Patent Application
20240098498
The present disclosure relates generally to communication systems, and more particularly, to detection of false base stations in a wireless network.
Wireless communication systems are widely deployed to provide various telecommunication services such as telephony, video, data, messaging, and broadcasts. Typical wireless communication systems may employ multiple-access technologies capable of supporting communication with multiple users by sharing available system resources. Examples of such multiple-access technologies include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single-carrier frequency division multiple access (SC-FDMA) systems, and time division synchronous code division multiple access (TD-SCDMA) systems.
These multiple access technologies have been adopted in various telecommunication standards to provide a common protocol that enables different wireless devices to communicate on a municipal, national, regional, and even global level. An example telecommunication standard is 5G New Radio (NR). 5G NR is part of a continuous mobile broadband evolution promulgated by Third Generation Partnership Project (3GPP) to meet new requirements associated with latency, reliability, security, scalability (e.g., with Internet of Things (IoT)), and other requirements. 5G NR includes services associated with enhanced mobile broadband (eMBB), massive machine type communications (mMTC), and ultra-reliable low latency communications (URLLC). Some aspects of 5G NR may be based on the 4G Long Term Evolution (LTE) standard. There exists a need for further improvements in 5G NR technology. These improvements may also be applicable to other multi-access technologies and the telecommunication standards that employ these technologies.
The following presents a simplified summary of one or more aspects in order to provide a basic understanding of such aspects. This summary is not an extensive overview of all contemplated aspects, and is intended to neither identify key or critical elements of all aspects nor delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to the more detailed description that is presented later.
In a wireless access network, a false base station (FBS) may imitate a legitimate base station by repeating the transmissions of the legitimate base station at a higher power level such that one or more user equipment (UEs) synchronize with the FBS instead of the legitimate base station. The FBS may then act as a man-in-the-middle and launch various attacks such as a denial of service attack. In particular, the FBS may decode physical layer transmissions to determine whether to drop the transmission to the UE. Accordingly, the FBS may deny services to the UE.
The present disclosure provides aspects for a UE to detect an FBS. As presented herein, the UE may estimate a time of arrival of different multipath components of a downlink signal corresponding to a physical cell identity. The UE may determine an existence of the FBS based on a difference between the times of arrival of two of the different multipath components exceeding a threshold amount of time. As the FBS decodes the physical layer downlink signal in order to determine whether to drop the signal to the UE, the UE may identify the presence of an FBS if the delay of the repeated signal is greater than an expected amount due to propagation and/or a legitimate repeater. Accordingly, the UE may determine that the later arriving multipath components indicate presence of an FBS. The UE may perform a mitigation operation in response to determining the existence of the FBS.
In an aspect of the disclosure, a method, a computer-readable medium, and an apparatus for a UE are provided. The apparatus may include a memory and at least one processor coupled to the memory and configured to execute instructions stored therein. The at least one processor may be configured to estimate a time of arrival of different multipath components of a downlink signal corresponding to a physical cell identity (PCI). The at least one processor may be configured to determine an existence of an FBS based on a difference between the times of arrival of two of the different multipath components exceeding a threshold amount of time. The at least one processor may be configured to perform a mitigation operation in response to determining the existence of the FBS.
In another aspect of the disclosure, a method, a computer-readable medium, and an apparatus for a base station are provided. The apparatus may include a memory and at least one processor coupled to the memory and configured to execute instructions stored therein. The at least one processor may be configured to determine, by a base station, a threshold amount of time that signifies a maximum allowable difference between arrival of different multipath components of a downlink signal corresponding to PCI of the base station The at least one processor may be configured to transmit the threshold amount of time to a UE for detection of an FBS by the UE. In an aspect, the at least one processor may be configured to receive an indication that a device connected to the base station has detected an FBS based on a difference between two of the different multipath components exceeding the threshold amount of time. The at least one processor may be configured to perform a mitigation operation in response to the indication.
To the accomplishment of the foregoing and related ends, the one or more aspects comprise the features hereinafter fully described and particularly pointed out in the claims. The following description and the annexed drawings set forth in detail certain illustrative features of the one or more aspects. These features are indicative, however, of but a few of the various ways in which the principles of various aspects may be employed, and this description is intended to include all such aspects and their equivalents.
The detailed description set forth below in connection with the appended drawings is intended as a description of various configurations and is not intended to represent the only configurations in which the concepts described herein may be practiced. The detailed description includes specific details for the purpose of providing a thorough understanding of various concepts. However, it will be apparent to those skilled in the art that these concepts may be practiced without these specific details. In some instances, well known structures and components are shown in block diagram form in order to avoid obscuring such concepts.
Several aspects of telecommunication systems will now be presented with reference to various apparatus and methods. These apparatus and methods will be described in the following detailed description and illustrated in the accompanying drawings by various blocks, components, circuits, processes, algorithms, etc. (collectively referred to as “elements”). These elements may be implemented using electronic hardware, computer software, or any combination thereof. Whether such elements are implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system.
By way of example, an element, or any portion of an element, or any combination of elements may be implemented as a “processing system” that includes one or more processors. Examples of processors include microprocessors, microcontrollers, graphics processing units (GPUs), central processing units (CPUs), application processors, digital signal processors (DSPs), reduced instruction set computing (RISC) processors, systems on a chip (SoC), baseband processors, field programmable gate arrays (FPGAs), programmable logic devices (PLDs), state machines, gated logic, discrete hardware circuits, and other suitable hardware configured to perform the various functionality described throughout this disclosure. One or more processors in the processing system may execute software. Software shall be construed broadly to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software components, applications, software applications, software packages, routines, subroutines, objects, executables, threads of execution, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.
Accordingly, in one or more example embodiments, the functions described may be implemented in hardware, software, or any combination thereof. If implemented in software, the functions may be stored on or encoded as one or more instructions or code on a computer-readable medium. Computer-readable media includes computer storage media. Storage media may be any available media that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise a random-access memory (RAM), a read-only memory (ROM), an electrically erasable programmable ROM (EEPROM), optical disk storage, magnetic disk storage, other magnetic storage devices, combinations of the aforementioned types of computer-readable media, or any other medium that can be used to store computer executable code in the form of instructions or data structures that can be accessed by a computer.
