Selected data fields of anonymized roaming signaling exchange between the visiting and the home mobile networks for security analysis

Description

The dataset is a simulated roaming signaling exchange between a visiting and a home mobile network. One thousand UEs (User Equipments) in roaming-out have been simulated, i.e., HPLMN (with address: mnc262.mcc321) subscribers connected to VPLMN (with address: mnc261.mcc320) network. It has been simulated that the system injects 100 new subscribers every second. Every new subscriber is authenticated by the HPLMN through 5G-AKA procedures, the AMF in the VPLMN is registered for that subscriber, and a new PDU session is created. The sessions have been configured to remain active for 5 seconds before being torn down, that means, in a steady state the system will be handling about 500 simultaneous active subscribers. The load at that rate is maintained for 50 seconds, thus after ramp-up, the system holds the load (≈ 500 concurrent subscribers) for 50 seconds before stopping them. The raw signaling data needs to be transformed into a structured dataset of signaling messages. By using Tshark tool and Python scripting a CSV file has been built, where selected data fields for the security analysis (e.g., subscriber identities, secret material, location etc.) have been parsed and extracted in columns per message. The following pipeline has been followed: PCAP → (Tshark) → CSV (HTTP/2 headers/data) → (Python parser – JSON) → formatted CSV. Every message of the file, x_i, (in rows) contains the following data (in columns) extracted via Tshark tool: Source IP address Destination IP address HTTP/2 header path HTTP/2 header method HTTP/2 data (JSON in hexadecimal) From the HTTP/2 headers and data the following related security attributes have been extracted via Python scripting: SUPI (IMSI) SUCI PEI (Permanent Equipment Identifier) GPSI (Generic Public Subscription Identifier): MSISDN K_SEAF: Derived key for SEAF (Security Anchor Function) AUTN: Authentication Token RAND: Random number (challenge sent by the network to the UE) TAC: Tracking Area Code nrCellId: NR Cell Identity

Steps to reproduce

The simulation environment has been deployed in a commercial simulator platform called LoadCore (v.5.1.0), created by Keysight Inc.: https://www.keysight.com/be/en/product/P8900S/loadcore-core-network-solutions.html

Institutions

• Politechnika Warszawska Instytut Telekomunikacji

Categories

Funders

• National Centre for Research and Development

  Ministry of Science and Higher Education

  Poland

  Grant ID: CYBERSECIDENT/489818/IV/NCBR/2021

Licence