Security Penetration Test Framework for the Diameter Protocol

Frederick R. Carlson

DOI: https://doi.org/10.48550/arXiv.1407.6508

2014-07-24

Abstract:This paper outlines the infrastructure required for a penetration testing suite centered around the cellular call control protocol called Diameter. A brief description of Diameter is given along with the basic equipment and design requirements to conduct the testing.

Cryptography and Security

What problem does this paper attempt to address?

Research on Diameter Protocols

邱锡鹏,刘海鹏

DOI: https://doi.org/10.3969/j.issn.1002-137X.2003.02.021

2003-01-01

Computer Science

Abstract:Diameter is the next authentication,authorization and accounting protocol currently developed in the IETF AAA working group,which will replace the widely and successfully deployed Radius protocol. In the paper, the motivations and backgrounds of Diameter protocols are firstly introduced. The following is a detailed description of the Diameter base protocol and its applications, such as mobile IP, NASREQ. Then the comparisons and analysis between Diameter and Radius are given.
An Overview of Penetration Testing

Chiem Trieu Phong,Wei Qi Yan

DOI: https://doi.org/10.4018/ijdcf.2014100104

2014-01-01

International Journal of Digital Crime and Forensics

Abstract:Penetration testing is an effort to attack a system using similar techniques and tools adopted by real hackers. The ultimate goal of penetration testing is to call to light as many existing vulnerabilities as possible, then come up with practical solutions to remediate the problems; thus, enhance the system security as a whole. The paper introduces concepts and definitions related to penetration testing, together with different models and methodologies to conduct a penetration test. A wide range of penetration testing state-of-the-art, as well as related tools (both commercial and free open source available on the market) are also presented in relatively rich details.
Hardening of network segmentation using automated referential penetration testing

Mohammed Alabbad,Neerja Mhaskar,Ridha Khedri

DOI: https://doi.org/10.1016/j.jnca.2024.103851

IF: 7.574

2024-04-01

Journal of Network and Computer Applications

Abstract:We study the problem of hardening the security of existing networks. Dynamic and static analysis are two main approaches that are used to address this problem. Dynamic analysis is performed using penetration testing. Penetration testing (short pentesting) simulates attacks on an existing and possibly dynamic network to identify its vulnerabilities without causing it any harm. Static analysis analyzes the access control policies of both network resources and firewalls without executing them. Although, dynamic and static analysis are extremely useful approaches, they also have several drawbacks. For instance, they do not identify vulnerabilities resulting from weak network segmentation, improper implementation of the Defence in Depth strategy, and an increased attack surface for a given resource or firewall. In this paper, we propose a novel approach termed as the referential penetration testing (RPT) approach to evaluate the security of networks. The RPT approach evaluates the network and checks for segmentation flaws, while checking for other traditional vulnerabilities. We then propose a novel framework, called the RPT framework, that incorporates the RPT approach to identify vulnerabilities in networks. The proposed framework is an application of the Digital Twin Technology in network security. We compare RPT to the network vulnerabilities assessment tools Nessus, OpenVAS, Qualys, Illumio, Tufin, and AlgoSec. The comparison reveals that RPT is different from the other tools on all the considered technical aspects, which indicates that it brings a novel approach to assess network segmentation. It has a very limited focus compared to the others, which makes it suitable for being used in combination with anyone of them to further enhance the robustness of the segmentation. Finally, we implement this framework in the Software Defined Network (SDN) environment and discuss its usefulness.

computer science, interdisciplinary applications, software engineering, hardware & architecture
Implementing a Secure AAA System in IPv6 Network

Fang Meng,Changqing An,Jiahai Yang

DOI: https://doi.org/10.1109/icct.2006.341803

2006-01-01

Abstract:With the rapid development of new networking technologies and services, and the increasing complexity of network, it is required that AAA architecture offer secure and flexible service in IPv6 scenarios. The paper proposes a secure AAA system in IPv6 network, which is based on 802.11i and diameter protocol. The system provides policy-based access control and supports heterogeneous user terminals. We discuss the implementation of the testbed and policies, and present additional attributes for diameter protocol. Security analysis is also provided. The proposed system is highly flexible and secure, and supports user roaming in global networks.
PTFW: a protocol testing framework for wireless sensor networks

