CIS 6930 - Cellular and Mobile Network Security: Cellular Networking - PowerPoint PPT Presentation

CIS 6930 - Cellular and Mobile Network Security: Cellular Networking Professor Patrick Traynor 9/18/2018 Florida Institute for Cybersecurity (FICS) Research

The Big Picture Details create the big picture. -Sanford I. Weill Florida Institute for Cybersecurity (FICS) Research 2

Overview Evolution • Architecture • Air Interfaces • Network Protocols • Application: Messaging • Florida Institute for Cybersecurity (FICS) Research 3

Cellular Systems Wireless Access • TDMA (IS-136, GSM) • CDMA (IS-95, CDMA2000) • WCDMA (UMTS) • Connection oriented networks for voice • PSTN (ISDN) • Packet overlay networks for data • General Packet Radio Service (GPRS) - GSM and UMTS • Enhanced Version Data “Optimized” (EVDO) - CDMA • Rebranded from “Data Only” • Signaling protocols • Signaling system number 7 (SS7) for voice and GPRS • IETF protocols for EVDO • Florida Institute for Cybersecurity (FICS) Research 4

Wireless Standards Evolution to 4G 3G 4G Existing 1G 2G 700 MHz 2.5G 2.75G Spectrum Analog IS-95-A/ 
 IS-95-B/ 
 CDMA2000 1xRTT CDMA2000 AMPS cdmaOne cdmaOne 3x (5 MHz) (1.25 MHz) CDMA2000 1xEVDO (1.25 MHz) LTE (1.4, 3, 5, 10, 15, 20 MHz) IS-136 TDMA WiMAX TACS GSM GSM GPRS EDGE WCDMA GSM (UMTS) HSCSD Florida Institute for Cybersecurity (FICS) Research 5

Reference Architecture VLR VLR BSC BSC MSC AuC HLR MS BSC BTS PSTN/ISDN MSC BTS BTS HLR Wireless MS: Mobile Subscriber/Station • MSC Network BTS: Base Transceiver Station • BSC: Base Station Controller • MSC: Mobile Switching Center • HLR: Home Location Register • AuC: Authentication Center • VLR: Visitor’s Location Register • Florida Institute for Cybersecurity (FICS) Research 6

Basic Network Architecture MSC VLR VLR MSC SMSC MS BS Network HLR GMSC BS BS Gateway MSC receives incoming calls for phones. • Serving MSC assigned based on location • HLR: Permanent registry for service profiles, pointer to VLR • VLR: Temporary repository for profile information, pointer to SMSC. • Florida Institute for Cybersecurity (FICS) Research 7

Cellular Services Automatic call delivery • find a user, deliver a call • IN-type services • e.g., call forwarding • Messaging • short message service • Connection oriented user data transfer • voice, fax, circuit-switched data • Packet Data • General Packet Radio Service (GPRS) - GSM and UMTS • Enhanced Version Data “Optimized” (EVDO) - CDMA • Florida Institute for Cybersecurity (FICS) Research 8

High Level Call Flow Mobile User Registers • Power up/down • Movement • Periodic • Call recipient located • Call routed to gateway or home MSC • Gateway MSC searches for called mobile (via HLRs and VLRs) • Mobile user is paged (determines current base station) • Call delivered • Uses standard SS7 procedures • Florida Institute for Cybersecurity (FICS) Research 9

Delivering a Call MSC GMSC 2. 404-894-2000 BS maps to HLR X 8. Call to 999-xxx 7. 999-xxx 4. How do I deliver call VLR 5. 999-xxx to User 222? 9. Page 10. Call Network HLR SMS 3. How do I deliver call MS BS 6. 999-xxx to User 222? 1. 404-894-2000 BS Florida Institute for Cybersecurity (FICS) Research 10

Protocols of Note MSC Mobility Management Protocols GSM-MAP , ANSI41-MAP VLR HLR MSC MS SS7 BS PSTN/ISDN Air Interfaces GSM , IS136, IS-95, UMTS BS BS Florida Institute for Cybersecurity (FICS) Research 11

Mobile Registration - High Level Old Old HLR VLR MSC BS VLR SMSC Update Location Cancel Location OK Florida Institute for Cybersecurity (FICS) Research 12

Mobile Call Delivery - High Level Gateway HLR VLR MSC BS MSC Call Request Request Routing Info Routing Number Call SS7 Call Delivery Request Page Connect Florida Institute for Cybersecurity (FICS) Research 13

Security Moment - Location Granularity Commonly heard assertion: “The phone company knows exactly where all • of their customers are located at every moment.” 
 Virtually all phones are equipped with some type of GPS resolution. 
 • Is this true? • What are the security implications? • What services could be enabled? • Florida Institute for Cybersecurity (FICS) Research 14

