公共安全通信信号的隐藏生命周期：TETRA、TETRAPOL与P25的安全性对比分析
The Hidden Life of Public Safety Communications Signals: A Comparative Security Analysis of TETRA, TETRAPOL, and P25
浏览论文内容
中文总结 AI 辅助
该研究对比分析TETRA、TETRAPOL与P25三种LMR标准的安全性，发现其信令信道暴露可推断大量敏感信息，甚至能提取TETRAPOL的未加密语音，最后提出针对性防护建议。
中文摘要 AI 辅助
公共安全机构与关键基础设施运营商依赖基于P25、TETRA和TETRAPOL的集群陆地移动无线电（LMR）系统，这些系统不仅需保护通信内容，还需保护通信本身的存在。然而，LMR标准在内容保密性与通信保密性之间存在明显差距：在加密的业务信道之下，其信令信道几乎完全处于明文状态。我们探究从该暴露信令中进行对抗性推断的深度与影响。此前对这些系统的安全分析集中在业务信道——即恢复加密密钥或捕获意外明文。我们证明，即使内容加密完美，仅通过被动观测信令也能推断出同等敏感的信息。具体而言，我们展示了针对各类集群LMR标准，仅通过接收的软件定义无线电（SDR）进行被动观测，即可恢复操作层面敏感的网络拓扑与地理细节、单元存在情况、跨小区与群组的移动性、组织结构，以及特殊密钥域和密钥周期轮换等操作安全细节。这种信令信道推断的覆盖范围远超观测者的直接接收区域，将本地嗅探转化为全国范围内的网络测绘能力，削弱或破坏了LMR标准通过时序与关联实现的身份混淆。对于TETRAPOL，我们展示了如何通过此类信令元数据的推断与跟踪，以及紧急呼叫处理中的标准层面保密性缺陷，实现未加密语音提取。最后，我们讨论了潜在的对策与缓解措施，包括针对保护小区间、基站及用户身份的具体建议。
英文摘要
Public-safety agencies and critical infrastructure operators rely on trunked land-mobile radio (LMR) systems, based on P25, TETRA, and TETRAPOL. These systems are expected to protect not just the content of a communication but the fact of it. Yet LMR standards leave a stark gap between confidentiality of \emph{content} and of \emph{communication}: underneath an encrypted traffic plane, their signaling plane is almost entirely in the clear. We probe the depth and impact of adversarial inference from this exposed signaling. Prior security analyses of these systems have concentrated on the content plane---recovering encryption keys or capturing accidental cleartext. We show that comparably sensitive information can be \emph{inferred from passively observed signaling even if the content encryption were perfect}. In particular, we show that across the trunked LMR standards, a passive, receive-only software-defined radio (SDR) observer can recover operationally sensitive network topology and geography details, unit presence, mobility across cells and groups, organizational structure, as well as operational security details such as special key domains and key-epoch rotation. This signaling-plane inference reaches far beyond the observer's direct area of reception, turning \emph{local} sniffing into \emph{nationwide} network mapping capabilities that degrade or defeat LMR standards' identity obfuscation through timing and association. In the case of TETRAPOL, we demonstrate how inference and tracking of such signaling metadata and a standards-level confidentiality failure in emergency call handling enable unencrypted voice extraction. Finally, we discuss potential countermeasures and mitigations, including specific recommendations for protecting inter-cell, base station and subscriber identities.
