Security vulnerability detection method for 5G core network

Abstract

The invention provides a security vulnerability detection method for a 5G core network, and the method comprises the steps: a terminal generates a test case and a test case sequence, and the test case and the test case sequence are constructed according to the protocol message level of a non-access stratum (NAS) protocol message; the test case is used for detecting a first type of vulnerabilities under a static condition, and the test case sequence is used for detecting a second type of vulnerabilities under a dynamic condition; the terminal sends the test case and the test case sequence to the core network through the base station; the core network receives the test case and the test case sequence, and analyzes the test case and the test case sequence based on the internal logic of the core network; the core network obtains an analysis processing result, and monitors whether the core network has a first type of vulnerability or a second type of vulnerability according to the analysis processing result; the first type of vulnerabilities are vulnerabilities caused by processing abnormal messages, the second type of vulnerabilities are vulnerabilities caused in the state transition process, and the method improves the comprehensiveness and accuracy of testing.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a security vulnerability detection method for a 5G core network. Background Art

[0002] As a key protocol of the 5G control plane, the Non Access Stratum (NAS) protocol undertakes important functions such as access management, mobility management, and session management, and is closely related to processes such as registration, authentication, location update, and session control. However, due to insufficient consideration of the security of sensitive processes such as the initial message interaction during the design phase, as well as inconsistencies with standards during the implementation phase, the NAS protocol itself still has many design and implementation defects, which may cause security issues such as denial of service, location tracking, or leakage of user sensitive information, and thus have a serious impact on the data security and privacy of the 5G core network and terminal UE. Therefore, studying and ensuring the security of the 5G core network is of great significance to the security of the 5G network.

[0003] At present, a large number of research works and test frameworks are designed for 4G systems. They rely on the specific properties and security models of 4G protocols, which makes it difficult to directly apply these research results to 5G systems with different threat scenarios. In addition, the existing fuzz testing frameworks and security analysis tools focus on the terminal side, and there are few corresponding test frameworks for the core network side. Therefore, there are defects in the detection of security vulnerabilities on the core network side. Furthermore, although fuzz testing is widely used in the field of security detection of unknown vulnerabilities, due to the uniqueness of the 5G NAS protocol in connection establishment, data format, process interaction, etc., the existing 4G fuzz testing scheme cannot directly detect security vulnerabilities in the 5G core network. Summary of the invention

[0004] In order to solve the above problems existing in the prior art, the present invention provides a security vulnerability detection method for the 5G core network.

[0005] The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] The present invention provides a security vulnerability detection method for a 5G core network, which is applied to a 5G communication system. The 5G communication system includes: a terminal, a base station and a core network, including:

[0007] The terminal generates test cases and test case sequences, which are constructed according to the protocol message hierarchy of the non-access layer NAS protocol message; the protocol message hierarchy includes: message header level, information component level, field level and bit level; the test cases are used to detect the first type of vulnerabilities under static conditions, and the test case sequences are used to detect the second type of vulnerabilities under dynamic conditions;

[0008] The terminal sends the test case and the test case sequence to the core network through the base station;

[0009] The core network receives the test cases and test case sequences, and parses and processes the test cases and test case sequences based on its own internal logic;

[0010] The core network obtains the results of the parsing process and monitors whether the core network has the first type of vulnerability or the second type of vulnerability based on the results of the parsing process; the first type of vulnerability is a vulnerability caused by processing malformed messages, and the second type of vulnerability is a vulnerability caused during the state transfer process.

[0011] Optionally, the terminal generates a test case and a test case sequence, including:

[0012] Generate NAS protocol messages;

[0013] Based on NAS protocol messages, determine the protocol message hierarchy;

[0014] Selecting a level from the protocol message levels to obtain a selected level;

[0015] After the selected layers are processed with corresponding fusion mutations, they are filled into the structured message template to construct a test case.

[0016] A finite state machine model is established according to the internal transfer state of the core network, and a test case sequence is formed using the finite state machine model.

[0017] Optionally, a finite state machine model is established according to the internal transfer state of the core network, and a test case sequence is formed using the finite state machine model, including:

[0018] According to the finite state machine model, the path search is performed on the state set under the depth-first search algorithm to generate a state detection path set;

[0019] Perform detection path selection on the state detection path set to obtain a transfer path to be detected;

[0020] According to the transfer path to be detected and the NAS protocol message, an initial sequence of test cases is generated, and the initial sequence of test cases is filled into the message template to form a test case sequence.

