KR20220050767A - Method for validating man-in-the-middle attack for cellular control plane protocols and the system thereof - Google Patents

Abstract

The present invention relates to a method and system for verifying a man-in-the-middle attack on a mobile communication control area, capable of diagnosing vulnerability to man-in-the-middle attack on a mobile communication network through the implementation of a test automated by the generation of a test case and the detection of a security threat. The method includes the steps of: generating a test case defining an operation of a control area protocol; making an interconnection with mobile communication equipment and terminals through the test case to implement a scenario of a man-in-the-middle attack with the test case; and determining whether there is a security threat to a terminal or network by analyzing a control area message generated due to the implementation of the scenario of the test case.

Description

METHOD FOR VALIDATING MAN-IN-THE-MIDDLE ATTACK FOR CELLULAR CONTROL PLANE PROTOCOLS AND THE SYSTEM THEREOF

The present invention relates to a method and system for verifying a man-in-the-middle attack on a mobile communication control area protocol and, more particularly, to a man-in-the-middle attack vulnerability in a mobile communication network network through automated test execution and security threat detection by generating test cases It's about technology.

In a mobile communication network, the control plane protocol refers to a control-related procedure performed by a user terminal to normally use the wireless service provided by the mobile communication network. It performs security functions such as communication encryption and integrity protection.

In order to provide safe and reliable service as well as user quality of experience in a mobile communication network, it is very important to check the correct operation of the control area procedure and security. Therefore, it is a very important technology for mobile communication equipment manufacturers and operators to detect abnormal operations and security threats that occur during the control domain procedure, and to find and solve the cause.

In this case, specific control domain procedures and operations of the mobile communication network are defined by a standard organization called ^3rd generation partnership project (3GPP). However, the standards describing the operation of the control area are written based on a vast amount of natural language, and various implementations are possible according to the operation policy of the manufacturer or communication network operator. The 3GPP standard defines a test case and execution method for a conformance test that confirms whether a mobile communication terminal operates according to the standard. Accordingly, the manufacturer can verify whether the developed terminal can receive the normal service in various situations from the commercial mobile communication network through the conformance check. However, since the conformance check test case does not consider an attacker who poses a security threat between network communications, the verification process for this is not defined in the standard.

Among mobile communication network security threats, a man-in-the-middle attack is an attack technique that intercepts communication between a terminal and a mobile communication base station and eavesdrops on or manipulates the contents. Although the terminal thinks it is communicating with the normal network, it is actually connected to a man in the middle, and the man in the middle receives a message from the terminal or network, steals the necessary information, or performs an attack by transferring it as it is or by altering it.

Due to the characteristics of the wireless communication between the terminal and the base station, there is no way to detect a man-in-the-middle attack in the current mobile communication standard. However, mutual authentication, control area and user data encryption, and control area message integrity protection are applied to minimize security threats caused by man-in-the-middle attacks. However, in the standard, various implementation and setting options are defined to support various usage environments such as industrial IoT, V2X, and public safety nets and terminals and network equipment suitable for them, and manufacturers and operators are supposed to implement them according to the environment. At this time, it is entirely up to the manufacturer to verify in which cases it can be vulnerable to a man-in-the-middle attack.

For this reason, there are various operation implementation and operation options in the standard of the control area protocol, and it is difficult to diagnose the effectiveness of the man-in-the-middle attack and the attack effect in each case through the formal analysis of standard technical documents. In addition, a weakness in the control area protocol that enables a man-in-the-middle attack may occur if the manufacturer implementing the mobile communication equipment and terminal incorrectly implements it, or depending on the communication operator's incorrect network configuration policy and settings. Therefore, there is a need for a dynamic analysis method that can diagnose the presence of potential security threats due to man-in-the-middle attacks for all kinds of implementation and configuration options.