The base stations 102 configured for 4G LTE (collectively referred to as Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (E-UTRAN)) may interface with the EPC 160 through first backhaul links 132 (e.g., S1 interface). The base stations 102 configured for 5G NR (collectively referred to as Next Generation RAN (NG-RAN)) may interface with core network 190 through second backhaul links 184. In addition to other functions, the base stations 102 may perform one or more of the following functions: transfer of user data, radio channel ciphering and deciphering, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection setup and release, load balancing, distribution for non-access stratum (NAS) messages, NAS node selection, synchronization, radio access network (RAN) sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment trace, RAN information management (RIM), paging, positioning, and delivery of warning messages. The base stations 102 may communicate directly or indirectly (e.g., through the EPC 160 or core network 190) with each other over third backhaul links 134 (e.g., X2 interface). The first backhaul links 132, the second backhaul links 184, and the third backhaul links 134 may be wired or wireless.
The base stations 102 may wirelessly communicate with the UEs 104. Each of the base stations 102 may provide communication coverage for a respective geographic coverage area 110. There may be overlapping geographic coverage areas 110. For example, the small cell 102′ may have a coverage area 110′ that overlaps the coverage area 110 of one or more macro base stations 102. A network that includes both small cell and macrocells may be known as a heterogeneous network. A heterogeneous network may also include Home Evolved Node Bs (eNBs) (HeNBs), which may provide service to a restricted group known as a closed subscriber group (CSG). The communication links 120 between the base stations 102 and the UEs 104 may include uplink (UL) (also referred to as reverse link) transmissions from a UE 104 to a base station 102 and/or downlink (DL) (also referred to as forward link) transmissions from a base station 102 to a UE 104. The communication links 120 may use multiple-input and multiple-output (MIMO) antenna technology, including spatial multiplexing, beamforming, and/or transmit diversity. The communication links may be through one or more carriers. The base stations 102/UEs 104 may use spectrum up to Y MHz (e.g., 5, 10, 15, 20, 100, 400, etc. MHz) bandwidth per carrier allocated in a carrier aggregation of up to a total of Yx MHz (x component carriers) used for transmission in each direction. The carriers may or may not be adjacent to each other. Allocation of carriers may be asymmetric with respect to DL and UL (e.g., more or fewer carriers may be allocated for DL than for UL). The component carriers may include a primary component carrier and one or more secondary component carriers. A primary component carrier may be referred to as a primary cell (PCell) and a secondary component carrier may be referred to as a secondary cell (SCell).
Certain UEs 104 may communicate with each other using device-to-device (D2D) communication link 158. The D2D communication link 158 may use the DL/UL WWAN spectrum. The D2D communication link 158 may use one or more sidelink channels, such as a physical sidelink broadcast channel (PSBCH), a physical sidelink discovery channel (PSDCH), a physical sidelink shared channel (PSSCH), and a physical sidelink control channel (PSCCH). D2D communication may be through a variety of wireless D2D communications systems, such as for example, WiMedia, Bluetooth, ZigBee, Wi-Fi based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard, LTE, or NR.
The wireless communications system may further include a Wi-Fi access point (AP) 150 in communication with Wi-Fi stations (STAs) 152 via communication links 154, e.g., in a 5 GHz unlicensed frequency spectrum or the like. When communicating in an unlicensed frequency spectrum, the STAs 152/AP 150 may perform a clear channel assessment (CCA) prior to communicating in order to determine whether the channel is available.
The small cell 102′ may operate in a licensed and/or an unlicensed frequency spectrum. When operating in an unlicensed frequency spectrum, the small cell 102′ may employ NR and use the same unlicensed frequency spectrum (e.g., 5 GHz, or the like) as used by the Wi-Fi AP 150. The small cell 102′, employing NR in an unlicensed frequency spectrum, may boost coverage to and/or increase capacity of the access network.
The electromagnetic spectrum is often subdivided, based on frequency/wavelength, into various classes, bands, channels, etc. In 5G NR, two initial operating bands have been identified as frequency range designations FR1 (410 MHz-7.125 GHz) and FR2 (24.25 GHz-52.6 GHz). The frequencies between FR1 and FR2 are often referred to as mid-band frequencies. Although a portion of FR1 is greater than 6 GHz, FR1 is often referred to (interchangeably) as a “sub-6 GHz” band in various documents and articles. A similar nomenclature issue sometimes occurs with regard to FR2, which is often referred to (interchangeably) as a “millimeter wave” band in documents and articles, despite being different from the extremely high frequency (EHF) band (30 GHz-300 GHz) which is identified by the International Telecommunications Union (ITU) as a “millimeter wave” band.
With the above aspects in mind, unless specifically stated otherwise, it should be understood that the term “sub-6 GHz” or the like if used herein may broadly represent frequencies that may be less than 6 GHz, may be within FR1, or may include mid-band frequencies. Further, unless specifically stated otherwise, it should be understood that the term “millimeter wave” or the like if used herein may broadly represent frequencies that may include mid-band frequencies, may be within FR2, or may be within the EHF band.
A base station 102, whether a small cell 102′ or a large cell (e.g., macro base station), may include and/or be referred to as an eNB, gNodeB (gNB), or another type of base station. Some base stations, such as gNB 180 may operate in a traditional sub 6 GHz spectrum, in millimeter wave frequencies, and/or near millimeter wave frequencies in communication with the UE 104. When the gNB 180 operates in millimeter wave or near millimeter wave frequencies, the gNB 180 may be referred to as a millimeter wave base station. The millimeter wave base station 180 may utilize beamforming 182 with the UE 104 to compensate for the path loss and short range. The base station 180 and the UE 104 may each include a plurality of antennas, such as antenna elements, antenna panels, and/or antenna arrays to facilitate the beamforming.
