SpectraCert: A Hierarchical System for Dynamic Spectrum License Enforcement#

Ryan W. West; Dustin Maas; Jacobus Van der Merwe; David M. Johnson (University of Utah)

• Why: This is PKI and X.509-style hierarchical certificate derivation applied to a physical resource — spectrum. As someone working identity, you'll recognize the pattern (delegatable, revocable, attestable authority enforced by a trusted module in the endpoint) playing out in an entirely new domain, which is a sharp lens on how far the delegation-certificate model can stretch.
• What: A dynamic, PKI-based system for spectrum sharing: entities receive "spectracerts" — certificates encoding allowed frequencies, times, geographies, power limits, expirations — derived from parent spectracerts with increasingly limited rights. Trusted Modules inside SDRs validate certificate chains and revocations, and physically enforce radio configuration to match (from abstract only).
• How: Certificate hierarchy from Spectrum-Authorized Entities down to individual radios; automatic revocation/replacement propagation across the hierarchy; integration with the OpenZMS spectrum management system; spectracerts also double as verification tokens for interference/occupancy attestations.
• Where applicable: Regulatory/spectrum-sharing contexts (dynamic spectrum access, SDR certification). Nothing deployable for you directly, but the enforce-in-endpoint-trusted-hardware pattern is one to watch as it rhymes with SPIFFE-style workload identity for physical infrastructure.