The present invention proposes a method for dynamically detecting a part that may be vulnerable to a man-in-the-middle attack during various implementation or operation policy settings of terminals and networks in the control area protocol communication process, and the control area protocol procedure according to each implementation and operation policy It aims to provide a method for diagnosing whether there is a security threat to a terminal or network by creating a test case defining

In a method for verifying a man-in-the-middle attack on a mobile communication control region protocol according to an embodiment of the present invention, generating a test case defining an operation of the control region protocol, using the test case to interwork with mobile communication equipment and terminals performing a man-in-the-middle attack scenario by the test case and determining whether a security threat to a terminal or a network is present by analyzing a control area message generated by performing the test case scenario.

The generating step generates the test case defining the procedure and operation of the control domain protocol according to each implementation and operation policy, and the test case includes the number, direction, name, transmission method and It can consist of content.

In the performing step, a scenario form of a man-in-the-middle attack by the test case may be configured, and an initial setting may be performed according to the attack environment of the test case.

In the performing step, when the test case is executed, the operation defined in each step of the test case is performed for each message received from the terminal or network, and the message received from the terminal or network matches the scenario defined in the test case You can check whether the message is

In the determining step, if the message conforms to the scenario defined in the test case, the subsequent steps are continued, and when all of the scenarios are performed, the security threat can be analyzed.

In the determining step, if the message does not conform to the scenario defined in the test case, it may be determined that the implementation and configuration of the terminal or network is not vulnerable to a man-in-the-middle attack to be tested.

In the determining step, when all of the scenario procedures are in progress through the performing step, the control domain message including the response and state change information of the control plane received in the performing step It can be analyzed to detect security threats such as eavesdropping, user privacy, and denial of service.

In the system for verifying a man-in-the-middle attack on a mobile communication control area protocol according to an embodiment of the present invention, a generator that generates a test case defining the operation of the control area protocol and a mobile communication device and a terminal using the test case and an attack detection unit that analyzes a control area message generated by performing a man-in-the-middle attack scenario based on the test case in conjunction with each other to determine whether there is a security threat to the terminal or the network.

The generator generates the test case defining the procedure and operation of the control domain protocol according to each implementation and operation policy, and the test case includes the number, direction, name, transmission method and content of communication messages between the terminal and the base station. can be configured.

The attack detection unit includes a scenario execution unit that performs a man-in-the-middle attack scenario and an attack determination unit that determines whether there is a security threat, and the scenario execution unit configures a scenario form of a man-in-the-middle attack by the test case, and the attack of the test case You can perform initial settings according to the environment.

The scenario performing unit performs an operation defined in each step of the test case for each message received from the terminal or network when the test case is executed, and the message received from the terminal or network matches the scenario defined in the test case. You can check if it is a message.

In the case of a message matching the scenario defined in the test case, the attack determination unit may continue to the subsequent steps, and when all of the scenarios are performed, the attack determination unit may analyze the security threat.

If the message does not conform to the scenario defined in the test case, the attack determination unit may determine that the implementation and configuration of the terminal or network is not vulnerable to a man-in-the-middle attack to be tested.

The attack determination unit analyzes the control area message including the response and state change information of the control plane received from the scenario unit when all of the scenario procedures are performed through the scenario unit and eavesdropping; Security threats such as user privacy and denial of service can be detected.

According to an embodiment of the present invention, it is possible to dynamically detect a part that may be vulnerable to a man-in-the-middle attack during various implementation or operation policy settings of terminals and networks in the control area protocol communication process.

In the case of security analysis of existing mobile communication networks, most of them were performed through passive analysis by mobile communication security experts. can be found without fail. Moreover, the test case generation method of the present invention can check various types of vulnerabilities in the man-in-the-middle attack method according to the generation rule.

1 is a flowchart illustrating an operation of a man-in-the-middle attack verification method according to an embodiment of the present invention, and FIG. 2 shows an example of a test case according to an embodiment of the present invention.
3 is a block diagram of a man-in-the-middle attack verification technique according to an embodiment of the present invention.
4 illustrates an example of performing and detecting a man-in-the-middle attack test according to an embodiment of the present invention.
5 is a block diagram illustrating a detailed configuration of a man-in-the-middle attack verification system according to an embodiment of the present invention.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be embodied in various different forms, and only these embodiments allow the disclosure of the present invention to be complete, and common knowledge in the art to which the present invention pertains It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims.

