Content for TR 33.821 Word version: 9.0.0
4 Layered Security Approach in LTE p. 9
4.1 S1-C interface security p. 10
4.2 S1-U interface security p. 10
4.3 Example case: Direct Path Switch Message Security p. 10
4.4 Conclusion p. 11
5 Threats p. 12
5.1 Threats to UE p. 12
5.1.1 IMSI catching attack p. 12
5.1.1.1 Threats p. 12
5.1.1.2 Countermeasures p. 12
5.1.2 Threat of UE tracking p. 14
5.1.2.1 Threats p. 14
5.1.2.2 Countermeasures p. 15
5.1.3 Forced handover p. 18
5.1.3.1 Threats within LTE p. 18
5.1.3.2 Countermeasures p. 19
5.1.4 Forced handover to legacy RAT p. 19
5.1.4.1 Threats p. 19
5.1.4.2 Countermeasures p. 20
5.1.5 Threats of unprotected bootstrap and multicast signalling in LTE p. 21
5.1.5.1 Threats p. 21
5.1.6 Threat related to broadcast of system information p. 21
5.1.6.1 Threats p. 21
5.1.6.2 Countermeasures p. 22
5.2 Threats to eNB and last-mile transport links p. 24
5.2.1 User Plane packet injection attacks p. 24
5.2.1.1 Threats p. 24
5.2.1.2 Countermeasures p. 24
5.2.2 User plane packet modification attacks p. 26
5.2.2.1 Threats p. 26
5.2.2.2 Countermeasures p. 26
5.2.3 User plane packet eavesdropping p. 26
5.2.3.1 Threats p. 26
5.2.3.2 Countermeasures p. 26
5.2.4 Physical attack threat on eNB p. 26
5.2.4.1 Threats p. 26
5.2.4.2 Countermeasures p. 27
5.2.5 (D)DoS attacks against eNB from the network p. 27
5.2.5.1 Threats p. 27
5.2.5.2 Countermeasures p. 27
5.2.6 (D)DoS attacks against eNB from UEs p. 27
5.2.6.1 Threats p. 27
5.2.6.2 Countermeasures p. 28
5.2.7 RLF recovery p. 28
5.3 Threats to MME/SAE gateway p. 30
5.3.1 (D)DoS attacks against MME through from RAN side p. 30
5.3.1.1 Threat p. 30
5.3.1.2 Countermeasures p. 31
5.4 Threats related to mobility management p. 31
5.4.1 Unauthorised access to control plane data p. 31
5.4.1.1 Threats p. 31
5.4.1.2 Countermeasure p. 31
5.4.2 Privacy p. 31
5.4.2.1 Threats p. 31
5.4.2.2 Countermeasure p. 31
5.4.3 Unauthorised manipulation of control plane data p. 32
5.4.3.1 Threats p. 32
5.4.3.2 Countermeasure p. 32
5.4.4 Disturbing or misusing network services p. 32
5.4.4.1 Threats p. 32
5.4.4.2 Countermeasure p. 32
5.4.5 Unauthorised access to network services p. 32
5.4.5.1 Threats p. 32
5.4.5.2 Countermeasure p. 33
