WO2023155699A1 - 空口协议安全漏洞的挖掘方法、装置、移动终端 - Google Patents

空口协议安全漏洞的挖掘方法、装置、移动终端 Download PDF

Info

Publication number
WO2023155699A1
WO2023155699A1 PCT/CN2023/074441 CN2023074441W WO2023155699A1 WO 2023155699 A1 WO2023155699 A1 WO 2023155699A1 CN 2023074441 W CN2023074441 W CN 2023074441W WO 2023155699 A1 WO2023155699 A1 WO 2023155699A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
air interface
base station
interface protocol
protocol
Prior art date
Application number
PCT/CN2023/074441
Other languages
English (en)
French (fr)
Inventor
刘谈
张金鑫
张飞
赵尹源
仝琦源
赵英俊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2023155699A1 publication Critical patent/WO2023155699A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/126—Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks

Definitions

  • the embodiments of the present application relate to the technical field of communication transmission security, and in particular to a method, device, and mobile terminal for mining air interface protocol security vulnerabilities.
  • the fuzzy test of Long Term Evolution (LTE) network control components and control plane process adopts the fuzzy test of conventional process replay, that is, the original business data of the completed business is sent again, Since there is usually an encrypted authentication process that cannot be reused in the business process, if the business is still successfully completed after the original business data is sent again, it proves that there is a security problem in the business execution process; this method is only applicable to fixed test scenarios, such as for easy specification testing
  • the application layer of the scenario is not applicable to the underlying network where the test scenario cannot be clearly defined, the air interface protocol cannot be fuzzy tested, and the security of information transmitted between the user equipment (User Equipment, UE) and the 5G base station air interface cannot be guaranteed.
  • the main purpose of the embodiments of the present application is to provide a method, device, and mobile terminal for mining air interface protocol security vulnerabilities.
  • an embodiment of the present application provides a method for mining air interface protocol security vulnerabilities, which is applied to mobile terminals.
  • the method includes: obtaining mutated data, the mutated data is generated according to the fuzzing test task; obtaining air interface protocol business message; modify the service message according to the mutated data; send the modified service message to the base station; monitor the status of the base station, and record a security vulnerability log according to the status of the base station.
  • the embodiment of the present application also provides an air interface protocol security vulnerability mining device, which is characterized in that it includes: a first acquisition unit for acquiring mutated data, the mutated data is generated according to the fuzzing test task; The acquisition unit is used to obtain the service message; the modification unit is used to modify the service message according to the variation data; the sending unit is used to send the modified service message to the base station; the recording unit is used to monitor all The status of the base station is recorded, and the security vulnerability log is recorded according to the status of the base station.
  • an embodiment of the present application further provides a mobile terminal, including: at least one processor; and a memory connected to the at least one processor in communication; wherein, the memory stores information that can be used by the at least one processor Instructions executed by a processor, the instructions are executed by the at least one processor, so that the at least one processor can execute the above method.
  • an embodiment of the present application further provides a computer-readable storage medium storing a computer program, and implementing the above method when the computer program is executed by a processor.
  • the mobile terminal Since the mobile terminal can open the bottom layer port, it is allowed to modify the service message of the air interface protocol, that is By obtaining mutated data and service packets of the air interface protocol, modifying the service packets based on the mutated data, sending the modified service packets to the base station, and monitoring the status of the base station in real time, it is possible to record the security vulnerability log of the air interface protocol and mine the air interface
  • the effect of security loopholes in the protocol can improve the robustness and security of the base station and increase product competitiveness.
  • Fig. 1 is a flow chart of a mining method for an air interface protocol security hole according to an embodiment of the present application
  • Fig. 2 is a schematic diagram 1 of mutated data generation according to an embodiment of the present application.
  • Fig. 3 is a schematic diagram 2 of mutation data generation according to an embodiment of the present application.
  • Fig. 4 is a schematic diagram 3 of generating mutated data according to an embodiment of the present application.
  • FIG. 5 is a first schematic diagram of a data structure provided according to an embodiment of the present application.
  • FIG. 6 is a second schematic diagram of a data structure provided according to an embodiment of the present application.
  • FIG. 7 is a first schematic diagram of a mining method for air interface protocol security vulnerabilities provided according to an embodiment of the present application.
  • FIG. 8 is a second schematic diagram of a mining method for air interface protocol security vulnerabilities provided according to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a system for mining air interface protocol security vulnerabilities according to an embodiment of the present application.
  • FIG. 10 is a schematic diagram of an air interface protocol security vulnerability mining device provided according to an embodiment of the present application.
  • Fig. 11 is a schematic structural diagram of a mobile terminal according to an embodiment of the present application.
  • An embodiment of the present application relates to a mining method for air interface protocol security loopholes, which is applied to mobile terminals, and the mobile terminal supports the opening of the bottom layer interface.
  • the business message is parsed and the business message is modified.
  • the process of analyzing the service message and modifying the service message is generally realized through a customized bottom interface. Opening the bottom layer interface means that in-depth customization can be carried out on the mobile terminal to realize the fuzz testing function.
  • the specific flow of the mining method for air interface protocol security vulnerabilities in this embodiment can be shown in Figure 1, including:
  • Step 101 obtaining mutated data, which is generated according to the fuzzing task
  • Step 102 obtaining service packets of the air interface protocol
  • Step 103 modifying the service message according to the mutated data
  • Step 104 sending the modified service message to the base station
  • Step 105 monitor the status of the base station, and record security breach logs according to the status of the base station.
  • step 101 mutated data is obtained, and the mutated data is generated according to the fuzzing task. That is, the mobile terminal obtains the mutated data required in the fuzz testing process, and the mutated data is used to provide an unexpected input for the operation of the base station, and then the mobile terminal can monitor the operating status of the base station based on the unexpected input data to discover the security of the base station. loophole.
  • the fuzzing task and mutation data can be preset in a storage device, which is connected in communication with the mobile terminal or placed in the mobile terminal, and the mobile terminal is stored according to the detected real-time base station traffic. Match the corresponding fuzzing task in the device, query and obtain the corresponding mutation data according to the fuzzing task.
  • the mobile terminal receives the mutation data obtained by the server according to the fuzzing task.
  • the data in the data preset in the storage space is limited, so querying the mutated data from the preset data, the result of the mutated data is also limited; if the mutated data is limited, in To a certain extent, it will limit the effect of fuzz testing.
  • This embodiment provides a server for providing variation data for the mobile terminal, that is, the server can generate a fuzzing task according to the current service of the base station, and obtain variation data according to the fuzzing task.
  • the mutated data received by the server according to the fuzzing test task received by the mobile terminal is personalized and generated by the server according to the actual situation, and it is not a limited amount of data pre-stored in the storage space.
  • Variation data has limitations.
  • the method for generating mutated data provided by the mobile terminal receiving server in this embodiment expands the type, quantity and coverage of mutated data, and can ensure the effect of fuzz testing.
  • the fuzzing task can be obtained through the protocol data model in the server.
  • the protocol data model is generated by analyzing the protocol features and service features of the 5G air interface protocol. Protocols such as Service Data Adaptation Protocol (Service Data Adaptation Protocol, SDAP), Radio Resource Control (Radio Resource Control, RRC) protocol, Packet Data Convergence Protocol (Packet Data Convergence Protocol, PDCP), Radio Link Layer Control Protocol (Radio Link Control, RLC), Media Access Control (Media Access Control, MAC) protocol, etc. Protocol features such as SDAP protocol and RRC protocol, etc.
  • SDAP protocol is unique to the user plane, while RRC protocol is unique to the control plane, and other protocols are shared by the user plane and the control plane; business features include the role played by each protocol layer in the business, Services such as cell search, system information, paging, measurement, random access, etc.
  • the protocol data model combines the protocol features and service features to generate the matching relationship between different services and protocols, including the cell search model CELL_SEARCH_DATA_MODEL, the random access model RANDOM_ACCESS_DATA_MODEL, etc.
  • the protocol data model can first identify the services of the base station in real time, and determine the needs to be performed according to these matching relationships.
  • the business packets of the mutated protocol are combined with user requirements or preset requirements to generate fuzz testing tasks.
  • the protocol data model can be set for closed-loop learning and regular error checking and updating, etc., and can also handle more complex details. Compared with directly matching fuzzy testing tasks through preset correspondences, the fault tolerance rate is higher and the recognition accuracy is higher. The accuracy is higher, which can further guarantee the effect of obtaining the fuzzing task.
  • a task management module can be set in the above server to control the start and sequence of processes such as configuration, initiation, stop, suspension and recovery of the fuzzing test task.
  • the receiving server generates mutation data according to a mutation method; wherein, the mutation method is determined by the fuzzing task, and the mutation method includes one of the following or any combination thereof: multi-protocol field simultaneous mutation, disorderly mutation , Feedback variation. According to the content of the fuzzing test task, the mutation method corresponding to the content can be selected.
  • Simultaneous mutation of multiple protocol fields can improve the coverage of fuzz testing.