The base station 180 may transmit a beamformed signal to the UE 104 in one or more transmit directions 182′. The UE 104 may receive the beamformed signal from the base station 180 in one or more receive directions 182″. The UE 104 may also transmit a beamformed signal to the base station 180 in one or more transmit directions. The base station 180 may receive the beamformed signal from the UE 104 in one or more receive directions. The base station 180/UE 104 may perform beam training to determine the best receive and transmit directions for each of the base station 180/UE 104. The transmit and receive directions for the base station 180 may or may not be the same. The transmit and receive directions for the UE 104 may or may not be the same.
The EPC 160 may include a Mobility Management Entity (MME) 162, other MMEs 164, a Serving Gateway 166, a Multimedia Broadcast Multicast Service (MBMS) Gateway 168, a Broadcast Multicast Service Center (BM-SC) 170, and a Packet Data Network (PDN) Gateway 172. The MME 162 may be in communication with a Home Subscriber Server (HSS) 174. The MME 162 is the control node that processes the signaling between the UEs 104 and the EPC 160. Generally, the MME 162 provides bearer and connection management. All user Internet protocol (IP) packets are transferred through the Serving Gateway 166, which itself is connected to the PDN Gateway 172. The PDN Gateway 172 provides UE IP address allocation as well as other functions. The PDN Gateway 172 and the BM-SC 170 are connected to the IP Services 176. The IP Services 176 may include the Internet, an intranet, an IP Multimedia Subsystem (IMS), a PS Streaming Service, and/or other IP services. The BM-SC 170 may provide functions for MBMS user service provisioning and delivery. The BM-SC 170 may serve as an entry point for content provider MBMS transmission, may be used to authorize and initiate MBMS Bearer Services within a public land mobile network (PLMN), and may be used to schedule MBMS transmissions. The MBMS Gateway 168 may be used to distribute MBMS traffic to the base stations 102 belonging to a Multicast Broadcast Single Frequency Network (MBSFN) area broadcasting a particular service, and may be responsible for session management (start/stop) and for collecting eMBMS related charging information.
The core network 190 may include an Access and Mobility Management Function (AMF) 192, other AMFs 193, a Session Management Function (SMF) 194, and a User Plane Function (UPF) 195. The AMF 192 may be in communication with a Unified Data Management (UDM) 196. The AMF 192 is the control node that processes the signaling between the UEs 104 and the core network 190. Generally, the AMF 192 provides QoS flow and session management. All user Internet protocol (IP) packets are transferred through the UPF 195. The UPF 195 provides UE IP address allocation as well as other functions. The UPF 195 is connected to the IP Services 197. The IP Services 197 may include the Internet, an intranet, an IP Multimedia Subsystem (IMS), a Packet Switch (PS) Streaming (PSS) Service, and/or other IP services.
The base station may include and/or be referred to as a gNB, Node B, eNB, an access point, a base transceiver station, a radio base station, a radio transceiver, a transceiver function, a basic service set (BSS), an extended service set (ESS), a transmit reception point (TRP), or some other suitable terminology. The base station 102 provides an access point to the EPC 160 or core network 190 for a UE 104. Examples of UEs 104 include a cellular phone, a smart phone, a session initiation protocol (SIP) phone, a laptop, a personal digital assistant (PDA), a satellite radio, a global positioning system, a multimedia device, a video device, a digital audio player (e.g., MP3 player), a camera, a game console, a tablet, a smart device, a wearable device, a vehicle, an electric meter, a gas pump, a large or small kitchen appliance, a healthcare device, an implant, a sensor/actuator, a display, or any other similar functioning device. Some of the UEs 104 may be referred to as IoT devices (e.g., parking meter, gas pump, toaster, vehicles, heart monitor, etc.). The UE 104 may also be referred to as a station, a mobile station, a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless device, a wireless communications device, a remote device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a handset, a user agent, a mobile client, a client, or some other suitable terminology.
Referring again to
In certain aspects, the base station 180 may include an FBS mitigation component 198 configured to indicate, by a base station, a threshold amount of time that signifies a maximum allowable difference between arrival of different multipath components of a downlink signal corresponding to a physical cell identity (PCI) of the base station. The FBS mitigation component 198 may be configured to receive an indication that a device connected to the base station has detected an FBS based on a difference between two of the different multipath components exceeding the threshold amount of time. The FBS mitigation component 198 may be configured to perform a mitigation operation in response to the indication.
Although the following description may be focused on 5G NR, the concepts described herein may be applicable to other similar areas, such as LTE, LTE-A, CDMA, GSM, and other wireless technologies.
Other wireless communication technologies may have a different frame structure and/or different channels. A frame (10 ms) may be divided into 10 equally sized subframes (1 ms). Each subframe may include one or more time slots. Subframes may also include mini-slots, which may include 7, 4, or 2 symbols. Each slot may include 7 or 14 symbols, depending on the slot configuration. For slot configuration 0, each slot may include 14 symbols, and for slot configuration 1, each slot may include 7 symbols. The symbols on DL may be cyclic prefix (CP) orthogonal frequency division multiplexing (OFDM) (CP-OFDM) symbols. The symbols on UL may be CP-OFDM symbols (for high throughput scenarios) or discrete Fourier transform (DFT) spread OFDM (DFT-s-OFDM) symbols (also referred to as single carrier frequency-division multiple access (SC-FDMA) symbols) (for power limited scenarios; limited to a single stream transmission). The number of slots within a subframe is based on the slot configuration and the numerology. For slot configuration 0, different numerologies μ 0 to 4 allow for 1, 2, 4, 8, and 16 slots, respectively, per subframe. For slot configuration 1, different numerologies 0 to 2 allow for 2, 4, and 8 slots, respectively, per subframe. Accordingly, for slot configuration 0 and numerology μ, there are 14 symbols/slot and 2μ slots/subframe. The subcarrier spacing and symbol length/duration are a function of the numerology. The subcarrier spacing may be equal to 2μ*15 kHz, where μ is the numerology 0 to 4. As such, the numerology μ=0 has a subcarrier spacing of 15 kHz and the numerology μ=4 has a subcarrier spacing of 240 kHz. The symbol length/duration is inversely related to the subcarrier spacing.
