Reliable and secure routing is essential for the connectivity of critical communications networks, ensuring that data packets reach their intended destinations without being intercepted, altered or dropped. Inadequate routing security can make the entire network susceptible to attacks such as Internet Protocol (IP) spoofing, route hijacking and man-in-the-middle attacks.

With the increasing complexity and ubiquity of IP network infrastructures across the globe, the security of core routing protocols — including the Border Gateway Protocol (BGP) and the Resource Public Key Infrastructure (RPKI) — is an integral facet of the cybersecurity landscape. Malicious actors and threat vectors that target the network routing layer can lead to severe disruptions, such as data leakage, network outages and unauthorized access to sensitive information.

To address the issue, CableLabs has just released a “Cybersecurity Framework Profile for Internet Routing” (Routing Security Profile, or RSP) that serves as a foundation for improving the security of the internet’s routing system. The RSP is an actionable and adaptable guide, aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), that enables Internet Service Providers (ISPs), enterprise networks, cloud service providers and organizations — large and small — to proactively identify risks and mitigate threats to enhance routing infrastructure security.

The RSP was developed as an extension of CableLabs’ and the cable industry’s longstanding leadership and commitment to building and maintaining a more secure internet ecosystem. It also was developed in response to NIST’s call to action to submit examples of “profiles” mapped to the CSF that are aimed at addressing cybersecurity risks associated with a particular business activity or operation.

What Is the Routing Security Profile, and Who Can Use It?

Network engineers, IT managers, cybersecurity professionals and decision-makers involved in network security risk management are prime candidates for using the RSP — with its exclusive focus on routing protocols and services — as one tool in an overall network strategy to enhance existing security policies and risk management procedures within their organizations.

The RSP describes various technologies and techniques used for internet routing security, including BGP, Internet Routing Registries (IRRs), Autonomous System (AS) path filtering and RPKI. In addition, it outlines several key recommendations for improving BGP security that include Route Origin Authorizations (ROAs), Route Origin Validation (ROV), BGP peer authentication, prefix filtering and monitoring for anomalies.

What Can the Routing Security Profile Do?

By mapping routing security best practices and standards to the applicable key categories and subcategories of the NIST CSF 1.1’s Core Functions — Identify, Protect, Detect, Respond and Recover — the RSP can help organizations with the following tasks:

• Identifying systems, assets, data and risks that pertain to IP networks.
• Protecting IP networks by performing self-assessments and adhering to cybersecurity principles.
• Detecting cybersecurity-related disturbances or corruption of IP network services and data.
• Responding to IP network service or data anomalies in a timely, effective and resilient manner.
• Recovering the IP network to proper working order after a cybersecurity incident.

The RSP is a framework for improving security and managing risks for internet routing, which is one key piece of a larger critical infrastructure cybersecurity puzzle. As with any endeavor in security, the RSP will evolve over time to reflect changes to the NIST CSF, including the CSF 2.0 update coming in early 2024, advances in routing security technologies and the rapidly emerging security threat landscape.

The RSP was developed by CableLabs’ Cable Routing Engineering for Security and Trust Working Group (CREST WG). The CREST WG is composed of routing security technologists from CableLabs, NCTA — The Internet & Television Association, as well as network operators from around the world, including representatives from Armstrong, Charter, Comcast, Cox, Eastlink, Liberty Global, Midco, Rogers/Shaw and Videotron. For more information on the CREST WG, please contact us.

We welcome feedback on the RSP from other internet ecosystem stakeholders as we continue to advance this work. Please send comments to Tao Wan. We will also engage with the broader internet community through forums such as M 3AAWG to drive awareness and to further improve the profile for the benefit of all AS operators, including ISPs, cloud service providers, government agencies, universities and other organizations.

Today, 5G mobile networks are being deployed rapidly around the globe. According to GSMA Mobile Economy 2021, 5G mobile connections in North America accounted for 3 percent of all mobile connections in 2020, but that number is expected to climb to 51 percent by 2025.

