Abstract:Over the years, several security vulnerabilities in the 3GPP cellular systems have been demonstrated in the literature. Most studies focus on higher layers of the cellular radio stack, such as the RRC and NAS, which are cryptographically protected. However, lower layers of the stack, such as PHY and MAC, are not as thoroughly studied, even though they are neither encrypted nor integrity protected. Furthermore, the latest releases of 5G significantly increased the number of low-layer control messages and procedures. The complexity of the cellular standards and the high degree of cross-layer operations, makes reasoning about security non-trivial, and requires a systematic analysis. We study the control procedures carried by each physical channel, and find that current cellular systems are susceptible to several new passive attacks due to information leakage, and active attacks by injecting MAC and PHY messages. For instance, we find that beamforming information leakage enables fingerprinting-based localization and tracking of users. We identify active attacks that reduce the users' throughput by disabling RF front ends at the UE, disrupt user communications by tricking other connected UEs into acting as jammers, or stealthily disconnect an active user. We evaluate our attacks against COTS UEs in various scenarios and demonstrate their practicality by measuring current operators' configurations across three countries. Our results show that an attacker can, among other things, localize users with an accuracy of 20 meters 96% of the time, track users' moving paths with a probability of 90%, reduce throughput by more than 95% within 2 seconds (by spoofing a 39 bits DCI), and disconnect users.

Control-plane Protocol Interactions in Cellular Networks

Detecting Problematic Control-Plane Protocol Interactions in Mobile Networks

Vulnerabilities and Attacks of Inter-device Coordination in Programmable Networks.

Safe Reconfiguring Data Plane Via Supervision over Resource and Flow States

6G Data Plane: A Novel Architecture Enabling Data Collaboration with Arbitrary Topology.

Characterizing and Modeling Control-Plane Traffic for Mobile Core Network

Joint User Pairing, Resource Block Allocation, And Power Control For Full-Duplex Cellular Networks

Unprotected 4G/5G Control Procedures at Low Layers Considered Dangerous

A Control-Plane Perspective on Reducing Data Access Latency in LTE Networks.

Enabling Communication and Control Co-Design in 6G Networks

Downlink Resource Allocation and Power Control for Device-to-Device Communication Underlaying Cellular Networks.

Control Plane Optimization in Software-Defined Vehicular Ad Hoc Networks

System design and software-defined implementation for hyper-cellular network

Stable Throughput Region and Admission Control for Device-To-Device Cellular Coexisting Networks

Communication-protocol-based analysis and synthesis of networked systems: progress, prospects and challenges

CAP on Mobility Control for 4G LTE Networks

Traffic Engineering in Hierarchical Sdn Control Plane

Integrated Control Plane for Ip Enabled Optical Networks

Game Theory Based Interference Control and Power Control for D2D Communication in Cellualar Networks

SoftCell: Taking Control of Cellular Core Networks

Evaluation of Inter-Cell Interference Coordination with CAP Model