CellScope - Automatically Specifying and Verifying Cellular Network Protocols.

Yinbo Yu,You Li,Kaiyu Hou,Yan Chen,Hai Zhou,Jianfeng Yang

DOI: https://doi.org/10.1145/3342280.3342294

2019-01-01

Abstract: An abstract is not available.

What problem does this paper attempt to address?

CellularLint: A Systematic Approach to Identify Inconsistent Behavior in Cellular Network Specifications

Mirza Masfiqur Rahman,Imtiaz Karim,Elisa Bertino

2024-07-19

Abstract:In recent years, there has been a growing focus on scrutinizing the security of cellular networks, often attributing security vulnerabilities to issues in the underlying protocol design descriptions. These protocol design specifications, typically extensive documents that are thousands of pages long, can harbor inaccuracies, underspecifications, implicit assumptions, and internal inconsistencies. In light of the evolving landscape, we introduce CellularLint--a semi-automatic framework for inconsistency detection within the standards of 4G and 5G, capitalizing on a suite of natural language processing techniques. Our proposed method uses a revamped few-shot learning mechanism on domain-adapted large language models. Pre-trained on a vast corpus of cellular network protocols, this method enables CellularLint to simultaneously detect inconsistencies at various levels of semantics and practical use cases. In doing so, CellularLint significantly advances the automated analysis of protocol specifications in a scalable fashion. In our investigation, we focused on the Non-Access Stratum (NAS) and the security specifications of 4G and 5G networks, ultimately uncovering 157 inconsistencies with 82.67% accuracy. After verification of these inconsistencies on open-source implementations and 17 commercial devices, we confirm that they indeed have a substantial impact on design decisions, potentially leading to concerns related to privacy, integrity, availability, and interoperability.

Cryptography and Security,Artificial Intelligence,Information Retrieval
System design and software-defined implementation for hyper-cellular network

Sheng CHEN,Yongkang LI,Guangchao WANG,Liumeng WANG,Zhiyuan JIANG,Sheng ZHOU,Zhisheng NIU

DOI: https://doi.org/10.1360/N112017-00040

2017-01-01

Abstract:The rapid growth of traffic data in mobile networks has led to a shortage in spectrum resources and a significant increase in energy consumption.In order to solve these problems,hyper-cellular networks provide dynamic sleep and resource scheduling schemes for base stations through careful separation of control coverage and traffic coverage,thus greatly improving network spectral and energy efficiency.However,how to separate network control coverage and traffic coverage without destroying existing terminal protocol stacks is a problem that still needs to be solved.We analyze the signaling flow and protocol architecture of GSM and LTE systems,and then propose a separation scheme for these systems in a hyper-cellular architecture.The basic idea is to accomplish the separation of base station functionality by dividing the logical channel,thus achieving separation of control coverage and traffic coverage.With the aid of software radio equipment,we build an experimental platform to verify the proposed solutions.Combined with other technologies such as cloud radio access networks and Software Defined Networks,we propose a software-defined hyper cellular architecture and create a cloud-based demonstration platform.
Detecting Problematic Control-Plane Protocol Interactions in Mobile Networks

Guan-Hua Tu,Yuanjie Li,Chunyi Peng,Chi-Yu Li,Songwu Lu

DOI: https://doi.org/10.1109/tnet.2015.2404336

2016-01-01

IEEE/ACM Transactions on Networking

Abstract:The control-plane protocols in 3G/4G mobile networks communicate with each other, and provide a rich set of control functions, such as radio resource control, mobility support, connectivity management, to name a few. Despite their significance, the problem of verifying protocol correctness remains largely unaddressed. In this paper, we examine control-plane protocol interactions in mobile networks. We propose CNetVerifier, a two-phase signaling diagnosis tool to detect problematic interactions in both design and practice. CNetVerifier first performs protocol screening based on 3GPP standards via domain-specific model checking, and then conducts phone-based empirical validation in operational 3G/4G networks. With CNetVerifier, we have uncovered seven types of troublesome interactions, along three dimensions of cross (protocol) layers, cross (circuit-switched and packet-switched) domains, and cross (3G and 4G) systems. Some are caused by necessary yet problematic cooperation (i.e., protocol interactions are needed but they misbehave), whereas others are due to independent yet unnecessary coupled operations (i.e., protocols interactions are not required but actually coupled). These instances span both design defects in 3GPP standards and operational slips by carriers and vendors. They all result in performance penalties or functional incorrectness. We deduce root causes, present empirical results, propose solutions, and summarize learned lessons.
A New Cellular Architecture for Information Retrieval from Sensor Networks through Embedded Service and Security Protocols