A resource grid may be used to represent the frame structure. Each time slot includes a resource block (RB) (also referred to as physical RBs (PRBs)) that extends 12 consecutive subcarriers. The resource grid is divided into multiple resource elements (REs). The number of bits carried by each RE depends on the modulation scheme.
As illustrated in
As illustrated in
The transmit (TX) processor 316 and the receive (RX) processor 370 implement layer 1 functionality associated with various signal processing functions. Layer 1, which includes a physical (PHY) layer, may include error detection on the transport channels, forward error correction (FEC) coding/decoding of the transport channels, interleaving, rate matching, mapping onto physical channels, modulation/demodulation of physical channels, and MIMO antenna processing. The TX processor 316 handles mapping to signal constellations based on various modulation schemes (e.g., binary phase-shift keying (BPSK), quadrature phase-shift keying (QPSK), M-phase-shift keying (M-PSK), M-quadrature amplitude modulation (M-QAM)). The coded and modulated symbols may then be split into parallel streams. Each stream may then be mapped to an OFDM subcarrier, multiplexed with a reference signal (e.g., pilot) in the time and/or frequency domain, and then combined together using an Inverse Fast Fourier Transform (IFFT) to produce a physical channel carrying a time domain OFDM symbol stream. The OFDM stream is spatially precoded to produce multiple spatial streams. Channel estimates from a channel estimator 374 may be used to determine the coding and modulation scheme, as well as for spatial processing. The channel estimate may be derived from a reference signal and/or channel condition feedback transmitted by the UE 350. Each spatial stream may then be provided to a different antenna 320 via a separate transmitter 318TX. Each transmitter 318TX may modulate an RF carrier with a respective spatial stream for transmission.
At the UE 350, each receiver 354RX receives a signal through its respective antenna 352. Each receiver 354RX recovers information modulated onto an RF carrier and provides the information to the receive (RX) processor 356. The TX processor 368 and the RX processor 356 implement layer 1 functionality associated with various signal processing functions. The RX processor 356 may perform spatial processing on the information to recover any spatial streams destined for the UE 350. If multiple spatial streams are destined for the UE 350, they may be combined by the RX processor 356 into a single OFDM symbol stream. The RX processor 356 then converts the OFDM symbol stream from the time-domain to the frequency domain using a Fast Fourier Transform (FFT). The frequency domain signal comprises a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols on each subcarrier, and the reference signal, are recovered and demodulated by determining the most likely signal constellation points transmitted by the base station 310. These soft decisions may be based on channel estimates computed by the channel estimator 358. The soft decisions are then decoded and deinterleaved to recover the data and control signals that were originally transmitted by the base station 310 on the physical channel. The data and control signals are then provided to the controller/processor 359, which implements layer 3 and layer 2 functionality.
The controller/processor 359 can be associated with a memory 360 that stores program codes and data. The memory 360 may be referred to as a computer-readable medium. In the UL, the controller/processor 359 provides demultiplexing between transport and logical channels, packet reassembly, deciphering, header decompression, and control signal processing to recover IP packets from the EPC 160. The controller/processor 359 is also responsible for error detection using an ACK and/or NACK protocol to support HARQ operations.
Similar to the functionality described in connection with the DL transmission by the base station 310, the controller/processor 359 provides RRC layer functionality associated with system information (e.g., MIB, SIB s) acquisition, RRC connections, and measurement reporting; PDCP layer functionality associated with header compression/decompression, and security (ciphering, deciphering, integrity protection, integrity verification); RLC layer functionality associated with the transfer of upper layer PDUs, error correction through ARQ, concatenation, segmentation, and reassembly of RLC SDUs, re-segmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto TBs, demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority handling, and logical channel prioritization.
Channel estimates derived by a channel estimator 358 from a reference signal or feedback transmitted by the base station 310 may be used by the TX processor 368 to select the appropriate coding and modulation schemes, and to facilitate spatial processing. The spatial streams generated by the TX processor 368 may be provided to different antenna 352 via separate transmitters 354TX. Each transmitter 354TX may modulate an RF carrier with a respective spatial stream for transmission.
The UL transmission is processed at the base station 310 in a manner similar to that described in connection with the receiver function at the UE 350. Each receiver 318RX receives a signal through its respective antenna 320. Each receiver 318RX recovers information modulated onto an RF carrier and provides the information to a RX processor 370.
The controller/processor 375 can be associated with a memory 376 that stores program codes and data. The memory 376 may be referred to as a computer-readable medium. In the UL, the controller/processor 375 provides demultiplexing between transport and logical channels, packet reassembly, deciphering, header decompression, control signal processing to recover IP packets from the UE 350. IP packets from the controller/processor 375 may be provided to the EPC 160. The controller/processor 375 is also responsible for error detection using an ACK and/or NACK protocol to support HARQ operations.
At least one of the TX processor 368, the RX processor 356, and the controller/processor 359 may be configured to perform aspects in connection with the FBS detection component 140 of
At least one of the TX processor 316, the RX processor 370, and the controller/processor 375 may be configured to perform aspects in connection with the FBS mitigation component 198 of
An FBS 452 poses a security threat to wireless communication systems. The FBS 452 may be a non-authorized device that transmits synchronization signals to get the UE 104 to synchronize to the FBS 452. For example, the FBS 452 may transmit the synchronization signals (e.g., SSB) with a relatively high power so that the UE 104 will be more likely to select the FBS 452 than a legitimate cell 402. Once the UE 104 is camped on or connected to the FBS 452, the FBS 452 may be able to launch different types of attacks against the UE.
