针对5G核心网协议的自动化漏洞挖掘方法

吴佩翔; 张志龙; 陈力波; 王轶骏; 薛质

doi:10.11959/j.issn.2096-109x.2024006

您当前的位置：

首页 >

文章列表页 >

针对5G核心网协议的自动化漏洞挖掘方法

学术论文 | 更新时间：2024-06-03

- 针对5G核心网协议的自动化漏洞挖掘方法
- Automated vulnerability discovery method for 5G core network protocol
- 网络与信息安全学报 2024年10卷第1期页码：156-168
- 作者机构：
- 作者简介：
  
  [ "吴佩翔（1992− ），男，新疆伊宁人，上海交通大学硕士生，主要研究方向为自动化代码审计、5G安全、容器安全" ]
  [ "张志龙（1981− ），男，江苏南通人，上海交通大学博士生，主要研究方向为网络空间安全、计算机外设安全" ]
  [ "陈力波（1985− ），男，江西广丰人，上海交通大学高级工程师，主要研究方向为软件与系统安全、物联网安全、虚拟化安全" ]
  [ "王轶骏（1980− ），男，上海人，上海交通大学工程师，主要研究方向为网络与系统安全、网络攻防对抗" ]
  [ "薛质（1971− ），男，江苏苏州人，博士，上海交通大学教授、博士生导师，主要研究方向为计算机通信网、网络攻防与评测、安全主动网" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2022QY1702)
- DOI：10.11959/j.issn.2096-109x.2024006
  中图分类号： TN915.08
- 网络首发：2024-02，
  
  纸质出版：2024-02-25
- 稿件说明：
移动端阅览
吴佩翔, 张志龙, 陈力波, 等. 针对5G核心网协议的自动化漏洞挖掘方法[J]. 网络与信息安全学报, 2024,10(1):156-168.

Peixiang WU, Zhilong ZHANG, Libo CHEN, et al. Automated vulnerability discovery method for 5G core network protocol[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 156-168.
吴佩翔, 张志龙, 陈力波, 等. 针对5G核心网协议的自动化漏洞挖掘方法[J]. 网络与信息安全学报, 2024,10(1):156-168. DOI： 10.11959/j.issn.2096-109x.2024006.

Peixiang WU, Zhilong ZHANG, Libo CHEN, et al. Automated vulnerability discovery method for 5G core network protocol[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 156-168. DOI： 10.11959/j.issn.2096-109x.2024006.

摘要

随着5G在全球范围内的广泛商用，5G网络安全问题广泛受到关注。针对5G核心网协议的自动化漏洞挖掘手段主要以黑盒模糊测试为主，但由于5G核心网协议设计复杂，黑盒模糊测试存在效率低、通用性差、拓展性不足等问题，不能有效检测到 5G 核心网协议安全漏洞。针对上述问题，深入了解 5G 核心网架构和重点接口协议的工作原理，总结在5G核心网场景下基于静态分析的自动化漏洞挖掘方法相较传统黑盒模糊测试方法的优势。对5G核心网的开源解决方案进行了源代码审计，发现在 5G 核心网协议实现中一类变量生命周期管理不当而导致的内存泄露安全问题，可导致5G核心网网元被拒绝服务攻击。基于此，提出了针对此类安全问题的通用漏洞模型，设计并实现了基于控制流和数据流混合分析的自动化漏洞挖掘方法。通过实验对该方法进行了有效性测试和效率评估，成功挖掘到了通用 5G 开源解决方案——Open5GS 中的5个未公开安全漏洞，涵盖多个接口协议应用场景，获得了4个CVE 编号。通过模拟环境，验证了该系列漏洞的影响范围广且利用条件低，充分证明了所提自动化漏洞挖掘方法的有效性，并向相关厂商进行了披露。

Abstract

With the widespread development of fifth-generation (5G) mobile communication technology

concerns regarding 5G network security have also increased.Blackbox fuzzing is a commonly used method for automated vulnerability discovery in software security.However

applying dynamic approaches like fuzzing to discover vulnerabilities in the complex design of 5G core network protocols poses challenges such as low efficiency

poor versatility

and lack of scalability.Therefore

a novel static method to examine the open-source solution of the 5G core network was proposed.Through this method

a series of memory leak security issues caused by improper variable life cycle management were identified

which can lead to denial-of-service attacks on the 5G core network.To summarize these weaknesses

a general vulnerability model and an automated vulnerability discovery method called HoI were presented

which utilized hybrid analysis based on control and data flow.By successfully discovering five zero-day bugs in Open5GS

an open-source solution for the 5G core network

vulnerabilities that cover practical application scenarios of multiple interface protocols in the 5G core network were identified.These vulnerabilities have wide-ranging impact

are highly detrimental

and can be easily exploited.They have been reported to the vendor and assigned four Common Vulnerabilities and Exposures (CVE) numbers

demonstrating the effectiveness of this automated vulnerability discovery method.

关键词

Keywords

references

3GPP . 5G,System architecture for the 5G System (5GS) [S ] . ETSI TS 123 501-2018 .

冯登国 , 徐静 , 兰晓 . 5G 移动通信网络安全研究 [J ] . 软件学报 , 2018 , 29 ( 6 ): 1813 - 1825 .

