Verifiable Alerts for 4G/5G Public Warning System

Public warning system (PWS) in cellular networking delivers emergency alerts to user equipment, such as those for earthquakes, presidential alerts, and child abductions. The alerts occur intermittently and rarely, but when they do, the timely delivery of alerts is critical because they require immediate attention. Base stations therefore use broadcasting communications for alert delivery to any nearby user equipment, e.g., independent of whether it is subscribed to the mobile network operator company. However, these critical messages remain vulnerable to a fake base station sending fake alerts. To prevent such fake base station threats, we design and build the Verifiable Alert scheme. The scheme provides stronger security properties than the existing research, which overlooks threats such as replay and wormhole. Furthermore, while building on the existing research using the public-key signature, our Verifiable Alert scheme uses commit-and-reveal so that the processing-intensive signature verifications occur once at any time before the PWS alert, while the hash-based reveal verification occurs during the PWS alert. We introduce the commit as the authenticator token, i.e., the base station commits the one-time random authenticator tokens, which can later be revealed and used for alert transmission protection during the alert delivery when the PWS event occurs. We implement the scheme using software-defined radios and open-source software, srsRAN. Our design and prototype are compatible with 4G/5G 3G$P$P standardization. Our experiments demonstrate that our Verifiable Alert scheme effectively authenticates the base station source, the timestamp, and the location. Furthermore, during a PWS alert event, the Verifiable Alert scheme verifies alerts on mobile user equipment three orders of magnitude (258x) quicker than the state-of-the-art verification.