Security and Protocol Exploit Analysis of the 5G Specifications

IEEE Access

Roger Piqueras Jover¹  Vuk Marojevic² 

[1] Bloomberg LP, New York, NY, USA;Department of Electrical and Computer Engineering, Mississippi State University, Starkville, MS, USA;

关键词: Security;    5G;    3GPP Release 15;    LTE;    protocol exploit;   

DOI  :  10.1109/ACCESS.2019.2899254

来源: DOAJ

【 摘 要 】

The third generation partnership project released its first 5G security specifications in March 2018. This paper reviews the proposed security architecture and its main requirements and procedures and evaluates them in the context of known and new protocol exploits. Although security has been improved from previous generations, our analysis identifies potentially unrealistic 5G system assumptions and protocol edge cases that can render 5G communication systems vulnerable to adversarial attacks. For example, null encryption and null authentication are still supported and can be used in valid system configurations. With no clear proposal to tackle pre-authentication message-based exploits, mobile devices continue to implicitly trust any serving network, which may or may not enforce a number of optional security features, or which may not be legitimate. Moreover, several critical security and key management functions are considered beyond the scope of the specifications. The comparison with known 4G long-term evolution protocol exploits reveals that the 5G security specifications, as of Release 15, Version 1.0.0, do not fully address the user privacy and network availability challenges.

【 授权许可】

Unknown