  • the implementation process of multi-protocol field simultaneous mutation for example: first obtain the protocol configuration (including the service message of the protocol and the characteristics of the protocol, etc.), arrange and combine them and put them into the protocol pool, wherein, The permutation and combination process can refer to the formula:
  • the protocol configuration contains the name, length, and value of each field of multiple protocols.
  • the protocol pool is composed of protocols plus field names, lengths, and values, such as the DC field name of the RLC protocol, the F field value of the MAC protocol, and the MAC protocol.
  • m and n can represent the specific layers of protocols, and can also represent the fields of a certain protocol; for example, two of the four protocols can be selected for fuzz testing, and five protocols of a certain protocol can also be selected 3 fields in field.
  • a mutation algorithm is used for the data in the protocol pool.
  • the protocol pool is a collection of business messages of the protocols that may be used.
  • the result set obtained by passing the data in the protocol pool through the mutation algorithm is as follows:
  • the use case seed pool extracts and combines the data in the use case seed pool to obtain test cases, puts the newly generated test cases into the original protocol pool, and the newly generated test cases are mutated data, that is, the mutated data is added to the original protocol in the pool.
  • the method of looping through the protocol pool can cover a variety of test scenarios and cover all the generated test cases. Since the multi-field simultaneous mutation method has no restrictions on the fields or types of mutations, that is to say, the coverage of the mutation results is relatively large, which can greatly improve the coverage of test cases in fuzz testing, thereby ensuring the coverage of fuzz testing.
  • Unordered mutation can realize replay, sequence, reverse order and other fuzzy testing processes. It does not use the data calculation process of the algorithm, but mainly selects special values.
  • Feedback variation is suitable for monitoring, recording, analysis and other processes in fuzz testing, as shown in Figure 4.
  • the specific implementation of feedback variation for example: identifying the state change of the log message of the base station, and analyzing the state characteristics of the log message according to the formula, that is, the analysis of the state change of the log message, for example, through the formula: analysis, where c i represents the type of air interface protocol, and ⁇ represents the state characteristics of the obtained log messages of the base station.
  • This calculation formula is used as a Bayesian classification model, which is mainly used to obtain the state characteristics for a certain air interface protocol type edge probability to complete the analysis of the state characteristics of the log message; the analyzed result is supplemented and updated to the use case pool, and the analyzed result is used to obtain the variation data, and the use case pool is used in this embodiment for the message
  • the seed pool provides mutated data for fuzz testing.
  • the mutated data used for fuzz testing is obtained by processing the data in the use case pool through the mutation algorithm and placed in the message seed pool.
  • the terminal obtains the data in the message seed pool, that is, The mobile terminal obtains the variation data.
  • the mobile terminal may send a request for the log message of the base station to the base station, and the base station may feed back the corresponding log message to the mobile terminal after receiving the request for the log message, and the mobile terminal may receive the feedback In the case of a log message, analyze the log message, and then obtain the status feature of the log message.
  • the mobile terminal can also send a request for the status characteristics of the log message of the base station to the base station, and the base station will give feedback after receiving the request, and the feedback information will carry the status of the log message of the base station feature, after receiving the feedback, the mobile terminal can obtain the status feature of the log message of the base station. It can be understood that, in the specific implementation process of the present application, the state characteristics of the log message of the base station are not limited.
  • the server analyzes the characteristics of the 5G air interface protocol (SDAP/RRC/PDCP/RLC/MAC, etc.), generates a protocol data model according to its characteristics, and the mobile terminal accesses the base station and obtains the current air interface protocol configuration Information, combined with three different machine learning methods to generate mutated data, the input message of the machine learning method can be generated according to a specific business model, such as simultaneous mutation of multiple protocol fields; it can also be a real business message extracted from a mobile terminal, such as no Sequence mutation, so as to automatically and gradually improve the coverage of test cases in an unattended state, and then discover deep-seated problems.
  • a specific business model such as simultaneous mutation of multiple protocol fields
  • it can also be a real business message extracted from a mobile terminal, such as no Sequence mutation, so as to automatically and gradually improve the coverage of test cases in an unattended state, and then discover deep-seated problems.
  • the task management module of the server or other server can be responsible for the configuration, initiation, stop, suspension and recovery of the fuzzing test task; the forwarding module is responsible for completing the control and data interaction between the server and the mobile terminal.
  • Step 102 acquiring service packets of the air interface protocol.
  • the service message of the air interface protocol is a service message that needs to be transmitted to the base station during the information exchange process between the mobile terminal and the base station. That is to say, before sending the service message to the base station, the mobile terminal needs to obtain the service message to be sent for subsequent processing of the service message to meet the requirements of the fuzz test.
  • the method further includes: parsing the service message.
  • the parsing module will analyze the service packets packaged by the L3 and L2 protocols on the air interface of the mobile terminal according to the standard protocol packet format, and identify the service packets in which they are located. Protocol layers, protocol fields, and protocol field attributes. Among them, the analysis of the service message is mainly completed with reference to the 3GPP protocol format.
  • the protocol layer (such as MAC, RLC, etc.), protocol fields (such as logical channel identify (logical channel identify, lcid), segment Information (Segmentation Info, SI), serial number (Serial Number, SN, etc.) , SDU) format as shown in Figure 5.
  • payload is the payload
  • R represents the reserved field
  • DC represents the data/control field
  • L represents the field of the length of the SDU or control message, and its length is indicated by the F field
  • SO indicates the segment offset field.
  • Step 103 modifying the service message according to the mutated data.
  • the mobile terminal After the mobile terminal obtains the mutated data and the service message of the air interface protocol, it matches the mutated data with the service message in combination with the fuzzing test task, that is, modifies the service message according to the mutated data, and writes the generated fuzzy test data into the service message corresponding data location.
  • the fuzzing task can be obtained by the mobile terminal alone or together with the mutation data.
  • the obtained mutated log message is stored in the message seed pool, and then the service message is modified with the message in the message seed pool, and the message modification is completed.
  • SDUs of one TB block of the service message The format modification method is shown in Figure 6, where Muiti entry phr means multi-entry power headroom report, phr is called Power Headroom Report, and short bsr means short BSR format.
  • the mobile terminal After the mobile terminal receives the mutated data, it will store it in the inter-core shared memory.
  • the test task obtains the required mutation data.
  • the components of the mutated data also include the message header, where the message header can be customized according to requirements.
  • modifying the service message according to the mutated data includes: determining a data position corresponding to the mutated data in the parsed air interface protocol service message; modifying the mutated data at the data position The analysis Subsequent air interface protocol service packets.
  • the fuzz test task can support the modification of the fields in the service message of a single or multiple 5G air interface protocols, and can also support the modification of a certain segment of the service message. Since the mutated data may be data generated by different protocols, it needs to be placed in the corresponding position where it is generated, so as to prevent the location change of the mutated data from affecting the structure of the business message, for example, to cause the protocol to detect structural problems during execution.
  • modifying the service message according to the variation data includes: modifying the service message according to the variation data within a scheduling delay of the service message.
  • the mobile terminal will complete the modification of the service message according to the fuzzy test task, and use the KMP algorithm (Knuth-Morris-Pratt, string matching algorithm) to make the time consumption of obtaining and modifying the service message not exceed the time range of service scheduling.
  • KMP algorithm Knuth-Morris-Pratt, string matching algorithm
  • Step 104 sending the modified service message to the base station.
  • the message processing module in the mobile terminal obtains the mutated data, it completes the modification of the 5G air interface protocol message according to the fuzzy test task configured on the server.
  • the service scheduling According to the original time window, the modified service message is sent to the 5G base station through the physical layer and radio frequency antenna.
  • Step 105 monitor the status of the base station, and record security breach logs according to the status of the base station. That is, after the mobile terminal sends the service message modified according to the mutated data to the base station, it detects the operation status of the base station, so as to discover the security loopholes of the base station.
  • recording a security breach log according to the state of the base station includes: the mobile terminal identifies whether the base station has a security breach according to the state of the base station; if there is a security breach, recording a security breach log; wherein, the security breach
  • the logs include protocol fields, service packets before and after mutation, and system logs of the mobile terminal.
  • the mobile terminal monitors the status of the base station in real time, and judges whether a security vulnerability is found based on the status information of the base station obtained through the interface of the mobile terminal, and then the mobile terminal can confirm whether the 5G base station generates an abnormal alarm or the system crashes through the network management system of the 5G base station. After a security vulnerability is discovered, the security vulnerability log is collected.
