Detection and Notification of Rogue BS Attack in 4G LTE Non-Public Networks

Abstract

Recently, the rise of low-cost Software-Defined Radio (SDR) increases the possibility of rogue BS attacks, where UE and IoT devices are attracted to connect the rogue BS and perform actions instructed by the rouge BS. The detection of such unauthorized BS becomes a critical issue. In this paper, we utilize the unstable signal strength from such low-cost BS and the aid of Multi-access Edge Computing (MEC) to increase the detection accuracy of rouge BS attacks in Non-Public Network (NPN). In particular, we apply Attach Reject attack in NAS layer as detection target. Moreover, we use open-source software srsRAN and low-cost SDR to construct 4G rogue BS, which could send malicious Attack Reject message. We exploit srsUE and commercial SIM to build a sensor who could receive signals from rogue and legal BSs and deploy the sensor inside NPN. We investigate unstable property of Reference Signal Received Power (RSRP) of signal sent from rogue BS and calculate the maximum strength difference between SIB 1 and Attach Reject message to determine the rogue BS. The detection results are collected in MEC to increase detection accuracy and further notified to the subscribers so that users are aware of the existence of rogue BS. The experimental results show that the detection accuracy could reach 91%, which validates the feasibility of the proposed mechanism.