Table of Contents
Advertisement
INTRODUCTION
_________________________________________________________________________________________________________
The Airlink base stations and remote stations support remote digital certification revocation,
renewal, and change using the Apollo toolkit as an operation that is enabled to the administrator
only. Airlink currently uses a single default username and password for all base stations and
remote stations.
2.5.1 Encryption
The Airlink system uses traffic key encryption AES-128 or AES-256 and Counter with Cipher
Block Chaining-Message Authentication Code (CBC-MAC). Airlink uses the IEEE-802.16 key
derivation function Dot16KDF.
Cryptographic keys and security data are stored in secured storage within the system memory
in locations that are impervious to unwanted access. Secure storage includes an encrypted blob
of keys, anti-tamper protection that can only be unlocked by a master key, a private key bus
between non-volatile memory and cryptographic engines.
Airlink uses the Privacy and Key Management Protocol version 2 (PKMv2) for secure key
management transfer and exchange. The authorization key is generated and is used to secure
the 3-way handshake of the traffic key distribution. The process is secured, encrypted, and
authenticated through all stages using RSA-4096, Cipher-based Message Authentication Code
(CMAC), Hash-based Message Authentication Code (HMAC), and AES-256 – CCM.
Passwords are encrypted with the device public key. The private key is stored in secured
storage provided by the chip. All keys in the system, except the private-public keys, are
randomly generated and with a configurable lifecycle. Hardware-generated random number
generator is used by all cryptographic algorithms and hashing functions.
2.5.2 Detection and Monitoring
Airlink devices include several security mechanisms such as secure boot (hardware-enforced
root-of-trust, customer programmable keys, and OTP data, support for takeover protection, IP
protection, and anti-rollback protection), strong cryptography algorithms, trusted execution
environment support (firewall support for isolation, secure DMA path and interconnect and
secure watchdog/timer/IPC) and more.
2-8
COM-00-21-04
OCTOBER 2021
Version No.: A.1
Advertisement
Table of Contents