For instance, a man-in-the-middle (MITM) FBS 452 may logically sit in the middle between the UE 104 and the legitimate cell 402 in the form of a malicious repeater. The FBS 452 may act as a legitimate cell towards the UE and as a UE towards the legitimate cell. For instance, in the downlink, the FBS 452 may receive a PHY layer signal 404 from the legitimate cell 402 and generate a repeated PHY layer signal 454. However, the FBS 452 may modify the repeated PHY layer signal 454 or inject unsecure transmissions, as well as, selectively drop some (secure or unsecure) transmissions on either link direction. The UE 104 may receive and decode the repeated PHY layer signal 454. Although the UE 104 may also receive the PHY layer signal 404 from the legitimate cell 402 the UE 104 may not decode the PHY layer signal 404, because the UE 104 is synchronized to the FBS 452. As another example, in the uplink, the UE 104 may transmit an uplink signal 456 to the FBS 452. The FBS 452 may repeat the uplink signal 456 as repeated uplink signal 458, may modify the uplink signal 456, or may drop the uplink signal 456.
The dropping of transmissions by an MITM FBS may be problematic because the FBS may drop transmissions (e.g., PHY layer signal 404 that are cryptographical secure (e.g., ciphered and integrity protected). If the MITM FBS drops only a selected subset of transmissions, then the FBS 452 may go undetected for a length of time. The MITM FBS may perform an attack on Physical Downlink Control Channel (PDCCH) by leading the UE to synchronize with the FBS and then dropping PDCCH transmissions from the actual base station. The UE may not detect the attack because a dropped PDCCH transmission would be treated by the UE 104 as if there were no transmission.
As an example of an attack, the MITM FBS 452 may selectively drop all PDCCH transmissions from the legitimate base station which carry short messages indicating a public warning system (PWS) notification. Then, any UE 104 connected to the legitimate cell 402 via the FBS 452 would not receive emergency warning messages and thus be the victim of a denial of service attack. As the UE 104 is unaware of incoming PWS notifications on PDCCH, the FBS 452 could go undetected for a substantial length of time.
Several characteristics of the FBS 452 may be inferred based on an assumption that the FBS 452 tries to remain undetected. First, a MITM FBS 452 may typically be configured to use the same physical cell identity (PCI) as the legitimate cell 402. The access stratum (AS) security keys used for PDCP security are derived using, amongst other parameters, the PCI of the serving cell (i.e. the legitimate cell 402). Accordingly, in order to relay secure signaling messages unmodified and remain undetected, the FBS may use the same PCI as the legitimate cell. If a different PCI were used, the integrity protection at the UE 104 would fail and the UE 104 may detect the FBS 452.
In order to remain undetected, the MITM FBS 452 may avoid dropping all PDCCH transmissions. For example, if the FBS 452 were to drop each PDCCH transmission including those scheduled on the system information (SI) radio network temporary identifier (RNTI), the UE would not be able to decode the SI and may suspect malicious behavior or find another cell. Similarly, the FBS 452 may avoid dropping a PDCCH scheduling a signaling radio bearer (SRB) message since the dropped SRB message may lead to a radio resource control (RRC) or non-access stratum (NAS) procedure timeout. The UE 104 may reselect to a new cell in response to such timeouts, thereby avoiding the FBS.
In order to selectively drop PDCCH transmissions, the FBS 452 may decode the PHY layer signal 404 from the legitimate cell 402 and decide on a subsequent action (e.g., repeat as repeated PHY layer signal 454 or drop) depending on the nature of the PHY layer signal 404. An FBS with the ability to decode PHY layer or layer 1 transmissions (e.g. PDCCH) may be referred to as an L1 MITM FBS.
Decoding the PDCCH and deciding a subsequent action, introduces extra delay in the downlink transmission (e.g., repeated PHY layer signal 454) from the FBS 452 to the UE 104 compared to the downlink transmission (e.g., PHY layer signal 404) from the legitimate cell 402 to the UE 104. The amount of extra delay may be on the order of the PDCCH transmission duration. As one, non-limiting example, in 5G NR, the minimum and maximum allowed PDCCH durations are one and three time-domain OFDM symbols, respectively. The symbol length may vary based on the numerology or sub-carrier spacing, but are known to the UE based on the configuration.
The example wireless channel power profile 500 represents a probable profile when an FBS 452 is active. For example, the wireless channel power profile 500 may be for the PHY layer signal 404 illustrated in
The UE 104 may also receive multicomponent paths from the legitimate repeater that may be deployed to extend the coverage are of the cell. A legitimate repeater, however, may repeat the RF signal from the legitimate cell 402 without down converting or decoding the RF signal. Accordingly, a difference in the arrival time for multipath components from a legitimate repeater may be within the threshold amount of time (e.g., less than a PDCCH duration).
Additionally, the received power level of the multipath components may provide additional evidence of an FBS MITM attack. For an MITM attack to be successful, the later arriving path (e.g., multipath components 520, 522, 524) from the FBS 452 is at a higher power than an earlier arriving path (e.g., multipath components 510, 512, 514) from the legitimate cell 402. The FBS 452 transmits with a higher power to improve the likelihood that the UE synchronizes to the FBS. If the received signals from the FBS 452 had a lower power than other signals, the UE 104 may synchronize with the other signals. Accordingly, in the channel power profile 500, the later arriving multipath components 520, 522, 524 are received with a higher power (e.g., received signal strength indicator (RSSI)) than the earlier arriving multipath components 510, 512, 514. The FBS detection component 140 may detect such power inversion to reinforce an FBS detection hypothesis based on the time difference in arrival.
The legitimate cell 402 may transmit downlink communications 608 to the UE 104. The FBS 452 may repeat the downlink communications 608 as repeated downlink communications 610. The FBS 452 may selectively modify or drop the downlink communications 608. For example, for a denial of service attack, the FBS 452 may drop downlink communications 608 for a particular service and not transmit the repeated downlink communications 610 for that service. The UE 104 may be unaware when the FBS 452 drops downlink communications 608 because the UE 104 is not synchronized with the legitimate cell 402.
In an aspect, the legitimate cell 402 may configure the UE 104 with a threshold time period for detecting an FBS. The configuration may be carried by, for example, the SSB 602 or the downlink communications 608. In an implementation, the SSB 602 may include the PBCH carrying system information that includes the threshold. In another implementation, the configuration may be carried in UE specific communications (e.g., RRC) that are protected by PDCP ciphering and integrity protection.
