Abstract:The security context, generally stored in the universal subscriber identity module card or the baseband chip, is the critical information applied by the subscriber to access the 5G network during the fast authentication procedure. Once exposed or illegally used, the security context can be exploited to derive various keys for authentication and encryption. Despite its importance, challenges and questions still remain in the previous relevant research. To fill this gap, by adopting the security protocol verification tool ProVerif, we provide a comprehensive formal model of the fast authentication procedure based on the security context to analyze whether security goals can be met. Unfortunately, we uncover two vulnerabilities, including one never reported before. Our analysis shows that these vulnerabilities stem from fundamental design flaws in the cellular network protocol and thus apply to the 4G network. These vulnerabilities could be exploited to launch several attacks, including impersonation and eavesdropping. We have validated these attacks using 5 mobile phones from 5 different baseband manufacturers through experimentation in three mobile carriers. We find an insecure implementation of one of these phones, which exposed it to replay attacks. And we further discuss the security threats posed by the impersonation attack, such as location spoofing and one-tap authentication bypass, which is verified on 10 popular apps. We finally propose several countermeasures to eliminate these security issues. Actually, we have reported the novel vulnerability to the GSM Association and received a confirmation in the form of a coordinated vulnerability disclosure (CVD) number CVD-2022-0057.

A Secure Registration Scheme for Femtocell Embedded Networks

Utility-Aware Refunding Framework for Hybrid Access Femtocell Network.

Macro-femto heterogeneous network deployment and management: from business models to technical solutions

Eliminating Rouge Femtocells Based on Distance Bounding Protocol and Geographic Information

Cooperative interference mitigation for indoor dense femtocell networks

Radio Resource Allocation in Buildings with Dense Femtocell Deployment.

Towards Safer Connections: Secure Authentication in 5G Networks Leveraging Radio Frequency Fingerprinting

Access Control for Hybrid Femtocell Network Based on AGV Mechanism

RDAP: Rapid Deployment Authentication Protocol Between Mobile Devices and Femtocells

An Efficient End-to-end Mutual Authentication Scheme for 2G-GSM System

Joint Access Control and Subchannel Allocation Scheme for Femtocell-Based M2M Network Using a Truthful Mechanism.

EEE-GSM: End-to-End Encryption Scheme over GSM System

Joint Subchannel and Power Allocation in Secure Transmission Design for Femtocell Networks.

User-to-User Mutual Authentication and Key Agreement Scheme for LTE Cellular System

Femtocell Networks: A Survey

End-To-End Encryption For Gsm Cellular Standard Using Cl-Pkc

A formal security analysis of the fast authentication procedure based on the security context in 5G networks

Intelligent Interference Management Based on On-Demand Service Connectivity for Femtocellular Networks

Dynamic Resource Coordination and Interference Management for Femtocell Networks

Authentication and key agreement scheme for CDMA cellular system

On Cell Association and Scheduling Policies in Femtocell Networks