The terminology used herein is for the purpose of describing the embodiments, and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, "comprises" and/or "comprising" refers to the presence of one or more other components, steps, operations and/or elements mentioned. or addition is not excluded.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless specifically defined explicitly.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. The same reference numerals are used for the same components in the drawings, and repeated descriptions of the same components are omitted.

The summary of the embodiments of the present invention is to dynamically detect and verify a part that may be vulnerable to a man-in-the-middle attack during various implementation or operation policy settings of a user equipment (UE) and a network in the control area protocol communication process. do it with

The terminal is a device that uses a voice call or a wireless network by being connected to a telephone network or an Internet network through a base station and a backhaul network. For example, a terminal includes all smart devices that can use voice calls or wireless networks, such as smart phones, tablet PCs, and smart watches, and is a concept that includes notebooks, laptops, PDAs, etc. in addition to smart devices. A terminal can use a voice call or a wireless network by transmitting and receiving voice information or data to and from another device (eg, a portal server or another terminal) by connecting a session with the telephone network or the Internet network through the base station and the backhaul network.

In addition, the terminal receives a control plane message on various services (eg, location check, terminal authentication, phone connection or radio resource connection, etc.) using a voice call or a wireless network. The terminal receives control area messages on various services from a communication company that provides voice calls or wireless networks, and operates or determines according to the received control area messages. Thereafter, the terminal transmits the operation result or determination result according to the control area message to the telephone network or the Internet network, so that the communication company can check the operation result or determination result of the terminal according to the transmission of the control area message.

Furthermore, the base station exists between the terminal and the backhaul network, and transfers voice information or data between the terminal and the telephone network or Internet network. The base station may be implemented as a NodeB when the network is implemented with 3G mobile communication, and as an eNodeB when the network is implemented with 4G mobile communication.

The backhaul network connects the base station and the telephone network or the Internet network to transmit and receive data or control area messages. The backhaul network may include various configurations according to the implementation form of the network. For example, when the network is implemented as 3G mobile communication, the backhaul network includes a configuration of a Mobile Switching Center (MSC), a Serving GPRS Support Node (SGSN), and a Gateway GPRS Support Node (GGSN), such as a telephone network or an Internet network Data in the data area such as voice information or wireless network data and messages in the control area are transmitted and received between the carrier and the terminal through the On the other hand, when the network is implemented as 4G mobile communication, the backhaul network includes a configuration such as a Mobility Management Entity (MME), a Serving Gateway (S-GW), a Packet Data Network Gateway (PGW), or a Home Subscriber Server (HSS). . As described above, the backhaul network is implemented including a configuration that enables transmission and reception of data or control area messages according to the form in which the network is implemented. In the future, even if a new network (for example, 5G mobile communication or a later generation mobile communication) appears due to the development of technology, the backhaul network may be implemented including a configuration for transmitting and receiving data or control area messages within the network. there is.

The man-in-the-middle attack verification method and system according to an embodiment of the present invention is a technology for determining whether a security threat to a terminal or network is present by analyzing a control area message generated by performing a man-in-the-middle attack scenario using a generated test case. .