Aamir Shahzad,René Landry,Malrey Lee,Naixue Xiong,Jongho Lee,Changhoon Lee

DOI: https://doi.org/10.3390/s16060821

2016-06-14

Abstract:Substantial changes have occurred in the Information Technology (IT) sectors and with these changes, the demand for remote access to field sensor information has increased. This allows visualization, monitoring, and control through various electronic devices, such as laptops, tablets, i-Pads, PCs, and cellular phones. The smart phone is considered as a more reliable, faster and efficient device to access and monitor industrial systems and their corresponding information interfaces anywhere and anytime. This study describes the deployment of a protocol whereby industrial system information can be securely accessed by cellular phones via a Supervisory Control And Data Acquisition (SCADA) server. To achieve the study goals, proprietary protocol interconnectivity with non-proprietary protocols and the usage of interconnectivity services are considered in detail. They support the visualization of the SCADA system information, and the related operations through smart phones. The intelligent sensors are configured and designated to process real information via cellular phones by employing information exchange services between the proprietary protocol and non-proprietary protocols. SCADA cellular access raises the issue of security flaws. For these challenges, a cryptography-based security method is considered and deployed, and it could be considered as a part of a proprietary protocol. Subsequently, transmission flows from the smart phones through a cellular network.
Discovering emergency call pitfalls for cellular networks with formal methods

Kaiyu Hou,You Li,Yinbo Yu,Yan Chen,Hai Zhou

DOI: https://doi.org/10.1145/3458864.3466625

2021-01-01

Abstract:ABSTRACTAvailability and security problems in cellular emergency call systems can cost people their lives, yet this topic has not been thoroughly researched. Based on our proposed Seed-Assisted Specification method, we start to investigate this topic by looking closely into one emergency call failure case in China. Using what we learned from the case as prior knowledge, we build a formal model of emergency call systems with proper granularity. By running model checking, four public-unaware scenarios where emergency calls cannot be correctly routed are discovered. Additionally, we extract configurations of two major U.S. carriers and incorporate them as model constraints into the model. Based on the augmented model, we find two new attacks leveraging the privileges of emergency calls. Finally, we present a solution with marginal overhead to resolve issues we can foresee.
A Study on Cell Search Algorithms for IEEE 802.16e OFDMA Systems.

Peng Cheng,Zhaoyang Zhang,Xiangwei Zhou,Jing Li,Peiliang Qiu

DOI: https://doi.org/10.1109/wcnc.2007.347

2007-01-01

Abstract:In this paper, the problem of cell search for IEEE 802.16e OFDMA systems is addressed, which includes two steps: frame detection and cell ID identification. We propose two novel frame detection algorithms: one is based on the pseudo-periodicity property of the preamble signal in time-domain (TD algorithm), and the other one is based on the Euclidean distance in frequency-domain (FD algorithm). In comparison with the FD algorithm, the TD algorithm is more robust to fading and interference, at the cost of a higher implementation complexity. Therefore, we should choose the suitable one based on different system reliability and complexity requirements. As for the cell ID identification procedure, an adaptive correlation length algorithm (ACL algorithm) is proposed, in which the necessary correlation length can be chosen without prior channel knowledge, and thereby greatly reduces the cell search time. The system simulation results show that the proposed frame detection and cell ID identification algorithms are robust and efficient for OFDMA cellular systems, especially for IEEE 802.16e OFDMA systems.
Integrated Coverage Control and Security Connectivity in Mobile Sensor Networks