On top of the accelerated deployment of public 5G networks, private 5G networks based on unlicensed spectrum and open 5G solutions supporting open interfaces and interoperability are also emerging. It’s anticipated that 5G networks—both public and private—will become predominant in the near future.

From a security perspective, 5G networks introduce both new security enhancements and new security challenges. Particularly, the move of 5G core networks to service-based and virtualized architectures will create new security challenges. How to securely deploy 5G networks to protect both subscribers and 5G network infrastructure is of top concern to both executives and practitioners using and managing 5G technologies.

Filling the Gap in 5G Security Standards

The good news is that the National Cybersecurity Center of Excellence (NCCoE), part of the National Institute of Standards and Technology (NIST), is developing 5G cybersecurity guidance to help organizations effectively mitigate 5G-related security risks. In particular, the NCCoE seeks to address the gap in current 5G cybersecurity standards development, which primarily focuses on the security of the interfaces between 5G components. These standards don’t specify the cybersecurity protections for the underlying IT components that support and operate the 5G system.

CableLabs, along with our fellow collaborators, worked with the NCCoE on developing a 5G cybersecurity practice guide and a secure 5G reference architecture to mitigate 5G cybersecurity risks. We considered both 5G standards-based security features and a secure cloud-based hosting IT infrastructure.

The guide provides recommendations related to implementing a secure cloud environment for hosting 5G core networks—for example, by leveraging server hardware root of trust to enable remote attestation of the trustworthiness of cloud computing platforms. To date, 3GPP SA3 has yet to complete its study of security impacts resulting from the virtualization of the 5G core. Therefore, the NCCoE’s guidance and recommendations for securing the 5G cloud platform will help fill the gap in current 5G security standards and help inform 3GPP’s work in this area.

Share Your 5G Expertise

We encourage you to review the preliminary draft guide and share your expertise with us by June 27. Submit your feedback online or send an email to 5G-security@nist.gov.

Today, CableLabs is releasing a set of best common practices to help accelerate the deployment of Resource Public Key Infrastructure (RPKI), which can mitigate the risk of IP prefix hijacking.

All broadband networks serving residential and business users consist of both access networks and IP networks. The access network connects residential homes and business premises to the broadband provider’s IP network. IP networks are then interconnected, using the Border Gateway Protocol (BGP), to form the internet.

A common disruption to BGP and the exchange of traffic between IP networks is IP prefix hijacking, which can occur accidentally (e.g., by misconfiguration) or intentionally (e.g., by malicious parties).

Incidents of IP prefix hijacking occurred as early as 1997, when a top-level autonomous system (AS) accidentally advertised routes for a large number of IP prefixes belonging to other network operators, creating a routing black hole and major disruption to the internet. Since then, IP prefix hijacking has occurred regularly, causing service disruption to hundreds of millions of internet users, and is considered one of the top threats to internet availability.

Fortunately, network operators and the broader industry have come together to address the risk of IP prefix hijacking. Specifically, RPKI has been standardized by Internet Engineering Task Force (IETF) with deployment strategies outlined by the Messaging Malware Mobile Anti-Abuse Working Group (M³AAWG) and is being deployed by cable operators and other network operators to prevent IP prefix hijacking. RPKI allows the rightful owner of IP address spaces to cryptographically assert the ownership of their prefixes. It then allows other parties to verify received BGP routes against the trusted cryptographic assertions to detect prefix hijacking. Today, about a third of IP prefixes announced on the internet are digitally signed using RPKI.

To help speed up the deployment of RPKI across the internet and improve the resilience of all networks, CableLabs is releasing an RPKI deployment best common practices (BCP) document. This document was developed by BGP experts from CableLabs and its members (including Charter, Comcast, Cox and Liberty Global) who have successfully deployed RPKI in their networks.

The RPKI deployment BCP provides a five-step guide to deploy both Route Origin Authorization (ROA) and Route Origin Validation (ROV), two major components of RPKI. In addition, it provides guidance on the monitoring of RPKI and BGP to ensure continuous health of the routing infrastructure.

To that end, we invite you to download the CableLabs BCP as a resource in deploying and maintaining RPKI in your networks. With the widespread deployment of RPKI, we can minimize the risk of IP prefix hijacking and increase the security and resiliency of the internet.