Due to this, the present invention can provide the effect of preempting the mobile communication network standard technology. TSG SA WG3 (Technical Specification Group Service and System Aspects) of 3GPP, a mobile communication network technology standard organization, is currently actively discussing to recognize various security threats that may occur from man-in-the-middle attacks in 5G networks and to prepare countermeasures. In particular, various manufacturers are proposing different countermeasures and trying to standardize them. Therefore, by utilizing the technology of the present invention, the manufacturer can preemptively diagnose security threat scenarios that may occur in various implementation and operation setting processes, and can propose an appropriate countermeasure for it as a standard technology. In addition, recent 3GPP defines test cases and execution methods for verifying the security functions of network devices such as SCAS and NESAS. However, since the technology for the control area protocol test case and function verification method considering the man-in-the-middle attacker is not included in the current standard, the technology of the present invention can be adopted as the standard technology of 3GPP in the future, in which case the effect of preempting the standard technology have

In addition, the present invention can enhance competitiveness in the mobile communication network equipment industry. The mobile communication network is expected to be used in various industries ranging from data communication and telephony to public safety, industrial Internet of Things (IoT), and vehicle to everything (V2X) communication. In particular, as mobile communication networks are introduced to services related to user safety, security accidents and performance problems in mobile communication networks can directly affect user safety. In addition, security accidents caused by incorrect operation policies in mobile communication network equipment may lead to economic loss not only for telecommunication operators but also for equipment manufacturers having the problem. Therefore, by applying the man-in-the-middle attack verification technology of the present invention to the equipment developed before the system application stage, it detects potential threats in advance and prepares countermeasures to prevent economic loss and improve security technology as a competitive advantage compared to other equipment. can also be used.

Hereinafter, the present invention will be described in more detail with reference to FIGS. 1 to 5 .

1 is a flowchart illustrating an operation of a man-in-the-middle attack verification method according to an embodiment of the present invention, and FIG. 2 shows an example of a test case according to an embodiment of the present invention.

Referring to FIG. 1 , in step S110, the man-in-the-middle attack verification method according to an embodiment of the present invention generates test cases defining the operation of the control area protocol.

Step S110 may generate a test case defining the procedure and operation of the control area protocol according to each implementation and operation policy. In this case, the test case may be composed of the number of communication messages between the terminal and the base station (num_of_flows), the direction (Protocol direction), the name (message_name), the transmission method (transmit_type), and the content (message_payload). Referring to FIG. 2 , the number (num_of_flows) indicates the total number of messages generated in a man-in-the-middle attack scenario to be performed. Therefore, it has “Step” as many as “num_of_flows” value, and it defines specifically which message is transmitted in each “Step”. First, the direction (protocol direction) has a value of UL or DL, UL means an uplink message sent by the terminal to the network, and DL means a downlink message sent by the network to the terminal. Next, define the control plane protocol message name in the name (message_name). This may be a specific message of L3 protocol (NAS, RRC) or L2 protocol (MAC, PDCP, RLC) depending on the type of man-in-the-middle attack to be performed. The transmission method (transmit_type) refers to a method in which the man-in-the-middle attacker (Controller, 400) on the test execution module processes the message transmitted from the terminal or the network, and has a total of four methods.

First, in the case of “relay”, the message received by the man-in-the-middle attacker (Controller, 400) is delivered without modification. For example, if a downlink message is received from the network, it is transmitted to the terminal as it is. Second, in the case of “temper”, all or part of the received message is replaced with the content defined in the content (message_payload) and delivered. Third, “reply” responds to the sender with the content defined in “message_payload” without forwarding the received message. For example, if the “NAS Attach Request” message is received from the terminal, the “NAS Attach Request” message is sent back to the terminal according to the “message_payload”. Finally, “drop” does not process the received message and does no action. The test case example shown in FIG. 2 is written in XML, and can be written in other data exchange languages according to the above-mentioned rules.

Thereafter, the man-in-the-middle attack verification method according to an embodiment of the present invention performs a man-in-the-middle attack scenario by a test case in conjunction with a mobile communication device and a terminal using the generated test case, and as the test case scenario is performed, It is determined whether there is a security threat to the terminal or the network by analyzing the generated control area message (steps S120 and S130).

In step S120, a scenario form of a man-in-the-middle attack by the test case may be configured, and initial settings may be performed according to the attack environment of the test case.