  • the security vulnerability log contains the necessary information needed to locate the problem, which is used to help accurately locate the trigger location of the security vulnerability and provide a favorable support for finding a solution to the security vulnerability.
  • the abnormal status of the 5G base station that the mobile terminal can perceive mainly includes abnormal status such as cell abnormality, link uplink out-of-sync, link downlink out-of-sync, and link re-establishment. It is also possible to confirm through the network management system of the 5G base station whether there is an alarm or system abnormality in the 5G base station system.
  • the task of monitoring the state of the base station is mainly completed by the monitoring module in the mobile terminal.
  • the monitoring module obtains the state of the base station from the interface of the mobile terminal.
  • the monitoring module can also be responsible for the real-time forwarding function of the log when the state of the base station is normal or abnormal, and sends it to Server.
  • the server-side maintenance and measurement module will complete the local storage and interface display of the base station status and recorded logs.
  • the method further includes: retesting the security vulnerability according to the security vulnerability log to determine the problematic protocol field of the security vulnerability. That is, it supports retesting of detected security vulnerabilities, which is convenient for developers to repair the vulnerabilities.
  • the system After the system discovers the vulnerability, it will store the business scenario of the fuzz test at this time, the mutated data generated by the 5G air interface protocol data model (such as the random access model RANDOM_ACCESS_DATA_MODEL ), and the mutated data generated by the mutated data. test case. If vulnerability retesting is required, the system will use the According to the information of the vulnerability, the fuzz test is performed again according to the process of discovering the vulnerability, so as to complete the recurrence of the security vulnerability. In some execution processes, related functions can be implemented by triggering the fuzzing retesting function of task management in the system.
  • the implementation process with the retesting process is shown in Figure 8, wherein the protocol model is the above protocol data model, the 5G base station air interface protocol configuration is the above protocol configuration, and the base station configuration is the aforementioned base station air interface protocol configuration .
  • the user interface in the mobile terminal mainly includes environment configuration, task management and task details.
  • environment configuration configuration items such as background/log server address, business address, foreground/SFTP server address, environment identification number, etc.
  • task management responsible for background and foreground fuzzy test terminal test task delivery and task management functions, support The multi-task sequential test and single-task test in different modes also support the functions of manually stopping the test, pausing/resuming the test and clearing the records
  • task details mainly include three parts: status statistics, task details and message statistics.
  • the above-mentioned method embodiment can be embodied in the form of a module, which is named as a fuzz testing system, as shown in FIG. 9 , including a task management module located at the server (server) for managing fuzz testing tasks;
  • the intelligent mutator on the server side is used to generate mutated data;
  • the forwarding module on the server side is used for information interaction between the server side and the mobile terminal;
  • the maintenance module on the server side is used to store the base station status and recorded logs locally and Interface display;
  • the communication module located in the mobile terminal is used for information interaction with the server;
  • the message analysis module located in the mobile terminal is used to complete the air interface protocol message analysis;
  • the message processing module located in the mobile terminal is used to The mutated data and the parsed message complete the message mutation;
  • the radio frequency antenna located in the mobile terminal is used for information interaction with the base station;
  • the monitoring module located in the mobile terminal is used to monitor the status of the base station and complete the fuzzy test.
  • a mobile terminal based on an open bottom layer interface is proposed to realize the mining method of air interface protocol security loopholes in fuzzy testing.
  • the air interface protocol can be reflected through the data transmission between the base station and the mobile terminal.
  • the bottom port allows modification of the service packets of the air interface protocol, that is, by obtaining mutated data and service packets of the air interface protocol, modifying the service packets in combination with the mutated data, sending the modified service packets to the base station, and monitoring the base station in real time state, confirm the security problems of the base station caused by the modified air interface protocol, and then realize the effect of mining the security loopholes of the air interface protocol.
  • this application adopts the fuzzing test embedded in the air interface protocol process and parsing the air interface data stream.
  • the mutator is integrated into the machine learning algorithm, which can better perform fuzzing testing on the air interface protocol.
  • the depth of the test is deeper and the breadth is more comprehensive. Robustness and security, increasing product competitiveness.
  • FIG. 10 is a schematic diagram of a mining device for air interface protocol security vulnerabilities described in this embodiment, including:
  • the first acquiring unit 201 is configured to acquire mutated data, the mutated data is generated according to the fuzzing task;
  • the second obtaining unit 202 is configured to obtain service packets
  • a modifying unit 203 configured to modify the service message according to the mutated data
  • a sending unit 204 configured to send the modified service message to the base station
  • the recording unit 205 is configured to monitor the state of the base station, and record a security breach log according to the state of the base station.
  • the acquired mutated data for example: receiving mutated data obtained by the server according to the fuzzing test task.
  • the receiving server obtains the mutation data according to the fuzzing task, including: receiving server Mutation data is generated according to a mutation method; wherein, the mutation method is determined by the fuzzing task, and the mutation method includes one of the following or any combination thereof: multi-protocol field simultaneous mutation, disorderly mutation, and feedback mutation.
  • the multi-protocol fields are simultaneously mutated, including: acquiring the required protocol configurations for the fuzz testing task, the protocol configurations including service packets of each protocol; using a mutation algorithm for each protocol configuration, obtaining A use case seed pool; obtain mutation data from the use case seed pool.
  • the feedback variation includes: obtaining the mobile terminal log message of the base station with a certain status feature, analyzing the status feature; placing the analysis result in a use case pool; analyzing the use case pool Results Mutation data were obtained by mutation algorithm.
  • modifying unit 203 after acquiring the service message of the air interface protocol and before modifying the service message according to the mutated data, it further includes: parsing the service message; Modifying the service message includes: determining the data position corresponding to the mutated data in the parsed air interface protocol service message; modifying the parsed air interface protocol service message according to the mutated data at the data position .
  • the modifying the service message according to the variation data includes: within the scheduling delay of the service message, modifying the service message according to the variation data.
  • a security breach log according to the state of the base station, for example: identify whether the base station has a security breach according to the state of the base station; if there is a security breach, record a security breach log; wherein, the The security vulnerability log includes protocol fields, service packets before and after mutation, and system logs of the mobile terminal.
  • the method further includes: retesting the security breach according to the security breach log to determine a problematic protocol field of the security breach.
  • a mobile terminal based on an open bottom layer interface is proposed to realize a fuzzy testing method for mining security vulnerabilities of the air interface protocol.
  • the mobile terminal Since the mobile terminal can open the bottom layer port, it is allowed to modify the service message of the air interface protocol, that is By obtaining mutated data and service packets of the air interface protocol, modifying the service packets based on the mutated data, sending the modified service packets to the base station, and monitoring the status of the base station in real time, it is possible to record the security vulnerability log of the air interface protocol and mine the air interface
  • the effect of security loopholes in the protocol can improve the robustness and security of the base station and increase product competitiveness.
  • this embodiment is an apparatus embodiment corresponding to the above method embodiment, and this embodiment can be implemented in cooperation with the above method embodiment.
  • the relevant technical details and technical effects mentioned in the above embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition.
  • the relevant technical details mentioned in this embodiment can also be applied in the above embodiments.
  • modules involved in this embodiment are logical modules.
  • a logical unit can be a physical unit, or a part of a physical unit, or multiple physical units. Combination of units.
  • units that are not closely related to solving the technical problem proposed in the present application are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.
  • FIG. 11 Another embodiment of the present application relates to a mobile terminal, as shown in FIG. 11 , including: at least one processor 301; and a memory 302 communicatively connected to the at least one processor 301; wherein, the memory 302 stores Instructions that can be executed by the at least one processor 301, the instructions are executed by the at least one processor 301, so that the at least one processor 301 can execute the method for mining air interface protocol security holes in the above-mentioned embodiments .
  • the memory and the processor are connected by a bus, and the bus may include any number of interconnected buses and bridges,
  • the bus connects together the various circuits of one or more processors and memory.
  • the bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein.
  • the bus interface provides an interface between the bus and the transceivers.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium.
  • the data processed by the processor is transmitted on the wireless medium through the antenna, further, the antenna also receives the data and transmits the data to the processor.
  • the processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Instead, memory can be used to store data that the processor uses when performing operations.
  • Another embodiment of the present application relates to a computer-readable storage medium storing a computer program.
  • the above method embodiments are implemented when the computer program is executed by the processor.
  • a storage medium includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Abstract

