TR 33.809
Study on 5G Security enhancements against False Base Stations (FBS)
V18.1.0 (Wzip)
2023/09 131 p.
- Rapporteur:
- Ms. Guo, Ivy
Apple Computer Trading Co. Ltd
full Table of Contents for TR 33.809 Word version: 18.1.0
0 Introduction p. 11
The present document uses the term "false base station" in general to denote wireless devices that impersonate genuine base stations.
False base stations are also popularly known as IMSI catchers. While one of their initial attacks was to catch subscribers' IMSIs, more advancements have happened since - not only to the false base stations technologies, but also to the mobile network security.
Today, the capabilities of false base stations vary depending upon whether the mobile network is GPRS, UMTS, LTE, or 5G. The 5G system in particular has already made significant improvements to combat false base stations, the improvements like SUPI concealment, guaranteed GUTI refreshment, protected redirections, and a general informative detection framework. There are also other security features that the 5G security inherited from earlier generations like mutual authentication between UE and network, integrity protected signalling, and secure algorithm negotiations.
Some of the security solutions, constraints, and requirements studied in TR 33.969 "Study on Security aspects of Public Warning System (PWS)" may also be useful when considering security enhancement against false base stations specifically, the protection of the System Information (SI) broadcasts used for the PWS warning messages.
1 Scope p. 12
The present document studies the potential threats and privacy issues associated with false base station scenarios.
The present document identifies the potential solutions for mitigating the risks caused by false base station.
2 References p. 12
3 Definitions of terms, symbols and abbreviations p. 13
4 Security overviews of 5G system against false base stations p. 14
5 Key Issues p. 14
5.1 Key Issue #1: Security of unprotected unicast messages p. 14
5.2 Key Issue #2: Security protection of system information p. 16
5.3 Key Issue #3: Network detection of false base stations p. 17
5.4 Key Issue #4: Protection against SON poisoning attempts p. 17
5.5 Key Issue #5: Mitigation against the authentication relay attack p. 19
5.6 Key Issue #6: Resistance to radio jamming p. 19
5.7 Key Issue #7: Protection against Man-in-the-Middle false gNB attacks p. 20
5.7.1 Key issue details p. 20
5.7.2 Security Threats p. 20
6 Candidate Solutions p. 21
6.0 Mapping between key issues and solutions p. 21
6.1 Solution #1: Protection for the UE Capability Transfer p. 22
6.2 Solution #2: Protection of RRCReject message in RRC_INACTIVE state p. 22
6.3 Solution #3: Protection of uplink UECapabilityInformation RRC message p. 23
6.4 Solution #4: Enriched measurement reports p. 24
6.5 Solution #5: Mitigation against the authentication relay attack p. 27
6.6 Solution #6: Avoiding UE connecting to false base station during HO p. 29
6.6.1 Introduction p. 29
6.6.2 Solution details p. 29
6.6.2.1 Background p. 29
6.6.2.2 Procedure p. 31
6.6.3 Evaluation p. 33
6.7 Solution #7: Verification of authenticity of the cell p. 33
6.7.1 Introduction p. 33
6.7.2 Solution details p. 34
6.7.2.1 System Information verification using Digital Signatures p. 34
6.7.2.2 System Information verification using Identity Based Cryptography p. 35
6.7.2.3 Optimization of SI verification using the other SI p. 36
6.7.2.4 Capability negotiation p. 36
6.7.3 Evaluation p. 37
6.7.4 Assessment using clause A.3 p. 37
6.7.4.1 UE aspects p. 37
6.7.4.2 UE actions upon detection of invalid signature p. 38
6.7.4.3 Threats that are mitigated by signed SI messages p. 38
