A review of DoS attack models for 3G cellular networks from a system-design perspective

Abstract

Third-generation cellular networks are exposed to novel forms of denial-of-service attacks that only recently have started to be recognized and documented by the scientific community. In this contribution, we review some recently published attack models specific for cellular networks. We review them collectively in order to identify the main system-design aspects that are ultimately responsible for the exposure to the attack. The goal of this contribution is to build awareness about the intrinsic weaknesses of 3G networks from a system-design perspective. In doing that we hope to inform the design practice of future generation networks, motivating the adoption of randomization, adaptation and prioritization as central ingredients of robust system design.

Introduction

Wide-area wireless access for mobile and portable terminals is now a reality thanks to the widespread deployment of third-generation (3G) cellular networks. The most prominent 3G standards are the Universal Mobile Telecommunications System (UMTS), developed by 3GPP as an evolution to GSM, and CDMA2000 derived from IS-95. Albeit not interoperable, all these technologies share the same fundamental design principles. Therefore our discussion applies in general to 3G technologies, although in the rest of this paper we will refer specifically to the 3GPP terminology.

Cellular data networks play an increasingly important role in society and economy. They provide ubiquitous data access to human and machine users, serving a broad range of applications, including critical services like remote control and surveillance, safety applications, e-care, localization services, tele-metering, support to logistics, etc. The development of a rich application and service ecosystem will be fostered by the prospective increase in the available radio bandwidth, thanks to the introduction of so-called 3.5G technologies like High-Speed Packet Access (HSPA, see [19]), to the expansion of geographical coverage and to the ongoing decrease of tariffs for end-customers. Many mobile operators worldwide are actively engaged along such development lines. However, ensuring a high degree of service availability remains a key prerequisite for the affirmation of any critical application. At the network layer this translates into a strong requirement for robustness: in order to ensure service continuity, the network infrastructure must be robust to overload conditions and failures, be them caused by legitimate unanticipated events or deliberate attacks.

As we will show, a number of features specific to cellular data network expose such systems to novel forms of Denial-of-Service (DoS) attacks that only recently have started to be recognized and investigated by the research community. In this paper, we review a number of DoS attack models specific for 3G networks that have recently appeared in the literature, sparse across different conferences papers. We analyze them collectively in order to identify the common root causes, i.e. the fundamental system-design aspects that ultimately generate exposure. Such understanding is important for the implementation of preventive countermeasures and, in general, for achieving a more robust configuration of the network infrastructure. Furthermore, clear awareness about the system-design weaknesses that affect 3G systems today would be beneficial for the ongoing design and standardization process of next generation systems (Long Term Evolution, LTE) and would help improving the intrinsic robustness of future 4G networks.

The rest of the paper is organized as follows. In Section 2 we recall some aspects of 3G networks that are relevant to subsequent discussion. In Section 4 we review the SMS flowing attack, which is the oldest example of DoS attack specific for cellular networks. In Sections 5 Paging attack, 6 Attacks based on Dedicated Channel (DCH) assignment we review three other attack models specific for 3G networks. All attack models are rooted in certain system-design aspects of 3G cellular networks that we highlight and comment in Section 7. In Section 8 we briefly suggest some possible directions for the design of future generation system. Finally, in Section 9 we draw the conclusions.