本申请实施例涉及通信传输安全技术领域，特别涉及一种空口协议安全漏洞的挖掘方法、装置、移动终端。上述空口协议安全漏洞的挖掘方法包括：获取变异数据，所述变异数据根据模糊测试任务生成；获取空口协议的业务报文；根据所述变异数据修改所述业务报文；将修改后的业务报文发送至基站；监控所述基站的状态，根据所述基站的状态记录安全漏洞日志。

Description

空口协议安全漏洞的挖掘方法、装置、移动终端
相关申请
本申请要求于2022年2月15号申请的、申请号为202210138690.1的中国专利申请的优先权。
技术领域
本申请实施例涉及通信传输安全技术领域，特别涉及一种空口协议安全漏洞的挖掘方法、装置、移动终端。
背景技术
随着5G网络大规模商用，5G基站作为无线通信网络不可或缺的组成部分，其安全性受到广泛关注，3GPP安全保障系列标准(Security Assurance Specification，SCAS)规范、通信监管部门和运营商均有空口协议安全测试要求，因此基于模糊测试的空口协议安全漏洞挖掘变的尤为重要。
对此，长期演进技术(Long Term Evolution，LTE)网络控制组件及控制平面过程的模糊测试，该方案采用常规流程重放的模糊测试，即，将已完成的业务的原业务数据进行再次发送，由于业务流程中通常存在不可二次利用的加密认证过程，若原业务数据再次发送后业务依然成功完成，则证明业务执行过程存在安全问题；该方式仅适用于固定的测试场景，例如针对易规范测试场景的应用层，对于无法明确测试场景的底层网络不适用，不能对空口协议进行模糊测试，无法保证用户设备(User Equipment，UE)与5G基站空口上传输信息的安全性。
发明内容
本申请实施例的主要目的在于提出一种空口协议安全漏洞的挖掘方法、装置、移动终端。
为实现上述目的，本申请实施例提供了一种空口协议安全漏洞的挖掘方法，应用于移动终端，所述方法包括：获取变异数据，所述变异数据根据模糊测试任务生成；获取空口协议的业务报文；根据所述变异数据修改所述业务报文；将修改后的业务报文发送至基站；监控所述基站的状态，根据所述基站的状态记录安全漏洞日志。
为实现上述目的，本申请实施例还提供一种空口协议安全漏洞的挖掘装置，其特征在于，包括：第一获取单元，用于获取变异数据，所述变异数据根据模糊测试任务生成；第二获取单元，用于获取业务报文；修改单元，用于根据所述变异数据修改所述业务报文；发送单元，用于将修改后的业务报文发送至基站；记录单元，用于监控所述基站的状态，根据所述基站的状态记录安全漏洞日志。
为实现上述目的，本申请实施例还提供了一种移动终端，包括：至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行上述的方法。
为实现上述目的，本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现上述的方法。
传统方案中，大多空口协议测试是完成功能和性能的测试，对于一些更深更广层次的安全问题很难被发现，例如大多数空口协议测试是对基站的正常使用功能或者性能参数进行测试，集中于应用层，对于调用链比较深的场景、协议的实现、协议标准的执行等过程无法进行检测，其中，调用链比较深的场景例如：代码层面功能由多层接口实现，调用关系较多等。本申请的实施例中提出了一种基于开放底层接口的移动终端，实现模糊测试的空口协议安全漏洞的挖掘方法，由于移动终端能够开放底层端口，允许对空口协议的业务报文进行修改，即通过获取变异数据及获取空口协议的业务报文，结合变异数据修改业务报文，将修改后的业务报文发送至基站，实时监控基站的状态，可以实现记录空口协议的安全漏洞日志，挖掘空口协议的安全漏洞的效果，进而能够提升基站的健壮性和安全性，增加产品竞争力。
附图说明
图1是根据本申请一个实施例的空口协议安全漏洞的挖掘方法的流程图；
图2是根据本申请一个实施例中变异数据生成的示意图一；
图3是根据本申请一个实施例中变异数据生成的示意图二；
图4是根据本申请一个实施例中变异数据生成的示意图三；
图5是根据本申请一个实施例提供的数据结构的示意图一；
图6是根据本申请一个实施例提供的数据结构的示意图二；
图7是根据本申请一个实施例提供的空口协议安全漏洞的挖掘方法的示意图一；
图8是根据本申请一个实施例提供的空口协议安全漏洞的挖掘方法的示意图二；
图9是根据本申请一个实施例提供的空口协议安全漏洞挖掘的系统的示意图；
图10是根据本申请一个实施例提供的空口协议安全漏洞的挖掘装置的示意图；
图11是根据本申请一个实施例的移动终端的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施例进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施例中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施例的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
本申请的一个实施例涉及一种空口协议安全漏洞的挖掘方法，应用于移动终端，所述移动终端支持开放底层接口，底层接口，即移动终端在业务报文组包完成后，发送给物理层处理前，将该业务报文进行解析及业务报文修改的部分，业务报文进行解析及业务报文修改的过程一般通过定制的底层接口实现。开放底层接口即能够在移动终端上进行深度定制实现模糊测试功能。本实施例的空口协议安全漏洞的挖掘方法的具体流程可以如图1所示，包括：
步骤101，获取变异数据，变异数据根据模糊测试任务生成；
步骤102，获取空口协议的业务报文；
步骤103，根据变异数据修改业务报文；
步骤104，将修改后的业务报文发送至基站；
步骤105，监控基站的状态，根据基站的状态记录安全漏洞日志。
下面对本实施例的空口协议安全漏洞的挖掘方法的实现细节进行具体的说明，以下内容仅为方便理解提供的实现细节，并非实施本方案的必须。
步骤101，获取变异数据，变异数据根据模糊测试任务生成。即，移动终端获取模糊测试过程中所需要的变异数据，变异数据用于为基站的运行提供一种非预期的输入，进而移动终端能够监测基站基于非预期输入数据的运行状况，以发掘基站安全漏洞。在一些情况下，模糊测试任务和变异数据可以预置在存储设备中，该存储设备与所述移动终端通信连接或置于所述移动终端中，移动终端根据检测到的实时的基站业务在存储设备中匹配对应的模糊测试任务，根据所述模糊测试任务查询并获取对应的变异数据。