Jialu Fan,Jiming Chen,Ruilong Deng,Youxian Sun,Xuemin (Sherman) Shen

DOI: https://doi.org/10.1145/1582379.1582477

2009-01-01

Abstract:Protocol testing has been one of the most active fields in computer networks. In Wireless Sensor Networks (WSNs), before directly employing protocols on hardware testbed, we expect an effective test framework to verify the logical correctness of protocols on computers, which could facilitate the whole test process. Towards this goal, this paper introduces an upper test framework in WSNs, namely Protocol Testing Framework for WSNs (PTFW). PTFW is a visual client-server test framework which is built upon the unique features of WSNs. It is based on the layered architecture of WSNs and uses Finite State Machine (FSM) theory as the kernel. The proposed test framework is developed on Linux Operating System (OS) and coded in standard C language for the consideration of compatibility for real-world implementation. PTFW provides the standards/specifications of conformance testing for test on hardware testbed. To validate the performance and effectiveness of PTFW, we apply it to a real-world WSNs protocol. The results show that PTFW exhibits excellent visual and real-time features, which bring considerable convenience to the later employments on testbed.
Development and Analysis of P2SCP: A Paradigm for Penetration Testing of Systems that Cannot be Subjected to the Risk of Penetration Testing

Jeremy Straub

2023-06-07

Abstract:Penetration testing increases the security of systems through tasking testers to 'think like the adversary' and attempt to find the ways that an attacker would break into the system. For many systems, this can be conducted in a safe and controlled way; however, some systems are so critical to human life and safety that the risk of their failure or disablement due to active penetration testing cannot be assumed. These systems are also critical to evaluate the security of, to prevent attackers from disabling them or causing their maloperation; however, this must be done in a manner that doesn't risk the very malady that testing seeks to avoid through the testing process itself. This paper presents P2SCP, a paradigm for penetration testing of systems that cannot be subjected to the risk of penetration testing. It discusses how data collection, the creation of digital twins and cousins and evaluative analysis can be utilized to conduct virtual penetration tests on critical infrastructure systems. This proposed paradigm is analyzed through the use of several case studies.

Cryptography and Security
A Formal Approach for Passive Testing of Protocol Data Portions

D Lee,DL Chen,RB Hao,RE Miller,JP Wu,X Yin

DOI: https://doi.org/10.1109/icnp.2002.1181393

2002-01-01

Abstract:Passive testing is a process of detecting faults in a system under test by passively observing its input/output behaviors only without interrupting its normal operations, and proves to be a promising technique for network fault management. We study passive testing of data portions of network protocols and present two algorithms, using an Event-driven Extended Finite State Machine model. Experimental results on the Internet routing protocol OSPF are reported.
Security Analysis of Session Initiation Protocol Digest Access Authentication Scheme.

Yuting Feng,Feng Xiong,Wenchao Huang,Yan Xiong

DOI: https://doi.org/10.1109/bigcom53800.2021.00005

2021-01-01

Abstract:The Internet Engineering Task Force (IETF) proposed the Session Initiation Protocol (SIP) as the IP-based telephony protocol. With the widespread application of the Voice over IP (VoIP) on Internet, Security problems of SIP have received a lot of attention of researchers and the authentication mechanism in SIP is becoming increasingly important. Many studies reveal that the initial version of SIP specification suffers malicious attacks. To improve the security of the authentication mechanism in SIP, amendments and supplements are expressed over years. Researches on the previous specification have been carried out and some attacks are found, such as replay attack, online dictionary attack, man in the middle attack, etc. However, there is currently a lack of security analysis to the fresh security mechanisms of SIP. In this paper, we accommodate such a requirement by analyzing the security properties of SIP Digest Access Authentication Scheme adopting a formal protocol analysis tool SPAN. The authentication scheme is modeled in the validator according to two practical scenarios. With the two back-ends of SPAN, the two models of authentication scheme are verified both as safe. This result confirms that the supplemented version of SIP authentication mechanism is more reliable.
RDAP: Rapid Deployment Authentication Protocol Between Mobile Devices and Femtocells