6.7.4.4 Threats that are not mitigated by signed SI messages p. 38
6.7.4.5 Provisioning of keys p. 38
6.7.4.6 RAN aspects p. 39
6.7.4.7 VPLMN aspects p. 39
6.7.4.8 HPLMN aspects p. 40
6.7.4.9 Network sharing aspects p. 40
6.7.4.10 Roaming aspects p. 40
6.7.4.11 Regulatory aspects p. 40
6.7.4.12 Signature schemes p. 40
6.7.4.13 Signature length p. 40
6.7.4.14 Resistance against Quantum Computing p. 40
6.8 Solution #8: Network detection of nearby false base stations from call statistics and measurements p. 40
6.8.1 Introduction p. 40
6.8.2 Solution details p. 41
6.8.2.1 Detection of false base Stations from Active UE Measurement report p. 41
6.8.2.2 Detection of false base stations from duplicate Cell IDs in Active UE Measurement report p. 41
6.8.3 Evaluation p. 41
6.9 Solution #9: Using symmetric algorithm with assistance of USIM and home network p. 41
6.9.1 Introduction p. 41
6.9.2 Solution details p. 42
6.9.2.1 Framework p. 42
6.9.2.2 Provisioning p. 44
6.9.2.2.1 Protection Key Agreement (PKA) and Protection Key Transfer (PKT) procedure p. 44
6.9.2.2.2 Protection area p. 45
6.9.2.2.3 Protection Area Information Provisioning (PAIP) procedure p. 46
6.9.2.3 Authenticity p. 47
6.9.3 Evaluation p. 49
6.10 Solution #10: Protection on the unicast message based on ECDH p. 49
6.10.1 Introduction p. 49
6.10.2 Solution details p. 49
6.10.2.1 General description p. 49
6.10.2.2 Pre-provision p. 50
6.10.2.3 Message used to send ePK uplink p. 50
6.10.2.4 Replay resistant p. 50
6.10.2.5 Procedures p. 50
6.10.3 Assessment using clause A.3 p. 51
6.10.3.1 UE aspects p. 51
6.10.3.2 UE actions upon detection of invalid signature p. 51
6.10.3.3 Threats that are mitigated by signed SI messages p. 51
6.10.3.4 Threats that are not mitigated by signed SI messages p. 51
6.10.3.5 Provisioning of keys p. 51
6.10.3.6 RAN aspects p. 51
6.10.3.7 VPLMN aspects p. 51
6.10.3.8 HPLMN aspects p. 51
6.10.3.9 Network sharing aspects p. 51
6.10.3.10 Roaming aspects p. 52
6.10.3.11 Regulatory aspects p. 52
6.10.3.12 Signature schemes p. 52
6.10.3.13 Signature length p. 52
6.10.3.14 Resistance against Quantum Computing p. 52
6.11 Solution #11: Certificate based solution against false base station p. 52
6.11.1 Introduction p. 52
6.11.2 Solution details p. 52
6.11.2.1 Pre-provision and certificate distribution p. 52
6.11.2.2 Signature algorithm p. 53
6.11.2.3 Procedures p. 54
6.11.2.4 Certificate format: p. 54
6.11.3 Assessment using clause A.3 p. 54
6.11.3.1 UE aspects p. 54
6.11.3.2 UE actions upon detection of invalid signature p. 55
6.11.3.3 Threats that are mitigated by signed SI messages p. 55
6.11.3.4 Threats that are not mitigated by signed SI messages p. 55
6.11.3.5 Provisioning of keys p. 55
6.11.3.6 RAN aspects p. 55
6.11.3.7 VPLMN aspects p. 55
6.11.3.8 HPLMN aspects p. 56
6.11.3.9 Network sharing aspects p. 56
6.11.3.10 Roaming aspects p. 56
6.11.3.11 Regulatory aspects p. 56
6.11.3.12 Signature schemes p. 56
6.11.3.13 Signature length p. 56
6.11.3.14 Resistance against Quantum Computing p. 57
6.12 Solution #12: ID based solution against false base station p. 57
6.12.1 Introduction p. 57
6.12.2 Solution details p. 57
6.12.3 Assessment using clause A.3 p. 59
6.12.3.1 UE aspects p. 59
6.12.3.2 UE actions upon detection of invalid signature p. 59
6.12.3.3 Threats that are mitigated by signed SI messages p. 59
6.12.3.4 Threats that are not mitigated by signed SI messages p. 59
6.12.3.5 Provisioning of keys p. 59
6.12.3.6 RAN aspects p. 59
6.12.3.7 VPLMN aspects p. 59
6.12.3.8 HPLMN aspects p. 60
6.12.3.9 Network sharing aspects p. 60
6.12.3.10 Roaming aspects p. 60
6.12.3.11 Regulatory aspects p. 60
6.12.3.12 Signature schemes p. 60
6.12.3.13 Signature length p. 60
6.12.3.14 Resistance against Quantum Computing p. 60