[0021] Optionally, the test case sequence is sent to the core network in a predetermined order to guide the core network to transfer according to the state corresponding to the test case sequence.

[0022] Optionally, the generation method of the message header level includes: random generation, sequential enumeration, and free enumeration;

[0023] The generation methods at the information component level include: length mutation, byte flipping, arithmetic mutation, byte replacement, and byte swapping;

[0024] Field-level generation methods include: random generation, boundary value generation, reserved value enumeration, and free enumeration;

[0025] The bit-level generation methods include: bit flip, bit XOR, bit AND, bit set, and bit swap.

[0026] Optionally, the state set of the core network includes: initial state, registration initialization, authentication initialization, identification initialization, authentication completion, security mode function SMC initialization, SMC completion, registration intermediate state, registration completion, deregistration initialization and final state;

[0027] The events that trigger state transitions in the state set include: receiving a registration request, sending an authentication request, sending a registration rejection, sending an identification request, receiving an identification response, receiving an authentication response, receiving an authentication rejection, sending an SMC command request, receiving an SMC completion reply, receiving an SMC rejection, sending a registration acceptance, receiving a registration completion, receiving a deregistration request, and sending a deregistration acceptance.

[0028] Optionally, the generation of the test case further includes: generating the test case based on the corresponding NAS protocol message version to ensure that the test case covers the protocol version and message type of the NAS protocol message.

[0029] Optionally, the core network obtains a result of the parsing process, and monitors whether the core network has a first type of vulnerability or a second type of vulnerability according to the result of the parsing process, including:

[0030] The core network obtains log information when it processes the test case or test case sequence, and uses the log information as the result of the parsing process;

[0031] Use log information to determine whether the core network has Type I or Type II vulnerabilities.

[0032] Optionally, the security vulnerability detection method for the 5G core network further includes:

[0033] After detecting the existence of a first-category vulnerability or a second-category vulnerability in the core network, a report containing the first-category vulnerability or the second-category vulnerability is generated and sent to a preset security management system for further vulnerability analysis and repair.

[0034] The present invention provides a security vulnerability detection method for a 5G core network, which is applied to a 5G communication system. The 5G communication system includes: a terminal, a base station and a core network, including: the terminal generates a test case and a test case sequence, the test case and the test case sequence are constructed according to the protocol message hierarchy of a non-access layer NAS protocol message; the protocol message hierarchy includes: a message header level, an information component level, a field level and a bit level; the test case is used to detect a first type of vulnerability under static conditions, and the test case sequence is used to detect a second type of vulnerability under dynamic conditions; the terminal sends the test case and the test case sequence to the core network through the base station; the core network receives the test case and the test case sequence, and parses and processes the test case and the test case sequence based on its own internal logic; the core network obtains a result of the parsing process, and monitors whether the core network has a first type of vulnerability or a second type of vulnerability based on the result of the parsing process; the first type of vulnerability is a vulnerability caused by processing a malformed message, and the second type of vulnerability is a vulnerability caused during a state transfer process. In the present invention, by designing and generating test cases and test case sequences for NAS protocol messages, various situations when the core network processes malformed messages in different formats can be fully covered, thereby improving the breadth and depth of the test; in addition, by designing a test case sequence to detect vulnerabilities caused by the core network during the state transfer process, the comprehensiveness and accuracy of the test are improved; finally, since the detection process of the invention method is efficient and highly automated, the efficiency and quality of core network security vulnerability detection can be significantly improved, thereby reducing the detection cost.

[0035] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of a process for detecting a security vulnerability in a 5G core network provided by an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of the structure of a finite state machine model corresponding to a core network provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0039] In order to improve the comprehensiveness and accuracy of core network vulnerability detection and reduce detection costs, an embodiment of the present invention provides a security vulnerability detection method for a 5G core network, which is applied to a 5G communication system. The 5G communication system includes: a terminal, a base station and a core network. Figure 1 A flowchart of a method for detecting security vulnerabilities in a 5G core network provided by an embodiment of the present invention. Figure 1 As shown, including:

[0040] S101. The terminal generates a test case and a test case sequence.

[0041] The test cases and test case sequences are constructed according to the protocol message hierarchy of the non-access layer NAS protocol message. In the embodiment of the present invention, the protocol message hierarchy may include: message header level, information component level, field level and bit level.

