Side Channel Analysis in 4G and 5G Cellular Networks · 3G 4G 5G. Why Side-Channel Analysis is...
23
Side Channel Analysis in 4G and 5G Cellular Networks Syed Rafiul Hussain
Transcript of Side Channel Analysis in 4G and 5G Cellular Networks · 3G 4G 5G. Why Side-Channel Analysis is...
Side Channel Analysis in 4G and 5G Cellular Networks
Syed Rafiul Hussain
Cellular Network Key Enabler for Critical Insfrastructure
Security and Privacy Threats in Cellular Networks
Why Cellular Networks Are Not Sufficiently Secure?
2G3G
4G5G
Why Side-Channel Analysis is Hard?
Paging Procedure
⋮
Core NetworkBase Station
Paging Occasion
IMSI = 310 260 628687893 = 100011010XXX … XXX 00010101
IMSI = 310 260 628687883 = 100011010XXX … XXX 00001011
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 122 123 124 125 126 12716 17 18 19 20 22212111
IMSI = 310 260 628687765 = 100011010XXX … XXX 00010101
ToRPEDOTRacking via Paging mEssage DistributiOn
Filtering - ToRPEDO Attack (1/3)
Counting - ToRPEDO Attack (2/3)
Likelihood – ToRPEDO Attack (3/3)
12
𝑇1 𝑇2 𝑇3 𝑇4 𝑇5
𝐿𝑖𝐿𝑗
> 10𝒯
𝐿𝑖
𝐿−1
PIERCER (Persistent Information ExposuRe by the CorE netwoRk)
13
310 260 628687893 = 100011010XXX … XXXXXXX00010101
IMSI-Cracking Attack in 4G
14
7 bitsMCC
USAMNC
T-Mobile
MSIN 18 bits
49 bits
IMSIguess1 IMSIvictim
(TMSIvictim
IMSIguess2 IMSIvictim
TMSIvictim
≠
TMSIvictim
IMSIguess
(IMSIvictim
⋮
TMSIvictim
IMSIguess
E𝑃𝐾(IMSIguess)
310 260 628687893 = 100011010XXX … XXXXXXX00010101
IMSI-Cracking Attack in 5G
15
7 bitsMCC
USAMNC
T-Mobile
MSIN 18 bits
49 bits
IMSIguess IMSIvictimIMSIguess2 IMSIvictim
Evaluation
Countermeasure Against ToRPEDO
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 122 12312
4
12
5
12
6
12
716 17 18 19 20 2221
Exposing the Device’s TMSI and Paging Occasion
Paging Request
Paging Request
Paging Request
Our Proposed Noise-based Countermeasure
Attack Impact
Conclusion
