70RSAT19RB00000001_-_6_SRMNI_BAA_Overview_5-16-2019.pdf

DHS SCIENCE AND TECHNOLOGY

Secure and Resilient Mobile Network Infrastructure Research & Development

Vincent Sritapan

Portfolio Manager Physcial & Cyber Security Science and Technology Directorate

May 16, 2019

What is the Problem Weaknesses exist in protocols for mobile network infrastructure Known security vulnerabilities in current and legacy protocols (SS7/Diameter or LTE) have been exploited to conduct location tracking, call/SMS interception, and denial of service

Commercial/government security requirements are at risk if they are not incorporated into 5G security protocols

Enterprises lack visibility and management of mobile network traffic Mobile network traffic cannot go through the trusted internet connection (TIC) Need new approaches, including solutions that may not require all mobile traffic to go through the TIC/Mobile Gateway

The U.S. Government should continue and enhance its active participation in international standards bodies so it can represent America’s national interest with the private sector in the development of consensus-based voluntary mobile security standards and best practices

FISMA metrics should be enhanced to secure mobile devices …potential metrics include volume of mobile device user traffic not going through the D/A’s TIC

Source: DHS Study on Mobile Device Security

AdaptiveMobile Security Ltd can confirm, as a result of in-depth threat analysis on U.S.

cellular networks that the U.S. is under continuous and consistent attack from other Nation-States attempting to surveil key U.S.

personnel, and abuse data privacy/sovereignty of U.S. cellular subscribers.

Mobile Network Security Challenges

2G/3G 4G 5G

COMPUTERWORLD

ZDNetarsTECHNICA arsTECHNICA arsTECHNICA

DataCenter Knowledge

Mobile Network Traffic Visibility for the Enterprise

Radware Blog threat post

Network-Based Risks

Brute-force decryption of Bluetooth

4.0 communication due to weak

BR/EDR encryption algorithm

Attacker masquerading as USIM or a terminal to intercept data on the UICC-terminal interface

Malicious NFC tags Air Interface

Eavesdropping

Malicious Wi-Fi networks or cellular towers masquerading as legitimate

Exploiting SS7 to monitor or redirect phone calls or text messages

Capturing or modifying sensitive data in transit sent over the network with insufficient or no encryption

Unauthorized access to backend systems/ exfiltration of sensitive data Target for R&D

Attacking virtualized infrastructure to degrade or deny service

Attacks on 911 Call Centers and Core Network Subscriber Database cyberscoop MOTHERBOARD

Security Challenges & Opportunities Legacy and Current Mobile Networks SS7 access exploited to monitor calls/messages Rogue cell towers capture user information; force protocol downgrade Gateway, firewall and other security point solutions; not integrated

Next Gen 5G Networks Virtualization, network densification, and heterogeneous access protocols provide opportunity and increase risk; government participation needed to influence standards

Network Traffic Visibility Mobile network traffic not routed through the TIC; bypassing traffic inspection Network Resilience Reliance on mobile networks to deliver government services puts mission at risk if networks are damaged or service degraded

Strategic Alignment

DHS 2014 Quadrennial Homeland Security Review Mission 4: Safeguard and Secure Cyberspace; Goal 4.1: Strengthen the

Security and Resilience of Critical Infrastructure DHS Study on Mobile Device Security New applied R&D program in securing mobile network infrastructure to address current and emerging challenges impeding mobile technology U.S. Government should continue and enhance its active participation in international standards bodies National Security Telecommunications Advisory Committee (NSTAC) Security of the 5G infrastructure should receive great priority, and the shift to 5G represents another opportunity to get cybersecurity right

Alignment to DHS Priorities

Proposed R&D Topic Areas

Threat Detection and Protection of Current and Legacy Protocols & Networks Approaches and implementations to protect U.S. government employees and citizens from being tracked, or their calls or text messages being snooped or hijacked due to inherent SS7/Diameter vulnerabilities, radio access network threats. It also seeks vendor agnostic techniques to protect the core network.

5G Mobile Network Security Leverage 5G virtual functions/network slicing to define methods and approaches to achieve:

Flexible 5G security architecture tailored for government environment Government controlled security policy End-to-end security for the mobile device to the core Secure voice implementation for Federal Government users

Enterprise Visibility & Management of Mobile Network Traffic Mobile Network Traffic Visibility: Approaches to increase visibility into mobile network traffic and to improve protection for mobile devices and enterprise backend systems by independently monitoring traffic from mobile devices.

