CS 8803 - Cellular and Mobile Network Security: GSM - In Detail - PowerPoint PPT Presentation

CS 8803 - Cellular and Mobile Network Security: GSM - In Detail Professor Patrick Traynor 10/2/18 Florida Institute for Cybersecurity (FICS) Research

Cellular Telecommunications Architecture • Background • Air Interfaces • Network Protocols • Application: Messaging • Research • Florida Institute for Cybersecurity (FICS) Research 2

GSM The Global System for Mobile Communications (GSM) is the de facto • standard for wireless communications with well over 5 billion users. As a comparison, there are approximately 1.5 billion Internet users. 
 • The architectures of other network are similar, so knowing how to “speak • GSM” will get you a long way in this space. 
 Florida Institute for Cybersecurity (FICS) Research 3

Wireless Signaling and Control in GSM Common Control Channel • Structure • Broadcast Channels • Channel Access from Mobile • Procedures and Messages for Call Control 
 • Traffic Channel • Structure Handoffs • Florida Institute for Cybersecurity (FICS) Research 4

GSM Control Functions Read System Parameters • Register • Receive and Originate Calls • Manage Handoffs • Florida Institute for Cybersecurity (FICS) Research 5

GSM Structure Traffic Channel (per user in a call) Common Control Channel (CCCH) TCH (13 KBps) Common Control Channel (CCCH) • Used for control information: registration, paging, call origination/termination. • Traffic Channel (TCH) • Information transfer • in-call control (fast/slow associated control channels) • Florida Institute for Cybersecurity (FICS) Research 6


 
 GSM TDMA Frames TDMA Frame: 
 • Slot 7 Frame: 4.615 msec Slot 0 Slot 1 Slot 2 Slot 3 Slot 4 Slot 5 Slot 6 51 Multiframe: Frame 0 Frame 1 Frame 2 ... Frame 50 235.365 msec Florida Institute for Cybersecurity (FICS) Research 7

From Frames to Channels 26 Multiframe: 120.00 ms 7 } 0 1 2 3 Frame: 4 4.615ms 5 6 Florida Institute for Cybersecurity (FICS) Research 8

GSM CCCH Reverse Forward Forward Forward Forward (MS BS) (BS MS) (BS MS) (BS MS) (BS MS) Random Access Paging and Synchronization Broadcast Frequency Control Channel Access Grant Channel Control Correction (RACH) Channel (PAGCH) (SCH) Channel Channel (BCCH) (FCCH) PCH AGCH Florida Institute for Cybersecurity (FICS) Research 9


 
 
 
 
 
 
 
 GSM CCCH Structure TDMA Frame: 
 • Slot 7 Frame: 4.615 msec Slot 0 Slot 1 Slot 2 Slot 3 Slot 4 Slot 5 Slot 6 51 Multiframe: Frame 0 Frame 1 Frame 2 ... Frame 50 235.365 msec Uplink: Channel Name (Frame #) Downlink 
 • RACH (0) ... RACH (50) FCCH (0) SCH (1) BCCH (2-5) PAGCH (6-9) FCCH (10) SCH (11) PAGCH (12-19) FCCH (20) SCH (21) PAGCH (22-29) PAGCH (11) FCCH (30) SCH (31) PAGCH (32-39) FCCH (40) SCH (41) PAGCH (42-49) I (50) CCCH/RACH always uses Slot 0 of each frame; other seven slots for TCH • TCH: 26 multi-frame repeats every 120 msec (13th and 16th frames are used by Slow Associated Control Channel (SACCH) or is idle • Florida Institute for Cybersecurity (FICS) Research 10

GSM: BCCH Broadcast to all users on the CCCH • No addressing • Used to acquire system parameters, so mobile may operate with the system. • Key parameters (contained in RR SYSTEM INFORMATION MESSAGES ): • RACH control parameters • cell channel descriptions (frequencies) • neighbor cells (frequencies) • cell id • Location Area ID (LAI) • Control Channel description • Florida Institute for Cybersecurity (FICS) Research 11

GSM: FCCH and SCH Keeps system synchronization • What do you mean, synchronization? • Broadcasts Basestation ID • Why is this useful information? • Florida Institute for Cybersecurity (FICS) Research 12

GSM: Mobile Channel Access Procedures (RACH) MS Communicates with BS over RACH • Only initially and must compete for this shared resource. • Feedback provided with AGCH • Points the user to a dedicated channel for real exchanges. • Functions: • Responses to paging messages • Location update (registration) • Call Origination • Florida Institute for Cybersecurity (FICS) Research 13