In addition, step S120 performs the operation defined in each step of the test case for each message received from the terminal or the network when the test case is executed, and whether the message received from the terminal or the network meets the scenario defined in the test case can be checked

For example, if the message received from the terminal or network in step S120 is a message that does not conform to the scenario defined in the test case, in step S130 it is determined that the implementation and configuration of the terminal or network is not vulnerable to a man-in-the-middle attack to be tested can do.

As another example, if the message received from the terminal or network in step S120 is a message that meets the scenario defined in the test case, step S130 continues with the subsequent steps, and when all of the scenario procedures are in progress, the message is received in step S120 Security threats such as wiretapping, user privacy, and denial of service can be detected by analyzing the control plane message including the response and state change information of the control plane.

3 is a block diagram of a man-in-the-middle attack verification technique according to an embodiment of the present invention.

The man-in-the-middle attack verification technology according to an embodiment of the present invention includes a test case generation module, a man-in-the-middle attack test execution and security threat detection module.

The test case generation module performs a test case consisting of the number, direction, name, transmission method, and content of messages exchanged between the terminal and the base station. The man-in-the-middle attack test and security threat detection module performs a test case scenario by interworking with commercial mobile communication equipment and terminals using the generated test case, and receives the control area message of the control area response and state change information received in the process. Analyze to detect security threats such as eavesdropping, user privacy, and denial of service.

As described above, the man-in-the-middle attack verification technique according to the embodiment of the present invention is composed of a controller (Controller, 400), a base station component (eNB component, 200) and a terminal component (UE component, 300) as shown in FIG. do.

The controller 400 first receives the test cases 100 written in the scenario interpreter 410 as input, configures it in the form of a man-in-the-middle attack scenario, and executes the initial settings according to the attack environment of the test case. . For example, in the case of temper or relaying a message exchanged between the terminal (UE) and the network (network), both the base station element (eNB component, 200) and the terminal element (UE component, 300) must be interlocked, and in addition to reply In the case of a test case consisting of only drop or drop, only one element (200 or 300) can be executed as needed.

When the test case 100 is executed, the message inspector 420 performs an operation defined in each step of the test case for each message received from the terminal or the network. In this case, it is first checked whether the message received from the terminal or the network meets the scenario defined in the test case. If the message received from the terminal or network conforms to the scenario defined in the test case, the subsequent steps are continued. For example, user information contained in some messages is leaked due to the network setting not being encrypted, causing user privacy issues, or eavesdropping is possible due to a problem that is not properly checked in implementation in the process of integrity protection mutual authentication, etc. It is determined whether there is a security threat such as abnormal use of the service of a normal user.

On the other hand, if a message that does not conform to the defined scenario is received during test execution, it is determined that the implementation and configuration of a commercial terminal or network is not vulnerable to a man-in-the-middle attack to be tested.

The base station element (eNB component, 200) and the terminal element (UE component, 300) perform wireless communication functions with a commercial terminal (Commercial UE) and a commercial mobile communication network (Commercial network), respectively. Taking the base station component (eNB component, 200) as an example, first, by setting the same settings as the base station of the commercial network, the terminal determines that it is a commercial base station and induces a connection attempt. At this time, upon receiving the control area protocol message sent by the terminal, the message content of a specific protocol is transmitted to the controller 400 according to a scenario to be performed. According to an embodiment, when the controller 400 performs the relay, the corresponding message is delivered to the terminal element (UE component, 300), and the terminal element (UE component, 300) is a commercial network with the same settings as the user terminal. The message received from the controller 400 is transmitted as it is through a wireless connection to the . In this case, the terminal (UE) and the base station element (eNB component, 200) communicate with the controller 400 through a general wired Internet protocol (IP).

4 illustrates an example of performing and detecting a man-in-the-middle attack test according to an embodiment of the present invention.

4 is an example of implementing and installing the man-in-the-middle attack verification technique according to an embodiment of the present invention using actual equipment, and utilizes USRP B210, a software defined radio equipment, for wireless communication with terminals and networks. can

5 is a block diagram illustrating a detailed configuration of a man-in-the-middle attack verification system according to an embodiment of the present invention.

