4G Mobile Networks At Risk

Transcription

1 Consortium Attack analysis and Security concepts for MObile Network infastructures supported by collaborative Information exchange 4G Mobile Networks At Risk The ASMONIA Threat and Risk Analysis for 4G Mobile Networks Peter Schneider Nokia Siemens Networks Research

2 3GPP 4G Mobile Network 4G Mobile Core Network (Evolved Packet Core) Mobile 4G Radio Access Network SEG MME Charging Systems SAE-GW Internet enb Relay Node SeGW Serv.GW PDN-GW HeNB Trusted Non-3GPP Access Network Untrusted Non-3GPP Access Network epdg HSS 3GPP AAA Server PCRF IMS / Operator Services Corporate IP Networks Trusted Untrusted Control plane User plane Control+user pl. 2

3 3GPP 4G Mobile Network physical attacks on the enodeb physical attacks on backhauling networks insider attacks enb EPS HSS PCRF IMS MME SAE-GW L3/L2 based attacks from backhauling networks Serv.GW PDN-GW Application Server Mobile attacks on the radio interface attacks from mobile stations attacks from other PLMNs other PLMN / GRX general IP based attacks from external IP networks The Internet / other PDNs 3

4 Threat and Risk Analysis (TRA) Method checked: a number of ISO/3GPP/ETSI/ITU documents individual approach chosen: around 10 generic threats flooding an interface, eavesdropping, compromise via management interface, theft of service, around 20 assets (network elements, network parts) per asset and threat: assess likelihood of attack overall vulnerability of the asset impact on the network 1 low 2 Scale high RISK = likelihood * vulnerability * impact 4

5 Ranking of Threats Threat Risk Compromise via management interface 39 Malicious insider 33 Compromise via implementation flaw 26 Flooding an interface 19 Crashing a network element 16 Theft of service 15 Eavesdropping (user plane) 15 Eavesdropping (control plane) 13 Unauthorized access to data on a network element 10 Traffic modification (control plane) 10 Traffic modification (user plane) 9 Data modification on a network element 9 5

6 Ranking of Assets 4G Mobile Core Network (Evolved Packet Core) Mobile 4G Radio Access Network 4 (22) SEG 19 (12) MME 17 (14) Charging Systems SAE-GW Internet 2 (28) Relay Node 1 (30) enb 14 (15) SeGW Serv.GW 5 (21) PDN-GW HeNB Operation & Maintenance Center 18 (13) HSS 12 (17) PCRF 6 (20) Corporate IP Networks 7 (20) Short Message Service 3 (25) GW MSC SMSC IMS / Operator Services Rank (Risk) 6

7 Ranking of Network Elements (most critical ones) Asset Risk HeNB (4G home base station, "femto-cell") 30 Relay Node 28 Short Message Service 25 enb (4G base station) 22 SAE-Gateway 21 IP Multimedia System 20 Operation and Maintenance Servers 20 GGSN (Gateway GPRS Support Node) 19 IP/MPLS Router (e.g. core site router) 19 DNS-Server 18 epdg (evolved Packet Data Gateway) 17 PCRF (Policy and Charging Rules Function) 17 7

8 Ranking of Network Elements (less critical ones) Asset Risk Location Services 15 Security Gateway 15 Web Proxy 14 Circuit-Switched Core Network Domain 14 Charging Systems 14 HSS (Home Subscriber Server) 13 MME (Mobility Management Entity) 12 SGSN (Serving GPRS Support Node) 12 HeNB-Gateway 12 EIR (Equipment Identity Register) 11 3GPP AAA-Server/Proxy 10 8

9 Summary & Conclusion ASMONIA has carried out a comprehensive Threat and Risk Analysis (TRA) of 4G mobile communication networks. Security-budgets are limited so the TRA can give guidance on which threats and which assets to focus in order to reduce the overall risks of a deployed PLMN most efficiently. The TRA gives also valuable guidance for research: it served as foundation and guidedance for the work in ASMONIA it is used also in 3GPP s security standardization work it may be used to steer efforts in future research The complete results of the TRA are available on ( Acknowledgements to the co-authors of the TRA document: André Egners, Enno Rey, Hendrik Schmidt, Sascha Wessel 9

10 Some Abbreviations 3GPP 3. Generation Partnership Project Ln Communication Layer n AAA DNS enb epdg EPS GRX GW HeNB HSS IMS IP LTE Authentication, Authorization, Accounting Domain Name Service Evolved Node B Evolved Packet Data Gateway Evolved Packet System GPRS Roaming Exchange Network Gateway Home enb Home Subscriber Server IP Multimedia System Internet Protocol Long Term Evolution MME MPLS MSC PCRF PDN PLMN SAE SEG SeG Serv.GW SMSC TRA Mobility Management Entity Multi Protocol Label Switching Mobile Switching Center Policy and Charging Rules Function Packet Data Network Public Land Mobile Network System Architecture Evolution Security Gateway Security Gateway Serving Gateway Short Message Service Center Threat and Risk Analysis 10