Security flaws in the 5G mobile protocol

Jannik Dreier, senior lecturer at the Université de Lorraine (Télécom Nancy) has collaborated with researchers from the ETH Zurich (Swiss Federal Institute of Technology) and the University of Dundee (Scotland) to carry out a very precise security analysis of the future mobile communication system, 5G.
Their conclusion: data protection has been improved in comparison with the previous 3G and 4G standards but flaws remain.

Two thirds of the world’s population or around five billion people use mobile phones on a daily basis. They connect to a mobile network via their SIM cards to make calls, send texts, exchange images or make purchases. On many occasions, criminals have managed to gain access to this form of communication when the phone connects to the network and thereby intercept conversations or steal data. The fifth and latest generation of mobile communication technology (5G) is scheduled to be rolled out by 2020 and should offer users enhanced security. To guarantee this level of security, the mobile and the network must be capable of authenticating each other when connecting to the network. At the same time, exchanges of data, the identity and location of the user must remain confidential. This has been implemented via a communication protocol called the Authentification and Key Agreement (AKA) since the introduction of the 3G standard.

The 5G mobile communication standard has not rectified all the flaws

Using the Tamarin security protocols verification tool developed by the ETH Zurich, the PESTO team in Nancy -which jointly belongs to the Inria and the Loria- and the CISPA in Saarbrücken, the research team ran an in-depth analysis of the 5G AKA protocol. The tool automatically identified the minimum security hypotheses required to attain the security objectives defined in the standard proposed by the 3rd Generation Partnership Project (3GPP). “The analysis showed that the protocol was insufficient to achieve all the critical security objectives as defined in the hypotheses set out in the standard”, explains Jannik who teaches at Télécom Nancy. More specifically, an implementation which is too rapid but respects the standard could lead to situations in which users are billed for other users’ calls.

Possible error rectification before 5G is launched

The protocol will considerably improve data protection compared with the 3G and 4G technologies. Particularly, the 3GPP has succeeded in filling a gap with the new standard which was previously exploited by IMSI-catchers (International Mobile Subscriber Identity). With this equipment, the international identity of a mobile subscriber’s mobile phone card could be read to determine the location of the phone and track the user. To do this, the IMSI-catcher just needed to listen to the transmissions between the mobile phone and the mobile network’s tower. This flaw has been solved with the 5G AKA. However, the researchers found that the protocol still allowed other tracking attacks in which an attacker could still identify a mobile phone and track it even though the phone does not send the user’s complete identity. Given the flaws that were identified, if this new mobile communication technology is introduced with the current specifications, it could lead to many cyber attacks with the ensuing consequences for the protection of users’ privacy. The research team is therefore in contact with 3GPP, the telephone companies’ standardization organization, to jointly implement improvements to the 5G AKA protocol.

In October, their scientific publication was presented at the prestigious 2018 Computer and Communications Security conference in Toronto, one of the main international computer security conferences.

Find out more about CCS2018
Find out more about Jannik Dreier
Find out more about PESTO team