LTE Resistance to Jamming capability

To which extend a standard LTE system is able to resist to intentional jammers

Guy Philippe, Franois Montaigne, Jean-Christophe Schiel,

Eric Georgeaux, Christophe Gruet, Pierre-Yves Roy, Pierre Force, Philippe Mge
Security Solutions
CASSIDIAN
Elancourt, France

Abstract This paper is providing an analysis on how an LTE-

based mobile broadband communication system would be able to
survive and resist to intentional jammers as encountered in some
military use cases. This analysis has been developed using our
LTE knowledge for professional usage and our own expertise on
jammers characteristics and use cases.

Keywords: LTE, Jammer, ECCM, Anti-jamming margin

I. INTRODUCTION
To respond to the ever increasing citizen demand of more
efficient protection, Public Protection and Disaster Relief
(PPDR) organizations are looking at Mobile Broadband Data
services to improve their daily operations. In order to respond
to their need to exchange a significant level of information on
the field and to support the evolution to Network Centric
operation, military users are also looking at such Mobile
Broadband Data capability.
The 3GPP LTE (Long Term Evolution) state-of-the-art
technology has been selected by the PPDR Community in
North America and is also considered in Europe, Middle East
and Asia as the technology basis to develop voice and data
communications services for both PPDR and Defense Market
[1, 2].
This paper aims at presenting the resistance to jamming
capability of the LTE technology in case it is used for Military
applications. It is made of four main sections. The first one is
presenting the selected jamming scenarios, the second one is
dealing with the anti-jamming margin approach and
calculations; the third one introduces the actual resistance to
jamming performances assessments. The last section is
summarizing the resistance to jamming capability of LTE
systems and identify how to improve such resistance, should it
be needed.
II. JAMMING SCENARIOS DESCRIPTION
To assess the resistance of the LTE to jammers, we
considered a LTE cell and a jammer located out of the cell
coverage. This jammer will be impacting both LTE uplink and
downlink, i.e. respectively the base station and user equipment
reception.
Figure 1. : Jamming scenario overview
In order to define the jamming scenarios for calculating the
LTE resistance to jamming, we characterized the jammer by
the following parameters illustrated by Fig.1:
o Pj, its transmission power,
o Gj, its antenna gain. Its antenna may be capable to
offer beam-forming and can be different for ulpink
(GjUL) andfor downlink (GjDL),
o Dj, its distance to the LTE cell,
o Hj, its antenna height,
o its category as described below.
Given the known state-of-the-art in ECCM (Electronic
counter-countermeasures), we have considered three jammer
categories in the scenarios:
the broadband jammer (BB)
the pulsed jammer (PJ) and
the partial band jammer (PB).
The discussion relies on the hypothesis that the Counter
Measure Unit will have a limited and given power (radio
transmission power, named Pj) and that several power
allocation strategies may be applied depending on the ability of
the system to adapt to its target, based on time and frequency
characteristics of the victim system.
Those three categories are described hereunder.
 Broadband jammer (BB): Jammer transmitting a
Gaussian noise with a constant power in a bandwidth
adapted to the LTE signal to jam (see Fig. 2).
Figure 2. Broadband jammer (BB)
Figure 3. Pulsed Jammer (PJ)
Figure 4. Partial band jammer (PB)
Pulsed Jammer (PJ): Jammer transmitting a Gaussian
noise with a constant power in a bandwidth adapted to
the LTE signal to jam but concentrating its power into
time pulses corresponding to specific time intervals of
the LTE signal (see Fig. 3). The pulsed jammer is able
to synchronize itself to the LTE signal, resulting in the
capability to concentrate its power at very specific
moments in order to interfere for instance with the
synchronization pilots of the LTE system.
Partial band Jammer (PB): Jammer transmitting a
Gaussian noise with a constant power in a bandwidth
adapted to the LTE signal to jam but concentrating its
power into sub-bands corresponding to specific
frequency intervals of the LTE signal (see Fig. 4). The
partial band jammer is able to concentrate its power in
very specific bandwidth in order to interfere with
specific LTE signals such as synchronization signals or
signaling (i.e. PUCCH Physical Uplink Control
CHannel).
Two operational scenarios are considered, the first one
called defensive where the jammer is located at 10 km from the
LTE cell edge and the second one called offensive in which the
jammer is 2 km far from the LTE cell edge, characterized by
the parameters of Table 1.
III. ANTI-JAMMING MARGIN APPROACH
The investigations regarding resistance to hostile jammers
are based on the anti-jamming margin approach. The anti-
jamming margin (AJM) characterizes the capability of a
receiver to resist to an hostile jammer. It corresponds to the
minimum value of the ratio between the jamming power and
the signal power at the receiver input needed to maintain the
communication. This is equivalent to a Signal to Interference
ratio.
Since LTE is combining, on both uplink and downlink,
multiple physical channels with different waveforms and
coding schemes [3], an anti-jamming margin has to be
calculated for each and every physical channel. Those
calculations have been made based on existing results and
literature available within 3GPP. The results presented below
are dealing with an LTE transmission over 5 MHz and a data
load of 70%. Note that LTE has been designed to operate with
a re-use factor of 1, i.e. LTE is offering significant resistance to
interference and as a consequence to jammers.
Figure 5 illustrates the relative vulnerabilities of the LTE
Downlink channels as a function of the category of jammers.
The higher the vulnerability value is the more the physical
channel is sensitive to jammers.
TABLE I. JAMMER PARAMETERS
Dj Pj GjUL GjDL Hj Category
(m) (W) (dB) (dB) (m)
Defensive 10000 100 10 3 2 BB, PJ, PB
scenario
Offensive 2000 100 10 3 2 BB, PJ, PB
scenario
 20 Equipment (vehicular mounted device). These LTE parameters
15 lead to a cell radius of 28 km (uplink limited) in a rural
Vulnerability (dB)

