements, so the base stations can actually request each of the phones to perform a measurement for all the active uh base stations and the and their power that exists nearby and report, these measurements and the usage of the and the usage of the spectrum to to the base stations.

A

All of this information is recorded on the blockchain and it can be used for any machine learning based algorithms to uh to actually perform decision making and all these decisions are recorded transparently, so that you can improve future resource allocation decisions and also the independent network operators know how how these, uh how this information is being used so over this year.

A

What we're hoping to do is actually we're running a bunch of parallel efforts at decentralizing all of these protocols and trying to move away from centralized cellular protocols in an effort to see if we can achieve the same properties or the same performance properties that we see in centralized telecom operators in a decentralized set of networks that we have across of seattle.

A

And we are trying to also measure how the user experiences might look like and we're doing these as with continuous experimental rollouts, with a bunch of the partners from local connectivity lab and the seattle uh community networks and tacoma cooperative networks and so on. Who are trying to run these efforts, but some of the things that we we did notice in the lab when we were trying to run these experiments is that the blockchain consensus protocols are extremely chatty and they consume lots of bandwidth, which is actually a scarce resource for community cellular networks.

A

So there is a need to kind of be able to tune these network parameters to minimize their chattiness and, over the next few months, we're trying to roll out some of the optimization updates in into this real world deployments that that we have across seattle.

A

So uh thank you and I'm open to questions and I'll also be available on twitter or over email. If you would like to reach out and ask any more questions, I'm trying to find if there are any active questions, I do not see them, but I'll probably wait for a while to see if there are any questions coming in.

A

Thank you brian.

A

ah I see, I see a question. Sorry, I missed that. How did the fcc give you clearance to experiment in cell networks? I think I think that's a great question. We um we actually use the lte unlicensed or the 5g unlicensed spectrum, and uh there is, uh but- but this is still at this point, currently a very centralized process. If you look at it, you need uh you need someone who who is like a spectrum allocation service or an approved spectrum allocation service.

A

We use google for uh google sas, which is the spectrum allocation service, and we query, google and we lease out some some of the spectrum that we would like to use. So this is the active map of seattle and a list of uh available spectrum like how many channels are available in in different regions across of um across seattle and across tacoma, for example.

A

So it's not we're not buying uh any spectrum per se, but the eventual goal that we would want to go to is actually decentralize the need for having uh google sas or the requirements like google sas and see if these decisions can actually be made over the blockchain in a way such that it is, it is tamper, proof it's it's recorded and it can be further audited by by someone.

A

Currently, I think it's like a regulatory reason why fcc wants a few sas operators to actually run this, because I think these operators are are audited and you can query them for, and you can explicitly ask them why they have been giving clearances and so.

A

On thank you that that's a great question. I don't know if that answered your question.

A

Okay, um I see a question from benedict. uh Thank you. Can you go into detail on the high bandwidth consumption of the blockchain consensus you mentioned yeah, absolutely so all the deployments that we have currently use pbft and uh we would we would probably want to lighten that load by going to uh by going to a more uh by going to a different different, like consensus algorithm.

A

Maybe um I think poet was one one of the algorithms that we were trying to consider, but it needs like specialized hardware like sdx to actually run this, but uh there have been work that that is published at osdi like blocking uh and uh some other consensus protocols um like like the stellar consensus protocol and so on, which might also be interesting, uh interesting options for us to consider. But, of course, the the problem there is the minimum number of players that is necessary to perform. This consensus is much larger.

A

It's in the order of to thousands than in the order of tens that we're trying to play with in in this in this ecosystem.

A

uh Thank you james. I think I think we're actually out of time, so I would, I would leave this uh here, but please feel free to uh reach out to me over twitter or uh or over over an email, and I would be very, very happy to have have additional conversations with you. Thank you.