在一个例子中，移动终端接收服务器根据模糊测试任务得到的变异数据。可以理解的是，在预置于存储空间中的数据中的数据是有限的，所以从所述预置的数据中查询变异数据，得到的变异数据的结果也是有限的；若变异数据有限，在一定程度上会限制模糊测试的效果。本实施例提供服务器用于为移动终端提供变异数据，即服务器能够根据基站当前的业务生成模糊测试任务，并根据模糊测试任务得到变异数据。也就是说，移动终端所接收到的服务器根据模糊测试任务得到的变异数据，均为所述服务器根据实际情况个性化生成，不是在存储空间中预存的有限个数据，不会对模糊测试任务或变异数据存在限制。本实施例所提供的移动终端接收服务器生成变异数据的方式，拓展了变异数据的种类、数量及覆盖范围，能够保证模糊测试的效果。
其中，在服务器生成模糊测试任务时，模糊测试任务可以通过服务器中的协议数据模型得到。该协议数据模型通过分析5G空口协议具有的协议特征和业务特征生成。协议例如服务数据适配协议(Service Data Adaptation Protocol，SDAP)、无线资源控制(Radio Resource Control，RRC)协议、分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)、无线链路层控制协议(Radio Link Control，RLC)、介质访问控制(Media Access Control，MAC)协议等。协议特征例如SDAP协议和RRC协议等，SDAP协议是用户面独有，而RRC协议是控制面特有，其他协议是用户面和控制面共有；业务特征包括各协议层在业务上所发挥的作用，业务如小区搜索、系统消息、寻呼、测量、随机接入等。协议数据模型结合协议特征和业务特征生成不同业务与协议的匹配关系，包括小区搜索模型CELL_SEARCH_DATA_MODEL、随机接入模型RANDOM_ACCESS_DATA_MODEL等，协议数据模型可以先实时识别到基站的业务，根据这些匹配关系确定需要进行变异的协议的业务报文，并结合用户需求或预置的要求生成模糊测试任务。可以理解的是，协议数据模型可以设置闭环学习和定期查错更新等，还能够处理更复杂的细节情况，相较于直接通过预置的对应关系匹配模糊测试任务，容错率更高，识别的准确度更高，能够进一步保证获取模糊测试任务的效果。
另外，上述服务器中可以设置任务管理模块，用于控制模糊测试任务的配置、发起、停止、暂停和恢复等进程的起始和顺序。
在一个例子中，接收服务器根据变异方法生成变异数据；其中，所述变异方法由所述模糊测试任务确定，所述变异方法包括以下之一或其任意组合：多协议字段同时变异、无序变异、反馈变异。能够根据模糊测试任务的内容，选择该内容对应的变异方法。
多协议字段同时变异，能够提升模糊测试的覆盖范围。具体可参考图2，其中，多协议字段同时变异的实现流程，例如：首先获取协议配置(包括协议的业务报文和协议的特征等)，将其排列组合后置入协议池中，其中，排列组合过程可参考公式：协议配置中是多个协议的各字段的名称、长度、值，协议池均是由协议加字段名称、长度、值的排列组合，如RLC协议的DC字段名称、MAC协议的F字段值、MAC协议的LCID字段的长度和值等。公式中m和n可以表示具体的哪几层协议，也可以表示某个协议的哪几个字段；如可以选取4个协议中的2个进行模糊测试，还可以选取某一个协议的5个协议字段里的3个字段。对于协议池中的数据采用变异算法，协议池为可能用到的协议的业务报文的集合，将协议池中数据通过变异算法(此处并不限定具体变异算法的类型)得到的结果集合为用例种子池，对于用例种子池中的数据进行抽取、组合得到测试用例，将新生成的测试用例置入原协议池，新生成的测试用例即为变异数据，也就是将变异数据加入进原协议池中。另外，在将新生成的测试用例置入原协议池时，采用循环遍历协议池的方法，可以覆盖多种测试场景，将生成的测试用例均测试覆盖到。由于多字段同时变异的方式对于发生变异的字段或类型不存在限制，也就是说变异结果覆盖的范围较大，能够极大提升模糊测试中测试用例覆盖率，从而保证模糊测试的覆盖范围。
无序变异可实现重放、顺序、倒序等模糊测试过程，并不采用算法的数据运算过程，主要是选取特殊值。具体可参考图3，其中，无序变异的实现流程，例如：对需要变异的协议的业务报文进行特征分析，根据模糊测试任务采取对应的处理措施；所述处理措施包括默认的将所有数据均作为模糊测试的变异数据(即在模糊测试过程中遍历所有数据)，或将边界值均作为变异数据；或者采用公式：an＝a1+(n-1)d或者公式an＝a1×qn-1，选取参与模糊测试任务的变异数据，也就是变异数据可以选择等差数列an＝a1+(n-1)d，等比数列an＝a1*qn-1，或选a1，a1是选取的第一个用例，d是等差数列的公差，q是等比数列的公比，an是选取的第n个测试用例；同时可以设置获取其变异数据的检测顺序为Positive/Reverse，即正序或者逆序选取测试用例；在本情况下，变异数据的选取范围为：min＜an＜max/an＝aFinxed，min代表选取用例的最小值，即至少选择1个测试用例，max/an＝aFinxed是测试用例的最大值，即用例池中能存放的最大用例数。
反馈变异适用于模糊测试中需要监控、记录、分析等过程，如图4所示。反馈变异的具体实现，例如：识别基站的日志报文的状态变化，并根据公式进行日志报文的状态特征的分析，即日志报文的状态变化的分析，例如通过公式：进行分析，其中，ci代表空口协议类别，ω代表获取的基站的日志报文的状态特征，本计算公式作为贝叶斯的分类模型，主要用于获取特定空口协议类别下针对某一状态特征的边缘概率，以完成日志报文的状态特征的分析；将分析后的结果补充更新至用例池，所述分析后的结果用于获取变异数据，用例池在本实施方式中用于为报文种子池提供模糊测试的变异数据，其中，用于模糊测试的变异数据通过变异算法处理用例池中的数据得到，并置于报文种子池中，终端获取报文种子池中的数据，也就是移动终端获取变异数据。在一些例子中，可以由移动终端向基站发送对于基站的日志报文的请求，基站收到该日志报文的请求后反馈对应的日志报文至移动终端，移动终端在接收到所述反馈的日志报文的情况下，对于所述日志报文进行分析，进而获取所述日志报文的状态特征。此外，还可以由移动终端向基站发送对于基站的日志报文的状态特征的请求，基站收到该请求后进行反馈，反馈的信息中携带所述基站的日志报文的状态 特征，移动终端收到所述反馈后，即能够获取到所述基站的日志报文的状态特征。可以理解的是，在本申请具体实施的过程中，并不限制基站的日志报文的状态特征。
对于步骤101，在一个实施方式中，服务器分析5G空口协议(SDAP/RRC/PDCP/RLC/MAC等)具有的特征，根据其特征生成协议数据模型，移动终端接入基站并获取当前空口协议配置信息，结合不同的三种机器学习方法生成变异数据，机器学习方法的输入报文可以依据特定业务模型生成，例如多协议字段同时变异；也可以是从移动终端提取的真实业务报文，例如无序变异，从而在无人值守的状态下自动逐步提高测试用例覆盖率，进而发现深层次的问题。还能够通过引入真实业务报文作为反馈环，例如反馈变异，融入机器学习方法和信令状态机模型，自动化行为学习闭环和状态机模型更新。变异数据生成后可以经转发模块发送至移动终端的通讯模块进行存储。服务器或其他服务端的任务管理模块能够负责模糊测试任务的配置、发起、停止、暂停和恢复；转发模块负责完成服务端和移动终端的控制和数据交互。
