5G SNPN에서 RRCReject과 RRCRelease를 이용한 감금 공격에 대한 분석
Analysis of Incarceration Attacks with RRCReject and RRCRelease in 5G Standalone Non-Public Network
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
본 논문에서는 5G SNPN (Standalone Non-Public Networ)에서 RRCRejecet와 RRCRelease를 이용한UE (User Equipment) 감금 (Incarceration) 공격의 가능성을 3GPP 표준 문서를 기반으로 분석한다. 먼저 UE의 셀 선택과 재선택 절차를 분석하고, RRCReject와 RRCRelease의 전송 전/후의 허위 기지국과 UE의 처리 과정 분석한다. 분석 결과, 강한 신호를 송출하는 허위 기지국은 피해자 UE가허위 기지국 자신에게 RRC 연결 설정을 하도록 하는 것이 가능하다. 또한, 피해자 UE의 RRC 연결 설정 시도에 대한 응답으로 허위 기지국은 무결성 보호가 되지 않는 RRCReject 메시지를 전송하면, 피해자 UE가 RRC 연결 시도 과정에 계속 머무르게 할 수 있을 것으로 판단된다. 반면, RRCRelease를 이용하여 다른 허위 기지국으로 RRC 연결 설정 시도를 유도함으로써 피해자 UE를감금하는 것은 불가능한 것으로 판단된다.
Abstract
In this paper, the possibility of a UE (User Equipment) incarceration attack using RRCRejecet and RRCRelease in 5G SNPN (Standalone Non-Public Network) is analyzed based on the 3GPP standard document. First, the cell selection and reselection procedures of the UE are analyzed, and then the processing process of the false base station and the UE before and after transmission of RRCReject and RRCRelease is analyzed. As a result of the analysis, it is possible that the false base station that transmits a strong signal causes the victim UE to establish an RRC connection to the false base station itself. In addition, if the false base station transmits an RRCReject message without integrity protection in response to the victim UE's attempt to establish an RRC connection, it is determined that the victim UE can continue to stay in the RRC connection attempt process. On the other hand, it is determined that it is impossible to incarcerate the victim UE by inducing an attempt to establish an RRC connection to another false base station using RRCRelease.
참고문헌 (15)
- Mamta Agiwal, "Next Generation 5G Wireless Networks: A Comprehensive Survey", IEEE Communications Surveys & Tutorials, 18(3), pp.1617~1655 (2016), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Martin Wollschlaeger, "The Future of Industrial Communication: Automation Networks in the Era of the Internet of Things and Industry 4.0", IEEE Industrial Electronics Magazine, 11(1), pp.17~27 (2017), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Ijaz Ahmad, "Security for 5G and Beyond", IEEE Communications Surveys & Tutorials, 21(4), pp.3682~3722 (2019), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Rabia Khan, "A Survey on Security and Privacy of 5G Technologies: Potential Solutions, Recent Advancements, and Future Directions", IEEE Communications Surveys & Tutorials, 22(1), pp.196~248 (2020), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- D. Basin, "A Formal Analysis of 5G Authentication", Proc. the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS ’18), pp.1383~1396 (2018)
- C. Cremers, "Component-based formal analysis of 5G-AKA: channel assumptions and session confusion", Proc. 26th Annual Network and Distributed System Security Symposium, NDSS, pp.24~27 (2019)
- H. Kim, "Touching the Untouchables:Dynamic Security Analysis of the LTE Control Plane", Proc. IEEE Symposium on Security and Privacy (SP), pp.1153~1168 (2019)
- S.R. Hussain, "5GReasoner: A Property-Directed Security and Privacy Analysis Framework for 5G Cellular Network Protocol", Proc. 2019 ACM SIGSAC Conference on Computer and Communications Security, pp.669~684 (2019)
- 김기원, "5G Standalone Non-Public Network에서 등록 해제 공격에 대한 분석", 한국컴퓨터정보학회논문지, 26(9), pp.81~88 (2021), 한국컴퓨터정보학회[DOI]
- 5G-ACIA White Paper: “5G Non-Public Networks for Industrial Scenarios,”, , ~ (2019)
- 박태근, "Security Threats and Potential Security Requirements in 5G Non-Public Networks for Industrial Applications", 한국컴퓨터정보학회논문지, 25(11), pp.105~114 (2020), 한국컴퓨터정보학회[DOI]
- "3GPP TS 38.304 v16.4.0: “NR; User Equipment (UE) procedures in Idle mode and RRC Inactive state,”", ~ (2021)
- "3GPP TS 38.331 v16.3.1: “Radio Resource Control (RRC)protocol specification,”", ~ (2021)
- "3GPP TS 38.133 v.16.7.0, “NR; Requirements for support of radio resource management,”", ~ (2021)
- "3GPP TS 38.300 v16.5.0, “NR; NR and NG-RAN Overall Description; Stage 2,”", ~ (2021)