Jia Jie,Zhang Zhaoyang,Chen Jian,Zhao Linliang,Wang Xingwei

DOI: https://doi.org/10.1109/PCSPA.2010.83

2010-01-01

Abstract:Security plays an important role in the ability to deploy and retrieve trustworthy data for a wireless sensor network. Secure coverage is an effective defense against attacks which take advantage of a lack of deployment information. In this work, on the basis of improved genetic algorithm, a novel algorithm is proposed to guarantee the effect of secure surveillance. Comparison and simulation results show that the proposed solution outperforms the virtual force algorithm in terms of coverage rate and secure connectivity.
NG-Scope: Fine-Grained Telemetry for NextG Cellular Networks

Yaxiong Xie,Kyle Jamieson

DOI: https://doi.org/10.1145/3547353.3522652

2022-06-20

ACM SIGMETRICS Performance Evaluation Review

Abstract:Accurate and highly-granular channel capacity telemetry of the cellular last hop is crucial for the effective operation of transport layer protocols and cutting edge applications, such as video on demand and videotelephony. This paper presents the design, implementation, and experimental performance evaluation of NG-Scope, the first such telemetry tool able to fuse physical-layer channel occupancy readings from the cellular control channel with higher-layer packet arrival statistics and make accurate capacity estimates. NG-Scope handles the latest cellular innovations, such as when multiple base stations aggregate their signals together to serve mobile users. End-to-end experiments in a commercial cellular network demonstrate that wireless capacity varies significantly with channel quality, mobility, competing traffic within each cell, and the number of aggregated cells. Our experiments demonstrate significantly improved cell load estimation accuracy, missing the detection of less than 1% of data capacity overall, a reduction of 82% compared to OWL [2], the state-of-the-art in cellular monitoring. Further experiments show that MobileInsight-based [4] CLAW [6] has a root-mean-squared capacity error of 30.5 Mbit/s, which is 3.3× larger than NG-Scope (9.2 Mbit/s).
MobileInsight

Yuanjie Li,Chunyi Peng,Zengwen Yuan,Haotian Deng,Jiayao Li,Tao Wang

DOI: https://doi.org/10.1145/3103535.3103548

2017-01-01

GetMobile Mobile Computing and Communications

Abstract:MobileInsight is a software tool that collects, analyzes and exploits runtime, fine-grained cellular network information over commodity phones. It is our first step to help developers and researchers understand the closed, large-scale cellular network system. It exposes the below-IP protocol messages to the user space, provides protocol analysis, and offers APIs for mobile applications to obtain low-level network information. We have built showcases to illustrate how MobileInsight can be applied to cellular network research.
The System Design of the GSM Safety Communication Manage Center

Yang Liu

2009-01-01

Abstract:With the fast development of mobile communication industry, the security and secrecy of information has become vital.Nowadays, the security of communication is of great importance to confirm the safety of business information.On the situation that the mobile phone has been diffusely applied, the hidden safety troubles of mobile phone should not be ignored(such as wire tapping, imitated handset station, blue teeth connection, and cell phone virus ).Cell phone security issue has become urgent to solve the current important issues.The GSM Management Centre programme to solve the major symmetric key cryptosystem based on the virtual private network applications, the management center can manage one or more virtual private networks, and virtual private network within the terminal for the realization of a key, storage, distribution, replacement and destruction, and other functions, and to provide security management for mobile phone services.
Inference and analysis of cell-cell communication using CellChat

Suoqin Jin,Christian F. Guerrero-Juarez,Lihua Zhang,Ivan Chang,Raul Ramos,Chen-Hsiang Kuan,Peggy Myung,Maksim V. Plikus,Qing Nie

