telecom network engineers

Abstract: The development of 5G and its evolutionary path to 6G brings virtualization as close as possible to the antennas. Native 3GPP systems are now software running at servers boosted by accelerator cards to cope with computationally intense signal processing. Meanwhile, the Radio Frequency (RF) front-end is still proprietary hardware, sheltering specific PHY-layer procedures like passband amplification/modulation. This approach takes advantage of the software's flexibility while keeping the complex microsecond signal processing performance from modern telecommunication systems. This paper provides tutorial material on the Core Network and Radio Access Network of OpenAirInterface (OAI) 5G stack on top of Universal Software Radio Peripheral (USRP) platforms. A set of blueprints showcases OAI's ability to provide a virtualized 5G network with different transmission capabilities and the possibility to use it with commercial mobile phones. Configuration discussions and throughput benchmark analyses follow installation and deployment instructions. Our results show that 5G prototyping using OAI and USRP frontends can lead to good reproducibility and consistent throughput.

Abstract: Tracking users in 5G NR has recently been successfully demonstrated by exploiting various side-channels. This allows for identification of individuals, classification of user activity in real time as well as tracking by fingerprinting, affecting billions of users with a 5G subscription and companies with private 5G deployments. However, previous work relies on weak operator configurations that leak networking parameters--either the radio network temporary identifier (RNTI) or scrambling factor ($N_{ID}$) during handshake--or to inefficiently brute-force Downlink Control Information (DCI). In this paper we present a novel technique exploiting algebraic structure to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline. It provides enabling input for subsequent attacks like live tracking of users and supports automatic detection of control channel configurations used. We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors. It reaches block error rates of less than $1\%$ at SNRs below expected values for efficient communication, while performing significantly faster on a reference sample than a previously suggested passive technique brute-forcing the required parameters. In addition, it is entirely passive and does not rely on any side-channel leakage.