Referring to FIG. 5 , the man-in-the-middle attack verification system according to an embodiment of the present invention generates a test case and diagnoses the vulnerability of a man-in-the-middle attack in a mobile communication network through automated test execution and security threat detection.

To this end, the man-in-the-middle attack verification system 500 according to an embodiment of the present invention includes a generation unit 510 and an attack detection unit 520 .

The generator 510 generates test cases defining the operation of the control region protocol.

The generator 510 may generate a test case defining the procedure and operation of the control area protocol according to each implementation and operation policy. In this case, the test case may be composed of the number of communication messages between the terminal and the base station (num_of_flows), the direction (Protocol direction), the name (message_name), the transmission method (transmit_type), and the content (message_payload). Referring to FIG. 2 , the number (num_of_flows) indicates the total number of messages generated in a man-in-the-middle attack scenario to be performed. Therefore, it has “Step” as many as “num_of_flows” value, and it defines specifically which message is transmitted in each “Step”. First, the direction (protocol direction) has a value of UL or DL, UL means an uplink message sent by the terminal to the network, and DL means a downlink message sent by the network to the terminal. Next, define the control plane protocol message name in the name (message_name). This may be a specific message of L3 protocol (NAS, RRC) or L2 protocol (MAC, PDCP, RLC) depending on the type of man-in-the-middle attack to be performed. The transmission method (transmit_type) refers to a method in which the man-in-the-middle attacker (Controller, 400) on the test execution module processes the message transmitted from the terminal or the network, and has a total of four methods.

First, in the case of “relay”, the message received by the man-in-the-middle attacker (Controller, 400) is delivered without modification. For example, if a downlink message is received from the network, it is transmitted to the terminal as it is. Second, in the case of “temper”, all or part of the received message is replaced with the content defined in the content (message_payload) and delivered. Third, “reply” responds to the sender with the content defined in “message_payload” without forwarding the received message. For example, if the “NAS Attach Request” message is received from the terminal, the “NAS Attach Request” message is sent back to the terminal according to the “message_payload”. Finally, “drop” does not process the received message and does no action.

Thereafter, the attack detection unit 520 of the man-in-the-middle attack verification system according to an embodiment of the present invention performs a man-in-the-middle attack scenario by the test case by interworking with the mobile communication equipment and the terminal using the generated test case, and tests It is determined whether there is a security threat to the terminal or the network by analyzing the control area message generated by performing the case scenario. In this case, the attack detection unit 520 may include a scenario execution unit 521 for performing a man-in-the-middle attack scenario and an attack determination unit 522 for determining whether there is a security threat.

The scenario performing unit 521 may configure a scenario form of a man-in-the-middle attack by a test case, and may execute initial settings according to an attack environment of the test case.

In addition, the scenario performing unit 521 performs an operation defined in each step of the test case for each message received from the terminal or network when the test case is executed, and the message received from the terminal or network is applied to the scenario defined in the test case. You can check whether the message matches.

For example, when the message received from the terminal or network in the scenario performing unit 521 is a message that does not conform to the scenario defined in the test case, the attack determination unit 522 determines whether the implementation and setting of the terminal or network is tested. It can be judged that it is not vulnerable to a man-in-the-middle attack.

As another example, when the message received from the terminal or the network by the scenario performing unit 521 is a message that matches the scenario defined in the test case, the attack determining unit 522 continues the subsequent steps, and all of the scenario procedures are completed. Upon progress, it analyzes the control plane message including the response and state change information of the control plane received from the scenario performing unit 521 to determine whether there are security threats such as wiretapping, user privacy, and denial of service. can detect

The system or apparatus described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications executed on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that can include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

Software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or apparatus, to be interpreted by or to provide instructions or data to the processing device. , or may be permanently or temporarily embody in a transmitted signal wave. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible from the above description by those skilled in the art. For example, the described techniques are performed in an order different from the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (14)

