People with a better understanding of the LTE protocols than I do -- is it possible to make an LTE relay (like this "magic box") but without any cooperation fro

People with a better understanding of the LTE protocols than I do -- is it possible to make an LTE relay (like this "magic box") but without any cooperation from the network operator (so no access to any cryptographic keys/secrets and no special/internal access to the operator's network)? I know that to avoid self-interference, the relay needs to either implement frequency separation between its link to the real eNB and its link to the UEs it serves, or implement time separation. AIUI, time separation gets done by (for DL) not transmitting to real eNB when needing to listen to UE and (for UL) by not transmitting to UE when needing to listen to eNB. I think this gets more complicated when DL and UL are in the same band (TDD LTE). Since I have no access to any key material, I cannot read anything that's encrypted and I cannot modify anything that'll get verified cryptographically or gets used as an input to a KDF (changes in KDF inputs will lead to different keys on the UE than the network expects). Given this limitation, is it possible to either: 1. Demodulate signals from the real eNB (on its DL band), replace any reference to the real DL band (in the master/system information blocks) with our DL band, and radiate that on a different DL band to the UE -- and do the same transform with the UL bands. Is it possible to fool the UE this way? Is the UARFCN used as a KDF input or talked about over some signalling radio bearer in RRC / NAS messages (which afaict, is encrypted and thus inaccessible)? 2. Is it possible to intercept/consistently modify/pass-on scheduling requests / resource grants for both UL and DL without breaking anything? Are scheduling requests / resource grants ever encrypted or otherwise protected by cryptography? Does anything above that layer actually know/care about the precise scheduling? Would this be a feasible method to ensure that there's no self-interference at the relay (by telling the UE to radiate on UL at a different time than the relay will radiate on UL to the eNB, and similarly for DL)?