Hierarchy of Location Information VLR Registration HLR VLR Registration Phone Temporary Number Routing # SMSC MSC MSC GMSC Paging Florida Institute for Cybersecurity (FICS) Research 15

E911 Enhanced 911 (E911) transmits your GPS location to the nearest Public Safety • Answering Point (PSAP). This is how you always get the nearest 911 call center, regardless of where • you are traveling in North America. But what about the “Location On” vs. “E911 Only” options available on most • phones? “Location On” does not allow the phone company to constantly track you. • It instead allows services within the network to use your GPS data when you initiate them (e.g., Verizon Navigator, Family Locator). The phone company simply can not keep track 
 • of all the changes in location information at 
 every moment! Florida Institute for Cybersecurity (FICS) Research 16

Voice Path VLR HLR MSC MS BS PSTN/ISDN Coded Voice Full rate voice (64 Kbps) This is under the assumption that the underlying network 
 • supports digital voice. What does that mean? • Florida Institute for Cybersecurity (FICS) Research 17

Analog vs Digital Phone systems are generally classified as either analog or digital. • What exactly does that mean? 
 • This is all about how data is represented and delivered through the network. 
 • Analog is the translation of voice/sound into electrical impulses. • Pure waveform representations of sounds. 
 • Digital is an approximation of this waveform, 
 • represented in 0s and 1s. Florida Institute for Cybersecurity (FICS) Research 18

Analog vs Digital - Tradeoffs Analog • Inexpensive - think cheap home phones • Bandwidth constrained - very limited amount of data can be sent. • Security thoughts? • Noise - every link introduces noise, reduces clarity. • Digital • Expensive - relatively speaking • Improved voice clarity - signal arrives exactly as approximated. • What about quality? • Higher bandwidth - compression of data. • Florida Institute for Cybersecurity (FICS) Research 19

Voice Encoding - GSM-FR/PCM/G.711 Pulse Code Modulation (PCM) is the basis for GSM Full-Rate (GSM-FR) • voice encoding. 8 kHz samples (64 kbps) reduced to 13.2 kbps using Regular Pulse • Excitation - Long Term Prediction (RPE-LTP). Converted back to 64 kbps at MSC prior to Release 4. • Changes in the core towards “TrFO” for all IP . • ... ... ... ... 20 msec 20 msec 160 Samples 160 Samples 260-bit frame RTP-LTP RTP-LTP Encoder Decoder Sender Receiver Florida Institute for Cybersecurity (FICS) Research 20

Air Interface Functions Control • read system parameters • authenticate • update location • receive and originate calls • manage handoffs • Dedicated traffic • voice, data • Shared Traffic • Messaging, data, signaling • Florida Institute for Cybersecurity (FICS) Research 21

Wireless Access Basics Frequency Division Multiple Access (FDMA): • Analog cellular - 1G 
 • Time Division Multiple Access (TDMA): • IS-54, IS-136, FSM - 2G • GPRS - 2.5G 
 • Code Division Multiple Access (CDMA): • IS-95 (cdmaOne) - 2G • IS-2000 (CDMA2000), WCDMA - 3G • Florida Institute for Cybersecurity (FICS) Research 22

FDD/TDD modes for Forward/Reverse Channels Frequency Division Duplex (FDD) • Two distinct bands of frequency for each user (forward and reverse). • Frequency separation between forward and reverse constant for all channels. • Reverse channel typically lower frequency than forward channel (so that the • mobile device can transmit at lower power). Time Division Duplex (TDD) • Each duplex channel has a forward timeslot and reverse timesolt for bidirectional • communication. Simplifies subscriber equipment. • Rigid timing required for time-slotting. • Florida Institute for Cybersecurity (FICS) Research 23

Background - AMPS Advanced Mobile Phone System • Analog Channels • Frequency Modulation (FM) • 1 channel per carrier (1 conversation) • f c Florida Institute for Cybersecurity (FICS) Research 24

Background - TDMA Combination of FDMA and TDMA • System operated within certain frequency bands • Within system bands: • many carrier frequencies are defined • each carrier is divided into timeslots • a channel is defined by a set of time slots on a carrier frequency • Forward (downlink) and Reverse (uplink) channels use different carriers. • Information is digitally coded. • Florida Institute for Cybersecurity (FICS) Research 25

TDMA Overview One Carrier/ One Slot One User Channel Co-channel Interference • Inter-symbol Interference • A M D T Capacity limited by • number of carriers, slots. System Bandwidth FDMA Florida Institute for Cybersecurity (FICS) Research 26