Cellular networks such as 4G and 5G have been exceedingly successful, but have encountered a parallel surge in security threats. Random access (RA) is an essential procedure performed between a user and a base station to facilitate attachment to the network and obtaining radio resources for downlink and uplink transmissions. Particularly, users get tightly synchronized to the base station based on the timing advance (TA) command that estimates propagation delay over the air during the RA procedure. In this paper, we investigate security issues related to the transmission and reception of TA information, and scheduled uplink transmission during the RA procedure in cellular networks. Furthermore, we present a random access failure attack that forces TA misalignment to users and thus results in service failure of legitimate users in the network. Finally, we verify our analysis through software-defined radio (SDR) based experiments.

A cellular network is a closed system, and each network operator has built a unique “walled garden” for their network by combining different operation policies, network configurations, and implementation optimizations. Unfortunately, some of these combinations can induce performance degradation due to misconfiguration or unnecessary procedures. To detect such degradation, a thorough understanding of even the minor details of the standards and operator-specific implementations is important. However, it is difficult to detect such problems, as the control plane is complicated by numerous procedures. This paper introduces a simple yet powerful method that diagnoses these problems by exploiting the operator-specific implementations of cellular networks. We develop a signaling collection and analysis tool that collects control plane messages from operators and finds problems through comparative analysis. The analysis process consists of three different control plane comparison procedures that can find such problems effectively. These individual procedures use a time threshold, control flow sequence, and signaling failure as the basis for comparison. To this end, we collect approximately 3.1 million control-plane messages from 13 major cellular operators worldwide. As a case study, we analyze the circuit-switched fallback technology that triggers generation crossover between third generation and long-term evolution technologies.

Recently, cellular operators have started migrating to IPv6 in response to the increasing demand for IP addresses. With the introduction of IPv6, cellular middleboxes, such as firewalls for preventing malicious traffic from the Internet and stateful NAT64 boxes for providing backward compatibility with legacy IPv4 services, have become crucial to maintain stability of cellular networks. This paper presents security problems of the currently deployed IPv6 middleboxes of five major operators. To this end, we first investigate several key features of the current IPv6 deployment that can harm the safety of a cellular network as well as its customers. These features combined with the currently deployed IPv6 middlebox allow an adversary to launch six different attacks. First, firewalls in IPv6 cellular networks fail to block incoming packets properly. Thus, an adversary could fingerprint cellular devices with scanning, and further, she could launch denial-of-service or over-billing attacks. Second, vulnerabilities in the stateful NAT64 box, a middlebox that maps an IPv6 address to an IPv4 address (and vice versa), allow an adversary to launch three different attacks: 1) NAT overflow attack that allows an adversary to overflow the NAT resources, 2) NAT wiping attack that removes active NAT mappings by exploiting the lack of TCP sequence number verification of firewalls, and 3) NAT bricking attack that targets services adopting IP-based blacklisting by preventing the shared external IPv4 address from accessing the service. We confirmed the feasibility of these attacks with an empirical analysis. We also propose effective countermeasures for each attack.

An effort to deploy security devices by the network provider has been increasing as the network is being exposed to various types of network attacks. However, network providers are incapable of handling all types of attacks as each security device is designed for a certain purpose. If an attack breaks out, only one particular device becomes busy in terms of resource usage while others being idle. Moreover, it is hard to adjust a level of security service with respect to the importance of network flow. To address these issues, we propose a new security solution, QoSE, which provides adaptive security services based on Network Function Virtualization (NFV). QoSE provides a capability to manage resource usage that the network flow is not concentrated on a specific node. We design QoSE considering a distributed NFV environment to avoid a single point of failure and a bottleneck problem. Our proposed solution has also shown a quick recovery from fault situation. In addition, we provide a novel resource optimization algorithm to operate security services efficiently. We have implemented a prototype system to verify our ideas and have checked that QoSE shows reasonable performance compared with a common device.