6.12.4 Evaluation p. 60
6.13 Solution #13: Protecting RRCResumeRequest against MiTM p. 61
6.14 Solution #14: Shared key based MIB/SIBs protection p. 62
6.15 Solution #15: Mitigation against the authentication relay attack with different PLMNs p. 63
6.16 Solution #16: Protection of RRC Reject Message p. 66
6.16.1 Introduction p. 66
6.16.2 Solution details p. 67
6.16.2.1 Protection of RRC Reject Message in RRC_IDLE state p. 67
6.16.2.2 Protection of RRC Reject Message in RRC_INACTIVE state p. 67
6.16.3 Evaluation p. 67
6.17 Solution 17: Integrity protection of the whole RRCResumeRequest message p. 68
6.18 Solution #18: Avoiding UE connecting to False Base Station during Conditional Handover p. 69
6.19 Solution #19: AS security based MIB/SIBs integrity information provided by gNB p. 71
6.20 Solution #20: Digital Signing Network Function (DSnF) p. 73
6.20.1 Introduction p. 73
6.20.2 Solution details p. 74
6.20.2.1 Digital Signatures of System Information p. 74
6.20.2.2 Digital Signing Network Function (DSnF) p. 74
6.20.2.2.1 Digital Signing Request p. 74
6.20.2.2.2 Digital Signature Computation p. 75
6.20.2.2.3 Digital Signing Response p. 75
6.20.2.2.4 Short-term Certificate: request and usage p. 75
6.20.2.3 gNB Behaviours p. 77
6.20.2.3.0 General p. 77
6.20.2.3.1 Requesting Digital Signatures p. 77
6.20.2.3.2 Receiving Digital Signatures p. 78
6.20.2.3.3 Broadcasting Digital Signatures p. 78
6.20.2.4 Procedures for digital signature request and response p. 78
6.20.2.5 UE Behaviours p. 80
6.20.2.5a General p. 80
6.20.2.5.0 Introduction p. 80
6.20.2.5.1 Trust Anchors in UE p. 80
6.20.2.5.2 Cell Scanning p. 81
6.20.2.5.3 Verification of Digital Signatures p. 81
6.20.2.5.4 Verification of Time Counter p. 82
6.20.2.5.5 Cell Selection and Reselection p. 83
6.20.2.6 Security Analysis p. 84
6.20.3 Assessment using clause A.3 p. 85
6.20.3.1 UE aspects p. 85
6.20.3.2 UE actions upon detection of invalid signature p. 85
6.20.3.3 Threats that are mitigated by signed SI messages p. 86
6.20.3.4 Threats that are not mitigated by signed SI messages p. 86
6.20.3.5 Provisioning of keys p. 86
6.20.3.6 RAN aspects p. 86
6.20.3.7 VPLMN aspects p. 86
6.20.3.8 HPLMN aspects p. 86
6.20.3.9 Network sharing aspects p. 86
6.20.3.10 Roaming aspects p. 86
6.20.3.11 Regulatory aspects p. 86
6.20.3.12 Signature schemes p. 86
6.20.3.13 Signature length p. 86
6.20.3.14 Resistance against Quantum Computing p. 87
6.20.4 Evaluation p. 87
6.21 Solution #21: Certificate based solution against false base station for Non-Public Networks p. 88
6.21.1 Introduction p. 88
6.21.2 Solution details p. 89
6.21.2.1 Certificate Provisioning p. 89
6.21.2.2 Procedure for NPN Deployments p. 89
6.21.2.2.1 Procedure p. 89
6.21.2.3 Certificate format: p. 90
6.21.3 Assessment using clause A.3 p. 90
6.21.3.1 UE aspects p. 90
6.21.3.2 UE actions without the network's certificate p. 90
6.21.3.3 Threats that are mitigated by protecting system information messages using Digital Signature as well as encrypting unicast signalling messages p. 91
6.21.3.4 Threats that are not mitigated by protecting system information messages using Digital Signature or encrypting unicast signalling messages. p. 91
6.21.3.5 Provisioning of certificates into the UE p. 91
6.21.3.6 RAN aspects p. 91
6.21.3.7 VPLMN aspects p. 91
6.21.3.8 HPLMN aspects p. 91
6.21.3.9 NSPN aspects p. 91
6.21.3.10 Network sharing aspects p. 91
6.21.3.11 Roaming aspects p. 91
6.21.3.12 Regulatory aspects p. 91
6.21.3.13 Encryption schemes p. 91
6.21.3.14 Signature / Encryption length p. 92
6.21.3.15 Resistance against Quantum Computing p. 92
6.22 Solution #22: Detecting false base stations based on UE positioning measurements p. 92
