• Abstract and Figures
• Public Full-text

MODELING AND ANALYSIS OF MOBILE TELEPHONY PROTOCOLS by Chunyu Tang A DISSERTATION Submitted to the Faculty of the Stevens Institute of Technology in partial fulfillment of the requirements for the degree of DOCTOR OF PHILOSOPHY Chunyu Tang, Candidate ADVISORY COMMITTEE David A. Naumann, Chairman Date Yingying Chen Date Daniel Duchamp Date Susanne Wetzel Date STEVENS INSTITUTE OF TECHNOLOGY Castle Point on Hudson Hoboken, NJ 07030 2013 c 2013, Chunyu Tang. All rights reserved. iii MODELING AND ANALYSIS OF MOBILE TELEPHONY PROTOCOLS ABSTRACT The GSM (2G), UMTS (3G), and LTE (4G) mobile telephony protocols are all in active use, giving rise to a number of interoperation situations. This poses serious challenges in ensuring authentication and other security properties. Analyzing the security of all possible interoperation scenarios by hand is, at best, tedious under- taking. Model checking techniques provide an effective way to automatically find vulnerabilities in or to prove the security properties of security protocols. Although the specifications address the interoperation cases between GSM and UMTS and the switching and mapping of established security context between LTE and previous technologies, there is not a comprehensive specification of which are the possible interoperation cases. Nor is there comprehensive specification of the procedures to establish security context (authentication and short-term keys) in the various interoperation scenarios. We systematically enumerate the cases, classifying them as allowed, disallowed, or uncertain with rationale based on detailed analysis of the specifications. We identify the authentication and key agreement procedure for each of the possible cases. We formally model the pure GSM, UMTS, LTE authentication protocols, as well as all the interoperation scenarios; we analyze their security, in the symbolic model of cryptography, using the tool ProVerif. We find the previously known man- in-the-middle attack on GSM. For the interoperation scenarios, we find three kind of attacks: one is the false base station attack which is inherited from GSM; another attack is a similar false base station attack but with a 4G base station; the third one modifies the CMC message. Based on the proved and refuted properties, we compare the authenticity achieved in different scenarios, and we provide recommendations to improve the mobile telephony standards. Author: Chunyu Tang Advisor: David A. Naumann Date: January 13, 2014 Department: Computer Science Degree: Doctor of Philosophy iv Acknowledgments I am deeply grateful to my advisor, Professor David A. Naumann, for his teaching, supporting, and kindness. His enthusiasm for research and broad knowledge inspire me. He spent countless hours discussing my work, reading my papers, proposal, and dissertation, and criticizing my talks. This dissertation would not be possible without the insightful guidance of Professor Naumann. It was a great honor to work with him. I would also like to thank Professor Susanne Wetzel for the tremendous time and energy she invested into my research. This dissertation would not have existed without her detailed comments, endless patience, and valuable advice. I give my sincere thanks to the members of my Ph.D committee, Professor Daniel Duchamp and Professor Yingying Chen. Their valuable comments on my proposal and dissertation greatly enhanced and strengthened my work. I would also like to thank Professor Adriana Compagnoni for serving on my proposal committee and for her valuable comments on my work. I would like to thank Andrey Chudnov, Stan Rosenberg, and Ye Wu for their excellent comments and helpful discussion of my work. I thank the professors and students in our regular LSS meeting for sharing their helpful comments. I would like to thank my parents for their love, encouragement, and support. I am proud to be their son. Finally, I would like to thank my wonderful wife, Yan Zhuang, and my adorable son, Albert Tang. They keep my life with love. They shared all my exciting and disappointing moments over the years. v Table of Contents Abstract iii Acknowledgments iv List of Tables ix List of Figures x Index of Defined Terms xii 1 Introduction 1 1.1 Motivation and Goals1 1.2 Approach2 1.3 Thesis3 1.4 Contribution3 1.5 Outline4 2 Background on Security Protocol Analysis and Related Work 5 2.1 Informal Analysis Techniques and Prior Work for Mobile Telephony Protocols5 2.1.1 Conventional Analysis5 2.1.2 Prior Work6 2.2 Background on Formal Analysis7 2.2.1 Dolev-Yao (Symbolic) and Computational Model7 2.2.2 Events and Correspondence Assertion8 2.3 Comparative Overview of Formal Tools9 2.3.1 Formal Analysis Tools9 2.3.2 