Network service federated identity (NS-FId) protocol for service authorization in 5G network

Fifth generation mobile network (5G) will make network services available anywhere from multiple Service Providers (SP) and its provisioning raises security concerns. The users will require seamless connectivity and secure access to these services. Mobile Network Operator (MNO) will want to provide services to users and be able to share infrastructure resources with other MNOs. This requires robust authentication and authorization mechanisms that can provide secure access and provisioning of service to multiple users and providers in heterogeneous network. Therefore, Federated Identity (FId) with Single Sign On (SSO) could be used for seamless access and provisioning to network services in 5G. So, we propose Network Service Federated Identity (NS-FId) protocol, a federated protocol that provides secure access to services from multiple SPs and provides SSO to users. We formally verify and analyse the proposed NSFId protocol using ProVerif. We also conduct a security analysis of the protocol’s security properties

An identity aware wimax personalization for pervasive computing services

Mobile Internet access is becoming more and more pervasive in the new 4G scenarios, where WiMAX is to play a crucial role. WiMax has advantages when considering both energy consumption and bandwidth, when compared with HSDPA and LTE. However, we have found some limitations in IEEE 802.16 security support, which may limit authentication and authorization mechanisms for ubiquitous service development. In this article we analyze weaknesses and vulnerabilities we have found in WiMAX security. WiMax, with the adequate identity management support, could be invaluable for developing new pervasive computing services. We propose the introduction of identity management in WiMAX, as a pervious step to the definition of identity aware WiMax personalization of pervasive computing servicesProyecto CCG10-UC3M/TIC-4992 de la Comunidad Autónoma de Madrid y la Universidad Carlos III de Madri

Privacy of User Identities in Cellular Networks

This thesis looks into two privacy threats of cellular networks. For their operations, these networks have to deal with unique permanent user identities called International Mobile Subscriber Identity (IMSI). One of the privacy threats is posed by a device called IMSI catcher. An IMSI catcher can exploit various vulnerabilities. Some of these vulnerabilities are easier to exploit than others. This thesis looks into fixing the most easily exploitable vulnerability, which is in the procedure of identifying the subscriber. This vulnerability exists in all generations of cellular networks prior to 5G. The thesis discusses solutions to fix the vulnerability in several different contexts. One of the solutions proposes a generic approach, which can be applied to any generation of cellular networks, to fix the vulnerability. The generic approach uses temporary user identities, which are called pseudonyms, instead of using the permanent identity IMSI. The thesis also discusses another solution to fix the vulnerability, specifically in the identification procedure of 5G. The solution uses Identity-Based Encryption (IBE), and it is different from the one that has been standardised in 5G. Our IBE-based solution has some additional advantages that can be useful in future works. The thesis also includes a solution to fix the vulnerability in the identification procedure in earlier generations of cellular networks. The solution fixes the vulnerability when a user of a 5G network connects to those earlier generation networks. The solution is a hybridisation of the pseudonym-based generic solution and the standardised solution in 5G. The second of the two threats that this thesis deals with is related to the standards of a delegated authentication system, known as Authentication and Key Management for Applications (AKMA), which has been released in July 2020. The system enables application providers to authenticate their users by leveraging the authentication mechanism between the user and the user's cellular network. This thesis investigates what requirements AKMA should fulfil. The investigation puts a special focus on identifying privacy requirements. It finds two new privacy requirements, which are not yet considered in the standardisation process. The thesis also presents a privacy-preserving AKMA that can co-exist with a normal-mode AKMA.Väitöskirjassa tutkitaan kahta yksityisyyteen kohdistuvaa uhkaa mobiiliverkoissa. Näissä verkoissa käyttäjät tunnistetaan yksikäsitteisen pysyvän identiteetin perusteella. Hyökkääjä voi uhata käyttäjän yksityisyyttä sellaisen radiolähettimen avulla, joka naamioituu mobiiliverkon tukiasemaksi. Tällainen väärä tukiasema voi pyytää lähellä olevia mobiililaitteita kertomaan pysyvän identiteettinsä, jolloin hyökkääjä voi esimerkiksi selvittää, onko tietyn henkilön puhelin lähistöllä vai ei. Väitöskirjassa selvitetään, millaisilla ratkaisuilla tämän tyyppisiltä haavoittuvuuksilta voidaan välttyä. Viidennen sukupolven mobiiliteknologian standardiin on sisällytetty julkisen avaimen salaukseen perustuva suojaus käyttäjän pysyvälle identiteetille. Tällä ratkaisulla voidaan suojautua väärän tukiaseman uhkaa vastaan, mutta se toimii vain 5G-verkoissa. Yksi väitöskirjassa esitetyistä vaihtoehtoisista ratkaisuista soveltuu käytettäväksi myös vanhempien mobiiliteknologian sukupolvien yhteydessä. Ratkaisu perustuu pysyvän identiteetin korvaamiseen pseudonyymillä. Toinen esitetty ratkaisu käyttää identiteettiin pohjautuvaa salausta, ja sillä olisi tiettyjä etuja 5G-standardiin valittuun, julkisen avaimen salaukseen perustuvaan menetelmään verrattuna. Lisäksi väitöskirjassa esitetään 5G-standardiin valitun menetelmän ja pseudonyymeihin perustuvan menetelmän hybridi, joka mahdollistaisi suojauksen laajentamisen myös aiempiin mobiiliteknologian sukupolviin. Toinen väitöskirjassa tutkittu yksityisyyteen kohdistuva uhka liittyy 5G-standardin mukaiseen delegoidun tunnistautumisen järjestelmään. Tämä järjestelmä mahdollistaa käyttäjän vahvan tunnistautumisen automaattisesti mobiiliverkon avulla. Väitöskirjassa tutkitaan järjestelmälle asetettuja tietoturvavaatimuksia erityisesti yksityisyyden suojan näkökulmasta. Työssä on löydetty kaksi vaatimusta, joita ei ole toistaiseksi otettu huomioon standardeja kehitettäessä. Lisäksi työssä esitetään ratkaisu, jolla delegoidun tunnistautumisen järjestelmää voidaan laajentaa paremmin yksityisyyttä suojaavaksi