FENG D G , XU J , LAN X . Study on 5G mobile communication network security [J ] . Journal of Software , 2018 , 29 ( 6 ): 1813 - 1825 .

LIU Y . Evaluation of Free5GC Forwarding performance on private and public clouds [C ] // 2022 IEEE Cloud Summit . 2022 : 9 - 16 .

JUSTUS R . 5G campus networks:a first measurement study [J ] . IEEE Access 2021 . 2021 ,( 99 ): 121786 - 121803 .

穆佳 , 王勇 , 马瑞涛 , 等 . 面向3GPP R16的5G核心网演进策略研究 [J ] . 邮电设计技术 , 2022 ( 2 ).

MU J , WANG Y , MA R T , et al . Research on 5G core network evolution strategies for 3GPP R16 [J ] . Designing Techniques of Posts and Telecommunications , 2022 ( 2 ).

TANG Q , ERMIS O , NGUYEN C D , et al . A systematic analysis of 5G networks with a focus on 5G core security [J ] . IEEE Access , 2022 , 10 : 298 - 319 .

ZHAO B , LI Z , QIN S , et al . StateFuzz:system call-based state-aware linux driver fuzzing [C ] // Proceedings of the 31st USENIX Security Symposium (USENIX Security 22) . 2022 .

ZHOU S , YANG Z , QIAO D , et al . Ferry:state-aware symbolic execution for exploring state-dependent program paths [C ] // Proceedings of the 31st USENIX Security Symposium (USENIX Security 22) . 2022 .

CHEN L , WANG Y , CAI Q , et al . Sharing more and checking less:leveraging common input keywords to detect bugs in embedded systems [C ] // Proceedings of the 30th USENIX Security Symposium (USENIX Security 21) . 2021 .

YOUN D , LEE S , RYU S . Declarative static analysis for multilingual programs using CodeQL [J ] . Software:Practice and Experience . 2023 , 9 ( 3 ).

DOLENTE F , GARROPPO R G , PAGANO M . A vulnerability assessment of open-source implementations of fifth-generation core network functions [J ] . Future Internet , 2023 , 16 ( 1 ).

TECHNOLOGIES P . Threat vector:GTP vulnerabilities in LTE and 5G networks 2020 [EB ] .

HU X , LIU C , LIU S , et al . Signalling security analysis:is HTTP/2 secure in 5G core network [C ] // Proceedings of 2018 10th International Conference on Wireless Communications and Signal Processing (WCSP) . 2018 .

KQIEN G M . On threats to the 5G service based architecture [J ] . Wireless Personal Communications , 2021 , 119 ( 1 ): 97 - 116 .

BORGAONKAR R , HIRSCHI L , PARK S , et al . New privacy threat on 3G,4G,and upcoming 5G AKA protocols [J ] . Proceedings on Privacy Enhancing Technologies , 2019 , 2019 ( 3 ): 108 - 127 .

HUSSAIN S R , ECHEVERRIA M , CHOWDHURY O , et al . Privacy attacks to the 4G and 5G cellular paging protocols using side channel information [C ] // Proceedings of Network and Distributed Systems Security (NDSS) Symposium2019 . 2019 .

SILVEIRA L B , DE RESENDE H C , BOTH C B , et al . Tutorial on communication between access networks and the 5G core [J ] . Computer Networks , 2022 :109301.

OPENAIRINTERFACE An open-source 5G core network solution under development [EB ] .

GROUP N The challenges of fuzzing 5G protocols [EB ] .

NCCGROUP . An 5G core network protocol fuzzer [EB ] .

DEMANTZ . A coverage-guided blackbox fuzzer based on the Frida instrumentation framework [EB ] .

PHAM V-T , BÖHME M , ROYCHOUDHURY A . AFLNet:a greybox fuzzer for network protocols [C ] // Proceedings of 2020 IEEE 13th International Conference on Software Testing,Validation and Verification (ICST) . 2020 .

SALAZAR Z , NGUYEN H N , MALLOULI W , et al . 5Greplay:a 5G network traffic fuzzer - application to attack injection [C ] // Proceedings of the 16th International Conference on Availability,Reliability and Security . 2021 .

HU Y , YANG W , CUI B , et al . Fuzzing method based on selection mutation of partition weight table for 5G core network NGAP protocol [M ] . Springer Nature Switzerland AG , 2022 .

CAO Y , CHEN Y , ZHOU W . Detection of PFCP protocol based on fuzz method [C ] // Proceedings of 2022 2nd International Conference on Computer,Control and Robotics (ICCCR) . 2022 : 207 - 211 .

JAIN A , LOPEZ-AGUILERA E , DEMIRKOL I . Improved handover signaling for 5G networks [C ] // Proceedings of 2018 IEEE 29th Annual International Symposium on Personal,Indoor and Mobile Radio Communications (PIMRC) . 2018 : 164 - 170 .

浏览量

282

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于状态引导的放大漏洞挖掘方法

基于大语言模型的AppArmor安全策略自动生成方法

基于注意力与门控机制的多特征融合恶意软件检测方法

基于多因素聚类选择的Android应用程序分类风险评估方法

Docker组件间标准输入输出复制的DoS攻击分析