CellSecInspector: Safeguarding Cellular Networks via Automated Security Analysis on Specifications

TL;DR

CellSecInspector is an automated framework that analyzes 3GPP specifications to identify security vulnerabilities in cellular networks by modeling procedures, validating security properties, and generating test cases.

Contribution

It introduces a novel automated approach that captures deep semantic dependencies in specifications, enabling vulnerability discovery without manual security requirements.

Findings

Discovered 43 vulnerabilities in 4G and 5G specifications

Identified 7 previously unreported security issues

Demonstrated scalability and effectiveness of the approach

Abstract

The complexity, interdependence, and rapid evolution of 3GPP specifications present fundamental challenges for ensuring the security of modern cellular networks. Manual reviews and existing automated approaches, which often depend on rule-based parsing or small sets of manually crafted security requirements, fail to capture deep semantic dependencies, cross-sentence/clause relationships, and evolving specification behaviors. In this work, we present CellSecInspector, an automated framework for security analysis of 3GPP specifications. CellSecInspector extracts structured state-condition-action (SCA) representations, models mobile network procedures with comprehensive function chains, systematically validates them against 9 foundational security properties under 4 adversarial scenarios, and automatically generates test cases. This end-to-end approach enables the automated discovery of vulnerabilities without relying on manually predefined security requirements or rules. Applying CellSecInspector to the well-studied 5G and 4G NAS and RRC specifications and selected sections of TS 23.501 and TS 24.229, it discovers 43 vulnerabilities, 7 of which are previously unreported. Our findings show that CellSecInspector is a scalable, adaptive, and effective solution to assess 3GPP specifications for safeguarding operational and next-generation cellular networks.