On Security Research Towards Future Mobile Network Generations

Over the last decades, numerous security and privacy issues in all three active mobile network generations have been revealed that threaten users as well as network providers. In view of the newest generation (5G) currently under development, we now have the unique opportunity to identify research directions for the next generation based on existing security and privacy issues as well as already proposed defenses. This paper aims to unify security knowledge on mobile phone networks into a comprehensive overview and to derive pressing open research questions. To achieve this systematically, we develop a methodology that categorizes known attacks by their aim, proposed defenses, underlying causes, and root causes. Further, we assess the impact and the efficacy of each attack and defense. We then apply this methodology to existing literature on attacks and defenses in all three network generations. By doing so, we identify ten causes and four root causes for attacks. Mapping the attacks to proposed defenses and suggestions for the 5G specification enables us to uncover open research questions and challenges for the development of next-generation mobile networks. The problems of unsecured pre-authentication traffic and jamming attacks exist across all three mobile generations. They should be addressed in the future, in particular to wipe out the class of downgrade attacks and, thereby, strengthen the users' privacy. Further advances are needed in the areas of inter-operator protocols as well as secure baseband implementations. Additionally, mitigations against denial-of-service attacks by smart protocol design represent an open research question.

I. Introduction

Over the past decades, mobile communication has become an integral part of our daily life. For instance, in 2016 the mobile network comprised 4.61 billion users [1] and the revenue of all mobile network operators totaled 1,331 billion USD [2]. In many markets, the number of mobile Internet subscribers has outnumbered the stationary ones. A vast and diverse mobile communication and application ecosystem has emerged. These applications include private as well as business communication, and even critical infrastructures. For example, payment services, energy infrastructure, and emergency services (e.g., FirstNet [3]) highly depend on mobile networks. As a consequence, the reliability and security of mobile networks have become a substantial aspect of our daily lives.