步骤102，获取空口协议的业务报文。空口协议的业务报文为移动终端与基站进行信息交互的过程中，需要向基站传输的业务报文。也就是说，在将业务报文向基站发送之前，移动终端需要获取即将发送的业务报文，供后续对该业务报文进行处理，满足模糊测试的要求。
在一个例子中，在获取空口协议的业务报文之后，根据变异数据修改所述业务报文之前，还包括：解析所述业务报文。例如，移动终端接入基站(例如5G基站)做数据业务时，解析模块会按照标准协议报文格式将移动终端空口L3、L2层协议组包后的业务报文进行解析，识别其所处的协议层、协议字段及协议字段属性。其中，业务报文的解析主要参考3GPP协议格式来完成，经报文解析后能够识别出协议层(如MAC、RLC等)、协议字段(如逻辑信道标识(logical channel identify，lcid)、分段信息(Segmentation Info，SI)、序列号(Serial Number，SN)等)及协议字段属性(如长度等)，业务报文一个太字节(Terabyte，TB)块的若干服务数据单元(Service Data Unit，SDU)格式如图5所示。对于图5所示格式，其中payload为有效负荷；R表示保留字段；DC表示数据/控制字段；L表示SDU或者控制消息的长度的域，它的长度由F域指示；F用于指示L的长度，如果SDU或者控制消息的长度大于128byte，那么设置F＝1，否则设为0；SO表示段偏移字段。
步骤103，根据变异数据修改业务报文。移动终端在获取变异数据和空口协议的业务报文之后，结合模糊测试任务将变异数据与业务报文相匹配，即根据变异数据修改业务报文，将生成的模糊测试的数据写到业务报文对应的数据位置。可以理解的是，模糊测试任务可以由移动终端单独获取，或随变异数据一同获取。
以反馈变异为例，获取的变异后的日志报文存储至报文种子池，进而以报文种子池中的报文修改业务报文，完成报文修改，业务报文一个TB块的若干SDU格式修改方法如图6所示，其中Muiti entry phr表示多入口功率余量报告，phr全称为Power Headroom Report，short bsr表示短BSR格式。
在一个例子中，移动终端接收到变异数据后会将其存储至核间共享内存，待完成空口协议的业务报文解析(例如，5G空口协议的业务报文解析)后，移动终端再根据模糊测试任务获取所需要的变异数据。变异数据的组成部分还包括报文头，其中报文头可根据需求定制。
在一个例子中，根据所述变异数据修改所述业务报文，包括：在解析后的空口协议业务报文中确定所述变异数据对应的数据位置；在所述数据位置根据所述变异数据修改所述解析 后的空口协议业务报文。其中，模糊测试任务可以支持单个或者多个5G空口协议的业务报文中字段的修改，也可支持某一段业务报文的修改。由于变异数据可能是由不同协议生成的数据，所以需要放置在其生成的对应位置，避免产生变异数据的位置变化影响到业务报文的结构，例如使得协议在执行过程中检测到结构有问题，包括不符合校验规则，进而相关业务报文被直接丢弃，无法执行模糊测试的情况。进一步减少模糊测试任务执行过程中的影响因素，保证模糊测试任务的顺利执行，提高测试效率。
在一个例子中，根据所述变异数据修改所述业务报文，包括：在所述业务报文的调度时延内，根据所述变异数据修改所述业务报文。例如，移动终端会根据模糊测试任务，完成业务报文的修改，采用KMP算法(Knuth-Morris-Pratt，字符串匹配算法)使获取和修改业务报文的耗时不超出业务调度的时间范围。
步骤104，将修改后的业务报文发送至基站。移动终端中的报文处理模块获取变异数据后，根据服务端配置的模糊测试任务完成5G空口协议报文修改，获取和修改5G空口协议报文满足5G空口协议时延要求的情况下，业务调度按照原有的时间窗将修改后的业务报文经物理层及射频天线发送给5G基站。
步骤105，监控基站的状态，根据基站的状态记录安全漏洞日志。即，移动终端在向基站发送了根据变异数据修改的业务报文之后，检测基站的运行情况，以发掘基站的安全漏洞。
在一个例子中，根据所述基站的状态记录安全漏洞日志，包括：移动终端根据所述基站的状态识别所述基站是否存在安全漏洞；若存在安全漏洞，则记录安全漏洞日志；其中，安全漏洞日志包括协议字段、变异前和变异后的业务报文和所述移动终端的系统日志。
移动终端实时监控基站的状态，依据移动终端的接口获取的基站的状态信息来判断是否发现安全漏洞，进而移动终端能够通过5G基站的网管系统确认5G基站是否产生异常告警或者系统崩溃。发现安全漏洞后采集安全漏洞日志，安全漏洞日志包含问题定位所需要的必要信息，用于帮助准确定位安全漏洞的触发位置，为找出安全漏洞解决方案提供有利支撑。以发现5G基站下行失步漏洞为例，发现该漏洞后需要保存协议字段(lcid、SI、DC等)变异前和变异后的报文、transtime、tbSize和移动终端系统日志等信息，根据这些信息匹配该时间片内5G基站系统的系统日志信息，进而确认触发漏洞的协议字段。以发现5G基站下行失步漏洞为例，移动终端中的监控模块工作过程如图7所示。
其中，移动终端能够感知的5G基站异常状态主要包括小区异常、链路上行失步、链路下行失步、链路重建立等异常状态。亦可通过5G基站的网管系统确认5G基站系统是否发生告警或者系统异常。监控基站状态的任务主要由移动终端中的监控模块完成，监控模块从移动终端接口获取基站状态，除此之外监控模块还能够负责基站状态正常和异常时日志实时转发功能，经通讯模块发送给服务端。服务端维测模块会把基站状态和记录的日志完成本地存储及界面展示。
在一个例子中，所述根据所述基站的状态记录安全漏洞日志之后，还包括：根据所述安全漏洞日志复测安全漏洞以确定所述安全漏洞的问题协议字段。即，支持对检测到的安全漏洞进行复测，便于开发人员进行漏洞修复。
如以发现5G基站下行失步漏洞为例，系统发现该漏洞后会存储此时模糊测试的业务场景、5G空口协议数据模型(如随机接入模型RANDOM_ACCESS_DATA_MODEL)生成的变异数据以及由变异数据生成的测试用例。若需要进行漏洞复测，系统会使用发现漏洞时存储 的信息，按照发现漏洞的流程再次进行模糊测试，从而完成安全漏洞复现。在一些执行过程中，相关功能可以在系统触发任务管理的模糊测试复测功能以实现。
在一个例子中，具有复测流程的实施过程如图8所示，其中，所述协议模型为上述协议数据模型，所述5G基站空口协议配置为上述协议配置，基站配置为前述基站空口协议配置。
