CBL - Campus del Baix Llobregat

Projecte llegit

Títol: Security in 5G New Radio networks using OTA Protocol Analizers.

Estudiants que han llegit aquest projecte:

Director/a: GARCÍA LOZANO, MARIO

Departament: TSC

Títol: Security in 5G New Radio networks using OTA Protocol Analizers.

Data inici oferta: 10-02-2022     Data finalització oferta: 10-10-2022


Estudis d'assignació del projecte:
    GR ENG SIS TELECOMUN
Tipus: Individual
 
Lloc de realització: Fora UPC    
 
        Supervisor/a extern: Ginés Garcia Avilés
        Institució/Empresa: i2CAT Foundation
        Titulació del Director/a: Telematics Engineering
 
Paraules clau:
Mobile Networks, Wireless Security, Sniffer, Measurement, 5G Security Enhancement
 
Descripció del contingut i pla d'activitats:
Software Defined Radio (SDR) is a radio communication system where many components that were traditionally
implemented in hardware, are now software components fully programmable running on off-the-shelf SDR hardware.
Given the affordability of these platforms and the flexibility they provide, an open-source community has emerged
creating and maintaining fully softwarized 4G and 5G New Radio protocol stacks.

Thus, the main goal of this thesis is to research the capabilities and features of the security in 5G New Radio
networks using portable solutions. To probe the security of 5G RAN (Radio Access Network), a UE (User Equipment)
terminal with the capability of capture downlink data Over The Air will be used to collect data from 5G commercial
networks. Additionally, we will test in a simulated 5G network environment the performance and reliability of our
5G protocol analyser tool. All the packets and frames referring to 5G communications previously analysed will be
studied.

To carry out this study, it is intended to divide the work into different stages. At first, an in-depth study of
protocols in the different OSI layers for 5G NR will be carried out. Also, the major 5G security enhancements
coming from the 3GPP standardisation group will be analised. Moreover, by characterising the improvements that 5G
presents in cybersecurity with respect to the previous generation (4G LTE), it will be exhibited what types of
attacks are more effective and in what environment and level they are deployed. By using commercial and open-
source (srsRAN) protocol analysers for 5G mobile networks we have verified the security in three 5G RAN
environments. Finally, it will be shown how exposed the user information is by featuring the attacks that are
still feasible.
 
Overview (resum en anglès):
The fifth-generation (5G) cellular network is in an era of rapid development. 5G not only provide ultra low latency data transmissions, it also offers enhanced security based on 5G security specifications developed by the 3rd Generation Partnership Project (3GPP). However, with billions of people using mobile networks every single day, it is important to know which are the present security enhancements implemented by the network operators providing 5G services.

The main goal of this thesis is to research the capabilities and features of the security in 5G New Radio networks and perform a reality check of these new security enhancements in commercial 5G networks.

For this purpose, we use a commercial security analyser tool to capture the messages exchanged between a mobile equipment and two 5G commercial network within different areas of Spain. Analysing the different messages captured, we measured the compliance of these 5G networks with the major 5G security enhancements coming from the 3GPP standardisation group.
Further, we designed and tested in a simulated 5G network environment the performance and reliability of our 5G protocol analyser tool which is capable of capture and decode some of the information coming from the physical downlink channels.

The results show that a major discrepancy exists between 5G security standards and real world deployment. Therefore, it has been shown which new attacks have emerged and which ones, some of them coming from the previous 4G generation, can still be executed within the commercial networks analysed such as IMSI catching, user data leakage and location tracking.

© CBLTIC Campus del Baix Llobregat - UPC