Insecure Connection Bootstrapping in Cellular Networks: The Root of All Evil Syed Rafiul Hussain*, Mitziu Echeverria†, Ankush Singla*, Omar Chowdhury†, Elisa Bertino* Purdue University, University of Iowa

Initial Connection Setup with a Base Station in 4G and 5G Networks Time & Frame Synchronization System Info. Block Master info. Block Frame Synch.

Fake Base Station in 4G and 5G Networks How can we prevent cellular devices from connecting to Fake Base Stations? IMSI Response Authentication Reject Registration Reject IMSI Request IMSI: International Mobile Subscriber Identity

Potential Defense Techniques Against Fake Base Station Attack Specific Defense Prevent Spoofing of Individual Messages Generic Defense Prevent Spoofing of Broadcast Messages IMSI Request Registration Reject Authentication Reject IMSI Request Registration Reject Authentication Reject

Preventing Broadcast Spoofing Symmetric Key Based Broadcast Authentication TESLA-based Broadcast Authentication msg 2, MAC2, Key 1 Secure Channel msg 3, MAC3, Key 2 Secure channel establishment Delayed key disclosure

1. Certificate chain length 2. Certificate Revocation PKI-based Mechanism MME UE Base Station Core Network 1. Certificate chain length 2. Certificate Revocation 3. Signature Generation Overhead 4. MitM Relay Self-signed MME-signed CN-signed MIB, 𝐒𝐈 𝐆 𝐁𝐒 , 𝐜𝐞𝐫 𝐭 𝐌𝐌𝐄 , 𝐜𝐞𝐫 𝐭 𝐂𝐍 SIB1, 𝐒𝐈 𝐆 𝐁𝐒 , 𝐜𝐞𝐫 𝐭 𝐌𝐌𝐄 , 𝐜𝐞𝐫 𝐭 𝐂𝐍 6

Optimized PKI Scheme (1/3) A Lightweight Design of Certificate for Cellular Network Propose a specialized certificate format Base Station’s Public Key Cell ID location expiration time signature of MME

Protocol-Level Optimizations Which messages require authentication? Which SIBs require authentication? Frame Synch. Sys. Info. Block Type 1 Master info. Block Sys. Info. Block Type 2 System Info. Block Minimize certificate chain’s transmission SIB 1, SIGN_SIB1 CERT CHAIN SIB2, SIGN_SIB2 Aggregating Authentication

Cryptographic Scheme-level Optimization Reduce the size of the signatures Aggregate SIGN SIB1, SIGN_BS, SIGN_MME, SIGN_CN Compute the expensive crypto operations at offline

Countermeasure for Relay Attacks Distance Bounding Protocol Allow a bootstrapping message to be valid for a short time SIB1, Aggregate SIGN, Timestamp, ∆t, location t rcvd − t gen < ∆ t

Evaluation Results End-to-end delay induced by different digital signature schemes against baseline

Conclusion Prevents devices to connect to malicious base stations. Moderate Overhead (Max: 220 bytes, 28 ms). Backward compatibility.

Thank You

Syed Rafiul Hussain Purdue University hussain1@purdue.edu Insecure Connection Bootstrapping in Cellular Networks: The Root of All Evil Syed Rafiul Hussain Purdue University hussain1@purdue.edu