10
environment.
5

0
Broadband Jammer
Pulsed Jammer For the simulation, the LTE cell is divided into discrete
-5 Partial Band Jammer
areas into which the SINR (Signal to Interference plus Noise
-10
Ratio) is calculated and compared to the AJM calculated as
-15
PHICH PSS SSS PCFICH PBCH P-DCCH P-DSCH RS described in the previous chapter.
Downlink Logical Channels
The comparison determines if the area considered is
Figure 5. LTE Downlink relative vulnerabilities jammed or not and by cumulating the areas for the complete
cell, it is possible to estimate for each LTE logical channel
5
what is the percentage of the cell area which is jammed. The
results are provided hereunder for each scenario:
0
A. Defensive scenario
Vulnerability (dB)

-5 The results show that the LTE uplink is strongly jammed

Broadband Jammer
(see Fig.7). This is due to the limited power of the UE (User
-10 Pulsed Jammer Equipment) compared to a jammer concentrating its power in
Partial Band Jammer the direction of the base station receiver.
-15 This result was expected as we considered a standard LTE
cell with no antenna processing. The impact on the coverage is
-20
RS PUSCH PRACH RS PUCCH
symmetric around the base station as linked only to the signal
PUSCH PUCCH levels received at the base station.
Uplink Logical Channels
Due to the jammer presence, the uplink coverage is reduced
Figure 6. LTE uplink relative vulnerabilities from 28 km to around 9 km. This value is obtained by
considering that 90% (RS PUSCH) of the initial cell area is
Some channels like PHICH (Physical Hybrid ARQ interfered.
Indicator Channel, transmits uplink transmission For the downlink, the jammer is much less impacting the
acknowledgement), PSS (Primary Synchronization Signal), LTE system (see Fig.8). The impact is much more visible in
SSS (Secondary Synchronization Signal), PCFICH (Physical the direction of the jammer than on the opposite direction.
Control Format Indicator Channel, transmits the number of With a pulsed jammer synchronized on the more vulnerable
OFDM symbols to be used for the PDCCH Physical logical channels such as the PHICH and the PSS/SSS or, 20%
Downlink Control CHannel) and PBCH (Physical Broadcast of the cell area is jammed.
Channel) present some level of vulnerabilities. PDSCH
vulnerability has been computed considering a QPSK-1/3 Defensive scenario - Uplink
modulation/coding scheme.
100

