Side Channel Analysis in 4G and 5G Cellular Networks

Syed Rafiul Hussain

Cellular Network Key Enabler for Critical Insfrastructure

Security and Privacy Threats in Cellular Networks

Why Cellular Networks Are Not Sufficiently Secure?

2G3G

4G5G

Why Side-Channel Analysis is Hard?

Paging Procedure

⋮

Core NetworkBase Station

Paging Occasion

IMSI = 310 260 628687893 = 100011010XXX … XXX 00010101

IMSI = 310 260 628687883 = 100011010XXX … XXX 00001011

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 122 123 124 125 126 12716 17 18 19 20 22212111

IMSI = 310 260 628687765 = 100011010XXX … XXX 00010101

ToRPEDOTRacking via Paging mEssage DistributiOn

Filtering - ToRPEDO Attack (1/3)

Counting - ToRPEDO Attack (2/3)

Likelihood – ToRPEDO Attack (3/3)

12

𝑇1 𝑇2 𝑇3 𝑇4 𝑇5

𝐿𝑖𝐿𝑗

> 10𝒯

𝐿𝑖

𝐿−1

PIERCER (Persistent Information ExposuRe by the CorE netwoRk)

13

310 260 628687893 = 100011010XXX … XXXXXXX00010101

IMSI-Cracking Attack in 4G

14

7 bitsMCC

USAMNC

T-Mobile

MSIN 18 bits

49 bits

IMSIguess1 IMSIvictim

(TMSIvictim

IMSIguess2 IMSIvictim

TMSIvictim

≠

TMSIvictim

IMSIguess

(IMSIvictim

⋮

TMSIvictim

IMSIguess

E𝑃𝐾(IMSIguess)

310 260 628687893 = 100011010XXX … XXXXXXX00010101

IMSI-Cracking Attack in 5G

15

7 bitsMCC

USAMNC

T-Mobile

MSIN 18 bits

49 bits

IMSIguess IMSIvictimIMSIguess2 IMSIvictim

Evaluation

Countermeasure Against ToRPEDO

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 122 12312

4

12

5

12

6

12

716 17 18 19 20 2221

Exposing the Device’s TMSI and Paging Occasion

Paging Request

Paging Request

Paging Request

Our Proposed Noise-based Countermeasure

Attack Impact

Conclusion

Side Channel Analysis in 4G and 5G Cellular Networks

Syed Rafiul Hussain

hussain1@purdue.edu