TTA #1: Threat Detection and Protection of Current and Legacy Protocols and Networks

Goal 1 – Data Filtering and Anomaly Detection to Improve SS7 Security Develop and demonstrate technologies to monitor, detect, and respond to anomalous or potentially malicious use of SS7 networks.

Goal 2 – Threat Assessment and Mitigations for Diameter Interworking Function (IWF)

Identify and eliminate weaknesses in the SS7/Diameter IWF to reduce the attack surface before vulnerabilities are discovered and exploited.

Describe methods that would enable MNOs to clearly differentiate whether data requests received through the IWF are from untrusted or trusted external partners.

Goal 3 – Vendor Agnostic Protection Methods for the Core Network Develop vendor agnostic protection methods for the LTE core network and validate them in a testbed environment. Describe the creation and demonstration of capabilities to discover the elements of the core LTE network and map them to a template according to 3GPP standards.

TTAs #2 : Fifth Generation (5G) Network Security

Goal 1 – Unified Family of 5G Security Techniques Development of integrated 5G techniques to address LTE vulnerabilities that are carried over to 5G networks and new threats introduced by 5G.

Goal 2 – Security Architecture for Government Using Network Slicing

Define and demonstrate a flexible security architecture with network slicing capability that can be dynamically altered to meet regulated security requirements (e.g., confidentiality and integrity protections, protection of user identity and location, and authentication of sending and receiving entities).

Goal 3 – End-to-End Security from the Mobile Device to the Core Implement end-to-end 5G encryption from the User Equipment to a secure node within the core network or outside of the core network (e.g., government security enforcement point).

Goal 4 – Interoperable Secure Voice for the Federal Government Implement interoperable secure unclassified voice across Federal

Government agencies.

TTA #3: Mobile Network Traffic Visibility for the Enterprise

Goal 1 – Track Mobile Traffic Develop methods to enable enterprises to identify sources and destinations of mobile device traffic to enable identification of compromised devices. Provide a clear description of traffic flow monitoring to include, e.g., source and destination IP address, IP protocol version and Transmission Control Protocol/User Datagram Protocol (TCP/UDP) port number.

Goal 2 – Enable Mobile Traffic Filtering Identify methods to direct all (or part) of mobile traffic through enterprise controlled security protection systems to filter malware before it reaches the mobile devices. Enable redirection of all or part of mobile traffic to government security gateways.

Goal 3 – Categorization of Mobile Traffic Document what types of iOS and Android traffic could be easily filtered and what types of traffic would likely remain unfiltered. Catalog the various categories of traffic communicating with mobile devices and demonstrate which commonly available filtering solutions would be able to filter each type of traffic.

Anticipated Award Info

BAA Call 70RSAT19RB00000001 posted to FedBizOps April 22, 2019 Anticipated Award Types:

Contracts Cooperative agreements

Anticipated Period of Performance: Up to 4 years including pilots/options Anticipated Award ceilings:

TTA 1 & 2: $2.75M

TTA 3: $2M

Anticipated Go/No-Gos on 6 month intervals Anticipated Proposals Due: June 26, 2019 Anticipated Notifications: September 24, 2019 Email questions to: MNI19-BAA-Call@hq.dhs.gov

DIVERSE PERSPECTIVES + SHARED GOALS = POWERFUL SOLUTIONS 13

15DIVERSE PERSPECTIVES + SHARED GOALS = POWERFUL SOLUTIONS

FLICKR

flickr.com/photos/dhsscitech/

YOUTUBE

youtube.com/dhsscitech

PERISCOPE

periscope.tv/dhsscitech/

FACEBOOK

@dhsscitech

TWITTER

@dhsscitech

WEBSITE

scitech.dhs.gov

Engage With Us!

https://www.flickr.com/photos/dhsscitech/ https://www.flickr.com/photos/dhsscitech/ https://www.youtube.com/dhsscitech https://www.youtube.com/dhsscitech https://www.periscope.tv/dhsscitech/ https://www.periscope.tv/dhsscitech/ https://www.facebook.com/dhsscitech https://www.facebook.com/dhsscitech https://twitter.com/dhsscitech https://twitter.com/dhsscitech https://www.dhs.gov/science-and-technology https://www.dhs.gov/science-and-technology