Security Assessment Framework for 5G User Equipment (UE)

Details

Supervisors

Sadre, Ramin ; Cavalcanti Rafael

Faculty

Ecole polytechnique de Louvain

Degree label

Master [120] en cybersécurité, à finalité spécialisée: conception et analyse de systèmes

Abstract

en3GPP’s Security Assurance Specification (SCAS) framework defines normative security requirements and executable test cases for 5G network functions such as the AMF and UPF, but no equivalent product class specification exists for the User Equipment (UE). A UE that is non-compliant with 3GPP security requirements can be compromised by a radio-local attacker operating a rogue base station, regardless of how well the network side has been hardened, yet this attack surface remains outside SCAS’s scope entirely. This thesis addresses that gap by building a SCAS-inspired security assessment framework for the UE. A minimal, prioritised set of testable requirements is derived directly from TS 33.501, TS 38.331, and TS 24.501, organised around four recurring threat classes: Down- grade / Bidding-Down, Integrity Bypass / Tampering, Denial of Service / Robustness, and Identity / Privacy Exposure. These requirements are evaluated using a two-phase testbed built from a radio-local, rogue-gNB attacker position. Phase 1 is a software-defined platform passively observe and, where armed, actively rewrite RRC and NAS messages exchanged with an open-source UE. Phase 2 carries the same byte-level injection technique over genuine RF, using a commercial rogue base station stack against a real commercial Android device inside a Faraday cage. Sixteen SCAS-style test cases were defined and executed against Phase 1, and two further test cases against Phase 2, each specified with the same requirement traceability, objective, procedure, and verdict structure used by TS 33.117. The results show the reference UE correctly rejects a tampered authentication challenge and correctly detects a content-mismatched, capability-replay attack in the NAS Security Mode Command, confirming the testbed itself is capable of producing a correct Pass outcome. Against that baseline, three active injection test cases fail: the UE accepts a genuinely null (NIA0) integrity algorithm outside the permitted emergency-session context at both the NAS and AS/RRC layers, and separately accepts an out-of-range, reserved algorithm identifier at the AS/RRC layer with no defined meaning at all. In every failing case, the UE authenticates and integrity checks the message carrying the algorithm declaration but never validates the declared value itself, and no code path implementing RRC SecurityModeFailure exists anywhere in the tested UE’s codebase. The Phase 2 hardware results corroborate the same theme from a different angle, reproducing a known pre-security NAS parsing crash and confirming that a rogue base station can rewrite a NAS reject cause in transit over real RF. With the EU Cyber Resilience Act requiring manufacturers to demonstrate baseline cybersecurity assurance for connected products from December 2027, this thesis offers a minimal, requirement-traceable, SCAS-style test suite for the UE, demonstrated against both a software-defined and a real commercial implementation, as a concrete starting point for the SCAS-for-UE product class specification that TS 33.511–TS 33.519 currently leave undefined.