You might have heard of False Base Station (FBS), Rogue Base Station (RBS), International Mobile Subscriber Identifier (IMSI) Catcher or Stingray. All four of these terminologies refer to a tool consisting of hardware and software that allow for passive and active attacks against mobile subscribers over radio access networks (RANs). The attacking tool (referred to as FBS hereafter) exploits security weaknesses in mobile networks from 2G (second generation) to 3G, 4G and 5G. (Certain improvements have been made in 5G, which I’ll discuss later.)

In mobile networks of all generations, cellular base stations periodically broadcast information about the network. Mobile devices or user equipment (UE) listen to these broadcasting messages, select an appropriate cellular cell and connect to the cell and the mobile network. Because of practical challenges, broadcasting messages aren’t protected for confidentiality, authenticity or integrity. As a result, broadcasting messages are subject to spoofing or tampering. Some unicasting messages aren’t protected either, also allowing for spoofing. The lack of security protection of mobile broadcasting messages and certain unicasting messages makes FBS possible.

An FBS can take various forms, such as a single integrated device or multiple separated components. In the latter form [1], an FBS usually consists of a wireless transceiver, a laptop and a cellphone. The wireless transceiver broadcasts radio signals to impersonate legitimate base stations. The laptop connects to the transceiver (e.g., via an USB interface) and controls what to broadcast as well as the strength of the broadcasting signal. The cellphone is often used to capture broadcasting messages from legitimate base stations and feed into the laptop to simplify the configuration of the transceiver. In either form, an FBS can be made compact with a small footprint, allowing it to be left in a location unnoticeably (e.g., mounted to a street pole) or carried conveniently (e.g., inside a backpack).

An FBS often broadcasts the same network identifier as a legitimate network but with a stronger signal to lure users away. How much stronger does an FBS’s signal need to be to succeed? The answer to that question hasn’t been well understood until recently. According to the experiments in the study [2], an FBS’s signal must be more than 30db stronger than a legitimate signal to have any success. When the signal is 35db stronger, the success rate is about 80 percent. When it’s 40db stronger, the success rate increases to 100 percent. In these experiments, FBS broadcasts the same messages with the same frequency and band as the legitimate cell. Another strategy taken by an FBS is to broadcast the same network identifier but with a different tracking area code, tricking the UE into believing that it has entered a new tracking area, and then switch to the FBS. This strategy can make it easier to lure the UE to the FBS and should help reduce the signal strength required by the FBS to be successful. However, the exact signal strength requirement in this case wasn’t measured in the experiments.

Once camped at an FBS, a UE is subject to both passive and active attacks. In passive attacks, an adversary only listens to radio signals from both the UE and legitimate base stations without interfering with the communication (e.g., with signal injection). Consequences from passive attacks include—but are not limited to—identity theft and location tracking. In addition, eavesdropping often forms a stepping stone toward active attacks, in which an adversary also injects signals. An active attacker can be a man-in-the-middle (MITM) or man-on-the-side (MOTS) attacker.

In MITM attacks, the attacker is on the path of the communication between a UE and another entity and can do pretty much anything to the communication, such as reading, injecting, modifying and deleting messages. One such attack is to downgrade a UE to 2G with weak or null ciphers to allow for eavesdropping. Another example of an MITM attack is aLTEr [3], which only tampers with DNS requests in LTE networks, without any downgrading or tampering of control messages. Although user plane data is encrypted in LTE, it’s still subject to tampering if the encryption (e.g., AES counter mode) is malleable due to the lack of integrity protection.

In MOTS attacks, an attacker doesn’t have the same amount of control over communication as with an MITM attack. More often, the attacker injects messages to obtain information from the UE (e.g., stealing the IMSI by an identity request), send malicious messages to the UE (e.g., phishing SMS) or hijack services from a victim UE (e.g., answering a call on behalf of the UE [4]). A MOTS attacker, without luring a UE to connect to it, can still interfere with existing communication—for example, by injecting slightly stronger signals that are well timed to overwrite a selected part of a legitimate message [2].

