Abstract:Softwarization and virtualization in 5G and beyond necessitate thorough testing to ensure the security of critical infrastructure and networks, requiring the identification of vulnerabilities and unintended emergent behaviors from protocol designs to their software stack implementation. To provide an efficient and comprehensive solution, we propose a novel and first-of-its-kind approach that connects the strengths and coverage of formal and fuzzing methods to efficiently detect vulnerabilities across protocol logic and implementation stacks in a hierarchical manner. We design and implement formal verification to detect attack traces in critical protocols, which are used to guide subsequent fuzz testing and incorporate feedback from fuzz testing to broaden the scope of formal verification. This innovative approach significantly improves efficiency and enables the auto-discovery of vulnerabilities and unintended emergent behaviors from the 3GPP protocols to software stacks. Following this approach, we discover one identifier leakage model, one DoS attack model, and two eavesdrop attack models due to the absence of rudimentary MITM protection within the protocol, despite the existence of a Transport Layer Security (TLS) solution to this issue for over a decade. More remarkably, guided by the identified formal analysis and attack models, we exploit 61 vulnerabilities using fuzz testing demonstrated on srsRAN platforms. These identified vulnerabilities contribute to fortifying protocol-level assumptions and refining the search space. Compared to state-of-the-art fuzz testing, our united formal and fuzzing methodology enables auto-assurance by systematically discovering vulnerabilities. It significantly reduces computational complexity, transforming the non-practical exponential growth in computational cost into linear growth.

Apply Formal Methods in Certifying the SyberX High-Assurance Kernel

A Secure Scan Method for Crypto Chips

Ensuring secure and robust grid applications – from a formal method point of view

High-Assurance Separation Kernels: A Survey on Formal Methods

A formal description of SECIMOS operating system

Synthesizing verified components for cyber assured systems engineering

Refinement-based Specification and Security Analysis of Separation Kernels

Rely-guarantee Reasoning about Concurrent Memory Management: Correctness, Safety and Security

An experimental Study using ACSL and Frama-C to formulate and verify Low-Level Requirements from a DO-178C compliant Avionics Project

Verifying the Safety of Xen Security Modules

Formal Security Analysis of the AMD SEV-SNP Software Interface

Formal-Guided Fuzz Testing: Targeting Security Assurance from Specification to Implementation for 5G and Beyond

A Security Assurance Framework Combining Formal Verification and Security Functional Testing

Practical and Scalable Security Verification of Secure Architectures

A Formal Methodology for Verifying Side-Channel Vulnerabilities in Cache Architectures

SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel

An Research for Formal Verification of Safety-Critical Software

Formal and Fuzzing Amplification: Targeting Vulnerability Detection in 5G and Beyond

A Verification Methodology for the Arm® Confidential Computing Architecture: From a Secure Specification to Safe Implementations

Formal Verification of OS Security Model with Alloy and Event-B

A Survey of Practical Formal Methods for Security