[0042] The test cases are used to detect the first type of vulnerabilities under static conditions, and the test case sequences are used to detect the second type of vulnerabilities under dynamic conditions.

[0043] Examples of static vulnerability include buffer overflow, format string vulnerability, integer overflow, null pointer dereference, and insufficient input validation.

[0044] Vulnerabilities under dynamic conditions can be, for example: state transition errors, race conditions, or state recovery failures.

[0045] Optionally, the generation method of the message header level includes: random generation, sequential enumeration and free enumeration.

[0046] The generation methods at the information component level include: length mutation, byte flipping, arithmetic mutation, byte replacement, and byte swapping.

[0047] Field-level generation methods include: random generation, boundary value generation, reserved value enumeration, and free enumeration.

[0048] The bit-level generation methods include: bit flip, bit XOR, bit AND, bit set, and bit swap.

[0049] It should be noted that random generation can specifically be a random generation of message headers; sequential enumeration can specifically enumerate all possible message header configurations in a certain order; free enumeration can specifically be manual or tool selection of certain specific message header configurations for testing; length variation can specifically be changing the length of the information component; byte flipping can specifically be flipping certain bytes in the information component; arithmetic variation can specifically be addition, subtraction, multiplication, division and other operations on the values ​​in the information component; byte replacement can specifically be replacing certain bytes in the information component with other values; byte swapping can specifically be changing the order of bytes in the information component; random generation can specifically be a random generation of field values; boundary value generation can specifically be generating boundary values ​​(minimum value, maximum value, middle value, etc.) of the field; reserved value enumeration can specifically be enumerating some reserved values ​​in the field; free enumeration can specifically be manual or tool selection of certain specific field values ​​for testing. Bit flipping can specifically be flipping certain bits in the field; bit setting can specifically be setting certain bits to 1; bit and can specifically be performing and operations on certain bits. Bit XOR can specifically be performing XOR operations on certain bits. Bit swapping can specifically be changing the order of bits in the field.

[0050] Optionally, S101 may specifically include:

[0051] Generate NAS protocol messages;

[0052] Based on NAS protocol messages, determine the protocol message hierarchy;

[0053] Selecting a level from the protocol message levels to obtain a selected level;

[0054] After the selected layers are processed with corresponding fusion mutations, they are filled into the structured message template to construct a test case.

[0055] A finite state machine model is established according to the internal transfer state of the core network, and a test case sequence is formed using the finite state machine model.

[0056] It should be noted that, in the embodiment of the present invention, the corresponding fusion and variation processing is performed on the selected layer, for example, it may include: bit flipping, bit XOR, bit AND, bit setting, bit swapping, etc.

[0057] Optionally, the generation of the test case further includes: generating the test case based on the corresponding NAS protocol message version to ensure that the test case covers the protocol version and message type of the NAS protocol message.

[0058] For example, the test case is as follows:

[0059] Test case 1:

[0060] msgtype:registration_request

[0061] state:before_registration_request

[0062] meta:

[0063] ue_security_capability.present:true

[0064] mobile_identity_5gs.type:guti

[0065] hdrs:{}

[0066] ies:{}

[0067] fields:{}

[0068] octets:

[0069] registration_type_5gs.octet1:12

[0070] Test Case 2:

[0071] msgtype:registration_request

[0072] state:after_registration_request

[0073] meta:

[0074] ue_security_capability.present:true

[0075] mobile_identity_5gs.type:guti

[0076] hdrs:

[0077] security_header_type:2

[0078] mac:25

[0079] ies:

[0080] ng_ksi.content:hex1b07

[0081] fields:{}

[0082] octets:{}

[0083] Test case 1 is a regular test case that does not participate in the pairing combination. The message type and metadata are consistent with those specified in the test rules. The test status is before the test message is sent (before_registration_request). The bit-level parameter is registration_type_5gs, and the first byte of the component is 12. The above value is obtained by flipping the 4th bit of the seed value 19 specified in the test rule, that is, from 0b00010011 to 0b00001100, which verifies the validity of the mutation strategy. Other parameters are empty. Test case 2 is a test case that participates in the pairing combination. Its test status is after the test message is sent (after_registration_request), and the values ​​of the three parameters such as security_header_type, mac and ng_ksi are 2, 25 and hex1b07 respectively, which all meet the corresponding test rules and verify the validity of the generation strategy and length mutation.

