O244-P002-0090 Sentinel: xApps for Detecting, Characterizing, and Mitigating Malicious Signaling Attacks and Interference against 5G

5G holds promise for the DoD to capitalize on developments in the commercial world, reducing costs and accelerating the deployment cycle of communications solutions. This enhances many aspects of military operations, including communications, intelligence, surveillance, and command and control. By leveraging innovations and economies of scale achieved in the commercial sector, the DoD can improve operational efficiency and effectiveness across multiple domains. However, commercially available 5G has intrinsic limitations including vulnerability to a variety of attacks from jamming to smart denial of service attacks. 5G lower layers are neither encrypted nor integrity protected, even beyond the System Synchronization Block (SSB) and SIB1. The PHY/MAC/RLC signaling is considered non-critical in terms of security, due to historical simplicity and lack of state. Furthermore, demand for low latency caused a push of several control plane mechanisms to the unprotected PHY/MAC lower layers of the 5G protocol stack, to allow for faster reconfiguration. In our recent 5G ROSETA project funded by ONR, we identified and demonstrated the practicality of several attacks including stealthy spoofing of SSB to create rogue stations, injection of MAC Control Elements (CE) or PDCCH signaling to reduce the users' throughput by disabling RF front ends at the UE, disrupting user communications by tricking other connected UEs into acting as jammers, or stealthily disconnect an active user. In addition to vulnerabilities, trends in 5G systems deployments increasingly require sharing spectrum and operating over bands with non-adversarial incumbents inside or outside the US. The O-RAN ecosystem provides opportunities to address adversarial attacks and spectrum sharing challenges.