NSF Convergence Accelerator Track G: Building Resilient and Secure 5G Systems (BRASS)

目前正在开发的5G无线通信技术依赖于各种各样的设备，包括基站、无线电和最终用户设备。这些设备中的大多数都包含许多不同的处理器，每个处理器都运行复杂的固件，每个处理器都可能容易受到网络攻击。构建弹性和安全的5G系统（BRASS）项目解决了5G设备低级固件利用的挑战，从而防止了主要类别的攻击。Red Balloon Security （RBS）在BRASS中针对的主要研究挑战是：如何在具有多个供应商和5G设备固件中几乎肯定存在的未知尚未发现的漏洞的多样化供应链环境中为5G主机提供安全性-特别是考虑到固件格式极端多样性的挑战，以及经常缺乏访问源代码和/或硬件设计信息？目前，解决这些挑战需要专家对每个设备、每个处理器和每个固件进行大量的逆向工程。BRASS项目将研究将被动和主动固件保护自动化和加速集成到关键和脆弱环境中的平台的方法。利用红气球安全公司（RBS）在固件安全解决方案商业化方面的经验，BRASS不仅将产生一个原型，可以解决预期的国防部（DoD）任务场景，并可以过渡到国防部的操作使用，而且还可以创建5G原始设备制造商（oem）希望将其纳入其产品的保护。鉴于BRASS专注于解决5G设备多样性带来的挑战，BRASS将支持RBS的更广泛目标，即为广泛的网络物理系统（CPS）嵌入式固件提供世界级的保护。BRASS对RBS核心固件分析和修改工具链的改进将公开提供，支持各种固件分析、改进和强化应用程序。红气球安全公司（RBS）率先并成功部署了新颖的基于主机的嵌入式固件防御技术，能够预防和/或检测大型网络攻击，包括利用零日漏洞的攻击。这些功能使用RBS的开放固件反向分析控制台（OFRAK）工具包合并到候选固件中，该工具包不需要访问源代码。在BRASS中，RBS将：1)对终端用户设备上的基带固件应用固件保护，在任意网络环境中保护它们（轨道G.1、G.2、G.3）；2)对5G基础设施设备中的平台和无线电前端固件实施固件保护，不影响其网络功能（G.2和G.3轨道）；3)使用OFRAK的自动删除功能删除实现非必要5G功能的代码，从而删除代码可能包含的所有漏洞（跟踪不需要完整5G标准实现的G.3定制网络）。在第一阶段，RBS将利用一支具有多学科能力的团队：1)根据国防部的任务场景和需求，细化其技术需求；2)继续与5G oem（如爱立信、诺基亚和Parallel Wireless）进行对话，并将其中至少一家纳入其第二阶段团队；3)展示5G固件保护的概念验证原型。RBS将针对5G固件：1)执行安全评估，以突出安全漏洞、漏洞和设计缺陷；2)开发描述新固件防御能力的设计文档和概念证明；3)提供集成在目标5G固件上的功能完整的原型；4)在5G测试环境中展示原型的安全有效性。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

5G wireless communications technologies currently in development rely on a wide variety of devices, including base stations, radios, and end user devices. Most of these devices contain a number of different processors, each running complex firmware, each potentially vulnerable to cyber attacks. The Building Resilient and Secure 5G Systems (BRASS) project tackles the challenge of low-level firmware exploitation of 5G devices, and thereby prevent major classes of attacks. The main research challenge to be targeted in BRASS by the performer Red Balloon Security (RBS) is: How does one provide security on a 5G host in a diverse supply chain environment with multiple vendors and unknown yet-to-be-discovered vulnerabilities almost certainly present in the firmware of the 5G devices – particularly, given the challenge of extreme diversity of firmware formats, and frequent lack of access to source code and/or hardware design information? Currently, addressing these challenges requires significant per-device, per-processor, and per-firmware reverse engineering effort by an expert. The BRASS project will research methods to automate and accelerate the integration of passive and active firmware protections to platforms in critical and vulnerable environments. Leveraging Red Balloon Security’s (RBS) experience in commercializing its firmware security solutions, BRASS will not only result in a prototype that addresses anticipated Department of Defense (DoD) mission scenarios and can be transitioned into DoD operational use, but which can also create protections that 5G Original Equipment Manufacturers (OEMs) would want to incorporate into their products. Given its focus on addressing the challenge presented by the diversity of 5G devices, BRASS would support RBS's broader goal of providing world-class protections to a broad class of cyber-physical system (CPS) embedded firmware. BRASS improvements to RBS’s core firmware analysis and modification toolchain will be made publicly available, enabling a variety of firmware analysis, improvement, and hardening applications.Red Balloon Security (RBS) has pioneered and successfully deployed novel, host-based embedded firmware defense technologies capable of preventing and/or detecting large classes of cyber attacks, including ones exploiting zero-day vulnerabilities. These capabilities are merged into the candidate firmware using RBS's Open Firmware Reverse Analysis Konsole (OFRAK) toolkit, which does not require access to source code. In BRASS, RBS would: 1) apply firmware protections to baseband firmware on the end-user devices, securing them in the context of arbitrary networks (tracks G.1, G.2, G.3); 2) apply firmware protections to the platform and radio front-end firmware in the 5G infrastructure devices, without affecting their network functionality (tracks G.2 and G.3); and 3) use OFRAK's autotomy capabilities to remove the code implementing non-essential 5G features, and thus all vulnerabilities that code could contain (track G.3 tailored networks not requiring a complete 5G standard implementation). In Phase 1, RBS will leverage a team with multidisciplinary proficiency to: 1) refine the requirements for its technology based on the DoD mission scenarios and needs; 2) continue its ongoing dialogues with 5G OEMs, such as Ericsson, Nokia, and Parallel Wireless, and to include at least one of them in its Phase 2 team; and 3) demonstrate a proof-of-concept prototype of 5G firmware protections. RBS will target 5G firmware to: 1) perform a security assessment to highlight security gaps, vulnerabilities, and design flaws; 2) develop a design document and proof of concept describing the new firmware defense capabilities; 3) deliver a feature-complete prototype integrated on target 5G firmware; and 4) demonstrate the prototype’s security efficacy against an exploit in a 5G test environment.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.