Sprint's magic box
newsroom.sprint.com
newsroom.sprint.com
T-Mobile also has the "4G LTE CellSpot", which needs an Internet connection like the Sprint AIRAVE.
T-Mobile has better device names. "Magic Box" tells you nothing. Does it make popcorn, or what?
It's been a must have for my in now both a low-income city and rural New Jersey. Without the extra signal support I am constantly dropping calls and having the audio cut out.
This new device looks like it receives service from a nearby Sprint tower and uses it to serve your home/office. That wouldn't have worked at my home where it was nigh impossible to get Sprint service even when outdoors.
I know that to avoid self-interference, the relay needs to either implement frequency separation between its link to the real eNB and its link to the UEs it serves, or implement time separation. AIUI, time separation gets done by (for DL) not transmitting to real eNB when needing to listen to UE and (for UL) by not transmitting to UE when needing to listen to eNB. I think this gets more complicated when DL and UL are in the same band (TDD LTE).
Since I have no access to any key material, I cannot read anything that's encrypted and I cannot modify anything that'll get verified cryptographically or gets used as an input to a KDF (changes in KDF inputs will lead to different keys on the UE than the network expects). Given this limitation, is it possible to either:
1. Demodulate signals from the real eNB (on its DL band), replace any reference to the real DL band (in the master/system information blocks) with our DL band, and radiate that on a different DL band to the UE -- and do the same transform with the UL bands. Is it possible to fool the UE this way? Is the UARFCN used as a KDF input or talked about over some signalling radio bearer in RRC / NAS messages (which afaict, is encrypted and thus inaccessible)?
2. Is it possible to intercept/consistently modify/pass-on scheduling requests / resource grants for both UL and DL without breaking anything? Are scheduling requests / resource grants ever encrypted or otherwise protected by cryptography? Does anything above that layer actually know/care about the precise scheduling? Would this be a feasible method to ensure that there's no self-interference at the relay (by telling the UE to radiate on UL at a different time than the relay will radiate on UL to the eNB, and similarly for DL)?
The lower frequencies will in theory have better range than the higher frequencies they use for typical LTE
Which is to say if there is no sprint tower near you this is a useless product.