The legitimate cell 402 may transmit signals 612 that are known to the UE 104, such as reference signals or synchronization signals. For example, the SSB and the CSI-RS may be known or determined based on the PCI of the legitimate cell 402. Generally, the FBS 452 will repeat the known signals 612 as repeated known signals 614 because the UE 104 may perform measurements based on the known signals and trigger a timeout event or change cells of the known signals 612 are not received. As the UE 104 receives both the known signals 612 and the repeated known signals 614, the UE 104 may analyze the channel power profile 500 of the known signals 612 and the repeated known signals 614. At block 616, the UE 104 may detect the FBS 452 based on a timing difference between the multipath components for the known signals 612 and the repeated known signals 614. The UE 104 may also consider whether the power level of the known signals 612 and the repeated known signals 614 has an inverted pattern when detecting the FBS 452.
In response to detecting the FBS 452, the UE 104 may perform a mitigation operation. For example, the UE 104 may transmit an FBS report 618 indicating the detected FBS. The FBS report 618 may be transmitted as a higher layer control message (e.g., RRC message) that is protected by PDCP ciphering and integrity protection. The legitimate cell 402 may forward the FBS report 618 as a report 620 to a security server 622. The security server 622 may provide information to network administrators or operators to take further action. Additionally, or alternatively, the UE 104 may change cells and/or the legitimate cell 402 may initiate a cell change. For example, at block 624, the UE 104 may autonomously select a different cell (e.g., by ignoring or disregarding the repeated SSB 604 from the FBS 452). Accordingly, the UE 104 may access the network via a different frequency, band, or system (e.g., LTE instead of 5G NR). At block 626, the legitimate cell 402 may facilitate a change of cells, for example, by initiating a handover of the UE 104 to a different cell. As another example, the legitimate cell 402 may update one or more communication parameters to de-prioritize the cells corresponding to the FBS 452 for cell selection/re-selection at the UE. In an aspect, the mitigation operations of the legitimate cell 402 may be applied to UEs that have not detected the FBS 452 (e.g., without an FBS detection component 140). Accordingly, the FBS mitigation component 198 may mitigate the effects of the FBS 452 for multiple UEs.
At block 710, the UE may optionally receive a configuration of a threshold amount of time for FBS detection. For example, the indication component 806 of the apparatus 802 or 902 may receive the configuration of the threshold amount of time from the legitimate cell 402, 850 via the reception component 804. For instance, the indication component 806 may receive the threshold amount of time within system information of the legitimate cell 402, which may be repeated by the FBS 452. In another implementation, the indication component 806 may receive the threshold amount of time in UE specific signaling. For instance, the threshold amount of time may be configured in an RRC configuration message.
At block 720, the UE may optionally compute a threshold amount of time for FBS detection based on a maximum expected delay spread in a wireless channel. For example, the configuration component 808 of the apparatus 802 or 902 may compute the threshold amount of time for FBS detection. For example, the threshold amount of time may be a function of a numerology, sub-carrier spacing, or symbol period and the maximum expected delay spread, which may be based on a size of the cell. Accordingly, the configuration component 808 of the apparatus 802 or 902 may compute the threshold amount of time for FBS detection based on a current configuration.
At block 730, the UE estimates a time of arrival of different multipath components of a downlink signal from a base station. The UE may identify the base station that is a source of the downlink signal based on a PCI associated with the downlink signal. For example, the multipath component 812 of the apparatus 802 or 902 may estimate the time of arrival of different multipath components of a downlink signal from the base station. The time of arrival of a multipath component may be estimated by correlating the received downlink signal from a base station with a known reference signal. The correlation may be carried out at different points in time and the time of arrival of a multipath component may be estimated to be the time that results in the correlation value exceeding a threshold. The UE may receive a cluster 516 of multipath components having various times of arrival, e.g., as described in connection with
In some examples, the UE may estimate the time of arrival of the different multipath components for a particular base station, e.g., as identified by a PCI. For example, the PCI may be the PCI of a current serving cell to which the UE is connected. The downlink signal may be a known signal such as an SSB or CSI-RS. Accordingly, the multipath component 812 may receive the known signal via the reception component 804 and estimate the time of arrival of each multipath component. For instance, the multipath component 812 may generate the channel power profile 500 by identifying a power level (e.g., RSSI) for each of the arrival times. As described in connection with
At block 740, the UE determines an existence of an FBS based on a difference between the times of arrival of two of the different multipath components exceeding a threshold amount of time. For example, the timing component 814 of the apparatus 802 or 902 may determine the existence of the FBS 452 based on the difference 540 between the times of arrival of two of the different multipath components (e.g., multipath components 510 and 520) exceeding the threshold amount of time (e.g., symbol duration 530). In an example in which the FBS is between the UE and the actual base station, the later arriving path (e.g., multipath component 520) of the different multipath components that is from the FBS may have a greater received signal strength than an earlier arriving path (e.g., multipath component 510) from the signal from the actual base station. The timing component 814 may determine the existence of the FBS based on the received signal strengths of the later arriving path and the earlier arriving path. For instance, the timing component 814 may confirm the FBS component when the later arriving multipath component 520 has a greater signal strength than the earlier arriving multipath component 510.
At block 750, the UE performs a mitigation operation in response to determining the existence of the FBS. For example, the mitigation component 816 of the apparatus 802 or 902 may perform the mitigation operation in response to determining the existence of the FBS 452. For example, at sub-block 752, the mitigation component 816 may report the determination of the existence of the FBS to a security server of a communication network. For instance, the mitigation component 816 may transmit the FBS report 618 to the security server 622 via the transmission component 810 and the legitimate cell 402. As another example, at sub-block 754, the mitigation component 816 may update one or more communication parameters to access a communication network using a different cell, frequency, band, or system. For instance, the mitigation component 816 may receive a handover command or configuration change command from the legitimate cell 402 in response to the FBS report 618. In another implementation, the mitigation component 816 may autonomously change communication parameters (e.g., measurements) to initiate a change of cell, frequency, band, or system. Accordingly, the UE 104 may mitigate the effects of the FBS 452, for example, by changing cells to avoid a denial of service attack.