Security for network services delivery of 5G enabled device-to-device communications mobile network

The increase in mobile traffic led to the development of Fifth Generation (5G) mobile network. 5G will provide Ultra Reliable Low Latency Communication (URLLC), Massive Machine Type Communication (mMTC), enhanced Mobile Broadband (eMBB). Device-to-Device (D2D) communications will be used as the underlaying technology to offload traffic from 5G Core Network (5GC) and push content closer to User Equipment (UE). It will be supported by a variety of Network Service (NS) such as Content-Centric Networking (CCN) that will provide access to other services and deliver content-based services. However, this raises new security and delivery challenges. Therefore, research was conducted to address the security issues in delivering NS in 5G enabled D2D communications network. To support D2D communications in 5G, this thesis introduces a Network Services Delivery (NSD) framework defining an integrated system model. It incorporates Cloud Radio Access Network (C-RAN) architecture, D2D communications, and CCN to support 5G’s objectives in Home Network (HN), roaming, and proximity scenarios. The research explores the security of 5G enabled D2D communications by conducting a comprehensive investigation on security threats. It analyses threats using Dolev Yao (DY) threat model and evaluates security requirements using a systematic approach based on X.805 security framework. Which aligns security requirements with network connectivity, service delivery, and sharing between entities. This analysis highlights the need for security mechanisms to provide security to NSD in an integrated system, to specify these security mechanisms, a security framework to address the security challenges at different levels of the system model is introduced. To align suitable security mechanisms, the research defines underlying security protocols to provide security at the network, service, and D2D levels. This research also explores 5G authentication protocols specified by the Third Generation Partnership Project (3GPP) for securing communication between UE and HN, checks the security guarantees of two 3GPP specified protocols, 5G-Authentication and Key Agreement (AKA) and 5G Extensive Authentication Protocol (EAP)-AKA’ that provide primary authentication at Network Access Security (NAC). The research addresses Service Level Security (SLS) by proposing Federated Identity Management (FIdM) model to integrate federated security in 5G, it also proposes three security protocols to provide secondary authentication and authorization of UE to Service Provider (SP). It also addresses D2D Service Security (DDS) by proposing two security protocols that secure the caching and sharing of services between two UEs in different D2D communications scenarios. All protocols in this research are verified for functional correctness and security guarantees using a formal method approach and semi-automated protocol verifier. The research conducts security properties and performance evaluation of the protocols for their effectiveness. It also presents how each proposed protocol provides an interface for an integrated, comprehensive security solution to secure communications for NSD in a 5G enabled D2D communications network. The main contributions of this research are the design and formal verification of security protocols. Performance evaluation is supplementary

Advancing authentication for cellular networks and mobile users

Cellular networks provide connectivity and network services to billions of users. Therefore, it is critically important to protect the cellular network and its users against malicious actors. This thesis contributes to two aspects of cellular network security: authentication and transparency.  Authentication is a crucial element in cellular network security. It is required for authorizing subscribers to access the cellular services, authenticating users to applications, and logging in administrators to the cellular backend. We integrated federated OpenID authentication with an early version of the OpenStack cloud for authenticating the cloud administrators. One of the authentication methods in OpenID was the Generic Bootstrapping Architecture (GBA), which uses the mobile subscriber credentials for the authentication. We performed formal modeling and analysis of OpenID with GBA internetworking. The analysis provided security assurance of the integration for critical applications, such as administering virtual mobile backend functions in the cloud. The security of the mobile subscriber authentication depends on how the user credentials are provisioned, and this is changing from physical SIM cards to remotely downloadable SIM profiles. We perform formal modeling and analysis of the consumer Remote SIM Provisioning (RSP) protocol that is used for downloading the credentials. We verify that the protocol meets its stated and implicit security goals against a network adversary. We also analyze the protocol in realistic partial compromise scenarios, such as in the presence of some compromised servers and phones. We then suggest how to make the protocol more robust in these scenarios.  In the cloud, a tenant relies on the cloud provider for its security. We developed an automated security compliance monitoring tool for the OpenStack cloud. Its primary purpose was to increase trust in the cloud platform and to enable the implementation of virtual network functions. This work was done before commercial cloud providers had widely adopted such compliance monitoring mechanisms. We also designed two transparency mechanisms that enable the tenants and third-party auditors to monitor for security breaches. The first is a smart contract based transparency mechanism for the web PKI, and the second is transparency for issued SIM profiles in RSP.  Overall, this thesis presents research results that have addressed timely and relevant security issues in cellular networks over a time span of about ten years. We have contributed technologies and provided research-based input to the design and implementation of secure cellular networks