Scyther 11 2.3.3 AVISPA 12 2.4 ProVerif 14 2.4.1 Rationale for the choice of ProVerif 14 2.4.2 Specifying Protocols and Security Properties 14 2.4.3 Analysis Technique and Approximation 16 2.4.4 Applications 19 2.5 Prior Work on Formal Analysis of Mobile Telephony Protocols 19 3 Modeling and Analysis of GSM 21 3.1 Overview of GSM AKA 21 3.2 Modeling the GSM AKA 24 3.2.1 Design Choices 24 vi 3.2.2 GSM Model 28 3.3 Security Property Specifications and Findings 33 4 Modeling and Analysis of UMTS 37 4.1 Overview of UMTS AKA 37 4.2 Modeling the UMTS AKA 40 4.2.1 Design Choices 40 4.2.2 UMTS Model 40 4.3 Security Property Specifications and Findings 44 5 Modeling and Analysis of LTE 46 5.1 Overview of LTE AKA 46 5.2 Modeling the LTE AKA 50 5.2.1 Design Choices 50 5.2.2 LTE Model 51 5.3 Security Property Specifications and Findings 57 6 Comparative Authenticity 59 6.1 Authentication of the MS to the SN 59 6.1.1 GSM vs. UMTS 59 6.1.2 UMTS vs. LTE 60 6.2 Authentication of the SN to the MS 62 6.2.1 GSM vs. UMTS 62 6.2.2 UMTS vs. LTE 62 6.3 Summary 64 7 Establishing a Initial Security Context in Interoperation 66 7.1 System Components 66 7.2 Allowed Interoperation Cases 74 7.3 Disallowed Interoperation Cases 75 7.4 Uncertain Interoperation Cases 75 8 Modeling and Analysis of Interoperation Scenarios involving GSM and UMTS Procedures Only 77 8.1 Determining the Scenarios only involving GSM and UMTS Components 77 8.2 Scenario S4: A UMTS MS roams to an SN with a GSM BS and GSM MSC 79 8.2.1 Overview of the AKA Scenario 79 8.2.2 Modeling the AKA Scenario 80 8.2.3 Security Property Specifications and Findings 82 8.3 Scenario S5: A GSM MS roams to an SN with a UMTS BS and UMTS MSC 83 8.3.1 Overview of the AKA Scenario 83 vii 8.3.2 Modeling the AKA Scenario 84 8.3.3 Security Property Specifications and Findings 87 8.4 Scenario S6: A UMTS MS roams to an SN with a GSM BS and a UMTS MSC 87 8.4.1 Overview of the AKA Scenario 88 8.4.2 Modeling the AKA Scenario 88 8.4.3 Security Property Specifications and Findings 90 9 Modeling and Analysis of Scenarios involving LTE Procedures 93 9.1 Determining the Scenarios involving LTE Components 93 9.2 Scenario S7: LTE I k UMTS II{III k [optionally, LTE IV] k LTE V, conv(CK IK ! KASME , MME) 98 9.2.1 Overview of the AKA Scenario 99 9.2.2 Modeling the AKA Scenario 99 9.2.3 Security Property Specifications and Findings 107 9.3 Scenario S8: LTE I' k UMTS II{III k LTE IV{V, conv(CK IK nonces ! KASME , MME) 108 9.3.1 Overview of the AKA Scenario 108 9.3.2 Modeling the AKA Scenario 108 9.3.3 Security Property Specifications and Findings 113 9.4 Scenario S9: GSM I k LTE II{III k [optionally, LTE IV] k GSM IV, conv(CK IK ! Kc, MME), AV = 4G AV + CK + IK 114 9.4.1 Overview of the AKA Scenario 114 9.4.2 Modeling the AKA Scenario 114 9.4.3 Security Property Specifications and Findings 121 9.5 Scenario S10: UMTS I k LTE II{III k [optionally, LTE IV] k UMTS IV, AV = 4G AV + CK + IK 122 9.5.1 Overview of the AKA Scenario 122 9.5.2 Modeling the AKA Scenario 123 9.5.3 Security Property Specifications and Findings 128 10 Summary of Findings 130 10.1 Secrecy and Integrity Properties 130 10.2 Authentication Properties 130 10.2.1 Authentication of the MS to the SN 131 10.2.2 Authentication of the SN to the MS 131 10.3 Attacks 133 11 Conclusion and Future Work 135 Appendix A 138 Bibliography 175 viii Vita 183 ix List of Tables 3.1 Analysis result of GSM model 34 4.1 Analysis result of UMTS model 45 5.1 Analysis result of LTE model 58 6.1 Types of authentication achieved by the pure AKAs 65 6.2 Parameters of the correspondence assertions used in the proved au- thentication properties 65 7.1 Legend used in Table 7.2 67 7.2 Classifying the 243 interoperation cases (legend explained in Table 7.1) 67 8.1 Reasons used for determining AKA scenarios (see Table 9.1 for full set) 78 8.2 Classifying the interoperation cases involving GSM and UMTS com- ponents only. (The reasons are in Table 8.1) 79 8.3 Analysis result of S4 model 83 8.4 Analysis result of S5 model 87 8.5 Analysis result of S6 model 91 9.1 Reasons used for determining AKA scenarios 94 9.2 Classifying the interoperation cases (for GSM, UMTS, and LTE) 95 9.3 Determining components of each scenario 99 9.4 Analysis result of S7 models 107 9.5 Analysis result of S8 model 113 9.6 Analysis result of S9 models 121 9.7 Analysis result of S10 models 129 10.1 Types of SN components authenticity achieved by the scenarios 133 10.2 Analysis results of authentication properties 134 x List of Figures 1.1 Example of an interoperation case1 2.1 Term and Process Grammar 15 3.1 GSM architecture [94, 76] 22 3.2 GSM message sequence diagram [94, 76] 23 3.3 GSM diagram annotated in accord with our model.

Load more

  195

Copy Link