The apparatus 802 may include additional components that perform each of the blocks of the algorithm in the aforementioned flowchart of
The communication manager 932 includes the indication component 806, the configuration component 808, the multipath component 812, the timing component 814, and/or the mitigation component 816 that may be configured to perform the aspects described in connection with
The apparatus may include additional components that perform each of the blocks of the algorithm in the aforementioned flowchart of
In one configuration, the apparatus 902, and in particular the cellular baseband processor 904, includes means for estimating a time of arrival of different multipath components of a downlink signal corresponding to a PCI; means for determining an existence of a FBS based on a difference between the times of arrival of two of the different multipath components exceeding a threshold amount of time; means for performing a mitigation operation in response to determining the existence of the FBS; and means for computing the threshold amount of time based on a maximum expected delay spread in a wireless channel. The aforementioned means may be one or more of the aforementioned components of the apparatus 902 configured to perform the functions recited by the aforementioned means. As described supra, the apparatus 902 may include the TX processor 368, the RX processor 356, and the controller/processor 359. As such, in one configuration, the aforementioned means may be the TX processor 368, the RX processor 356, and the controller/processor 359 configured to perform the functions recited by the aforementioned means.
At block 1010, the base station determines a threshold amount of time that signifies a maximum allowable difference between arrival of different multipath components of a downlink signal from the base station. A source of the downlink signal may be indicated by a PCI associated with the downlink signal. For example, the computation component 1106 of the apparatus 1102 or 1202 may determine the threshold amount of time that signifies a maximum allowable difference between arrival of different multipath components of the downlink signal corresponding to the PCI of the base station. For example, in sub-block 1012, the block 1010 may optionally include computing a threshold amount of time for FBS detection based on a maximum expected delay spread in a wireless channel. In an aspect, for example, the computation component 1106 may compute the threshold amount of time for FBS detection based on the maximum expected delay spread in a wireless channel. For example, the threshold amount of time may be a function of a numerology, sub-carrier spacing, or symbol period and the maximum expected delay spread, which may be based on a size of the cell. Accordingly, the computation component 1106 may compute the threshold amount of time for FBS detection based on a current configuration.
At block 1020, the base station transmits the threshold amount of time to a UE for detection of an FBS by the UE. For example, the signaling component 1108 of the apparatus 1102 or 1202 may transmit the threshold amount of time to the UE 104 for detection of the FBS 452 by the UE 104. For instance, at sub-block 1022, the signaling component 1108 may transmit the threshold amount of time within system information. As another example, at sub-block 1024, the signaling component 1108 may transmit the threshold amount of time in UE specific signaling.
At block 1030, the base station may optionally receive a report that the UE has detected an FBS based on a difference between two of the different multipath components exceeding the threshold amount of time. For example, the FBS component 1112 of the apparatus 1102 or 1202 may receive the report (e.g., FBS report 618) that the UE 104 has detected the FBS based on the difference between two of the different multipath components exceeding the threshold amount of time.
At block 1040, the base station may optionally perform a mitigation operation in response to determining the existence of the FBS. For example, the mitigation component 1114 of the apparatus 1102 or 1202 may perform the mitigation operation in response to determining the existence of the FBS. For example, at block 1042, the mitigation component 1114 may report the determination of the existence of the FBS to the security server 622 of the communication network. As another example, at sub-block 1044, the mitigation component 1114 may update one or more communication parameters for a device to access a communication network using a different cell, frequency, band, or system. The device may be the device that detected the FBS and provided the indication. Accordingly, the mitigation component 1114 may change the parameters of the device to avoid the FBS. The device may additionally or alternatively be a different device that did not detect the FBS. The mitigation component 1114 may determine that the other device is also potentially vulnerable to the FBS and may change the parameters of the other device to protect the other device from the FBS.
The apparatus may include additional components that perform each of the blocks of the algorithm in the aforementioned flowcharts of
The communication manager 1232 may include the computation component 1106, the signaling component 1108, the FBS component 1112, and the mitigation component 1114 that are configured to perform the aspects described in connection with
The apparatus may include additional components that perform each of the blocks of the algorithm in the aforementioned flowchart of
In one configuration, the apparatus 1202, and in particular the baseband unit 1204, includes means for indicating, by a base station, a threshold amount of time that signifies a maximum allowable difference between arrival of different multipath components of a downlink signal corresponding to a PCI of the base station; means for receiving an indication that a device connected to the base station has detected a FBS based on a difference between two of the different multipath components exceeding the threshold amount of time; means for performing a mitigation operation in response to the indication; and means for computing the threshold amount of time based on a maximum expected delay spread in a wireless channel. The aforementioned means may be one or more of the aforementioned components of the apparatus 1202 configured to perform the functions recited by the aforementioned means. As described supra, the apparatus 1202 may include the TX processor 316, the RX processor 370, and the controller/processor 375. As such, in one configuration, the aforementioned means may be the TX processor 316, the RX processor 370, and the controller/processor 375 configured to perform the functions recited by the aforementioned means.
In view of the foregoing, the present disclosure provides for detection and mitigation of an FBS. That is, by detecting an FBS, a UE may avoid synchronizing with the FBS and the FBS may not be able to launch an attack such as a man-in-the-middle denial of service attack against the UE. Accordingly, the present disclosure improves the performance and security of a UE. Further, by reporting the FBS to a legitimate base station and/or security server, the UE allows the network to mitigate the effects of the FBS. For example, the network may change parameters of another UE such that the other UE also avoids the FBS.
The following aspects are illustrative only and may be combined with other aspects or teaching described herein, without limitation.
Aspect 1 is a method of wireless communication for a UE, comprising: estimating a time of arrival of different multipath components of a downlink signal from a base station; determining an existence of a FBS based on a difference between times of arrival of two of the different multipath components exceeding a threshold amount of time; and performing a mitigation operation in response to determining the existence of the FBS.
