Putting LTE Security Functions to the Test: A Framework to Evaluate Implementation Correctness David Rupprecht Kai Jansen Horst Gortz¨ Institute for IT-Security Horst Gortz¨ Institute for IT-Security Ruhr-University Bochum, Germany Ruhr-University Bochum, Germany
[email protected] [email protected] Christina Popper¨ New York University Abu Dhabi
[email protected] Abstract promise of users as well as service providers. Security- related changes need to be carefully evaluated in order to Long Term Evolution (LTE) is the most recent generation maintain strong protection, especially since LTE is con- of mobile communications promising increased transfer sidered as the communication technology for, e. g., criti- rates and enhanced security features. It is todays commu- cal infrastructures, emergency services, and law enforce- nication technology for mobile Internet as well as con- ment [12]. The increasing dependency on LTE makes it sidered for the use in critical infrastructure, making it an an attractive subject to a wide range of attacks and any attractive target to a wide range of attacks. We evalu- vulnerability could have serious impact on the underly- ate the implementation correctness of LTE security func- ing services. tions that should protect personal data from compromise. By addressing several security issues of the previ- In this paper, we focus on two security aspects: user ous mobile communication specifications, in particular data encryption and network authentication. We de- Global System for Mobile Communications (GSM) and velop a framework to analyze various LTE devices with Universal Mobile Telecommunications System (UMTS), respect to the implementations of their security-related LTE raises the bar in terms of security and applies, e.