TWC: Small: Collaborative: Cellular Network Services in Peril: A Perspective on Control-Plane and Data-Plane Design

蜂窝网络是目前部署的最大的无线基础设施。它为用户提供移动互联网接入和电信级语音服务。每个这样的服务（例如，数据或语音）通常涉及在数据和控制平面上的操作。前者将服务内容传递给用户，后者执行服务实例化、维护、更新和终止等控制功能。因此，确保控制平面和数据平面的安全对移动网络服务至关重要。与互联网建立在“尽力而为”的基础上不同，第四代（4G）移动网络支持多种业务模式。它不仅在网络中提供多个优先级（例如，语音比数据具有更高的优先级），而且还通过不同的无线电信道传输控制和数据。因此，给定一项服务（例如，语音、视频或消息传递），其控制面和数据面操作为安全研究开辟了新的场所。本项目旨在从安全角度研究4G网络中的两个平面。这项研究的成功不仅可以保护数十亿智能手机用户数万亿美元的移动语音市场，还可以保护移动互联网接入免受恶意呼叫的攻击。拟议的活动可能会影响即将到来的5G技术标准化，并培养新一代工程师和学生。拟议中的研究有两个主要目的。一是4G网络业务的不安全性分析。这个项目检查控制和数据平面及其协调。它进行彻底的理论分析，以发现所有潜在的漏洞，探索新的攻击，并经验验证这些实际威胁。另一种是提出防御措施，以确保两架飞机免受此类威胁。该解决方案需要网络和用户、硬件和软件之间的协同努力。该项目寻求做出三个贡献：(1)系统地披露控制平面和数据平面操作的不安全性：两者都会导致当前防御措施无法保护的新漏洞；(2)多种根源识别：移动标准规定松散，设备软硬件相互保护。随着智能手机在两架飞机上的使用变得越来越方便，没有新的保护机制到位。(3)保护控制平面和数据平面操作的解决方案：它在移动设备和网络基础设施内部的硬件和软件上增加了保护。它进一步利用了设备功能，同时保留了灵活的网络服务。

The cellular network is the largest wireless infrastructure deployed today. It offers users mobile Internet access and carrier-grade voice service. Each such service (e.g., data or voice) typically involves operations on both data and control planes. The former transfers service content to users, whereas the latter performs control functions of service instantiation, maintenance, update, and termination. Securing control and data planes is thus critical to mobile network service. Different from the Internet built upon the single best-effort delivery, the fourth-generation (4G) mobile network supports diversified service models. It not only provides multiple priorities within the network (e.g., voice has higher priority than data), but also carries control and data over different radio channels. Consequently, given a service (e.g., voice, video, or messaging), its control-plane and data-plane operations open new venues for security research. This project aims to study both planes in 4G networks from the security perspective. The success of this research will not only protect the trillion-dollar market of mobile voice for billions of smartphone users, but also safeguard the mobile Internet access from attacks initiated by malicious calls. The proposed activity may influence the upcoming 5G technology standardization and train a new generation of engineers and students.The proposed research has two main thrusts. One is the insecurity analysis of 4G network services. This project examines the control and data planes and their coordination. It conducts thorough theoretical analysis to uncover all potential vulnerabilities, explores novel attacks, and empirically validates those practical threats. The other is to propose defenses to secure both planes from such threats. The solution calls for concerted efforts between the network and the user, and between hardware and software. This project seeks to make three contributions: (1) Systematic disclosure of insecurity on the control-plane and data-plane operations: Both incur new breaches that current defense measures fail to protect; (2) Identification of diverse root causes: Mobile standards stipulate loose regulations, whereas device software and hardware assume protection from each other. As both planes become more accessible to smartphones, no new protection mechanisms are in place. (3) Solution that secures both control-plane and data-plane operations: It adds protection at both hardware and software at mobile devices, and inside the network infrastructure. It further leverages device capabilities while preserving flexible network services.