另外，移动终端中的用户界面主要包括环境配置、任务管理和任务详情。具体地，环境配置，配置项如后台/日志服务器地址、业务地址、前台/SFTP服器地址、环境标识号等；任务管理，负责后台与前台模糊测试终端测试任务下发及任务管理功能，支持不同模式的多任务顺序的接续测试和单任务测试，还支持用户手动停止测试、暂停/恢复测试和清空记录的功能；任务详情，主要包括状态统计、任务详情以及报文统计三部分功能。
在一个例子中，上述方法实施例可以以模块的形式进行体现，将其命名为模糊测试系统，如图9所示，包括位于服务端(服务器)的任务管理模块，用于管理模糊测试任务；位于服务端的智能变异器，用于生成变异数据；位于服务端的转发模块，用于服务端与移动终端进行信息交互；位于服务端的维测模块，用于把基站状态和记录的日志完成本地存储及界面展示；位于移动终端的通信模块，用于与服务端进行信息交互；位于移动终端的报文解析模块，用于完成完成空口协议报文解析；位于移动终端的报文处理模块，用于根据变异数据和解析后的报文完成报文变异；位于移动终端的射频天线，用于与基站进行信息交互；位于移动终端的监控模块，用于监控基站的状态，完成模糊测试。
传统方案中，大多空口协议测试是完成功能和性能的测试，对于一些更深更广层次的安全问题很难被发现。本申请的实施例中提出了一种基于开放底层接口的移动终端，实现模糊测试的空口协议安全漏洞的挖掘方法，空口协议可以通过基站和移动终端之间的数据传输体现，由于移动终端能够开放底层端口，允许对空口协议的业务报文进行修改，即通过获取变异数据及获取空口协议的业务报文，结合变异数据修改业务报文，将修改后的业务报文发送至基站，实时监控基站的状态，确认由修改后的空口协议引起的基站的安全问题，进而可以实现挖掘空口协议的安全漏洞的效果。并且本申请采用嵌入空口协议流程和解析空口数据码流的模糊测试，变异器融入机器学习算法，能够更好地对空口协议进行模糊测试，测试的深度更深入且广度更全面，进而能够提升基站的健壮性和安全性，增加产品竞争力。
本申请的另一个实施例涉及一种空口协议安全漏洞的挖掘装置，下面对本实施例的空口协议安全漏洞的挖掘装置的实现细节进行具体的说明，以下内容仅为方便理解提供的实现细节，并非实施本方案的必须，图10是本实施例所述的空口协议安全漏洞的挖掘装置的示意图，包括：
第一获取单元201，用于获取变异数据，所述变异数据根据模糊测试任务生成；
第二获取单元202，用于获取业务报文；
修改单元203，用于根据所述变异数据修改所述业务报文；
发送单元204，用于将修改后的业务报文发送至基站；
记录单元205，用于监控所述基站的状态，根据所述基站的状态记录安全漏洞日志。
对于所述第一获取单元201，所述获取变异数据，例如：接收服务器根据模糊测试任务得到的变异数据。
在一个例子中，所述接收服务器根据模糊测试任务得到的变异数据，包括：接收服务器 根据变异方法生成变异数据；其中，所述变异方法由所述模糊测试任务确定，所述变异方法包括以下之一或其任意组合：多协议字段同时变异、无序变异、反馈变异。
在一个例子中，所述多协议字段同时变异，包括：获取模糊测试任务所需的各协议配置，所述各协议配置包括各协议的业务报文；对于各所述协议配置采用变异算法，得到用例种子池；从所述用例种子池中获取变异数据。
在一个例子中，所述反馈变异，包括：获取所述基站具有某种状态特征的移动终端日志报文，分析所述状态特征；将分析结果置于用例池；对所述用例池中的分析结果采用变异算法得到变异数据。
对于所述修改单元203，所述获取空口协议的业务报文之后，所述根据所述变异数据修改所述业务报文之前，还包括：解析所述业务报文；所述根据所述变异数据修改所述业务报文，包括：在解析后的空口协议业务报文中确定所述变异数据对应的数据位置；在所述数据位置根据所述变异数据修改所述解析后的空口协议业务报文。
在一个例子中，所述根据所述变异数据修改所述业务报文，包括：在所述业务报文的调度时延内，根据所述变异数据修改所述业务报文。
对于所述记录单元205，根据所述基站的状态记录安全漏洞日志，例如：根据所述基站的状态识别所述基站是否存在安全漏洞；若存在安全漏洞，则记录安全漏洞日志；其中，所述安全漏洞日志包括协议字段、变异前和变异后的业务报文以及所述移动终端的系统日志。
在一个例子中，根据所述基站的状态记录安全漏洞日志之后，还包括：根据所述安全漏洞日志复测安全漏洞以确定所述安全漏洞的问题协议字段。
传统方案中，大多空口协议测试是完成功能和性能的测试，对于一些更深更广层次的安全问题很难被发现。本申请的实施例中提出了一种基于开放底层接口的移动终端，实现模糊测试的空口协议安全漏洞的挖掘方法，由于移动终端能够开放底层端口，允许对空口协议的业务报文进行修改，即通过获取变异数据及获取空口协议的业务报文，结合变异数据修改业务报文，将修改后的业务报文发送至基站，实时监控基站的状态，可以实现记录空口协议的安全漏洞日志，挖掘空口协议的安全漏洞的效果，进而能够提升基站的健壮性和安全性，增加产品竞争力。
不难发现，本实施例为与上述方法实施例对应的装置实施例，本实施例可以与上述方法实施例互相配合实施。上述实施例中提到的相关技术细节和技术效果在本实施例中依然有效，为了减少重复，这里不再赘述。相应地，本实施例中提到的相关技术细节也可应用在上述实施例中。
值得一提的是，本实施例中所涉及到的各模块均为逻辑模块，在实际应用中，一个逻辑单元可以是一个物理单元，也可以是一个物理单元的一部分，还可以以多个物理单元的组合实现。此外，为了突出本申请的创新部分，本实施例中并没有将与解决本申请所提出的技术问题关系不太密切的单元引入，但这并不表明本实施例中不存在其它的单元。
本申请另一个实施例涉及一种移动终端，如图11所示，包括：至少一个处理器301；以及，与所述至少一个处理器301通信连接的存储器302；其中，所述存储器302存储有可被所述至少一个处理器301执行的指令，所述指令被所述至少一个处理器301执行，以使所述至少一个处理器301能够执行上述各实施例中的空口协议安全漏洞的挖掘方法。
其中，存储器和处理器采用总线方式连接，总线可以包括任意数量的互联的总线和桥， 总线将一个或多个处理器和存储器的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给处理器。
处理器负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器可以被用于存储处理器在执行操作时所使用的数据。
本申请另一个实施例涉及一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述方法实施例。
即，本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域的普通技术人员可以理解，上述各实施方式是实现本申请的具体实施例，而在实际应用中，可以在形式上和细节上对其作各种改变，而不偏离本申请的精神和范围。