DOI: https://doi.org/10.1038/s41467-021-21246-9

IF: 16.6

2021-02-17

Nature Communications

Abstract:Abstract Understanding global communications among cells requires accurate representation of cell-cell signaling links and effective systems-level analyses of those links. We construct a database of interactions among ligands, receptors and their cofactors that accurately represent known heteromeric molecular complexes. We then develop CellChat, a tool that is able to quantitatively infer and analyze intercellular communication networks from single-cell RNA-sequencing (scRNA-seq) data. CellChat predicts major signaling inputs and outputs for cells and how those cells and signals coordinate for functions using network analysis and pattern recognition approaches. Through manifold learning and quantitative contrasts, CellChat classifies signaling pathways and delineates conserved and context-specific pathways across different datasets. Applying CellChat to mouse and human skin datasets shows its ability to extract complex signaling patterns. Our versatile and easy-to-use toolkit CellChat and a web-based Explorer ( http://www.cellchat.org/ ) will help discover novel intercellular communications and build cell-cell communication atlases in diverse tissues.

multidisciplinary sciences
CellOS: Zero-touch Softwarized Open Cellular Networks

Leonardo Bonati,Salvatore D'Oro,Lorenzo Bertizzolo,Emrecan Demirors,Zhangyu Guan,Stefano Basagni,Tommaso Melodia

DOI: https://doi.org/10.1016/j.comnet.2020.107380

2021-02-11

Abstract:Current cellular networks rely on closed and inflexible infrastructure tightly controlled by a handful of vendors. Their configuration requires vendor support and lengthy manual operations, which prevent Telco Operators (TOs) from unlocking the full network potential and from performing fine grained performance optimization, especially on a per-user basis. To address these key issues, this paper introduces CellOS, a fully automated optimization and management framework for cellular networks that requires negligible intervention ("zero-touch"). CellOS leverages softwarization and automatic optimization principles to bridge Software-Defined Networking (SDN) and cross-layer optimization. Unlike state-of-the-art SDN-inspired solutions for cellular networking, CellOS: (i) Hides low-level network details through a general virtual network abstraction; (ii) allows TOs to define high-level control objectives to dictate the desired network behavior without requiring knowledge of optimization techniques, and (iii) automatically generates and executes distributed control programs for simultaneous optimization of heterogeneous control objectives on multiple network slices. CellOS has been implemented and evaluated on an indoor testbed with two different LTE-compliant implementations: OpenAirInterface and srsLTE. We further demonstrated CellOS capabilities on the long-range outdoor POWDER-RENEW PAWR 5G platform. Results from scenarios with multiple base stations and users show that CellOS is platform-independent and self-adapts to diverse network deployments. Our investigation shows that CellOS outperforms existing solutions on key metrics, including throughput (up to 86% improvement), energy efficiency (up to 84%) and fairness (up to 29%).

Networking and Internet Architecture
Design of Application Software over a New Network System

WANG Ping,CHEN Xiang-ning,LI Shuang-qun

DOI: https://doi.org/10.3969/j.issn.1000-2367.2006.01.010

2006-01-01

Abstract:This paper presents design and development of the application software over a brand-new system: Advanced Cell Transfer Network.The key issues and development process are analyzed and a net-phone application is developed to confirm the feasibility and correctness of the proposed network design.
Working mechanism and code analysis of NS2 simulation for mobile Ad hoc networks

Shuo SHI,Xue-mai GU,Wen-bin ZHANG,Xue-jun SHA

DOI: https://doi.org/10.16208/j.issn1000-7024.2008.18.005

2008-01-01

Abstract:The working mechanism,main codes of simulation components libraries and the joint use of OTCL and C++ languages under split-object model of NS simulation for mobile ad hoc networks is analyzed,based on this,the interface of the multi-layers of the com-ponents library can be established.The key techniques of network layer,link layer and the physical one are emphasized,meanwhile,the implement of AODV codes and the MAC timer one is provided.The network simulation and protocol codes extension become easily by the help of such work.
Hyper-cellular communication system and hyper-cellular communication method

Wu Jian,Yang Peng,Bao Yanan,Niu Zhisheng,Zhou Sheng,Liu Chunguang,Mizutani Mika

2014-01-01

Abstract:The invention provides a hyper-cellular communication system and a hyper-cellular communication method for associating a user to a macro-cell site or a micro-cell site. The hyper-cellular communication system comprises a gateway and a resource optimization function unit, wherein the gateway is provided with a service quality classification enquiry form of the user, and the service quality classification enquiry form includes two parameters: user mobility and signaling overhead; the resource optimization function unit refers to the service quality classification enquiry form to carry out a base station related decision and a decision of wireless resource distribution.
SoftCell: Scalable and Flexible Cellular Core Network Architecture