GSM: Paging Channel (PCH) Used to send pages to mobile devices. • Notifications of incoming services (e.g., voice, data, SMS) • Done at regular intervals • Mobiles belong to a paging class • Allows the device to sleep, conserve power • More than 1 mobile paged at a time. • Florida Institute for Cybersecurity (FICS) Research 14

GSM: RACH and Slotted ALOHA (Layer 2) Slotted ALOHA • Operation Assumptions • when node obtains fresh frame, it transmits in next slot • all frames same size • no collision, node successfully • time is divided into equal size transmitted the frame slots, time to transmit 1 frame • if collision, node retransmits • frame in each subsequent slot nodes start to transmit with prob. p until success frames only at beginning of slots • clocks are synchronized • if 2 or more nodes transmit in slot, all nodes detect collision Florida Institute for Cybersecurity (FICS) Research 15

GSM: More Slotted ALOHA Pros • single active node can continuously transmit at full rate of channel • highly decentralized: only slots in nodes need to be in sync • simple Cons • collisions, wasting slots • idle slots • nodes may be able to detect collision in less than time to transmit packet • clock synchronization Florida Institute for Cybersecurity (FICS) Research 16

GSM: Slotted ALOHA Efficiency • For max efficiency with N Efficiency is the long-run 
 nodes, find p* that fraction of successful slots 
 maximizes 
 when there are many nodes, each with many frames to send Np(1-p) N-1 • For many nodes, take • Suppose N nodes with many frames to send, limit of Np*(1-p*) N-1 as N each transmits in slot with probability p goes to infinity, gives 1/e = .37 • prob that node 1 has success in a slot 
 = p(1-p) N-1 At best: channel • prob that any node has a success = Np(1-p) N-1 has maximum throughput of 37%! Florida Institute for Cybersecurity (FICS) Research 17

GSM: RACH Procedures (Layer 2) Mobile • sends assignment request with information • Basestation • sends back assignment with information echoed • Creates Radio Resource (RR) connection • “Standalone Dedicated Control Channel” • May be a physical channel • May be a traffic channel in signaling-only mode • May eventually be bandwidth stolen from TCH (associated control channel). • Florida Institute for Cybersecurity (FICS) Research 18

Basic Flow on Air Interface Alert phone of incoming activity Request dedicated signaling channel Signal Release signaling channel Florida Institute for Cybersecurity (FICS) Research 19

GSM Signaling Signaling in GSM occurs over the Radio Interface Layer 3 (RIL-3). • Technically layer 3, but debatable from OSI perspective as application- • esque things happen here. 
 Control messages are handled by protocol control processes and include • Call Control (CC), Mobility Management (MM), Radio Resource management (RR), Short Messaging Service management (SMS) and Supplementary Services management (SS). Florida Institute for Cybersecurity (FICS) Research 20

GSM Signaling (cont) CC • Call establishment, in-call signaling, tone signaling • MM (uses RR) • common: temporary ID maintenance (TMSI), authentication, 
 • de-registration RR • Paging, handoffs, cipher mode • SMS • Text Messages • SS • Call waiting, call forwarding, group call • Florida Institute for Cybersecurity (FICS) Research 21

Time Out: Privacy? With all of this signaling going over well-known channels, isn’t there a risk • of user tracking/profiling? Think about the PCH... what is transmitted here? 
 • Florida Institute for Cybersecurity (FICS) Research 22

GSM Registration Types • Power up and down • Location Area changes (mobility) • Periodic • User Privacy • Mobile device may transmit real address: International Mobile Subscriber Identity • (IMSI) Get back temporary id (TMSI) • Unique to a local area • Subsequent registrations use TMSI • Florida Institute for Cybersecurity (FICS) Research 23

GSM: Registration, High Level Get SDCCH RR connection established Authenticate Cipher UpdateLocation Release RR connection Florida Institute for Cybersecurity (FICS) Research 24

GSM Registration: Gory Details More details on this “authentication” procedure soon... • Get SDCCH RR connection established LOC UPD RQST Authentication Request (RAND) Authentication Response (SRES) Cipher Mode Cipher Mode Complete LOC UPD ACC (TMSI Assigned) TMSI RE-ALLOC Complete Release RR connection Florida Institute for Cybersecurity (FICS) Research 25

GSM: Call Termination (Receive a Call) Page Request (TMSI) Get SDCCH Channel Request Channel Assignment RR connection established SABM(Page Response) UA(Page Response) Authentication and Ciphering SETUP Call Confirmed Alert Assignment Command Assignment Complete Connect Connect ACK Florida Institute for Cybersecurity (FICS) Research 26