6.23 Solution #23: Cryptographic CRC to avoid MitM relay nodes p. 96
6.24 Solution #24: UE&Network-assisted UE avoidance and Network detection of FBS p. 99
6.24.1 Introduction p. 99
6.24.2 Solution details p. 100
6.24.2.1 UE Initialization p. 100
6.24.2.2 UE Operation (IDLE mode) p. 100
6.24.2.3 UE Operation (CONNECTED mode) p. 101
6.24.2.4 Network operation p. 101
6.24.3 Evaluation p. 101
6.25 Solution #25: Detection of Man-in-the-Middle false base stations p. 102
6.26 Solution #26: KI#2 with PKC-based and without tight time synchronization p. 104
6.26.1 Introduction p. 104
6.26.2 Solution details p. 104
6.26.2.1 Requirements p. 104
6.26.2.2 Protocol Operation p. 104
6.26.2.3 Clarifications regarding the protocol operation p. 106
6.26.3 Evaluation p. 107
6.27 Solution #27: Short-lived asymmetric key-based solution for protecting system information p. 108
6.27.1 Introduction p. 108
6.27.1.1 General p. 108
6.27.1.2 Hash-based consistency checks p. 109
6.27.1.3 Symmetric key based MAC p. 109
6.27.1.4 Asymmetric key based digital signatures p. 109
6.27.2 Solution details p. 110
6.27.2.1 Authenticity of system information p. 110
6.27.2.1.1 Signing entities p. 110
6.27.2.1.2 Raw public keys or certificates p. 110
6.27.2.1.3 Trust anchors p. 111
6.27.2.1.4 PKI trust models p. 112
6.27.2.1.5 Trust anchor provisioning p. 112
6.27.2.1.6 Delivering signatures and short-lived public keys p. 113
6.27.2.1.7 System information to be protected p. 113
6.27.2.2 Replay mitigation p. 114
6.27.2.2.0 General p. 114
6.27.2.2.1 Message timeliness p. 114
6.27.2.2.2 gNB unique properties p. 116
6.27.2.2.3 Time synchronization issues p. 117
6.27.2.2.4 Limitations p. 117
6.27.2.3 Cell selection and reselection p. 118
6.27.3 Assessment using clause A.3 p. 119
6.27.3.1 UE aspects p. 119
6.27.3.2 UE actions upon detection of invalid signature p. 119
6.27.3.3 Threats that are mitigated by signed SI messages p. 120
6.27.3.4 Threats that are not mitigated by signed SI messages p. 120
6.27.3.5 Provisioning of keys p. 120
6.27.3.6 RAN aspects p. 120
6.27.3.7 VPLMN aspects p. 120
6.27.3.8 HPLMN aspects p. 120
6.27.3.9 Network sharing aspects p. 120
6.27.3.10 Roaming aspects p. 120
6.27.3.11 Regulatory aspects p. 120
6.27.3.12 Signature schemes p. 120
6.27.3.13 Signature length p. 120
6.27.3.14 Resistance against Quantum Computing p. 121
6.27.4 Evaluation p. 121
7 Conclusions p. 121
7.1 Conclusions on Key Issue #1 p. 121
7.2 Conclusions on Key Issue #2 p. 121
7.3 Conclusions on Key Issue #3 p. 121
7.4 Conclusions on Key Issue #4 p. 121
7.5 Conclusions on Key Issue #5 p. 121
7.6 Conclusions on Key Issue #6 p. 122
7.7 Conclusions on Key Issue #7 p. 122
A Assessment of system, architectural and security impacts of signing SI messages p. 123
A.1 Introduction p. 123
A.2 Example architecture p. 123
A.3 Aspects that need to be addressed p. 123
A.3.1 UE Aspects p. 123
A.3.2 UE actions upon detection of invalid signature p. 123
A.3.3 Threats that are mitigated by signed SI messages p. 124
A.3.4 Threats that are not mitigated by signed Si messages p. 124
A.3.5 Provisioning of keys p. 124
A.3.6 RAN aspects p. 124
A.3.7 VPLMN aspects p. 124
A.3.8 HPLMN aspects p. 124
A.3.9 Network sharing aspects p. 124
A.3.10 Roaming aspects p. 124
A.3.11 Regulatory aspects p. 124
A.3.12 Signature schemes p. 124
A.3.13 Signature length p. 124
A.3.14 Resistance against Quantum Computing p. 125
B Taxonomy of attacks against 5G UE over radio interfaces p. 125
B.1 Introduction p. 125
B.2 Attack taxonomy p. 125
B.2.0 General p. 125
B.2.1 Active Attacks p. 126
B.2.1.0 General p. 126
B.2.1.1 Radio Jamming p. 126
B.2.1.2 Signal shadowing p. 126
B.2.1.3 Message attacks p. 127
B.2.2 Passive Attacks p. 128
$ Change history p. 129