Sathvik Reddy Thogaru,Harshitha Parupalli,Avanthika Makkena

DOI: https://doi.org/10.32628/cseit2390637

2023-12-02

Abstract:SoftCell is introduced as a scalable architecture for addressing challenges in cell core networks, characterised by means of inflexible and highly-priced gadget, at the side of complex control-plane protocols. This answer leverages commodity switches and servers to permit high-quality-grained policies for cellular gadgets. SoftCell allows the implementation of high-stage carrier regulations, directing site visitors through sequences of middleboxes based totally on subscriber attributes and packages. To optimize forwarding tables, the architecture aggregates traffic across numerous dimensions, along with carrier coverage, base station, and cell tool. Fine-grained packet classification is carried out at get admission to switches to deal with state and bandwidth necessities effectively. SoftCell guarantees that packets from the identical connection traverse the equal middlebox collection in each guideline, regardless of mobility. The effectiveness of SoftCell is established via evaluation of real LTE workloads, micro-benchmarks on the prototype controller, and massive-scale simulations, showcasing progressed scalability and versatility in cellular middle networks.

English Else
Intelligent Network/cell Selection Scheme for Beyond 3G Communication System

XU Xiang-hua,GUO Qiang,ZHU Jie,ZHANG Hai-bin

DOI: https://doi.org/10.3321/j.issn:1001-0920.2006.08.024

2006-01-01

Abstract:In order to improve the accuracy of the network/cell selection of the handoff in beyond 3G communication system,an intelligent selection scheme is proposed.This scheme takes the characteristics of wireless heterogeneous,different access technologies and multiple traffics of the beyond 3G system into consideration.Then,a fuzzy multiple objective decision algorithm is used to select the optimum cell for the mobile host to hand over.Instance analysis and simulation results show that under different radio network environments and traffic types,this scheme can make the most reasonable decision.In contrast with other candidates,the selected cell can provide the best quality of service(QoS).
Uncovering Cellular Network Characteristics : Performance , Infrastructure , and Policies

Junxian Huang,Feng Qian,Qiang Xu,Zhiyun Qian,Z. Morley Mao,A. Rayes

2013-01-01

Abstract:Mobile Smart Devices (Smartphones and tablets) have become increasingly popular especially in IT based service management companies. According to IDC, more than 70% of executives and sale managers are replacing their PCs with tablets. This is in part due to the agility flexibility and the availability of diverse network-based and support applications. Thus network characteristics directly affect user-perceived performance and a deep understanding of the properties of contemporary cellular networks for commonly used platforms is important for smartphone application and platform optimization. In this work, we carry out the largest study to date of cellular networks in terms of users, time duration, location, and networks to understand the performance, infrastructure, and policy characteristics. With the data set collected from around 100K users across the world over 18 months, MobiPerf, a smartphone network measurement tool we developed and publicly deployed, enables us to analyze network performance along several new dimensions, previously not examined. Our results indicate that with better infrastructure support, large cities appear to have better performance than rural areas. Our case study on packet size’s effect on RTT uncovers a surprising pattern for AT&T’s uplink RTT. We also show that Internet-based CDN service provides very limited latency improvement in today’s cellular networks. We further examine how local DNS servers are assigned to mobile users. In addition, we scrutinize the carriers’ policy towards different types of traffic and successfully identify some middlebox behavior of today’s cellular carriers.
Semantic-Enhanced Static Vulnerability Detection in Baseband Firmware

Yiming Liu,Cen Zhang,Feng Li,Yeting Li,Jianhua Zhou,Jian Wang,Lanlan Zhan,Yang Liu,Wei Huo

