Abstract:Softwarization and virtualization in 5G and beyond necessitate thorough testing to ensure the security of critical infrastructure and networks, requiring the identification of vulnerabilities and unintended emergent behaviors from protocol designs to their software stack implementation. To provide an efficient and comprehensive solution, we propose a novel and first-of-its-kind approach that connects the strengths and coverage of formal and fuzzing methods to efficiently detect vulnerabilities across protocol logic and implementation stacks in a hierarchical manner. We design and implement formal verification to detect attack traces in critical protocols, which are used to guide subsequent fuzz testing and incorporate feedback from fuzz testing to broaden the scope of formal verification. This innovative approach significantly improves efficiency and enables the auto-discovery of vulnerabilities and unintended emergent behaviors from the 3GPP protocols to software stacks. Following this approach, we discover one identifier leakage model, one DoS attack model, and two eavesdrop attack models due to the absence of rudimentary MITM protection within the protocol, despite the existence of a Transport Layer Security (TLS) solution to this issue for over a decade. More remarkably, guided by the identified formal analysis and attack models, we exploit 61 vulnerabilities using fuzz testing demonstrated on srsRAN platforms. These identified vulnerabilities contribute to fortifying protocol-level assumptions and refining the search space. Compared to state-of-the-art fuzz testing, our united formal and fuzzing methodology enables auto-assurance by systematically discovering vulnerabilities. It significantly reduces computational complexity, transforming the non-practical exponential growth in computational cost into linear growth.

A Security Assurance Framework Combining Formal Verification and Security Functional Testing

Practical and Scalable Security Verification of Secure Architectures

From Wireless Sensor Networks to Wireless Body Area Networks: Formal Modeling and Verification on Security Using PAT.

FESR: A Framework for Eliciting Security Requirements Based on Integration of Common Criteria and Weakness Detection Formal Model

A Formal Model to Facilitate Security Testing in Modern Automotive Systems

Verification Framework for UML-Based Design of Embedded Systems.

Formal Specification of a Security Framework for Smart Contracts

A Model Based Framework for Testing Safety and Security in Operational Technology Environments

An Automated Framework for Analysis and Evaluation of Algebraic Fault Attacks on Lightweight Block Ciphers

Automatic Support of the Generation and Maintenance of Assurance Cases.

Formal-Guided Fuzz Testing: Targeting Security Assurance from Specification to Implementation for 5G and Beyond

A Fault Injection and Formal Verification Framework Based on UML Sequence Diagrams

DBMS Security Independence Test Framework Design and Implementation

A Formal Specification and Verification Framework for Timed Security Protocols.

Checking security compliance between models and code

Formal Specification and Analysis of Autonomous Systems under Partial Compliance

Model Based System Assurance Using the Structured Assurance Case Metamodel

Test Cases Generation Based on Formal Specification

A Security Domain Separation Z Model Based on DTE Policy

A Framework for Testing Semantic Web Services Using Model Checking

A Hybrid Approach to Detecting Security Defects in Programs