Figure 6 illustrates the relative vulnerabilities of the LTE 90

% of jammed Cell

80
uplink channels as a function of the type of jammers. The 70

higher the vulnerability value is the more the physical channel 60

50
BB
PJ
is sensible to jammers. Compared to the downlink, uplink is 40 PB

offering less vulnerabilities. There are already in an equivalent 30

20
C/I (signal to interference ratio) of 0 dB or better, which is 10

consistent with LTE C/I target. LTE design is generaly 0

RS PUSCH PUSCH 70% PRACH RS PUCCH PUCCH

performed for negative C/I ratio (in the range of 3 dB) at the
cell edge. Figure 7. Defensive scenario results for LTE uplink

Defensive scenario - Downlink

IV. PERFORMANCES ANALYSIS OF AN LTE SYSTEM IN THE
PRESENCE OF HOSTILE JAMMER 25

A system-level simulation tool has been developed to

% of jammed Cell

20

assess the performances of LTE systems. The following 15

BB
quantitative results are derived from proprietary simulation PJ

tools with the specific parameters that have been derived from 10 PB

Jamming Scenarios described, the actual performance of an 5

LTE 400MHz system and the LTE resistance to Jammer that 0

has been described in the previous chapter. PHICH PSS SSS PCFICH PBCH P-DCCH P-DSCH RS

The simulations have been run for a LTE 400 MHz cell Figure 8. Defensive scenario results for LTE downlink
using a 5 MHz bandwidth, a 90 W eNodeB and a 5 W User
 V. SUMMARY
B. Offensive scenario
Regarding the two studied scenarios, we have quantified
Due to the jammer presence, the uplink coverage (see
the capability of an LTE 400MHz system to offer resilience to
Fig. 9) is reduced from 28 km to around 6.5 km. This value is
jammers operating under during power profile in the 400MHz
obtained by considering that 95% (RS PUSCH) of the initial
range.
cell area is interfered.
It is shown that such LTE 400MHz system is offering a
In this very aggressive scenario, the same conclusions than
fairly good performance, under the medium then strong
for the defensive scenario apply but with different
jamming environment that has been considered in this paper,
improvement results:
compared to the excellent performances exhibited in the lack of
For the Uplink, by applying rather standard antenna jamming baseline scenario. Other studies are echoing this
processing techniques, the percentage of jammed cell could be analysis considering different jamming scenarios [4].
easily reduced from 95% to around 80%, leading to an
We would also like to emphasize that LTE-advance
equivalent usable cell of 12.6 km.
features (3GPP release 10 and next) will further improve the
For the Downlink, some improvements have also been resistance to jamming of LTE 400MHz system. As an example,
identified leading the percentage of jammed cell would be carrier aggregation may help to introduce an equivalent of very
reduced from 25% to around 8%. wide frequency bandwidth by using two LTE carriers.
Offensive scenario - Uplink
REFERENCES
100

90
[1] NPSTC, 700 MHz Public Safety Broadband Task Force Report and
Recommendations, September 2009
% of jammed Cell

80

70
[2] TETRA and Critical Communications Association, Statement on LTE,
60

50
BB October 2012
PJ
40 PB [3] Matthew Baker, Tim Moulsley. Downlink physical data and control
30
channels. In Stefania Sesia, Issam Toufik, and Matthew Baker, editors,
20

10
LTE, The UMTS Long Term Evolution: From Theory to Practice,
0
chapter 9. John Wiley & Sons Ltd, Chichester, West Sussex, United
RS PUSCH PUSCH 70% PRACH RS PUCCH PUCCH
Kingdom, second edition, 2011
Figure 9. Offensive scenario results for LTE uplink [4] Jeffrey Reed, Marc Lichtman, Virginia Tech, FirstNet NOI regarding the
conceptual network architecture, November 2012,
http://www.ntia.doc.gov/files/ntia/va_tech_response.pdf
Offensive scenario - Downlink

30

25
% of jammed Cell

20

BB
15
PJ
PB
10

0
PHICH PSS SSS PCFICH PBCH P-DCCH P-DSCH RS

Figure 10. Offensive scenario results for LTE downlink