Unpredictable GHz fields mooted for nuclear warhead monitoring

German and US scientists think they might have the answer, using a technique much like the PUFs – physically uncloneable functions – used in add unpredictable unique identity numbers to ICs.

“The technology combines cyber-physical security assessments, previously only possible on data and security chips, with cross-system physics in a completely new way,” said Professor Christian Zenger of Ruhr University Bochum (RUB).

The new idea is to set up a 3 to 9GHz RF field in the vicinity of the warhead and monitor that remotely for changes.

“Our system uses two antennas to record a radio fingerprint of the room,” said researcher Johannes Tobisch, who was at RUB for this research.

One of the antennas emits a signal, which is reflected off the walls and objects in the room, and the other is used to record the result.

“The recorded signal is characteristic: if the objects were moved only minimally, this would noticeably change the radio fingerprint. Major changes, such as the removal of a stored nuclear warhead, can thus be reliably detected,” according to the university.

But a monitored country could record the outgoing signal, then keep playing that recording back while they tamper with or remove the warhead. “Like someone sticking a photo in front of a surveillance camera,” said Tobisch.

Against this, the concept includes 20 movable mirrors clustered around the antennas, and the monitoring country would make a database of radio fingerprints for multiple mirror positions during a one-time initial site visit.

Now the monitoring state can occasionally ask the monitored state to move the mirrors into new positions, knowing what pattern this should generate if nothing else in the room has been touched.

To test the concept, movable barrels were set up in a shipping container at Ruhr University. “Using this set-up, they showed that radio fingerprints could be reliably reproduced for individual mirror settings,” said the university. “Different mirror settings also produced a variety of easily distinguishable radio fingerprints. If the researchers moved one of the barrels in the container, a few millimeters of displacement were enough to show up in the radio fingerprint.”

The team analysed whether it’s possible to decipher how mirror positions and radio fingerprints correspond to each other using machine learning, and it is, but it isn’t quick.

“With 20 mirrors, it would take eight weeks for an attacker to decode the underlying mathematical function,” said Tobisch, adding:  “Because of the scalability of the system, it’s possible to increase the security factor even more.”

Ruhr University Bochum worked with the Max Planck Institute for Security and Privacy Bochum, Princeton University, the University of Connecticut, Harvard University, Physec and Technische Universität Berlin.

“70% of the world nuclear weapons are kept in storage for military reserve or awaiting dismantlement,” according to Sebastien Philippe of Princeton University. “The presence and number of such weapons at any given site cannot be verified easily via satellite imagery or other means that are unable to see into storage vaults. Because of the difficulties to monitor them, these 9,000 nuclear weapons are not accounted for under existing nuclear arms control agreements.”

This research is published by the journal Nature Communications as ‘Remote inspection of adversary-controlled environments‘ – full paper available without payment.