Towards formal verification of IoT protocols: A Review

As a critical component of the security architecture of 5G network, the authentication protocol plays a role of the first safeguard in ensuring the communication security, such as the confidentiality of user data. EAP-TLS is one of such protocols being defined in the 5G standards to provide key services in the specific IoT circumstances. This protocol is currently under the process of standardization, and it is vital to guarantee that the standardized protocol is free from any design flaws, which may result in severe vulnerabilities and serious consequences when implemented in real systems. However, it is still unclear whether the proposed 5G EAP-TLS authentication protocol provides the claimed security guarantees. To fill this gap, we present in this work a comprehensive formal analysis of the security related properties of the 5G EAP-TLS authentication protocol based on the symbolic model checking approach. Specifically, we build the first formal model of the 5G EAP-TLS authentication protocol in the applied pi calculus, and perform an automated security analysis of the formal protocol model by using the ProVerif model checker. Our analysis results show that there are some subtle flaws in the current protocol design that may compromise the claimed security objectives. To this end, we also propose and verify a possible fix that is able to mitigate these flaws. To the best of our knowledge, this is the first thorough formal analysis of the 5G EAP-TLS authentication protocol.

/pdf/formal-analysis-of-5g-eap-tls-authentication-protocol-using-2nickrc0a5.pdf

Formal Analysis of 5G EAP-TLS Authentication Protocol Using Proverif

Vehicle to Everything (V2X) communication is a technology that provides connectivity between vehicles, pedestrians, and road infrastructure. Dedicated Short-Range Communication (DSRC) is proposed by different standards such as ETSI, IEEE, and others since ten years ago to provide wireless connectivity in V2X. Recently, the LTE-V2X based cellular communication is standardized by the 3rd Generation Partner Project (3GPP) Release 14 as an alternative V2X technology to support autonomous driving. 5G-NewRadio (5G-NR) is being proposed by the 3GPP Release 16 as a new radio access technology to offer enhanced radio coverage and wide ultra-high reliability services. 3GPP Release15 was published in 2018 to include Phase 1 5G-NR standard.
3GPP Release 16 is designed to provide the 5G phase 2 and scheduled for being delivered in June 2020. In this paper, we study V2X based DSRC and LTE-V2X standards and introduce the current 5G-V2X standards progress. We present the 5G-V2X architecture design, core elements, challenges, essential requirements, security enhancement, and radio techniques. Also, we consider the security aspects of architecture and issues of 5G-V2X.

Current and future developments to improve 5G-NewRadio performance in vehicle-to-everything communications

Abstract Built on top of UDP, the recently standardized QUIC protocol primarily aims to gradually replace the TCP plus TLS plus HTTP/2 model. For instance, HTTP/3 is designed to exploit QUIC’s features, including reduced connection establishment time, multiplexing without head of line blocking, always-encrypted end-to-end security, and others. This work serves two key objectives. Initially, it offers the first to our knowledge full-fledged review on QUIC security as seen through the lens of the relevant literature so far. Second and more importantly, through extensive fuzz testing, we conduct a hands-on security evaluation against the six most popular QUIC-enabled production-grade servers. This assessment identified several effective and practical zero-day vulnerabilities, which, if exploited, can quickly overwhelm the server resources. This finding is a clear indication that the fragmented production-level implementations of this contemporary protocol are not yet mature enough. Overall, the work at hand provides the first wholemeal appraisal of QUIC security from both a literature review and empirical standpoint, and it is therefore foreseen to serve as a reference for future research in this timely area. 

/pdf/revisiting-quic-attacks-a-comprehensive-review-on-quic-2qrg7peu.pdf

Revisiting QUIC attacks: a comprehensive review on QUIC security and a hands-on study

As a newly proposed secure transport protocol, QUIC aims to improve the transport performance of HTTPS traffic and enable rapid deployment and evolution of transport mechanisms. QUIC is currently i...

/pdf/a-systematic-approach-to-formal-analysis-of-quic-handshake-1azidcjjvc.pdf

A Systematic Approach to Formal Analysis of QUIC Handshake Protocol Using Symbolic Model Checking

In mobile communication networks, the security of users' data depends on the guarantees provided by the authentication protocols. For the next generation of mobile network (i.e., 5G network), the 5G-EAP-TLS protocol has been proposed for this purpose. However, it is still unknown whether this protocol provides the claimed security guarantees or not. To fill this gap, we provide in this work the first formal model of 5G-EAP-TLS protocol and conduct a thorough analysis based on Scyther model checker. Secondly, we identify several design flaws in the protocol, which may jeopardize the security goals and result in severe security vulnerabilities when implemented in real systems. To our knowledge, this is the first study on the formal verification of 5G-EAP-TLS protocol.

Tao Feng

Papers

Formal Verification of 5G-EAP-TLS Authentication Protocol

A Systematic Approach to Formal Analysis of QUIC Handshake Protocol Using Symbolic Model Checking