DOI: https://doi.org/10.1145/3597503.3639158

2024-01-01

Abstract:Cellular network is the infrastructure of mobile communication. Baseband firmware, which carries the implementation of cellular network, has critical security impact on its vulnerabilities. To handle the inherent complexity in cellular communication, cellular protocols are usually implemented as message-centric systems, containing the common message processing phase and message specific handling phase. Though the latter takes most of the code (99.67%) and exposed vulnerabilities (74%), it is rather under-studied: existing detectors either cannot sufficiently analyze it or focused on analyzing the former phase. To fill this gap, we proposed a novel semantic-enhanced static vulnerability detector named BVFinder focusing on message specific phase vulnerability detection. Generally, it identifies a vulnerability by locating whether a predefined sensitive memory operation is tainted by any attacker-controllable input. Specifically, to reach high automation and preciseness, it made two key improvements: a semantic-based taint source identification and an enhanced taint propagation. The former employs semantic search techniques to identify registers and memory offsets that carry attacker-controllable inputs. This is achieved by matching the inputs to their corresponding message and data types using textual features and addressing patterns within the assemblies. On the other hand, the latter technology guarantees effective taint propagation by employing additional indirect call resolution algorithms. The evaluation shows that BVFinder outperforms the state-of-the-art detectors by detecting three to four times of amount of vulnerabilities in the dataset. Till now, BVFinder has found four zero-day vulnerabilities, with four CVEs and 12,410 USD bounty assigned. These vulnerabilities can potentially cause remote code execution to phones using Samsung shannon baseband, affecting hundreds of millions of end devices.
SoftCell: Taking Control of Cellular Core Networks

Xin Jin,Li Erran Li,Laurent Vanbever,Jennifer Rexford

DOI: https://doi.org/10.48550/arxiv.1305.3568

2013-01-01

Abstract:Existing cellular networks suffer from inflexible and expensive equipment, and complex control-plane protocols. To address these challenges, we present SoftCell, a scalable architecture for supporting fine-grained policies for mobile devices in cellular core networks. The SoftCell controller realizes high-level service polices by directing traffic over paths that traverse a sequence of middleboxes, optimized to the network conditions and user locations. To ensure scalability, the core switches forward traffic on hierarchical addresses (grouped by base station) and policy tags (identifying paths through middleboxes). This minimizes data-plane state in the core switches, and pushes all fine-grained state to software switches at the base stations. These access switches apply fine-grained rules, specified by the controller, to map all traffic to the appropriate addresses and tags. SoftCell guarantees that packets in the same connection traverse the same sequence of middleboxes in both directions, even in the presence of mobility. Our characterization of real LTE workloads, micro-benchmarks on our prototype controller, and large-scale simulations demonstrate that SoftCell improves the flexibility of cellular core networks, while enabling the use of inexpensive commodity switches and middleboxes.

CellScope - Automatically Specifying and Verifying Cellular Network Protocols.

CellularLint: A Systematic Approach to Identify Inconsistent Behavior in Cellular Network Specifications

System design and software-defined implementation for hyper-cellular network

Detecting Problematic Control-Plane Protocol Interactions in Mobile Networks

A New Cellular Architecture for Information Retrieval from Sensor Networks through Embedded Service and Security Protocols

Discovering emergency call pitfalls for cellular networks with formal methods

A Study on Cell Search Algorithms for IEEE 802.16e OFDMA Systems.

Integrated Coverage Control and Security Connectivity in Mobile Sensor Networks

NG-Scope: Fine-Grained Telemetry for NextG Cellular Networks

MobileInsight

The System Design of the GSM Safety Communication Manage Center

Inference and analysis of cell-cell communication using CellChat

CellOS: Zero-touch Softwarized Open Cellular Networks

Design of Application Software over a New Network System

Working mechanism and code analysis of NS2 simulation for mobile Ad hoc networks

Hyper-cellular communication system and hyper-cellular communication method

SoftCell: Scalable and Flexible Cellular Core Network Architecture

Intelligent Network/cell Selection Scheme for Beyond 3G Communication System

Uncovering Cellular Network Characteristics : Performance , Infrastructure , and Policies

Semantic-Enhanced Static Vulnerability Detection in Baseband Firmware

SoftCell: Taking Control of Cellular Core Networks