Yao-Hsin Chen,Li-Wei Huang,Yue-Hsun Lin,Shao-Wei Huang,Chun-Hao Yeh,Hung-Min Sun

DOI: https://doi.org/10.1109/tencon.2010.5686587

2010-01-01

Abstract:Femtocells is an ongoing technology to improve coverage for broadband radios, e.g., WiMAX and 3G. To prevent the core network from unauthorized accesses, a security gateway is designed to protect communications between legal femtocells and the core network. However, there are no integrated solutions to protect subscribers from rogue femtocells. Without any protection mechanisms, rogue femtocells are able to launch any attacks they wish, e.g., Sybil attack, Man-In-The-Middle attack. Hence, we propose an mutual authentication protocol to prevent rogue femtocells. With aid of visual channel, subscribers' mobile device can verify the source of connected femtocell based on physical trust. After the protocol finishes, a secure tunnel is also forced to protect mutual communication. Moreover, this protocol could be dynamically deployed and seamless combined with current access control mechanisms. In the end of this paper, we conduct the procotol on the current mobile phone platform to show its efficiency.
DIP: Disruption-Tolerance for IP

Michael Neufeld

DOI: https://doi.org/10.48550/arXiv.1003.3996

2010-03-21

Networking and Internet Architecture

Abstract:Disruption Tolerant Networks (DTN) have been a popular subject of recent research and development. These networks are characterized by frequent, lengthy outages and a lack of contemporaneous end-to-end paths. In this work we discuss techniques for extending IP to operate more effectively in DTN scenarios. Our scheme, Disruption Tolerant IP (DIP) uses existing IP packet headers, uses the existing socket API for applications, is compatible with IPsec, and uses familiar Policy-Based Routing techniques for network management.
A Novel Framework to Carry out Cloud Penetration Test

Jianbin Hu,Yonggang Wang,Cong Tang,Zhi Guan,Fengxian Ren,Zhong Chen

DOI: https://doi.org/10.5815/ijcnis.2011.03.01

2011-01-01

International Journal of Computer Network and Information Security

Abstract:in current cloud services, users put their data and resources into the cloud so as to enjoy the on-demand high quality applications and services. Different from the conventional services, users in cloud services lose control of their data which is instead manipulated by the large-scale cloud. Therefore, cloud service providers (CSP) guarantee that the cloud which they provide is of high confidence in accuracy and integrity. Traditional penetration test is carried out manually and has low efficiency. In this paper, we propose FPTC, a novel framework of penetration test in cloud environment. In FPTC, there are managers, executors and toolkits. FPTC managers guide FPTC executors to gather information from the cloud environment, generate appropriate testing scenarios, run matched tools in the toolkit and collect test results to do evaluation. The capacity and quality of the toolkit is a key issue in FPTC. We develop a prototype in which FPTC is implemented and the experimental results show that FPTC is helpful to automatically carry out penetration test in cloud environment.
Physical Layer Security in D2D Underlay Cellular Networks with Poisson Cluster Process.

Jiawei Lyu,Hui-Ming Wang,Ke-Wen Huang

DOI: https://doi.org/10.1109/tcomm.2020.3017287

IF: 6.166

2020-01-01

IEEE Transactions on Communications

Abstract:Device-to-device (D2D) communication is a promising solution to meet rapidly growing demands for data services via spectrum reuse. This paper studies the physical layer security in a D2D underlay cellular network from a network-wide perspective, where the locations of D2D and cellular users are modeled as Poisson cluster processes (PCPs) to characterize the clustering feature of D2D users, the locations of eavesdroppers (Eves) and base stations (BSs) are modeled as a PCP and Poisson point process (PPP), respectively. We establish an analytical framework to assess the coverage and security performance of the network. Two scenarios are considered, i.e., one D2D pair scenario and multiple D2D pairs scenario, where in each cell there is one or multiple D2D users (DUs) sharing the frequency spectrum with the cellular users (CUs) in each time slot of the TDMA scheme adopted by BSs. In each considered scenario, we derive exact expressions for the coverage outage probabilities (COPs) and secrecy outage probabilities (SOPs), respectively, for both the CUs and DUs. Furthermore, the exact expression for the network-wide secrecy throughput (ST) is derived. Numerical results are presented to verify our theoretical derivations and reveal some insights into the impact of various parameters on the system performance.
A decoy chain deployment method based on SDN and NFV against penetration attack