[0084] In addition, when selecting a level from the protocol message level, you can flexibly select according to the test requirements, for example, select a level or a combination of multiple levels. It is understandable that testing through level combination testing can save test time and improve test efficiency. In addition, filling the selected level into the structured message template is mainly used for standardized processing of the message so that the core network can recognize it.

[0085] Optionally, a finite state machine model is established according to the internal transfer state of the core network, and a test case sequence is formed using the finite state machine model, including:

[0086] According to the finite state machine model, the path search is performed on the state set under the depth-first search algorithm to generate a state detection path set;

[0087] Perform detection path selection on the state detection path set to obtain a transfer path to be detected;

[0088] According to the transfer path to be detected and the NAS protocol message, an initial sequence of test cases is generated, and the initial sequence of test cases is filled into the message template to form a test case sequence.

[0089] For example, Figure 2 A schematic diagram of the structure of a finite state machine model corresponding to the core network provided in an embodiment of the present invention. Figure 2 As shown, the core network state set includes: initial state S0, registration initialization S1, authentication initialization S2, identification initialization S3, authentication completion S4, security mode function SMC initialization S5, SMC completion S6, registration intermediate state S7, registration completion S8, deregistration initialization S9 and final state Se.

[0090] Specifically, S0 represents the initial state of the finite state machine. At this time, the core network is in a waiting state, waiting for the arrival of the registration request; in the S1 state, the core network has received the registration request and is performing the initial registration process. At this time, the core network can perform the next step according to different events; when the core network is in the S2 state, the core network is performing the user authentication process. The core network will send an authentication request to the user and wait for a response; in the S3 state, the core network will initialize the identification, send an identification request to the user and wait for the user's identification response; when the core network enters the S4 state, it means that the authentication process has been completed and the user has successfully passed the authentication; when the core network enters the S5 state, it will process session-related requests; when the core network enters the S6 state, the SMC process has been successfully completed and the core network has completed the relevant operations of session management; S7 is an intermediate state, indicating that the registration operation has not been fully completed and the core network is waiting for further processing steps; when the core network enters the S8 state, it indicates that the registration operation has been completely successful and the user registration has been completed; the S9 state indicates that the core network has begun to process the logout operation and is processing the initial logout request; Se is the terminal state of the finite state machine, indicating that all registration and logout operations have been completed and the core network enters the final state.

[0091] The events that trigger state transitions in the state set include: receiving a registration request E0, sending an authentication request E1, sending a registration rejection E2, sending an identification request E3, receiving an identification response E4, receiving an authentication response E5, receiving an authentication rejection E6, sending an SMC command request E7, receiving an SMC completion reply E8, receiving an SMC rejection E9, sending a registration acceptance E10, receiving a registration completion E11, receiving a deregistration request E12, and sending a deregistration acceptance E13.

[0092] Specifically, E0 indicates that the core network receives a new registration request, triggering the core network to enter the registration initialization state S1 from the initial state S0. During the registration initialization phase S1, the core network receives an authentication request E1, triggering the core network to enter the authentication initialization state S2. E2 indicates that the core network decides to reject the registration request at a certain stage, triggering the core network to enter the final state Se. During the registration initialization phase S1, the core network receives an identification request E3, triggering the core network to enter the identification initialization state S3. After the core network receives the identification response E4, it continues the next step from the identification initialization state S3 and enters the authentication initialization state S2. E5 indicates that the core network receives an authentication response in the authentication initialization state S2, completes the user authentication, and enters the authentication completion state S4. When the core network receives an authentication rejection E6 during the authentication process, it will trigger the core network to enter the final state Se, indicating that the authentication failed and the registration was rejected. After the authentication is completed, the core network will send an SMC command request E7 and enter the SMC initialization state S5. When the core network receives the SMC completion reply E8, it enters the SMC completion state S6. When the core network receives SMC rejection E9, it will trigger the core network to enter the final state Se. After completing SMC and other necessary operations, the core network sends registration acceptance E10 information, indicating that the registration operation is about to be completed. When the core network receives the confirmation information of registration completion E11, it enters the registration completion state S8, marking the completion of the entire registration process. E12 indicates that the core network receives a deregistration request, triggering the core network to enter the deregistration initialization state S9 from the current state. When the core network processes the deregistration request, it will send deregistration acceptance E13, and finally the core network enters the final state Se, indicating that the deregistration process is completed.

[0093] The processing logic of the depth-first search algorithm is:

[0094] (1) Starting from the initial state S0, the algorithm deeply traverses all possible state transition paths in sequence.

