5GReasoner

Hussain, Syed Rafiul; Echeverria, Mitziu; Karim, Imtiaz; Chowdhury, Omar; Bertino, Elisa

doi:10.1145/3319535.3354263

Cited by 89 publications

(30 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When T L instead of T R is used, non-existent users are created, that have a smaller load value than the T R extracted ones. These errors can have substantial impact [0-1] min,TR [2][3][4] min,TR [5][6][7][8] min,TR [9][10][11][12][13][14][15][16] min,TR [17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32] min,TR min,TR [0-1] min,TL [2][3][4] min,TL [5][6][7][8] min,TL [9][10][11][12][13][14][15][16] min,TL [17][18][19][20]…”

Section: Discussionmentioning

confidence: 99%

“…Nevertheless, several works have shown that RNTIs can be mapped to other identifiers like TMSI, allowing an adversary to track and localize users within a cell [15,16], and even to eavesdrop and decipher a user's signaling and data traffic [17]. Most of the protocol vulnerabilities of 5G NR and LTE assume knowledge of the RNTIs [18]. In practice, a timer monitors the user inactivity: when it exceeds a given threshold, the user-RNTI association is released and the same RNTI can be re-assigned to another user.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

In-depth study of RNTI management in mobile networks: Allocation strategies and implications on data trace analysis

et al. 2022

View full text Add to dashboard Cite

Section: Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

In-depth study of RNTI management in mobile networks: Allocation strategies and implications on data trace analysis

et al. 2022

View full text Add to dashboard Cite

“…The formal verification of 5G network protocols has been approached through various models. Basin et al [13] model the Authentication and Key Agreement Protocols (5G-AKA) of 5GS, while Hussain et al [14] analyze several NAS and RRC protocols. Yang et al [15] present a formal model of the Authentication and Key Management for Application (AKMA) service used for establishing authenticated communication between users and application functions.…”

Section: Related Workmentioning

confidence: 99%

A Vulnerability Assessment of Open-Source Implementations of Fifth-Generation Core Network Functions

Dolente,

Garroppo,

Pagano

2023

Future Internet

View full text Add to dashboard Cite

The paper presents an experimental security assessment within two widely used open-source 5G projects, namely Open5GS and OAI (Open-Air Interface). The examination concentrates on two network functions (NFs) that are externally exposed within the core network architecture, i.e., the Access and Mobility Management Function (AMF) and the Network Repository Function/Network Exposure Function (NRF/NEF) of the Service-Based Architecture (SBA). Focusing on the Service-Based Interface (SBI) of these exposed NFs, the analysis not only identifies potential security gaps but also underscores the crucial role of Mobile Network Operators (MNOs) in implementing robust security measures. Furthermore, given the shift towards Network Function Virtualization (NFV), this paper emphasizes the importance of secure development practices to enhance the integrity of 5G network functions. In essence, this paper underscores the significance of scrutinizing security vulnerabilities in open-source 5G projects, particularly within the core network’s SBI and externally exposed NFs. The research outcomes provide valuable insights for MNOs, enabling them to establish effective security measures and promote secure development practices to safeguard the integrity of 5G network functions. Additionally, the empirical investigation aids in identifying potential vulnerabilities in open-source 5G projects, paving the way for future enhancements and standard releases.

show abstract

“…To analyze the security and reliability of the communication network efficiently and conveniently, the researchers designed a systematic approach based on the principle of the model checking method and used it to discover the design weaknesses resulting in attacks having security implications in the communication network. We lucubrate the work of literature [4,6,13] and summarize the operation flow of this approach. Figure 3 shows the operation flow of this approach.…”

Section: Applied Systematic Approachmentioning

confidence: 99%

“…ey identified ten new 5G protocol vulnerabilities for 5G nonaccess stratum signaling security and proposed a defense method utilizing the existing publicprivate key pair adopted by 3GPP. Afterward, Hussain et al [6] employed this approach to verify 5G NAS layer procedures (i.e., initial registration, deregistration, paging, configuration update, handover, and service request procedures) and the corresponding RRC layer procedures against relevant security and privacy properties. ey discovered 11 design weaknesses resulting in attacks having security and privacy implications in the 5G network.…”

Section: Introductionmentioning

confidence: 99%

Towards 5G Security Analysis against Null Security Algorithms Used in Normal Communication

ZhangRun¹,

ZhouWenAn²,

HuHuamiao³

2021

Security and Communication Networks

View full text Add to dashboard Cite

mailto: 5G network makes our lives delicate and more pleasant, and its security will impact the operation of the entire society. Compared with the LTE network, 5G brings up many new security features and possesses more sophisticated and robust security mechanisms, while there are still many potential security issues with the 5G network. Therefore, the security analysis of the 5G network is highly crucial. Null security algorithm (i.e., NEA0 and NIA0) is used in normal communication, a security vulnerability that exists and has not been fully addressed in the LTE network, but in the 5G network, no studies have been performed to demonstrate whether this security vulnerability still exists so far. Therefore, in this paper, we apply a systematic approach based on the principle of model checking to verify. We conduct an in-depth analysis of the signaling interaction and security mechanism for the attach procedure in the 5G network. And then, we model UE and AMF into two synchronous communication finite-state machines, extract the desired properties from 3GPP relevant specifications, and construct an adversary model to test the system’s security. By observing the operation of state machines and analyzing relevant protocol behavior, we discover that faulty security algorithm selection could result in the acceptance of the null security algorithm (i.e., NEA0 and NIA0) on the side of the core network, and attackers can exploit this to trigger IP spoofing attacks and SUPI catching attacks on the victim UE. We analyze the root cause of these network attacks and propose an anomaly detection method to avoid these network attacks from being launched effectively.

show abstract

5GReasoner

Cited by 89 publications

References 28 publications

In-depth study of RNTI management in mobile networks: Allocation strategies and implications on data trace analysis

In-depth study of RNTI management in mobile networks: Allocation strategies and implications on data trace analysis

A Vulnerability Assessment of Open-Source Implementations of Fifth-Generation Core Network Functions

Towards 5G Security Analysis against Null Security Algorithms Used in Normal Communication

Contact Info

Product

Resources

About