Qi Zhao,Chuanhao Zhang,Zheng Zhao

DOI: https://doi.org/10.1371/journal.pone.0189095

IF: 3.7

2017-12-07

PLoS ONE

Abstract:Penetration attacks are one of the most serious network security threats. However, existing network defense technologies do not have the ability to entirely block the penetration behavior of intruders. Therefore, the network needs additional defenses. In this paper, a decoy chain deployment (DCD) method based on SDN+NFV is proposed to address this problem. This method considers about the security status of networks, and deploys decoy chains with the resource constraints. DCD changes the attack surface of the network and makes it difficult for intruders to discern the current state of the network. Simulation experiments and analyses show that DCD can effectively resist penetration attacks by increasing the time cost and complexity of a penetration attack.
Penetration Tests for Bluetooth Low Energy and Zigbee using the Software-Defined Radio

Mahyar Taj Dini,Volodymyr Sokolov

DOI: https://doi.org/10.5281/zenodo.2528810

2019-02-23

Abstract:This article discusses the available Software Defined Radios (SDRs), compatible software, message formats, and also shows how it is possible to do penetration tests using SDR for Bluetooth Low Energy (BLE) and ZigBee technologies.

Cryptography and Security,Networking and Internet Architecture
Sec-D2D: A Secure and Lightweight D2D Communication System with Multiple Sensors

Mingsheng Cao,Luhan Wang,Hua Xu,Dajiang Chen,Chunwei Lou,Ning Zhang,Yixin Zhu,Zhiguang Qin

DOI: https://doi.org/10.1109/access.2019.2900727

IF: 3.9

2019-01-01

IEEE Access

Abstract:Device-to-Device (D2D) communication is a promising method for the emerging Internet of Things. Secure information exchange plays a key role in the application of D2D communication. Considering that the wireless devices are powered by batteries, in this paper, a lightweight secure D2D system is designed by using multiple sensors on mobile devices. Specifically, by leveraging an acceleration sensor equipped in two wireless devices, a lightweight and efficient key distribution scheme for secure D2D communication is proposed. Based on the distributed secure key, an efficient near-field authentication is developed with a speaker and a microphone to determine whether these two devices are physically close; and a secure information exchange scheme with high efficiency, which includes message encryption/decryption and message authentication, is presented over the audio channel and the RF channel. The Extensive experiments are provided to demonstrate that our system can achieve a secure information exchange between two wireless devices with low energy consumption and computing resources.
Strengthening SDN Security: Protocol Dialecting and Downgrade Attacks

Michael Sjoholmsierchio,Britta Hale,Daniel Lukaszewski,Geoffrey G. Xie

DOI: https://doi.org/10.48550/arXiv.2010.11870

2020-10-23

Abstract:Software-defined networking (SDN) has become a fundamental technology for data centers and 5G networks. In an SDN network, routing and traffic management decisions are made by a centralized controller and communicated to switches via a control channel. Transport Layer Security (TLS) has been proposed as its single security layer; however, use of TLS is optional and connections are still vulnerable to downgrade attacks. In this paper, we propose the strengthening of security assurance using a protocol dialecting approach to provide additional and customizable security. We consider and evaluate two dialecting approaches for OpenFlow protocol operation, adding per-message authentication to the SDN control channel that is independent of TLS and provides robustness against downgrade attacks in the optional case of TLS implementation. Furthermore, we measure the performance impact of using these dialecting primitives in a Mininet experiment. The results show a modest increase of communication latency of less than 22%.

Networking and Internet Architecture
The Security of Distance Testing System

ZENG Huajun,Shen Ruimin,Shen Liping,ZHANG Tongzhen

DOI: https://doi.org/10.3969/j.issn.1000-3428.2001.03.052

2001-01-01

Abstract:Web-based distance testing system brings out a series of security problems. The security of Web-test includes not only normal information security problems like authentication. privacy, access control, integrality, etc, but also unique ones such as cheat-preventing, paper-protecting, etc. We suggest a half-closed Web-test environment, and use a particular testing gateway to apply security mechanism. The functions and running process of the testing gateway is also presented in detail.
Side-Channel Analysis for the Authentication Protocols of CDMA Cellular Networks