FBS has been a security threat to all generations of mobile networks since 2G. The mitigation to FBS was studied by 3GPP in the past—however, without any success due to practical constraints such as deployment challenges in cryptographic key management and difficulty in timing synchronization. In 5G release 15 [5], network side detection of FBS is specified, which can help mitigate the risk, albeit fail to prevent FBS. 5G release 15 also introduces public key encryption of subscriber permanent identifier (SUPI) before it is sent out from the UE, which—if implemented—makes it difficult for FBS to steal SUPI. In 5G release 16 [6], FBS is being studied again. Various solutions have been proposed, including integrity protection of broadcasting, paging and unicasting messages. Other detection approaches have also been proposed.

Our view is that FBS arises mainly from the lack of integrity protection of broadcasting messages. Thus, a fundamental solution is to protect broadcasting messages with integrity (e.g., using public key based digital signatures). Although challenges remain with such a solution, we don’t believe those challenges are insurmountable. Other solutions are based on the signatures of attacks, which may help but can eventually be bypassed when attacks evolve to change their attacking techniques and behaviors. We look forward to agreement from 3GPP SA3 on a long-term solution that can fundamentally solve the problem of FBS in 5G.

To learn more about 5G in the future subscribe to our blog.

References

[1] Li, Zhenhua, Weiwei Wang, Christo Wilson, Jian Chen, Chen Qian, Taeho Jung, Lan Zhang, Kebin Liu, Xiangyang Li, and Yunhao Liu. “FBS-Radar: Uncovering Fake Base Stations at Scale in the Wild.” In Proceedings of ISOC Symposium on Network and Distributed Systems Security (NDSS), February 2017.

[2] Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song Min Kim, and Yongdae Kim. “Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE.” In Proceedings of 28th USENIX Security Symposium (USENIX Security), August 2019.

[3] Rupprecht D, Kohls K, Holz T, and Popper C. “Breaking LTE on Layer Two.” In Proceedings of IEEE Symposium on Security & Privacy (S&P), May 2019.

[4] Golde N, Redon K, and Seifert JP. “Let Me Answer That for You: Exploiting Broadcast Information in Cellular Networks.” In Proceedings of the 22nd USENIX Security Symposium (USENIX Security), August 2013.

[5] 3GPP TS 33.501, “Security Architecture and Procedures for 5G System” (Release 15), v15.5.0, June 2019.

[6] 3GPP TR 33.809, “Study on 5G Security Enhancement against False Base Stations” (Release 16), v0.5.0, June 2019.

The 5G (fifth generation) of cellular mobile communication is among the hottest technologies today and is under development by 3GPP. Besides providing faster speed, higher bandwidth, and lower latency, 5G also supports more use cases, such as:

• Enhanced Mobile Broadband (eMBB)
• Massive Machine Type Communications (mMTC)
• Ultra Reliable Low Latency Communications (uRLLC)

With global deployment imminent, privacy and security protection are of critical importance to 5G. Calls, messaging, and mobile data must be protected with authentication, confidentiality, and integrity. Authentication and key agreement form the cornerstone of mobile communication security by providing mutual authentication between users and the network, as well as cryptographic key establishment that is required to protect both signaling messages and user data. Therefore, each generation of cellular networks defines at least one authentication method. For example, 4G defines EPS-AKA. 5G defines three authentication methods: 5G-AKA, EAP-AKA’, and EAP-TLS. Network practitioners are asking what motivates the adoption of the new 5G authentication methods, how they differ from 4G authentication, and how they differ from each other.

To answer these questions, CableLabs studied and compared 4G and 5G authentication. Our analysis shows that 5G authentication improves 4G EPS-AKA authentication in a number of areas. For instance, 5G offers a unified authentication framework for supporting more use cases, better UE identity protection, enhanced home network control, and additional key separation in key derivation. This study also points out that 5G authentication is not without weakness and requires continuous evolvement.

For more information, please download the “A Comparative Introduction of 4G and 5G Authentication” white paper. Be sure to contact Tao Wan if you have questions.