Claims (12)

  1. 一种空口协议安全漏洞的挖掘方法，应用于移动终端，所述方法包括：
    获取变异数据，所述变异数据根据模糊测试任务生成；
    获取空口协议的业务报文；
    根据所述变异数据修改所述业务报文；
    将修改后的业务报文发送至基站；
    监控所述基站的状态，根据所述基站的状态记录安全漏洞日志。
  2. 根据权利要求1所述的空口协议安全漏洞的挖掘方法，其中，所述根据所述基站的状态记录安全漏洞日志之后，还包括：
    根据所述安全漏洞日志复测所述安全漏洞以确定所述安全漏洞的问题协议字段。
  3. 根据权利要求1所述的空口协议安全漏洞的挖掘方法，其中，所述获取空口协议的业务报文之后，所述根据所述变异数据修改所述业务报文之前，还包括：
    解析所述业务报文；
    所述根据所述变异数据修改所述业务报文，包括：
    在解析后的空口协议业务报文中确定所述变异数据对应的数据位置；
    在所述数据位置根据所述变异数据修改所述解析后的空口协议业务报文。
  4. 根据权利要求1所述的空口协议安全漏洞的挖掘方法，其中，所述获取变异数据，包括：
    接收服务器根据模糊测试任务得到的变异数据。
  5. 根据权利要求4所述的空口协议安全漏洞的挖掘方法，其中，所述接收服务器根据模糊测试任务得到的变异数据，包括：
    接收服务器根据变异方法生成变异数据；其中，所述变异方法由所述模糊测试任务确定，所述变异方法包括以下之一或其任意组合：多协议字段同时变异、无序变异、反馈变异。
  6. 根据权利要求5所述的空口协议安全漏洞的挖掘方法，其中，所述多协议字段同时变异，包括：
    获取模糊测试任务所需的各协议配置，所述各协议配置包括各协议的业务报文；
    对于各所述协议配置采用变异算法，得到用例种子池；
    从所述用例种子池中获取变异数据。
  7. 根据权利要求5所述的空口协议安全漏洞的挖掘方法，其中，所述反馈变异，包括：
    获取所述基站的日志报文的状态特征，分析所述状态特征；
    将分析结果置于用例池；
    对所述用例池中的分析结果采用变异算法得到变异数据。
  8. 根据权利要求1所述的空口协议安全漏洞的挖掘方法，其中，根据所述基站的状态记录安全漏洞日志，包括：
    根据所述基站的状态识别所述基站是否存在安全漏洞；
    若存在安全漏洞，则记录安全漏洞日志；其中，所述安全漏洞日志包括协议字段、变异前和变异后的业务报文以及所述移动终端的系统日志。
  9. 根据权利要求1至8中任意一项所述的空口协议安全漏洞的挖掘方法，其中，所述根据所述变异数据修改所述业务报文，包括：
    在所述业务报文的调度时延内，根据所述变异数据修改所述业务报文。
  10. 一种空口协议安全漏洞的挖掘装置，包括：
    第一获取单元，设置为获取变异数据，所述变异数据根据模糊测试任务生成；
    第二获取单元，设置为获取业务报文；
    修改单元，设置为根据所述变异数据修改所述业务报文；
    发送单元，设置为将修改后的业务报文发送至基站；
    记录单元，设置为监控所述基站的状态，根据所述基站的状态记录安全漏洞日志。
  11. 一种移动终端，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至9中任一项所述的空口协议安全漏洞的挖掘方法。
  12. 一种计算机可读存储介质，存储有计算机程序，其中，所述计算机程序被处理器执行时实现权利要求1至9中任一项所述的空口协议安全漏洞的挖掘方法。
PCT/CN2023/074441 2022-02-15 2023-02-03 空口协议安全漏洞的挖掘方法、装置、移动终端 WO2023155699A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210138690.1A CN116647845A (zh) 2022-02-15 2022-02-15 空口协议安全漏洞的挖掘方法、装置、移动终端
CN202210138690.1 2022-02-15

Publications (1)

Publication Number Publication Date
WO2023155699A1 true WO2023155699A1 (zh) 2023-08-24

Family

ID=87577566

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/074441 WO2023155699A1 (zh) 2022-02-15 2023-02-03 空口协议安全漏洞的挖掘方法、装置、移动终端

Country Status (2)

Country Link
CN (1) CN116647845A (zh)
WO (1) WO2023155699A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117435506A (zh) * 2023-12-15 2024-01-23 中兴通讯股份有限公司 模糊测试方法、电子设备及计算机可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103209173A (zh) * 2013-03-08 2013-07-17 北京理工大学 一种网络协议漏洞挖掘方法
CN111628900A (zh) * 2019-02-28 2020-09-04 西门子股份公司 基于网络协议的模糊测试方法、装置和计算机可读介质
CN113542299A (zh) * 2021-07-29 2021-10-22 国家工业信息安全发展研究中心 一种基于模糊测试的工业互联网漏洞挖掘方法及系统
CN113778879A (zh) * 2021-09-13 2021-12-10 上海幻电信息科技有限公司 接口的模糊测试方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103209173A (zh) * 2013-03-08 2013-07-17 北京理工大学 一种网络协议漏洞挖掘方法
CN111628900A (zh) * 2019-02-28 2020-09-04 西门子股份公司 基于网络协议的模糊测试方法、装置和计算机可读介质
CN113542299A (zh) * 2021-07-29 2021-10-22 国家工业信息安全发展研究中心 一种基于模糊测试的工业互联网漏洞挖掘方法及系统
CN113778879A (zh) * 2021-09-13 2021-12-10 上海幻电信息科技有限公司 接口的模糊测试方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
NOKIA, NOKIA SHANGHAI BELL: "Adding abbreviations and corrections for alignment", 3GPP DRAFT; S3-194301, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), vol. SA WG3, 11 November 2019 (2019-11-11), XP051824612 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117435506A (zh) * 2023-12-15 2024-01-23 中兴通讯股份有限公司 模糊测试方法、电子设备及计算机可读存储介质
CN117435506B (zh) * 2023-12-15 2024-04-16 中兴通讯股份有限公司 模糊测试方法、电子设备及计算机可读存储介质

Also Published As

Publication number Publication date
CN116647845A (zh) 2023-08-25

Similar Documents

Publication Publication Date Title
US10392823B2 (en) Synthetic client
CN112714047B (zh) 基于工控协议流量的测试方法、装置、设备及存储介质
US9019944B2 (en) Diagnosing and resolving wireless network malfunctions
WO2017041406A1 (zh) 一种故障定位方法及装置
CN103763121A (zh) 一种网络配置信息快速下发的方法及装置
US10609633B2 (en) Method for triggering registrar protocol interaction, access point, and station
CN105052076B (zh) 一种基于云计算的网元管理系统及网元管理方法
WO2023155699A1 (zh) 空口协议安全漏洞的挖掘方法、装置、移动终端
WO2020135429A1 (zh) 流量的分析、检测方法及装置
CN111263377B (zh) 网络配置方法、装置、设备、系统和配网测试方法、系统
CN111601335B (zh) 一种无线网络性能测试方法及无线ap
CN111726414A (zh) 一种车辆上报数据的处理方法和车辆数据上报系统
CN110022374A (zh) 基于物联网的网络连接方法、装置、通信设备及存储介质
US20150215333A1 (en) Network filtering apparatus and filtering method
CN108039968A (zh) 网络优化方法、设备及计算机可读存储介质
US20140155057A1 (en) Method and apparatus for associating reports
CN107426755B (zh) 基站问题的排查方法、装置、计算机可读存储介质及计算机设备
US20230262572A1 (en) Communication method and related device
WO2021155529A1 (zh) 资源删除方法、装置、设备及存储介质
US9999079B2 (en) Communication device, communication control method, and non-transitory computer readable medium
CN111813615B (zh) 一种应用系统事务异常处理方法
CN117061638B (zh) 一种报文传输方法、装置、存储介质、设备及系统
WO2023169097A1 (zh) 5g消息终端的识别方法、服务平台和存储介质
US20220377577A1 (en) Real-time radio access network analytics
WO2024061256A1 (zh) 转发规则配置方法、装置、终端及网络侧设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23755702

Country of ref document: EP

Kind code of ref document: A1