Abstract
A consistent effort has been made to provide fast, secure and uninterrupted mobile connectivity around the world. Mobile network operators use the private Interconnection network (IPX) to communicate with each other and with other service providers for international roaming and a large range of services. In LTE/4G, many core network nodes are involved in the communication and connection set-up for the subscriber in roaming scenarios. Currently, Diameter based protocols and the S9 interface are rolled out on the IPX network. We analyze the roaming interface (S9) in the LTE networks which is used for communicating charging, service control and QoS control signaling messages. This research explores Diameter Protocol features for the charging mechanisms and describes how manipulation in policy control and charging rules can influence the subscriber plan and services. The concept has been implemented and tested using a specification conformant LTE emulator. To mitigate the attack we will describe approaches and protection strategies that can be deployed.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
- 2.
- 3.
References
3GGP: 3GPP TS 29.215 version 9.9.0 release 9. https://www.etsi.org/deliver/etsi_ts/129200_129299/129215/09.09.00_60/ts_129215v090900p.pdf
3GGP: Evolved Packet Core. http://www.3gpp.org/technologies/keywords-acronyms/100-the-evolved-packet-core
3GGP: Numbering, addressing and identification. http://www.qtc.jp/3GPP/Specs/23003-3e0.pdf
3GGP: Policy and Charging Control 3GPP TS 29.212 version 12.6.0 release 12. https://www.etsi.org/deliver/etsi_ts/129200_129299/129212/12.06.00_60/ts_129212v120600p.pdf
Cichonski, J., Franklin, J.M., Bartock, M.: Guide to LTE security. Technical report, NIST SP 800–187, National Institute of Standards and Technology, Gaithersburg, MD, December 2017. https://doi.org/10.6028/NIST.SP.800-187. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-187.pdf, 00002
Ferrus, R., Sallent, O., Baldini, G., Goratti, L.: LTE: the technology driver for future public safety communications. IEEE Commun. Mag. 51(10), 154–161 (2013). https://doi.org/10.1109/MCOM.2013.6619579
Forsberg, D., Horn, G., Moeller, W.D., Niemi, V.: LTE Security. Wiley, Hoboken (2012). Google-Books-ID: 9wTs815ii70C, 00097
GSMA: Guidelines for IPX Provider networks. https://www.gsma.com/newsroom/wp-content/uploads//IR.34-v14.0-3.pdf
GSMA: International roaming explained. https://www.gsma.com/latinamerica/wp-content/uploads/2012/08/GSMA-Mobile-roaming-web-English.pdf
GSMA: IPX White Paper. https://www.gsma.com/publicpolicy/wp-content/uploads/2012/03/ipxwp12.pdf
GSMA: IR.88 - LTE and EPC Roaming Guidelines. https://www.gsma.com/newsroom/wp-content/uploads//IR.88v18.0.pdf
GSMA: NRTRDE. http://www.archclearing.com/html/Service/FraudandRevenueAssurance/NRTRDE/NRTRDE.htm
Holtmanns, S.: Mobile Data Interception from the Interconnection Link. https://media.ccc.de/v/34c3-8879-mobile_data_interception_from_the_interconnection_link
Holtmanns, S.: Interconnection Security-SS7 and Diameter, December 2017. https://www.youtube.com/watch?v=GczSCWRWyCk
Holtmanns, S., Nokia Bell Labs, Karakaari 13, 01620 Espoo, Finland: interconnection security standards - we are all connected. J. ICT Stand. 4(1), 1–18 (2016). https://doi.org/10.13052/jicts2245-800X.411. http://www.riverpublishers.com/journal_read_html_article.php?j=JICTS/4/1/1, 0000
Holtmanns, S., Oliver, I.: SMS and one-time-password interception in LTE networks (2017). https://www.semanticscholar.org/paper/SMS-and-one-time-password-interception-in-LTE-Holtmanns-Oliver/d53b731b979697cab9bd99639563be0a10f3530a, 00003
Huawei: LTE International Roaming Whitepaper. http://carrier.huawei.com/en/technical-topics/core-network/lte-roaming-whitepaper
IETF: Diameter Base Protocol. https://tools.ietf.org/html/rfc3588
Ivan, I., Milodin, D., Zamfiroiu, A.: Security of M-Commerce transactions. http://store.ectap.ro/articole/880.pdf
Kantola, R., Kabir, H., Loiseau, P.: Cooperation and end-to-end in the internet. Int. J. Commun. Syst. 30(12), e3268 (2017). https://doi.org/10.1002/dac.3268. https://onlinelibrary.wiley.com/doi/abs/10.1002/dac.3268, e3268 IJCS-15-0043.R4
Kumar, K.R.R.: International mobile data roaming: managed or unmanaged? In: 2010 9th Conference of Telecommunication, Media and Internet, pp. 1–9, June 2010. https://doi.org/10.1109/CTTE.2010.5557699, 00004
Mashukov, S.: Diameter security: an auditor’s viewpoint. J. ICT Stand. 5(1), 53–68 (2017). https://doi.org/10.13052/jicts2245-800X.513. https://riverpublishers.com/journalreadhtmlarticle.php?j=JICTS/5/1/3, 00000
Rupprecht, D., Dabrowski, A., Holz, T., Weippl, E., Pöpper, C.: On security research towards future mobile network generations. arXiv:1710.08932 [cs], October 2017, 00006
Sanyal, R.: Challenges in interoperability and roaming between LTE - legacy core for mobility management, routing, real time charging. In: 2011 Technical Symposium at ITU Telecom World (ITU WT), pp. 116–122, October 2011
Holtmanns, S., Kotte, B., Rao, S.: Detach Me Not - DoS Attacks Against 4G Cellular Users Worldwide from your Desk. https://www.blackhat.com/eu-16/speakers/Dr-Silke-Holtmanns.html
Syniverse Technologies: Preparing for LTE Roaming. https://pdfs.semanticscholar.org/presentation/7a09/50e6a2679ad03948b259445852797206247e.pdf
Tata Communications: Fighting Fraud on 4G. https://www.tatacommunications.com/sites/default/files/MOB-LTE-Fraud-WP-87299.pdf
Acknowledgements
We thank to the European Union’s Horizon 2020 research and innovation programme for funding this project under grant agreement No. 737422 of the SCOTT project and Nokia Bell Labs for providing this platform.
Author information
Authors and Affiliations
Corresponding authors
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Switzerland AG
About this paper
Cite this paper
Singh, I., Holtmanns, S., Kantola, R. (2019). Roaming Interface Signaling Security for LTE Networks. In: Lanet, JL., Toma, C. (eds) Innovative Security Solutions for Information Technology and Communications. SECITC 2018. Lecture Notes in Computer Science(), vol 11359. Springer, Cham. https://doi.org/10.1007/978-3-030-12942-2_16
Download citation
DOI: https://doi.org/10.1007/978-3-030-12942-2_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-12941-5
Online ISBN: 978-3-030-12942-2
eBook Packages: Computer ScienceComputer Science (R0)