A method for verifying a man-in-the-middle attack on a mobile communication control area protocol, the method comprising:
generating test cases defining the operation of the control plane protocol;
performing a man-in-the-middle attack scenario by the test case in conjunction with a mobile communication device and a terminal using the test case; and
determining whether there is a security threat to the terminal or the network by analyzing the control area message generated by performing the scenario of the test case
A man-in-the-middle attack verification method comprising a. According to claim 1,
The generating step is
generating the test cases defining the procedure and operation of the control plane protocol according to each implementation and operation policy;
The test case is
A man-in-the-middle attack verification method, characterized in that it consists of the number, direction, name, transmission method and content of the communication message between the terminal and the base station. According to claim 1,
The performing step is
A man-in-the-middle attack verification method comprising configuring a scenario form of a man-in-the-middle attack by the test case and executing an initial setting according to the attack environment of the test case. 4. The method of claim 3,
The performing step is
When the test case is performed, the operation defined in each step of the test case is performed for each message received from the terminal or network, and the message received from the terminal or network is a message that meets the scenario defined in the test case Characterized in that, a man-in-the-middle attack verification method. 5. The method of claim 4,
The judging step
If the message conforms to the scenario defined in the test case, the subsequent steps are continued, and when all the procedures of the scenario are completed, the security threat is analyzed, a man-in-the-middle attack verification method. 5. The method of claim 4,
The judging step
If the message does not conform to the scenario defined in the test case, it is determined that the implementation and configuration of the terminal or network is not vulnerable to the man-in-the-middle attack to be tested, the man-in-the-middle attack verification method. 6. The method of claim 5,
The judging step
When all the procedures of the scenario are progressed through the performing step, the control area message including the response and state change information of the control plane received in the performing step is analyzed and eavesdropping, the user A man-in-the-middle attack verification method that detects security threats such as privacy and denial of service. A system for verifying a man-in-the-middle attack on a mobile communication control area protocol, comprising:
a generation unit that generates a test case defining the operation of the control plane protocol; and
An attack detection unit that analyzes a control area message generated by performing a man-in-the-middle attack scenario by the test case in conjunction with a mobile communication device and a terminal using the test case to determine whether there is a security threat to the terminal or network
A man-in-the-middle attack verification system that includes. 9. The method of claim 8,
the generating unit
generating the test cases defining the procedure and operation of the control plane protocol according to each implementation and operation policy;
The test case is
Man-in-the-middle attack verification system, characterized in that it consists of the number, direction, name, transmission method and content of the communication message between the terminal and the base station. 9. The method of claim 8,
The attack detection unit
a scenario execution unit for performing a man-in-the-middle attack scenario; and
It includes an attack determination unit that determines whether there is a security threat,
The scenario execution unit
A man-in-the-middle attack verification system that configures a scenario form of a man-in-the-middle attack by the test case and executes an initial setting according to the attack environment of the test case. 11. The method of claim 10,
The scenario execution unit
When the test case is performed, the operation defined in each step of the test case is performed for each message received from the terminal or network, and the message received from the terminal or network is a message that meets the scenario defined in the test case Characterized in that, the man-in-the-middle attack verification system. 12. The method of claim 11,
The attack determination unit
If the message conforms to the scenario defined in the test case, the subsequent steps are continued, and when all the procedures of the scenario are in progress, the security threat is analyzed, a man-in-the-middle attack verification system. 12. The method of claim 11,
The attack determination unit
If the message does not conform to the scenario defined in the test case, it is determined that the implementation and configuration of the terminal or network is not vulnerable to the man-in-the-middle attack to be tested, the man-in-the-middle attack verification system. 13. The method of claim 12,
The attack determination unit
When all the scenario procedures are performed through the scenario unit, the control plane message including the response and state change information of the control plane received from the scenario unit is analyzed to provide eavesdropping, user privacy, and service A man-in-the-middle attack verification system that detects security threats such as denial.

Images