Chi Zhang,Jun-Rong Liu,Da-Wu Gu,Wei-Jia Wang,Xiang-Jun Lu,Zheng Guo,Hai-Ning Lu

DOI: https://doi.org/10.1007/s11390-019-1961-5

2019-01-01

Abstract:Time-division multiple access (TDMA) and code-division multiple access (CDMA) are two technologies used in digital cellular networks. The authentication protocols of TDMA networks have been proven to be vulnerable to side-channel analysis (SCA), giving rise to a series of powerful SCA-based attacks against unprotected subscriber identity module (SIM) cards. CDMA networks have two authentication protocols, cellular authentication and voice encryption (CAVE) based authentication protocol and authentication and key agreement (AKA) based authentication protocol, which are used in different phases of the networks. However, there has been no SCA attack for these two protocols so far. In this paper, in order to figure out if the authentication protocols of CDMA networks are sufficiently secure against SCA, we investigate the two existing protocols and their cryptographic algorithms. We find the side-channel weaknesses of the two protocols when they are implemented on embedded systems. Based on these weaknesses, we propose specific attack strategies to recover their authentication keys for the two protocols, respectively. We verify our strategies on an 8-bit microcontroller and a real-world SIM card, showing that the authentication keys can be fully recovered within a few minutes with a limited number of power measurements. The successful experiments demonstrate the correctness and the effectiveness of our proposed strategies and prove that the unprotected implementations of the authentication protocols of CDMA networks cannot resist SCA.
Advanced Penetration Testing for Enhancing 5G Security

Shari-Ann Smith-Haynes

2024-07-24

Abstract:Advances in fifth-generation (5G) networks enable unprecedented reliability, speed, and connectivity compared to previous mobile networks. These advancements can revolutionize various sectors by supporting applications requiring real-time data processing. However, the rapid deployment and integration of 5G networks bring security concerns that must be addressed to operate these infrastructures safely. This paper reviews penetration testing approaches for identifying security vulnerabilities in 5G networks. Penetration testing is an ethical hacking technique used to simulate a network's security posture in the event of cyberattacks. This review highlights the capabilities, advantages, and limitations of recent 5G-targeting security tools for penetration testing. It examines ways adversaries exploit vulnerabilities in 5G networks, covering tactics and strategies targeted at 5G features. A key topic explored is the comparison of penetration testing methods for 5G and earlier generations. The article delves into the unique characteristics of 5G, including massive MIMO, edge computing, and network slicing, and how these aspects require new penetration testing methods. Understanding these differences helps develop more effective security solutions tailored to 5G networks. Our research also indicates that 5G penetration testing should use a multithreaded approach for addressing current security challenges. Furthermore, this paper includes case studies illustrating practical challenges and limitations in real-world applications of penetration testing in 5G networks. A comparative analysis of penetration testing tools for 5G networks highlights their effectiveness in mitigating vulnerabilities, emphasizing the need for advanced security measures against evolving cyber threats in 5G deployment.

Cryptography and Security

Security Penetration Test Framework for the Diameter Protocol

Research on Diameter Protocols

An Overview of Penetration Testing

Hardening of network segmentation using automated referential penetration testing

Implementing a Secure AAA System in IPv6 Network

PTFW: a protocol testing framework for wireless sensor networks

Development and Analysis of P2SCP: A Paradigm for Penetration Testing of Systems that Cannot be Subjected to the Risk of Penetration Testing

A Formal Approach for Passive Testing of Protocol Data Portions

Security Analysis of Session Initiation Protocol Digest Access Authentication Scheme.

RDAP: Rapid Deployment Authentication Protocol Between Mobile Devices and Femtocells

DIP: Disruption-Tolerance for IP

A Novel Framework to Carry out Cloud Penetration Test

Physical Layer Security in D2D Underlay Cellular Networks with Poisson Cluster Process.

A decoy chain deployment method based on SDN and NFV against penetration attack

Penetration Tests for Bluetooth Low Energy and Zigbee using the Software-Defined Radio

Sec-D2D: A Secure and Lightweight D2D Communication System with Multiple Sensors

Strengthening SDN Security: Protocol Dialecting and Downgrade Attacks

The Security of Distance Testing System

Side-Channel Analysis for the Authentication Protocols of CDMA Cellular Networks

Advanced Penetration Testing for Enhancing 5G Security