[0095] (2) Whenever a leaf node (terminal state) is reached, the current path is returned and all visited states and events are recorded as a complete state transition path.

[0096] (3) In the recursive process, all possible state transition paths are generated by concatenating the state and event of the previous node and the path of the next node.

[0097] (4) By tracing back to the initial node, a complete set of state detection paths can be obtained.

[0098] Exemplarily, the test case sequence generation process is as follows:

[0099] Taking S0→S1→S2→S4 as an example, three test cases need to be designed as follows:

[0100] Transition state (1) sends a registration request (S0→S1), that is, constructs a valid registration_request message containing the terminal's registration information, such as ue_security_capability and mobile_identity.

[0101] msgtype:registration_request

[0102] state:before_registration_request

[0103] meta:

[0104] ue_security_capability.present:true

[0105] mobile_identity_5gs.type:guti

[0106] octets:

[0107] registration_type_5gs.octet1:12

[0108] The transition state (2) sends an authentication request (S1→S2), that is, constructs an authentication_request message, which includes the identity of the terminal to be authenticated and the parameters required by the network for authentication.

[0109] msgtype:authentication_request

[0110] state:after_registration_request

[0111] meta:

[0112] ue_security_capability.present:true

[0113] mobile_identity_5gs.type:guti

[0114] hdrs:

[0115] security_header_type:2

[0116] mac:25

[0117] ies:

[0118] ng_ksi.content:hex1b07

[0119] Transition state (3) receives and processes the authentication response (S2→S4), that is, constructs an authentication_response message, indicating that the terminal has successfully passed the authentication and the core network has confirmed the identity of the terminal.

[0120] msgtype:authentication_response

[0121] state:after_authentication_request

[0122] meta:

[0123] authentication_result:success

[0124] ng_ksi.content:hex1b07

[0125] The transition states (1)(2)(3) together constitute the test case sequence.

[0126] S102. The terminal sends the test case and the test case sequence to the core network through the base station.

[0127] It should be noted that the test case sequence is sent to the core network in a predetermined order to guide the core network to transfer according to the state corresponding to the test case sequence.

[0128] S103: The core network receives the test case and the test case sequence, and parses and processes the test case and the test case sequence based on its own internal logic.

[0129] Specifically, in the embodiment of the present invention, the test cases and test case sequences may be run on the core network, and the test cases and test case sequences may be parsed according to the running logic of the core network itself.

[0130] S104: The core network obtains the result of the analysis process, and monitors whether the core network has the first type of vulnerability or the second type of vulnerability based on the result of the analysis process.

[0131] The first type of vulnerability is caused by processing malformed messages, and the second type of vulnerability is caused by the state transfer process.

[0132] Optionally, S104 may specifically include:

[0133] The core network obtains log information when it processes the test case or test case sequence, and uses the log information as the result of the parsing process;

[0134] Use log information to determine whether the core network has Type I or Type II vulnerabilities.

[0135] The embodiment of the present invention provides a security vulnerability detection method for a 5G core network. By designing and generating test cases and test case sequences for NAS protocol messages, it can comprehensively cover various situations when the core network processes malformed messages in different formats, thereby improving the breadth and depth of the test. In addition, by designing a test case sequence, the vulnerabilities caused by the core network during the state transition process are detected, thereby improving the comprehensiveness and accuracy of the test. Finally, since the detection process of the invention method is efficient and highly automated, it can significantly improve the efficiency and quality of core network security vulnerability detection and reduce the detection cost.

[0136] Optionally, the security vulnerability detection method for the 5G core network further includes:

[0137] After detecting the existence of a first-category vulnerability or a second-category vulnerability in the core network, a report containing the first-category vulnerability or the second-category vulnerability is generated and sent to a preset security management system for further vulnerability analysis and repair.

[0138] The method provided in the embodiment of the present invention can be applied to an electronic device. Specifically, the electronic device can be: a desktop computer, a portable computer, an intelligent mobile terminal, a server, etc., which is not limited in the embodiment of the present invention.

[0139] It should be noted that the terms "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention.

[0140] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0141] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other changes of the above disclosed embodiments by viewing the drawings and the disclosed content. In the description of the present invention, the term "comprising" does not exclude other components or steps, "one" or "an" does not exclude multiple situations, and the meaning of "multiple" is two or more, unless otherwise clearly and specifically limited. In addition, certain measures are recorded in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0142] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the scope of protection of the present invention.