In aspect 2, the method of aspect 1 further includes that the UE identifies the base station that is a source of the downlink signal based on a PCI associated with the downlink signal.
In aspect 3, the method of aspect 1 or aspect 2 further includes that the downlink signal is an SSB.
In aspect 4, the method of aspect 1 or aspect 2 further includes that the downlink signal is a CSI-RS.
In aspect 5, the method of any of aspects 1-4 further includes that the threshold amount of time is received within system information.
In aspect 6, the method of any of aspects 1-4 further includes that the threshold amount of time is received in UE specific signaling.
In aspect 7, the method of any of aspects 1-6 further includes computing the threshold amount of time based on a maximum expected delay spread in a wireless channel.
In aspect 8, the method of any of aspects 1-7 further includes that performing the mitigation operation comprises reporting the determination of the existence of the FBS to a security server of a communication network.
In aspect 9, the method of any of aspects 1-8 further includes that performing the mitigation operation comprises updating one or more communication parameters to access a communication network using a different cell, frequency, band, or system.
In aspect 10, the method of any of aspects 1-9 further includes that a later arriving path of the different multipath components has a greater received signal strength than an earlier arriving path of the different multipath components.
In aspect 11, the method of aspect 10 further includes that determining the existence of the FBS is further based on the received signal strengths of the later arriving path and the earlier arriving path.
Aspect 12 is a device including one or more processors and one or more memories in electronic communication with the one or more processors storing instructions executable by the one or more processors to cause the device to implement a method as in any of aspects 1-11.
Aspect 13 is a system or apparatus including means for implementing a method or realizing an apparatus as in any of aspects 1-11.
Aspect 14 is a non-transitory computer readable medium storing instructions executable by one or more processors to cause the one or more processors to implement a method as in any of aspects 1-11.
Aspect 15 is a method of wireless communication, comprising: determining, by a base station, a threshold amount of time that signifies a maximum allowable difference between arrival of different multipath components of a downlink signal from the base station; and transmitting the threshold amount of time to a UE for detection of a FBS by the UE.
In aspect 16, the method of aspect 15 further includes that a source of the downlink signal is indicated by a PCI associated with the downlink signal.
In aspect 17, the method of aspect 15 or aspect 16 further includes receiving a report that the UE has detected the FBS based on a difference between two of the different multipath components exceeding the threshold amount of time; and performing a mitigation operation in response to the indication.
In aspect 18, the method of aspect 17 further includes that performing the mitigation operation comprises updating one or more communication parameters of the UE to access a communication network using a different cell, frequency, band, or system.
In aspect 19, the method of aspect 17 or 18 further includes that performing the mitigation operation comprises updating one or more communication parameters of another device connected to the base station to access a communication network using a different cell, frequency, band, or system.
In aspect 20, the method of any of aspects 15-19 further includes that transmitting the threshold amount of time comprises transmitting the threshold amount of time within system information.
In aspect 21, the method of any of aspects 15-19 further includes that transmitting the threshold amount of time comprises transmitting the threshold amount of time in UE specific signaling.
In aspect 22, the method of any of aspects 15-21 further includes that determining the threshold amount of time comprises computing the threshold amount of time based on a maximum expected delay spread in a wireless channel.
Aspect 23 is a device including one or more processors and one or more memories in electronic communication with the one or more processors storing instructions executable by the one or more processors to cause the device to implement a method as in any of aspects 15-22.
Aspect 24 is a system or apparatus including means for implementing a method or realizing an apparatus as in any of aspects 15-22.
Aspect 25 is a non-transitory computer readable medium storing instructions executable by one or more processors to cause the one or more processors to implement a method as in any of aspects 15-22.
It is understood that the specific order or hierarchy of blocks in the processes/flowcharts disclosed is an illustration of example approaches. Based upon design preferences, it is understood that the specific order or hierarchy of blocks in the processes/flowcharts may be rearranged. Further, some blocks may be combined or omitted. The accompanying method claims present elements of the various blocks in a sample order, and are not meant to be limited to the specific order or hierarchy presented.
The previous description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other aspects. Thus, the claims are not intended to be limited to the aspects shown herein, but is to be accorded the full scope consistent with the language claims, wherein reference to an element in the singular is not intended to mean “one and only one” unless specifically so stated, but rather “one or more.” The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any aspect described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects. Unless specifically stated otherwise, the term “some” refers to one or more. Combinations such as “at least one of A, B, or C,” “one or more of A, B, or C,” “at least one of A, B, and C,” “one or more of A, B, and C,” and “A, B, C, or any combination thereof” include any combination of A, B, and/or C, and may include multiples of A, multiples of B, or multiples of C. Specifically, combinations such as “at least one of A, B, or C,” “one or more of A, B, or C,” “at least one of A, B, and C,” “one or more of A, B, and C,” and “A, B, C, or any combination thereof” may be A only, B only, C only, A and B, A and C, B and C, or A and B and C, where any such combinations may contain one or more member or members of A, B, or C. All structural and functional equivalents to the elements of the various aspects described throughout this disclosure that are known or later come to be known to those of ordinary skill in the art are expressly incorporated herein by reference and are intended to be encompassed by the claims. Moreover, nothing disclosed herein is intended to be dedicated to the public regardless of whether such disclosure is explicitly recited in the claims. The words “module,” “mechanism,” “element,” “device,” and the like may not be a substitute for the word “means.” As such, no claim element is to be construed as a means plus function unless the element is expressly recited using the phrase “means for.”
This application is a divisional of U.S. application Ser. No. 17/086,267, entitled “Wireless Channel Power Profile False Base Station Detection” and filed on Oct. 30, 2023, which claims the benefit of U.S. Provisional Application Ser. No. 62/935,595, entitled “Wireless Channel Power Profile False Base Station Detection” and filed on Nov. 14, 2019, the entire contents of each of which are expressly incorporated by reference herein in their entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62935595 | Nov 2019 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17086267 | Oct 2020 | US |
| Child | 18527167 | US |
