The Long Term Evolution (LTE) is the latest mobile standard being implemented globally to provide connectivity and access to advanced services for personal mobile devices. Moreover, LTE networks are considered to be one of the main pillars for the deployment of Machine to Machine (M2M) communication systems and the spread of the Internet of Things (IoT). As an enabler for advanced communications services with a subscription count in the billions, security is of capital importance in LTE. Although legacy GSM (Global System for Mobile Communications) networks are known for being insecure and vulnerable to rogue base stations, LTE is assumed to guarantee confidentiality and strong authentication. However, LTE networks are vulnerable to security threats that tamper availability, privacy and authentication. This manuscript, which summarizes and expands the results presented by the author at ShmooCon 2016 jover2016lte , investigates the insecurity rationale behind LTE protocol exploits and LTE rogue base stations based on the analysis of real LTE radio link captures from the production network. Implementation results are discussed from the actual deployment of LTE rogue base stations, IMSI catchers and exploits that can potentially block a mobile device. A previously unknown technique to potentially track the location of mobile devices as they move from cell to cell is also discussed, with mitigations being proposed.
LTE security research has been increasingly predominant over the last couple of years, mainly in network availability related projects. For example, there has been interesting studies aiming to quantify and investigate the impact of large spikes of traffic load originated from M2M systems against the LTE infrastructure @cite_14 . Also in the context of M2M, several studies have focused on the control plane signaling impact of the IoT against the LTE mobile core @cite_10 @cite_30 .
@cite_30 @cite_14 @cite_10
1932683804 2112998006 2147825047
Machine to Machine (M2M) systems are actively spreading, with mobile networks rapidly evolving to provide connectivity beyond smartphones and tablets. With billions of embedded devices expected to join cellular networks over the next few years, novel applications are emerging and contributing to the Internet of Things (IoT) paradigm. The new generation of mobile networks, the Long Term Evolution (LTE), has been designed to provide enhanced capacity for a large number of mobile devices and is expected to be the main enabler of the emergence of the IoT. In this context, there is growing interest in the industry and standardization bodies on understanding the potential impact of the scalability of M2M systems on LTE networks. The highly heterogeneous traffic patterns of most M2M systems, very different from those of smartphones and other mobile devices, and the surge of M2M connected devices over the next few years, present a great challenge for the network. This paper presents the first insights and answers on the scalability of the IoT on LTE networks, determining to what extent mobile networks could be overwhelmed by the large amount of devices attempting to communicate. Based on a detailed analysis with a custom-built, standards-compliant, large-scale LTE simulation testbed, we determine the main potential congestion points and bottlenecks, and determine which types of M2M traffic present a larger challenge. To do so, the simulation testbed implements realistic statistical M2M traffic models derived from fully anonymized real LTE traces of six popular M2M systems from one of the main tier-1 operators in the United States. The number of Machine-to-Machine (M2M) applications is rapidly increasing in cellular communication systems. In order to ensure a maximum system capacity, the impact of this special kind of traffic on common Human-to-Human (H2H) communication needs to be analyzed. In this paper, a system model for performance evaluation of cellular networks like Long Term Evolution (LTE) in the presence of M2M communication and under different Quality of Service (QoS) constraints is presented. By means of a Markovian model, which is parameterized by laboratory measurements and ray tracing simulations, an estimation of the behavior of LTE for different traffic characteristics is shown. We present blocking probabilities for an LTE network with heterogeneous M2M and H2H traffic and compare different transmission strategies for M2M communication to minimize the impact on human users. The results show that particularly a large number of devices with a low data rate influences the utilization of an LTE cell very negatively. The global wide area coverage of cellular networks offers a great advantage to provide connectivity to a wide range of emerging machine-to-machine (M2M) services. The anticipated massive growth of M2M devices is expected to challenge the planning and operation of cellular networks due to new models of traffic behaviour and high signalling loads over the radio access network. Accordingly, it is important to capture the signalling generated by M2M traffic and its effect on cellular network planning and operation. In this paper, we adopt an experimental approach to measure, quantify, and analyze the signalling overhead of two classes of M2M services that resemble smart metering and vehicular M2M connections. Different perspectives are provided in the analysis, identifying the relation between traffic payload data size, transmission direction and incurred signalling overhead for static and mobile scenarios. A security perspective is also presented looking at ways of utilizing the heavy signalling loads generated by M2M devices to implement denial of service (DoS) attacks over the radio access network. The insights drawn from the experimental study are reinforced by results obtained through elaborate network simulations for further analysis and validation.