Claims

1. A security vulnerability detection method for a 5G core network is applied to a 5G communication system, wherein the 5G communication system comprises: The terminal, base station and core network are characterized by comprising: The terminal generates a test case and a test case sequence, wherein the test case and the test case sequence are constructed according to a protocol message hierarchy of a non-access layer NAS protocol message; the protocol message hierarchy includes: a message header level, an information component level, a field level, and a bit level; the test case is used to detect a first type of vulnerability under static conditions, and the test case sequence is used to detect a second type of vulnerability under dynamic conditions; The terminal sends the test case and the test case sequence to the core network through the base station; The core network receives the test case and the test case sequence, and parses and processes the test case and the test case sequence based on its own internal logic; The core network obtains the result of the parsing process, and monitors whether the core network has the first type of vulnerability or the second type of vulnerability based on the result of the parsing process; the first type of vulnerability is a vulnerability caused by processing malformed messages, and the second type of vulnerability is a vulnerability caused during a state transfer process.

2. The method for detecting security vulnerabilities in a 5G core network according to claim 1, characterized in that: The terminal generates a test case and a test case sequence, including: Generate NAS protocol messages; Based on the NAS protocol message, determining a protocol message hierarchy; Selecting a level from the protocol message levels to obtain a selected level; Performing corresponding fusion and mutation processing on the selected level and filling the result into a structured message template to construct the test case; A finite state machine model is established according to the internal transfer state of the core network, and the test case sequence is formed using the finite state machine model.

3. The method for detecting security vulnerabilities in a 5G core network according to claim 2, characterized in that: The step of establishing a finite state machine model according to the internal transfer state of the core network and forming the test case sequence using the finite state machine model includes: According to the finite state machine model, a path search is performed on the state set under the processing of a depth-first search algorithm to generate a state detection path set; Performing detection path selection on the state detection path set to obtain a transfer path to be detected; According to the transfer path to be detected and the NAS protocol message, an initial sequence of test cases is generated, and the initial sequence of test cases is filled into the message template to form the test case sequence.

4. The method for detecting security vulnerabilities in a 5G core network according to claim 1, characterized in that: The test case sequence is sent to the core network in a predetermined order to guide the core network to transfer according to the state corresponding to the test case sequence.

5. The method for detecting security vulnerabilities in a 5G core network according to claim 1, characterized in that: The generation methods of the message header level include: random generation, sequential enumeration and free enumeration; The information component level generation method includes: length variation, byte flipping, arithmetic variation, byte replacement and byte swapping; The field-level generation methods include: random generation, boundary value generation, reserved value enumeration, and free enumeration; The bit-level generation methods include: bit flipping, bit XOR, bit AND, bit setting and bit swapping.

6. The method for detecting security vulnerabilities in a 5G core network according to claim 1, characterized in that: The state set of the core network includes: initial state, registration initialization, authentication initialization, identification initialization, authentication completion, security mode function SMC initialization, SMC completion, registration intermediate state, registration completion, deregistration initialization and final state; The events that trigger state transitions in the state set include: receiving a registration request, sending an authentication request, sending a registration rejection, sending an identification request, receiving an identification response, receiving an authentication response, receiving an authentication rejection, sending an SMC command request, receiving an SMC completion reply, receiving an SMC rejection, sending a registration acceptance, receiving a registration completion, receiving a deregistration request, and sending a deregistration acceptance.

7. The method for detecting security vulnerabilities in a 5G core network according to claim 1, characterized in that: The generation of the test case also includes: generating the test case based on the corresponding NAS protocol message version to ensure that the test case covers the protocol version and message type of the NAS protocol message.

8. The method for detecting security vulnerabilities in a 5G core network according to claim 1, characterized in that: The core network obtains the result of the analysis process, and monitors whether the core network has the first type of vulnerability or the second type of vulnerability according to the result of the analysis process, including: The core network obtains log information when processing the test case or the test case sequence, and uses the log information as the result of the parsing process; The log information is used to determine whether the core network has the first type of vulnerability or the second type of vulnerability.

9. The method for detecting security vulnerabilities in a 5G core network according to any one of claims 1 to 8, characterized in that: The security vulnerability detection method for the 5G core network also includes: After detecting the existence of the first type of vulnerability or the second type of vulnerability in the core network, a report containing the first type of vulnerability or the second type of vulnerability is generated and sent to a preset security management system for further vulnerability analysis and repair.

Images