Spectrum, security and regulation

Overview

Every radio you build or deploy operates under rules. They set the frequencies it may use, its power, how it must share the band and how much RF energy a person nearby may absorb. Security is a related duty. A radio link is open to anyone with a receiver, so confidentiality and authentication must come from the protocol. This hub gives a working engineer’s map of all three. It is not legal advice, and the rules differ by country, so always check the regulator where the equipment will be used.

Key ideas

Who sets the rules

At the international level, the ITU-R maintains the Radio Regulations, the treaty that allocates frequency bands to services and governs satellite orbits. World Radiocommunication Conferences review and revise them every three to four years, according to the ITU. WRC-23 was held in Dubai from 20 November to 15 December 2023. WRC-27 is scheduled for 18 October to 12 November 2027 in Shanghai. National regulators then turn the international allocations into licences and device rules. Examples are the FCC in the United States and Ofcom in the United Kingdom. In Europe, ETSI writes harmonised standards that manufacturers use to show their equipment meets the essential requirements. ETSI EN 300 220-2 for short range devices is one, discussed in the LPWAN and IoT hub.

Licensed, unlicensed and shared spectrum

Licensed spectrum gives one holder exclusive use of a band in an area. Mobile operators buy or are awarded such licences, and in return they get protection from interference. Unlicensed spectrum lets any device transmit if it meets the technical rules, with no protection from other users. Wi-Fi, Bluetooth and LoRaWAN live here. The FCC’s decision of 23 April 2020 made 5.925 to 7.125 GHz available for unlicensed use in the United States, according to its news release.

Shared spectrum sits between the two. The US Citizens Broadband Radio Service (CBRS) is a worked example. Under 47 CFR Part 96, CBRS uses 3550 to 3700 MHz. Priority Access users may operate in 3550 to 3650 MHz and General Authorized Access users across the whole band. Both tiers must protect incumbent users, and General Authorized Access must also accept interference from Priority Access. One or more Spectrum Access Systems coordinate every base station.

RF exposure limits at a working level

Two sets of limits matter most to an engineer. The International Commission on Non-Ionizing Radiation Protection publishes Guidelines for Limiting Exposure to Electromagnetic Fields (100 kHz to 300 GHz) (Health Physics, 2020). ICNIRP’s radiofrequency page states that “the only substantiated effect” of RF exposure relevant to health is heating of tissue, and the limits are set to prevent excessive heating. In the United States, 47 CFR 1.1310 sets specific absorption rate (SAR) limits from 100 kHz to 6 GHz. For the general population they are 0.08 W/kg averaged over the whole body and 1.6 W/kg peak averaged over any 1 g of tissue, with 4 W/kg over 10 g for the extremities. Occupational limits are higher.

For a design engineer this becomes a compliance task. Handheld devices are assessed for SAR. Base stations and fixed transmitters are assessed with field-strength or power-density limits and exclusion zones around the antenna. The test and calculation methods are set by the regulator and the referenced standards. Do not describe health effects beyond what the regulator or a peer-reviewed review states.

Wireless security

Radio removes the physical boundary of a cable, so attacks fall into a few groups: eavesdropping, impersonation, tracking and jamming. Cellular systems authenticate the subscriber and the network and encrypt the radio link. The 5G security architecture is TS 33.501, first in Release 15. It introduced the Subscription Concealed Identifier (SUCI) to hide the permanent subscriber identity from IMSI catchers. Mattsson and Nakarmi show in Nori (arXiv, 2021) that variable-length identifiers can still leak identity without padding. In Wi-Fi, Vanhoef and Piessens showed in Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2 (ACM CCS, 2017) that an attacker could manipulate the WPA2 handshake into reusing nonces. The Wi-Fi Alliance security page states that WPA3 is mandatory for Wi-Fi CERTIFIED devices. Jamming is a regulatory matter as well as a security one. In the United States, 47 U.S.C. § 333 prohibits wilful or malicious interference with licensed or authorised radio communications.

Where to start

The link budgets and noise hub and Decibels and link budgets explain EIRP, the quantity most power limits are written in. The Wi-Fi hub covers the 6 GHz rules in practice. The careers and industry hub describes regulatory and standards roles. Before you transmit with an SDR, read the transmit warnings in the software-defined radio hub.

Tools and platforms

Common mistakes

• Assuming a band that is unlicensed in one country is unlicensed everywhere.
• Quoting conducted power when the limit is EIRP. Antenna gain counts.
• Treating unlicensed spectrum as free of obligations. Device rules on power, duty cycle and listen-before-talk still apply.
• Testing an SDR transmitter over the air without a licence or test authorisation.
• Treating encryption on the radio link as end-to-end protection.
• Stating or implying health effects that the regulators and peer-reviewed reviews do not support.

Going deeper

• ITU, World Radiocommunication Conferences.
• ICNIRP, Guidelines for Limiting Exposure to Electromagnetic Fields (100 kHz to 300 GHz), Health Physics 118(5), 2020.
• US eCFR, 47 CFR 1.1310 and 47 CFR Part 96.
• Vanhoef and Piessens, Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2, ACM CCS, 2017.
• Mattsson and Nakarmi, Nori: Concealing the Concealed Identifier in 5G, arXiv, 2021.